Re: [OE-core] [PATCH] packagegroup-core-ssh-dropbear: Add openssh-sftp-server

[Richard Purdie <richard.purdie@linuxfoundation.org>]

On Thu, 2022-06-30 at 07:13 -1000, Steve Sakoman wrote:
> On Mon, Jun 27, 2022 at 9:14 AM Richard Purdie
> <richard.purdie@linuxfoundation.org> wrote:
> > 
> > On Fri, 2022-06-24 at 14:45 +0100, Richard Purdie via
> > lists.openembedded.org wrote:
> > > Seems sad to have to do this but openssh is moving to use sftp instead
> > > of scp to move files. This means scp from Fedora 36 will no longer be
> > > able to move files to/from a dropbear based image. This breaks a number
> > > of our key QA tests and I suspect will cause users pain too.
> > > 
> > > The sftp server from openssh is small and standalone so adding it to
> > > the packagegroup seems to be the best way to preserve user sanity. If
> > > people really don't want it, they can just use dropbear instead of the
> > > packageground.
> > > 
> > > Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
> > > ---
> > >  .../packagegroups/packagegroup-core-ssh-dropbear.bb             | 2 +-
> > >  1 file changed, 1 insertion(+), 1 deletion(-)
> > > 
> > > diff --git a/meta/recipes-core/packagegroups/packagegroup-core-ssh-dropbear.bb b/meta/recipes-core/packagegroups/packagegroup-core-ssh-dropbear.bb
> > > index 4f844ad9255..b969ab7ca01 100644
> > > --- a/meta/recipes-core/packagegroups/packagegroup-core-ssh-dropbear.bb
> > > +++ b/meta/recipes-core/packagegroups/packagegroup-core-ssh-dropbear.bb
> > > @@ -3,4 +3,4 @@ PR = "r1"
> > > 
> > >  inherit packagegroup
> > > 
> > > -RDEPENDS:${PN} = "dropbear"
> > > +RDEPENDS:${PN} = "dropbear openssh-sftp-server"
> > 
> > 
> > If we want kirkstone or dunfell to work on Fedora 36 we're going to
> > need this. Unfortunately it will break images with -dev packages in
> > them.
> > 
> > The fixes for master for that are not appropriate for
> > kirkstone/dunfell, they're quite invasive for master.
> > 
> > As such you may need to disable the -dev package dependencies for
> > dropbear/openssh, something like:
> > 
> > RDEPENDS:openssh-dev[nodeprrecs] = "1"
> > RDEPENDS:dropbear-dev[nodeprrecs] = "1"
> > 
> > in the appropriate places. I mention this now whilst I remember the
> > context!
> 
> Any hints as to the "appropriate places"? ;-)
> 
> I assumed you meant the openssh and dropbear recipes:
> 
> diff --git a/meta/recipes-connectivity/openssh/openssh_8.9p1.bb
> b/meta/recipes-connectivity/openssh/openssh_8.9p1.bb
> index f306b1245a..2178c4868f 100644
> --- a/meta/recipes-connectivity/openssh/openssh_8.9p1.bb
> +++ b/meta/recipes-connectivity/openssh/openssh_8.9p1.bb
> @@ -162,6 +162,8 @@ FILES:${PN}-keygen = "${bindir}/ssh-keygen"
> 
>  RDEPENDS:${PN} += "${PN}-scp ${PN}-ssh ${PN}-sshd ${PN}-keygen"
>  RDEPENDS:${PN}-sshd += "${PN}-keygen
> ${@bb.utils.contains('DISTRO_FEATURES', 'pam', 'pam-plugin-keyinit
> pam-plugin-loginuid', '', d)}"
> +RDEPENDS:openssh-dev[nodeprrecs] = "1"
> +
>  RRECOMMENDS:${PN}-sshd:append:class-target = "\
>      ${@bb.utils.filter('PACKAGECONFIG', 'rng-tools', d)} \
>  "
> diff --git a/meta/recipes-core/dropbear/dropbear.inc
> b/meta/recipes-core/dropbear/dropbear.inc
> index 78f9f9adbd..a93d247caa 100644
> --- a/meta/recipes-core/dropbear/dropbear.inc
> +++ b/meta/recipes-core/dropbear/dropbear.inc
> @@ -9,6 +9,7 @@ LICENSE = "MIT & BSD-3-Clause & BSD-2-Clause & PD"
>  LIC_FILES_CHKSUM = "file://LICENSE;md5=25cf44512b7bc8966a48b6b1a9b7605f"
> 
>  DEPENDS = "zlib virtual/crypt"
> +RDEPENDS:dropbear-dev[nodeprrecs] = "1"
>  RPROVIDES:${PN} = "ssh sshd"
>  RCONFLICTS:${PN} = "openssh-sshd openssh"
> 
> 
> but I still get failures on do_populate_sdk:
> 
> Error:
>  Problem: package dropbear-dev-2020.81-r0.core2_64 requires dropbear =
> 2020.81-r0, but none of the providers can be installed
>   - package dropbear-2020.81-r0.core2_64 conflicts with openssh
> provided by openssh-8.9p1-r0.core2_64
>   - package openssh-8.9p1-r0.core2_64 conflicts with dropbear provided
> by dropbear-2020.81-r0.core2_64
>   - package openssh-dev-8.9p1-r0.core2_64 requires openssh = 8.9p1-r0,
> but none of the providers can be installed
>   - conflicting requests

I'm confused between the different branches. I think you'll need:

RDEPENDS_${PN}-dev = ""

in both those recipes to break the main dependency. Whether you nee the
RRECOMMENDS chain breaking I'm less sure but for dunfell it would be:

RRECOMMENDS_dropbear-dev[nodeprrecs] = "1"

Cheers,

Richard