Re: [OE-core] [PATCH] packagegroup-core-ssh-dropbear: Add openssh-sftp-server

Re: [OE-core] [PATCH] packagegroup-core-ssh-dropbear: Add openssh-sftp-server

[Richard Purdie]

On Fri, 2022-06-24 at 14:45 +0100, Richard Purdie via
lists.openembedded.org wrote:
> Seems sad to have to do this but openssh is moving to use sftp instead
> of scp to move files. This means scp from Fedora 36 will no longer be
> able to move files to/from a dropbear based image. This breaks a number
> of our key QA tests and I suspect will cause users pain too.
> 
> The sftp server from openssh is small and standalone so adding it to
> the packagegroup seems to be the best way to preserve user sanity. If
> people really don't want it, they can just use dropbear instead of the
> packageground.
> 
> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
> ---
>  .../packagegroups/packagegroup-core-ssh-dropbear.bb             | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/meta/recipes-core/packagegroups/packagegroup-core-ssh-dropbear.bb b/meta/recipes-core/packagegroups/packagegroup-core-ssh-dropbear.bb
> index 4f844ad9255..b969ab7ca01 100644
> --- a/meta/recipes-core/packagegroups/packagegroup-core-ssh-dropbear.bb
> +++ b/meta/recipes-core/packagegroups/packagegroup-core-ssh-dropbear.bb
> @@ -3,4 +3,4 @@ PR = "r1"
>  
>  inherit packagegroup
>  
> -RDEPENDS:${PN} = "dropbear"
> +RDEPENDS:${PN} = "dropbear openssh-sftp-server"


If we want kirkstone or dunfell to work on Fedora 36 we're going to
need this. Unfortunately it will break images with -dev packages in
them.

The fixes for master for that are not appropriate for
kirkstone/dunfell, they're quite invasive for master.

As such you may need to disable the -dev package dependencies for
dropbear/openssh, something like:

RDEPENDS:openssh-dev[nodeprrecs] = "1"
RDEPENDS:dropbear-dev[nodeprrecs] = "1"

in the appropriate places. I mention this now whilst I remember the
context!

Cheers,

Richard

Re: [OE-core] [PATCH] packagegroup-core-ssh-dropbear: Add openssh-sftp-server

[Steve Sakoman]

On Mon, Jun 27, 2022 at 9:14 AM Richard Purdie
<richard.purdie@linuxfoundation.org> wrote:
>
> On Fri, 2022-06-24 at 14:45 +0100, Richard Purdie via
> lists.openembedded.org wrote:
> > Seems sad to have to do this but openssh is moving to use sftp instead
> > of scp to move files. This means scp from Fedora 36 will no longer be
> > able to move files to/from a dropbear based image. This breaks a number
> > of our key QA tests and I suspect will cause users pain too.
> >
> > The sftp server from openssh is small and standalone so adding it to
> > the packagegroup seems to be the best way to preserve user sanity. If
> > people really don't want it, they can just use dropbear instead of the
> > packageground.
> >
> > Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
> > ---
> >  .../packagegroups/packagegroup-core-ssh-dropbear.bb             | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/meta/recipes-core/packagegroups/packagegroup-core-ssh-dropbear.bb b/meta/recipes-core/packagegroups/packagegroup-core-ssh-dropbear.bb
> > index 4f844ad9255..b969ab7ca01 100644
> > --- a/meta/recipes-core/packagegroups/packagegroup-core-ssh-dropbear.bb
> > +++ b/meta/recipes-core/packagegroups/packagegroup-core-ssh-dropbear.bb
> > @@ -3,4 +3,4 @@ PR = "r1"
> >
> >  inherit packagegroup
> >
> > -RDEPENDS:${PN} = "dropbear"
> > +RDEPENDS:${PN} = "dropbear openssh-sftp-server"
>
>
> If we want kirkstone or dunfell to work on Fedora 36 we're going to
> need this. Unfortunately it will break images with -dev packages in
> them.
>
> The fixes for master for that are not appropriate for
> kirkstone/dunfell, they're quite invasive for master.
>
> As such you may need to disable the -dev package dependencies for
> dropbear/openssh, something like:
>
> RDEPENDS:openssh-dev[nodeprrecs] = "1"
> RDEPENDS:dropbear-dev[nodeprrecs] = "1"
>
> in the appropriate places. I mention this now whilst I remember the
> context!

Any hints as to the "appropriate places"? ;-)

I assumed you meant the openssh and dropbear recipes:

diff --git a/meta/recipes-connectivity/openssh/openssh_8.9p1.bb
b/meta/recipes-connectivity/openssh/openssh_8.9p1.bb
index f306b1245a..2178c4868f 100644
--- a/meta/recipes-connectivity/openssh/openssh_8.9p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_8.9p1.bb
@@ -162,6 +162,8 @@ FILES:${PN}-keygen = "${bindir}/ssh-keygen"

 RDEPENDS:${PN} += "${PN}-scp ${PN}-ssh ${PN}-sshd ${PN}-keygen"
 RDEPENDS:${PN}-sshd += "${PN}-keygen
${@bb.utils.contains('DISTRO_FEATURES', 'pam', 'pam-plugin-keyinit
pam-plugin-loginuid', '', d)}"
+RDEPENDS:openssh-dev[nodeprrecs] = "1"
+
 RRECOMMENDS:${PN}-sshd:append:class-target = "\
     ${@bb.utils.filter('PACKAGECONFIG', 'rng-tools', d)} \
 "
diff --git a/meta/recipes-core/dropbear/dropbear.inc
b/meta/recipes-core/dropbear/dropbear.inc
index 78f9f9adbd..a93d247caa 100644
--- a/meta/recipes-core/dropbear/dropbear.inc
+++ b/meta/recipes-core/dropbear/dropbear.inc
@@ -9,6 +9,7 @@ LICENSE = "MIT & BSD-3-Clause & BSD-2-Clause & PD"
 LIC_FILES_CHKSUM = "file://LICENSE;md5=25cf44512b7bc8966a48b6b1a9b7605f"

 DEPENDS = "zlib virtual/crypt"
+RDEPENDS:dropbear-dev[nodeprrecs] = "1"
 RPROVIDES:${PN} = "ssh sshd"
 RCONFLICTS:${PN} = "openssh-sshd openssh"


but I still get failures on do_populate_sdk:

Error:
 Problem: package dropbear-dev-2020.81-r0.core2_64 requires dropbear =
2020.81-r0, but none of the providers can be installed
  - package dropbear-2020.81-r0.core2_64 conflicts with openssh
provided by openssh-8.9p1-r0.core2_64
  - package openssh-8.9p1-r0.core2_64 conflicts with dropbear provided
by dropbear-2020.81-r0.core2_64
  - package openssh-dev-8.9p1-r0.core2_64 requires openssh = 8.9p1-r0,
but none of the providers can be installed
  - conflicting requests

Steve

Re: [OE-core] [PATCH] packagegroup-core-ssh-dropbear: Add openssh-sftp-server

[Richard Purdie]

On Thu, 2022-06-30 at 07:13 -1000, Steve Sakoman wrote:
> On Mon, Jun 27, 2022 at 9:14 AM Richard Purdie
> <richard.purdie@linuxfoundation.org> wrote:
> > 
> > On Fri, 2022-06-24 at 14:45 +0100, Richard Purdie via
> > lists.openembedded.org wrote:
> > > Seems sad to have to do this but openssh is moving to use sftp instead
> > > of scp to move files. This means scp from Fedora 36 will no longer be
> > > able to move files to/from a dropbear based image. This breaks a number
> > > of our key QA tests and I suspect will cause users pain too.
> > > 
> > > The sftp server from openssh is small and standalone so adding it to
> > > the packagegroup seems to be the best way to preserve user sanity. If
> > > people really don't want it, they can just use dropbear instead of the
> > > packageground.
> > > 
> > > Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
> > > ---
> > >  .../packagegroups/packagegroup-core-ssh-dropbear.bb             | 2 +-
> > >  1 file changed, 1 insertion(+), 1 deletion(-)
> > > 
> > > diff --git a/meta/recipes-core/packagegroups/packagegroup-core-ssh-dropbear.bb b/meta/recipes-core/packagegroups/packagegroup-core-ssh-dropbear.bb
> > > index 4f844ad9255..b969ab7ca01 100644
> > > --- a/meta/recipes-core/packagegroups/packagegroup-core-ssh-dropbear.bb
> > > +++ b/meta/recipes-core/packagegroups/packagegroup-core-ssh-dropbear.bb
> > > @@ -3,4 +3,4 @@ PR = "r1"
> > > 
> > >  inherit packagegroup
> > > 
> > > -RDEPENDS:${PN} = "dropbear"
> > > +RDEPENDS:${PN} = "dropbear openssh-sftp-server"
> > 
> > 
> > If we want kirkstone or dunfell to work on Fedora 36 we're going to
> > need this. Unfortunately it will break images with -dev packages in
> > them.
> > 
> > The fixes for master for that are not appropriate for
> > kirkstone/dunfell, they're quite invasive for master.
> > 
> > As such you may need to disable the -dev package dependencies for
> > dropbear/openssh, something like:
> > 
> > RDEPENDS:openssh-dev[nodeprrecs] = "1"
> > RDEPENDS:dropbear-dev[nodeprrecs] = "1"
> > 
> > in the appropriate places. I mention this now whilst I remember the
> > context!
> 
> Any hints as to the "appropriate places"? ;-)
> 
> I assumed you meant the openssh and dropbear recipes:
> 
> diff --git a/meta/recipes-connectivity/openssh/openssh_8.9p1.bb
> b/meta/recipes-connectivity/openssh/openssh_8.9p1.bb
> index f306b1245a..2178c4868f 100644
> --- a/meta/recipes-connectivity/openssh/openssh_8.9p1.bb
> +++ b/meta/recipes-connectivity/openssh/openssh_8.9p1.bb
> @@ -162,6 +162,8 @@ FILES:${PN}-keygen = "${bindir}/ssh-keygen"
> 
>  RDEPENDS:${PN} += "${PN}-scp ${PN}-ssh ${PN}-sshd ${PN}-keygen"
>  RDEPENDS:${PN}-sshd += "${PN}-keygen
> ${@bb.utils.contains('DISTRO_FEATURES', 'pam', 'pam-plugin-keyinit
> pam-plugin-loginuid', '', d)}"
> +RDEPENDS:openssh-dev[nodeprrecs] = "1"
> +
>  RRECOMMENDS:${PN}-sshd:append:class-target = "\
>      ${@bb.utils.filter('PACKAGECONFIG', 'rng-tools', d)} \
>  "
> diff --git a/meta/recipes-core/dropbear/dropbear.inc
> b/meta/recipes-core/dropbear/dropbear.inc
> index 78f9f9adbd..a93d247caa 100644
> --- a/meta/recipes-core/dropbear/dropbear.inc
> +++ b/meta/recipes-core/dropbear/dropbear.inc
> @@ -9,6 +9,7 @@ LICENSE = "MIT & BSD-3-Clause & BSD-2-Clause & PD"
>  LIC_FILES_CHKSUM = "file://LICENSE;md5=25cf44512b7bc8966a48b6b1a9b7605f"
> 
>  DEPENDS = "zlib virtual/crypt"
> +RDEPENDS:dropbear-dev[nodeprrecs] = "1"
>  RPROVIDES:${PN} = "ssh sshd"
>  RCONFLICTS:${PN} = "openssh-sshd openssh"
> 
> 
> but I still get failures on do_populate_sdk:
> 
> Error:
>  Problem: package dropbear-dev-2020.81-r0.core2_64 requires dropbear =
> 2020.81-r0, but none of the providers can be installed
>   - package dropbear-2020.81-r0.core2_64 conflicts with openssh
> provided by openssh-8.9p1-r0.core2_64
>   - package openssh-8.9p1-r0.core2_64 conflicts with dropbear provided
> by dropbear-2020.81-r0.core2_64
>   - package openssh-dev-8.9p1-r0.core2_64 requires openssh = 8.9p1-r0,
> but none of the providers can be installed
>   - conflicting requests

I'm confused between the different branches. I think you'll need:

RDEPENDS_${PN}-dev = ""

in both those recipes to break the main dependency. Whether you nee the
RRECOMMENDS chain breaking I'm less sure but for dunfell it would be:

RRECOMMENDS_dropbear-dev[nodeprrecs] = "1"

Cheers,

Richard

Re: [OE-core] [PATCH] packagegroup-core-ssh-dropbear: Add openssh-sftp-server

[Steve Sakoman]

On Thu, Jun 30, 2022 at 9:36 AM Richard Purdie
<richard.purdie@linuxfoundation.org> wrote:
>
> On Thu, 2022-06-30 at 07:13 -1000, Steve Sakoman wrote:
> > On Mon, Jun 27, 2022 at 9:14 AM Richard Purdie
> > <richard.purdie@linuxfoundation.org> wrote:
> > >
> > > On Fri, 2022-06-24 at 14:45 +0100, Richard Purdie via
> > > lists.openembedded.org wrote:
> > > > Seems sad to have to do this but openssh is moving to use sftp instead
> > > > of scp to move files. This means scp from Fedora 36 will no longer be
> > > > able to move files to/from a dropbear based image. This breaks a number
> > > > of our key QA tests and I suspect will cause users pain too.
> > > >
> > > > The sftp server from openssh is small and standalone so adding it to
> > > > the packagegroup seems to be the best way to preserve user sanity. If
> > > > people really don't want it, they can just use dropbear instead of the
> > > > packageground.
> > > >
> > > > Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
> > > > ---
> > > >  .../packagegroups/packagegroup-core-ssh-dropbear.bb             | 2 +-
> > > >  1 file changed, 1 insertion(+), 1 deletion(-)
> > > >
> > > > diff --git a/meta/recipes-core/packagegroups/packagegroup-core-ssh-dropbear.bb b/meta/recipes-core/packagegroups/packagegroup-core-ssh-dropbear.bb
> > > > index 4f844ad9255..b969ab7ca01 100644
> > > > --- a/meta/recipes-core/packagegroups/packagegroup-core-ssh-dropbear.bb
> > > > +++ b/meta/recipes-core/packagegroups/packagegroup-core-ssh-dropbear.bb
> > > > @@ -3,4 +3,4 @@ PR = "r1"
> > > >
> > > >  inherit packagegroup
> > > >
> > > > -RDEPENDS:${PN} = "dropbear"
> > > > +RDEPENDS:${PN} = "dropbear openssh-sftp-server"
> > >
> > >
> > > If we want kirkstone or dunfell to work on Fedora 36 we're going to
> > > need this. Unfortunately it will break images with -dev packages in
> > > them.
> > >
> > > The fixes for master for that are not appropriate for
> > > kirkstone/dunfell, they're quite invasive for master.
> > >
> > > As such you may need to disable the -dev package dependencies for
> > > dropbear/openssh, something like:
> > >
> > > RDEPENDS:openssh-dev[nodeprrecs] = "1"
> > > RDEPENDS:dropbear-dev[nodeprrecs] = "1"
> > >
> > > in the appropriate places. I mention this now whilst I remember the
> > > context!
> >
> > Any hints as to the "appropriate places"? ;-)
> >
> > I assumed you meant the openssh and dropbear recipes:
> >
> > diff --git a/meta/recipes-connectivity/openssh/openssh_8.9p1.bb
> > b/meta/recipes-connectivity/openssh/openssh_8.9p1.bb
> > index f306b1245a..2178c4868f 100644
> > --- a/meta/recipes-connectivity/openssh/openssh_8.9p1.bb
> > +++ b/meta/recipes-connectivity/openssh/openssh_8.9p1.bb
> > @@ -162,6 +162,8 @@ FILES:${PN}-keygen = "${bindir}/ssh-keygen"
> >
> >  RDEPENDS:${PN} += "${PN}-scp ${PN}-ssh ${PN}-sshd ${PN}-keygen"
> >  RDEPENDS:${PN}-sshd += "${PN}-keygen
> > ${@bb.utils.contains('DISTRO_FEATURES', 'pam', 'pam-plugin-keyinit
> > pam-plugin-loginuid', '', d)}"
> > +RDEPENDS:openssh-dev[nodeprrecs] = "1"
> > +
> >  RRECOMMENDS:${PN}-sshd:append:class-target = "\
> >      ${@bb.utils.filter('PACKAGECONFIG', 'rng-tools', d)} \
> >  "
> > diff --git a/meta/recipes-core/dropbear/dropbear.inc
> > b/meta/recipes-core/dropbear/dropbear.inc
> > index 78f9f9adbd..a93d247caa 100644
> > --- a/meta/recipes-core/dropbear/dropbear.inc
> > +++ b/meta/recipes-core/dropbear/dropbear.inc
> > @@ -9,6 +9,7 @@ LICENSE = "MIT & BSD-3-Clause & BSD-2-Clause & PD"
> >  LIC_FILES_CHKSUM = "file://LICENSE;md5=25cf44512b7bc8966a48b6b1a9b7605f"
> >
> >  DEPENDS = "zlib virtual/crypt"
> > +RDEPENDS:dropbear-dev[nodeprrecs] = "1"
> >  RPROVIDES:${PN} = "ssh sshd"
> >  RCONFLICTS:${PN} = "openssh-sshd openssh"
> >
> >
> > but I still get failures on do_populate_sdk:
> >
> > Error:
> >  Problem: package dropbear-dev-2020.81-r0.core2_64 requires dropbear =
> > 2020.81-r0, but none of the providers can be installed
> >   - package dropbear-2020.81-r0.core2_64 conflicts with openssh
> > provided by openssh-8.9p1-r0.core2_64
> >   - package openssh-8.9p1-r0.core2_64 conflicts with dropbear provided
> > by dropbear-2020.81-r0.core2_64
> >   - package openssh-dev-8.9p1-r0.core2_64 requires openssh = 8.9p1-r0,
> > but none of the providers can be installed
> >   - conflicting requests
>
> I'm confused between the different branches. I think you'll need:
>
> RDEPENDS_${PN}-dev = ""
>
> in both those recipes to break the main dependency. Whether you nee the
> RRECOMMENDS chain breaking I'm less sure but for dunfell it would be:
>
> RRECOMMENDS_dropbear-dev[nodeprrecs] = "1"

I'm working on kirkstone first.  Thanks for the advice!

Steve