Re: OpenSSH upgrade problem (8.0 => 8.4)

[John David Anglin <dave.anglin@bell.net>]

Hi Frank,

Should be fixed.  I upload a new build of libfido2.

There's a bug in the check for -fstack-protector-all:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=996428

Dave

On 2021-10-13 4:33 p.m., Frank Scheiner wrote:
> Dear all,
>
> just upgraded one of my rp3440s (last login was sometime in 2019) and
> stumbled across an issue with upgrading openssh-* to 8.4 from 8.0 (8.0p1-3).
>
> More recent OpenSSH versions in Debian seem to depend on "libfido2-1",
> which itself depends on "libcbor[...]". Now the problem is, that there
> is no "libcbor0" (anymore?) in the archive for hppa, there's only a
> "libcbor0.8", but that does not suffice the "libcbor[...]" dependency of
> "libfido2-1". Strangely the buildinfo file of "libfido2-1" ([1]) states
> it could install a "libcbor0" for hppa:
>
> ```
> [...]
> Installed-Build-Depends:
> [...]
>  libcbor-dev (= 0.5.0+dfsg-2),
>  libcbor0 (= 0.5.0+dfsg-2),
> [...]
> ```
>
> [1]:
> http://ftp.ports.debian.org/debian-ports/pool-hppa/main/libf/libfido2/libfido2_1.6.0-2_hppa.buildinfo
>
> According to [2] "libfido2-1" depends on "libcbor0" for "alpha, hppa,
> ia64, sparc64" and on "libcbor0.8" for every other arch (i.e. "not
> alpha, hppa, ia64, sparc64").
>
> [2]: https://packages.debian.org/sid/libfido2-1
>
> I could solve the issue by installing this "libcbor0" ([3]) from 2018
> from snapshots.debian.org and then upgrading the OpenSSH packages.
>
> [3]:
> http://snapshot.debian.org/archive/debian-ports/20180517T201824Z/pool-hppa/main/libc/libcbor/libcbor0_0.5.0%2Bdfsg-2_hppa.deb
>
> For reference I have:
>
> ```
> deb http://ftp.ports.debian.org/debian-ports unstable main
> deb http://ftp.ports.debian.org/debian-ports unreleased main
> deb http://ftp.ports.debian.org/debian-ports experimental main
> ```
>
> ...in my `/etc/apt/sources.list`.
>
> Cheers,
> Frank


--
John David Anglin  dave.anglin@bell.net