I just realized that gssapi patchset does not apply and we need to wait until the package is updated the debian (where we fetch the gssapi patch from).

Or just disable the gssapi patchset. I don't think that should be a blocker for updating ssh.

I added another change in 464890f which keeps version 8.1p1 for openssh_gssapi. I kept openssh_hpn for now, because it was fixed by version update in 025217a.

If there is a reason to drop the hpnSupport completely because no one uses it, I can amend my
changes, but it seems it's not really required as it builds for now and the upstream seems active too.

@GrahamcOfBorg eval

tested with fido2 and a titan security key, works like a charm 👍

Can anyone help with the eval failure? I don't see what's wrong here ...

@prusnak can you please try to rebase on master?

It looks like libfido2 needs IOKit if you haven't fixed it yet

Eval problems solved by disabling libfido2 feature for Darwin. This was caused because the libfido2 package does not build for Darwin at the moment (simply adding IOKit to libfido2 darwin package did not do the trick). That's why I limited libfido2 feature only to Linux.

Debian team meanwhile updated the gssapi patch for 8.2p1 so I also bumped openssh_gssapi to this version.

All is set for review. Also, we definitively want this in 20.03 as well.

This PR does need to add back a withFido2 option, which I think was in an earlier commit. I can't find it, but it should be in @prusnak's reflog. The option should probably default to stdenv.isUnix

I reintroduced the withFIDO option like suggested above by @artemist. However, there was no stdenv.isUnix attribute on my NixOS Linux system, so I used stdenv.hostPlatform.isUnix instead. Is that correct?

@GrahamcOfBorg test openssh

Given we need openssh 8.2 on the server side as well for these new features to work. I would like to propose to backport this into release-20.03.

@mmahut should we just create a PR to 20.03 branch or what exactly is the process for proposing a backport?

We discussed the possibility of backporting openssh 8.2p1 in #nixos-dev

• https://logs.nix.samueldr.com/nixos-dev/2020-02-27#3113587;

my feelings were well expressed in this comment https://logs.nix.samueldr.com/nixos-dev/2020-02-27#3113665;

A question that was raised that would make the determination easier if answered was "how long will 8.1 get security updates?".

@worldofpeace I'll ask among the OpenSSH folks what's their security update strategy is.

@worldofpeace answer from Damien Miller of OpenSSH: "We don't do backported security fixes - we're a tiny team and so only maintain the current release."

@worldofpeace answer from Damien Miller of OpenSSH: "We don't do backported security fixes - we're a tiny team and so only maintain the current release."

I guess this makes the decision easy 😄

@prusnak Let's do it.

@worldofpeace Shall I prepare a PR? To which branch?

@worldofpeace Shall I prepare a PR? To which branch?

release-20.03

Backport to 20.03 in #81368