gnu: libssh2: Fix CVE-2019-17498.

[jackhill/guix/guix.git] / gnu / packages / ssh.scm

diff --git a/gnu/packages/ssh.scm b/gnu/packages/ssh.scm
index b662013..0f2434d 100644 (file)
--- a/gnu/packages/ssh.scm
+++ b/gnu/packages/ssh.scm
@@ -2,7 +2,7 @@
 ;;; Copyright © 2012, 2013, 2014, 2015, 2016, 2017, 2018, 2019, 2020 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2013, 2014 Andreas Enge <andreas@enge.fr>
 ;;; Copyright © 2014, 2015, 2016 Mark H Weaver <mhw@netris.org>
-;;; Copyright © 2015, 2016, 2018, 2019 Efraim Flashner <efraim@flashner.co.il>
+;;; Copyright © 2015, 2016, 2018, 2019, 2020 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2016, 2019 Leo Famulari <leo@famulari.name>
 ;;; Copyright © 2016 Nicolas Goaziou <mail@nicolasgoaziou.fr>
 ;;; Copyright © 2016 Christopher Allan Webber <cwebber@dustycloud.org>
@@ -165,7 +165,8 @@ applications.")
                    version ".tar.gz"))
             (sha256
              (base32
-              "1zfsz9nldakfz61d2j70pk29zlmj7w2vv46s9l3x2prhcgaqpyym"))))
+              "1zfsz9nldakfz61d2j70pk29zlmj7w2vv46s9l3x2prhcgaqpyym"))
+            (patches (search-patches "libssh2-CVE-2019-17498.patch"))))
    (build-system gnu-build-system)
    ;; The installed libssh2.pc file does not include paths to libgcrypt and
    ;; zlib libraries, so we need to propagate the inputs.
@@ -189,7 +190,8 @@ a server that supports the SSH-2 protocol.")
              (method url-fetch)
              (uri (string-append "mirror://openbsd/OpenSSH/portable/"
                                  "openssh-" version ".tar.gz"))
-             (patches (search-patches "openssh-hurd.patch"))
+             (patches (search-patches "openssh-hurd.patch"
+                                      "openssh-fix-ssh-copy-id.patch"))
              (sha256
               (base32
                "091b3pxdlj47scxx6kkf4agkx8c8sdacdxx8m1dw1cby80pd40as"))))
@@ -487,36 +489,6 @@ of user keystrokes.  It's a replacement for SSH that's more robust and
 responsive, especially over Wi-Fi, cellular, and long-distance links.")
     (license license:gpl3+)))
 
-(define-public et
-  (package
-    (name "et")
-    (version "3.1.0")
-    (source
-     (origin
-       (method git-fetch)
-       (uri (git-reference
-             (url "https://github.com/MisterTea/EternalTCP")
-             (commit (string-append "et-v" version))))
-       (file-name (git-file-name name version))
-       (sha256
-        (base32 "1m5caxckn2ihwp9s2pbyh5amxlpwr7yc54q8s0kb10fr52w2vfnm"))))
-    (build-system cmake-build-system)
-    (arguments `(#:tests? #f))
-    (native-inputs
-     `(("pkg-config" ,pkg-config)))
-    (inputs `(("glog" ,glog)
-              ("gflags" ,gflags)
-              ("libsodium" ,libsodium)
-              ("protobuf" ,protobuf)))
-    (synopsis "Remote shell that automatically reconnects")
-    (description
-     "Eternal Terminal (ET) is a remote shell that automatically reconnects
-without interrupting the session.  Unlike SSH sessions, ET sessions will
-survive even network outages and IP changes.  ET uses a custom protocol over
-TCP, not the SSH protocol.")
-    (home-page "https://eternalterminal.dev/")
-    (license license:asl2.0)))
-
 (define-public dropbear
   (package
     (name "dropbear")
@@ -793,6 +765,45 @@ dynamically loadable modules for extended functionality such as new remote
 shell services and remote host selection.")
     (license license:gpl2+)))
 
+(define-public python-asyncssh
+  (package
+    (name "python-asyncssh")
+    (version "2.3.0")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (pypi-uri "asyncssh" version))
+       (sha256
+        (base32
+         "0pi6npmsgx7l9r1qrfvg8mxx3i23ipff492xz4yhrw13f56a7ga4"))))
+    (build-system python-build-system)
+    (propagated-inputs
+     `(("python-cryptography" ,python-cryptography)
+       ("python-pyopenssl" ,python-pyopenssl)
+       ("python-gssapi" ,python-gssapi)
+       ("python-bcrypt" ,python-bcrypt)))
+    (native-inputs
+     `(("openssh" ,openssh)
+       ("openssl" ,openssl)))
+    (arguments
+     `(#:phases
+       (modify-phases %standard-phases
+         (add-after 'unpack 'disable-tests
+           (lambda* _
+             (substitute* "tests/test_agent.py"
+               ;; TODO Test fails for unknown reason
+               (("(.+)async def test_confirm" all indent)
+                (string-append indent "@unittest.skip('disabled by guix')\n"
+                               indent "async def test_confirm")))
+             #t)))))
+    (home-page "https://asyncssh.readthedocs.io/")
+    (synopsis "Asynchronous SSHv2 client and server library for Python")
+    (description
+     "AsyncSSH is a Python package which provides an asynchronous client and
+server implementation of the SSHv2 protocol on top of the Python 3.6+ asyncio
+framework.")
+    (license license:epl2.0)))
+
 (define-public clustershell
   (package
     (name "clustershell")
@@ -868,7 +879,7 @@ clients at a time.")
 (define-public webssh
   (package
     (name "webssh")
-    (version "1.5.2")
+    (version "1.5.3")
     (source (origin
               (method git-fetch)
               (uri (git-reference
@@ -877,7 +888,7 @@ clients at a time.")
               (file-name (git-file-name name version))
               (sha256
                (base32
-                "1l4bwzaifsd6pl120d400qkhvaznj2ck1lvwg76ycb08jsk6gpaz"))))
+                "1bcy9flrzbvams5p77swwiygv54ac58ia7hpic1bvg30b3wpvv7b"))))
     (build-system python-build-system)
     (propagated-inputs
      `(("python-paramiko" ,python-paramiko)