diff --git a/AGENTS.md b/AGENTS.md index 94a3322..4098c9e 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -17,7 +17,7 @@ Shell scripts to backport and build OpenSSH RPMs for CentOS/RHEL-like distros (E ./compile.sh el7 # Docker-based build (see docker/README.md for per-version commands) -docker build -t elssh:el8 -f ./docker/Dockerfile.centos --build-arg VERSION_NUM=8 --build-arg MIRROR=0 . +docker build -t elssh:el8 -f ./docker/Dockerfile.centos-stream --build-arg VERSION_NUM=8 . docker run --rm -v .:/data elssh:el8 ``` @@ -29,10 +29,10 @@ docker run --rm -v .:/data elssh:el8 ## Key variables -- `WITH_OPENSSL`: `0` = no OpenSSL (no ssh-rsa keys), `1` = system OpenSSL, `2` = static OpenSSL (default for EL5/6/7, EL8 defaults to `1`) +- `WITH_OPENSSL`: `0` = no OpenSSL (no ssh-rsa keys), `1` = system OpenSSL, `2` = static OpenSSL. Only the `el7` spec dir (covering EL7/8/9) auto-detects in `compile.sh` TOPDIR_SELECT: system OpenSSL >= 3 -> `1`, else `2`. EL5/EL6 leave it unset and rpmbuild falls back to `2` via `${WITH_OPENSSL:-2}`. Note `docker/docker_compile.sh` has its own overlapping auto-detect (checks openssl-devel presence + version), so behavior inside Docker may differ from a direct `./compile.sh` run. - `PKGREL`: package release number (defaults to `1`) - `M32=1`: build 32-bit RPMs (EL5 only) -- `DOCKERBUILD=1`: when set, `pullsrc.sh` skips downloading (assumes Docker image has the sources) +- `DOCKERBUILD=1`: when set, `pullsrc.sh` skips the openssh/openssl/askpass downloads but still fetches PERLSRC - `UOS20=1`: build the UOS 20 variant — enables the kernel-panic patch (`openssh-uos20-kernel-panic-fix.patch`) and prefixes `PKGREL` with `uos20.` so resulting RPMs are distinguishable. ## Architecture notes diff --git a/README.md b/README.md index 096c551..d2b5cbb 100644 --- a/README.md +++ b/README.md @@ -6,7 +6,7 @@ Similar Project: [Backport OpenSSH for Debian / Ubuntu distros](https://github.c ## Supported (tested) Distro: -| Distro | Version | Arch | Recommanded EL RPMs | +| Distro | Version | Arch | Recommended EL RPMs | |----------------|----------------|---------------------|----------------------------------------------------------------------| | CentOS | 5 | x86_64 / i686 | EL 5 (`rpm-el5-x86_64`, `rpm-el5-i686`) | | CentOS | 6 | x86_64 | EL 6 (`rpm-el6-x86_64`) | @@ -16,6 +16,11 @@ Similar Project: [Backport OpenSSH for Debian / Ubuntu distros](https://github.c | CentOS Stream | 9 | x86_64 / aarch64 | EL 9 (`rpm-el9-x86_64`, `rpm-el9-aarch64`) | | Rocky Linux | 8 | x86_64 / aarch64 | EL 8 (`rpm-el8-x86_64`, `rpm-el8-aarch64`) | | Rocky Linux | 9 | x86_64 / aarch64 | EL 9 (`rpm-el9-x86_64`, `rpm-el9-aarch64`) | +| AlmaLinux | 8 | x86_64 / aarch64 | EL 8 (`rpm-el8-x86_64`, `rpm-el8-aarch64`) | +| AlmaLinux | 9 | x86_64 / aarch64 | EL 9 (`rpm-el9-x86_64`, `rpm-el9-aarch64`) | +| Oracle Linux | 7 | x86_64 / aarch64 | EL 7 (`rpm-el7-x86_64`, `rpm-el7-aarch64`) | +| Oracle Linux | 8 | x86_64 / aarch64 | EL 8 (`rpm-el8-x86_64`, `rpm-el8-aarch64`) | +| Oracle Linux | 9 | x86_64 / aarch64 | EL 9 (`rpm-el9-x86_64`, `rpm-el9-aarch64`) | | Amazon Linux | 1 | x86_64 | EL 6 (`rpm-el6-x86_64`) | | Amazon Linux | 2 | x86_64 / aarch64 | EL 7 (`rpm-el7-x86_64`, `rpm-el7-aarch64`) | | Amazon Linux | 2023 | x86_64 / aarch64 | EL 9 (`rpm-el9-x86_64`, `rpm-el9-aarch64`) | @@ -64,28 +69,31 @@ yum install -y systemd-devel yum install -y gcc44 ``` +`libXt-devel`, `libX11-devel` and `gtk2-devel` are only relevant to the EL6/EL7-era askpass subpackages — the EL8+ spec skips them (`compile.sh` passes `no_gtk2` / `skip_gnome_askpass` / `skip_x11_askpass = 1`) and the centos-stream Dockerfile doesn't install them. + ## Usage ### Download RPMs -You can download the needed RPMs from the GitHub Release using the GitHub -API. The script below auto-detects your architecture and EL version from -the running system, then fetches the matching asset from the latest -release. +Go to the [Releases page](https://github.com/boypt/openssh-rpms/releases) +and download the zip file that matches your system. No script or GitHub +API needed. + +Each release provides one zip per tag, named like: + +``` +openssh__.zip +``` + +e.g. `openssh_v10.5p1_b1_rpm-el8-x86_64.zip`. + +1. Find your distro in the "Supported (tested) Distro" table above, and + note the tag in the "Recommended EL RPMs" column (e.g. `rpm-el8-x86_64`). +2. Download the zip whose name ends with that tag. +3. Unzip it and install: ```bash -ARCH=$(uname -m) -# Read the system's own rpm dist tag (.el8 -> el8, .el7 -> el7, ...). -# Override for non-elN dists (e.g. UOS 20) or when auto-detect fails. -# If unsure which EL value to use, see the "Supported (tested) Distro" -# table at the top of this README. -EL=$(rpm --eval '%{?dist}' 2>/dev/null | grep -oE 'el[0-9]+' | head -1) -[[ -z "$EL" ]] && EL=el7 - -curl -s https://api.github.com/repos/boypt/openssh-rpms/releases/latest \ -| jq -r --arg el "$EL" --arg arch "$ARCH" \ - '.assets[] | select(.name | ascii_downcase | contains($el) and contains($arch)) | .browser_download_url' \ -| wget -i - --show-progress -c +unzip openssh_*_rpm-el8-x86_64.zip ``` ### Build RPMs @@ -115,22 +123,22 @@ ls output # Backup current SSH config [[ -f /etc/ssh/sshd_config ]] && mv /etc/ssh/sshd_config /etc/ssh/sshd_config.$(date +%Y%m%d) -# Install rpm packages. +# Install rpm packages (`dnf` works the same on EL8/EL9). sudo yum --disablerepo=* localinstall -y ./openssh*.rpm # Check Installed version: ssh -V && /usr/sbin/sshd -V # Restart service -sudo service sshd restart +sudo systemctl restart sshd # (`service sshd restart` also works) # Test a new ssh connection ssh localhost ``` -**DO NOT DISCONNECET** current ssh shell yet, open a **NEW** shell and login to you machine to verify that sshd is working properly. +**DO NOT DISCONNECT** current ssh shell yet, open a **NEW** shell and login to you machine to verify that sshd is working properly. -#### Trouble shooting +#### Troubleshooting You may get complains during the `yum localinstall` process. It's mostly because some subpackages depend on the main openssh package, upgrading only the main package won't fit in their dependencies. @@ -146,6 +154,44 @@ If still not satisfied, you may try the final weapon: FORCED INSTALL. rpm -ivh --force --nodeps --replacepkgs --replacefiles openssh-*.rpm ``` +### Rollback to distro stock OpenSSH + +If the custom build doesn't work for you, remove it and reinstall the +version shipped by your distro. Keep your current SSH session open until +the rollback is verified. + +```bash +# 1. Remove the custom-built packages +sudo rpm -e openssh openssh-clients openssh-server +# If it complains about dependencies, erase the subpackages too +# (same list as in Troubleshooting above), or add --nodeps. + +# 2. Reinstall the distro's own packages from its repos +# (re-enable the repos if you disabled them during install) +sudo yum install -y openssh openssh-clients openssh-server +# On EL8/EL9, `dnf` works the same. + +# 3. Restore the sshd_config backed up before installing +# (`ls /etc/ssh/sshd_config.*` to find the actual dated name) +sudo cp /etc/ssh/sshd_config.YYYYMMDD /etc/ssh/sshd_config + +# 4. Restart and verify +sudo systemctl restart sshd +ssh -V && /usr/sbin/sshd -V +ssh localhost +``` + +Notes: + +- The default build bundles OpenSSL statically (`WITH_OPENSSL=2`), so + the system OpenSSL is untouched — only the `openssh` packages need + rolling back. +- If step 2 can't find the packages, your base repos may be disabled or + (on EOL releases like EL5/EL6) moved to vault — fix the repo config + first. +- Same rule as install: **DO NOT** close your current shell, open a + **NEW** shell to verify that login works before disconnecting. + ## Use Docker For more details, see [docker/README.md](docker/README.md) @@ -183,7 +229,7 @@ unaffected. For the Docker-based build, see ### Install on uniontech UOS 20 -UOS's `openssh-help` subpackage has files that confilict with the package. It's must be removed before installing the compiled RPMs: +UOS's `openssh-help` subpackage has files that conflict with the package. It's must be removed before installing the compiled RPMs: ```bash sudo rpm --nodeps -e openssh-help diff --git a/docker/README.md b/docker/README.md index a7cf3e9..b90ca5f 100644 --- a/docker/README.md +++ b/docker/README.md @@ -18,11 +18,11 @@ All built RPM packages will be automatically placed in the `./output/` directory You must download the source code and tarballs before building: ```bash -# Download all required sources -env ALL=1 ./pullsrc.sh +# Download the pinned sources from version.env +./pullsrc.sh ``` -> **Note**: Run this command only once before starting any builds. It prepares all necessary files for every supported platform. +> **Note**: Run this command only once before starting any builds. It downloads the single pinned set of sources defined in `version.env`. With `DOCKERBUILD=1 ./pullsrc.sh` only the Perl tarball is fetched (used for EL5 image builds). ## Step 2: Building RPMs for Specific Platforms @@ -66,6 +66,8 @@ docker build -t elssh:el8 -f ./docker/Dockerfile.centos-stream --build-arg VERSI docker run --rm -v .:/data -e "UOS20=1" elssh:el8 ``` +The aarch64 UOS20 build (CI artifact `rpm-uos20-aarch64`) uses the aarch64 EL8 image with `-e "UOS20=1"`. + #### For EL8 (CentOS 8 / RHEL 8 / Rocky 8 / AlmaLinux 8) ```bash @@ -82,6 +84,17 @@ docker run --rm -v .:/data elssh:el9 ### aarch64 (ARM64) Builds +#### For EL7 aarch64 + +```bash +docker build -t elssh_aarch64:el7 \ + --platform linux/arm64 \ + -f ./docker/Dockerfile.centos \ + --build-arg VERSION_NUM=7 . + +docker run --rm -v .:/data --platform linux/arm64 elssh_aarch64:el7 +``` + #### For EL8 aarch64 ```bash @@ -116,35 +129,23 @@ docker run --rm -v .:/data --platform linux/arm64 elssh_aarch64:el9 ## Output Location -After each successful build, the RPM packages are copied to: - -``` -./output/ -``` - -Typical output structure: +After each successful build, all built `.rpm` files land directly in `./output/` (flat, no per-version subdirs): ``` output/ -├── el5/ -│ ├── x86_64/ -│ └── i686/ # only if M32=1 -├── el6/ -├── el7/ -├── el8/ -├── el9/ -├── el8-aarch64/ -└── el9-aarch64/ +├── openssh-*.rpm +├── openssh-clients-*.rpm +└── ... ``` -Each subdirectory contains the generated `.rpm` files (including debuginfo if available). +Every build (native `./compile.sh` or Docker via `docker/docker_compile.sh`) funnels through the same copy step, so building another EL version adds to / overwrites the same flat directory — copy the files out first if you need to keep versions separate. ## Quick Start Examples ### Build only for modern systems (EL8 + EL9) ```bash -env ALL=1 ./pullsrc.sh +./pullsrc.sh docker build -t elssh:el8 -f ./docker/Dockerfile.centos-stream --build-arg VERSION_NUM=8 . docker run --rm -v .:/data elssh:el8 @@ -156,7 +157,7 @@ docker run --rm -v .:/data elssh:el9 ### Build only for ARM64 ```bash -env ALL=1 ./pullsrc.sh +./pullsrc.sh docker build -t elssh_aarch64:el9 --platform linux/arm64 -f ./docker/Dockerfile.centos-stream --build-arg VERSION_NUM=9 . docker run --rm -v .:/data --platform linux/arm64 elssh_aarch64:el9