#1105036 openssh: please produce OpenSSH 10.x backports for Bookworm and Bullseye

Package:
openssh
Source:
openssh
Submitter:
Martin-Éric Racine
Date:
2025-05-19 14:15:02 UTC
Severity:
normal
#1105036#5
Date:
2025-05-10 09:34:34 UTC
From:
To:
Given how Trixie has raised the minimum CPU level for some architectures (e.g. on i386, minimum Pentium 4 due to Rust now requiring SSE2), it would be desirable for OpenSSH to be backported to at least Bookworm, preferably also to Bullseye, so that hosts running on deprecated CPUs can remain reachable using post-quantum crypto for the remainder of their LTS support timespan.

Martin-Éric
#1105036#10
Date:
2025-05-11 14:17:36 UTC
From:
To:
While I'm reasonably OK with doing this, backports rules mean that I
need to wait until there's a suitable version in testing, and I'd much
rather wait until at least version 1:10.0p1-3 is in testing since the
current version in testing has an RC bug.

No promises about bullseye; it will depend on how the test suite looks
there, and the rationale you give only really seems to apply to
bookworm.
#1105036#15
Date:
2025-05-11 15:33:59 UTC
From:
To:
su 11.5.2025 klo 17.17 Colin Watson (cjwatson@debian.org) kirjoitti:

That seems reasonable enough. Looking forward to it.

Understood. It's obviously a lower priority than for Bookworm.

Martin-Éric
#1105036#20
Date:
2025-05-19 08:45:40 UTC
From:
To:
su 11.5.2025 klo 18.33 Martin-Éric Racine (martin-eric.racine@iki.fi) kirjoitti:

Can we return to this now that we have 1:10.0p1-5 in Testing?

Martin-Éric
#1105036#25
Date:
2025-05-19 14:03:52 UTC
From:
To:
Thanks for the reminder.  I've uploaded 1:10.0p1-5~bpo12+1 to
bookworm-backports.

I did try bullseye, but the regression test suite hung at "conch
ciphers: cipher aes256-ctr".  That probably just needs reintroducing an
old patch to deal with older versions of Twisted, but this sort of thing
can get quite time-consuming and I'm reluctant to spend a lot of time on
it with weak justification.  I propose to just do bookworm and call that
good enough; users of affected CPUs can at least upgrade to bookworm.
#1105036#30
Date:
2025-05-19 14:13:25 UTC
From:
To:
ma 19.5.2025 klo 17.03 Colin Watson (cjwatson@debian.org) kirjoitti:

Thanks!

Agreed. IIRC no architecture was dropped since Bullseye, so Bookworm
should work for most people. Things only get more complicated starting
with Trixie, with mips64le(?) dropped and i386 now requiring SSE2 so
786 (Pentium 4, Core, etc.) due to Rust, and no longer shipping any
kernel.

Martin-Éric