Bugzilla – Bug 1222716
libssh tries to read config from wrong crypto-policies location
Last modified: 2024-04-15 06:20:40 UTC
libssh-config ships /etc/libssh/libssh_server.config which contains # Parse system-wide crypto configuration file Include /usr/etc/crypto-policies/back-ends/libssh.config But there is no such file. It's supposed to be /etc/crypto-policies/back-ends/libssh.config Probably caused by the fix for bug 1211718.
Right, the libssh.config location for CP should not be changed. I'll amend that in a moment.
Factory submission: https://build.opensuse.org/request/show/1167009
(In reply to Pedro Monreal Gonzalez from comment #2) > Factory submission: https://build.opensuse.org/request/show/1167009 FWICT the logic for this is wrong: If /etc/ssh/ssh_config exists, that file is read. If not, /usr/etc/ssh/ssh_config is read. Currently libssh only reads the latter, so user configuration may get ignored.
Right, the usretc change was not done correctly in TW. I think GLOBAL_CLIENT_CONFIG and GLOBAL_BIND_CONFIG should still point to %{_sysconfdir} and in the config files both %{_sysconfdir} and %{_distconfdir} should be Included, right? So, I think the sed command: > %if 0%{?suse_version} > 1600 > sed -i '/^Include/ s|/etc|/usr/etc|' %{buildroot}%{_sysconfdir}/libssh/libssh_client.config > sed -i '/^Include/ s|/etc|/usr/etc|' %{buildroot}%{_sysconfdir}/libssh/libssh_server.config > %endif should be substituted by: > %if 0%{?suse_version} > 1600 > install -d -m755 %{buildroot}%{_distconfdir}/libssh/ > mv %{buildroot}%{_sysconfdir}/libssh/libssh_client.config %{buildroot}%{_distconfdir}/libssh/ > mv %{buildroot}%{_sysconfdir}/libssh/libssh_server.config %{buildroot}%{_distconfdir}/libssh/ > echo "Include /usr/etc/ssh/ssh_config" >> %{buildroot}%{_distconfdir}/libssh/libssh_client.config > %endif I get an rpmlint complaint about non-etc-or-var-file-marked-as-conffile warning.
(In reply to Pedro Monreal Gonzalez from comment #4) > Right, the usretc change was not done correctly in TW. I think > GLOBAL_CLIENT_CONFIG and GLOBAL_BIND_CONFIG should still point to > %{_sysconfdir} and in the config files both %{_sysconfdir} and > %{_distconfdir} should be Included, right? It's a bit more complex than that unfortunately. According to https://en.opensuse.org/openSUSE:Packaging_UsrEtc, packages must not ship files in /etc, neither upstream nor distro ones. If distro config is necessary, the file is put somewhere into /usr/etc, /usr/share, /usr/lib (according to preference) and only read if there is no user configuration in /etc. For libssh this means that it needs a code change to read /etc/libssh/libssh_{client,server}.config first and if that doesn't exist, /usr/etc/libssh/libssh_{client,server}.config. Such a patch would probably get accepted upstream, /usr/lib is the most commonly used location.