Rebuild to add install target for sshdgenkeys.service

Otherwise we can't enable the service with systemd presets.

Rebuild to apply various improvements to systemd integration moving the
privilege separation directory to /usr/share/empty.sshd.

The rationale can be found at
https://github.com/systemd/systemd/blob/v256/NEWS#L495-L533

While Arch already ships the tmpfiles config for creating
/var/empty/ at boot, that still feels kinda unnecessary.
Fedora's practice is simpler and effective, hence let's
embrace /usr/share/empty.sshd/.

RemainAfterExit=yes is pretty pointless here, but rather
causes some inconsistency: if the conditions don't pass,
the service stays inactive, which means when sshd.service
is restarted and new key types got added, the service
would actually be triggered. OTOH, if the conditions
don't pass initially, the service stays active after
doing its job, and sshd.service restarts would not result
in reevaluation of the sshdgenkeys.service conditions.

Therefore, the behavior is mostly not useful, and sometimes
could lead to confusion. Drop it.

According to systemd.exec(5):

> Note that this option is only relevant for the system service manager,
> as system services by default do not automatically inherit any
> environment variables set for the service manager itself.
> However, in case of the user service manager all environment variables
> are passed to the executed processes anyway, hence this option is
> without effect for the user service manager.

Rebuild to fix typo in list of dependencies.

Signed-off-by: David Runge <dvzrv@archlinux.org>

Rebuild for building without ldns support and various cleanups (SPDX
license identifiers, factory dir support).

Rename the tmpfiles.d integration based on the package name, following
upstream recommendations.
Install all files below /etc to factory location and extend tmpfiles.d
integration to install missing files from factory location.

Signed-off-by: David Runge <dvzrv@archlinux.org>

As many different licenses apply to different portions of the code, be
more specific and split out the respective license texts to separate
files.

Signed-off-by: David Runge <dvzrv@archlinux.org>

If sodeps are defined globally, they may pull in packages defining
specific soprovides, but for the wrong architecture.

Signed-off-by: David Runge <dvzrv@archlinux.org>

Signed-off-by: David Runge <dvzrv@archlinux.org>

We do not ship slogin, so we do not need its man page.

Signed-off-by: David Runge <dvzrv@archlinux.org>

loqs authored 1 year ago and David Runge committed 1 year ago

Since glibc 2.31 the trust-ad configuration option in /etc/resolv.conf
is available and offers DNSSEC validation.
This AD bit is unfortunately ignored by ldns.
With glibc >= 2.31 there is no longer a reason to rely on ldns as DNS
resolver.

Closes #2.

The use of /etc/securetty is not useful on modern Linux systems.
Remove the (already commented) entry.
https://bugs.archlinux.org/task/45903



Signed-off-by: David Runge <dvzrv@archlinux.org>

Rebuild to fix issues with configuration overrides and ssh-agent user service.
https://bugs.archlinux.org/task/79285
https://bugs.archlinux.org/task/79608

As upstream does not support socket activation per-se, we do not need
the socket unit.
Simplify the ssh-agent.service by removing socket related functionality
and information related to setups that we do not support or package.
https://bugs.archlinux.org/task/79608

As discussed in https://bugs.archlinux.org/task/79285 the distribution
drop-in configuration must order last, otherwise user-provided drop-ins
can not apply.

Rebuild to fix issues due to broken configure heuristics:
ahttps://bugs.archlinux.org/task/79568
Add systemd user units for ssh-agent.
Consolidate license identifiers.

Add systemd user services for ssh-agent:
https://bugs.archlinux.org/task/78656

Switch to a more granular set of license identifiers based on
information provided in
https://github.com/openssh/openssh-portable/blob/master/LICENCE

The zlib version check is broken and leads to build failure:
https://bugs.archlinux.org/task/79568
As it is not useful to us to have openssh check for the zlib version
based on some (potentially outdated) heuristic, we disable it.
Whether zlib is vulnerable or not is defined by the Arch Linux security
tracker.

Allow inclusion of drop-in configs for ssh_config and sshd_config:
https://bugs.archlinux.org/task/79285

Inclusion of configuration drop-ins has to happen at the beginning of
/etc/ssh/sshd_config, as the parsing algorithm uses the first found
value.

Instead of patching /etc/ssh/sshd_config to set distribution defaults,
provide the drop-in 00-archlinux.conf which sets the relevant defaults.

Add sh to optdepends for various scripts.