projects/guix·blob kernel-updates · refs

1201 lines · 48.0 KiB

1;;; GNU Guix --- Functional package management for GNU
2;;; Copyright © 2012-2023, 2025 Ludovic Courtès <[email protected]>
3;;; Copyright © 2013, 2014 Andreas Enge <[email protected]>
4;;; Copyright © 2014, 2015, 2016 Mark H Weaver <[email protected]>
5;;; Copyright © 2015, 2016, 2018-2022, 2024, 2025 Efraim Flashner <[email protected]>
6;;; Copyright © 2016, 2019 Leo Famulari <[email protected]>
7;;; Copyright © 2016, 2021, 2023 Nicolas Goaziou <[email protected]>
8;;; Copyright © 2016 Christine Lemmer-Webber <[email protected]>
9;;; Copyright © 2017–2021 Tobias Geerinckx-Rice <[email protected]>
10;;; Copyright © 2017 Stefan Reichör <[email protected]>
11;;; Copyright © 2017 Ricardo Wurmus <[email protected]>
12;;; Copyright © 2017 Nikita <[email protected]>
13;;; Copyright © 2018 Manuel Graf <[email protected]>
14;;; Copyright © 2019 Gábor Boskovits <[email protected]>
15;;; Copyright © 2019, 2020 Mathieu Othacehe <[email protected]>
16;;; Copyright © 2020, 2023, 2024 Janneke Nieuwenhuizen <[email protected]>
17;;; Copyright © 2020 Oleg Pykhalov <[email protected]>
18;;; Copyright © 2020, 2021, 2022, 2025 Maxim Cournoyer <[email protected]>
19;;; Copyright © 2021 Brice Waegeneire <[email protected]>
20;;; Copyright © 2023 Simon Streit <[email protected]>
21;;; Copyright © 2024 Zheng Junjie <[email protected]>
22;;; Copyright © 2024-2026 Ashish SHUKLA <[email protected]>
23;;; Copyright © 2024, 2025 Sharlatan Hellseher <[email protected]>
24;;; Copyright © 2025 Ghislain Vaillant <[email protected]>
25;;; Copyright © 2025 Cayetano Santos <[email protected]>
26;;; Copyright © 2026 Patrick Norton <[email protected]>
27;;; Copyright © 2026 Artyom V. Poptsov <[email protected]>
28;;;
29;;; This file is part of GNU Guix.
30;;;
31;;; GNU Guix is free software; you can redistribute it and/or modify it
32;;; under the terms of the GNU General Public License as published by
33;;; the Free Software Foundation; either version 3 of the License, or (at
34;;; your option) any later version.
35;;;
36;;; GNU Guix is distributed in the hope that it will be useful, but
37;;; WITHOUT ANY WARRANTY; without even the implied warranty of
38;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
39;;; GNU General Public License for more details.
40;;;
41;;; You should have received a copy of the GNU General Public License
42;;; along with GNU Guix. If not, see <http://www.gnu.org/licenses/>.
43
44(define-module (gnu packages ssh)
45 #:use-module (guix gexp)
46 #:use-module (gnu packages)
47 #:use-module (gnu packages admin)
48 #:use-module (gnu packages autotools)
49 #:use-module (gnu packages base)
50 #:use-module (gnu packages bash)
51 #:use-module (gnu packages boost)
52 #:use-module (gnu packages check)
53 #:use-module (gnu packages compression)
54 #:use-module (gnu packages crypto)
55 #:use-module (gnu packages elf)
56 #:use-module (gnu packages gnupg)
57 #:use-module (gnu packages golang-build)
58 #:use-module (gnu packages golang-xyz)
59 #:use-module (gnu packages gperf)
60 #:use-module (gnu packages groff)
61 #:use-module (gnu packages guile)
62 #:use-module (gnu packages libedit)
63 #:use-module (gnu packages linux)
64 #:use-module (gnu packages logging)
65 #:use-module (gnu packages m4)
66 #:use-module (gnu packages multiprecision)
67 #:use-module (gnu packages ncurses)
68 #:use-module (gnu packages nettle)
69 #:use-module (gnu packages kerberos)
70 #:use-module (gnu packages perl)
71 #:use-module (gnu packages pkg-config)
72 #:use-module (gnu packages popt)
73 #:use-module (gnu packages protobuf)
74 #:use-module (gnu packages python)
75 #:use-module (gnu packages python-build)
76 #:use-module (gnu packages python-crypto)
77 #:use-module (gnu packages python-web)
78 #:use-module (gnu packages python-xyz)
79 #:use-module (gnu packages readline)
80 #:use-module (gnu packages security-token)
81 #:use-module (gnu packages texinfo)
82 #:use-module (gnu packages tls)
83 #:use-module (gnu packages xorg)
84 #:use-module (guix build-system cmake)
85 #:use-module (guix build-system gnu)
86 #:use-module (guix build-system go)
87 #:use-module (guix build-system pyproject)
88 #:use-module (guix download)
89 #:use-module (guix git-download)
90 #:use-module (guix gexp)
91 #:use-module ((guix licenses) #:prefix license:)
92 #:use-module (guix packages)
93 #:use-module (guix utils)
94 #:use-module (srfi srfi-1))
95
96(define-public hss
97 (package
98 (name "hss")
99 (version "1.10")
100 (source (origin
101 (method git-fetch)
102 (uri (git-reference
103 (url "https://github.com/six-ddc/hss")
104 (commit version)))
105 (file-name (git-file-name name version))
106 (sha256
107 (base32
108 "1xriqqp89nbzzx1q2jii3ylh3izmf48n5cpyz9ml7gcnzs04vd98"))))
109 (inputs
110 (list readline))
111 (arguments
112 (list #:make-flags
113 #~(list (string-append "CC=" #$(cc-for-target))
114 (string-append "INSTALL_BIN=" #$output "/bin"))
115 #:tests? #f ; no tests
116 #:phases
117 #~(modify-phases %standard-phases
118 (add-after 'unpack 'patch-file-names
119 (lambda _
120 (substitute* "Makefile"
121 (("/usr/local/opt/readline")
122 #$(this-package-input "readline")))))
123 (delete 'configure)))) ; no configure script
124 (build-system gnu-build-system)
125 (home-page "https://github.com/six-ddc/hss/")
126 (synopsis "Interactive SSH client for multiple servers")
127 (description
128 "@command{hss} is an interactive SSH client for multiple servers. Commands
129are executed on all servers in parallel. Execution on one server does not need
130to wait for that on another server to finish before starting. One can run a
131command on hundreds of servers at the same time, with almost the same experience
132as a local Bash shell.
133
134It supports:
135@itemize @bullet
136@item interactive input: based on GNU readline.
137@item history: responding to the @kbd{C-r} key.
138@item auto-completion: @key{TAB}-completion from remote servers for commands and
139file names.
140@end itemize\n")
141 (license license:expat)))
142
143(define-public libssh
144 (package
145 (name "libssh")
146 (version "0.12.0")
147 (source (origin
148 (method url-fetch)
149 (uri (string-append "https://www.libssh.org/files/"
150 (version-major+minor version)
151 "/libssh-" version ".tar.xz"))
152 (sha256
153 (base32
154 "08bidaiq4z911zl3v7xc2zb6s8i4p7syfpsfxznmwzijv0jg8shs"))))
155 (build-system cmake-build-system)
156 (outputs '("out" "debug"))
157 (arguments
158 (list
159 ;; Even as few as 6 processors have been reported to cause test
160 ;; failures, see
161 ;; https://codeberg.org/guix/guix/pulls/6776#issuecomment-11085680
162 #:parallel-tests? #f
163 #:configure-flags
164 #~(list #$@(if (%current-target-system)
165 #~()
166 #~("-DUNIT_TESTING=ON")))
167 #:phases
168 #~(modify-phases %standard-phases
169 (add-after 'unpack 'patch-commands
170 (lambda* (#:key inputs #:allow-other-keys)
171 ;; Runtime sources.
172 (substitute* '("src/config.c"
173 "src/socket.c")
174 (("\"/bin/sh\"")
175 (format #f "~s" (search-input-file inputs "/bin/sh"))))
176 ;; Test sources.
177 (substitute* '("tests/server/test_server/default_cb.c")
178 (("\"/bin/sh\"")
179 (format #f "~s" (which "sh"))))))
180 #$@(if (system-hurd?)
181 #~((add-after 'unpack 'skip-tests-hurd
182 ;; these subtests require an ipv6 address
183 ;; torture_config_match_localnetwork_string
184 ;; torture_config_match_localnetwork_file
185 (lambda _
186 (substitute* "tests/unittests/CMakeLists.txt"
187 (("torture_config_match_localnetwork") "")))))
188 #~())
189 #$@(if (target-ppc32?)
190 #~((add-after 'unpack 'skip-torture-test
191 ;; This test times out after 1500 seconds.
192 (lambda _
193 (substitute* "tests/unittests/CMakeLists.txt"
194 (("torture_threads_pki_rsa") "")))))
195 #~()))))
196 (native-inputs (list cmocka))
197 (inputs (list bash-minimal libsodium mit-krb5 openssl zlib))
198 (synopsis "SSH client library")
199 (description
200 "libssh is a C library implementing the SSHv2 and SSHv1 protocol for client
201and server implementations. With libssh, you can remotely execute programs,
202transfer files, and use a secure and transparent tunnel for your remote
203applications.")
204 (home-page "https://www.libssh.org")
205 (license license:lgpl2.1+)))
206
207(define-public libssh2
208 (package
209 (name "libssh2")
210 (version "1.11.1")
211 (source (origin
212 (method url-fetch)
213 (uri (string-append
214 "https://www.libssh2.org/download/libssh2-"
215 version ".tar.gz"))
216 (sha256
217 (base32
218 "1xsqysmrq40gdfjndd1yrcvwic16kn4jrzir6pn8xfadwg5pdv6r"))))
219 (build-system gnu-build-system)
220 ;; The installed libssh2.pc file does not include paths to openssl and
221 ;; zlib libraries, so we need to propagate the inputs.
222 (propagated-inputs (list openssl zlib))
223 (arguments
224 (list #:configure-flags #~'("--with-crypto=openssl"
225 "--disable-static"
226 "--disable-docker-tests")))
227 (synopsis "Client-side C library implementing the SSH2 protocol")
228 (description
229 "libssh2 is a library intended to allow software developers access to
230the SSH-2 protocol in an easy-to-use self-contained package. It can be built
231into an application to perform many different tasks when communicating with
232a server that supports the SSH-2 protocol.")
233 (license license:bsd-3)
234 (home-page "https://www.libssh2.org/")))
235
236(define-public openssh
237 (package
238 (name "openssh")
239 (version "10.5p1")
240 (source
241 (origin
242 (method url-fetch)
243 (uri (string-append "mirror://openbsd/OpenSSH/portable/"
244 "openssh-" version ".tar.gz"))
245 (patches (search-patches "openssh-trust-guix-store-directory.patch"))
246 (sha256
247 (base32 "04fv329d3jyn7cddink1jfrv444rwpym14f6kjbaz7ga76l2hkfl"))))
248 (build-system gnu-build-system)
249 (arguments
250 (list
251 #:test-target "tests"
252 ;; Not all of the tests can be run in parallel, see
253 ;; <https://marc.info/?l=openssh-unix-dev&m=170313565518842>.
254 #:parallel-tests? #f
255 ;; Otherwise, the test scripts try to use a nonexistent directory and fail.
256 #:make-flags
257 #~(list "REGRESSTMP=\"$${BUILDDIR}/regress\"")
258 #:configure-flags
259 #~(list
260 "--sysconfdir=/etc/ssh"
261 ;; Default value of 'PATH' used by sshd.
262 "--with-default-path=/run/current-system/profile/bin"
263 ;; configure needs to find krb5-config.
264 (string-append "--with-kerberos5="
265 #$(this-package-input "mit-krb5")
266 "/bin")
267 ;; libedit is needed for sftp completion.
268 "--with-libedit"
269 ;; Enable PAM support in sshd.
270 #$@(if (target-hurd?)
271 #~()
272 #~("--with-pam"
273 ;; Support creation and use of ecdsa-sk, ed25519-sk keys.
274 "--with-security-key-builtin"))
275 ;; "make install" runs "install -s" by default, which doesn't work for
276 ;; cross-compiled binaries because it invokes 'strip' instead of
277 ;; 'TRIPLET-strip'. Work around this.
278 #$@(if (%current-target-system)
279 #~("--disable-strip"
280 #$@(let ((xauth (this-package-input "xauth")))
281 (if xauth
282 #~((string-append "--with-xauth=" #$xauth "/bin/xauth"))
283 #~())))
284 #~()))
285 #:phases
286 #~(modify-phases %standard-phases
287 (add-after 'configure 'trust-store-location
288 (lambda _
289 (substitute* "misc.c"
290 (("@STORE_DIRECTORY@")
291 (string-append "\"" (%store-directory) "/\"")))
292 (substitute* "ssh-agent.c"
293 (("DEFAULT_ALLOWED_PROVIDERS \"")
294 (string-append "DEFAULT_ALLOWED_PROVIDERS "
295 "\"" (%store-directory) "/**/lib*/*,")))))
296 (add-before 'check 'patch-tests
297 (lambda _
298 (substitute* "regress/test-exec.sh"
299 (("/bin/sh") (which "sh")))
300
301 ;; Remove 't-exec' regress target which requires user 'sshd'.
302 (substitute* (list "Makefile"
303 "regress/Makefile")
304 (("^(tests:.*) t-exec(.*)" all pre post)
305 (string-append pre post)))))
306 (replace 'install
307 (lambda* (#:key (make-flags '()) #:allow-other-keys)
308 ;; Don't create /var/empty.
309 (substitute* "Makefile"
310 ((".*MKDIR_P.*PRIVSEP_PATH.*") ""))
311 ;; Install without host keys and system configuration files.
312 (apply invoke "make" "install-nosysconf" make-flags)
313 (with-directory-excursion "contrib"
314 (chmod "ssh-copy-id" #o555)
315 (install-file "ssh-copy-id"
316 (string-append #$output "/bin/"))
317 (install-file "ssh-copy-id.1"
318 (string-append #$output "/share/man/man1/"))))))))
319 (native-inputs (list groff pkg-config))
320 (inputs
321 (cons* libedit
322 openssl
323 mit-krb5
324 zlib
325 xauth ; for 'ssh -X' and 'ssh -Y'
326 (if (target-hurd?)
327 (list libxcrypt)
328 (list linux-pam
329 libfido2)))) ; fails to build on GNU/Hurd
330 (synopsis "Client and server for the secure shell (ssh) protocol")
331 (description
332 "The SSH2 protocol implemented in OpenSSH is standardised by the
333IETF secsh working group and is specified in several RFCs and drafts.
334It is composed of three layered components:
335
336The transport layer provides algorithm negotiation and a key exchange.
337The key exchange includes server authentication and results in a
338cryptographically secured connection: it provides integrity, confidentiality
339and optional compression.
340
341The user authentication layer uses the established connection and relies on
342the services provided by the transport layer. It provides several mechanisms
343for user authentication. These include traditional password authentication
344as well as public-key or host-based authentication mechanisms.
345
346The connection layer multiplexes many different concurrent channels over the
347authenticated connection and allows tunneling of login sessions and
348TCP-forwarding. It provides a flow control service for these channels.
349Additionally, various channel-specific options can be negotiated.")
350 (license (license:non-copyleft "file://LICENSE"
351 "See LICENSE in the distribution."))
352 (properties
353 '((release-monitoring-url . "https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/")))
354 (home-page "https://www.openssh.com/")))
355
356;; Deprecation added on 2025-11-18.
357(define-deprecated-package lsh openssh)
358
359;; OpenSSH without X support. This allows using OpenSSH without dragging X
360;; libraries to the closure.
361(define-public openssh-sans-x
362 (package
363 (inherit openssh)
364 (name "openssh-sans-x")
365 (inputs (modify-inputs inputs
366 (delete "xauth")))
367 (synopsis "OpenSSH client and server without X11 support")))
368
369(define-public hpn-ssh
370 (package
371 (inherit openssh)
372 (name "hpn-ssh")
373 (version "18.12.0")
374 (source
375 (origin
376 (inherit (package-source openssh))
377 (method git-fetch)
378 (uri
379 (git-reference
380 (url "https://github.com/rapier1/hpn-ssh")
381 (commit (string-append "hpn-" version))))
382 (file-name (git-file-name name version))
383 (sha256 (base32 "1bipc4dhspr8nn0pbfldxg409ad7xykqxmlrmp1kl51cywgslb30"))))
384 (arguments
385 (substitute-keyword-arguments arguments
386 ((#:configure-flags flags #~(list))
387 #~(cons* "--with-privsep-user=sshd"
388 "--with-pam-service=sshd"
389 #$flags))
390 ((#:modules mods %default-gnu-modules)
391 (cons '(ice-9 string-fun) mods))
392 ((#:phases phases #~(list))
393 #~(modify-phases #$phases
394 (add-after 'unpack 'patch-ssh-stuff
395 (lambda _
396 (substitute* "Makefile.in"
397 (("^sysconfdir=.*$")
398 "sysconfdir=/etc/ssh\n")
399 ((".*MKDIR_P.*PRIVSEP_PATH.*")
400 ""))
401 (substitute* "ssh.h"
402 (("#define HPNSSH_DEFAULT_PORT.*$")
403 "#define HPNSSH_DEFAULT_PORT 22\n"))))
404 (replace 'install
405 (lambda* (#:key (make-flags '()) #:allow-other-keys)
406 (let ((bindir (string-append #$output "/bin"))
407 (sbindir (string-append #$output "/sbin"))
408 (mandir (string-append #$output "/share/man")))
409 ;; Install without host keys and system configuration files. This
410 ;; will install /var/empty to the store, which is needed by the
411 ;; system openssh-service-type.
412 (apply invoke "make" "install-nosysconf" make-flags)
413 ;; rename files so it can act as replacement for openssh
414 (with-directory-excursion "contrib"
415 (chmod "hpnssh-copy-id" #o555)
416 (install-file "hpnssh-copy-id" bindir)
417 (install-file "hpnssh-copy-id.1"
418 (string-append mandir "/man1/")))
419 (for-each
420 (lambda (file)
421 (when (string-prefix? (string-append bindir "/hpn") file)
422 (symlink (basename file)
423 (string-replace-substring file "/bin/hpn" "/bin/"))))
424 (find-files bindir))
425 (for-each
426 (lambda (file)
427 (when (string-prefix? (string-append sbindir "/hpn") file)
428 (symlink (basename file)
429 (string-replace-substring file "/sbin/hpn" "/sbin/"))))
430 (find-files sbindir))
431 (for-each
432 (lambda (file)
433 (when (string-prefix? "hpn" (basename file))
434 (symlink (basename file)
435 (string-replace-substring file "/hpn" "/"))))
436 (find-files mandir)))))))))
437 (native-inputs
438 (modify-inputs native-inputs
439 (append autoconf automake)))
440 (synopsis "High performance SSH/SCP client, and server")
441 (description "HPN-SSH is a series of modifications to OpenSSH, the predominant implementation
442of the ssh protocol. It was originally developed to address performance issues when using ssh on high speed long distance networks.")
443 (home-page "https://hpnssh.org/")))
444
445(define-public hpn-ssh-sans-x
446 (package
447 (inherit hpn-ssh)
448 (name "hpn-ssh-sans-x")
449 (inputs
450 (modify-inputs inputs
451 (delete "xauth")))
452 (synopsis "High performance SSH/SCP client, and server without X11 support")))
453
454(define-public guile-ssh
455 (package
456 (name "guile-ssh")
457 (version "1.0.0")
458 (home-page "https://github.com/artyom-poptsov/guile-ssh")
459 (source (origin
460 (method git-fetch)
461 (uri (git-reference
462 (url home-page)
463 (commit (string-append "v" version))))
464 (file-name (git-file-name name version))
465 (sha256
466 (base32
467 "02n6d631720vvc70bhldvfbyfz06ymyzy4yim46s3x7s351qb841"))))
468 (build-system gnu-build-system)
469 (outputs '("out" "debug"))
470 (arguments
471 `(;; It makes no sense to build libguile-ssh.a.
472 #:configure-flags '("--disable-static")
473
474 #:phases (modify-phases %standard-phases
475 (add-before 'bootstrap 'support-cross-compilation
476 (lambda _
477 ;; Support cross-compilation:
478 ;; <https://github.com/artyom-poptsov/guile-ssh/issues/30>.
479 (substitute* "libguile-ssh/Makefile.am"
480 (("\\$\\(guile_snarf\\)")
481 "CPP=\"$(CPP)\" $(guile_snarf)"))))
482 (add-before 'build 'fix-libguile-ssh-file-name
483 (lambda* (#:key outputs #:allow-other-keys)
484 ;; Build and install libguile-ssh.so so that we can use
485 ;; its absolute file name in .scm files, before we build
486 ;; the .go files.
487 (let* ((out (assoc-ref outputs "out"))
488 (lib (string-append out "/lib")))
489 (invoke "make" "install"
490 "-C" "libguile-ssh"
491 "-j" (number->string
492 (parallel-job-count)))
493 (substitute* (find-files "." "\\.scm$")
494 (("\"libguile-ssh\"")
495 (string-append "\"" lib "/libguile-ssh\""))))))
496 ,@(if (%current-target-system)
497 '()
498 '((add-before 'check 'fix-guile-path
499 (lambda* (#:key inputs #:allow-other-keys)
500 (let ((guile (assoc-ref inputs "guile")))
501 (substitute* "tests/common.scm"
502 (("/usr/bin/guile")
503 (string-append guile "/bin/guile"))))))))
504 (add-after 'install 'remove-bin-directory
505 (lambda* (#:key outputs #:allow-other-keys)
506 (let* ((out (assoc-ref outputs "out"))
507 (bin (string-append out "/bin"))
508 (examples (string-append
509 out "/share/guile-ssh/examples")))
510 (mkdir-p examples)
511 (rename-file (string-append bin "/ssshd.scm")
512 (string-append examples "/ssshd.scm"))
513 (rename-file (string-append bin "/sssh.scm")
514 (string-append examples "/sssh.scm"))
515 (delete-file-recursively bin)))))))
516 (native-inputs (list autoconf
517 automake
518 libtool
519 texinfo
520 pkg-config
521 which
522 guile-3.0)) ;needed when cross-compiling.
523 (inputs (list guile-3.0 libssh libgcrypt))
524 (synopsis "Guile bindings to libssh")
525 (description
526 "Guile-SSH is a library that provides access to the SSH protocol for
527programs written in GNU Guile interpreter. It is a wrapper to the underlying
528libssh library.")
529 (license license:gpl3+)))
530
531(define-public guile2.2-ssh
532 (package
533 (inherit guile-ssh)
534 (name "guile2.2-ssh")
535 (native-inputs
536 (modify-inputs native-inputs
537 (delete "guile")
538 (prepend guile-2.2 ;needed when cross-compiling.
539 )))
540 (inputs (modify-inputs inputs
541 (replace "guile" guile-2.2)))))
542
543(define-public corkscrew
544 ;; The last 2.0 release hails from 2009. Use a fork (submitted upstream as
545 ;; <https://github.com/patpadgett/corkscrew/pull/5>) that adds now-essential
546 ;; IPv6 and TLS support.
547 (let ((revision "0")
548 (commit "268b71e88ee51fddceab96d665b327394f1feb12"))
549 (package
550 (name "corkscrew")
551 (version (git-version "2.0" revision commit))
552 (source
553 (origin
554 (method git-fetch)
555 (uri (git-reference
556 (url "https://github.com/rtgill82/corkscrew")
557 (commit commit)))
558 (sha256
559 (base32 "1rylbimlfig3ii4bqr4r058lkc43pqkxnxqpqdpm31blh3xs0dcw"))
560 (file-name (git-file-name name version))))
561 (build-system gnu-build-system)
562 (arguments
563 `(#:configure-flags
564 (list "--enable-ssl")
565 #:phases
566 (modify-phases %standard-phases
567 (add-after 'unpack 'update-metadata
568 (lambda _
569 (substitute* "configure.ac"
570 ;; Our version differs significantly.
571 (("2.0") (string-append ,version " (Guix)")))
572 (substitute* "corkscrew.c"
573 ;; This domain's since been squat.
574 (("\\(agroman@agroman\\.net\\)")
575 (format #f "<~a>" ,(package-home-page this-package))))))
576 (add-after 'install 'install-documentation
577 (lambda* (#:key outputs #:allow-other-keys)
578 (let* ((out (assoc-ref outputs "out"))
579 (doc (string-append out "/share/doc/" ,name "-" ,version)))
580 (install-file "README.md" doc)
581 #t))))))
582 (native-inputs
583 (list autoconf automake pkg-config))
584 (inputs
585 (list openssl))
586 (home-page "https://github.com/patpadgett/corkscrew")
587 (synopsis "SSH tunneling through HTTP(S) proxies")
588 (description
589 "Corkscrew tunnels SSH connections through most HTTP and HTTPS proxies.
590It supports proxy authentication through the HTTP basic authentication scheme
591with optional @acronym{TLS, Transport-Level Security} to protect credentials.")
592 (license license:gpl2+))))
593
594(define-public mosh
595 (package
596 (name "mosh")
597 (version "1.4.0")
598 (source (origin
599 (method url-fetch)
600 (uri (string-append "https://mosh.org/mosh-" version ".tar.gz"))
601 (sha256
602 (base32
603 "1pax8sqlvcc7ammsxd9r53yx4m2hg1827wfz6f4rrwjx9q9lnbl7"))))
604 (build-system gnu-build-system)
605 (arguments
606 (list
607 #:phases
608 #~(modify-phases %standard-phases
609 (add-after 'unpack 'patch-FHS-file-names
610 (lambda* (#:key inputs #:allow-other-keys)
611 (substitute* "scripts/mosh.pl"
612 (("/bin/sh" shell)
613 (search-input-file inputs shell)))))
614 (add-after 'install 'wrap
615 (lambda _
616 ;; Make sure 'mosh' can find 'mosh-client' and 'mosh-server'.
617 (let ((bin (string-append #$output "/bin")))
618 (wrap-program (string-append bin "/mosh")
619 `("PATH" ":" prefix (,bin)))))))))
620 (native-inputs
621 (list pkg-config))
622 (inputs
623 (list bash-minimal
624 boost
625 ncurses
626 openssl
627 perl
628 perl-io-tty
629 protobuf
630 zlib))
631 (home-page "https://mosh.org/")
632 (synopsis "Remote shell tolerant to intermittent connectivity")
633 (description
634 "Mosh is a remote terminal application that allows client roaming, supports
635intermittent connectivity, and provides intelligent local echo and line editing
636of user keystrokes. It's a replacement for SSH that's more robust and
637responsive, especially over Wi-Fi, cellular, and long-distance links.")
638 (license license:gpl3+)))
639
640(define-public dropbear
641 (package
642 (name "dropbear")
643 (version "2025.89")
644 (source
645 (origin
646 (method url-fetch)
647 (uri (string-append
648 "https://matt.ucc.asn.au/dropbear/releases/"
649 "dropbear-" version ".tar.bz2"))
650 (sha256
651 (base32 "0d1n26g8rddflyja0bgy08x25n6gp7575rl5ibf3dhyg26kpq7qd"))
652 (modules '((guix build utils)))
653 (snippet
654 '(begin
655 (delete-file-recursively "libtommath")
656 (delete-file-recursively "libtomcrypt")
657 (substitute* "configure"
658 (("-ltomcrypt") "-ltomcrypt -ltommath"))))))
659 (build-system gnu-build-system)
660 (arguments
661 (list
662 #:configure-flags #~(list "--disable-bundled-libtom")
663 ;; The test suite runs an instance of dropbear, which requires a
664 ;; resolver ("Error resolving: Servname not supported for ai_socktype").
665 #:tests? #f
666 #:phases #~(modify-phases %standard-phases
667 (add-after 'unpack 'enable-x11-forwarding
668 (lambda _
669 (substitute* "src/default_options.h"
670 (("#define DROPBEAR_X11FWD 0")
671 "#define DROPBEAR_X11FWD 1")))))))
672 (inputs (list libtomcrypt libtommath libxcrypt zlib))
673 (synopsis "Small SSH server and client")
674 (description "Dropbear is a relatively small SSH server and
675client. It runs on a variety of POSIX-based platforms. Dropbear is
676particularly useful for embedded systems, such as wireless routers.")
677 (home-page "https://matt.ucc.asn.au/dropbear/dropbear.html")
678 (license (license:x11-style "" "See file LICENSE."))))
679
680(define-public liboop
681 (package
682 (name "liboop")
683 (version "1.0.1")
684 (source
685 (origin
686 (method url-fetch)
687 (uri (string-append "http://ftp.lysator.liu.se/pub/liboop/"
688 name "-" version ".tar.gz"))
689 (sha256
690 (base32
691 "1q0p1l72pq9k3bi7a366j2rishv7dzzkg3i6r2npsfg7cnnidbsn"))))
692 (build-system gnu-build-system)
693 (home-page "https://www.lysator.liu.se/liboop/")
694 (synopsis "Event loop library")
695 (description "Liboop is a low-level event loop management library for
696POSIX-based operating systems. It supports the development of modular,
697multiplexed applications which may respond to events from several sources. It
698replaces the \"select() loop\" and allows the registration of event handlers
699for file and network I/O, timers and signals. Since processes use these
700mechanisms for almost all external communication, liboop can be used as the
701basis for almost any application.")
702 (license license:lgpl2.1+)))
703
704(define-public sshpass
705 (package
706 (name "sshpass")
707 (version "1.10")
708 (source
709 (origin
710 (method url-fetch)
711 (uri (string-append "mirror://sourceforge/sshpass/sshpass/"
712 version "/sshpass-" version ".tar.gz"))
713 (sha256
714 (base32 "1npfvxxqs77qg6l4s6cn8q3b98zwr9n8rb9vra2n3dfb0g10c4dd"))))
715 (build-system gnu-build-system)
716 (home-page "https://sourceforge.net/projects/sshpass/")
717 (synopsis "Non-interactive password authentication with SSH")
718 (description "sshpass is a tool for non-interactively performing password
719authentication with SSH's so-called @dfn{interactive keyboard password
720authentication}.")
721 (license license:gpl2+)))
722
723(define-public autossh
724 (package
725 (name "autossh")
726 (version "1.4g")
727 (source
728 (origin
729 (method url-fetch)
730 (uri (string-append
731 "https://www.harding.motd.ca/autossh/autossh-"
732 version ".tgz"))
733 (sha256
734 (base32 "0xqjw8df68f4kzkns5gcah61s5wk0m44qdk2z1d6388w6viwxhsz"))))
735 (build-system gnu-build-system)
736 (arguments `(#:tests? #f)) ; There is no "make check" or anything similar
737 (inputs (list openssh))
738 (synopsis "Automatically restart SSH sessions and tunnels")
739 (description "autossh is a program to start a copy of @command{ssh} and
740monitor it, restarting it as necessary should it die or stop passing traffic.")
741 (home-page "https://www.harding.motd.ca/autossh/")
742 (license
743 ;; Why point to a source file? Well, all the individual files have a
744 ;; copy of this license in their headers, but there's no separate file
745 ;; with that information.
746 (license:non-copyleft "file://autossh.c"))))
747
748(define-public pdsh
749 (package
750 (name "pdsh")
751 (version "2.35")
752 (source
753 (origin
754 (method url-fetch)
755 (uri (string-append "https://github.com/chaos/pdsh/"
756 "releases/download/pdsh-" version
757 "/pdsh-" version ".tar.gz"))
758 (sha256
759 (base32 "1ziw142im1hzj0wr20msrp97sp709x1c9ybgilzz9zs8g0s1bvvm"))))
760 (build-system gnu-build-system)
761 (arguments
762 `(#:configure-flags
763 (list "--with-ssh")
764 #:phases
765 (modify-phases %standard-phases
766 (add-after 'unpack 'patch-/bin/sh
767 (lambda _
768 (substitute* '("tests/t0006-pdcp.sh"
769 "tests/t0004-module-loading.sh"
770 "tests/t2001-ssh.sh"
771 "tests/t1003-slurm.sh"
772 "tests/t6036-long-output-lines.sh"
773 "tests/aggregate-results.sh"
774 "tests/t2000-exec.sh"
775 "tests/t0002-internal.sh"
776 "tests/t1002-dshgroup.sh"
777 "tests/t5000-dshbak.sh"
778 "tests/t0001-basic.sh"
779 "tests/t0005-rcmd_type-and-user.sh"
780 "tests/test-lib.sh"
781 "tests/t2002-mrsh.sh"
782 "tests/t0003-wcoll.sh"
783 "tests/test-modules/pcptest.c")
784 (("/bin/sh") (which "bash")))
785 #t))
786 (add-after 'unpack 'patch-tests
787 (lambda _
788 (substitute* "tests/t6036-long-output-lines.sh"
789 (("which") (which "which")))
790 #t)))))
791 (inputs
792 (list openssh mit-krb5 perl))
793 (native-inputs
794 (list which))
795 (home-page "https://github.com/chaos/pdsh")
796 (synopsis "Parallel distributed shell")
797 (description "Pdsh is a an efficient, multithreaded remote shell client
798which executes commands on multiple remote hosts in parallel. Pdsh implements
799dynamically loadable modules for extended functionality such as new remote
800shell services and remote host selection.")
801 (license license:gpl2+)))
802
803(define-public python-asyncssh
804 (package
805 (name "python-asyncssh")
806 (version "2.23.1") ;XXX: higher version needs cryptography >= 48.0.1
807 (source
808 (origin
809 (method url-fetch)
810 (uri (pypi-uri "asyncssh" version))
811 (sha256
812 (base32 "0kzlldy1rbdj3z288s2mxd5svd7j9aifdh6ih1flngkg4303pp6r"))))
813 (build-system pyproject-build-system)
814 (arguments
815 (list
816 ;; tests: 1700 passed, 34 skipped, 1 deselected, 4184 subtests passed
817 #:test-flags
818 #~(list "-k" (string-join
819 (list
820 ;; TODO Test fails with:
821 ;; "Unable to sign with requested key"
822 "not test_confirm"
823 #$@(if (target-aarch64?)
824 (list
825 ;; Tests fail with: asyncssh.misc.ConnectionLost:
826 ;; Connection lost
827 "test_connect_non_tcp_sock"
828 "test_connect_reverse_proxy"
829 "test_get_server_auth_methods_no_sockn"
830 "test_get_server_auth_methods_no_sockname"
831 "test_get_server_host_key_proxy")
832 '()))
833 " and not " ))
834 #:phases
835 #~(modify-phases %standard-phases
836 (add-before 'check 'pre-check
837 (lambda* _
838 (substitute* "tests/test_connection.py"
839 ;; nc is always available.
840 (("which nc") "true")))))))
841 (native-inputs
842 (list netcat
843 openssh
844 openssl
845 python-pytest
846 python-setuptools))
847 (propagated-inputs
848 (list python-cryptography
849 python-typing-extensions
850 ;; [optional]
851 python-bcrypt
852 python-fido2
853 python-ifaddr
854 python-gssapi
855 ;; python-pkcs11 ;not packaged yet in Guix
856 python-pyopenssl))
857 (home-page "https://asyncssh.readthedocs.io/")
858 (synopsis "Asynchronous SSHv2 client and server library for Python")
859 (description
860 "AsyncSSH is a Python package which provides an asynchronous client and
861server implementation of the SSHv2 protocol on top of the Python 3.6+ asyncio
862framework.")
863 (license license:epl2.0)))
864
865(define-public python-mock-ssh-server
866 (package
867 (name "python-mock-ssh-server")
868 (version "0.9.1")
869 (source
870 (origin
871 (method git-fetch)
872 (uri (git-reference
873 (url "https://github.com/carletes/mock-ssh-server")
874 (commit version)))
875 (file-name (git-file-name name version))
876 (sha256
877 (base32 "0fmnn2ddfagi0qybnw1n10hn29jawnj01bgwl4p9lnwx71c7x5y8"))))
878 (build-system pyproject-build-system)
879 (native-inputs
880 (list inetutils
881 openssh
882 python-pytest
883 python-setuptools))
884 (propagated-inputs
885 (list python-paramiko))
886 (home-page "https://github.com/carletes/mock-ssh-server")
887 (synopsis "Mock SSH server for testing purposes")
888 (description
889 "@code{mock-ssh-server} packs a Python context manager that implements an
890SSH server for testing purposes. It is built on top of paramiko, so it does not
891need OpenSSH binaries to be installed.")
892 (license license:expat)))
893
894(define-public python-sshfs
895 (package
896 (name "python-sshfs")
897 (version "2026.8.0")
898 (source
899 (origin
900 (method git-fetch)
901 (uri (git-reference
902 (url "https://github.com/fsspec/sshfs")
903 (commit version)))
904 (file-name (git-file-name name version))
905 (sha256
906 (base32 "1p7mvrngng85v40ngakjk5hs36ay8svwc3xhgdh1ahria00my3qv"))))
907 (build-system pyproject-build-system)
908 (native-inputs
909 (list python-importlib-metadata
910 python-mock-ssh-server
911 python-pytest
912 python-pytest-asyncio
913 python-setuptools
914 python-setuptools-scm))
915 (propagated-inputs
916 (list python-asyncssh
917 python-bcrypt
918 python-fsspec))
919 (home-page "https://github.com/fsspec/sshfs")
920 (synopsis "SSH/SFTP implementation for fsspec")
921 (description
922 "This package provides an implementation of fsspec for the SFTP protocol
923using asyncssh, with the following features:
924
925@itemize
926@item A complete implementation of the fsspec protocol through SFTP
927@item Supports features outside of the SFTP
928@item Quite fast
929@item Builtin Channel Management
930@item Async
931@end itemize")
932 (license license:asl2.0)))
933
934(define-public clustershell
935 (package
936 (name "clustershell")
937 (version "1.9.3")
938 (source
939 (origin
940 (method git-fetch)
941 (uri (git-reference
942 (url "https://github.com/cea-hpc/clustershell")
943 (commit (string-append "v" version))))
944 (file-name (git-file-name name version))
945 (sha256
946 (base32 "0maw8y22gxva2ja0a4d4i3iibjn4yd2zvcx0r6sj8lksdqyavad1"))))
947 (build-system pyproject-build-system)
948 (arguments
949 (list
950 #:tests? #f ; tests require python-nose, and most of them fail
951 #:phases
952 #~(modify-phases %standard-phases
953 (add-before 'build 'fix-pathes
954 (lambda _
955 (let ((ssh #$(this-package-input "openssh")))
956 (substitute* (list "lib/ClusterShell/Worker/Ssh.py"
957 "lib/ClusterShell/Worker/fastsubprocess.py")
958 (("\"/bin/sh\"") (format #f "'~a'" (which "sh")))
959 (("\"ssh\"") (format #f "'~a/bin/ssh'" ssh))
960 (("\"scp\"") (format #f "'~a/bin/scp'" ssh)))
961 (substitute* (find-files "./tests" "\\.py$")
962 (("\"/bin/hostname\"") (format #f "'~a'" (which "hostname")))
963 (("/bin/sleep") "sleep")
964 (("/bin/echo") "echo")
965 (("/bin/uname") "uname")
966 (("/bin/false") "false")
967 (("/bin/true") "true")
968 (("/usr/bin/printf") "printf"))))))))
969 (native-inputs
970 (list python-setuptools))
971 (inputs
972 (list openssh))
973 (propagated-inputs
974 (list python-pyyaml))
975 (home-page "https://cea-hpc.github.io/clustershell/")
976 (synopsis "Scalable event-driven Python framework for cluster administration")
977 (description
978 "ClusterShell is an event-driven Python framework, designed to run local
979or distant commands in parallel on server farms or on large GNU/Linux
980clusters. It will take care of common issues encountered on HPC clusters,
981such as operating on groups of nodes, running distributed commands using
982optimized execution algorithms, as well as gathering results and merging
983identical outputs, or retrieving return codes. ClusterShell takes advantage
984of existing remote shell facilities such as SSH.")
985 (license license:lgpl2.1+)))
986
987(define-public endlessh
988 (package
989 (name "endlessh")
990 (version "1.1")
991 (source
992 (origin
993 (method git-fetch)
994 (uri (git-reference
995 (url "https://github.com/skeeto/endlessh")
996 (commit version)))
997 (file-name (git-file-name name version))
998 (sha256
999 (base32 "0ziwr8j1frsp3dajr8h5glkm1dn5cci404kazz5w1jfrp0736x68"))))
1000 (build-system gnu-build-system)
1001 (arguments
1002 `(#:make-flags (list (string-append "PREFIX=" (assoc-ref %outputs "out"))
1003 ,(string-append "CC=" (cc-for-target)))
1004 #:tests? #f ; no test target
1005 #:phases
1006 (modify-phases %standard-phases
1007 (delete 'configure)))) ; no configure script
1008 (home-page "https://github.com/skeeto/endlessh")
1009 (synopsis "SSH tarpit that slowly sends an endless banner")
1010 (description
1011 "Endlessh is an SSH tarpit that very slowly sends an endless, random SSH
1012banner. It keeps SSH clients locked up for hours or even days at a time. The
1013purpose is to put your real SSH server on another port and then let the script
1014kiddies get stuck in this tarpit instead of bothering a real server.
1015
1016Since the tarpit is in the banner before any cryptographic exchange occurs, this
1017program doesn't depend on any cryptographic libraries. It's a simple,
1018single-threaded, standalone C program. It uses @code{poll()} to trap multiple
1019clients at a time.")
1020 (license license:unlicense)))
1021
1022(define-public ssh-tools
1023 (package
1024 (name "ssh-tools")
1025 (version "1.9")
1026 (source
1027 (origin
1028 (method git-fetch)
1029 (uri (git-reference
1030 (url "https://codeberg.org/vaporup/ssh-tools")
1031 (commit (string-append "v" version))))
1032 (file-name (git-file-name name version))
1033 (sha256
1034 (base32 "1bh6pp5ic4b8pbgzwqr516z8466x62kzwyaka38agz294qwck5sh"))))
1035 (build-system go-build-system)
1036 (arguments
1037 (list
1038 #:modules '((srfi srfi-26)
1039 (guix build go-build-system)
1040 (guix build utils))
1041 #:install-source? #f
1042 #:import-path "codeberg.org/vaporup/ssh-tools/cmd/go/..."
1043 #:unpack-path "codeberg.org/vaporup/ssh-tools"
1044 #:test-flags
1045 ;; "non-constant format string in call to fmt.Fprintf"
1046 #~(list "-vet=off")
1047 #:phases
1048 #~(modify-phases %standard-phases
1049 (add-after 'install 'install-bash
1050 (lambda* (#:key unpack-path #:allow-other-keys)
1051 (let ((files (find-files (string-append "src/" unpack-path
1052 "/cmd/bash") "ssh-"))
1053 (bin (string-append #$output "/bin")))
1054 (for-each (cut install-file <> bin) files))))
1055 (add-after 'install-bash 'install-manpages
1056 (lambda* (#:key unpack-path #:allow-other-keys)
1057 (copy-recursively (string-append "src/" unpack-path "/man/")
1058 (string-append #$output "/share/man/man1")))))))
1059 (native-inputs
1060 (list go-golang-org-x-crypto
1061 go-sigs-k8s-io-yaml))
1062 (home-page "https://codeberg.org/vaporup/ssh-tools")
1063 (synopsis "Miscellaneous SSH utilities")
1064 (description
1065 "This package provides a suite of miscellaneous SSH-related utilities.
1066
1067This package includes the following commands:
1068@itemize
1069
1070@item @command{ssh-ping}: Checks if a host is reachable using
1071@code{ssh_config}.
1072
1073@item @command{ssh-last}: Like @command{last} but for SSH sessions.
1074
1075@item @command{ssh-certinfo}: Shows validity and information for SSH
1076certificates.
1077
1078@item @command{ssh-force-password}: Forces password authentication.
1079
1080@item @command{ssh-keyinfo}: Prints keys in several formats.
1081
1082@item @command{ssh-hostkeys}: Prints server host keys in several formats.
1083
1084@item @command{ssh-facts}: Gets some facts about the remote system.
1085
1086@item @command{ssh-diff}: Diffs a file over SSH.
1087
1088@item @command{ssh-version}: Shows version of the SSH server you are
1089connecting to.
1090
1091@item @command{ssh-pwd}: Quickly echos path to use for @command{scp} or
1092@command{rsync}.
1093
1094@item @command{ssh-authorized-keys}: Collects info from
1095@command{authorized_keys} files from every user it can find.
1096
1097@item @command{ssh-sig}: Makes @code{ssh-keygen -Y} easier to use.
1098
1099@end itemize")
1100 (license license:gpl3)))
1101
1102(define-public webssh
1103 (package
1104 (name "webssh")
1105 (version "1.6.3")
1106 (source
1107 (origin
1108 (method git-fetch)
1109 (uri (git-reference
1110 (url "https://github.com/huashengdun/webssh")
1111 (commit (string-append "v" version))))
1112 (file-name (git-file-name name version))
1113 (sha256
1114 (base32 "0gvs64xjm1pfwv6jyc71hsj0pwfhvmw8ahbx4y9p6isfwspcbmr0"))))
1115 (build-system pyproject-build-system)
1116 ;; FIXME: Errors with:
1117 ;; "AttributeError: 'AsyncHTTPTestCase' object has no attribute 'runTest'"
1118 (arguments (list #:tests? #f))
1119 (native-inputs
1120 (list python-pytest
1121 python-setuptools))
1122 (propagated-inputs
1123 (list python-paramiko
1124 python-tornado))
1125 (home-page "https://webssh.huashengdun.org/")
1126 (synopsis "Web application to be used as an SSH client")
1127 (description
1128 "This package provides a web application to be used as an SSH client.
1129
1130Features:
1131@itemize @bullet
1132@item SSH password authentication supported, including empty password.
1133@item SSH public-key authentication supported, including DSA RSA ECDSA
1134Ed25519 keys.
1135@item Encrypted keys supported.
1136@item Two-Factor Authentication (time-based one-time password) supported.
1137@item Fullscreen terminal supported.
1138@item Terminal window resizable.
1139@item Auto detect the ssh server's default encoding.
1140@item Modern browsers are supported.
1141@end itemize")
1142 (license license:expat)))
1143
1144(define-public x11-ssh-askpass
1145 (package
1146 (name "x11-ssh-askpass")
1147 (version "1.2.4.1")
1148 (source
1149 (origin
1150 (method url-fetch)
1151 ;; The project home page seams to be offline.
1152 (uri (string-append "https://pkgs.fedoraproject.org/repo/pkgs/openssh/"
1153 name "-" version ".tar.gz"
1154 "/8f2e41f3f7eaa8543a2440454637f3c3/"
1155 name "-" version ".tar.gz"))
1156 (sha256
1157 (base32 "124c1frwvdmg4nv8xqv435ibjhj2y8xc1bmfr6i8a8g75b1y63b2"))))
1158 (build-system gnu-build-system)
1159 (arguments
1160 (list
1161 #:tests? #f ;no tests
1162 #:make-flags
1163 #~(list (string-append "BINDIR=" #$output "/libexec")
1164 (string-append "MANDIR=" #$output "/share/man"))
1165 #:configure-flags
1166 #~(list (string-append "--mandir="
1167 "/usr/share/man/test")
1168 (string-append "--libexecdir="
1169 "/usr/lib/ssh/test")
1170 (string-append "--with-app-defaults-dir="
1171 "/usr/share/X11/app-defaults/test"))
1172 #:phases
1173 #~(modify-phases %standard-phases
1174 (add-after 'configure 'xmkmf
1175 (lambda* (#:key inputs #:allow-other-keys)
1176 (let ((imake #$(this-package-native-input "imake")))
1177 (invoke "xmkmf")
1178 (substitute* "Makefile"
1179 ;; These imake variables somehow remain undefined
1180 (("DefaultGcc2[[:graph:]]*Opt") "-O2")
1181 ;; Reset a few variable defaults that are set in imake
1182 ;; templates.
1183 ((imake) #$output)
1184 (("(MANPATH = )[[:graph:]]*" _ front)
1185 (string-append front #$output "/share/man"))))))
1186 (add-after 'xmkmf 'make-includes
1187 (lambda _
1188 (invoke "make" "includes")))
1189 (add-after 'install 'install/doc
1190 (lambda _
1191 (lambda _
1192 (invoke "make"
1193 (string-append "MANDIR=" #$output "/share/man")
1194 "install.man")))))))
1195 (native-inputs (list imake))
1196 (inputs (list libxt))
1197 (home-page "http://www.jmknoble.net/software/x11-ssh-askpass/")
1198 (synopsis "Lightweight passphrase dialog for SSH")
1199 (description "code{x11-ssh-askpass} is an X11-based pass-phrase dialog for
1200use with OpenSSH.")
1201 (license license:gpl2+)))