3 ms·
why should a package like ssh have so many random dependencies It's worth noting that vanilla upstream OpenSSH DOESN'T depend on xz. The dependency was patched
by dlgeek 3y ago
why should a package like ssh have so many random dependencies
It's worth noting that vanilla upstream OpenSSH DOESN'T depend on xz. The dependency was patched in by the major distros to better integrate with systemd - and it's (AIUI) a transitive dependency from systemd - even the patch doesn't use it, but it gets pulled in with other systemd stuff.
- michelsedgh 3y agoThat is worth noting, thanks for posting this and letting me know.
- em-bee 3y agovanilla upstream OpenSSH DOESN'T depend on xz that's what i believed as well, but i didn't take time to verify. and i didn't know about the details. thanks. as you describe it ssh still doesn't depend on xz (and why would it?) so part of the problem here is software architecture. how is it possible that a seemingly unrelated dependency somewhere within systemd can affect and be exploited through ssh directly? shouldn't it be possible to keep that separate? doesn't openssh itself already implement some form of privilege separation? how does software architecture here and in general need to change to prevent things like this? i am sure somewhere these questions are already being discussed. i'd appreciate any pointers.