casa-mp-base

# -*- coding: utf-8; mode: tcl; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- vim:fenc=utf-8:ft=tcl:et:sw=4:ts=4:sts=4

​

PortSystem          1.0

​

name                openssh

version             7.6p1

revision            5

categories          net

platforms           darwin

maintainers         nomaintainer

license             BSD

installs_libs       no

conflicts           lsh

​

description         OpenSSH secure login server

​

long_description    OpenSSH is a FREE version of the SSH protocol suite of \

                    network connectivity tools that increasing numbers of people on the \

                    Internet are coming to rely on. Many users of telnet, rlogin, ftp, \

                    and other such programs might not realize that their password is \

                    transmitted across the Internet unencrypted, but it is. OpenSSH \

                    encrypts all traffic (including passwords) to effectively eliminate \

                    eavesdropping, connection hijacking, and other network-level \

                    attacks. Additionally, OpenSSH provides a myriad of secure \

                    tunneling capabilities, as well as a variety of authentication \

                    methods.

​

homepage            http://www.openbsd.org/openssh/

​

checksums           ${distfiles} \

                    rmd160  486ae743f51ffbf8197d564aab9ae54f9e2ac9da \

                    sha256  a323caeeddfe145baaa0db16e98d784b1fbc7dd436a6bf1f479dfd5cd1d21723 \

                    size    1489788

​

master_sites        openbsd:OpenSSH/portable \

                    ftp://ftp.cise.ufl.edu/pub/mirrors/openssh/portable/ \

                    http://openbsd.mirrors.pair.com/OpenSSH/portable

​

if {${name} eq ${subport}} {

    depends_lib         path:lib/libssl.dylib:openssl \

                        port:libedit \

                        port:ncurses \

                        port:zlib

    depends_run         port:ssh-copy-id

​

    # the HPN patch needs this, so rewrite all other patches to support it, too

    patch.args          -p1

    patchfiles          launchd.patch \

                        pam.patch \

                        patch-sandbox-darwin.c-apple-sandbox-named-external.diff \

                        patch-sshd.c-apple-sandbox-named-external.diff

​

    # We need a couple of patches

    # - pam.patch

    #   getpwnam(3) on OS X always returns "*********" in the pw_passwd field even

    #   when run as root, so it can't be used for authentication. This patch just

    #   forces the use of PAM regardless of the configuration.

    # - patch-*-apple-sandbox-named-external.diff

    #   Use Apple's sandbox_init(3) in addition to standard privilege separation.

    #   This requires a sandbox profile (which we provide) and the sandbox_init(3)

    #   call before the chroot(2) to privsep-path (${prefix}/var/empty), or it will

    #   fail to load the sandbox description and libsandbox.1.dylib.

​

    post-patch {

        # reinplace prefix in path to sandbox definition added by

        # patch-sandbox-darwin.c-apple-sandbox-named-external.diff

        reinplace "s|@PREFIX@|${prefix}|g" ${worksrcpath}/sandbox-darwin.c

    }

​

    # strnvis(3) isn't actually "broken".  OpenBSD decided to be special and flip

    # the order of arguments to strnvis and considers everyone else to be broken.

    configure.cppflags-append -DBROKEN_STRNVIS=1

​

    # Use Apple's sandboxing feature

    configure.cppflags-append -D__APPLE_SANDBOX_NAMED_EXTERNAL__ \

                              -D__APPLE_API_STRICT_CONFORMANCE

    configure.ldflags-append  -Wl,-search_paths_first

    configure.args      --with-ssl-dir=${prefix} \

                        --sysconfdir=${prefix}/etc/ssh \

                        --with-privsep-path=/var/empty \

                        --with-md5-passwords \

                        --with-pid-dir=${prefix}/var/run \

                        --with-pam \

                        --mandir=${prefix}/share/man \

                        --with-zlib=${prefix} \

                        --without-kerberos5 \

                        --with-libedit \

                        --with-pie \

                        --without-xauth \

                        --without-ldns

​