fix: disable dropbear password auth in the built ipk

oap commented

2026-10-25 02:43:20 -07:00

Owner

Upstream starts dropbear with no -s/-w (services/startup.sh), so it
offers password auth alongside publickey even once authorized_keys is
provisioned. The placeholder "alpine" password is only skipped in that
case, never actually disabled as an auth method - ssh -v confirms
dropbear still lists "password" as a continuing method after a
successful pubkey login.

Patch services/startup.sh right after checkout, before npm run
package builds the ipk, so the ipk's hash is correct by construction
instead of needing a rebuild/rehash after the fact. A grep -F
assertion fails the build loudly if upstream ever changes this line,
rather than silently doing nothing.

Co-Authored-By: Claude Sonnet 5 noreply@anthropic.com

Upstream starts dropbear with no -s/-w (services/startup.sh), so it offers password auth alongside publickey even once authorized_keys is provisioned. The placeholder "alpine" password is only skipped in that case, never actually disabled as an auth method - ssh -v confirms dropbear still lists "password" as a continuing method after a successful pubkey login. Patch services/startup.sh right after checkout, before npm run package builds the ipk, so the ipk's hash is correct by construction instead of needing a rebuild/rehash after the fact. A grep -F assertion fails the build loudly if upstream ever changes this line, rather than silently doing nothing. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

oap added 1 commit

2026-10-25 02:43:21 -07:00

fix: disable dropbear password auth in the built ipk 43160443dc

Upstream starts dropbear with no -s/-w (services/startup.sh), so it
offers password auth alongside publickey even once authorized_keys is
provisioned. The placeholder "alpine" password is only skipped in that
case, never actually disabled as an auth method - ssh -v confirms
dropbear still lists "password" as a continuing method after a
successful pubkey login.

Patch services/startup.sh right after checkout, before npm run
package builds the ipk, so the ipk's hash is correct by construction
instead of needing a rebuild/rehash after the fact. A grep -F
assertion fails the build loudly if upstream ever changes this line,
rather than silently doing nothing.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

oap added 1 commit

2026-10-25 02:46:55 -07:00

refactor: apply our changes to upstream's source as patch files f49cba5bd5

Replace the bespoke sed/grep step with a generic patches/*.patch
mechanism, applied in filename order before the build. Adding a
behavior change on top of upstream's source is now adding a patch
file (git -C src diff > patches/000N-name.patch), not writing new
shell logic into this workflow each time.

git -C src apply <relative patch path> looks for the patch inside
src/, not the invoking shell's cwd - -C changes how git resolves every
relative argument, not just repo-root detection. Pass the patch path
as $PWD/$p to avoid that; caught by testing against a real clone
before trusting it, same as the sed/grep bugs in the previous commit.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

oap force-pushed fix/dropbear-disable-password-auth from f49cba5bd5 to 63907b1d3f

2026-10-25 02:49:28 -07:00

Compare

oap merged commit 63907b1d3f into mainline

2026-10-25 02:50:19 -07:00

oap deleted branch fix/dropbear-disable-password-auth

2026-10-25 02:50:19 -07:00

oap referenced this pull request

2026-10-25 02:54:07 -07:00

Decouple upstream tag from our published version to support rebuilds like v0.7.3.1 #3

oap referenced this pull request

2026-10-25 03:17:18 -07:00

feat: publish rebuilds of an upstream tag as v0.7.3.N #4

Rows
Columns

fix: disable dropbear password auth in the built ipk #2