Bug#1116363: openssh-client: ssh-sk-helper links libcbor.so.0.8 on trixie but only libcbor.so.0.10 is available

Package: openssh-client
Version: 1:10.0p1-7
Severity: normal
X-Debbugs-Cc: [email protected]

Dear Maintainer,


   * What led up to the situation?

     Using and existing FIDO2/ecdsa-sk key will fail silently or with unspecific error messages like "agent refused the action".
     
     Creating a FIDO2 ssh-key with the following command will expose the problem:

        ssh-keygen -t ecdsa-sk -O resident -O verify-required -C "

     I then checked:

        ldd /usr/lib/openssh/ssh-sk-helper | egrep 'libcbor'
            libcbor.so.0.8 => not found

     and:

        /sbin/ldconfig -p | grep libcbor
            libcbor.so.0.10 (libc6,x86-64) => /lib/x86_64-linux-gnu/libcbor.so.0.10
            libcbor.so (libc6,x86-64) => /lib/x86_64-linux-gnu/libcbor.so

     libcbor.0.8 is not available on Debian Trixie.
     

   * What exactly did you do (or not do) that was effective (or
     ineffective)?

     I linked the new library, which seems to work.


-- System Information:
Debian Release: 13.1
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 6.12.48+deb13-amd64 (SMP w/8 CPU threads; PREEMPT)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US:en
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages openssh-client depends on:
ii  adduser              3.152
ii  init-system-helpers  1.69~deb13u1
ii  libc6                2.41-12
ii  libedit2             3.1-20250104-1
ii  libfido2-1           1.15.0-1+b1
ii  libgssapi-krb5-2     1.21.3-5
ii  libselinux1          3.8.1-1
ii  libssl3t64           3.5.1-1
ii  passwd               1:4.17.4-2
ii  zlib1g               1:1.3.dfsg+really1.3.1-1+b1

Versions of packages openssh-client recommends:
ii  xauth  1:1.1.2-1.1

Versions of packages openssh-client suggests:
pn  keychain      <none>
pn  libpam-ssh    <none>
pn  monkeysphere  <none>
pn  ssh-askpass   <none>

-- no debconf information