Re: Call for testing: OpenSSH 10.4

On 7/2/26 01:25, Damien Miller wrote:
> On Wed, 1 Jul 2026, Felix Fehlauer via openssh-unix-dev wrote:
> 
[...]
> 
> That might mean that something is already using port 3322 on your machine.
> 
> Try changing the 'base=33' variable in regress/forwarding.sh to something
> else (e.g. try "94") and see if that helps.
> 
> -d

Sorry for the late reply.

I cannot find anything running on port 3322, but indeed changing the 
base to 94 makes the test pass.

However, unless the tests are executed with the insecure LEGACY crypto 
policy, they still fail with:
[...]
run test cert-userkey.sh ...
[...]
certified user keys: rsa wrong authorized_principals
certified user keys: rsa correct authorized_principals
ssh cert connect failed
certified user keys: rsa authorized_principals bad key opt
certified user keys: rsa authorized_principals command=false
certified user keys: rsa authorized_principals command=true
ssh cert connect failed
certified user keys: rsa wrong principals key option
certified user keys: rsa correct principals key option
ssh cert connect failed
certified user keys: ed25519 authorized_keys connect
[...]
certified user keys: [email protected] authorized_keys 
empty KRL
certified user keys: rsa authorized_keys connect
debug1: mm_log_handler: write: Broken pipe
ssh cert connect failed
certified user keys: rsa authorized_keys revoked key
certified user keys: rsa authorized_keys revoked via KRL
certified user keys: rsa authorized_keys empty KRL
ssh cert connect failed
certified user keys: rsa authorized_keys revoked CA key
[...]
certified user keys: [email protected] 
TrustedUserCAKeys empty KRL
certified user keys: rsa TrustedUserCAKeys connect
debug1: mm_log_handler: write: Broken pipe
ssh cert connect failed
certified user keys: rsa TrustedUserCAKeys revoked key
certified user keys: rsa TrustedUserCAKeys revoked via KRL
certified user keys: rsa TrustedUserCAKeys empty KRL
ssh cert connect failed
certified user keys: rsa TrustedUserCAKeys revoked CA key
[...]
certified user keys: user ecdsa-sha2-nistp521 connect wrong cert
Confirm user presence for key ECDSA-SK 
SHA256:M6j6A0lz9pwtSgplHhu61zh/g3e3DEWhl1eO5WfLtC8
User presence confirmed
certified user keys: user [email protected] connect 
wrong cert
certified user keys: user rsa connect wrong cert
failed certified user keys
[...]

regress/failed-ssh.log then contains lines like:
debug1: libcrypto: 'error:03000098:digital envelope routines::invalid 
digest:crypto/evp/m_sigver.c:265:'
debug1: identity_sign: sshkey_sign: error in libcrypto: invalid digest
sign_and_send_pubkey: signing failed for RSA 
"/tmp/openssh/regress/cert_user_key_rsa": error in libcrypto

So my assumption would be this is due to some RSA-SHA1 usage or the like.

Is this intentional?

Thanks