diff --git a/.github/workflows/version-check.yml b/.github/workflows/version-check.yml new file mode 100644 index 0000000..2e653ec --- /dev/null +++ b/.github/workflows/version-check.yml @@ -0,0 +1,45 @@ +name: version-check + +on: + push: + branches: + - main + pull_request: + types: [opened, synchronize, reopened] + +jobs: + check_version: + name: Check version consistency + runs-on: ubuntu-22.04 + steps: + - uses: actions/checkout@v4 + - name: Compare idf_component.yml and libssh_version.h + shell: bash + run: | + set -euo pipefail + HDR=libssh/port/libssh/libssh_version.h + YML=libssh/idf_component.yml + + major=$(sed -n 's/^#define LIBSSH_VERSION_MAJOR[[:space:]]*\([0-9][0-9]*\).*/\1/p' "$HDR") + minor=$(sed -n 's/^#define LIBSSH_VERSION_MINOR[[:space:]]*\([0-9][0-9]*\).*/\1/p' "$HDR") + micro=$(sed -n 's/^#define LIBSSH_VERSION_MICRO[[:space:]]*\([0-9][0-9]*\).*/\1/p' "$HDR") + hdr_ver="${major}.${minor}.${micro}" + + yml_ver=$(sed -n 's/^version:[[:space:]]*"\([^"]*\)".*/\1/p' "$YML") + # Component registry may use "0.12.0~1"; compare the semver before '~' + yml_base=${yml_ver%%~*} + + echo "libssh_version.h: ${hdr_ver}" + echo "idf_component.yml: ${yml_ver} (base ${yml_base})" + + if [[ -z "$major" || -z "$minor" || -z "$micro" || -z "$yml_base" ]]; then + echo "::error::Failed to parse version from $HDR or $YML" + exit 1 + fi + + if [[ "$hdr_ver" != "$yml_base" ]]; then + echo "::error::Version mismatch: ${HDR} has ${hdr_ver}, ${YML} has ${yml_ver}" + exit 1 + fi + + echo "Versions match." diff --git a/README.md b/README.md index 3863727..1185152 100644 --- a/README.md +++ b/README.md @@ -2,21 +2,11 @@ [![Membrowse](https://membrowse.com/badge.svg)](https://membrowse.com/public/david-cermak/libssh) -A minimal ESP-IDF port of libssh. -The purpose of this component is to provide a way to run `sshd` on your ESP32 device, so you can "ssh" into your device. +Embedded ports of [libssh](https://www.libssh.org/) so you can run `sshd` on your device and SSH into it. -## How to use +Supported platforms: -Add the libssh subdirectory to your component list, either using IDF build system or by means of the component yaml file: -``` -dependencies: - libssh: - version: '*' - path: /path/to/the_libssh_directory/ -``` - -## Example - -See the simple server example in [server](libssh/examples/server) +- **[ESP-IDF](libssh/README.md)** — ESP32-class devices +- **[Zephyr](zephyr/README.md)** — Zephyr RTOS boards ![Demo](ssh-demo.gif) diff --git a/libssh/CHANGELOG.md b/libssh/CHANGELOG.md new file mode 100644 index 0000000..cae9dd5 --- /dev/null +++ b/libssh/CHANGELOG.md @@ -0,0 +1,19 @@ +See the upstream [CHANGELOG](libssh-mirror/CHANGELOG) + +0.12.0~2 +- See upstream changes 0.12.0 +- ESP-IDF: Add SBOM-yml +- Port: Fix version header to match component version (0.12.0) + +0.12.0~1 +- See upstream changes 0.12.0 +- Port: Using native mbedtls-v4 support (instead of mbedtls-v3-shim component) +- Port: Switched to submodule upstream (instead of downloading release packages) + +0.12.0 +- See upstream changes 0.12.0 (Support PQC KEX, security fixes) +- Port: Make PQC KEX configurable (Default OFF) + +0.11.0 +- See upstream changes 0.11.0 +- ESP-IDF: Simple ESP32 SSH server diff --git a/libssh/README.md b/libssh/README.md index 5ecf615..fdee3bf 100644 --- a/libssh/README.md +++ b/libssh/README.md @@ -13,20 +13,25 @@ Minimal ESP-IDF component wrapping upstream libssh to run an SSH server on ESP32 - Reference projects live in `examples/`. ### Requirements -- ESP-IDF v5.x (tested with recent v5 releases). +- ESP-IDF v5+ (tested with recent v5 and v6 releases). - Enable networking (Wi‑Fi or Ethernet) in your project. - Recommended: Ed25519 host keys for best performance and security. -### Add to your project (Component Manager) -Add this dependency to your app's `idf_component.yml`: +### How to use + +Add the libssh subdirectory to your component list, either using the IDF build system or via the component YAML file: + +```bash +idf.py add-dependency david-cermak/libssh +``` + +Or pull it from the Component Registry: ```yaml dependencies: david-cermak/libssh: "*" ``` -Or add as a local component via `path` if you vendor the directory into your project. - ### Quick start (examples) Build any of the examples under `examples/` using standard ESP-IDF flow: diff --git a/libssh/idf_component.yml b/libssh/idf_component.yml index 093966e..61c54c6 100644 --- a/libssh/idf_component.yml +++ b/libssh/idf_component.yml @@ -1,4 +1,4 @@ -version: "0.12.0~1" +version: "0.12.0~2" url: https://github.com/david-cermak/libssh license: LGPL-2.1 description: The component provides a general purpose SSH connectivity diff --git a/libssh/port/libssh/libssh_version.h b/libssh/port/libssh/libssh_version.h index 4f49e91..c25dc5d 100644 --- a/libssh/port/libssh/libssh_version.h +++ b/libssh/port/libssh/libssh_version.h @@ -28,7 +28,7 @@ /* libssh version */ #define LIBSSH_VERSION_MAJOR 0 -#define LIBSSH_VERSION_MINOR 11 +#define LIBSSH_VERSION_MINOR 12 #define LIBSSH_VERSION_MICRO 0 #define LIBSSH_VERSION_INT SSH_VERSION_INT(LIBSSH_VERSION_MAJOR, \ diff --git a/libssh/sbom.yml b/libssh/sbom.yml new file mode 100644 index 0000000..29d2f94 --- /dev/null +++ b/libssh/sbom.yml @@ -0,0 +1,7 @@ +name: 'libssh' +supplier: 'David Cermak ' +originator: 'David Cermak ' +description: ESP-IDF component wrapping upstream libssh with an mbedtls crypto backend. Provides SSH2 client/server connectivity for ESP32-class devices; ESP-IDF compatibility shims live under port/. +manifests: + - path: sbom_libssh.yml + dest: libssh-mirror diff --git a/libssh/sbom_libssh.yml b/libssh/sbom_libssh.yml new file mode 100644 index 0000000..99d329f --- /dev/null +++ b/libssh/sbom_libssh.yml @@ -0,0 +1,11 @@ +name: libssh +version: 0.12.0 +cpe: cpe:2.3:a:libssh:libssh:{}:*:*:*:*:*:*:* +supplier: 'Organization: The libssh Project ' +originator: 'Organization: The libssh Project ' +description: Multiplatform C library implementing the SSHv2 protocol (client and server). Vendored via the libssh-mirror submodule (upstream release baseline libssh-0.12.0). ESP-IDF-specific deltas live outside this tree under port/ and patches/. +url: https://www.libssh.org/ +hash: 9b1ce58e5677921ca2815d4f39b42b282c87f12e +cve-exclude-list: + - cve: CVE-2026-3731 + reason: Resolved in 0.11.4 / 0.12.0; current pin is at or past 0.12.0.