git: 0b707d5fe8b6 - main - ssh: Disable support for DSA keys

The branch main has been updated by emaste:

URL: https://cgit.FreeBSD.org/src/commit/?id=0b707d5fe8b6b1920eb29c6375a6be92b7e44758

commit 0b707d5fe8b6b1920eb29c6375a6be92b7e44758
Author:     Ed Maste <emaste@FreeBSD.org>
AuthorDate: 2025-02-09 20:41:12 +0000
Commit:     Ed Maste <emaste@FreeBSD.org>
CommitDate: 2025-02-10 20:54:25 +0000

    ssh: Disable support for DSA keys
    
    This is the upstream default -- from the 9.8p1 release notes:
    
    Future deprecation notice
    =========================
    
    OpenSSH plans to remove support for the DSA signature algorithm in
    early 2025. This release disables DSA by default at compile time.
    
    DSA, as specified in the SSHv2 protocol, is inherently weak - being
    limited to a 160 bit private key and use of the SHA1 digest. Its
    estimated security level is only 80 bits symmetric equivalent.
    
    OpenSSH has disabled DSA keys by default since 2015 but has retained
    run-time optional support for them. DSA was the only mandatory-to-
    implement algorithm in the SSHv2 RFCs, mostly because alternative
    algorithms were encumbered by patents when the SSHv2 protocol was
    specified.
    
    This has not been the case for decades at this point and better
    algorithms are well supported by all actively-maintained SSH
    implementations. We do not consider the costs of maintaining DSA
    in OpenSSH to be justified and hope that removing it from OpenSSH
    can accelerate its wider deprecation in supporting cryptography
    libraries.
    
    This release, and its deactivation of DSA by default at compile-time,
    marks the second step in our timeline to finally deprecate DSA. The
    final step of removing DSA support entirely is planned for the first
    OpenSSH release of 2025.
    
    ---
    
    The config.h comment /* DSA keys explicitly enabled */ is somewhat
    confusing, but this is what upstream's ./configure generates.
    
    Reviewed by:    jlduran
    Relnotes:       Yes
    Sponsored by:   The FreeBSD Foundation
    Differential Revision: https://reviews.freebsd.org/D48910
---
 crypto/openssh/config.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/crypto/openssh/config.h b/crypto/openssh/config.h
index aedacd88df10..29f73831ad7b 100644
--- a/crypto/openssh/config.h
+++ b/crypto/openssh/config.h
@@ -1977,8 +1977,8 @@
 /* Define if you want to enable AIX4's authenticate function */
 /* #undef WITH_AIXAUTHENTICATE */
 
-/* Define if to enable DSA keys. */
-#define WITH_DSA 1
+/* DSA keys explicitly enabled */
+/* #undef WITH_DSA */
 
 /* Define if you have/want arrays (cluster-wide session management, not C
    arrays) */