Build failure

[abcnorio]

Hello,

the build breaks.

OS = Debian bookworm 12.13

• get sources from today Fr 13. Feb ~10:52:26 CET 2026

git clone https://github.com/open-quantum-safe/openssh.git

• liboqs build runs well.

./oqs-scripts/build_liboqs.sh
[...]
[2161/2161] Linking C executable tests/vectors_kem
+ ninja install
[0/1] Install the project...
-- Install configuration: ""
-- Installing: $HOME/oqs/lib/cmake/liboqs/liboqsConfig.cmake
-- Installing: $HOME/oqs/lib/cmake/liboqs/liboqsConfigVersion.cmake
-- Installing: $HOME/oqs/lib/pkgconfig/liboqs.pc
-- Installing: $HOME/oqs/lib/liboqs.so.0.15.0
-- Up-to-date: $HOME/oqs/lib/liboqs.so.9
-- Up-to-date: $HOME/oqs/lib/liboqs.so
-- Installing: $HOME/oqs/lib/cmake/liboqs/liboqsTargets.cmake
-- Installing: $HOME/oqs/lib/cmake/liboqs/liboqsTargets-noconfig.cmake
-- Up-to-date: $HOME/oqs/include/oqs/oqs.h
-- Up-to-date: $HOME/oqs/include/oqs/aes_ops.h
-- Up-to-date: $HOME/oqs/include/oqs/common.h
-- Up-to-date: $HOME/oqs/include/oqs/rand.h
-- Up-to-date: $HOME/oqs/include/oqs/sha2_ops.h
-- Up-to-date: $HOME/oqs/include/oqs/sha3_ops.h
-- Up-to-date: $HOME/oqs/include/oqs/sha3x4_ops.h
-- Up-to-date: $HOME/oqs/include/oqs/kem.h
-- Up-to-date: $HOME/oqs/include/oqs/sig.h
-- Up-to-date: $HOME/oqs/include/oqs/sig_stfl.h
-- Up-to-date: $HOME/oqs/include/oqs/kem_bike.h
-- Up-to-date: $HOME/oqs/include/oqs/kem_frodokem.h
-- Up-to-date: $HOME/oqs/include/oqs/kem_ntruprime.h
-- Up-to-date: $HOME/oqs/include/oqs/kem_ntru.h
-- Up-to-date: $HOME/oqs/include/oqs/kem_classic_mceliece.h
-- Up-to-date: $HOME/oqs/include/oqs/kem_kyber.h
-- Up-to-date: $HOME/oqs/include/oqs/kem_ml_kem.h
-- Up-to-date: $HOME/oqs/include/oqs/sig_ml_dsa.h
-- Up-to-date: $HOME/oqs/include/oqs/sig_falcon.h
-- Up-to-date: $HOME/oqs/include/oqs/sig_mayo.h
-- Up-to-date: $HOME/oqs/include/oqs/sig_cross.h
-- Up-to-date: $HOME/oqs/include/oqs/sig_uov.h
-- Up-to-date: $HOME/oqs/include/oqs/sig_snova.h
-- Up-to-date: $HOME/oqs/include/oqs/sig_slh_dsa.h
-- Installing: $HOME/oqs/include/oqs/oqsconfig.h

• configure of openssh does not bring up any errors
• actual break of oqs-scripts/build_openssh.sh:

./oqs-scripts/build_openssh.sh
[...]
cc -g -O2 -pipe -Wno-error=format-truncation -Wall -Wextra -Wpointer-arith -Wuninitialized -Wsign-compare -Wformat-security -Wsizeof-pointer-memaccess -Wno-pointer-sign -Wno-unused-parameter -Wno-unused-result -Wimplicit-fallthrough -Wmisleading-indentation -fno-strict-aliasing -D_FORTIFY_SOURCE=2 -ftrapv -fzero-call-used-regs=used -ftrivial-auto-var-init=zero -fno-builtin-memset -fstack-protector-strong -Wno-implicit-function-declaration -I$HOME/oqs-test/tmp/include -fPIE   -I. -I. -I"$HOME/openbsd-compat/include" -I$HOME/oqs/include -I/usr/include  -D_XOPEN_SOURCE=600 -D_BSD_SOURCE -D_DEFAULT_SOURCE -D_GNU_SOURCE -DOPENSSL_API_COMPAT=0x10100000L -DSSHDIR=\"$HOME/oqs-test/tmp\" -D_PATH_SSH_PROGRAM=\"$HOME/oqs-test/tmp/bin/ssh\" -D_PATH_SSH_ASKPASS_DEFAULT=\"$HOME/oqs-test/tmp/libexec/ssh-askpass\" -D_PATH_SFTP_SERVER=\"$HOME/oqs-test/tmp/libexec/sftp-server\" -D_PATH_SSH_KEY_SIGN=\"$HOME/oqs-test/tmp/libexec/ssh-keysign\" -D_PATH_SSHD_SESSION=\"$HOME/oqs-test/tmp/libexec/sshd-session\" -D_PATH_SSHD_AUTH=\"$HOME/oqs-test/tmp/libexec/sshd-auth\" -D_PATH_SSH_PKCS11_HELPER=\"$HOME/oqs-test/tmp/libexec/ssh-pkcs11-helper\" -D_PATH_SSH_SK_HELPER=\"$HOME/oqs-test/tmp/libexec/ssh-sk-helper\" -D_PATH_SSH_PIDDIR=\"/var/run\" -D_PATH_PRIVSEP_CHROOT_DIR=\"/var/empty\" -DHAVE_CONFIG_H -c ssh-oqs.c -o ssh-oqs.o
ssh-oqs.c: In function ‘oqs_sig_pk_len’:
ssh-oqs.c:59:61: error: ‘OQS_SIG_sphincs_sha2_128f_simple_length_public_key’ undeclared (first use in this function); did you mean ‘OQS_SIG_cross_rsdp_128_small_length_public_key’?
   59 |     case KEY_ECDSA_NISTP256_SPHINCS_SHA2_128F_SIMPLE:return OQS_SIG_sphincs_sha2_128f_simple_length_public_key;
      |                                                             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      |                                                             OQS_SIG_cross_rsdp_128_small_length_public_key
ssh-oqs.c:59:61: note: each undeclared identifier is reported only once for each function it appears in
ssh-oqs.c:61:61: error: ‘OQS_SIG_sphincs_sha2_256f_simple_length_public_key’ undeclared (first use in this function); did you mean ‘OQS_SIG_cross_rsdp_256_small_length_public_key’?
   61 |     case KEY_ECDSA_NISTP521_SPHINCS_SHA2_256F_SIMPLE:return OQS_SIG_sphincs_sha2_256f_simple_length_public_key;
      |                                                             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      |                                                             OQS_SIG_cross_rsdp_256_small_length_public_key
ssh-oqs.c: In function ‘oqs_sig_sk_len’:
ssh-oqs.c:96:14: error: ‘OQS_SIG_sphincs_sha2_128f_simple_length_secret_key’ undeclared (first use in this function); did you mean ‘OQS_SIG_cross_rsdp_128_small_length_secret_key’?
   96 |       return OQS_SIG_sphincs_sha2_128f_simple_length_secret_key;
      |              ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      |              OQS_SIG_cross_rsdp_128_small_length_secret_key
ssh-oqs.c:99:14: error: ‘OQS_SIG_sphincs_sha2_256f_simple_length_secret_key’ undeclared (first use in this function); did you mean ‘OQS_SIG_cross_rsdp_256_small_length_secret_key’?
   99 |       return OQS_SIG_sphincs_sha2_256f_simple_length_secret_key;
      |              ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      |              OQS_SIG_cross_rsdp_256_small_length_secret_key
ssh-oqs.c: In function ‘ssh_sphincssha2128fsimple_sign’:
ssh-oqs.c:747:32: error: ‘OQS_SIG_alg_sphincs_sha2_128f_simple’ undeclared (first use in this function)
  747 |     OQS_SIG *sig = OQS_SIG_new(OQS_SIG_alg_sphincs_sha2_128f_simple);
      |                                ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
ssh-oqs.c: In function ‘ssh_sphincssha2128fsimple_verify’:
ssh-oqs.c:765:32: error: ‘OQS_SIG_alg_sphincs_sha2_128f_simple’ undeclared (first use in this function)
  765 |     OQS_SIG *sig = OQS_SIG_new(OQS_SIG_alg_sphincs_sha2_128f_simple);
      |                                ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
ssh-oqs.c: In function ‘ssh_sphincssha2256fsimple_sign’:
ssh-oqs.c:825:32: error: ‘OQS_SIG_alg_sphincs_sha2_256f_simple’ undeclared (first use in this function)
  825 |     OQS_SIG *sig = OQS_SIG_new(OQS_SIG_alg_sphincs_sha2_256f_simple);
      |                                ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
ssh-oqs.c: In function ‘ssh_sphincssha2256fsimple_verify’:
ssh-oqs.c:843:32: error: ‘OQS_SIG_alg_sphincs_sha2_256f_simple’ undeclared (first use in this function)
  843 |     OQS_SIG *sig = OQS_SIG_new(OQS_SIG_alg_sphincs_sha2_256f_simple);
      |                                ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
make: *** [Makefile:214: ssh-oqs.o] error 1

Thanks!

[abcnorio]

The snapshot from 2025-05 builds without any problems. It would be good if some automated note can be generated for which git version of liboqs the openssh version here builds.

[alharrison]

Hey abc, thank you for letting us know. It looks like the problem is caused because we are behind on updating the name for the sphincs references. When you build the snapshot, did you pull a new libOQS or did you use the referenced 0.13.0 version?

Thank you!

[abcnorio]

Indeed, I pulled a new libOQS and built later your snapshot with the referenced 0.13.0 version which worked without any problems. Will re-try your recent git status with the referenced 0.13.0. The

./oqs-scripts/clone_liboqs.sh

just uses a git pull and has no reference included. Maybe one can change that to a reference working libOQS version?

[abcnorio]

just tried with a changed ./oqs-scripts/clone_liboqs.sh

TAG="0.13.0"
rm -rf oqs-scripts/tmp && mkdir oqs-scripts/tmp
#git clone --branch ${LIBOQS_BRANCH} --single-branch ${LIBOQS_REPO} oqs-scripts/tmp/liboqs
git clone --branch ${LIBOQS_BRANCH} ${LIBOQS_REPO} oqs-scripts/tmp/liboqs
pushd oqs-scripts/tmp/liboqs
git checkout tags/$TAG

No idea whether that suits your preferences, but it works and builds just fine. The liboqs version (tag) is here hardcoded.

[alharrison]

I think we need to get up to date with the updated provider. I've opened up a PR to do this.