[ellert]

This PR updates gsissh ro version 10.3p1 that compiles with OpenSSL 4.

[msalle]

For 8 and 9 the build/test/deploy scripts fail for gsissh, on a missing install tool, for 10 it doesn't seen to be a problem:
https://github.com/gridcf/gct/actions/runs/29684163550/job/88185459711?pr=247#step:3:7244

=== configuring in gsi_openssh/source (/gct/gsi_openssh/source)
configure: running /bin/sh ./configure.gnu --disable-option-checking '--prefix=/gct'  '--enable-silent-rules' '--disable-gram5' '--enable-myproxy' --cache-file=/dev/null --srcdir=.
configure: error: cannot find install-sh, install.sh, or shtool in "." "./.." "./../.."
configure: error: ./configure.gnu failed for gsi_openssh/source

and for 10 we have a problem with make dist, but oddly only for the gram5 one this is fatal:
https://github.com/gridcf/gct/actions/runs/29684163550/job/88185459723?pr=247#step:4:2538

2026-07-19T11:24:03.1463441Z make[1]: Entering directory '/gct/gsi_openssh/source'
2026-07-19T11:24:03.1465370Z make[1]: *** No rule to make target 'dist'.  Stop.
2026-07-19T11:24:03.1465715Z make[1]: Leaving directory '/gct/gsi_openssh/source'
2026-07-19T11:24:03.1468633Z make: *** [Makefile:2755: gsi-openssh-dist] Error 2

I also see an error in the myproxy/ssh but somehow it doesn't seem fatal:
https://github.com/gridcf/gct/actions/runs/29684163550/job/88185459720?pr=247#step:3:15305

2026-07-19T11:20:17.7302796Z make[4]: Entering directory '/gct/gsi_openssh/source'
2026-07-19T11:20:17.7306594Z make[4]: *** No rule to make target 'check'.  Stop.
2026-07-19T11:20:17.7307008Z make[4]: Leaving directory '/gct/gsi_openssh/source'
2026-07-19T11:20:17.7307858Z make[3]: *** [Makefile:2753: gsi-openssh-check] Error 2
2026-07-19T11:20:17.7309067Z make[3]: Leaving directory '/gct'
2026-07-19T11:20:17.7313334Z make[2]: Leaving directory '/gct'
2026-07-19T11:20:17.7314413Z make[2]: *** [Makefile:2866: check-local] Error 1
2026-07-19T11:20:17.7316316Z make[1]: *** [Makefile:781: check-am] Error 2
2026-07-19T11:20:17.7316791Z make[1]: Leaving directory '/gct'
2026-07-19T11:20:17.7320771Z make: *** [Makefile:482: check-recursive] Error 1

[fscheiner]

Looks good to me.

Where we keep the original functions from openssh-portable for builds with pre OpenSSL 3.x, we should maybe make clear, that we use the functions from the same OpenSSH version. But as they didn't change since 10.0p1 (I checked to be sure of it) it's not an issue and the comments are hence correct as is, too.

[fscheiner]

I test(-built) this also on Rocky Linux 8 and it works well:

[johndoe@gridftp-5 bin]$ sudo ~/bin/test-gss-kex-for-gsi-openssh.bash gridftp-5.machine-hall.org johndoe2
gsisshd: OpenSSH_10.3p1c-GSI_hpn18.9.0 GSI, OpenSSL 1.1.1k  FIPS 25 Mar 2021
gsissh: OpenSSH_10.3p1c-GSI_hpn18.9.0 GSI, OpenSSL 1.1.1k  FIPS 25 Mar 2021

Wait 3 seconds for startup of gsisshd ...

gss-gex-sha1- OK ( plus johndoe => johndoe2 )
gss-group1-sha1- OK ( plus johndoe => johndoe2 )
gss-group14-sha256- OK ( plus johndoe => johndoe2 )
gss-nistp256-sha256- OK ( plus johndoe => johndoe2 )
gss-curve25519-sha256- OK ( plus johndoe => johndoe2 )
gss-group16-sha512- OK ( plus johndoe => johndoe2 )

[fscheiner]

I also wanted to test(-build) this under current Debian Sid with OpenSSL 4.x installed, but this will require a little extra, as there's no FIPS support in Debian's OpenSSL IINM.

But as the current PR works as is, we should merge this right now and provide a patch to enable builds nder Debian (Sid) later.

[fscheiner]

Merging it now...

[fscheiner]

@ellert : Thanks for providing the update! :-)