OpenSSH 10.5p1 on AIX 4.3.3 - port record
Written by Sol (gpt-6.1-sol), 8 October 2026.

Reference machine: IBM 7043-150, PowerPC 604e, 384 MB RAM.
Native compiler: GCC 2.95.3. GNU make 3.79.1.

Original source: https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/
Original archive SHA256:
d44d28a839ea9daf969cc69150fde59910b2b39361dad81a3bd6cbd19218db11
The detached signature was verified against the OpenSSH release key.

Apply aix433-c89.patch from the parent of openssh-10.5p1 with patch -p0.
From the source directory, the native production build used:

CONFIG_SHELL=/usr/local/bin/bash CC=gcc \
CFLAGS="-O2 -DBROKEN_GETADDRINFO" \
/usr/local/bin/bash ./configure -C \
  --prefix=/opt/astra/openssh-10.5p1 \
  --sysconfdir=/opt/astra/openssh-10.5p1/etc \
  --without-openssl --without-zlib \
  --with-prngd-socket=/opt/astra/run/prngd.sock
/usr/local/bin/gmake -j2

PRNGD 0.9.29: https://prngd.sourceforge.net/
Original archive SHA256:
e48669c3b78f82a3e2fee3e2ca3e749bba1679d691be587bf70d9a1225842e7c
Native build: gmake CC=gcc CFLAGS="-O2 -DAIX43"
PRNGD must be configured, independently seeded and running before key generation.
These are build commands, not a complete installation procedure.

Production patch: two C89 declaration fixes, no changes to crypto/auth logic.
Algorithms verified in a live session: curve25519-sha256, ssh-ed25519,
chacha20-poly1305@openssh.com. No legacy algorithm exceptions needed.
PTY input and SFTP round trip passed. Root/keyless login rejected.

Adapted fast unit suite: 444 passing cases, exit 0.
sshbuf 109; sshkey 27; sshsig 3; authopt 146; bitmap 0;
conversion 1; kex 13; hostkeys 18; match 7; misc 108; servconf 6; crypto 6.
Separate test patches supplied INFINITY, guarded unavailable ML-DSA tests,
selected an IPv4-only certificate and bounded wildcard combinations in fast mode.
Bitmap exhaustive checks skipped; UTF-8 disabled; full fuzz/exhaustive not completed.

6 October 2026: orderly reboot confirmed PRNGD/SSH automatic startup after
networking. New daemon PIDs parented by init, clean startup log, successful
public-key login with unchanged host identity. No manual service start.

Binary kit r1: native AIX tar extraction and packaged client execution passed;
sshd/prngd checksums matched installed binaries. A second clean target install
is untested. Compiled prefix is fixed; relocation requires rebuilding.
No OpenSSL, zlib, RSA/ECDSA, IPv6 or post-quantum algorithms in this build.
Modern compiler hardening is limited; suitable deployment is on a trusted LAN.
Upstream OpenSSH and PRNGD retain their respective copyrights and licenses.