[r39.2] ota_make_recovery_img_dtb.sh fails on hosts with OpenSSH >= 10 — "command is failed"

Robotics & Edge Computing Jetson Systems Jetson AGX Orin
1

Summary

flash.sh aborts during recovery-ramdisk generation on any flashing host running
OpenSSH 10 or newer, because ota_make_recovery_img_dtb.sh unconditionally
generates a DSA host key. OpenSSH 10 removed DSA entirely.

The failure message gives no indication of the cause.

Environment

  • Jetson AGX Orin Developer Kit, 64 GB module (P3701-0005, FAB 501)
  • Jetson Linux r39.2.0 (JetPack 7.2), Jetson_Linux_r39.2.0_aarch64.tbz2
  • Flash host: Debian 13 (trixie) x86_64, OpenSSH_10.0p2, OpenSSL 3.5.6

Steps to reproduce

  1. Unpack the BSP and sample rootfs, run apply_binaries.sh.

  2. Put the AGX Orin in Force Recovery.

  3. Run:

    sudo ./tools/kernel_flash/l4t_initrd_flash.sh \
  -c tools/kernel_flash/flash_l4t_t234_nvme.xml \
  --external-device nvme0n1p1 \
  --erase-all --showlogs --network usb0 \
  jetson-agx-orin-devkit external

Observed

Making recovery ramdisk for recovery image...
Re-generating recovery ramdisk for recovery image...
.../bootloader/ramdisk_tmp .../bootloader .../Linux_for_Tegra
58950 blocks
_BASE_KERNEL_VERSION=6.8.12-1021-tegra
command is failed
Error: Failed to generate images for external device

Root cause

Linux_for_Tegra/tools/ota_tools/version_upgrade/ota_make_recovery_img_dtb.sh,
line 117, inside prepare_sshd_files():

ssh-keygen -t dsa -N "" -f "${_initrd_dir}/${ssh_config_dir}/ssh_host_dsa_key" >/dev/null 2>&1;check_error

On OpenSSH >= 10:

$ ssh-keygen -t dsa -N "" -f /tmp/x ; echo $?
unknown key type dsa
255

check_error is called with no argument, so it prints the generic
command is failed and exits — hiding both the failing command and its reason.

DSA was deprecated in OpenSSH 9.8 and removed in 10.0. Ubuntu 22.04 (8.9) and
24.04 (9.6) still have it, which is presumably why this has not surfaced
in-house. It will affect Debian 13, Fedora 42+, Arch, and any host tracking
current OpenSSH.

Suggested fix

The DSA key is never used — prepare_sshd_files() writes an sshd_config that
declares HostKey for rsa, ecdsa and ed25519 only. Simply removing the line is
correct. If you want to keep it for older hosts, make it conditional:

if ssh-keygen -t dsa -N "" -f /tmp/.probe >/dev/null 2>&1; then
    rm -f /tmp/.probe /tmp/.probe.pub
    ssh-keygen -t dsa -N "" -f "${_initrd_dir}/${ssh_config_dir}/ssh_host_dsa_key" >/dev/null 2>&1
fi

Separately: please pass a message to every check_error call. A bare
command is failed after ~40 lines of unrelated output is very hard to trace.

Workaround

sed -i '/ssh-keygen -t dsa/s|^|#|' \
  Linux_for_Tegra/tools/ota_tools/version_upgrade/ota_make_recovery_img_dtb.sh

Confirmed working — flashed successfully to NVMe afterwards.

3

Worth noting this was already reported in April for r39.2’s predecessor — Removing dsa key generation on ota_make_recovery_img_dtb.sh — and closed with “okay to comment out that”. r39.2 shipped in June with the line unchanged.

The workaround is fine for individuals, but the affected host population only grows: Debian 13, Fedora 42+ and Arch are all on OpenSSH >= 10 today, and Ubuntu will follow. Since prepare_sshd_files() writes an sshd_config that declares HostKey for rsa/ecdsa/ed25519 only, the DSA key is never used — deleting the line costs nothing.

The check_error call with no message is the separate issue: it turns a one-line fix into an hour of bisecting.