Production ready releases?

[alexhass]

I‘m confused why releases are still marked as non-production test releases, but Windows 2019 has a production ready OpenSSH server version embedded?

Why is this production ready version not available for older windows versions?

I need to run a sftp server in production on Windows 2016 and try to understand what is wrong with the releases here.

Please document the differences.

[manojampalam]

These releases on GitHub are not officially serviced. If a security issue gets uncovered, a fix may be included in a later release on GitHub, but a patch wont necessarily be issued for a specific version you may be relying on.

[alexhass]

How can I install an „officially serviced“ release on Windows 2016?

[gwojan]

How can I install an „officially serviced“ release on Windows 2016?

Why can't we at least get builds later than last July? 😄

[jborean93]

Does that mean OpenSSH installed through Add-WindowsCapability is not based on the GitHub releases and can contain newer changes?

[manojampalam]

@gwojan we have a couple of features in pipeline and will do a release this month. OpenSSH base has moved to 7.9 and there are some significant changes that we had to get in and ensure Windows support hasn't regressed.

@jborean93 GitHub releases are done more often and should have the latest changes. OpenSSH installed through Add-WindowsCapability is version the comes as part of Windows will typically be based off a previous version of Github release.

[jborean93]

@manojampalam thanks for the update, excited for the new release. While I know we would have to manually update installs from a GitHub zip, do you know if Add-WindowsCapability (or Windows Feature) installs are updated through Windows Update when a new release is available?

[alexhass]

@manojampalam: That sounds now like the complete opposite of what you said first.

These releases on GitHub are not officially serviced. If a security issue gets uncovered, a fix may be included in a later release on GitHub, but a patch wont necessarily be issued for a specific version you may be relying on.

compared to

GitHub releases are done more often and should have the latest changes. OpenSSH installed through Add-WindowsCapability is version the comes as part of Windows will typically be based off a previous version of Github release.

First you said Add-WindowsCapability is newer and may contain security fixes that github does not have and on the other side you say github is updated more often. For me an update also means uncovered security issues are fixed.

Using Add-WindowsCapability - I get an "OpenSSH.Client~~~~0.0.1.0". That is totally different from 7.7.x or 7.9.x. A version like 0.0.1.0 sound like the first DEV build ever and not like a stable one. I'm also not sure this is really the same and if this can be installed on Windows 2016 or earlier.

Finally why are github releases not production ready if they are based on same code?

[manojampalam]

Consider this sample release train above. The latest GiHub release will typically be experimental with new features. Windows official releases are based on stable and thoroughly tested versions of GitHub releases with additional fixes that may go in as needed. These will be officially serviced, so you'll automatically get any security fixes via Windows update.

If you are basing yourself on a V3 version of GitHub release, you wouldn't, automatically, get any patches for any relevant security issues. The hypothetical security fix could make it to V5 of Github release, but you wouldn't want to keeping rev'ing up OpenSSH in your production based on experimental releases of GitHub. HTH.

[alexhass]

I cannot find a 2.x or 3.x branch at https://github.com/PowerShell/Win32-OpenSSH/releases. There is a 1.0 Beta and than it jumps to 7.6.x and 7.7.x. No idea where 2.x and 3.x is. Maybe v7.7.2.0p1-Beta is the version embedded into Windows 2019?

I'm not sure if "OpenSSH.Client~~~~0.0.1.0" is really https://github.com/PowerShell/Win32-OpenSSH/releases/tag/v0.0.1.0 ? Has Microsoft embedded this 3 years old release marked as This is a pre-release (non-production ready) into Windows 2019? I cannot believe this.

What Github version is the version that Microsoft distributes with Windows 2019 - that is serviced and fully supported aka production ready? I'd like to install this production ready version on Windows 2016 and it should be updatable via Windows Update / WSUS for sure.

[manojampalam]

Those were just sample versions. The intent is to explain what it means to say that GitHub releases are not serviced. You're right, 7.7.2.0 is the GitHub release that Windows 2019 version is based on. You will observe that Windows 2019 will have 7.7.2.X to account for any patches on top of 7.7.2.0.

Now the point I was trying to make is that if you rely on 7.7.2.0 on Windows 2016, there is no official install vehicle and servicing pipeline for downlevel Windows platforms, so there is no way you can expect updates via WU/WSUS.

[alexhass]

Now we know that v7.7.2.0 is the official production use version of Windows 2019. On Github it is marked as non-production version. This is not logic.

Still not clear to me how I can install the version available for Windows 2019 on Windows 2016 and earlier in a supported way that also allow me to use WU/WSUS to keep it up to date. Can you share details how to install it on Windows 2016, please?

[rodion-m]

This is a pre-release (non-production ready) label is really confusing. It's sad that Microsoft even not recommend what version should we install on Windows Server 2016.

[anusanraj]

I have the same concern, Want to find stable version to install OpenSSH on Windows server 2012R12. But most of the releases in https://github.com/PowerShell/Win32-OpenSSH/releases are beta versions

[MythreyaK]

Any updates on how official releases are serviced now? I still see the older version in Get-WindowsCapability -Online | ? Name -like 'OpenSSH*'.

[bagajjal]

Next windows update will have OpenSSH V8.1, LibreSSL 3.0.2.

[MythreyaK]

How is it going to be serviced? Windows update or store would be perfect.

[bagajjal]

Through windows update.

[MythreyaK]

I think what he meant was that from 20H1, this package will be serviced through windows update. For now, (even on 1909), you must update manually. See #1317 (comment) and the replies below.

[Flightkick]

@bagajjal Any ETA for the update pushing OpenSSH V8.1, LibreSSL 3.0.2?
On the 11th of February you mentioned next Windows update. Still haven't received an update by now.

[maertendMSFT]

The next update for in-box Win32-OpenSSH will come in 20H2.

[lmayorga1980]

Any updated on the Production Release Readiness?

[bagajjal]

All our GitHub releases are mostly stable releases. Most of the time we ship the same release with few additional fixes (security fixes/bug fixes) depending on the timeline difference between windows inbox release vs GitHub release.

We explicitly call our GitHub releases as a beta. We don't have servicing channels for security fixes for GitHub releases. We don't have any plan to support in the future for GitHub releases.

OpenSSH (server, client) comes as two different windows (windows 10+,windows server 2019+) inbox packages. OpenSSH client package comes by default. OpenSSH server is an optional component, which you need to install on a need basis. For down-level OS, we do support azure VM extensions (which has servicing channel)which you can download by using the below AZ CLI cmdlets,

C:> az vm extension set --publisher "Microsoft.Azure.OpenSSH" -n WindowsOpenSSH --resource-group myrg --vm-name myvm

C:> az vm open-port --resource-group myrg --name myvm --port 22

[bagajjal]

Hope this addresses all the concerns raised / future concerns.
I'm closing this issue.

[mgkuhn]

@maertendMSFT wrote on 12 May 2020:

The next update for in-box Win32-OpenSSH will come in 20H2.

Did anyone here get “the next update for in-box Win32-OpenSSH” in 20H2? I upgraded to 20H2 this morning and I still get OpenSSH_for_Windows_7.7p1, LibreSSL 2.6.5 and OpenSSH.Client~~~~0.0.1.0, see also #1646.

[coocooman3]

@maertendMSFT wrote on 12 May 2020:

The next update for in-box Win32-OpenSSH will come in 20H2.

Did anyone here get “the next update for in-box Win32-OpenSSH” in 20H2? I upgraded to 20H2 this morning and I still get OpenSSH_for_Windows_7.7p1, LibreSSL 2.6.5 and OpenSSH.Client~~~~0.0.1.0, see also #1646.

Updated to 20H2 this morning. Still on OpenSSH_for_Windows_7.7p1, LibreSSL 2.6.5 even after uninstalling and reinstalling through the optional features menu.

[ofer-dev]

@maertendMSFT wrote on 12 May 2020:

The next update for in-box Win32-OpenSSH will come in 20H2.

Did anyone here get “the next update for in-box Win32-OpenSSH” in 20H2? I upgraded to 20H2 this morning and I still get OpenSSH_for_Windows_7.7p1, LibreSSL 2.6.5 and OpenSSH.Client~~~~0.0.1.0, see also #1646.

Same on my PC. Windows 10 20h2, OpenSSH_for_Windows_7.7p1, LibreSSL 2.6.5

[maertendMSFT]

Hi folks, please see #1693 for information regarding updates into Windows