[dropbear] fix #5661: patch to allow g+w and o+w to the user's homedi…

…r, ~/.ssh, and ~/.ssh/authorized_keys

We are don't expect other users beside root and gitpod, so it should be fine to loosen permission constaints by dropbear.

components/supervisor/BUILD.yaml

@@ -41,7 +41,7 @@ packages:
       commands:
         - ["curl", "-OL", "https://matt.ucc.asn.au/dropbear/dropbear-2020.81.tar.bz2"]
         - ["tar", "xjf", "dropbear-2020.81.tar.bz2"]
-        - ["sh", "-c", "cd dropbear-2020.81; ./configure --enable-static && sed -i '/clearenv();/d' svr-chansession.c && sed -i '/addnewvar(\"PATH\", DEFAULT_PATH);/d' svr-chansession.c && make"]
+        - ["sh", "-c", "cd dropbear-2020.81; ./configure --enable-static && sed -i '/clearenv();/d' svr-chansession.c && sed -i '/addnewvar(\"PATH\", DEFAULT_PATH);/d' svr-chansession.c && sed -i 's/filestat.st_mode & (S_IWGRP | S_IWOTH)/0/g' svr-authpubkey.c && make"]
         - ["mv", "dropbear-2020.81/dropbear", "dropbear"]
         - ["mv", "dropbear-2020.81/dropbearkey", "dropbearkey"]
         - ["rm", "-rf", "dropbear-2020.81*"]