Merge ~kajiya/ubuntu/+source/openssh:lp1952421-sshd-matching-certs-focal into ubuntu/+source/openssh:ubuntu/focal-devel

[Chloé Smith]

sbuild results

+------------------------------------------------------------------------------+
| Post Build |
+------------------------------------------------------------------------------+

+------------------------------------------------------------------------------+
| Cleanup |
+------------------------------------------------------------------------------+

Purging /<<BUILDDIR>>
Not cleaning session: cloned chroot in use

+------------------------------------------------------------------------------+
| Summary |
+------------------------------------------------------------------------------+

Build Architecture: amd64
Build Type: full
Build-Space: 153028
Build-Time: 471
Distribution: focal
Host Architecture: amd64
Install-Time: 77
Job: /home/kajiya/Desktop/sruu/openssh_8.2p1-4ubuntu0.4.dsc
Lintian: fail
Machine Architecture: amd64
Package: openssh
Package-Time: 659
Source-Version: 1:8.2p1-4ubuntu0.4
Space: 153028
Status: successful
Version: 1:8.2p1-4ubuntu0.4
--------------------------------------------------------------------------------
Finished at 2021-12-02T22:54:44Z
Build needed 00:10:59, 153028k disk space

[Chloé Smith (kajiya)]

@utkarsh

Soooo we have an error when we run autopkgtest :S

```````````````````````````````````````
autopkgtest [23:04:01]: testing package openssh version 1:8.2p1-4ubuntu0.4
autopkgtest [23:04:01]: build not needed
autopkgtest [23:04:45]: test regress: preparing testbed
Get:1 file:/tmp/autopkgtest.rmLHnm/binaries InRelease
Ign:1 file:/tmp/autopkgtest.rmLHnm/binaries InRelease
Get:2 file:/tmp/autopkgtest.rmLHnm/binaries Release [816 B]
Get:2 file:/tmp/autopkgtest.rmLHnm/binaries Release [816 B]
Get:3 file:/tmp/autopkgtest.rmLHnm/binaries Release.gpg
Ign:3 file:/tmp/autopkgtest.rmLHnm/binaries Release.gpg
Get:4 file:/tmp/autopkgtest.rmLHnm/binaries Packages [9,796 B]
Reading package lists...
Reading package lists...
Building dependency tree...
Reading state information...
Starting pkgProblemResolver with broken count: 3
Starting 2 pkgProblemResolver with broken count: 3
Investigating (0) openssh-client:amd64 < 1:8.2p1-4ubuntu0.3 -> 1:8.4p1-5ubuntu1.2 @ii pumU Ib >
Broken openssh-client:amd64 Depends on libc6:amd64 < 2.31-0ubuntu9.2 @ii mK > (>= 2.33)
Broken openssh-client:amd64 Depends on libfido2-1:amd64 < 1.3.1-1ubuntu2 @ii mK > (>= 1.5.0)
Broken openssh-client:amd64 Depends on libselinux1:amd64 < 3.0-1build2 @ii mK > (>= 3.1~)
Investigating (0) openssh-server:amd64 < 1:8.2p1-4ubuntu0.3 -> 1:8.4p1-5ubuntu1.2 @ii pumU Ib >
Broken openssh-server:amd64 Depends on libc6:amd64 < 2.31-0ubuntu9.2 @ii mK > (>= 2.33)
Broken openssh-server:amd64 Depends on libselinux1:amd64 < 3.0-1build2 @ii mK > (>= 3.1~)
Investigating (0) openssh-sftp-server:amd64 < 1:8.2p1-4ubuntu0.3 -> 1:8.4p1-5ubuntu1.2 @ii pumU Ib >
Broken openssh-sftp-server:amd64 Depends on libc6:amd64 < 2.31-0ubuntu9.2 @ii mK > (>= 2.33)
Done
Some packages could not be installed. This may mean that you have
requested an impossible situation or if you are using the unstable
distribution that some required packages have not yet been created
or been moved out of Incoming.
The following information may help to resolve the situation:

The following packages have unmet dependencies:
 openssh-client : Depends: libc6 (>= 2.33) but 2.31-0ubuntu9.2 is to be installed
                  Depends: libfido2-1 (>= 1.5.0) but 1.3.1-1ubuntu2 is to be installed
                  Depends: libselinux1 (>= 3.1~) but 3.0-1build2 is to be installed
 openssh-server : Depends: libc6 (>= 2.33) but 2.31-0ubuntu9.2 is to be installed
                  Depends: libselinux1 (>= 3.1~) but 3.0-1build2 is to be installed
 openssh-sftp-server : Depends: libc6 (>= 2.33) but 2.31-0ubuntu9.2 is to be installed
W: --force-yes is deprecated, use one of the options starting with --allow instead.
E: Unable to correct problems, you have held broken packages.
blame: arg:../openssh-client_8.2p1-4ubuntu0.4_amd64.deb deb:openssh-client arg:../openssh-client_8.4p1-5ubuntu1.2_amd64.deb deb:openssh-client arg:../openssh-server_8.2p1-4ubuntu0.4_amd64.deb deb:opens.
badpkg: installation of basic binaries failed, exit code 100
autopkgtest [23:04:49]: ERROR: erroneous package: installation of basic binaries failed, exit code 100
qemu-system-x86_64: terminating on signal 15 from pid 284096 (/usr/bin/python3)

````````````````````````````...

[Utkarsh Gupta (utkarsh)]

Hi Chloe,

> I'm assuming this is because it doesn't like the version
> I incremented using dch -i (1:8.2p1-4ubuntu0.4), but I'm
> not sure how to proceed. Any advice would be appreciated :D

Oh no, you did everything well! The version increment is absolutely correct and so is everything else (though a minor nitpick mentioned below in comments).

I've gone through your trace above and I feel that you're running this autopkgtest for another suite. I mean, either the debs produced are for Hirsute and you're running them in the Focal image or the other way round. But that said, I could build the package successfully and ran all the autopkgtests, too, via `autopkgtest -U -s --apt-pocket=proposed -B ../*.deb -- qemu ~/ubuntu/images/autopkgtest-focal-amd64.img` and here are the results:

autopkgtest [17:14:46]: test regress: -----------------------]
autopkgtest [17:14:47]: test regress: - - - - - - - - - - results - - - - - - - - - -
regress PASS
autopkgtest [17:14:47]: @@@@@@@@@@@@@@@@@@@@ summary
regress PASS

..and so since everything else looks good, I've sponsored this upload as well:
$ dput ubuntu ../openssh_8.2p1-4ubuntu0.4_source.changes
Checking signature on .changes
gpg: ../openssh_8.2p1-4ubuntu0.4_source.changes: Valid signature from 823E967606C34B96
Checking signature on .dsc
gpg: ../openssh_8.2p1-4ubuntu0.4.dsc: Valid signature from 823E967606C34B96
Package includes an .orig.tar.gz file although the debian revision suggests
that it might not be required. Multiple uploads of the .orig.tar.gz may be
rejected by the upload queue management software.
Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading openssh_8.2p1-4ubuntu0.4.dsc: done.
  Uploading openssh_8.2p1.orig.tar.gz: done.
  Uploading openssh_8.2p1-4ubuntu0.4.debian.tar.xz: done.
  Uploading openssh_8.2p1-4ubuntu0.4_source.buildinfo: done.
  Uploading openssh_8.2p1-4ubuntu0.4_source.changes: done.
Successfully uploaded packages.

review: Approve

Unmerged commits

96e7637... by Chloé Smith on 2021-12-02

* Update d/ch for 1:8.2p1-4ubuntu0.4 release

diff --git a/debian/changelog b/debian/changelog
index c7904a4..1a9555f 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,11 @@
+openssh (1:8.2p1-4ubuntu0.4) focal; urgency=medium
+
+  * d/p/match-host-certs-w-public-keys.patch: Add patch
+    to match host certificates agianst host public keys.
+    (LP: #1952421 
+
+ -- Chloé S <[e-mail]>  Thu, 02 Dec 2021 22:38:52 +0000
+
 openssh (1:8.2p1-4ubuntu0.3) focal; urgency=medium
 
   * d/systemd/ssh@.service: preserve the systemd managed runtime directory to
diff --git a/debian/patches/match-host-certs-w-public-keys.patch b/debian/patches/match-host-certs-w-public-keys.patch
new file mode 100644
index 0000000..2f4d509
--- /dev/null
+++ b/debian/patches/match-host-certs-w-public-keys.patch
@@ -0,0 +1,30 @@
+Description: Match host certificates against host public keys
+ not private keys. Allows use of certificates with private keys
+ held in a ssh-agent.
+Origin: upstream
+Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=3254
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/1952421
+Forwarded: not-needed
+Applied-Upstream: https://github.com/openssh/openssh-portable/commit/530739d4
+
+From 530739d42f6102668aecd699be0ce59815c1eceb Mon Sep 17 00:00:00 2001
+From: "[e-mail]" <[e-mail]>
+Date: Sun, 6 Jun 2021 11:34:16 +0000
+Reported by Miles Zhou in bz3524; ok dtucker@
+OpenBSD-Commit-ID: 25f5bf70003126d19162862d9eb380bf34bac22a
+
+---
+ sshd.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/sshd.c
++++ b/sshd.c
+@@ -1896,7 +1896,7 @@
+ 		/* Find matching private key */
+ 		for (j = 0; j < options.num_host_key_files; j++) {
+ 			if (sshkey_equal_public(key,
+-			    sensitive_data.host_keys[j])) {
++			    sensitive_data.host_pubkeys[j])) {
+ 				sensitive_data.host_certificates[j] = key;
+ 				break;
+ 			}
diff --git a/debian/patches/series b/debian/patches/series
index b5b84a9..0d109af 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -25,3 +25,4 @@ conch-old-privkey-format.patch
 revert-ipqos-defaults.patch
 lp-1876320-upstream-Do-not-call-process_queued_listen_addrs-for.patch
 CVE-2021-28041.patch
+match-host-certs-w-public-keys.patch