Merge ~michal-maloszewski99/ubuntu/+source/openssh:fix-outdated-ssh into ubuntu/+source/openssh:ubuntu/focal

[Michał Małoszewski]

[Andreas Hasenack (ahasenack)]

Grabbing this, some changes requested.

review: Needs Fixing

Unmerged commits

5793845... by Michał Małoszewski on 2022-07-26

changelog

388c3ee... by Michał Małoszewski on 2022-07-26

Fix ssh_config(5) which contains outdated information (LP: #1871465)

diff --git a/debian/changelog b/debian/changelog
index e9ee5d1..bb7123d 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+openssh (1:8.2p1-4ubuntu0.1) UNRELEASED; urgency=medium
+
+  * d/p/fix-outdated-info-ssh-conf.patch: Fix outdated information
+    (LP: #1871465)
+
+ -- Michal Maloszewski <[e-mail]>  Tue, 26 Jul 2022 21:51:55 +0200
+
 openssh (1:8.2p1-4) unstable; urgency=medium
 
   * Add /etc/ssh/ssh_config.d/ to openssh-client.
diff --git a/debian/patches/fix-outdated-info-ssh-conf.patch b/debian/patches/fix-outdated-info-ssh-conf.patch
new file mode 100644
index 0000000..b959a67
--- /dev/null
+++ b/debian/patches/fix-outdated-info-ssh-conf.patch
@@ -0,0 +1,54 @@
+Description: Fix outdated information in ssh_config.5
+ The release of OpenSSH 8.2 has removed 'ssh-rsa' from
+ the default list of CACertificateAlgorithms. 
+ .
+ openssh (1:8.2p1-4) unstable; urgency=medium
+ .
+   * Add /etc/ssh/ssh_config.d/ to openssh-client.
+   * Add /etc/ssh/sshd_config.d/ to openssh-server (closes: #952427).
+   * Install ssh-sk-helper even on non-Linux architectures, though it will
+     need an external middleware library in those cases.
+Author: Colin Watson <[e-mail]>
+Bug-Debian: https://bugs.debian.org/952427
+
+---
+The information above should follow the Patch Tagging Guidelines, please
+checkout http://dep.debian.net/deps/dep3/ to learn about the format. Here
+are templates for supplementary fields that you might want to add:
+
+Origin: upstream, https://github.com/openssh/openssh-portable/commit/53ea05e09b04fd7b6dea66b42b34d65fe61b9636 
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/1871465
+Last-Update: 2022-07-26
+
+--- openssh-8.2p1.orig/ssh_config.5
++++ openssh-8.2p1/ssh_config.5
+@@ -390,8 +390,11 @@ Specifies which algorithms are allowed f
+ by certificate authorities (CAs).
+ The default is:
+ .Bd -literal -offset indent
+-ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
+-ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
++ssh-ed25519,ecdsa-sha2-nistp256,
++ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
[e-mail],
[e-mail],
++rsa-sha2-512,rsa-sha2-256
+ .Ed
+ .Pp
+ .Xr ssh 1
+--- openssh-8.2p1.orig/sshd_config.5
++++ openssh-8.2p1/sshd_config.5
+@@ -408,8 +408,11 @@ Specifies which algorithms are allowed f
+ by certificate authorities (CAs).
+ The default is:
+ .Bd -literal -offset indent
+-ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
+-ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
++ssh-ed25519,ecdsa-sha2-nistp256,
++ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
[e-mail],
[e-mail],
++rsa-sha2-512,rsa-sha2-256
+ .Ed
+ .Pp
+ Certificates signed using other algorithms will not be accepted for
diff --git a/debian/patches/series b/debian/patches/series
index 8c1046a..007b2e5 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -23,3 +23,4 @@ debian-config.patch
 restore-authorized_keys2.patch
 conch-old-privkey-format.patch
 revert-ipqos-defaults.patch
+fix-outdated-info-ssh-conf.patch