Merge ~michal-maloszewski99/ubuntu/+source/openssh:fix-outdated-ssh into ubuntu/+source/openssh:applied/ubuntu/focal-devel

[Michał Małoszewski]

[Andreas Hasenack (ahasenack)]

Grabbing this, some changes requested.

review: Needs Fixing

Unmerged commits

5793845... by Michał Małoszewski on 2022-07-26

changelog

388c3ee... by Michał Małoszewski on 2022-07-26

Fix ssh_config(5) which contains outdated information (LP: #1871465)

diff --git a/debian/changelog b/debian/changelog
index 0eea97e..6ec74fd 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,4 @@
+<<<<<<< debian/changelog
 openssh (1:8.2p1-4ubuntu0.5) focal; urgency=medium
 
   * d/p/fix-connect-timeout-overflow.patch: prevent ConnectTimeout overflow.
@@ -40,6 +41,14 @@ openssh (1:8.2p1-4ubuntu0.1) focal; urgency=medium
     (LP: #1876320)
 
  -- Christian Ehrhardt <[e-mail]>  Fri, 29 May 2020 09:37:09 +0200
+=======
+openssh (1:8.2p1-4ubuntu0.1) UNRELEASED; urgency=medium
+
+  * d/p/fix-outdated-info-ssh-conf.patch: Fix outdated information
+    (LP: #1871465)
+
+ -- Michal Maloszewski <[e-mail]>  Tue, 26 Jul 2022 21:51:55 +0200
+>>>>>>> debian/changelog
 
 openssh (1:8.2p1-4) unstable; urgency=medium
 
diff --git a/debian/patches/fix-outdated-info-ssh-conf.patch b/debian/patches/fix-outdated-info-ssh-conf.patch
new file mode 100644
index 0000000..b959a67
--- /dev/null
+++ b/debian/patches/fix-outdated-info-ssh-conf.patch
@@ -0,0 +1,54 @@
+Description: Fix outdated information in ssh_config.5
+ The release of OpenSSH 8.2 has removed 'ssh-rsa' from
+ the default list of CACertificateAlgorithms. 
+ .
+ openssh (1:8.2p1-4) unstable; urgency=medium
+ .
+   * Add /etc/ssh/ssh_config.d/ to openssh-client.
+   * Add /etc/ssh/sshd_config.d/ to openssh-server (closes: #952427).
+   * Install ssh-sk-helper even on non-Linux architectures, though it will
+     need an external middleware library in those cases.
+Author: Colin Watson <[e-mail]>
+Bug-Debian: https://bugs.debian.org/952427
+
+---
+The information above should follow the Patch Tagging Guidelines, please
+checkout http://dep.debian.net/deps/dep3/ to learn about the format. Here
+are templates for supplementary fields that you might want to add:
+
+Origin: upstream, https://github.com/openssh/openssh-portable/commit/53ea05e09b04fd7b6dea66b42b34d65fe61b9636 
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/1871465
+Last-Update: 2022-07-26
+
+--- openssh-8.2p1.orig/ssh_config.5
++++ openssh-8.2p1/ssh_config.5
+@@ -390,8 +390,11 @@ Specifies which algorithms are allowed f
+ by certificate authorities (CAs).
+ The default is:
+ .Bd -literal -offset indent
+-ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
+-ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
++ssh-ed25519,ecdsa-sha2-nistp256,
++ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
[e-mail],
[e-mail],
++rsa-sha2-512,rsa-sha2-256
+ .Ed
+ .Pp
+ .Xr ssh 1
+--- openssh-8.2p1.orig/sshd_config.5
++++ openssh-8.2p1/sshd_config.5
+@@ -408,8 +408,11 @@ Specifies which algorithms are allowed f
+ by certificate authorities (CAs).
+ The default is:
+ .Bd -literal -offset indent
+-ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
+-ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
++ssh-ed25519,ecdsa-sha2-nistp256,
++ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
[e-mail],
[e-mail],
++rsa-sha2-512,rsa-sha2-256
+ .Ed
+ .Pp
+ Certificates signed using other algorithms will not be accepted for
diff --git a/debian/patches/series b/debian/patches/series
index 94dbe27..aa4c44a 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -23,8 +23,12 @@ debian-config.patch
 restore-authorized_keys2.patch
 conch-old-privkey-format.patch
 revert-ipqos-defaults.patch
+<<<<<<< debian/patches/series
 lp-1876320-upstream-Do-not-call-process_queued_listen_addrs-for.patch
 CVE-2021-28041.patch
 match-host-certs-w-public-keys.patch
 lp1966591-upstream-preserve-group-world-read-permission-on-kno.patch
 fix-connect-timeout-overflow.patch
+=======
+fix-outdated-info-ssh-conf.patch
+>>>>>>> debian/patches/series