Accepting request 922068 from home:hpjansson:branches:network

- Version upgrade to 8.8p1 * No changes for askpass, see main package changelog for details - Version update to 8.8p1: = Security * sshd(8) from OpenSSH 6.2 through 8.7 failed to correctly initialise supplemental groups when executing an AuthorizedKeysCommand or AuthorizedPrincipalsCommand, where a AuthorizedKeysCommandUser or AuthorizedPrincipalsCommandUser directive has been set to run the command as a different user. Instead these commands would inherit the groups that sshd(8) was started with. Depending on system configuration, inherited groups may allow AuthorizedKeysCommand/AuthorizedPrincipalsCommand helper programs to gain unintended privilege. Neither AuthorizedKeysCommand nor AuthorizedPrincipalsCommand are enabled by default in sshd_config(5). = Potentially-incompatible changes * This release disables RSA signatures using the SHA-1 hash algorithm by default. This change has been made as the SHA-1 hash algorithm is cryptographically broken, and it is possible to create chosen-prefix hash collisions for <USD$50K. For most users, this change should be invisible and there is no need to replace ssh-rsa keys. OpenSSH has supported RFC8332 RSA/SHA-256/512 signatures since release 7.2 and existing ssh-rsa keys will automatically use the stronger algorithm where possible. Incompatibility is more likely when connecting to older SSH implementations that have not been upgraded or have not closely tracked improvements in the SSH protocol. For these cases, it may be necessary to selectively re-enable RSA/SHA1 to allow connection and/or user authentication via the HostkeyAlgorithms and PubkeyAcceptedAlgorithms options. = New features * ssh(1): allow the ssh_config(5) CanonicalizePermittedCNAMEs directive to accept a "none" argument to specify the default behaviour. = Bugfixes * scp(1): when using the SFTP protocol, continue transferring files after a transfer error occurs, better matching original scp/rcp behaviour. * ssh(1): fixed a number of memory leaks in multiplexing, * ssh-keygen(1): avoid crash when using the -Y find-principals command. * A number of documentation and manual improvements, including bz#3340, PR139, PR215, PR241, PR257 - Additional changes from 8.7p1 release: = Potentially-incompatible changes * scp(1): this release changes the behaviour of remote to remote copies (e.g. "scp host-a:/path host-b:") to transfer through the local host by default. This was previously available via the -3 flag. This mode avoids the need to expose credentials on the origin hop, avoids triplicate interpretation of filenames by the shell (by the local system, the copy origin and the destination) and, in conjunction with the SFTP support for scp(1) mentioned below, allows use of all authentication methods to the remote hosts (previously, only non-interactive methods could be used). A -R flag has been added to select the old behaviour. * ssh(1)/sshd(8): both the client and server are now using a stricter configuration file parser. The new parser uses more shell-like rules for quotes, space and escape characters. It is also more strict in rejecting configurations that include options lacking arguments. Previously some options (e.g. DenyUsers) could appear on a line with no subsequent arguments. This release will reject such configurations. The new parser will also reject configurations with unterminated quotes and multiple '=' characters after the option name. * ssh(1): when using SSHFP DNS records for host key verification, ssh(1) will verify all matching records instead of just those with the specific signature type requested. This may cause host key verification problems if stale SSHFP records of a different or legacy signature type exist alongside other records for a particular host. bz#3322 * ssh-keygen(1): when generating a FIDO key and specifying an explicit attestation challenge (using -Ochallenge), the challenge will now be hashed by the builtin security key middleware. This removes the (undocumented) requirement that challenges be exactly 32 bytes in length and matches the expectations of libfido2. * sshd(8): environment="..." directives in authorized_keys files are now first-match-wins and limited to 1024 discrete environment variable names. = New features * scp(1): experimental support for transfers using the SFTP protocol as a replacement for the venerable SCP/RCP protocol that it has traditionally used. SFTP offers more predictable filename handling and does not require expansion of glob(3) patterns via the shell on the remote side. * sftp-server(8): add a protocol extension to support expansion of ~/ and ~user/ prefixed paths. This was added to support these paths when used by scp(1) while in SFTP mode. * ssh(1): add a ForkAfterAuthentication ssh_config(5) counterpart to the ssh(1) -f flag. GHPR231 * ssh(1): add a StdinNull directive to ssh_config(5) that allows the config file to do the same thing as -n does on the ssh(1) command- line. GHPR231 * ssh(1): add a SessionType directive to ssh_config, allowing the configuration file to offer equivalent control to the -N (no session) and -s (subsystem) command-line flags. GHPR231 * ssh-keygen(1): allowed signers files used by ssh-keygen(1) signatures now support listing key validity intervals alongside they key, and ssh-keygen(1) can optionally check during signature verification whether a specified time falls inside this interval. This feature is intended for use by git to support signing and verifying objects using ssh keys. * ssh-keygen(8): support printing of the full public key in a sshsig signature via a -Oprint-pubkey flag. = Bugfixes * ssh(1)/sshd(8): start time-based re-keying exactly on schedule in the client and server mainloops. Previously the re-key timeout could expire but re-keying would not start until a packet was sent or received, causing a spin in select() if the connection was quiescent. * ssh-keygen(1): avoid Y2038 problem in printing certificate validity lifetimes. Dates past 2^31-1 seconds since epoch were displayed incorrectly on some platforms. bz#3329 * scp(1): allow spaces to appear in usernames for local to remote and scp -3 remote to remote copies. bz#1164 * ssh(1)/sshd(8): remove references to ChallengeResponseAuthentication in favour of KbdInteractiveAuthentication. The former is what was in SSHv1, the latter is what is in SSHv2 (RFC4256) and they were treated as somewhat but not entirely equivalent. We retain the old name as a deprecated alias so configuration files continue to work as well as a reference in the man page for people looking for it. bz#3303 * ssh(1)/ssh-add(1)/ssh-keygen(1): fix decoding of X.509 subject name when extracting a key from a PKCS#11 certificate. bz#3327 * ssh(1): restore blocking status on stdio fds before close. ssh(1) needs file descriptors in non-blocking mode to operate but it was not restoring the original state on exit. This could cause problems with fds shared with other programs via the shell, bz#3280 and GHPR246 * ssh(1)/sshd(8): switch both client and server mainloops from select(3) to pselect(3). Avoids race conditions where a signal may arrive immediately before select(3) and not be processed until an event fires. bz#2158 * ssh(1): sessions started with ControlPersist were incorrectly executing a shell when the -N (no shell) option was specified. bz#3290 * ssh(1): check if IPQoS or TunnelDevice are already set before overriding. Prevents values in config files from overriding values supplied on the command line. bz#3319 * ssh(1): fix debug message when finding a private key to match a certificate being attempted for user authentication. Previously it would print the certificate's path, whereas it was supposed to be showing the private key's path. GHPR247 * sshd(8): match host certificates against host public keys, not private keys. Allows use of certificates with private keys held in a ssh-agent. bz#3524 * ssh(1): add a workaround for a bug in OpenSSH 7.4 sshd(8), which allows RSA/SHA2 signatures for public key authentication but fails to advertise this correctly via SSH2_MSG_EXT_INFO. This causes clients of these server to incorrectly match PubkeyAcceptedAlgorithmse and potentially refuse to offer valid keys. bz#3213 * sftp(1)/scp(1): degrade gracefully if a sftp-server offers the limits@openssh.com extension but fails when the client tries to invoke it. bz#3318 * ssh(1): allow ssh_config SetEnv to override $TERM, which is otherwise handled specially by the protocol. Useful in ~/.ssh/config to set TERM to something generic (e.g. "xterm" instead of "xterm-256color") for destinations that lack terminfo entries. * sftp-server(8): the limits@openssh.com extension was incorrectly marked as an operation that writes to the filesystem, which made it unavailable in sftp-server read-only mode. bz#3318 * ssh(1): fix SEGV in UpdateHostkeys debug() message, triggered when the update removed more host keys than remain present. * Many manual page fixes. - Additional changes from 8.6p1 release: = Security * sshd(8): OpenSSH 8.5 introduced the LogVerbose keyword. When this option was enabled with a set of patterns that activated logging in code that runs in the low-privilege sandboxed sshd process, the log messages were constructed in such a way that printf(3) format strings could effectively be specified the low-privilege code. = New features * sftp-server(8): add a new limits@openssh.com protocol extension that allows a client to discover various server limits, including maximum packet size and maximum read/write length. * sftp(1): use the new limits@openssh.com extension (when available) to select better transfer lengths in the client. * sshd(8): Add ModuliFile keyword to sshd_config to specify the location of the "moduli" file containing the groups for DH-GEX. * unit tests: Add a TEST_SSH_ELAPSED_TIMES environment variable to enable printing of the elapsed time in seconds of each test. = Bugfixes * ssh_config(5), sshd_config(5): sync CASignatureAlgorithms lists in manual pages with the current default. GHPR174 * ssh(1): ensure that pkcs11_del_provider() is called before exit. GHPR234 * ssh(1), sshd(8): fix problems in string->argv conversion. Multiple backslashes were not being dequoted correctly and quoted space in the middle of a string was being incorrectly split. GHPR223 * ssh(1): return non-zero exit status when killed by signal; bz#3281 * sftp-server(8): increase maximum SSH2_FXP_READ to match the maximum packet size. Also handle zero-length reads that are not explicitly banned by the spec. - Additional changes from 8.5p1 release: = Security * ssh-agent(1): fixed a double-free memory corruption that was introduced in OpenSSH 8.2 . We treat all such memory faults as potentially exploitable. This bug could be reached by an attacker with access to the agent socket. = Potentially-incompatible changes * ssh(1), sshd(8): this release changes the first-preference signature algorithm from ECDSA to ED25519. * ssh(1), sshd(8): set the TOS/DSCP specified in the configuration for interactive use prior to TCP connect. The connection phase of the SSH session is time-sensitive and often explicitly interactive. The ultimate interactive/bulk TOS/DSCP will be set after authentication completes. * ssh(1), sshd(8): remove the pre-standardization cipher rijndael-cbc@lysator.liu.se. It is an alias for aes256-cbc before it was standardized in RFC4253 (2006), has been deprecated and disabled by default since OpenSSH 7.2 (2016) and was only briefly documented in ssh.1 in 2001. * ssh(1), sshd(8): update/replace the experimental post-quantum hybrid key exchange method based on Streamlined NTRU Prime coupled with X25519. The previous sntrup4591761x25519-sha512@tinyssh.org method is replaced with sntrup761x25519-sha512@openssh.com. * ssh(1): disable CheckHostIP by default. It provides insignificant benefits while making key rotation significantly more difficult, especially for hosts behind IP-based load-balancers. = New features * ssh(1): this release enables UpdateHostkeys by default subject to some conservative preconditions: - The key was matched in the UserKnownHostsFile (and not in the GlobalKnownHostsFile). - The same key does not exist under another name. - A certificate host key is not in use. - known_hosts contains no matching wildcard hostname pattern. - VerifyHostKeyDNS is not enabled. - The default UserKnownHostsFile is in use. * ssh(1), sshd(8): add a new LogVerbose configuration directive for that allows forcing maximum debug logging by file/function/line pattern-lists. * ssh(1): when prompting the user to accept a new hostkey, display any other host names/addresses already associated with the key. * ssh(1): allow UserKnownHostsFile=none to indicate that no known_hosts file should be used to identify host keys. * ssh(1): add a ssh_config KnownHostsCommand option that allows the client to obtain known_hosts data from a command in addition to the usual files. * ssh(1): add a ssh_config PermitRemoteOpen option that allows the client to restrict the destination when RemoteForward is used with SOCKS. * ssh(1): for FIDO keys, if a signature operation fails with a "incorrect PIN" reason and no PIN was initially requested from the user, then request a PIN and retry the operation. This supports some biometric devices that fall back to requiring PIN when reading of the biometric failed, and devices that require PINs for all hosted credentials. * sshd(8): implement client address-based rate-limiting via new sshd_config(5) PerSourceMaxStartups and PerSourceNetBlockSize directives that provide more fine-grained control on a per-origin address basis than the global MaxStartups limit. = Bugfixes * ssh(1): Prefix keyboard interactive prompts with "(user@host)" to make it easier to determine which connection they are associated with in cases like scp -3, ProxyJump, etc. bz#3224 * sshd(8): fix sshd_config SetEnv directives located inside Match blocks. GHPR201 * ssh(1): when requesting a FIDO token touch on stderr, inform the user once the touch has been recorded. * ssh(1): prevent integer overflow when ridiculously large ConnectTimeout values are specified, capping the effective value (for most platforms) at 24 days. bz#3229 * ssh(1): consider the ECDSA key subtype when ordering host key algorithms in the client. * ssh(1), sshd(8): rename the PubkeyAcceptedKeyTypes keyword to PubkeyAcceptedAlgorithms. The previous name incorrectly suggested that it control allowed key algorithms, when this option actually specifies the signature algorithms that are accepted. The previous name remains available as an alias. bz#3253 * ssh(1), sshd(8): similarly, rename HostbasedKeyTypes (ssh) and HostbasedAcceptedKeyTypes (sshd) to HostbasedAcceptedAlgorithms. * sftp-server(8): add missing lsetstat@openssh.com documentation and advertisement in the server's SSH2_FXP_VERSION hello packet. * ssh(1), sshd(8): more strictly enforce KEX state-machine by banning packet types once they are received. Fixes memleak caused by duplicate SSH2_MSG_KEX_DH_GEX_REQUEST (oss-fuzz #30078). * sftp(1): allow the full range of UIDs/GIDs for chown/chgrp on 32bit platforms instead of being limited by LONG_MAX. bz#3206 * Minor man page fixes (capitalization, commas, etc.) bz#3223 * sftp(1): when doing an sftp recursive upload or download of a read-only directory, ensure that the directory is created with write and execute permissions in the interim so that the transfer can actually complete, then set the directory permission as the final step. bz#3222 * ssh-keygen(1): document the -Z, check the validity of its argument earlier and provide a better error message if it's not correct. bz#2879 * ssh(1): ignore comments at the end of config lines in ssh_config, similar to what we already do for sshd_config. bz#2320 * sshd_config(5): mention that DisableForwarding is valid in a sshd_config Match block. bz3239 * sftp(1): fix incorrect sorting of "ls -ltr" under some circumstances. bz3248. * ssh(1), sshd(8): fix potential integer truncation of (unlikely) timeout values. bz#3250 * ssh(1): make hostbased authentication send the signature algorithm in its SSH2_MSG_USERAUTH_REQUEST packets instead of the key type. This make HostbasedAcceptedAlgorithms do what it is supposed to - filter on signature algorithm and not key type. - Rebased patches: * openssh-7.7p1-IPv6_X_forwarding.patch * openssh-7.7p1-X11_trusted_forwarding.patch * openssh-7.7p1-X_forward_with_disabled_ipv6.patch * openssh-7.7p1-cavstest-ctr.patch * openssh-7.7p1-cavstest-kdf.patch * openssh-7.7p1-disable_openssl_abi_check.patch * openssh-7.7p1-eal3.patch * openssh-7.7p1-enable_PAM_by_default.patch * openssh-7.7p1-fips.patch * openssh-7.7p1-fips_checks.patch * openssh-7.7p1-host_ident.patch * openssh-7.7p1-hostname_changes_when_forwarding_X.patch * openssh-7.7p1-ldap.patch * openssh-7.7p1-no_fork-no_pid_file.patch * openssh-7.7p1-pam_check_locks.patch * openssh-7.7p1-pts_names_formatting.patch * openssh-7.7p1-remove_xauth_cookies_on_exit.patch * openssh-7.7p1-seccomp_ipc_flock.patch * openssh-7.7p1-seccomp_stat.patch * openssh-7.7p1-send_locale.patch * openssh-7.7p1-sftp_force_permissions.patch * openssh-7.7p1-sftp_print_diagnostic_messages.patch * openssh-7.7p1-systemd-notify.patch * openssh-7.9p1-keygen-preserve-perms.patch * openssh-7.9p1-revert-new-qos-defaults.patch * openssh-8.0p1-gssapi-keyex.patch * openssh-8.1p1-audit.patch * openssh-8.1p1-seccomp-clock_gettime64.patch * openssh-8.1p1-seccomp-clock_nanosleep.patch * openssh-8.1p1-seccomp-clock_nanosleep_time64.patch * openssh-8.1p1-use-openssl-kdf.patch * openssh-8.4p1-vendordir.patch * openssh-fips-ensure-approved-moduli.patch * openssh-link-with-sk.patch * openssh-reenable-dh-group14-sha1-default.patch * openssh-whitelist-syscalls.patch - Removed openssh-fix-ssh-copy-id.patch (fixed upstream). OBS-URL: https://build.opensuse.org/request/show/922068 OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=235
2021-10-07 08:06:58 +00:00 · 2021-10-07 08:06:58 +00:00 · 3fed02069e
commit 3fed02069e
parent 34c2098366
45 changed files with 1387 additions and 1195 deletions
--- a/openssh-7.7p1-IPv6_X_forwarding.patch
+++ b/openssh-7.7p1-IPv6_X_forwarding.patch
@ -5,15 +5,11 @@ Correctly parse DISPLAY variable for cases where it contains an IPv6 address

 bnc#847710 - https://bugzilla.novell.com/show_bug.cgi?id=847710

-diff --git a/openssh-7.7p1/channels.c b/openssh-7.7p1/channels.c
--- openssh-7.7p1/channels.c
-+++ openssh-7.7p1/channels.c
-@@ -4590,33 +4590,42 @@ x11_connect_display(struct ssh *ssh)
- 			return -1;
- 
- 		/* OK, we now have a connection to the display. */
- 		return sock;
- 	}
+Index: openssh-8.8p1/channels.c
+===================================================================
+--- openssh-8.8p1.orig/channels.c
+++ openssh-8.8p1/channels.c
+@@ -4776,9 +4776,10 @@ x11_connect_display(struct ssh *ssh)
 	/*
 	 * Connect to an inet socket.  The DISPLAY value is supposedly
 	 * hostname:d[.s], where hostname may also be numeric IP address.
@ -25,14 +21,7 @@ diff --git a/openssh-7.7p1/channels.c b/openssh-7.7p1/channels.c
 	if (!cp) {
 		error("Could not find ':' in DISPLAY: %.100s", display);
 		return -1;
- 	}
- 	*cp = 0;
- 	/*
- 	 * buf now contains the host name.  But first we parse the
- 	 * display number.
- 	 */
- 	if (sscanf(cp + 1, "%u", &display_number) != 1) {
- 		error("Could not parse display number from DISPLAY: %.100s",
+@@ -4793,6 +4794,14 @@ x11_connect_display(struct ssh *ssh)
 		    display);
 		return -1;
 	}
@ -47,8 +36,3 @@ diff --git a/openssh-7.7p1/channels.c b/openssh-7.7p1/channels.c
 
 	/* Look up the host address */
 	memset(&hints, 0, sizeof(hints));
- 	hints.ai_family = ssh->chanctxt->IPv4or6;
- 	hints.ai_socktype = SOCK_STREAM;
- 	snprintf(strport, sizeof strport, "%u", 6000 + display_number);
- 	if ((gaierr = getaddrinfo(buf, strport, &hints, &aitop)) != 0) {
- 		error("%.100s: unknown host. (%s)", buf,
--- a/openssh-7.7p1-X11_trusted_forwarding.patch
+++ b/openssh-7.7p1-X11_trusted_forwarding.patch
@ -6,10 +6,10 @@
 Enable Trusted X11 forwarding by default, since the security benefits of
 having it disabled are negligible these days with XI2 being widely used.

-Index: openssh-7.8p1/ssh_config
+Index: openssh-8.8p1/ssh_config
 ===================================================================
--- openssh-7.8p1.orig/ssh_config
-+++ openssh-7.8p1/ssh_config
+--- openssh-8.8p1.orig/ssh_config
+++ openssh-8.8p1/ssh_config
@@ -17,9 +17,20 @@
 # list of available options, their meanings and defaults, please see the
 # ssh_config(5) man page.
@ -32,10 +32,10 @@ Index: openssh-7.8p1/ssh_config
 #   PasswordAuthentication yes
 #   HostbasedAuthentication no
 #   GSSAPIAuthentication no
-Index: openssh-7.8p1/sshd_config
+Index: openssh-8.8p1/sshd_config
 ===================================================================
--- openssh-7.8p1.orig/sshd_config
-+++ openssh-7.8p1/sshd_config
+--- openssh-8.8p1.orig/sshd_config
+++ openssh-8.8p1/sshd_config
@@ -84,7 +84,7 @@ AuthorizedKeysFile	.ssh/authorized_keys
 #AllowAgentForwarding yes
 #AllowTcpForwarding yes
--- a/openssh-7.7p1-X_forward_with_disabled_ipv6.patch
+++ b/openssh-7.7p1-X_forward_with_disabled_ipv6.patch
@ -3,13 +3,13 @@
 Do not throw away already open sockets for X11 forwarding if another socket
 family is not available for bind()

-diff --git a/channels.c b/channels.c
-index f51b7e3..95af47e 100644
--- a/channels.c
-+++ b/channels.c
-@@ -4637,6 +4637,13 @@ x11_create_display_inet(struct ssh *ssh, int x11_display_offset,
- 				debug2("%s: bind port %d: %.100s", __func__,
- 				    port, strerror(errno));
+Index: openssh-8.8p1/channels.c
+===================================================================
+--- openssh-8.8p1.orig/channels.c
+++ openssh-8.8p1/channels.c
+@@ -4607,6 +4607,13 @@ x11_create_display_inet(struct ssh *ssh,
+ 				debug2_f("bind port %d: %.100s", port,
+ 				    strerror(errno));
 				close(sock);
 +				/* do not remove successfully opened sockets if
 +				 * the request failed because the protocol
--- a/openssh-7.7p1-cavstest-ctr.patch
+++ b/openssh-7.7p1-cavstest-ctr.patch
@ -2,11 +2,11 @@
 # Parent  cc1022edba2c5eeb0facba08468f65afc2466b63
 CAVS test for OpenSSH's own CTR encryption mode implementation

-Index: openssh-8.4p1/Makefile.in
+Index: openssh-8.8p1/Makefile.in
 ===================================================================
--- openssh-8.4p1.orig/Makefile.in
-+++ openssh-8.4p1/Makefile.in
-@@ -25,6 +25,7 @@ SFTP_SERVER=$(libexecdir)/sftp-server
+--- openssh-8.8p1.orig/Makefile.in
+++ openssh-8.8p1/Makefile.in
+@@ -26,6 +26,7 @@ SFTP_SERVER=$(libexecdir)/sftp-server
 SSH_KEYSIGN=$(libexecdir)/ssh-keysign
 SSH_PKCS11_HELPER=$(libexecdir)/ssh-pkcs11-helper
 SSH_SK_HELPER=$(libexecdir)/ssh-sk-helper
@ -14,7 +14,7 @@ Index: openssh-8.4p1/Makefile.in
 PRIVSEP_PATH=@PRIVSEP_PATH@
 SSH_PRIVSEP_USER=@SSH_PRIVSEP_USER@
 STRIP_OPT=@STRIP_OPT@
-@@ -68,6 +69,8 @@ MKDIR_P=@MKDIR_P@
+@@ -69,6 +70,8 @@ MKDIR_P=@MKDIR_P@
 
 TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-sk-helper$(EXEEXT)
 
@ -23,7 +23,7 @@ Index: openssh-8.4p1/Makefile.in
 XMSS_OBJS=\
 	ssh-xmss.o \
 	sshkey-xmss.o \
-@@ -242,6 +245,10 @@ sftp-server$(EXEEXT): $(LIBCOMPAT) libss
+@@ -245,6 +248,10 @@ sftp-server$(EXEEXT): $(LIBCOMPAT) libss
 sftp$(EXEEXT): $(LIBCOMPAT) libssh.a $(SFTP_OBJS)
 	$(LD) -o $@ $(SFTP_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS) $(LIBEDIT)
 
@ -34,7 +34,7 @@ Index: openssh-8.4p1/Makefile.in
 # test driver for the loginrec code - not built by default
 logintest: logintest.o $(LIBCOMPAT) libssh.a loginrec.o
 	$(LD) -o $@ logintest.o $(LDFLAGS) loginrec.o -lopenbsd-compat -lssh $(LIBS)
-@@ -400,6 +407,7 @@ install-files:
+@@ -407,6 +414,7 @@ install-files:
 	$(INSTALL) -m 0755 $(STRIP_OPT) ssh-sk-helper$(EXEEXT) $(DESTDIR)$(SSH_SK_HELPER)$(EXEEXT)
 	$(INSTALL) -m 0755 $(STRIP_OPT) sftp$(EXEEXT) $(DESTDIR)$(bindir)/sftp$(EXEEXT)
 	$(INSTALL) -m 0755 $(STRIP_OPT) sftp-server$(EXEEXT) $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
@ -42,10 +42,10 @@ Index: openssh-8.4p1/Makefile.in
 	$(INSTALL) -m 644 ssh.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1
 	$(INSTALL) -m 644 scp.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/scp.1
 	$(INSTALL) -m 644 ssh-add.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-add.1
-Index: openssh-8.4p1/cavstest-ctr.c
+Index: openssh-8.8p1/cavstest-ctr.c
 ===================================================================
 --- /dev/null
-+++ openssh-8.4p1/cavstest-ctr.c
+++ openssh-8.8p1/cavstest-ctr.c
@@ -0,0 +1,214 @@
 +/*
 + *
@ -261,10 +261,10 @@ Index: openssh-8.4p1/cavstest-ctr.c
 +	printf("\n");
 +	return 0;
 +}
-Index: openssh-8.4p1/cipher.c
+Index: openssh-8.8p1/cipher.c
 ===================================================================
--- openssh-8.4p1.orig/cipher.c
-+++ openssh-8.4p1/cipher.c
+--- openssh-8.8p1.orig/cipher.c
+++ openssh-8.8p1/cipher.c
@@ -58,15 +58,6 @@
 #define EVP_CIPHER_CTX void
 #endif
@ -281,10 +281,10 @@ Index: openssh-8.4p1/cipher.c
 struct sshcipher {
 	char	*name;
 	u_int	block_size;
-Index: openssh-8.4p1/cipher.h
+Index: openssh-8.8p1/cipher.h
 ===================================================================
--- openssh-8.4p1.orig/cipher.h
-+++ openssh-8.4p1/cipher.h
+--- openssh-8.8p1.orig/cipher.h
+++ openssh-8.8p1/cipher.h
@@ -48,7 +48,15 @@
 #define CIPHER_DECRYPT		0
 
--- a/openssh-7.7p1-cavstest-kdf.patch
+++ b/openssh-7.7p1-cavstest-kdf.patch
@ -2,11 +2,11 @@
 # Parent  1e1d5a2ab8bddfc800f570755f9ea1addcc878c1
 CAVS test for KDF implementation in OpenSSH

-Index: openssh-8.4p1/Makefile.in
+Index: openssh-8.8p1/Makefile.in
 ===================================================================
--- openssh-8.4p1.orig/Makefile.in
-+++ openssh-8.4p1/Makefile.in
-@@ -26,6 +26,7 @@ SSH_KEYSIGN=$(libexecdir)/ssh-keysign
+--- openssh-8.8p1.orig/Makefile.in
+++ openssh-8.8p1/Makefile.in
+@@ -27,6 +27,7 @@ SSH_KEYSIGN=$(libexecdir)/ssh-keysign
 SSH_PKCS11_HELPER=$(libexecdir)/ssh-pkcs11-helper
 SSH_SK_HELPER=$(libexecdir)/ssh-sk-helper
 CAVSTEST_CTR=$(libexecdir)/cavstest-ctr
@ -14,7 +14,7 @@ Index: openssh-8.4p1/Makefile.in
 PRIVSEP_PATH=@PRIVSEP_PATH@
 SSH_PRIVSEP_USER=@SSH_PRIVSEP_USER@
 STRIP_OPT=@STRIP_OPT@
-@@ -69,7 +70,7 @@ MKDIR_P=@MKDIR_P@
+@@ -70,7 +71,7 @@ MKDIR_P=@MKDIR_P@
 
 TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-sk-helper$(EXEEXT)
 
@ -23,7 +23,7 @@ Index: openssh-8.4p1/Makefile.in
 
 XMSS_OBJS=\
 	ssh-xmss.o \
-@@ -249,6 +250,9 @@ sftp$(EXEEXT): $(LIBCOMPAT) libssh.a $(S
+@@ -252,6 +253,9 @@ sftp$(EXEEXT): $(LIBCOMPAT) libssh.a $(S
 cavstest-ctr$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-sk.o sk-usbhid.o cavstest-ctr.o
 	$(LD) -o $@ cavstest-ctr.o ssh-sk.o sk-usbhid.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS) $(LIBFIDO2)
 
@ -33,7 +33,7 @@ Index: openssh-8.4p1/Makefile.in
 # test driver for the loginrec code - not built by default
 logintest: logintest.o $(LIBCOMPAT) libssh.a loginrec.o
 	$(LD) -o $@ logintest.o $(LDFLAGS) loginrec.o -lopenbsd-compat -lssh $(LIBS)
-@@ -408,6 +412,7 @@ install-files:
+@@ -415,6 +419,7 @@ install-files:
 	$(INSTALL) -m 0755 $(STRIP_OPT) sftp$(EXEEXT) $(DESTDIR)$(bindir)/sftp$(EXEEXT)
 	$(INSTALL) -m 0755 $(STRIP_OPT) sftp-server$(EXEEXT) $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
 	$(INSTALL) -m 0755 $(STRIP_OPT) cavstest-ctr$(EXEEXT) $(DESTDIR)$(libexecdir)/cavstest-ctr$(EXEEXT)
@ -41,10 +41,10 @@ Index: openssh-8.4p1/Makefile.in
 	$(INSTALL) -m 644 ssh.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1
 	$(INSTALL) -m 644 scp.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/scp.1
 	$(INSTALL) -m 644 ssh-add.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-add.1
-Index: openssh-8.4p1/cavstest-kdf.c
+Index: openssh-8.8p1/cavstest-kdf.c
 ===================================================================
 --- /dev/null
-+++ openssh-8.4p1/cavstest-kdf.c
+++ openssh-8.8p1/cavstest-kdf.c
@@ -0,0 +1,402 @@
 +/*
 + * Copyright (C) 2015, Stephan Mueller <smueller@chronox.de>
@ -249,8 +249,8 @@ Index: openssh-8.4p1/cavstest-kdf.c
 +		goto out;
 +	}
 +
-+	kex.session_id = test->session_id;
-+	kex.session_id_len = test->session_id_len;
+	kex.session_id = sshbuf_new();
+	sshbuf_put(kex.session_id, test->session_id, test->session_id_len);
 +
 +	/* setup kex */
 +
--- a/openssh-7.7p1-disable_openssl_abi_check.patch
+++ b/openssh-7.7p1-disable_openssl_abi_check.patch
@ -4,11 +4,11 @@ disable run-time check for OpenSSL ABI by version number as that is not a
 reliable indicator of ABI changes and doesn't make much sense in a
 distribution package

-diff --git a/configure.ac b/configure.ac
-index 42ffd95..20a1884 100644
--- a/configure.ac
-+++ b/configure.ac
-@@ -4878,6 +4878,19 @@ AC_ARG_WITH([bsd-auth],
+Index: openssh-8.8p1/configure.ac
+===================================================================
+--- openssh-8.8p1.orig/configure.ac
+++ openssh-8.8p1/configure.ac
+@@ -5236,6 +5236,19 @@ AC_ARG_WITH([bsd-auth],
 	]
 )
 
@ -28,11 +28,11 @@ index 42ffd95..20a1884 100644
 # Where to place sshd.pid
 piddir=/var/run
 # make sure the directory exists
-diff --git a/entropy.c b/entropy.c
-index f8b9f42..4957b23 100644
--- a/entropy.c
-+++ b/entropy.c
-@@ -223,11 +223,13 @@ seed_rng(void)
+Index: openssh-8.8p1/entropy.c
+===================================================================
+--- openssh-8.8p1.orig/entropy.c
+++ openssh-8.8p1/entropy.c
+@@ -100,11 +100,13 @@ seed_rng(void)
 	/* Initialise libcrypto */
 	ssh_libcrypto_init();
 
--- a/openssh-7.7p1-eal3.patch
+++ b/openssh-7.7p1-eal3.patch
@ -2,15 +2,11 @@
 # Parent  8fd4e445c3a5c823568661a4f71b064cbcb217a9
 fix paths and references in sshd man pages

-diff --git a/openssh-7.7p1/Makefile.in b/openssh-7.7p1/Makefile.in
--- openssh-7.7p1/Makefile.in
-+++ openssh-7.7p1/Makefile.in
-@@ -127,17 +127,18 @@ MANTYPE		= @MANTYPE@
- CONFIGFILES=sshd_config.out ssh_config.out moduli.out
- CONFIGFILES_IN=sshd_config ssh_config moduli
- 
- PATHSUBS	= \
- 	-e 's|/etc/ssh/ssh_config|$(sysconfdir)/ssh_config|g' \
+Index: openssh-8.8p1/Makefile.in
+===================================================================
+--- openssh-8.8p1.orig/Makefile.in
+++ openssh-8.8p1/Makefile.in
+@@ -165,7 +165,8 @@ PATHSUBS	= \
 	-e 's|/etc/ssh/ssh_known_hosts|$(sysconfdir)/ssh_known_hosts|g' \
 	-e 's|/etc/ssh/sshd_config|$(sysconfdir)/sshd_config|g' \
 	-e 's|/usr/libexec|$(libexecdir)|g' \
@ -20,8 +16,3 @@ diff --git a/openssh-7.7p1/Makefile.in b/openssh-7.7p1/Makefile.in
 	-e 's|/etc/ssh/ssh_host_key|$(sysconfdir)/ssh_host_key|g' \
 	-e 's|/etc/ssh/ssh_host_ecdsa_key|$(sysconfdir)/ssh_host_ecdsa_key|g' \
 	-e 's|/etc/ssh/ssh_host_dsa_key|$(sysconfdir)/ssh_host_dsa_key|g' \
- 	-e 's|/etc/ssh/ssh_host_rsa_key|$(sysconfdir)/ssh_host_rsa_key|g' \
- 	-e 's|/etc/ssh/ssh_host_ed25519_key|$(sysconfdir)/ssh_host_ed25519_key|g' \
- 	-e 's|/var/run/sshd.pid|$(piddir)/sshd.pid|g' \
- 	-e 's|/etc/moduli|$(sysconfdir)/moduli|g' \
- 	-e 's|/etc/ssh/moduli|$(sysconfdir)/moduli|g' \
--- a/openssh-7.7p1-enable_PAM_by_default.patch
+++ b/openssh-7.7p1-enable_PAM_by_default.patch
@ -4,25 +4,16 @@
 # bnc#46749
 # --used to be called '-pam-fix2'

-diff --git a/openssh-7.7p1/sshd_config b/openssh-7.7p1/sshd_config
--- openssh-7.7p1/sshd_config
-+++ openssh-7.7p1/sshd_config
-@@ -74,17 +74,17 @@ AuthorizedKeysFile	.ssh/authorized_keys
- # and session processing. If this is enabled, PAM authentication will
- # be allowed through the ChallengeResponseAuthentication and
- # PasswordAuthentication.  Depending on your PAM configuration,
- # PAM authentication via ChallengeResponseAuthentication may bypass
- # the setting of "PermitRootLogin without-password".
+Index: openssh-8.8p1/sshd_config
+===================================================================
+--- openssh-8.8p1.orig/sshd_config
+++ openssh-8.8p1/sshd_config
+@@ -79,7 +79,7 @@ AuthorizedKeysFile	.ssh/authorized_keys
 # If you just want the PAM account and session checks to run without
 # PAM authentication, then enable this but set PasswordAuthentication
- # and ChallengeResponseAuthentication to 'no'.
+ # and KbdInteractiveAuthentication to 'no'.
 -#UsePAM no
 +UsePAM yes
 
 #AllowAgentForwarding yes
 #AllowTcpForwarding yes
- #GatewayPorts no
- X11Forwarding yes
- #X11DisplayOffset 10
- #X11UseLocalhost yes
- #PermitTTY yes
--- a/openssh-7.7p1-fips.patch
+++ b/openssh-7.7p1-fips.patch
@ -3,11 +3,11 @@
 FIPS 140-2 compliance. Perform selftests on start and use only FIPS approved
 algorithms.

-Index: openssh-8.4p1/Makefile.in
+Index: openssh-8.8p1/Makefile.in
 ===================================================================
--- openssh-8.4p1.orig/Makefile.in
-+++ openssh-8.4p1/Makefile.in
-@@ -112,6 +112,8 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \
+--- openssh-8.8p1.orig/Makefile.in
+++ openssh-8.8p1/Makefile.in
+@@ -113,6 +113,8 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \
 
 SKOBJS=	ssh-sk-client.o
 
@ -16,10 +16,10 @@ Index: openssh-8.4p1/Makefile.in
 SSHOBJS= ssh.o readconf.o clientloop.o sshtty.o \
 	sshconnect.o sshconnect2.o mux.o $(SKOBJS)
 
-Index: openssh-8.4p1/cipher-ctr.c
+Index: openssh-8.8p1/cipher-ctr.c
 ===================================================================
--- openssh-8.4p1.orig/cipher-ctr.c
-+++ openssh-8.4p1/cipher-ctr.c
+--- openssh-8.8p1.orig/cipher-ctr.c
+++ openssh-8.8p1/cipher-ctr.c
@@ -27,6 +27,8 @@
 #include "xmalloc.h"
 #include "log.h"
@ -38,10 +38,10 @@ Index: openssh-8.4p1/cipher-ctr.c
 #endif
 	return (&aes_ctr);
 }
-Index: openssh-8.4p1/cipher.c
+Index: openssh-8.8p1/cipher.c
 ===================================================================
--- openssh-8.4p1.orig/cipher.c
-+++ openssh-8.4p1/cipher.c
+--- openssh-8.8p1.orig/cipher.c
+++ openssh-8.8p1/cipher.c
@@ -51,6 +51,9 @@
 
 #include "openbsd-compat/openssl-compat.h"
@ -61,7 +61,7 @@ Index: openssh-8.4p1/cipher.c
 #ifdef WITH_OPENSSL
 #ifndef OPENSSL_NO_DES
 	{ "3des-cbc",		8, 24, 0, 0, CFLAG_CBC, EVP_des_ede3_cbc },
-@@ -114,8 +117,52 @@ static const struct sshcipher ciphers[]
+@@ -112,8 +115,52 @@ static const struct sshcipher ciphers[]
 	{ NULL,			0, 0, 0, 0, 0, NULL }
 };
 
@ -114,7 +114,7 @@ Index: openssh-8.4p1/cipher.c
 /* Returns a comma-separated list of supported ciphers. */
 char *
 cipher_alg_list(char sep, int auth_only)
-@@ -124,7 +171,7 @@ cipher_alg_list(char sep, int auth_only)
+@@ -122,7 +169,7 @@ cipher_alg_list(char sep, int auth_only)
 	size_t nlen, rlen = 0;
 	const struct sshcipher *c;
 
@ -123,7 +123,7 @@ Index: openssh-8.4p1/cipher.c
 		if ((c->flags & CFLAG_INTERNAL) != 0)
 			continue;
 		if (auth_only && c->auth_len == 0)
-@@ -207,7 +254,7 @@ const struct sshcipher *
+@@ -205,7 +252,7 @@ const struct sshcipher *
 cipher_by_name(const char *name)
 {
 	const struct sshcipher *c;
@ -132,10 +132,10 @@ Index: openssh-8.4p1/cipher.c
 		if (strcmp(c->name, name) == 0)
 			return c;
 	return NULL;
-Index: openssh-8.4p1/fips.c
+Index: openssh-8.8p1/fips.c
 ===================================================================
 --- /dev/null
-+++ openssh-8.4p1/fips.c
+++ openssh-8.8p1/fips.c
@@ -0,0 +1,212 @@
 +/*
 + * Copyright (c) 2012 Petr Cerny.  All rights reserved.
@ -349,10 +349,10 @@ Index: openssh-8.4p1/fips.c
 +	return dgst;
 +}
 +
-Index: openssh-8.4p1/fips.h
+Index: openssh-8.8p1/fips.h
 ===================================================================
 --- /dev/null
-+++ openssh-8.4p1/fips.h
+++ openssh-8.8p1/fips.h
@@ -0,0 +1,44 @@
 +/*
 + * Copyright (c) 2012 Petr Cerny.  All rights reserved.
@ -398,10 +398,10 @@ Index: openssh-8.4p1/fips.h
 +
 +#endif
 +
-Index: openssh-8.4p1/hmac.c
+Index: openssh-8.8p1/hmac.c
 ===================================================================
--- openssh-8.4p1.orig/hmac.c
-+++ openssh-8.4p1/hmac.c
+--- openssh-8.8p1.orig/hmac.c
+++ openssh-8.8p1/hmac.c
@@ -145,7 +145,7 @@ hmac_test(void *key, size_t klen, void *
 	size_t			 i;
 	u_char			 digest[16];
@ -411,10 +411,10 @@ Index: openssh-8.4p1/hmac.c
 		printf("ssh_hmac_start failed");
 	if (ssh_hmac_init(ctx, key, klen) < 0 ||
 	    ssh_hmac_update(ctx, m, mlen) < 0 ||
-Index: openssh-8.4p1/kex.c
+Index: openssh-8.8p1/kex.c
 ===================================================================
--- openssh-8.4p1.orig/kex.c
-+++ openssh-8.4p1/kex.c
+--- openssh-8.8p1.orig/kex.c
+++ openssh-8.8p1/kex.c
@@ -62,6 +62,8 @@
 #include "sshbuf.h"
 #include "digest.h"
@ -433,7 +433,7 @@ Index: openssh-8.4p1/kex.c
 #ifdef WITH_OPENSSL
 	{ KEX_DH1, KEX_DH_GRP1_SHA1, 0, SSH_DIGEST_SHA1 },
 	{ KEX_DH14_SHA1, KEX_DH_GRP14_SHA1, 0, SSH_DIGEST_SHA1 },
-@@ -116,6 +118,47 @@ static const struct kexalg kexalgs[] = {
+@@ -118,6 +120,47 @@ static const struct kexalg kexalgs[] = {
 	{ NULL, 0, -1, -1},
 };
 
@ -481,7 +481,7 @@ Index: openssh-8.4p1/kex.c
 char *
 kex_alg_list(char sep)
 {
-@@ -123,7 +166,7 @@ kex_alg_list(char sep)
+@@ -125,7 +168,7 @@ kex_alg_list(char sep)
 	size_t nlen, rlen = 0;
 	const struct kexalg *k;
 
@ -490,7 +490,7 @@ Index: openssh-8.4p1/kex.c
 		if (ret != NULL)
 			ret[rlen++] = sep;
 		nlen = strlen(k->name);
-@@ -143,7 +186,7 @@ kex_alg_by_name(const char *name)
+@@ -145,7 +188,7 @@ kex_alg_by_name(const char *name)
 {
 	const struct kexalg *k;
 
@ -499,7 +499,7 @@ Index: openssh-8.4p1/kex.c
 		if (strcmp(k->name, name) == 0)
 			return k;
 	}
-@@ -163,7 +206,10 @@ kex_names_valid(const char *names)
+@@ -165,7 +208,10 @@ kex_names_valid(const char *names)
 	for ((p = strsep(&cp, ",")); p && *p != '\0';
 	    (p = strsep(&cp, ","))) {
 		if (kex_alg_by_name(p) == NULL) {
@ -510,10 +510,10 @@ Index: openssh-8.4p1/kex.c
 			free(s);
 			return 0;
 		}
-Index: openssh-8.4p1/mac.c
+Index: openssh-8.8p1/mac.c
 ===================================================================
--- openssh-8.4p1.orig/mac.c
-+++ openssh-8.4p1/mac.c
+--- openssh-8.8p1.orig/mac.c
+++ openssh-8.8p1/mac.c
@@ -41,6 +41,9 @@
 
 #include "openbsd-compat/openssl-compat.h"
@ -593,10 +593,10 @@ Index: openssh-8.4p1/mac.c
 		if (strcmp(name, m->name) != 0)
 			continue;
 		if (mac != NULL)
-Index: openssh-8.4p1/readconf.c
+Index: openssh-8.8p1/readconf.c
 ===================================================================
--- openssh-8.4p1.orig/readconf.c
-+++ openssh-8.4p1/readconf.c
+--- openssh-8.8p1.orig/readconf.c
+++ openssh-8.8p1/readconf.c
@@ -68,6 +68,8 @@
 #include "myproposal.h"
 #include "digest.h"
@ -606,8 +606,8 @@ Index: openssh-8.4p1/readconf.c
 /* Format of the configuration file:
 
    # Configuration data is parsed as follows:
-@@ -1949,6 +1951,23 @@ option_clear_or_none(const char *o)
- 	return o == NULL || strcasecmp(o, "none") == 0;
+@@ -2307,6 +2309,23 @@ config_has_permitted_cnames(Options *opt
+ 	return options->num_permitted_cnames > 0;
 }
 
 +/* remove algorithms not approved for use in FIPS mode, when running in FIPS
@ -630,7 +630,7 @@ Index: openssh-8.4p1/readconf.c
 /*
  * Initializes options to special values that indicate that they have not yet
  * been set.  Read_config_file will only set options with this value. Options
-@@ -2240,6 +2259,9 @@ fill_default_options(Options * options)
+@@ -2618,6 +2637,9 @@ fill_default_options(Options * options)
 		options->canonicalize_hostname = SSH_CANONICALISE_NO;
 	if (options->fingerprint_hash == -1)
 		options->fingerprint_hash = SSH_FP_HASH_DEFAULT;
@ -640,28 +640,20 @@ Index: openssh-8.4p1/readconf.c
 #ifdef ENABLE_SK_INTERNAL
 	if (options->sk_provider == NULL)
 		options->sk_provider = xstrdup("internal");
-@@ -2273,6 +2295,7 @@ fill_default_options(Options * options)
- 	ASSEMBLE(pubkey_key_types, def_key, all_key);
+@@ -2654,6 +2676,8 @@ fill_default_options(Options * options)
 	ASSEMBLE(ca_sign_algorithms, def_sig, all_sig);
 #undef ASSEMBLE
-+
- 	free(all_cipher);
- 	free(all_mac);
- 	free(all_kex);
-@@ -2284,6 +2307,8 @@ fill_default_options(Options * options)
- 	kex_default_pk_alg_filtered = def_key; /* save for later use */
- 	free(def_sig);
 
 +	filter_fips_algorithms(options);
 +
 #define CLEAR_ON_NONE(v) \
 	do { \
 		if (option_clear_or_none(v)) { \
-Index: openssh-8.4p1/readconf.h
+Index: openssh-8.8p1/readconf.h
 ===================================================================
--- openssh-8.4p1.orig/readconf.h
-+++ openssh-8.4p1/readconf.h
-@@ -200,6 +200,7 @@ typedef struct {
+--- openssh-8.8p1.orig/readconf.h
+++ openssh-8.8p1/readconf.h
+@@ -212,6 +212,7 @@ typedef struct {
 #define SSH_STRICT_HOSTKEY_YES	2
 #define SSH_STRICT_HOSTKEY_ASK	3
 
@ -669,10 +661,10 @@ Index: openssh-8.4p1/readconf.h
 const char *kex_default_pk_alg(void);
 char	*ssh_connection_hash(const char *thishost, const char *host,
     const char *portstr, const char *user);
-Index: openssh-8.4p1/servconf.c
+Index: openssh-8.8p1/servconf.c
 ===================================================================
--- openssh-8.4p1.orig/servconf.c
-+++ openssh-8.4p1/servconf.c
+--- openssh-8.8p1.orig/servconf.c
+++ openssh-8.8p1/servconf.c
@@ -70,6 +70,7 @@
 #include "auth.h"
 #include "myproposal.h"
@ -681,7 +673,7 @@ Index: openssh-8.4p1/servconf.c
 
 static void add_listen_addr(ServerOptions *, const char *,
     const char *, int);
-@@ -201,6 +202,23 @@ option_clear_or_none(const char *o)
+@@ -205,6 +206,23 @@ option_clear_or_none(const char *o)
 	return o == NULL || strcasecmp(o, "none") == 0;
 }
 
@ -705,7 +697,7 @@ Index: openssh-8.4p1/servconf.c
 static void
 assemble_algorithms(ServerOptions *o)
 {
-@@ -242,6 +260,8 @@ assemble_algorithms(ServerOptions *o)
+@@ -246,6 +264,8 @@ assemble_algorithms(ServerOptions *o)
 	free(def_kex);
 	free(def_key);
 	free(def_sig);
@ -713,8 +705,8 @@ Index: openssh-8.4p1/servconf.c
 +	filter_fips_algorithms_s(o);
 }
 
- static void
-@@ -454,6 +474,8 @@ fill_default_server_options(ServerOption
+ void
+@@ -438,6 +458,8 @@ fill_default_server_options(ServerOption
 		options->fwd_opts.streamlocal_bind_unlink = 0;
 	if (options->fingerprint_hash == -1)
 		options->fingerprint_hash = SSH_FP_HASH_DEFAULT;
@ -723,20 +715,20 @@ Index: openssh-8.4p1/servconf.c
 	if (options->disable_forwarding == -1)
 		options->disable_forwarding = 0;
 	if (options->expose_userauth_info == -1)
-Index: openssh-8.4p1/ssh-keygen.c
+Index: openssh-8.8p1/ssh-keygen.c
 ===================================================================
--- openssh-8.4p1.orig/ssh-keygen.c
-+++ openssh-8.4p1/ssh-keygen.c
-@@ -66,6 +66,8 @@
- #include "ssh-sk.h"
+--- openssh-8.8p1.orig/ssh-keygen.c
+++ openssh-8.8p1/ssh-keygen.c
+@@ -67,6 +67,8 @@
 #include "sk-api.h" /* XXX for SSH_SK_USER_PRESENCE_REQD; remove */
+ #include "cipher.h"
 
 +#include "fips.h"
 +
 #ifdef WITH_OPENSSL
 # define DEFAULT_KEY_TYPE_NAME "rsa"
 #else
-@@ -1036,11 +1038,13 @@ do_fingerprint(struct passwd *pw)
+@@ -1037,11 +1039,13 @@ do_fingerprint(struct passwd *pw)
 static void
 do_gen_all_hostkeys(struct passwd *pw)
 {
@ -752,7 +744,7 @@ Index: openssh-8.4p1/ssh-keygen.c
 #ifdef WITH_OPENSSL
 		{ "rsa", "RSA" ,_PATH_HOST_RSA_KEY_FILE },
 		{ "dsa", "DSA", _PATH_HOST_DSA_KEY_FILE },
-@@ -1055,6 +1059,17 @@ do_gen_all_hostkeys(struct passwd *pw)
+@@ -1056,6 +1060,17 @@ do_gen_all_hostkeys(struct passwd *pw)
 		{ NULL, NULL, NULL }
 	};
 
@ -770,7 +762,7 @@ Index: openssh-8.4p1/ssh-keygen.c
 	u_int32_t bits = 0;
 	int first = 0;
 	struct stat st;
-@@ -1062,6 +1077,12 @@ do_gen_all_hostkeys(struct passwd *pw)
+@@ -1063,6 +1078,12 @@ do_gen_all_hostkeys(struct passwd *pw)
 	char comment[1024], *prv_tmp, *pub_tmp, *prv_file, *pub_file;
 	int i, type, fd, r;
 
@ -783,7 +775,7 @@ Index: openssh-8.4p1/ssh-keygen.c
 	for (i = 0; key_types[i].key_type; i++) {
 		public = private = NULL;
 		prv_tmp = pub_tmp = prv_file = pub_file = NULL;
-@@ -3586,6 +3607,15 @@ main(int argc, char **argv)
+@@ -3620,6 +3641,15 @@ main(int argc, char **argv)
 		key_type_name = DEFAULT_KEY_TYPE_NAME;
 
 	type = sshkey_type_from_name(key_type_name);
@ -799,37 +791,37 @@ Index: openssh-8.4p1/ssh-keygen.c
 	type_bits_valid(type, key_type_name, &bits);
 
 	if (!quiet)
-Index: openssh-8.4p1/ssh_config.5
+Index: openssh-8.8p1/ssh_config.5
 ===================================================================
--- openssh-8.4p1.orig/ssh_config.5
-+++ openssh-8.4p1/ssh_config.5
-@@ -682,6 +682,8 @@ Valid options are:
- and
- .Cm sha256
+--- openssh-8.8p1.orig/ssh_config.5
+++ openssh-8.8p1/ssh_config.5
+@@ -736,6 +736,8 @@ The argument to this keyword must be
+ option) or
+ .Cm no
 (the default).
 +.Pp
 +In the FIPS mode the minimum of SHA-1 is enforced (which means sha256).
 .It Cm ForwardAgent
 Specifies whether the connection to the authentication agent (if any)
 will be forwarded to the remote machine.
-Index: openssh-8.4p1/sshd.c
+Index: openssh-8.8p1/sshd.c
 ===================================================================
--- openssh-8.4p1.orig/sshd.c
-+++ openssh-8.4p1/sshd.c
-@@ -124,6 +124,8 @@
- #include "ssherr.h"
- #include "sk-api.h"
+--- openssh-8.8p1.orig/sshd.c
+++ openssh-8.8p1/sshd.c
+@@ -126,6 +126,8 @@
+ #include "srclimit.h"
+ #include "dh.h"
 
 +#include "fips.h"
 +
 /* Re-exec fds */
 #define REEXEC_DEVCRYPTO_RESERVED_FD	(STDERR_FILENO + 1)
 #define REEXEC_STARTUP_PIPE_FD		(STDERR_FILENO + 2)
-Index: openssh-8.4p1/sshd_config.5
+Index: openssh-8.8p1/sshd_config.5
 ===================================================================
--- openssh-8.4p1.orig/sshd_config.5
-+++ openssh-8.4p1/sshd_config.5
-@@ -594,6 +594,8 @@ and
+--- openssh-8.8p1.orig/sshd_config.5
+++ openssh-8.8p1/sshd_config.5
+@@ -600,6 +600,8 @@ and
 .Cm sha256 .
 The default is
 .Cm sha256 .
--- a/openssh-7.7p1-fips_checks.patch
+++ b/openssh-7.7p1-fips_checks.patch
@ -14,10 +14,10 @@
 # file is not found (or the hash matches), proceed in non-FIPS mode and abort
 # otherwise.

-Index: openssh-8.4p1/fips-check.c
+Index: openssh-8.8p1/fips-check.c
 ===================================================================
 --- /dev/null
-+++ openssh-8.4p1/fips-check.c
+++ openssh-8.8p1/fips-check.c
@@ -0,0 +1,34 @@
 +#include "includes.h"
 +#include <fcntl.h>
@ -53,10 +53,10 @@ Index: openssh-8.4p1/fips-check.c
 +    fips_ssh_init();
 +	return 0;
 +}
-Index: openssh-8.4p1/fips.c
+Index: openssh-8.8p1/fips.c
 ===================================================================
--- openssh-8.4p1.orig/fips.c
-+++ openssh-8.4p1/fips.c
+--- openssh-8.8p1.orig/fips.c
+++ openssh-8.8p1/fips.c
@@ -35,30 +35,293 @@
 #include "log.h"
 #include "xmalloc.h"
@ -362,10 +362,10 @@ Index: openssh-8.4p1/fips.c
 int
 fips_mode(void)
 {
-Index: openssh-8.4p1/fips.h
+Index: openssh-8.8p1/fips.h
 ===================================================================
--- openssh-8.4p1.orig/fips.h
-+++ openssh-8.4p1/fips.h
+--- openssh-8.8p1.orig/fips.h
+++ openssh-8.8p1/fips.h
@@ -1,5 +1,5 @@
 /*
 - * Copyright (c) 2012 Petr Cerny.  All rights reserved.
@ -407,20 +407,20 @@ Index: openssh-8.4p1/fips.h
 
 #endif
 -
-Index: openssh-8.4p1/sftp-server.c
+Index: openssh-8.8p1/sftp-server.c
 ===================================================================
--- openssh-8.4p1.orig/sftp-server.c
-+++ openssh-8.4p1/sftp-server.c
-@@ -53,6 +53,8 @@
- 
- char *sftp_realpath(const char *, char *); /* sftp-realpath.c */
+--- openssh-8.8p1.orig/sftp-server.c
+++ openssh-8.8p1/sftp-server.c
+@@ -57,6 +57,8 @@ char *sftp_realpath(const char *, char *
+ /* Maximum data read that we are willing to accept */
+ #define SFTP_MAX_READ_LENGTH (SFTP_MAX_MSG_LENGTH - 1024)
 
 +#include "fips.h"
 +
 /* Our verbosity */
 static LogLevel log_level = SYSLOG_LEVEL_ERROR;
 
-@@ -1577,6 +1579,9 @@ sftp_server_main(int argc, char **argv,
+@@ -1717,6 +1719,9 @@ sftp_server_main(int argc, char **argv,
 	extern char *optarg;
 	extern char *__progname;
 
@ -430,10 +430,10 @@ Index: openssh-8.4p1/sftp-server.c
 	__progname = ssh_get_progname(argv[0]);
 	log_init(__progname, log_level, log_facility, log_stderr);
 
-Index: openssh-8.4p1/ssh.c
+Index: openssh-8.8p1/ssh.c
 ===================================================================
--- openssh-8.4p1.orig/ssh.c
-+++ openssh-8.4p1/ssh.c
+--- openssh-8.8p1.orig/ssh.c
+++ openssh-8.8p1/ssh.c
@@ -113,6 +113,8 @@
 #include "ssh-pkcs11.h"
 #endif
@ -443,9 +443,9 @@ Index: openssh-8.4p1/ssh.c
 extern char *__progname;
 
 /* Saves a copy of argv for setproctitle emulation */
-@@ -658,6 +660,10 @@ main(int ac, char **av)
- 	size_t n, len;
+@@ -632,6 +634,10 @@ main(int ac, char **av)
 	u_int j;
+ 	struct ssh_conn_info *cinfo = NULL;
 
 +	/* initialize fips - can go before ssh_malloc_init(), since that is a
 +	 * OpenBSD-only thing (as of OpenSSH 7.6p1) */
@ -454,11 +454,11 @@ Index: openssh-8.4p1/ssh.c
 	/* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */
 	sanitise_stdfd();
 
-Index: openssh-8.4p1/sshd.c
+Index: openssh-8.8p1/sshd.c
 ===================================================================
--- openssh-8.4p1.orig/sshd.c
-+++ openssh-8.4p1/sshd.c
-@@ -1545,6 +1545,10 @@ main(int ac, char **av)
+--- openssh-8.8p1.orig/sshd.c
+++ openssh-8.8p1/sshd.c
+@@ -1547,6 +1547,10 @@ main(int ac, char **av)
 	Authctxt *authctxt;
 	struct connection_info *connection_info = NULL;
 
--- a/openssh-7.7p1-host_ident.patch
+++ b/openssh-7.7p1-host_ident.patch
@ -2,15 +2,11 @@
 # Parent  0f731d0b541b8a919d24ac91098f560a49712822
 Suggest command line for removal of offending keys from known_hosts file

-diff --git a/openssh-7.7p1/sshconnect.c b/openssh-7.7p1/sshconnect.c
--- openssh-7.7p1/sshconnect.c
-+++ openssh-7.7p1/sshconnect.c
-@@ -1147,16 +1147,21 @@ check_host_key(char *hostname, struct so
- 		}
- 		/* The host key has changed. */
- 		warn_changed_key(host_key);
- 		error("Add correct host key in %.100s to get rid of this message.",
- 		    user_hostfiles[0]);
+Index: openssh-8.8p1/sshconnect.c
+===================================================================
+--- openssh-8.8p1.orig/sshconnect.c
+++ openssh-8.8p1/sshconnect.c
+@@ -1270,6 +1270,11 @@ check_host_key(char *hostname, const str
 		error("Offending %s key in %s:%lu",
 		    sshkey_type(host_found->key),
 		    host_found->file, host_found->line);
@ -22,8 +18,3 @@ diff --git a/openssh-7.7p1/sshconnect.c b/openssh-7.7p1/sshconnect.c
 
 		/*
 		 * If strict host key checking is in use, the user will have
- 		 * to edit the key manually and we can only abort.
- 		 */
- 		if (options.strict_host_key_checking !=
- 		    SSH_STRICT_HOSTKEY_OFF) {
- 			error("%s host key for %.200s has changed and you have "
--- a/openssh-7.7p1-hostname_changes_when_forwarding_X.patch
+++ b/openssh-7.7p1-hostname_changes_when_forwarding_X.patch
@ -3,11 +3,11 @@
 # -- uset do be called '-xauthlocalhostname'
 handle hostname changes when forwarding X

-Index: openssh-8.4p1/session.c
+Index: openssh-8.8p1/session.c
 ===================================================================
--- openssh-8.4p1.orig/session.c
-+++ openssh-8.4p1/session.c
-@@ -985,7 +985,7 @@ copy_environment(char **source, char ***
+--- openssh-8.8p1.orig/session.c
+++ openssh-8.8p1/session.c
+@@ -981,7 +981,7 @@ copy_environment(char **source, char ***
 #endif
 
 static char **
@ -16,7 +16,7 @@ Index: openssh-8.4p1/session.c
 {
 	char buf[256];
 	size_t n;
-@@ -1195,6 +1195,8 @@ do_setup_env(struct ssh *ssh, Session *s
+@@ -1191,6 +1191,8 @@ do_setup_env(struct ssh *ssh, Session *s
 		for (i = 0; env[i]; i++)
 			fprintf(stderr, "  %.200s\n", env[i]);
 	}
@ -25,7 +25,7 @@ Index: openssh-8.4p1/session.c
 	return env;
 }
 
-@@ -1203,7 +1205,7 @@ do_setup_env(struct ssh *ssh, Session *s
+@@ -1199,7 +1201,7 @@ do_setup_env(struct ssh *ssh, Session *s
  * first in this order).
  */
 static void
@ -34,8 +34,8 @@ Index: openssh-8.4p1/session.c
 {
 	FILE *f = NULL;
 	char *cmd = NULL, *user_rc = NULL;
-@@ -1260,12 +1262,20 @@ do_rc_files(struct ssh *ssh, Session *s,
- 			fatal("%s: xasprintf: %s", __func__, strerror(errno));
+@@ -1256,12 +1258,20 @@ do_rc_files(struct ssh *ssh, Session *s,
+ 			fatal_f("xasprintf: %s", strerror(errno));
 		f = popen(cmd, "w");
 		if (f) {
 +			char hostname[MAXHOSTNAMELEN];
@ -55,7 +55,7 @@ Index: openssh-8.4p1/session.c
 		} else {
 			fprintf(stderr, "Could not run %s\n",
 			    cmd);
-@@ -1526,6 +1536,7 @@ do_child(struct ssh *ssh, Session *s, co
+@@ -1518,6 +1528,7 @@ do_child(struct ssh *ssh, Session *s, co
 	char **env, *argv[ARGV_MAX], remote_id[512];
 	const char *shell, *shell0;
 	struct passwd *pw = s->pw;
@ -63,7 +63,7 @@ Index: openssh-8.4p1/session.c
 	int r = 0;
 
 	sshpkt_fmt_connection_id(ssh, remote_id, sizeof(remote_id));
-@@ -1582,7 +1593,7 @@ do_child(struct ssh *ssh, Session *s, co
+@@ -1574,7 +1585,7 @@ do_child(struct ssh *ssh, Session *s, co
 	 * Make sure $SHELL points to the shell from the password file,
 	 * even if shell is overridden from login.conf
 	 */
@ -72,7 +72,7 @@ Index: openssh-8.4p1/session.c
 
 #ifdef HAVE_LOGIN_CAP
 	shell = login_getcapstr(lc, "shell", (char *)shell, (char *)shell);
-@@ -1646,7 +1657,7 @@ do_child(struct ssh *ssh, Session *s, co
+@@ -1638,7 +1649,7 @@ do_child(struct ssh *ssh, Session *s, co
 
 	closefrom(STDERR_FILENO + 1);
 
--- a/openssh-7.7p1-ldap.patch
+++ b/openssh-7.7p1-ldap.patch
@ -10,11 +10,10 @@
 # internal versions. ssh-keyconverter consequently fails to link as it lacks
 # the proper flags, and libopenbsd-compat doesn't contain the b64_* functions)

-diff --git a/HOWTO.ldap-keys b/HOWTO.ldap-keys
-new file mode 100644
-index 0000000..831d399
+Index: openssh-8.8p1/HOWTO.ldap-keys
+===================================================================
 --- /dev/null
-+++ b/HOWTO.ldap-keys
+++ openssh-8.8p1/HOWTO.ldap-keys
@@ -0,0 +1,108 @@
 +
 +HOW TO START
@ -124,11 +123,11 @@ index 0000000..831d399
 +  - frederic peters.
 +  - Finlay dobbie.
 +  - Stefan Fisher.
-diff --git a/Makefile.in b/Makefile.in
-index 6010d1c..f54348b 100644
--- a/Makefile.in
-+++ b/Makefile.in
-@@ -25,6 +25,8 @@ SFTP_SERVER=$(libexecdir)/sftp-server
+Index: openssh-8.8p1/Makefile.in
+===================================================================
+--- openssh-8.8p1.orig/Makefile.in
+++ openssh-8.8p1/Makefile.in
+@@ -26,6 +26,8 @@ SFTP_SERVER=$(libexecdir)/sftp-server
 SSH_KEYSIGN=$(libexecdir)/ssh-keysign
 SSH_PKCS11_HELPER=$(libexecdir)/ssh-pkcs11-helper
 SSH_SK_HELPER=$(libexecdir)/ssh-sk-helper
@ -137,7 +136,7 @@ index 6010d1c..f54348b 100644
 CAVSTEST_CTR=$(libexecdir)/cavstest-ctr
 CAVSTEST_KDF=$(libexecdir)/cavstest-kdf
 PRIVSEP_PATH=@PRIVSEP_PATH@
-@@ -74,6 +76,9 @@ TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keys
+@@ -73,6 +75,9 @@ TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-a
 
 TARGETS += cavstest-ctr$(EXEEXT) cavstest-kdf$(EXEEXT)
 
@ -147,9 +146,9 @@ index 6010d1c..f54348b 100644
 XMSS_OBJS=\
 	ssh-xmss.o \
 	sshkey-xmss.o \
-@@ -158,8 +163,8 @@ SFTPSERVER_OBJS=sftp-common.o sftp-server.o sftp-server-main.o
+@@ -160,8 +165,8 @@ SFTPSERVER_OBJS=sftp-common.o sftp-serve
 
- SFTP_OBJS=	sftp.o sftp-client.o sftp-common.o sftp-glob.o progressmeter.o
+ SFTP_OBJS=	sftp.o progressmeter.o $(SFTP_CLIENT_OBJS)
 
 -MANPAGES	= moduli.5.out scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-keysign.8.out ssh-pkcs11-helper.8.out ssh-sk-helper.8.out sshd_config.5.out ssh_config.5.out
 -MANPAGES_IN	= moduli.5 scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-keysign.8 ssh-pkcs11-helper.8 ssh-sk-helper.8 sshd_config.5 ssh_config.5
@ -158,7 +157,7 @@ index 6010d1c..f54348b 100644
 MANTYPE		= @MANTYPE@
 
 CONFIGFILES=sshd_config.out ssh_config.out moduli.out
-@@ -242,6 +247,9 @@ ssh-sk-helper$(EXEEXT): $(LIBCOMPAT) libssh.a $(SKHELPER_OBJS)
+@@ -244,6 +249,9 @@ ssh-sk-helper$(EXEEXT): $(LIBCOMPAT) lib
 ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a $(SSHKEYSCAN_OBJS)
 	$(LD) -o $@ $(SSHKEYSCAN_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS)
 
@ -166,9 +165,9 @@ index 6010d1c..f54348b 100644
 +	$(LD) -o $@ ldapconf.o ldapbody.o ldapmisc.o ldap-helper.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS)
 +
 sftp-server$(EXEEXT): $(LIBCOMPAT) libssh.a $(SFTPSERVER_OBJS)
- 	$(LD) -o $@ $(SFTPSERVER_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
+ 	$(LD) -o $@ $(SFTPSERVER_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS)
 
-@@ -406,6 +414,10 @@ install-files:
+@@ -416,6 +424,10 @@ install-files:
 	$(INSTALL) -m 0755 $(STRIP_OPT) sshd$(EXEEXT) $(DESTDIR)$(sbindir)/sshd$(EXEEXT)
 	$(INSTALL) -m 4711 $(STRIP_OPT) ssh-keysign$(EXEEXT) $(DESTDIR)$(SSH_KEYSIGN)$(EXEEXT)
 	$(INSTALL) -m 0755 $(STRIP_OPT) ssh-pkcs11-helper$(EXEEXT) $(DESTDIR)$(SSH_PKCS11_HELPER)$(EXEEXT)
@ -179,7 +178,7 @@ index 6010d1c..f54348b 100644
 	$(INSTALL) -m 0755 $(STRIP_OPT) ssh-sk-helper$(EXEEXT) $(DESTDIR)$(SSH_SK_HELPER)$(EXEEXT)
 	$(INSTALL) -m 0755 $(STRIP_OPT) sftp$(EXEEXT) $(DESTDIR)$(bindir)/sftp$(EXEEXT)
 	$(INSTALL) -m 0755 $(STRIP_OPT) sftp-server$(EXEEXT) $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
-@@ -425,6 +437,10 @@ install-files:
+@@ -435,6 +447,10 @@ install-files:
 	$(INSTALL) -m 644 sftp-server.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/sftp-server.8
 	$(INSTALL) -m 644 ssh-keysign.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8
 	$(INSTALL) -m 644 ssh-pkcs11-helper.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-pkcs11-helper.8
@ -190,7 +189,7 @@ index 6010d1c..f54348b 100644
 	$(INSTALL) -m 644 ssh-sk-helper.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-sk-helper.8
 
 install-sysconf:
-@@ -449,6 +465,13 @@ install-sysconf:
+@@ -459,6 +475,13 @@ install-sysconf:
 	else \
 		echo "$(DESTDIR)$(sysconfdir)/moduli already exists, install will not overwrite"; \
 	fi
@ -204,7 +203,7 @@ index 6010d1c..f54348b 100644
 
 host-key: ssh-keygen$(EXEEXT)
 	@if [ -z "$(DESTDIR)" ] ; then \
-@@ -487,6 +510,8 @@ uninstall:
+@@ -497,6 +520,8 @@ uninstall:
 	-rm -f $(DESTDIR)$(SSH_KEYSIGN)$(EXEEXT)
 	-rm -f $(DESTDIR)$(SSH_PKCS11_HELPER)$(EXEEXT)
 	-rm -f $(DESTDIR)$(SSH_SK_HELPER)$(EXEEXT)
@ -213,7 +212,7 @@ index 6010d1c..f54348b 100644
 	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1
 	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/scp.1
 	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-add.1
-@@ -499,6 +524,7 @@ uninstall:
+@@ -509,6 +534,7 @@ uninstall:
 	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8
 	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-pkcs11-helper.8
 	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-sk-helper.8
@ -221,11 +220,11 @@ index 6010d1c..f54348b 100644
 
 regress-prep:
 	$(MKDIR_P) `pwd`/regress/unittests/test_helper
-diff --git a/configure.ac b/configure.ac
-index 4ddf539..1fd0b17 100644
--- a/configure.ac
-+++ b/configure.ac
-@@ -1688,6 +1688,106 @@ AC_ARG_WITH([audit],
+Index: openssh-8.8p1/configure.ac
+===================================================================
+--- openssh-8.8p1.orig/configure.ac
+++ openssh-8.8p1/configure.ac
+@@ -1758,6 +1758,106 @@ AC_ARG_WITH([audit],
 	esac ]
 )
 
@ -332,11 +331,10 @@ index 4ddf539..1fd0b17 100644
 AC_ARG_WITH([pie],
     [  --with-pie              Build Position Independent Executables if possible], [
 	if test "x$withval" = "xno"; then
-diff --git a/ldap-helper.c b/ldap-helper.c
-new file mode 100644
-index 0000000..0efff1f
+Index: openssh-8.8p1/ldap-helper.c
+===================================================================
 --- /dev/null
-+++ b/ldap-helper.c
+++ openssh-8.8p1/ldap-helper.c
@@ -0,0 +1,155 @@
 +/* $OpenBSD: ssh-pka-ldap.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
 +/*
@ -493,11 +491,10 @@ index 0000000..0efff1f
 +void   *buffer_get_string(struct sshbuf *b, u_int *l) { return NULL; }
 +void    buffer_put_string(struct sshbuf *b, const void *f, u_int l) {}
 +
-diff --git a/ldap-helper.h b/ldap-helper.h
-new file mode 100644
-index 0000000..14cb29a
+Index: openssh-8.8p1/ldap-helper.h
+===================================================================
 --- /dev/null
-+++ b/ldap-helper.h
+++ openssh-8.8p1/ldap-helper.h
@@ -0,0 +1,32 @@
 +/* $OpenBSD: ldap-helper.h,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
 +/*
@ -531,11 +528,10 @@ index 0000000..14cb29a
 +extern int config_warning_config_file;
 +
 +#endif /* LDAP_HELPER_H */
-diff --git a/ldap.conf b/ldap.conf
-new file mode 100644
-index 0000000..42e38d3
+Index: openssh-8.8p1/ldap.conf
+===================================================================
 --- /dev/null
-+++ b/ldap.conf
+++ openssh-8.8p1/ldap.conf
@@ -0,0 +1,88 @@
 +# $Id: openssh-5.5p1-ldap.patch,v 1.3 2010/07/07 13:48:36 jfch2222 Exp $
 +#
@ -625,12 +621,11 @@ index 0000000..42e38d3
 +#tls_cert
 +#tls_key
 +
-diff --git a/ldapbody.c b/ldapbody.c
-new file mode 100644
-index 0000000..032cc89
+Index: openssh-8.8p1/ldapbody.c
+===================================================================
 --- /dev/null
-+++ b/ldapbody.c
-@@ -0,0 +1,494 @@
+++ openssh-8.8p1/ldapbody.c
+@@ -0,0 +1,503 @@
 +/* $OpenBSD: ldapbody.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
 +/*
 + * Copyright (c) 2009 Jan F. Chadima.  All rights reserved.
@ -663,8 +658,17 @@ index 0000000..032cc89
 +#include "ldapmisc.h"
 +#include "ldapbody.h"
 +#include <stdio.h>
+#include <stdlib.h>
 +#include <unistd.h>
 +
+#ifndef FALSE
+# define FALSE 0
+#endif
+
+#ifndef TRUE
+# define TRUE 1
+#endif
+
 +#define LDAPSEARCH_FORMAT "(&(objectclass=posixAccount)(objectclass=ldapPublicKey)(uid=%s)%s)"
 +#define PUBKEYATTR "sshPublicKey"
 +#define LDAP_LOGFILE	"%s/ldap.%d"
@ -1125,11 +1129,10 @@ index 0000000..032cc89
 +	return;
 +}
 +
-diff --git a/ldapbody.h b/ldapbody.h
-new file mode 100644
-index 0000000..665dca2
+Index: openssh-8.8p1/ldapbody.h
+===================================================================
 --- /dev/null
-+++ b/ldapbody.h
+++ openssh-8.8p1/ldapbody.h
@@ -0,0 +1,37 @@
 +/* $OpenBSD: ldapbody.h,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
 +/*
@ -1168,11 +1171,10 @@ index 0000000..665dca2
 +
 +#endif /* LDAPBODY_H */
 +
-diff --git a/ldapconf.c b/ldapconf.c
-new file mode 100644
-index 0000000..2e22438
+Index: openssh-8.8p1/ldapconf.c
+===================================================================
 --- /dev/null
-+++ b/ldapconf.c
+++ openssh-8.8p1/ldapconf.c
@@ -0,0 +1,711 @@
 +/* $OpenBSD: ldapconf.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
 +/*
@ -1885,11 +1887,10 @@ index 0000000..2e22438
 +	dump_cfg_string(lSSH_Filter, options.ssh_filter);
 +}
 +
-diff --git a/ldapconf.h b/ldapconf.h
-new file mode 100644
-index 0000000..c2aa704
+Index: openssh-8.8p1/ldapconf.h
+===================================================================
 --- /dev/null
-+++ b/ldapconf.h
+++ openssh-8.8p1/ldapconf.h
@@ -0,0 +1,71 @@
 +/* $OpenBSD: ldapconf.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
 +/*
@ -1962,11 +1963,10 @@ index 0000000..c2aa704
 +void dump_config(void);
 +
 +#endif /* LDAPCONF_H */
-diff --git a/ldapincludes.h b/ldapincludes.h
-new file mode 100644
-index 0000000..8539bdc
+Index: openssh-8.8p1/ldapincludes.h
+===================================================================
 --- /dev/null
-+++ b/ldapincludes.h
+++ openssh-8.8p1/ldapincludes.h
@@ -0,0 +1,41 @@
 +/* $OpenBSD: ldapconf.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
 +/*
@ -2009,11 +2009,10 @@ index 0000000..8539bdc
 +#endif
 +
 +#endif /* LDAPINCLUDES_H */
-diff --git a/ldapmisc.c b/ldapmisc.c
-new file mode 100644
-index 0000000..de23c0c
+Index: openssh-8.8p1/ldapmisc.c
+===================================================================
 --- /dev/null
-+++ b/ldapmisc.c
+++ openssh-8.8p1/ldapmisc.c
@@ -0,0 +1,79 @@
 +
 +#include "ldapincludes.h"
@ -2094,11 +2093,10 @@ index 0000000..de23c0c
 +}
 +#endif
 +
-diff --git a/ldapmisc.h b/ldapmisc.h
-new file mode 100644
-index 0000000..4c271df
+Index: openssh-8.8p1/ldapmisc.h
+===================================================================
 --- /dev/null
-+++ b/ldapmisc.h
+++ openssh-8.8p1/ldapmisc.h
@@ -0,0 +1,35 @@
 +/* $OpenBSD: ldapbody.h,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
 +/*
@ -2135,10 +2133,10 @@ index 0000000..4c271df
 +
 +#endif /* LDAPMISC_H */
 +
-diff --git a/openbsd-compat/base64.c b/openbsd-compat/base64.c
-index 9e74667..14824be 100644
--- a/openbsd-compat/base64.c
-+++ b/openbsd-compat/base64.c
+Index: openssh-8.8p1/openbsd-compat/base64.c
+===================================================================
+--- openssh-8.8p1.orig/openbsd-compat/base64.c
+++ openssh-8.8p1/openbsd-compat/base64.c
@@ -46,7 +46,7 @@
 
 #include "includes.h"
@ -2157,7 +2155,7 @@ index 9e74667..14824be 100644
 int
 b64_ntop(u_char const *src, size_t srclength, char *target, size_t targsize)
 {
-@@ -185,7 +185,7 @@ b64_ntop(u_char const *src, size_t srclength, char *target, size_t targsize)
+@@ -185,7 +185,7 @@ b64_ntop(u_char const *src, size_t srcle
 }
 #endif /* !defined(HAVE_B64_NTOP) && !defined(HAVE___B64_NTOP) */
 
@ -2166,10 +2164,10 @@ index 9e74667..14824be 100644
 
 /* skips all whitespace anywhere.
    converts characters, four at a time, starting at (or after)
-diff --git a/openbsd-compat/base64.h b/openbsd-compat/base64.h
-index bd77293..e27df9a 100644
--- a/openbsd-compat/base64.h
-+++ b/openbsd-compat/base64.h
+Index: openssh-8.8p1/openbsd-compat/base64.h
+===================================================================
+--- openssh-8.8p1.orig/openbsd-compat/base64.h
+++ openssh-8.8p1/openbsd-compat/base64.h
@@ -45,16 +45,16 @@
 
 #include "includes.h"
@ -2191,11 +2189,10 @@ index bd77293..e27df9a 100644
 int b64_pton(char const *src, u_char *target, size_t targsize);
 # endif /* !HAVE_B64_PTON */
 # define __b64_pton(a,b,c) b64_pton(a,b,c)
-diff --git a/openssh-lpk-openldap.schema b/openssh-lpk-openldap.schema
-new file mode 100644
-index 0000000..c84f90f
+Index: openssh-8.8p1/openssh-lpk-openldap.schema
+===================================================================
 --- /dev/null
-+++ b/openssh-lpk-openldap.schema
+++ openssh-8.8p1/openssh-lpk-openldap.schema
@@ -0,0 +1,21 @@
 +#
 +# LDAP Public Key Patch schema for use with openssh-ldappubkey
@ -2218,11 +2215,10 @@ index 0000000..c84f90f
 +	DESC 'MANDATORY: OpenSSH LPK objectclass'
 +	MUST ( sshPublicKey $ uid ) 
 +	)
-diff --git a/openssh-lpk-sun.schema b/openssh-lpk-sun.schema
-new file mode 100644
-index 0000000..3136673
+Index: openssh-8.8p1/openssh-lpk-sun.schema
+===================================================================
 --- /dev/null
-+++ b/openssh-lpk-sun.schema
+++ openssh-8.8p1/openssh-lpk-sun.schema
@@ -0,0 +1,23 @@
 +#
 +# LDAP Public Key Patch schema for use with openssh-ldappubkey
@ -2247,11 +2243,10 @@ index 0000000..3136673
 +	DESC 'MANDATORY: OpenSSH LPK objectclass'
 +	MUST ( sshPublicKey $ uid ) 
 +	)
-diff --git a/ssh-ldap-helper.8 b/ssh-ldap-helper.8
-new file mode 100644
-index 0000000..f8440e4
+Index: openssh-8.8p1/ssh-ldap-helper.8
+===================================================================
 --- /dev/null
-+++ b/ssh-ldap-helper.8
+++ openssh-8.8p1/ssh-ldap-helper.8
@@ -0,0 +1,79 @@
 +.\" $OpenBSD: ssh-ldap-helper.8,v 1.1 2010/02/10 23:20:38 markus Exp $
 +.\"
@ -2332,21 +2327,19 @@ index 0000000..f8440e4
 +OpenSSH 5.5 + PKA-LDAP .
 +.Sh AUTHORS
 +.An Jan F. Chadima Aq jchadima@redhat.com
-diff --git a/ssh-ldap-wrapper b/ssh-ldap-wrapper
-new file mode 100644
-index 0000000..9fdfc37
+Index: openssh-8.8p1/ssh-ldap-wrapper
+===================================================================
 --- /dev/null
-+++ b/ssh-ldap-wrapper
+++ openssh-8.8p1/ssh-ldap-wrapper
@@ -0,0 +1,4 @@
 +#!/bin/sh
 +
 +exec @LIBEXECDIR@/ssh-ldap-helper -s "$1"
 +
-diff --git a/ssh-ldap.conf.5 b/ssh-ldap.conf.5
-new file mode 100644
-index 0000000..15eb03d
+Index: openssh-8.8p1/ssh-ldap.conf.5
+===================================================================
 --- /dev/null
-+++ b/ssh-ldap.conf.5
+++ openssh-8.8p1/ssh-ldap.conf.5
@@ -0,0 +1,376 @@
 +.\" $OpenBSD: ssh-ldap.conf.5,v 1.1 2010/02/10 23:20:38 markus Exp $
 +.\"
--- a/openssh-7.7p1-no_fork-no_pid_file.patch
+++ b/openssh-7.7p1-no_fork-no_pid_file.patch
@ -2,11 +2,11 @@
 # Parent  bad0c8b3b8d72abb6960ed85b57ee42352371738
 Do not write a PID file when not daemonizing (e.g. when running from systemd)

-diff --git a/sshd.c b/sshd.c
-index f3ccc3a..eadc1b3 100644
--- a/sshd.c
-+++ b/sshd.c
-@@ -2076,7 +2076,7 @@ main(int ac, char **av)
+Index: openssh-8.8p1/sshd.c
+===================================================================
+--- openssh-8.8p1.orig/sshd.c
+++ openssh-8.8p1/sshd.c
+@@ -2129,7 +2129,7 @@ main(int ac, char **av)
 		 * Write out the pid file after the sigterm handler
 		 * is setup and the listen sockets are bound
 		 */
--- a/openssh-7.7p1-pam_check_locks.patch
+++ b/openssh-7.7p1-pam_check_locks.patch
@ -5,10 +5,10 @@ UsePAM is used

 bnc#708678, FATE#312033

-Index: openssh-8.4p1/auth.c
+Index: openssh-8.8p1/auth.c
 ===================================================================
--- openssh-8.4p1.orig/auth.c
-+++ openssh-8.4p1/auth.c
+--- openssh-8.8p1.orig/auth.c
+++ openssh-8.8p1/auth.c
@@ -113,7 +113,7 @@ allowed_user(struct ssh *ssh, struct pas
 		return 0;
 
@ -27,10 +27,10 @@ Index: openssh-8.4p1/auth.c
 		int locked = 0;
 
 #ifdef LOCKED_PASSWD_STRING
-Index: openssh-8.4p1/servconf.c
+Index: openssh-8.8p1/servconf.c
 ===================================================================
--- openssh-8.4p1.orig/servconf.c
-+++ openssh-8.4p1/servconf.c
+--- openssh-8.8p1.orig/servconf.c
+++ openssh-8.8p1/servconf.c
@@ -92,6 +92,7 @@ initialize_server_options(ServerOptions
 
 	/* Portable-specific options */
@ -39,7 +39,7 @@ Index: openssh-8.4p1/servconf.c
 
 	/* Standard Options */
 	options->num_ports = 0;
-@@ -300,6 +301,8 @@ fill_default_server_options(ServerOption
+@@ -278,6 +279,8 @@ fill_default_server_options(ServerOption
 	/* Portable-specific options */
 	if (options->use_pam == -1)
 		options->use_pam = 0;
@ -48,7 +48,7 @@ Index: openssh-8.4p1/servconf.c
 
 	/* Standard Options */
 	if (options->num_host_key_files == 0) {
-@@ -501,7 +504,7 @@ fill_default_server_options(ServerOption
+@@ -485,7 +488,7 @@ fill_default_server_options(ServerOption
 typedef enum {
 	sBadOption,		/* == unknown option */
 	/* Portable-specific options */
@ -56,8 +56,8 @@ Index: openssh-8.4p1/servconf.c
 +	sUsePAM, sUsePAMChecklocks,
 	/* Standard Options */
 	sPort, sHostKeyFile, sLoginGraceTime,
- 	sPermitRootLogin, sLogFacility, sLogLevel,
-@@ -553,8 +556,10 @@ static struct {
+ 	sPermitRootLogin, sLogFacility, sLogLevel, sLogVerbose,
+@@ -535,8 +538,10 @@ static struct {
 	/* Portable-specific options */
 #ifdef USE_PAM
 	{ "usepam", sUsePAM, SSHCFG_GLOBAL },
@ -68,7 +68,7 @@ Index: openssh-8.4p1/servconf.c
 #endif
 	{ "pamauthenticationviakbdint", sDeprecated, SSHCFG_GLOBAL },
 	/* Standard Options */
-@@ -1318,6 +1323,9 @@ process_server_config_line_depth(ServerO
+@@ -1331,6 +1336,9 @@ process_server_config_line_depth(ServerO
 	case sUsePAM:
 		intptr = &options->use_pam;
 		goto parse_flag;
@ -78,11 +78,11 @@ Index: openssh-8.4p1/servconf.c
 
 	/* Standard Options */
 	case sBadOption:
-Index: openssh-8.4p1/servconf.h
+Index: openssh-8.8p1/servconf.h
 ===================================================================
--- openssh-8.4p1.orig/servconf.h
-+++ openssh-8.4p1/servconf.h
-@@ -195,6 +195,7 @@ typedef struct {
+--- openssh-8.8p1.orig/servconf.h
+++ openssh-8.8p1/servconf.h
+@@ -200,6 +200,7 @@ typedef struct {
 	char   *adm_forced_command;
 
 	int	use_pam;		/* Enable auth via PAM */
@ -90,11 +90,11 @@ Index: openssh-8.4p1/servconf.h
 
 	int	permit_tun;
 
-Index: openssh-8.4p1/sshd_config.0
+Index: openssh-8.8p1/sshd_config.0
 ===================================================================
--- openssh-8.4p1.orig/sshd_config.0
-+++ openssh-8.4p1/sshd_config.0
-@@ -1032,6 +1032,14 @@ DESCRIPTION
+--- openssh-8.8p1.orig/sshd_config.0
+++ openssh-8.8p1/sshd_config.0
+@@ -1074,6 +1074,14 @@ DESCRIPTION
              If UsePAM is enabled, you will not be able to run sshd(8) as a
              non-root user.  The default is no.
 
@ -109,11 +109,11 @@ Index: openssh-8.4p1/sshd_config.0
      VersionAddendum
              Optionally specifies additional text to append to the SSH
              protocol banner sent by the server upon connection.  The default
-Index: openssh-8.4p1/sshd_config.5
+Index: openssh-8.8p1/sshd_config.5
 ===================================================================
--- openssh-8.4p1.orig/sshd_config.5
-+++ openssh-8.4p1/sshd_config.5
-@@ -1718,6 +1718,18 @@ is enabled, you will not be able to run
+--- openssh-8.8p1.orig/sshd_config.5
+++ openssh-8.8p1/sshd_config.5
+@@ -1775,6 +1775,18 @@ is enabled, you will not be able to run
 as a non-root user.
 The default is
 .Cm no .
--- a/openssh-7.7p1-pts_names_formatting.patch
+++ b/openssh-7.7p1-pts_names_formatting.patch
@ -4,15 +4,11 @@
 # formats in ?tmp? files)
 # --used to be called '-pts'

-diff --git a/openssh-7.7p1/loginrec.c b/openssh-7.7p1/loginrec.c
--- openssh-7.7p1/loginrec.c
-+++ openssh-7.7p1/loginrec.c
-@@ -541,17 +541,17 @@ getlast_entry(struct logininfo *li)
- /*
-  * 'line' string utility functions
-  *
-  * These functions process the 'line' string into one of three forms:
-  *
+Index: openssh-8.8p1/loginrec.c
+===================================================================
+--- openssh-8.8p1.orig/loginrec.c
+++ openssh-8.8p1/loginrec.c
+@@ -549,7 +549,7 @@ getlast_entry(struct logininfo *li)
  * 1. The full filename (including '/dev')
  * 2. The stripped name (excluding '/dev')
  * 3. The abbreviated name (e.g. /dev/ttyp00 -> yp00
@ -21,17 +17,7 @@ diff --git a/openssh-7.7p1/loginrec.c b/openssh-7.7p1/loginrec.c
  *
  * Form 3 is used on some systems to identify a .tmp.? entry when
  * attempting to remove it. Typically both addition and removal is
-  * performed by one application - say, sshd - so as long as the choice
-  * uniquely identifies a terminal it's ok.
-  */
- 
- 
-@@ -602,16 +602,20 @@ line_abbrevname(char *dst, const char *s
- 	/* Always skip prefix if present */
- 	if (strncmp(src, "/dev/", 5) == 0)
- 		src += 5;
- 
- #ifdef WITH_ABBREV_NO_TTY
+@@ -610,6 +610,10 @@ line_abbrevname(char *dst, const char *s
 	if (strncmp(src, "tty", 3) == 0)
 		src += 3;
 #endif
@ -42,8 +28,3 @@ diff --git a/openssh-7.7p1/loginrec.c b/openssh-7.7p1/loginrec.c
 
 	len = strlen(src);
 
- 	if (len > 0) {
- 		if (((int)len - dstsize) > 0)
- 			src +=  ((int)len - dstsize);
- 
- 		/* note: _don't_ change this to strlcpy */
--- a/openssh-7.7p1-remove_xauth_cookies_on_exit.patch
+++ b/openssh-7.7p1-remove_xauth_cookies_on_exit.patch
@ -5,15 +5,11 @@ try to remove xauth cookies on logout

 bnc#98815

-diff --git a/openssh-7.7p1/session.c b/openssh-7.7p1/session.c
--- openssh-7.7p1/session.c
-+++ openssh-7.7p1/session.c
-@@ -2302,16 +2302,44 @@ session_close(struct ssh *ssh, Session *
- 	u_int i;
- 
- 	verbose("Close session: user %s from %.200s port %d id %d",
- 	    s->pw->pw_name,
- 	    ssh_remote_ipaddr(ssh),
+Index: openssh-8.8p1/session.c
+===================================================================
+--- openssh-8.8p1.orig/session.c
+++ openssh-8.8p1/session.c
+@@ -2441,6 +2441,34 @@ session_close(struct ssh *ssh, Session *
 	    ssh_remote_port(ssh),
 	    s->self);
 
@ -48,8 +44,3 @@ diff --git a/openssh-7.7p1/session.c b/openssh-7.7p1/session.c
 	if (s->ttyfd != -1)
 		session_pty_cleanup(s);
 	free(s->term);
- 	free(s->display);
- 	free(s->x11_chanids);
- 	free(s->auth_display);
- 	free(s->auth_data);
- 	free(s->auth_proto);
--- a/openssh-7.7p1-seccomp_ipc_flock.patch
+++ b/openssh-7.7p1-seccomp_ipc_flock.patch
@ -15,11 +15,11 @@ this is only need on s390 architecture.

 Signed-off-by: Eduardo Barretto <ebarretto@linux.vnet.ibm.com>

-Index: openssh-7.9p1/sandbox-seccomp-filter.c
+Index: openssh-8.8p1/sandbox-seccomp-filter.c
 ===================================================================
--- openssh-7.9p1.orig/sandbox-seccomp-filter.c
-+++ openssh-7.9p1/sandbox-seccomp-filter.c
-@@ -175,6 +175,9 @@ static const struct sock_filter preauth_
+--- openssh-8.8p1.orig/sandbox-seccomp-filter.c
+++ openssh-8.8p1/sandbox-seccomp-filter.c
+@@ -219,6 +219,9 @@ static const struct sock_filter preauth_
 #ifdef __NR_geteuid32
 	SC_ALLOW(__NR_geteuid32),
 #endif
@ -29,7 +29,7 @@ Index: openssh-7.9p1/sandbox-seccomp-filter.c
 #ifdef __NR_getpgid
 	SC_ALLOW(__NR_getpgid),
 #endif
-@@ -193,6 +196,9 @@ static const struct sock_filter preauth_
+@@ -237,6 +240,9 @@ static const struct sock_filter preauth_
 #ifdef __NR_getuid32
 	SC_ALLOW(__NR_getuid32),
 #endif
--- a/openssh-7.7p1-seccomp_stat.patch
+++ b/openssh-7.7p1-seccomp_stat.patch
@ -5,15 +5,11 @@ Allow the stat() syscall for OpenSSL re-seed patch

 bnc#912436

-diff --git a/openssh-7.7p1/sandbox-seccomp-filter.c b/openssh-7.7p1/sandbox-seccomp-filter.c
--- openssh-7.7p1/sandbox-seccomp-filter.c
-+++ openssh-7.7p1/sandbox-seccomp-filter.c
-@@ -224,16 +224,19 @@ static const struct sock_filter preauth_
- 	SC_ALLOW(__NR_select),
- #endif
- #ifdef __NR_shutdown
- 	SC_ALLOW(__NR_shutdown),
- #endif
+Index: openssh-8.8p1/sandbox-seccomp-filter.c
+===================================================================
+--- openssh-8.8p1.orig/sandbox-seccomp-filter.c
+++ openssh-8.8p1/sandbox-seccomp-filter.c
+@@ -294,6 +294,9 @@ static const struct sock_filter preauth_
 #ifdef __NR_sigprocmask
 	SC_ALLOW(__NR_sigprocmask),
 #endif
@ -23,8 +19,3 @@ diff --git a/openssh-7.7p1/sandbox-seccomp-filter.c b/openssh-7.7p1/sandbox-secc
 #ifdef __NR_time
 	SC_ALLOW(__NR_time),
 #endif
- #ifdef __NR_write
- 	SC_ALLOW(__NR_write),
- #endif
- #ifdef __NR_socketcall
- 	SC_ALLOW_ARG(__NR_socketcall, 0, SYS_SHUTDOWN),
--- a/openssh-7.7p1-send_locale.patch
+++ b/openssh-7.7p1-send_locale.patch
@ -3,15 +3,11 @@
 send locales in default configuration
 bnc#65747

-diff --git a/openssh-7.7p1/ssh_config b/openssh-7.7p1/ssh_config
--- openssh-7.7p1/ssh_config
-+++ openssh-7.7p1/ssh_config
-@@ -26,16 +26,21 @@ Host *
- # security reasons: Someone stealing the authentification data on the
- # remote side (the "spoofed" X-server by the remote sshd) can read your
- # keystrokes as you type, just like any other X11 client could do.
- # Set this to "no" here for global effect or in your own ~/.ssh/config
- # file if you want to have the remote X11 authentification data to 
+Index: openssh-8.8p1/ssh_config
+===================================================================
+--- openssh-8.8p1.orig/ssh_config
+++ openssh-8.8p1/ssh_config
+@@ -31,6 +31,11 @@ Host *
 # expire after twenty minutes after remote login.
     ForwardX11Trusted yes
 
@ -23,20 +19,11 @@ diff --git a/openssh-7.7p1/ssh_config b/openssh-7.7p1/ssh_config
 #   PasswordAuthentication yes
 #   HostbasedAuthentication no
 #   GSSAPIAuthentication no
- #   GSSAPIDelegateCredentials no
- #   BatchMode no
- #   CheckHostIP yes
- #   AddressFamily any
- #   ConnectTimeout 0
-diff --git a/openssh-7.7p1/sshd_config b/openssh-7.7p1/sshd_config
--- openssh-7.7p1/sshd_config
-+++ openssh-7.7p1/sshd_config
-@@ -104,14 +104,19 @@ X11Forwarding yes
- #VersionAddendum none
- 
- # no default banner path
- #Banner none
- 
+Index: openssh-8.8p1/sshd_config
+===================================================================
+--- openssh-8.8p1.orig/sshd_config
+++ openssh-8.8p1/sshd_config
+@@ -108,6 +108,11 @@ X11Forwarding yes
 # override default of no subsystems
 Subsystem	sftp	/usr/libexec/sftp-server
 
@ -48,6 +35,3 @@ diff --git a/openssh-7.7p1/sshd_config b/openssh-7.7p1/sshd_config
 # Example of overriding settings on a per-user basis
 #Match User anoncvs
 #	X11Forwarding no
- #	AllowTcpForwarding no
- #	PermitTTY no
- #	ForceCommand cvs server
--- a/openssh-7.7p1-sftp_force_permissions.patch
+++ b/openssh-7.7p1-sftp_force_permissions.patch
@ -1,7 +1,7 @@
-Index: openssh-8.4p1/sftp-server.8
+Index: openssh-8.8p1/sftp-server.8
 ===================================================================
--- openssh-8.4p1.orig/sftp-server.8
-+++ openssh-8.4p1/sftp-server.8
+--- openssh-8.8p1.orig/sftp-server.8
+++ openssh-8.8p1/sftp-server.8
@@ -38,6 +38,7 @@
 .Op Fl P Ar denied_requests
 .Op Fl p Ar allowed_requests
@ -21,11 +21,11 @@ Index: openssh-8.4p1/sftp-server.8
 .El
 .Pp
 On some systems,
-Index: openssh-8.4p1/sftp-server.c
+Index: openssh-8.8p1/sftp-server.c
 ===================================================================
--- openssh-8.4p1.orig/sftp-server.c
-+++ openssh-8.4p1/sftp-server.c
-@@ -69,6 +69,10 @@ struct sshbuf *oqueue;
+--- openssh-8.8p1.orig/sftp-server.c
+++ openssh-8.8p1/sftp-server.c
+@@ -73,6 +73,10 @@ struct sshbuf *oqueue;
 /* Version of client */
 static u_int version;
 
@ -36,7 +36,7 @@ Index: openssh-8.4p1/sftp-server.c
 /* SSH2_FXP_INIT received */
 static int init_done;
 
-@@ -687,6 +691,7 @@ process_open(u_int32_t id)
+@@ -724,6 +728,7 @@ process_open(u_int32_t id)
 	Attrib a;
 	char *name;
 	int r, handle, fd, flags, mode, status = SSH2_FX_FAILURE;
@ -44,7 +44,7 @@ Index: openssh-8.4p1/sftp-server.c
 
 	if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0 ||
 	    (r = sshbuf_get_u32(iqueue, &pflags)) != 0 || /* portable flags */
-@@ -696,6 +701,10 @@ process_open(u_int32_t id)
+@@ -733,6 +738,10 @@ process_open(u_int32_t id)
 	debug3("request %u: open flags %d", id, pflags);
 	flags = flags_from_portable(pflags);
 	mode = (a.flags & SSH2_FILEXFER_ATTR_PERMISSIONS) ? a.perm : 0666;
@ -55,7 +55,7 @@ Index: openssh-8.4p1/sftp-server.c
 	logit("open \"%s\" flags %s mode 0%o",
 	    name, string_from_portable(pflags), mode);
 	if (readonly &&
-@@ -717,6 +726,8 @@ process_open(u_int32_t id)
+@@ -754,6 +763,8 @@ process_open(u_int32_t id)
 			}
 		}
 	}
@ -64,7 +64,7 @@ Index: openssh-8.4p1/sftp-server.c
 	if (status != SSH2_FX_OK)
 		send_status(id, status);
 	free(name);
-@@ -1131,6 +1142,7 @@ process_mkdir(u_int32_t id)
+@@ -1183,6 +1194,7 @@ process_mkdir(u_int32_t id)
 	Attrib a;
 	char *name;
 	int r, mode, status = SSH2_FX_FAILURE;
@ -72,7 +72,7 @@ Index: openssh-8.4p1/sftp-server.c
 
 	if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0 ||
 	    (r = decode_attrib(iqueue, &a)) != 0)
-@@ -1138,9 +1150,16 @@ process_mkdir(u_int32_t id)
+@@ -1190,9 +1202,16 @@ process_mkdir(u_int32_t id)
 
 	mode = (a.flags & SSH2_FILEXFER_ATTR_PERMISSIONS) ?
 	    a.perm & 07777 : 0777;
@ -89,7 +89,7 @@ Index: openssh-8.4p1/sftp-server.c
 	status = (r == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
 	send_status(id, status);
 	free(name);
-@@ -1560,7 +1579,7 @@ sftp_server_usage(void)
+@@ -1700,7 +1719,7 @@ sftp_server_usage(void)
 	fprintf(stderr,
 	    "usage: %s [-ehR] [-d start_directory] [-f log_facility] "
 	    "[-l log_level]\n\t[-P denied_requests] "
@ -98,7 +98,7 @@ Index: openssh-8.4p1/sftp-server.c
 	    "       %s -Q protocol_feature\n",
 	    __progname, __progname);
 	exit(1);
-@@ -1588,7 +1607,7 @@ sftp_server_main(int argc, char **argv,
+@@ -1728,7 +1747,7 @@ sftp_server_main(int argc, char **argv,
 	pw = pwcopy(user_pw);
 
 	while (!skipargs && (ch = getopt(argc, argv,
@ -107,7 +107,7 @@ Index: openssh-8.4p1/sftp-server.c
 		switch (ch) {
 		case 'Q':
 			if (strcasecmp(optarg, "requests") != 0) {
-@@ -1650,6 +1669,15 @@ sftp_server_main(int argc, char **argv,
+@@ -1790,6 +1809,15 @@ sftp_server_main(int argc, char **argv,
 				fatal("Invalid umask \"%s\"", optarg);
 			(void)umask((mode_t)mask);
 			break;
--- a/openssh-7.7p1-sftp_print_diagnostic_messages.patch
+++ b/openssh-7.7p1-sftp_print_diagnostic_messages.patch
@ -2,10 +2,10 @@
 # Parent  60bdbe6dd8d6bc011883472363d56e1d97f68835
 Put back sftp client diagnostic messages in batch mode

-Index: openssh-8.4p1/sftp.1
+Index: openssh-8.8p1/sftp.1
 ===================================================================
--- openssh-8.4p1.orig/sftp.1
-+++ openssh-8.4p1/sftp.1
+--- openssh-8.8p1.orig/sftp.1
+++ openssh-8.8p1/sftp.1
@@ -287,6 +287,9 @@ Specifies the port to connect to on the
 .It Fl p
 Preserves modification times, access times, and modes from the
@ -16,12 +16,12 @@ Index: openssh-8.4p1/sftp.1
 .It Fl q
 Quiet mode: disables the progress meter as well as warning and
 diagnostic messages from
-Index: openssh-8.4p1/sftp.c
+Index: openssh-8.8p1/sftp.c
 ===================================================================
--- openssh-8.4p1.orig/sftp.c
-+++ openssh-8.4p1/sftp.c
-@@ -85,6 +85,9 @@ static volatile pid_t sshpid = -1;
- /* Suppress diagnositic messages */
+--- openssh-8.8p1.orig/sftp.c
+++ openssh-8.8p1/sftp.c
+@@ -82,6 +82,9 @@ static volatile pid_t sshpid = -1;
+ /* Suppress diagnostic messages */
 int quiet = 0;
 
 +/* Force diagnositic messages in batch mode */
@ -30,7 +30,7 @@ Index: openssh-8.4p1/sftp.c
 /* This is set to 0 if the progressmeter is not desired. */
 int showprogress = 1;
 
-@@ -2408,7 +2411,7 @@ main(int argc, char **argv)
+@@ -2381,7 +2384,7 @@ main(int argc, char **argv)
 	infile = stdin;
 
 	while ((ch = getopt(argc, argv,
@ -39,7 +39,7 @@ Index: openssh-8.4p1/sftp.c
 		switch (ch) {
 		/* Passed through to ssh(1) */
 		case 'A':
-@@ -2426,6 +2429,9 @@ main(int argc, char **argv)
+@@ -2399,6 +2402,9 @@ main(int argc, char **argv)
 			addargs(&args, "-%c", ch);
 			addargs(&args, "%s", optarg);
 			break;
@ -49,7 +49,7 @@ Index: openssh-8.4p1/sftp.c
 		case 'q':
 			ll = SYSLOG_LEVEL_ERROR;
 			quiet = 1;
-@@ -2510,6 +2516,8 @@ main(int argc, char **argv)
+@@ -2483,6 +2489,8 @@ main(int argc, char **argv)
 			usage();
 		}
 	}
--- a/openssh-7.7p1-systemd-notify.patch
+++ b/openssh-7.7p1-systemd-notify.patch
@ -3,11 +3,11 @@
 Send signals to systemd to prevent various race conditions
 bsc#1048367

-Index: openssh-7.8p1/configure.ac
+Index: openssh-8.8p1/configure.ac
 ===================================================================
--- openssh-7.8p1.orig/configure.ac
-+++ openssh-7.8p1/configure.ac
-@@ -4378,6 +4378,30 @@ AC_ARG_WITH([kerberos5],
+--- openssh-8.8p1.orig/configure.ac
+++ openssh-8.8p1/configure.ac
+@@ -4751,6 +4751,30 @@ AC_ARG_WITH([kerberos5],
 AC_SUBST([GSSLIBS])
 AC_SUBST([K5LIBS])
 
@ -38,7 +38,7 @@ Index: openssh-7.8p1/configure.ac
 # Looking for programs, paths and files
 
 PRIVSEP_PATH=/var/empty
-@@ -5183,6 +5207,7 @@ echo "                   libldns support
+@@ -5564,6 +5588,7 @@ echo "                   libldns support
 echo "  Solaris process contract support: $SPC_MSG"
 echo "           Solaris project support: $SP_MSG"
 echo "         Solaris privilege support: $SPP_MSG"
@ -46,11 +46,11 @@ Index: openssh-7.8p1/configure.ac
 echo "       IP address in \$DISPLAY hack: $DISPLAY_HACK_MSG"
 echo "           Translate v4 in v6 hack: $IPV4_IN6_HACK_MSG"
 echo "                  BSD Auth support: $BSD_AUTH_MSG"
-Index: openssh-7.8p1/sshd.c
+Index: openssh-8.8p1/sshd.c
 ===================================================================
--- openssh-7.8p1.orig/sshd.c
-+++ openssh-7.8p1/sshd.c
-@@ -87,6 +87,10 @@
+--- openssh-8.8p1.orig/sshd.c
+++ openssh-8.8p1/sshd.c
+@@ -85,6 +85,10 @@
 #include <prot.h>
 #endif
 
@ -72,7 +72,7 @@ Index: openssh-7.8p1/sshd.c
 	logit("Received SIGHUP; restarting.");
 	if (options.pid_file != NULL)
 		unlink(options.pid_file);
-@@ -1995,6 +2003,11 @@ main(int ac, char **av)
+@@ -2076,6 +2084,11 @@ main(int ac, char **av)
 			}
 		}
 
--- a/openssh-7.9p1-keygen-preserve-perms.patch
+++ b/openssh-7.9p1-keygen-preserve-perms.patch
@ -8,11 +8,11 @@ Date:   Fri Sep 27 01:57:16 2019 +0200
    just going with what mkstemp() gives us. This is useful in corner
    cases where known_hosts is shared between users.

-diff --git a/ssh-keygen.c b/ssh-keygen.c
-index 03a7fe5..ca8a309 100644
--- a/ssh-keygen.c
-+++ b/ssh-keygen.c
-@@ -1338,6 +1338,11 @@ do_known_hosts(struct passwd *pw, const char *name)
+Index: openssh-8.8p1/ssh-keygen.c
+===================================================================
+--- openssh-8.8p1.orig/ssh-keygen.c
+++ openssh-8.8p1/ssh-keygen.c
+@@ -1384,6 +1384,11 @@ do_known_hosts(struct passwd *pw, const
 		if (inplace)
 			unlink(tmp);
 	} else if (inplace) {
@ -24,7 +24,7 @@ index 03a7fe5..ca8a309 100644
 		/* Backup existing file */
 		if (unlink(old) == -1 && errno != ENOENT)
 			fatal("unlink %.100s: %s", old, strerror(errno));
-@@ -1352,6 +1357,12 @@ do_known_hosts(struct passwd *pw, const char *name)
+@@ -1398,6 +1403,12 @@ do_known_hosts(struct passwd *pw, const
 			unlink(old);
 			exit(1);
 		}
--- a/openssh-7.9p1-revert-new-qos-defaults.patch
+++ b/openssh-7.9p1-revert-new-qos-defaults.patch
@ -6,11 +6,11 @@ Date:   Thu Jun 20 23:54:11 2019 +0200
    
    Reverts OpenBSD-Commit-ID: d11d2a4484f461524ef0c20870523dfcdeb52181

-diff --git a/readconf.c b/readconf.c
-index 24f2cb1..bbdea0d 100644
--- a/readconf.c
-+++ b/readconf.c
-@@ -2183,9 +2183,9 @@ fill_default_options(Options * options)
+Index: openssh-8.8p1/readconf.c
+===================================================================
+--- openssh-8.8p1.orig/readconf.c
+++ openssh-8.8p1/readconf.c
+@@ -2679,9 +2679,9 @@ fill_default_options(Options * options)
 	if (options->visual_host_key == -1)
 		options->visual_host_key = 0;
 	if (options->ip_qos_interactive == -1)
@ -21,12 +21,12 @@ index 24f2cb1..bbdea0d 100644
 +		options->ip_qos_bulk = IPTOS_THROUGHPUT;
 	if (options->request_tty == -1)
 		options->request_tty = REQUEST_TTY_AUTO;
- 	if (options->proxy_use_fdpass == -1)
-diff --git a/servconf.c b/servconf.c
-index 13cf154..766ac6b 100644
--- a/servconf.c
-+++ b/servconf.c
-@@ -445,9 +445,9 @@ fill_default_server_options(ServerOptions *options)
+ 	if (options->session_type == -1)
+Index: openssh-8.8p1/servconf.c
+===================================================================
+--- openssh-8.8p1.orig/servconf.c
+++ openssh-8.8p1/servconf.c
+@@ -459,9 +459,9 @@ fill_default_server_options(ServerOption
 	if (options->permit_tun == -1)
 		options->permit_tun = SSH_TUNMODE_NO;
 	if (options->ip_qos_interactive == -1)
@ -38,11 +38,11 @@ index 13cf154..766ac6b 100644
 	if (options->version_addendum == NULL)
 		options->version_addendum = xstrdup("");
 	if (options->fwd_opts.streamlocal_bind_mask == (mode_t)-1)
-diff --git a/ssh_config.5 b/ssh_config.5
-index 3bf0502..10246f8 100644
--- a/ssh_config.5
-+++ b/ssh_config.5
-@@ -1088,11 +1088,9 @@ If one argument is specified, it is used as the packet class unconditionally.
+Index: openssh-8.8p1/ssh_config.5
+===================================================================
+--- openssh-8.8p1.orig/ssh_config.5
+++ openssh-8.8p1/ssh_config.5
+@@ -1182,11 +1182,9 @@ If one argument is specified, it is used
 If two values are specified, the first is automatically selected for
 interactive sessions and the second for non-interactive sessions.
 The default is
@ -56,11 +56,11 @@ index 3bf0502..10246f8 100644
 for non-interactive sessions.
 .It Cm KbdInteractiveAuthentication
 Specifies whether to use keyboard-interactive authentication.
-diff --git a/sshd_config.5 b/sshd_config.5
-index 50a4917..a276fcb 100644
--- a/sshd_config.5
-+++ b/sshd_config.5
-@@ -868,11 +868,9 @@ If one argument is specified, it is used as the packet class unconditionally.
+Index: openssh-8.8p1/sshd_config.5
+===================================================================
+--- openssh-8.8p1.orig/sshd_config.5
+++ openssh-8.8p1/sshd_config.5
+@@ -903,11 +903,9 @@ If one argument is specified, it is used
 If two values are specified, the first is automatically selected for
 interactive sessions and the second for non-interactive sessions.
 The default is
--- a/openssh-8.0p1-gssapi-keyex.patch
+++ b/openssh-8.0p1-gssapi-keyex.patch
--- a/openssh-8.1p1-audit.patch
+++ b/openssh-8.1p1-audit.patch
@ -1,9 +1,9 @@
-Index: openssh-8.4p1/Makefile.in
+Index: openssh-8.8p1/Makefile.in
 ===================================================================
--- openssh-8.4p1.orig/Makefile.in
-+++ openssh-8.4p1/Makefile.in
-@@ -113,7 +113,7 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \
- 	sntrup4591761.o kexsntrup4591761x25519.o kexgen.o \
+--- openssh-8.8p1.orig/Makefile.in
+++ openssh-8.8p1/Makefile.in
+@@ -114,7 +114,7 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \
+ 	kexsntrup761x25519.o sntrup761.o kexgen.o \
 	kexgssc.o \
 	sftp-realpath.o platform-pledge.o platform-tracing.o platform-misc.o \
 -	sshbuf-io.o
@ -11,11 +11,11 @@ Index: openssh-8.4p1/Makefile.in
 
 SKOBJS=	ssh-sk-client.o
 
-Index: openssh-8.4p1/audit-bsm.c
+Index: openssh-8.8p1/audit-bsm.c
 ===================================================================
--- openssh-8.4p1.orig/audit-bsm.c
-+++ openssh-8.4p1/audit-bsm.c
-@@ -372,13 +372,26 @@ audit_connection_from(const char *host,
+--- openssh-8.8p1.orig/audit-bsm.c
+++ openssh-8.8p1/audit-bsm.c
+@@ -373,13 +373,26 @@ audit_connection_from(const char *host,
 #endif
 }
 
@ -43,7 +43,7 @@ Index: openssh-8.4p1/audit-bsm.c
 audit_session_open(struct logininfo *li)
 {
 	/* not implemented */
-@@ -390,6 +403,12 @@ audit_session_close(struct logininfo *li
+@@ -391,6 +404,12 @@ audit_session_close(struct logininfo *li
 	/* not implemented */
 }
 
@ -56,7 +56,7 @@ Index: openssh-8.4p1/audit-bsm.c
 void
 audit_event(struct ssh *ssh, ssh_audit_event_t event)
 {
-@@ -451,4 +470,28 @@ audit_event(struct ssh *ssh, ssh_audit_e
+@@ -452,4 +471,28 @@ audit_event(struct ssh *ssh, ssh_audit_e
 		debug("%s: unhandled event %d", __func__, event);
 	}
 }
@ -85,10 +85,10 @@ Index: openssh-8.4p1/audit-bsm.c
 +	/* not implemented */
 +}
 #endif /* BSM */
-Index: openssh-8.4p1/audit-linux.c
+Index: openssh-8.8p1/audit-linux.c
 ===================================================================
--- openssh-8.4p1.orig/audit-linux.c
-+++ openssh-8.4p1/audit-linux.c
+--- openssh-8.8p1.orig/audit-linux.c
+++ openssh-8.8p1/audit-linux.c
@@ -33,27 +33,40 @@
 
 #include "log.h"
@ -459,10 +459,10 @@ Index: openssh-8.4p1/audit-linux.c
 +		error("cannot write into audit");
 +}
 #endif /* USE_LINUX_AUDIT */
-Index: openssh-8.4p1/audit.c
+Index: openssh-8.8p1/audit.c
 ===================================================================
--- openssh-8.4p1.orig/audit.c
-+++ openssh-8.4p1/audit.c
+--- openssh-8.8p1.orig/audit.c
+++ openssh-8.8p1/audit.c
@@ -34,6 +34,12 @@
 #include "log.h"
 #include "hostfile.h"
@ -640,10 +640,10 @@ Index: openssh-8.4p1/audit.c
 }
 # endif  /* !defined CUSTOM_SSH_AUDIT_EVENTS */
 #endif /* SSH_AUDIT_EVENTS */
-Index: openssh-8.4p1/audit.h
+Index: openssh-8.8p1/audit.h
 ===================================================================
--- openssh-8.4p1.orig/audit.h
-+++ openssh-8.4p1/audit.h
+--- openssh-8.8p1.orig/audit.h
+++ openssh-8.8p1/audit.h
@@ -26,6 +26,7 @@
 # define _SSH_AUDIT_H
 
@ -686,10 +686,10 @@ Index: openssh-8.4p1/audit.h
 +void	audit_destroy_sensitive_data(struct ssh *, const char *, pid_t, uid_t);
 
 #endif /* _SSH_AUDIT_H */
-Index: openssh-8.4p1/auditstub.c
+Index: openssh-8.8p1/auditstub.c
 ===================================================================
 --- /dev/null
-+++ openssh-8.4p1/auditstub.c
+++ openssh-8.8p1/auditstub.c
@@ -0,0 +1,52 @@
 +/* $Id: auditstub.c,v 1.1 jfch Exp $ */
 +
@ -743,20 +743,11 @@ Index: openssh-8.4p1/auditstub.c
 +audit_session_key_free_body(struct ssh *ssh, int ctos, pid_t pid, uid_t uid)
 +{
 +}
-Index: openssh-8.4p1/auth.c
+Index: openssh-8.8p1/auth.c
 ===================================================================
--- openssh-8.4p1.orig/auth.c
-+++ openssh-8.4p1/auth.c
-@@ -367,7 +367,7 @@ auth_log(struct ssh *ssh, int authentica
- # endif
- #endif
- #ifdef SSH_AUDIT_EVENTS
-	if (authenticated == 0 && !authctxt->postponed)
-+	if (authenticated == 0 && !authctxt->postponed && !partial)
- 		audit_event(ssh, audit_classify_auth(method));
- #endif
- }
-@@ -593,9 +593,6 @@ getpwnamallow(struct ssh *ssh, const cha
+--- openssh-8.8p1.orig/auth.c
+++ openssh-8.8p1/auth.c
+@@ -599,9 +599,6 @@ getpwnamallow(struct ssh *ssh, const cha
 		record_failed_login(ssh, user,
 		    auth_get_canonical_hostname(ssh, options.use_dns), "ssh");
 #endif
@ -766,10 +757,10 @@ Index: openssh-8.4p1/auth.c
 		return (NULL);
 	}
 	if (!allowed_user(ssh, pw))
-Index: openssh-8.4p1/auth.h
+Index: openssh-8.8p1/auth.h
 ===================================================================
--- openssh-8.4p1.orig/auth.h
-+++ openssh-8.4p1/auth.h
+--- openssh-8.8p1.orig/auth.h
+++ openssh-8.8p1/auth.h
@@ -189,6 +189,8 @@ struct passwd * getpwnamallow(struct ssh
 
 char	*expand_authorized_keys(const char *, struct passwd *pw);
@ -788,11 +779,11 @@ Index: openssh-8.4p1/auth.h
 
 /* Key / cert options linkage to auth layer */
 const struct sshauthopt *auth_options(struct ssh *);
-Index: openssh-8.4p1/auth2-hostbased.c
+Index: openssh-8.8p1/auth2-hostbased.c
 ===================================================================
--- openssh-8.4p1.orig/auth2-hostbased.c
-+++ openssh-8.4p1/auth2-hostbased.c
-@@ -150,7 +150,7 @@ userauth_hostbased(struct ssh *ssh)
+--- openssh-8.8p1.orig/auth2-hostbased.c
+++ openssh-8.8p1/auth2-hostbased.c
+@@ -149,7 +149,7 @@ userauth_hostbased(struct ssh *ssh)
 	authenticated = 0;
 	if (PRIVSEP(hostbased_key_allowed(ssh, authctxt->pw, cuser,
 	    chost, key)) &&
@ -801,7 +792,7 @@ Index: openssh-8.4p1/auth2-hostbased.c
 	    sshbuf_ptr(b), sshbuf_len(b), pkalg, ssh->compat, NULL)) == 0)
 		authenticated = 1;
 
-@@ -167,6 +167,19 @@ done:
+@@ -166,6 +166,19 @@ done:
 	return authenticated;
 }
 
@ -821,11 +812,11 @@ Index: openssh-8.4p1/auth2-hostbased.c
 /* return 1 if given hostkey is allowed */
 int
 hostbased_key_allowed(struct ssh *ssh, struct passwd *pw,
-Index: openssh-8.4p1/auth2-pubkey.c
+Index: openssh-8.8p1/auth2-pubkey.c
 ===================================================================
--- openssh-8.4p1.orig/auth2-pubkey.c
-+++ openssh-8.4p1/auth2-pubkey.c
-@@ -212,7 +212,7 @@ userauth_pubkey(struct ssh *ssh)
+--- openssh-8.8p1.orig/auth2-pubkey.c
+++ openssh-8.8p1/auth2-pubkey.c
+@@ -203,7 +203,7 @@ userauth_pubkey(struct ssh *ssh)
 		/* test for correct signature */
 		authenticated = 0;
 		if (PRIVSEP(user_key_allowed(ssh, pw, key, 1, &authopts)) &&
@ -834,7 +825,7 @@ Index: openssh-8.4p1/auth2-pubkey.c
 		    sshbuf_ptr(b), sshbuf_len(b),
 		    (ssh->compat & SSH_BUG_SIGTYPE) == 0 ? pkalg : NULL,
 		    ssh->compat, &sig_details)) == 0) {
-@@ -308,6 +308,19 @@ done:
+@@ -295,6 +295,19 @@ done:
 	return authenticated;
 }
 
@ -854,11 +845,11 @@ Index: openssh-8.4p1/auth2-pubkey.c
 static int
 match_principals_option(const char *principal_list, struct sshkey_cert *cert)
 {
-Index: openssh-8.4p1/auth2.c
+Index: openssh-8.8p1/auth2.c
 ===================================================================
--- openssh-8.4p1.orig/auth2.c
-+++ openssh-8.4p1/auth2.c
-@@ -293,9 +293,6 @@ input_userauth_request(int type, u_int32
+--- openssh-8.8p1.orig/auth2.c
+++ openssh-8.8p1/auth2.c
+@@ -290,9 +290,6 @@ input_userauth_request(int type, u_int32
 		} else {
 			/* Invalid user, fake password information */
 			authctxt->pw = fakepw();
@ -868,10 +859,10 @@ Index: openssh-8.4p1/auth2.c
 		}
 #ifdef USE_PAM
 		if (options.use_pam)
-Index: openssh-8.4p1/cipher.c
+Index: openssh-8.8p1/cipher.c
 ===================================================================
--- openssh-8.4p1.orig/cipher.c
-+++ openssh-8.4p1/cipher.c
+--- openssh-8.8p1.orig/cipher.c
+++ openssh-8.8p1/cipher.c
@@ -58,25 +58,6 @@
 #define EVP_CIPHER_CTX void
 #endif
@ -898,7 +889,7 @@ Index: openssh-8.4p1/cipher.c
 static const struct sshcipher ciphers_all[] = {
 #ifdef WITH_OPENSSL
 #ifndef OPENSSL_NO_DES
-@@ -462,7 +443,7 @@ cipher_get_length(struct sshcipher_ctx *
+@@ -460,7 +441,7 @@ cipher_get_length(struct sshcipher_ctx *
 void
 cipher_free(struct sshcipher_ctx *cc)
 {
@ -907,10 +898,10 @@ Index: openssh-8.4p1/cipher.c
 		return;
 	if ((cc->cipher->flags & CFLAG_CHACHAPOLY) != 0) {
 		chachapoly_free(cc->cp_ctx);
-Index: openssh-8.4p1/cipher.h
+Index: openssh-8.8p1/cipher.h
 ===================================================================
--- openssh-8.4p1.orig/cipher.h
-+++ openssh-8.4p1/cipher.h
+--- openssh-8.8p1.orig/cipher.h
+++ openssh-8.8p1/cipher.h
@@ -47,7 +47,25 @@
 #define CIPHER_ENCRYPT		1
 #define CIPHER_DECRYPT		0
@ -938,10 +929,10 @@ Index: openssh-8.4p1/cipher.h
 struct sshcipher_ctx {
 	int	plaintext;
 	int	encrypt;
-Index: openssh-8.4p1/kex.c
+Index: openssh-8.8p1/kex.c
 ===================================================================
--- openssh-8.4p1.orig/kex.c
-+++ openssh-8.4p1/kex.c
+--- openssh-8.8p1.orig/kex.c
+++ openssh-8.8p1/kex.c
@@ -62,6 +62,7 @@
 #include "ssherr.h"
 #include "sshbuf.h"
@ -950,7 +941,7 @@ Index: openssh-8.4p1/kex.c
 
 #ifdef GSSAPI
 #include "ssh-gss.h"
-@@ -857,12 +858,16 @@ kex_start_rekex(struct ssh *ssh)
+@@ -859,12 +860,16 @@ kex_start_rekex(struct ssh *ssh)
 }
 
 static int
@ -967,9 +958,9 @@ Index: openssh-8.4p1/kex.c
 		return SSH_ERR_NO_CIPHER_ALG_MATCH;
 +	}
 	if ((enc->cipher = cipher_by_name(name)) == NULL) {
- 		error("%s: unsupported cipher %s", __func__, name);
+ 		error_f("unsupported cipher %s", name);
 		free(name);
-@@ -883,8 +888,12 @@ choose_mac(struct ssh *ssh, struct sshma
+@@ -885,8 +890,12 @@ choose_mac(struct ssh *ssh, struct sshma
 {
 	char *name = match_list(client, server, NULL);
 
@ -981,9 +972,9 @@ Index: openssh-8.4p1/kex.c
 		return SSH_ERR_NO_MAC_ALG_MATCH;
 +	}
 	if (mac_setup(mac, name) < 0) {
- 		error("%s: unsupported MAC %s", __func__, name);
+ 		error_f("unsupported MAC %s", name);
 		free(name);
-@@ -897,12 +906,16 @@ choose_mac(struct ssh *ssh, struct sshma
+@@ -899,12 +908,16 @@ choose_mac(struct ssh *ssh, struct sshma
 }
 
 static int
@ -1002,7 +993,7 @@ Index: openssh-8.4p1/kex.c
 #ifdef WITH_ZLIB
 	if (strcmp(name, "zlib@openssh.com") == 0) {
 		comp->type = COMP_DELAYED;
-@@ -1043,7 +1056,7 @@ kex_choose_conf(struct ssh *ssh)
+@@ -1045,7 +1058,7 @@ kex_choose_conf(struct ssh *ssh)
 		nenc  = ctos ? PROPOSAL_ENC_ALGS_CTOS  : PROPOSAL_ENC_ALGS_STOC;
 		nmac  = ctos ? PROPOSAL_MAC_ALGS_CTOS  : PROPOSAL_MAC_ALGS_STOC;
 		ncomp = ctos ? PROPOSAL_COMP_ALGS_CTOS : PROPOSAL_COMP_ALGS_STOC;
@ -1011,7 +1002,7 @@ Index: openssh-8.4p1/kex.c
 		    sprop[nenc])) != 0) {
 			kex->failed_choice = peer[nenc];
 			peer[nenc] = NULL;
-@@ -1058,7 +1071,7 @@ kex_choose_conf(struct ssh *ssh)
+@@ -1060,7 +1073,7 @@ kex_choose_conf(struct ssh *ssh)
 			peer[nmac] = NULL;
 			goto out;
 		}
@ -1020,7 +1011,7 @@ Index: openssh-8.4p1/kex.c
 		    sprop[ncomp])) != 0) {
 			kex->failed_choice = peer[ncomp];
 			peer[ncomp] = NULL;
-@@ -1081,6 +1094,10 @@ kex_choose_conf(struct ssh *ssh)
+@@ -1083,6 +1096,10 @@ kex_choose_conf(struct ssh *ssh)
 		dh_need = MAXIMUM(dh_need, newkeys->enc.block_size);
 		dh_need = MAXIMUM(dh_need, newkeys->enc.iv_len);
 		dh_need = MAXIMUM(dh_need, newkeys->mac.key_len);
@ -1031,7 +1022,7 @@ Index: openssh-8.4p1/kex.c
 	}
 	/* XXX need runden? */
 	kex->we_need = need;
-@@ -1245,6 +1262,36 @@ dump_digest(const char *msg, const u_cha
+@@ -1250,6 +1267,36 @@ dump_digest(const char *msg, const u_cha
 }
 #endif
 
@ -1068,10 +1059,10 @@ Index: openssh-8.4p1/kex.c
 /*
  * Send a plaintext error message to the peer, suffixed by \r\n.
  * Only used during banner exchange, and there only for the server.
-Index: openssh-8.4p1/kex.h
+Index: openssh-8.8p1/kex.h
 ===================================================================
--- openssh-8.4p1.orig/kex.h
-+++ openssh-8.4p1/kex.h
+--- openssh-8.8p1.orig/kex.h
+++ openssh-8.8p1/kex.h
@@ -226,6 +226,8 @@ int	 kexgss_client(struct ssh *);
 int	 kexgss_server(struct ssh *);
 #endif
@ -1081,10 +1072,10 @@ Index: openssh-8.4p1/kex.h
 int	 kex_dh_keypair(struct kex *);
 int	 kex_dh_enc(struct kex *, const struct sshbuf *, struct sshbuf **,
     struct sshbuf **);
-Index: openssh-8.4p1/mac.c
+Index: openssh-8.8p1/mac.c
 ===================================================================
--- openssh-8.4p1.orig/mac.c
-+++ openssh-8.4p1/mac.c
+--- openssh-8.8p1.orig/mac.c
+++ openssh-8.8p1/mac.c
@@ -277,6 +277,20 @@ mac_clear(struct sshmac *mac)
 	mac->umac_ctx = NULL;
 }
@ -1106,10 +1097,10 @@ Index: openssh-8.4p1/mac.c
 /* XXX copied from ciphers_valid */
 #define	MAC_SEP	","
 int
-Index: openssh-8.4p1/mac.h
+Index: openssh-8.8p1/mac.h
 ===================================================================
--- openssh-8.4p1.orig/mac.h
-+++ openssh-8.4p1/mac.h
+--- openssh-8.8p1.orig/mac.h
+++ openssh-8.8p1/mac.h
@@ -49,5 +49,6 @@ int	 mac_compute(struct sshmac *, u_int3
 int	 mac_check(struct sshmac *, u_int32_t, const u_char *, size_t,
     const u_char *, size_t);
@ -1117,10 +1108,10 @@ Index: openssh-8.4p1/mac.h
 +void	 mac_destroy(struct sshmac *);
 
 #endif /* SSHMAC_H */
-Index: openssh-8.4p1/monitor.c
+Index: openssh-8.8p1/monitor.c
 ===================================================================
--- openssh-8.4p1.orig/monitor.c
-+++ openssh-8.4p1/monitor.c
+--- openssh-8.8p1.orig/monitor.c
+++ openssh-8.8p1/monitor.c
@@ -93,6 +93,7 @@
 #include "compat.h"
 #include "ssh2.h"
@ -1129,7 +1120,7 @@ Index: openssh-8.4p1/monitor.c
 #include "match.h"
 #include "ssherr.h"
 #include "sk-api.h"
-@@ -108,6 +109,8 @@ extern u_char session_id[];
+@@ -107,6 +108,8 @@ extern u_int utmp_len;
 extern struct sshbuf *loginmsg;
 extern struct sshauthopt *auth_opts; /* XXX move to permanent ssh->authctxt? */
 
@ -1138,7 +1129,7 @@ Index: openssh-8.4p1/monitor.c
 /* State exported from the child */
 static struct sshbuf *child_state;
 
-@@ -155,6 +158,11 @@ int mm_answer_gss_updatecreds(struct ssh
+@@ -152,6 +155,11 @@ int mm_answer_gss_updatecreds(struct ssh
 #ifdef SSH_AUDIT_EVENTS
 int mm_answer_audit_event(struct ssh *, int, struct sshbuf *);
 int mm_answer_audit_command(struct ssh *, int, struct sshbuf *);
@ -1150,7 +1141,7 @@ Index: openssh-8.4p1/monitor.c
 #endif
 
 static Authctxt *authctxt;
-@@ -210,6 +218,10 @@ struct mon_table mon_dispatch_proto20[]
+@@ -207,6 +215,10 @@ struct mon_table mon_dispatch_proto20[]
 #endif
 #ifdef SSH_AUDIT_EVENTS
     {MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
@ -1161,7 +1152,7 @@ Index: openssh-8.4p1/monitor.c
 #endif
 #ifdef BSD_AUTH
     {MONITOR_REQ_BSDAUTHQUERY, MON_ISAUTH, mm_answer_bsdauthquery},
-@@ -244,6 +256,11 @@ struct mon_table mon_dispatch_postauth20
+@@ -241,6 +253,11 @@ struct mon_table mon_dispatch_postauth20
 #ifdef SSH_AUDIT_EVENTS
     {MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
     {MONITOR_REQ_AUDIT_COMMAND, MON_PERMIT, mm_answer_audit_command},
@ -1173,7 +1164,7 @@ Index: openssh-8.4p1/monitor.c
 #endif
     {0, 0, NULL}
 };
-@@ -1407,8 +1424,10 @@ mm_answer_keyverify(struct ssh *ssh, int
+@@ -1403,8 +1420,10 @@ mm_answer_keyverify(struct ssh *ssh, int
 	int r, ret, req_presence = 0, req_verify = 0, valid_data = 0;
 	int encoded_ret;
 	struct sshkey_sig_details *sig_details = NULL;
@ -1185,18 +1176,18 @@ Index: openssh-8.4p1/monitor.c
 	    (r = sshbuf_get_string_direct(m, &signature, &signaturelen)) != 0 ||
 	    (r = sshbuf_get_string_direct(m, &data, &datalen)) != 0 ||
 	    (r = sshbuf_get_cstring(m, &sigalg, NULL)) != 0)
-@@ -1417,6 +1436,8 @@ mm_answer_keyverify(struct ssh *ssh, int
+@@ -1413,6 +1432,8 @@ mm_answer_keyverify(struct ssh *ssh, int
 	if (hostbased_cuser == NULL || hostbased_chost == NULL ||
 	  !monitor_allowed_key(blob, bloblen))
- 		fatal("%s: bad key, not previously allowed", __func__);
+ 		fatal_f("bad key, not previously allowed");
 +	if (type != key_blobtype)
-+		fatal("%s: bad key type", __func__);
+		fatal_f("bad key type");
 
 	/* Empty signature algorithm means NULL. */
 	if (*sigalg == '\0') {
-@@ -1432,14 +1453,19 @@ mm_answer_keyverify(struct ssh *ssh, int
+@@ -1428,14 +1449,19 @@ mm_answer_keyverify(struct ssh *ssh, int
 	case MM_USERKEY:
- 		valid_data = monitor_valid_userblob(data, datalen);
+ 		valid_data = monitor_valid_userblob(ssh, data, datalen);
 		auth_method = "publickey";
 +		ret = user_key_verify(ssh, key, signature, signaturelen, data,
 +		    datalen, sigalg, ssh->compat, &sig_details);
@ -1214,55 +1205,55 @@ Index: openssh-8.4p1/monitor.c
 		break;
 	}
 	if (!valid_data)
-@@ -1449,8 +1475,6 @@ mm_answer_keyverify(struct ssh *ssh, int
+@@ -1447,8 +1473,6 @@ mm_answer_keyverify(struct ssh *ssh, int
 	    SSH_FP_DEFAULT)) == NULL)
- 		fatal("%s: sshkey_fingerprint failed", __func__);
+ 		fatal_f("sshkey_fingerprint failed");
 
 -	ret = sshkey_verify(key, signature, signaturelen, data, datalen,
 -	    sigalg, ssh->compat, &sig_details);
- 	debug3("%s: %s %p signature %s%s%s", __func__, auth_method, key,
+ 	debug3_f("%s %s signature %s%s%s", auth_method, sshkey_type(key),
 	    (ret == 0) ? "verified" : "unverified",
 	    (ret != 0) ? ": " : "", (ret != 0) ? ssh_err(ret) : "");
-@@ -1537,13 +1561,19 @@ mm_record_login(struct ssh *ssh, Session
+@@ -1535,13 +1559,19 @@ mm_record_login(struct ssh *ssh, Session
 }
 
 static void
 -mm_session_close(Session *s)
 +mm_session_close(struct ssh *ssh, Session *s)
 {
- 	debug3("%s: session %d pid %ld", __func__, s->self, (long)s->pid);
+ 	debug3_f("session %d pid %ld", s->self, (long)s->pid);
 	if (s->ttyfd != -1) {
- 		debug3("%s: tty %s ptyfd %d", __func__, s->tty, s->ptyfd);
+ 		debug3_f("tty %s ptyfd %d", s->tty, s->ptyfd);
 		session_pty_cleanup2(s);
 	}
 +#ifdef SSH_AUDIT_EVENTS
 +	if (s->command != NULL) {
-+		debug3("%s: command %d", __func__, s->command_handle);
+		debug3_f("command %d", s->command_handle);
 +		session_end_command2(ssh, s);
 +	}
 +#endif
 	session_unused(s->self);
 }
 
-@@ -1610,7 +1640,7 @@ mm_answer_pty(struct ssh *ssh, int sock,
+@@ -1608,7 +1638,7 @@ mm_answer_pty(struct ssh *ssh, int sock,
 
  error:
 	if (s != NULL)
 -		mm_session_close(s);
 +		mm_session_close(ssh, s);
 	if ((r = sshbuf_put_u32(m, 0)) != 0)
- 		fatal("%s: buffer error: %s", __func__, ssh_err(r));
+ 		fatal_fr(r, "assemble 0");
 	mm_request_send(sock, MONITOR_ANS_PTY, m);
-@@ -1629,7 +1659,7 @@ mm_answer_pty_cleanup(struct ssh *ssh, i
+@@ -1627,7 +1657,7 @@ mm_answer_pty_cleanup(struct ssh *ssh, i
 	if ((r = sshbuf_get_cstring(m, &tty, NULL)) != 0)
- 		fatal("%s: buffer error: %s", __func__, ssh_err(r));
+ 		fatal_fr(r, "parse tty");
 	if ((s = session_by_tty(tty)) != NULL)
 -		mm_session_close(s);
 +		mm_session_close(ssh, s);
 	sshbuf_reset(m);
 	free(tty);
 	return (0);
-@@ -1651,6 +1681,8 @@ mm_answer_term(struct ssh *ssh, int sock
+@@ -1649,6 +1679,8 @@ mm_answer_term(struct ssh *ssh, int sock
 		sshpam_cleanup();
 #endif
 
@ -1271,7 +1262,7 @@ Index: openssh-8.4p1/monitor.c
 	while (waitpid(pmonitor->m_pid, &status, 0) == -1)
 		if (errno != EINTR)
 			exit(1);
-@@ -1697,12 +1729,47 @@ mm_answer_audit_command(struct ssh *ssh,
+@@ -1695,12 +1727,47 @@ mm_answer_audit_command(struct ssh *ssh,
 {
 	char *cmd;
 	int r;
@ -1320,18 +1311,18 @@ Index: openssh-8.4p1/monitor.c
 	free(cmd);
 	return (0);
 }
-@@ -1768,6 +1835,7 @@ monitor_apply_keystate(struct ssh *ssh,
+@@ -1772,6 +1839,7 @@ monitor_apply_keystate(struct ssh *ssh,
 void
 mm_get_keystate(struct ssh *ssh, struct monitor *pmonitor)
 {
 +	struct sshbuf *m;
- 	debug3("%s: Waiting for new keys", __func__);
+ 	debug3_f("Waiting for new keys");
 
 	if ((child_state = sshbuf_new()) == NULL)
-@@ -1775,6 +1843,19 @@ mm_get_keystate(struct ssh *ssh, struct
+@@ -1779,6 +1847,18 @@ mm_get_keystate(struct ssh *ssh, struct
 	mm_request_receive_expect(pmonitor->m_sendfd, MONITOR_REQ_KEYEXPORT,
 	    child_state);
- 	debug3("%s: GOT new keys", __func__);
+ 	debug3_f("GOT new keys");
 +
 +#ifdef SSH_AUDIT_EVENTS
 +	m = sshbuf_new();
@ -1344,11 +1335,10 @@ Index: openssh-8.4p1/monitor.c
 +	/* Drain any buffered messages from the child */
 +	while (pmonitor->m_log_recvfd >= 0 && monitor_read_log(pmonitor) == 0)
 +		;
-+
 }
 
 
-@@ -2052,3 +2133,102 @@ mm_answer_gss_updatecreds(struct ssh *ss
+@@ -2056,3 +2136,102 @@ mm_answer_gss_updatecreds(struct ssh *ss
 
 #endif /* GSSAPI */
 
@ -1451,10 +1441,10 @@ Index: openssh-8.4p1/monitor.c
 +	return 0;
 +}
 +#endif /* SSH_AUDIT_EVENTS */
-Index: openssh-8.4p1/monitor.h
+Index: openssh-8.8p1/monitor.h
 ===================================================================
--- openssh-8.4p1.orig/monitor.h
-+++ openssh-8.4p1/monitor.h
+--- openssh-8.8p1.orig/monitor.h
+++ openssh-8.8p1/monitor.h
@@ -61,7 +61,13 @@ enum monitor_reqtype {
 	MONITOR_REQ_PAM_QUERY = 106, MONITOR_ANS_PAM_QUERY = 107,
 	MONITOR_REQ_PAM_RESPOND = 108, MONITOR_ANS_PAM_RESPOND = 109,
@ -1470,11 +1460,11 @@ Index: openssh-8.4p1/monitor.h
 
 	MONITOR_REQ_GSSSIGN = 150, MONITOR_ANS_GSSSIGN = 151,
 	MONITOR_REQ_GSSUPCREDS = 152, MONITOR_ANS_GSSUPCREDS = 153,
-Index: openssh-8.4p1/monitor_wrap.c
+Index: openssh-8.8p1/monitor_wrap.c
 ===================================================================
--- openssh-8.4p1.orig/monitor_wrap.c
-+++ openssh-8.4p1/monitor_wrap.c
-@@ -492,7 +492,7 @@ mm_key_allowed(enum mm_keytype type, con
+--- openssh-8.8p1.orig/monitor_wrap.c
+++ openssh-8.8p1/monitor_wrap.c
+@@ -499,7 +499,7 @@ mm_key_allowed(enum mm_keytype type, con
  */
 
 int
@ -1483,17 +1473,17 @@ Index: openssh-8.4p1/monitor_wrap.c
     const u_char *data, size_t datalen, const char *sigalg, u_int compat,
     struct sshkey_sig_details **sig_detailsp)
 {
-@@ -508,7 +508,8 @@ mm_sshkey_verify(const struct sshkey *ke
+@@ -515,7 +515,8 @@ mm_sshkey_verify(const struct sshkey *ke
 		*sig_detailsp = NULL;
 	if ((m = sshbuf_new()) == NULL)
- 		fatal("%s: sshbuf_new failed", __func__);
+ 		fatal_f("sshbuf_new failed");
 -	if ((r = sshkey_puts(key, m)) != 0 ||
 +	if ((r = sshbuf_put_u32(m, type)) != 0 ||
 +	    (r = sshkey_puts(key, m)) != 0 ||
 	    (r = sshbuf_put_string(m, sig, siglen)) != 0 ||
 	    (r = sshbuf_put_string(m, data, datalen)) != 0 ||
 	    (r = sshbuf_put_cstring(m, sigalg == NULL ? "" : sigalg)) != 0)
-@@ -541,6 +542,20 @@ mm_sshkey_verify(const struct sshkey *ke
+@@ -548,6 +549,20 @@ mm_sshkey_verify(const struct sshkey *ke
 	return 0;
 }
 
@ -1514,7 +1504,7 @@ Index: openssh-8.4p1/monitor_wrap.c
 void
 mm_send_keystate(struct ssh *ssh, struct monitor *monitor)
 {
-@@ -894,11 +909,12 @@ mm_audit_event(struct ssh *ssh, ssh_audi
+@@ -900,11 +915,12 @@ mm_audit_event(struct ssh *ssh, ssh_audi
 	sshbuf_free(m);
 }
 
@ -1529,7 +1519,7 @@ Index: openssh-8.4p1/monitor_wrap.c
 
 	debug3("%s entering command %s", __func__, command);
 
-@@ -908,6 +924,30 @@ mm_audit_run_command(const char *command
+@@ -914,6 +930,30 @@ mm_audit_run_command(const char *command
 		fatal("%s: buffer error: %s", __func__, ssh_err(r));
 
 	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUDIT_COMMAND, m);
@ -1560,7 +1550,7 @@ Index: openssh-8.4p1/monitor_wrap.c
 	sshbuf_free(m);
 }
 #endif /* SSH_AUDIT_EVENTS */
-@@ -1068,3 +1108,83 @@ mm_ssh_gssapi_update_creds(ssh_gssapi_cc
+@@ -1074,3 +1114,83 @@ mm_ssh_gssapi_update_creds(ssh_gssapi_cc
 }
 
 #endif /* GSSAPI */
@ -1644,10 +1634,10 @@ Index: openssh-8.4p1/monitor_wrap.c
 +	sshbuf_free(m);
 +}
 +#endif /* SSH_AUDIT_EVENTS */
-Index: openssh-8.4p1/monitor_wrap.h
+Index: openssh-8.8p1/monitor_wrap.h
 ===================================================================
--- openssh-8.4p1.orig/monitor_wrap.h
-+++ openssh-8.4p1/monitor_wrap.h
+--- openssh-8.8p1.orig/monitor_wrap.h
+++ openssh-8.8p1/monitor_wrap.h
@@ -58,7 +58,9 @@ int mm_user_key_allowed(struct ssh *, st
     struct sshauthopt **);
 int mm_hostbased_key_allowed(struct ssh *, struct passwd *, const char *,
@ -1673,10 +1663,10 @@ Index: openssh-8.4p1/monitor_wrap.h
 #endif
 
 struct Session;
-Index: openssh-8.4p1/packet.c
+Index: openssh-8.8p1/packet.c
 ===================================================================
--- openssh-8.4p1.orig/packet.c
-+++ openssh-8.4p1/packet.c
+--- openssh-8.8p1.orig/packet.c
+++ openssh-8.8p1/packet.c
@@ -81,6 +81,7 @@
 #endif
 
@ -1685,7 +1675,7 @@ Index: openssh-8.4p1/packet.c
 #include "compat.h"
 #include "ssh2.h"
 #include "cipher.h"
-@@ -518,6 +519,13 @@ ssh_packet_get_connection_out(struct ssh
+@@ -506,6 +507,13 @@ ssh_packet_get_connection_out(struct ssh
 	return ssh->state->connection_out;
 }
 
@ -1699,7 +1689,7 @@ Index: openssh-8.4p1/packet.c
 /*
  * Returns the IP-address of the remote host as a string.  The returned
  * string must not be freed.
-@@ -595,22 +603,19 @@ ssh_packet_close_internal(struct ssh *ss
+@@ -583,22 +591,19 @@ ssh_packet_close_internal(struct ssh *ss
 {
 	struct session_state *state = ssh->state;
 	u_int mode;
@ -1727,7 +1717,7 @@ Index: openssh-8.4p1/packet.c
 	for (mode = 0; mode < MODE_MAX; mode++) {
 		kex_free_newkeys(state->newkeys[mode]);	/* current keys */
 		state->newkeys[mode] = NULL;
-@@ -646,8 +651,18 @@ ssh_packet_close_internal(struct ssh *ss
+@@ -634,8 +639,18 @@ ssh_packet_close_internal(struct ssh *ss
 #endif	/* WITH_ZLIB */
 	cipher_free(state->send_context);
 	cipher_free(state->receive_context);
@ -1746,15 +1736,15 @@ Index: openssh-8.4p1/packet.c
 		free(ssh->local_ipaddr);
 		ssh->local_ipaddr = NULL;
 		free(ssh->remote_ipaddr);
-@@ -904,6 +919,7 @@ ssh_set_newkeys(struct ssh *ssh, int mod
- 		   (unsigned long long)state->p_send.bytes,
- 		   (unsigned long long)state->p_send.blocks);
+@@ -892,6 +907,7 @@ ssh_set_newkeys(struct ssh *ssh, int mod
+ 		    (unsigned long long)state->p_send.bytes,
+ 		    (unsigned long long)state->p_send.blocks);
 		kex_free_newkeys(state->newkeys[mode]);
 +		audit_session_key_free(ssh, mode);
 		state->newkeys[mode] = NULL;
 	}
 	/* note that both bytes and the seqnr are not reset */
-@@ -2210,6 +2226,73 @@ ssh_packet_get_output(struct ssh *ssh)
+@@ -2178,6 +2194,73 @@ ssh_packet_get_output(struct ssh *ssh)
 	return (void *)ssh->state->output;
 }
 
@ -1828,20 +1818,20 @@ Index: openssh-8.4p1/packet.c
 /* Reset after_authentication and reset compression in post-auth privsep */
 static int
 ssh_packet_set_postauth(struct ssh *ssh)
-Index: openssh-8.4p1/packet.h
+Index: openssh-8.8p1/packet.h
 ===================================================================
--- openssh-8.4p1.orig/packet.h
-+++ openssh-8.4p1/packet.h
-@@ -218,4 +218,5 @@ const u_char	*sshpkt_ptr(struct ssh *, s
+--- openssh-8.8p1.orig/packet.h
+++ openssh-8.8p1/packet.h
+@@ -219,4 +219,5 @@ const u_char	*sshpkt_ptr(struct ssh *, s
 # undef EC_POINT
 #endif
 
 +void	 packet_destroy_all(struct ssh *, int, int);
 #endif				/* PACKET_H */
-Index: openssh-8.4p1/session.c
+Index: openssh-8.8p1/session.c
 ===================================================================
--- openssh-8.4p1.orig/session.c
-+++ openssh-8.4p1/session.c
+--- openssh-8.8p1.orig/session.c
+++ openssh-8.8p1/session.c
@@ -136,7 +136,7 @@ extern char *__progname;
 extern int debug_flag;
 extern u_int utmp_len;
@ -1851,7 +1841,7 @@ Index: openssh-8.4p1/session.c
 extern struct sshbuf *loginmsg;
 extern struct sshauthopt *auth_opts;
 extern char *tun_fwd_ifnames; /* serverloop.c */
-@@ -647,6 +647,14 @@ do_exec_pty(struct ssh *ssh, Session *s,
+@@ -643,6 +643,14 @@ do_exec_pty(struct ssh *ssh, Session *s,
 	/* Parent.  Close the slave side of the pseudo tty. */
 	close(ttyfd);
 
@ -1866,7 +1856,7 @@ Index: openssh-8.4p1/session.c
 	/* Enter interactive session. */
 	s->ptymaster = ptymaster;
 	ssh_packet_set_interactive(ssh, 1,
-@@ -711,15 +719,19 @@ do_exec(struct ssh *ssh, Session *s, con
+@@ -707,15 +715,19 @@ do_exec(struct ssh *ssh, Session *s, con
 	    s->self);
 
 #ifdef SSH_AUDIT_EVENTS
@ -1888,7 +1878,7 @@ Index: openssh-8.4p1/session.c
 #endif
 	if (s->ttyfd != -1)
 		ret = do_exec_pty(ssh, s, command);
-@@ -1542,8 +1554,11 @@ do_child(struct ssh *ssh, Session *s, co
+@@ -1534,8 +1546,11 @@ do_child(struct ssh *ssh, Session *s, co
 	sshpkt_fmt_connection_id(ssh, remote_id, sizeof(remote_id));
 
 	/* remove hostkey from the child's memory */
@ -1901,7 +1891,7 @@ Index: openssh-8.4p1/session.c
 
 	/* Force a password change */
 	if (s->authctxt->force_pwchange) {
-@@ -1752,6 +1767,9 @@ session_unused(int id)
+@@ -1744,6 +1759,9 @@ session_unused(int id)
 	sessions[id].ttyfd = -1;
 	sessions[id].ptymaster = -1;
 	sessions[id].x11_chanids = NULL;
@ -1911,7 +1901,7 @@ Index: openssh-8.4p1/session.c
 	sessions[id].next_unused = sessions_first_unused;
 	sessions_first_unused = id;
 }
-@@ -1834,6 +1852,19 @@ session_open(Authctxt *authctxt, int cha
+@@ -1823,6 +1841,19 @@ session_open(Authctxt *authctxt, int cha
 }
 
 Session *
@ -1931,7 +1921,7 @@ Index: openssh-8.4p1/session.c
 session_by_tty(char *tty)
 {
 	int i;
-@@ -2444,6 +2475,32 @@ session_exit_message(struct ssh *ssh, Se
+@@ -2430,6 +2461,32 @@ session_exit_message(struct ssh *ssh, Se
 		chan_write_failed(ssh, c);
 }
 
@ -1964,7 +1954,7 @@ Index: openssh-8.4p1/session.c
 void
 session_close(struct ssh *ssh, Session *s)
 {
-@@ -2485,6 +2542,10 @@ session_close(struct ssh *ssh, Session *
+@@ -2471,6 +2528,10 @@ session_close(struct ssh *ssh, Session *
 
 	if (s->ttyfd != -1)
 		session_pty_cleanup(s);
@ -1975,7 +1965,7 @@ Index: openssh-8.4p1/session.c
 	free(s->term);
 	free(s->display);
 	free(s->x11_chanids);
-@@ -2560,14 +2621,14 @@ session_close_by_channel(struct ssh *ssh
+@@ -2545,14 +2606,14 @@ session_close_by_channel(struct ssh *ssh
 }
 
 void
@ -1992,7 +1982,7 @@ Index: openssh-8.4p1/session.c
 			else
 				session_close(ssh, s);
 		}
-@@ -2693,6 +2754,15 @@ do_authenticated2(struct ssh *ssh, Authc
+@@ -2678,6 +2739,15 @@ do_authenticated2(struct ssh *ssh, Authc
 	server_loop2(ssh, authctxt);
 }
 
@ -2008,7 +1998,7 @@ Index: openssh-8.4p1/session.c
 void
 do_cleanup(struct ssh *ssh, Authctxt *authctxt)
 {
-@@ -2756,7 +2826,7 @@ do_cleanup(struct ssh *ssh, Authctxt *au
+@@ -2741,7 +2811,7 @@ do_cleanup(struct ssh *ssh, Authctxt *au
 	 * or if running in monitor.
 	 */
 	if (!use_privsep || mm_is_monitor())
@ -2017,10 +2007,10 @@ Index: openssh-8.4p1/session.c
 }
 
 /* Return a name for the remote host that fits inside utmp_size */
-Index: openssh-8.4p1/session.h
+Index: openssh-8.8p1/session.h
 ===================================================================
--- openssh-8.4p1.orig/session.h
-+++ openssh-8.4p1/session.h
+--- openssh-8.8p1.orig/session.h
+++ openssh-8.8p1/session.h
@@ -61,6 +61,12 @@ struct Session {
 		char	*name;
 		char	*val;
@ -2048,10 +2038,10 @@ Index: openssh-8.4p1/session.h
 Session	*session_by_tty(char *);
 void	 session_close(struct ssh *, Session *);
 void	 do_setusercontext(struct passwd *);
-Index: openssh-8.4p1/sshd.c
+Index: openssh-8.8p1/sshd.c
 ===================================================================
--- openssh-8.4p1.orig/sshd.c
-+++ openssh-8.4p1/sshd.c
+--- openssh-8.8p1.orig/sshd.c
+++ openssh-8.8p1/sshd.c
@@ -122,6 +122,7 @@
 #include "ssh-gss.h"
 #endif
@ -2060,7 +2050,7 @@ Index: openssh-8.4p1/sshd.c
 #include "ssh-sandbox.h"
 #include "auth-options.h"
 #include "version.h"
-@@ -267,8 +268,8 @@ struct sshbuf *loginmsg;
+@@ -262,8 +263,8 @@ struct sshbuf *loginmsg;
 struct passwd *privsep_pw = NULL;
 
 /* Prototypes for various functions defined later in this file. */
@ -2071,7 +2061,7 @@ Index: openssh-8.4p1/sshd.c
 static void do_ssh2_kex(struct ssh *);
 
 static char *listener_proctitle;
-@@ -286,6 +287,15 @@ close_listen_socks(void)
+@@ -281,6 +282,15 @@ close_listen_socks(void)
 	num_listen_socks = -1;
 }
 
@ -2087,8 +2077,8 @@ Index: openssh-8.4p1/sshd.c
 static void
 close_startup_pipes(void)
 {
-@@ -390,18 +400,45 @@ grace_alarm_handler(int sig)
- 	    ssh_remote_port(the_active_state));
+@@ -386,18 +396,45 @@ grace_alarm_handler(int sig)
+ 	}
 }
 
 -/* Destroy the host and server keys.  They will no longer be needed. */
@ -2136,7 +2126,7 @@ Index: openssh-8.4p1/sshd.c
 			sshkey_free(sensitive_data.host_certificates[i]);
 			sensitive_data.host_certificates[i] = NULL;
 		}
-@@ -410,14 +447,26 @@ destroy_sensitive_data(void)
+@@ -406,20 +443,38 @@ destroy_sensitive_data(void)
 
 /* Demote private to public keys for network child */
 void
@ -2163,9 +2153,8 @@ Index: openssh-8.4p1/sshd.c
 +				fp = NULL;
 			if ((r = sshkey_from_private(
 			    sensitive_data.host_keys[i], &tmp)) != 0)
- 				fatal("could not demote host %s key: %s",
-@@ -425,6 +474,12 @@ demote_sensitive_data(void)
- 				    ssh_err(r));
+ 				fatal_r(r, "could not demote host %s key",
+ 				    sshkey_type(sensitive_data.host_keys[i]));
 			sshkey_free(sensitive_data.host_keys[i]);
 			sensitive_data.host_keys[i] = tmp;
 +			if (fp != NULL) {
@ -2177,7 +2166,7 @@ Index: openssh-8.4p1/sshd.c
 		}
 		/* Certs do not need demotion */
 	}
-@@ -452,7 +507,7 @@ reseed_prngs(void)
+@@ -447,7 +502,7 @@ reseed_prngs(void)
 }
 
 static void
@ -2186,7 +2175,7 @@ Index: openssh-8.4p1/sshd.c
 {
 	gid_t gidset[1];
 
-@@ -467,7 +522,7 @@ privsep_preauth_child(void)
+@@ -462,7 +517,7 @@ privsep_preauth_child(void)
 	reseed_prngs();
 
 	/* Demote the private keys to public keys. */
@ -2195,7 +2184,7 @@ Index: openssh-8.4p1/sshd.c
 
 	/* Demote the child */
 	if (privsep_chroot) {
-@@ -502,7 +557,7 @@ privsep_preauth(struct ssh *ssh)
+@@ -497,7 +552,7 @@ privsep_preauth(struct ssh *ssh)
 
 	if (use_privsep == PRIVSEP_ON)
 		box = ssh_sandbox_init(pmonitor);
@ -2204,7 +2193,7 @@ Index: openssh-8.4p1/sshd.c
 	if (pid == -1) {
 		fatal("fork of unprivileged child failed");
 	} else if (pid != 0) {
-@@ -548,7 +603,7 @@ privsep_preauth(struct ssh *ssh)
+@@ -542,7 +597,7 @@ privsep_preauth(struct ssh *ssh)
 		/* Arrange for logging to be sent to the monitor */
 		set_log_handler(mm_log_handler, pmonitor);
 
@ -2213,7 +2202,7 @@ Index: openssh-8.4p1/sshd.c
 		setproctitle("%s", "[net]");
 		if (box != NULL)
 			ssh_sandbox_child(box);
-@@ -592,7 +647,7 @@ privsep_postauth(struct ssh *ssh, Authct
+@@ -586,7 +641,7 @@ privsep_postauth(struct ssh *ssh, Authct
 	pmonitor->m_sendfd = -1;
 
 	/* Demote the private keys to public keys. */
@ -2222,7 +2211,7 @@ Index: openssh-8.4p1/sshd.c
 
 	reseed_prngs();
 
-@@ -1159,7 +1214,7 @@ server_listen(void)
+@@ -1140,7 +1195,7 @@ server_listen(void)
  * from this function are in a forked subprocess.
  */
 static void
@ -2231,7 +2220,7 @@ Index: openssh-8.4p1/sshd.c
 {
 	fd_set *fdset;
 	int i, j, ret, maxfd;
-@@ -1220,6 +1275,7 @@ server_accept_loop(int *sock_in, int *so
+@@ -1186,6 +1241,7 @@ server_accept_loop(int *sock_in, int *so
 		if (received_sigterm) {
 			logit("Received signal %d; terminating.",
 			    (int) received_sigterm);
@ -2239,7 +2228,7 @@ Index: openssh-8.4p1/sshd.c
 			close_listen_socks();
 			if (options.pid_file != NULL)
 				unlink(options.pid_file);
-@@ -2089,7 +2145,7 @@ main(int ac, char **av)
+@@ -2091,7 +2147,7 @@ main(int ac, char **av)
 #endif
 
 		/* Accept a connection and return in a forked child */
@ -2248,7 +2237,7 @@ Index: openssh-8.4p1/sshd.c
 		    &newsock, config_s);
 	}
 
-@@ -2325,6 +2381,9 @@ main(int ac, char **av)
+@@ -2321,6 +2377,9 @@ main(int ac, char **av)
 	do_authenticated(ssh, authctxt);
 
 	/* The connection has been terminated. */
@ -2258,7 +2247,7 @@ Index: openssh-8.4p1/sshd.c
 	ssh_packet_get_bytes(ssh, &ibytes, &obytes);
 	verbose("Transferred: sent %llu, received %llu bytes",
 	    (unsigned long long)obytes, (unsigned long long)ibytes);
-@@ -2509,6 +2568,15 @@ do_ssh2_kex(struct ssh *ssh)
+@@ -2501,6 +2560,15 @@ do_ssh2_kex(struct ssh *ssh)
 void
 cleanup_exit(int i)
 {
@ -2274,8 +2263,8 @@ Index: openssh-8.4p1/sshd.c
 	if (the_active_state != NULL && the_authctxt != NULL) {
 		do_cleanup(the_active_state, the_authctxt);
 		if (use_privsep && privsep_is_preauth &&
-@@ -2520,9 +2588,16 @@ cleanup_exit(int i)
- 				    pmonitor->m_pid, strerror(errno));
+@@ -2513,9 +2581,16 @@ cleanup_exit(int i)
+ 			}
 		}
 	}
 +	is_privsep_child = use_privsep && pmonitor != NULL && pmonitor->m_pid == 0;
@ -2292,10 +2281,10 @@ Index: openssh-8.4p1/sshd.c
 		audit_event(the_active_state, SSH_CONNECTION_ABANDON);
 #endif
 	_exit(i);
-Index: openssh-8.4p1/sshkey.c
+Index: openssh-8.8p1/sshkey.c
 ===================================================================
--- openssh-8.4p1.orig/sshkey.c
-+++ openssh-8.4p1/sshkey.c
+--- openssh-8.8p1.orig/sshkey.c
+++ openssh-8.8p1/sshkey.c
@@ -371,6 +371,38 @@ sshkey_type_is_valid_ca(int type)
 }
 
@ -2335,11 +2324,11 @@ Index: openssh-8.4p1/sshkey.c
 sshkey_is_cert(const struct sshkey *k)
 {
 	if (k == NULL)
-Index: openssh-8.4p1/sshkey.h
+Index: openssh-8.8p1/sshkey.h
 ===================================================================
--- openssh-8.4p1.orig/sshkey.h
-+++ openssh-8.4p1/sshkey.h
-@@ -187,6 +187,7 @@ int		 sshkey_shield_private(struct sshke
+--- openssh-8.8p1.orig/sshkey.h
+++ openssh-8.8p1/sshkey.h
+@@ -189,6 +189,7 @@ int		 sshkey_shield_private(struct sshke
 int		 sshkey_unshield_private(struct sshkey *);
 
 int	 sshkey_type_from_name(const char *);
--- a/openssh-8.1p1-seccomp-clock_gettime64.patch
+++ b/openssh-8.1p1-seccomp-clock_gettime64.patch
@ -9,11 +9,11 @@ upcoming glibc ( 2.31 )
 sandbox-seccomp-filter.c | 3 +++
 1 file changed, 3 insertions(+)

-diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c
-index 3ef30c9d5..999c46c9f 100644
--- a/sandbox-seccomp-filter.c
-+++ b/sandbox-seccomp-filter.c
-@@ -248,6 +248,9 @@ static const struct sock_filter preauth_insns[] = {
+Index: openssh-8.8p1/sandbox-seccomp-filter.c
+===================================================================
+--- openssh-8.8p1.orig/sandbox-seccomp-filter.c
+++ openssh-8.8p1/sandbox-seccomp-filter.c
+@@ -279,6 +279,9 @@ static const struct sock_filter preauth_
 #ifdef __NR_clock_nanosleep_time64
 	SC_ALLOW(__NR_clock_nanosleep_time64),
 #endif
--- a/openssh-8.1p1-seccomp-clock_nanosleep.patch
+++ b/openssh-8.1p1-seccomp-clock_nanosleep.patch
@ -1,8 +1,8 @@
-diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c
-index c1e689e..74f69bc 100644
--- a/sandbox-seccomp-filter.c
-+++ b/sandbox-seccomp-filter.c
-@@ -264,6 +264,9 @@ static const struct sock_filter preauth_insns[] = {
+Index: openssh-8.8p1/sandbox-seccomp-filter.c
+===================================================================
+--- openssh-8.8p1.orig/sandbox-seccomp-filter.c
+++ openssh-8.8p1/sandbox-seccomp-filter.c
+@@ -273,6 +273,9 @@ static const struct sock_filter preauth_
 #ifdef __NR_clock_gettime64
 	SC_ALLOW(__NR_clock_gettime64),
 #endif
--- a/openssh-8.1p1-seccomp-clock_nanosleep_time64.patch
+++ b/openssh-8.1p1-seccomp-clock_nanosleep_time64.patch
@ -8,11 +8,11 @@ Needed on Linux ARM.  bz#3100, patch from jjelen@redhat.com.
 sandbox-seccomp-filter.c | 3 +++
 1 file changed, 3 insertions(+)

-Index: openssh-8.1p1/sandbox-seccomp-filter.c
+Index: openssh-8.8p1/sandbox-seccomp-filter.c
 ===================================================================
--- openssh-8.1p1.orig/sandbox-seccomp-filter.c
-+++ openssh-8.1p1/sandbox-seccomp-filter.c
-@@ -251,6 +251,9 @@ static const struct sock_filter preauth_
+--- openssh-8.8p1.orig/sandbox-seccomp-filter.c
+++ openssh-8.8p1/sandbox-seccomp-filter.c
+@@ -276,6 +276,9 @@ static const struct sock_filter preauth_
 #ifdef __NR_clock_nanosleep
     SC_ALLOW(__NR_clock_nanosleep),
 #endif
--- a/openssh-8.1p1-use-openssl-kdf.patch
+++ b/openssh-8.1p1-use-openssl-kdf.patch
@ -1,8 +1,8 @@
-diff --git a/kex.c b/kex.c
-index 96e44a5..7cd37d6 100644
--- a/kex.c
-+++ b/kex.c
-@@ -38,6 +38,7 @@
+Index: openssh-8.8p1/kex.c
+===================================================================
+--- openssh-8.8p1.orig/kex.c
+++ openssh-8.8p1/kex.c
+@@ -40,6 +40,7 @@
 #ifdef WITH_OPENSSL
 #include <openssl/crypto.h>
 #include <openssl/dh.h>
@ -10,7 +10,7 @@ index 96e44a5..7cd37d6 100644
 #endif
 
 #include "ssh.h"
-@@ -1109,8 +1110,92 @@ kex_choose_conf(struct ssh *ssh)
+@@ -1115,8 +1116,93 @@ kex_choose_conf(struct ssh *ssh)
 	return r;
 }
 
@ -69,7 +69,8 @@ index 96e44a5..7cd37d6 100644
 +	    || EVP_KDF_ctrl (hashctx, EVP_KDF_CTRL_SET_SSHKDF_XCGHASH,
 +			     hash, (size_t) hashlen) != 1
 +	    || EVP_KDF_ctrl (hashctx, EVP_KDF_CTRL_SET_SSHKDF_SESSION_ID,
-+			     kex->session_id, (size_t) kex->session_id_len) != 1)
+			     sshbuf_ptr(kex->session_id),
+			     (size_t) sshbuf_len(kex->session_id)) != 1)
 +	    goto out;
 +
 +	digest = calloc (1, need);
@ -104,7 +105,7 @@ index 96e44a5..7cd37d6 100644
     const struct sshbuf *shared_secret, u_char **keyp)
 {
 	struct kex *kex = ssh->kex;
-@@ -1174,6 +1259,50 @@ derive_key(struct ssh *ssh, int id, u_int need, u_char *hash, u_int hashlen,
+@@ -1179,6 +1265,50 @@ derive_key(struct ssh *ssh, int id, u_in
 	return r;
 }
 
--- a/openssh-8.4p1-vendordir.patch
+++ b/openssh-8.4p1-vendordir.patch
@ -1,52 +1,31 @@
 Gemeinsame Unterverzeichnisse: openssh-8.4p1/contrib und openssh-8.4p1-vendor/contrib.
-diff -u openssh-8.4p1/dh.c openssh-8.4p1-vendor/dh.c
--- openssh-8.4p1/dh.c	2020-09-27 09:25:01.000000000 +0200
-+++ openssh-8.4p1-vendor/dh.c	2021-01-29 11:49:40.968418136 +0100
-@@ -151,10 +151,18 @@
- 	size_t linesize = 0;
- 	int best, bestcount, which, linenum;
- 	struct dhgroup dhg;
-+	char *dh_moduli_path;
-+	struct stat st;
+Index: openssh-8.8p1/dh.c
+===================================================================
+--- openssh-8.8p1.orig/dh.c
+++ openssh-8.8p1/dh.c
+@@ -54,7 +54,17 @@ void dh_set_moduli_file(const char *file
 
-	if ((f = fopen(_PATH_DH_MODULI, "r")) == NULL) {
+ static const char * get_moduli_filename(void)
+ {
+-	return moduli_filename ? moduli_filename : _PATH_DH_MODULI;
+	struct stat st;
+
+	if (moduli_filename)
+		return moduli_filename;
+
 +	if (stat(_PATH_VENDOR_DH_MODULI, &st) == 0 &&
 +	    stat(_PATH_DH_MODULI, &st) == -1) {
-+	        dh_moduli_path = _PATH_VENDOR_DH_MODULI;
-+	} else {
-+	        dh_moduli_path = _PATH_DH_MODULI;
+	        return _PATH_VENDOR_DH_MODULI;
 +	}
-+	if ((f = fopen(dh_moduli_path, "r")) == NULL) {
- 		logit("WARNING: could not open %s (%s), using fixed modulus",
-		    _PATH_DH_MODULI, strerror(errno));
-+		      dh_moduli_path, strerror(errno));
- 		return (dh_new_group_fallback(max));
- 	}
+
+	return _PATH_DH_MODULI;
+ }
 
-@@ -185,7 +193,7 @@
- 
- 	if (bestcount == 0) {
- 		fclose(f);
-		logit("WARNING: no suitable primes in %s", _PATH_DH_MODULI);
-+		logit("WARNING: no suitable primes in %s", dh_moduli_path);
- 		return (dh_new_group_fallback(max));
- 	}
- 	which = arc4random_uniform(bestcount);
-@@ -210,7 +218,7 @@
- 	fclose(f);
- 	if (bestcount != which + 1) {
- 		logit("WARNING: selected prime disappeared in %s, giving up",
-		    _PATH_DH_MODULI);
-+		      dh_moduli_path);
- 		return (dh_new_group_fallback(max));
- 	}
- 
-Gemeinsame Unterverzeichnisse: openssh-8.4p1/.github und openssh-8.4p1-vendor/.github.
-Gemeinsame Unterverzeichnisse: openssh-8.4p1/m4 und openssh-8.4p1-vendor/m4.
-Gemeinsame Unterverzeichnisse: openssh-8.4p1/openbsd-compat und openssh-8.4p1-vendor/openbsd-compat.
-diff -u openssh-8.4p1/pathnames.h openssh-8.4p1-vendor/pathnames.h
--- openssh-8.4p1/pathnames.h	2020-09-27 09:25:01.000000000 +0200
-+++ openssh-8.4p1-vendor/pathnames.h	2021-01-29 11:35:41.655599046 +0100
+ static int
+Index: openssh-8.8p1/pathnames.h
+===================================================================
+--- openssh-8.8p1.orig/pathnames.h
+++ openssh-8.8p1/pathnames.h
@@ -18,6 +18,8 @@
 #define SSHDIR				ETCDIR "/ssh"
 #endif
@ -74,11 +53,11 @@ diff -u openssh-8.4p1/pathnames.h openssh-8.4p1-vendor/pathnames.h
 
 #ifndef _PATH_SSH_PROGRAM
 #define _PATH_SSH_PROGRAM		"/usr/bin/ssh"
-Gemeinsame Unterverzeichnisse: openssh-8.4p1/regress und openssh-8.4p1-vendor/regress.
-diff -u openssh-8.4p1/ssh.c openssh-8.4p1-vendor/ssh.c
--- openssh-8.4p1/ssh.c	2020-09-27 09:25:01.000000000 +0200
-+++ openssh-8.4p1-vendor/ssh.c	2021-01-27 18:22:52.322271681 +0100
-@@ -593,6 +593,7 @@
+Index: openssh-8.8p1/ssh.c
+===================================================================
+--- openssh-8.8p1.orig/ssh.c
+++ openssh-8.8p1/ssh.c
+@@ -549,6 +549,7 @@ static void
 process_config_files(const char *host_name, struct passwd *pw, int final_pass,
     int *want_final_pass)
 {
@ -86,7 +65,7 @@ diff -u openssh-8.4p1/ssh.c openssh-8.4p1-vendor/ssh.c
 	char buf[PATH_MAX];
 	int r;
 
-@@ -611,10 +612,23 @@
+@@ -567,10 +568,23 @@ process_config_files(const char *host_na
 			    &options, SSHCONF_CHECKPERM | SSHCONF_USERCONF |
 			    (final_pass ? SSHCONF_FINAL : 0), want_final_pass);
 
@ -114,11 +93,11 @@ diff -u openssh-8.4p1/ssh.c openssh-8.4p1-vendor/ssh.c
 	}
 }
 
-Nur in openssh-8.4p1-vendor: #ssh_config.5#.
-diff -u openssh-8.4p1/ssh_config.5 openssh-8.4p1-vendor/ssh_config.5
--- openssh-8.4p1/ssh_config.5	2020-09-27 09:25:01.000000000 +0200
-+++ openssh-8.4p1-vendor/ssh_config.5	2021-02-24 12:02:53.935729753 +0100
-@@ -54,6 +54,9 @@
+Index: openssh-8.8p1/ssh_config.5
+===================================================================
+--- openssh-8.8p1.orig/ssh_config.5
+++ openssh-8.8p1/ssh_config.5
+@@ -54,6 +54,9 @@ user's configuration file
 .It
 system-wide configuration file
 .Pq Pa /etc/ssh/ssh_config
@ -128,7 +107,7 @@ diff -u openssh-8.4p1/ssh_config.5 openssh-8.4p1-vendor/ssh_config.5
 .El
 .Pp
 For each parameter, the first obtained value
-@@ -1942,6 +1945,11 @@
+@@ -2212,6 +2215,11 @@ This file provides defaults for those
 values that are not specified in the user's configuration file, and
 for those users who do not have a configuration file.
 This file must be world-readable.
@ -140,11 +119,11 @@ diff -u openssh-8.4p1/ssh_config.5 openssh-8.4p1-vendor/ssh_config.5
 .El
 .Sh SEE ALSO
 .Xr ssh 1
-Nur in openssh-8.4p1-vendor: ssh_config.5~.
-diff -u openssh-8.4p1/sshd.c openssh-8.4p1-vendor/sshd.c
--- openssh-8.4p1/sshd.c	2020-09-27 09:25:01.000000000 +0200
-+++ openssh-8.4p1-vendor/sshd.c	2021-01-27 18:25:38.370273280 +0100
-@@ -136,7 +136,7 @@
+Index: openssh-8.8p1/sshd.c
+===================================================================
+--- openssh-8.8p1.orig/sshd.c
+++ openssh-8.8p1/sshd.c
+@@ -145,7 +145,7 @@ extern char *__progname;
 ServerOptions options;
 
 /* Name of the server configuration file. */
@ -153,7 +132,7 @@ diff -u openssh-8.4p1/sshd.c openssh-8.4p1-vendor/sshd.c
 
 /*
  * Debug mode flag.  This can be set on the command line.  If debug
-@@ -1526,6 +1526,7 @@
+@@ -1594,6 +1594,7 @@ prepare_proctitle(int ac, char **av)
 int
 main(int ac, char **av)
 {
@ -161,7 +140,7 @@ diff -u openssh-8.4p1/sshd.c openssh-8.4p1-vendor/sshd.c
 	struct ssh *ssh = NULL;
 	extern char *optarg;
 	extern int optind;
-@@ -1737,7 +1738,21 @@
+@@ -1809,7 +1810,21 @@ main(int ac, char **av)
 			 */
 			(void)atomicio(vwrite, startup_pipe, "\0", 1);
 		}
@ -183,9 +162,10 @@ diff -u openssh-8.4p1/sshd.c openssh-8.4p1-vendor/sshd.c
 		load_server_config(config_file_name, cfg);
 
 	parse_server_config(&options, rexeced_flag ? "rexec" : config_file_name,
-diff -u openssh-8.4p1/sshd_config.5 openssh-8.4p1-vendor/sshd_config.5
--- openssh-8.4p1/sshd_config.5	2020-09-27 09:25:01.000000000 +0200
-+++ openssh-8.4p1-vendor/sshd_config.5	2021-02-24 14:14:27.912038335 +0100
+Index: openssh-8.8p1/sshd_config.5
+===================================================================
+--- openssh-8.8p1.orig/sshd_config.5
+++ openssh-8.8p1/sshd_config.5
@@ -44,7 +44,9 @@
 .Xr sshd 8
 reads configuration data from
@ -197,11 +177,11 @@ diff -u openssh-8.4p1/sshd_config.5 openssh-8.4p1-vendor/sshd_config.5
 .Fl f
 on the command line).
 The file contains keyword-argument pairs, one per line.
-Nur in openssh-8.4p1-vendor: sshd_config.5~.
-diff -u openssh-8.4p1/ssh-keysign.c openssh-8.4p1-vendor/ssh-keysign.c
--- openssh-8.4p1/ssh-keysign.c	2020-09-27 09:25:01.000000000 +0200
-+++ openssh-8.4p1-vendor/ssh-keysign.c	2021-02-24 11:34:17.684570215 +0100
-@@ -172,6 +172,7 @@
+Index: openssh-8.8p1/ssh-keysign.c
+===================================================================
+--- openssh-8.8p1.orig/ssh-keysign.c
+++ openssh-8.8p1/ssh-keysign.c
+@@ -172,6 +172,7 @@ main(int argc, char **argv)
 	u_char *signature, *data, rver;
 	char *host, *fp;
 	size_t slen, dlen;
@ -209,19 +189,20 @@ diff -u openssh-8.4p1/ssh-keysign.c openssh-8.4p1-vendor/ssh-keysign.c
 
 	if (pledge("stdio rpath getpw dns id", NULL) != 0)
 		fatal("%s: pledge: %s", __progname, strerror(errno));
-@@ -205,8 +206,12 @@
+@@ -205,8 +206,14 @@ main(int argc, char **argv)
 
 	/* verify that ssh-keysign is enabled by the admin */
 	initialize_options(&options);
 -	(void)read_config_file(_PATH_HOST_CONFIG_FILE, pw, "", "",
 -	    &options, 0, NULL);
+
 +	if (stat(_PATH_HOST_CONFIG_FILE, &st) == 0)
 +	        (void)read_config_file(_PATH_HOST_CONFIG_FILE, pw, "", "",
 +		    &options, 0, NULL);
 +	else
-+	        (void)read_config_file(_PATH_HOST_VENDOR_CONFIG_FILE, pw,
-+		    "", "", &options, 0, NULL);
- 	fill_default_options(&options);
+	        (void)read_config_file(_PATH_HOST_VENDOR_CONFIG_FILE, pw, "", "",
+		    &options, 0, NULL);
+
+ 	(void)fill_default_options(&options);
 	if (options.enable_ssh_keysign != 1)
 		fatal("ssh-keysign not enabled in %s",
-Nur in openssh-8.4p1-vendor: ssh-keysign.c~.
--- a/openssh-8.4p1.tar.gz
+++ b/openssh-8.4p1.tar.gz
@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:5a01d22e407eb1c05ba8a8f7c654d388a13e9f226e4ed33bd38748dafa1d2b24
-size 1742201
--- a/openssh-8.4p1.tar.gz.asc
+++ b/openssh-8.4p1.tar.gz.asc
@ -1,14 +0,0 @@
-----BEGIN PGP SIGNATURE-----
-
-iQHDBAABCgAdFiEEWcIRjtIG2SfmZ+vj0+X1a22SDTAFAl9wQnwACgkQ0+X1a22S
-DTAR6wyAjRcvW7Jg9v73AR7TUO4WAD085sYi4ZLsECMZqhVZUBVv0Ofmcz2ISg3I
-NU1nr9Kiqf1/i05OUIR64kJEd4wTSwv+4HhyP5MPJqyCkKcFJ9TyRy6pASZtyH6D
-hKezJ79iGUg1U46bI6yyxchcAKrz0if97fKd0/1h5yE7T5lcbo+zQPsAg9dDXHBJ
-nL5mpBQXU3xbU8bC+E+vZ7VAyxEm6kzuY7MRW2wOhpPQ5DJgEjAUjtvzvd9SJhKl
-u/hgKXqIJBQB1pHlAFI1knfTrGUGrzob8QphukrvmbMJC3dO/o3Dplvx6lZkes0c
-6hP66rhTRp5Tmw9ae3iUmoDf6SyStlo/4QomCuw0NxHrSOng16VjCR+NRWHvZbXC
-JckIqparyOJ2jtHz0+e52sRZCZKauFBDMZboNj7f+htwQRUFOVfeSecpJiYut4bM
-YALdayOQwL96J6aMdoMKfMGZUevCPN6OM96E6cMC1fmanBenZQ/vatmskIvvvO/P
-rwECYTpGVRezhAvXMEy9x+EVdV6ctA==
-=PW3D
-----END PGP SIGNATURE-----
--- a/openssh-8.8p1.tar.gz
+++ b/openssh-8.8p1.tar.gz
@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9
+size 1815060
--- a/openssh-8.8p1.tar.gz.asc
+++ b/openssh-8.8p1.tar.gz.asc
@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABCgAdFiEEcWi5g4FaXu9ZpK39Kj9BTnNgYLoFAmFQfp8ACgkQKj9BTnNg
+YLq2SQ/8C3iOHTkyqX82FYt0SKkybebe9b2iBPr91HQOUmx+U3I+vgrSWArXabWJ
+uSu0b685RQKlcr7UjEtPk6g0cm45NoJFjju9ljvnOFfZw73V3a5qX15Lx4xRnkRx
+v1LJn6Yh12PKLWL4/A1qPQnfAObVwq/BF0BR01FfXLAOt5+lFwYvg79HpE+69b0r
+KtcIEpsyTEn2lSKSWD7q4lpe6Z/iR+XzBKfnB6JJXhKyHiDV63hlAJk9Pt3mIvS6
+tnE9/7GDawvi+Tsl018kw3wsf6aHVSQ+O+vzcDgfy0vDJVGjD6Ec9it9FvikXJh6
+3pSTBYuUJdt+CAQYvmEui73v4nrkfouHXsxqgzEDZaTwIZC4wPrvNYxUaIyirWlc
+l4/YSnxSxSiYbvPa5eYRBvXvoWbnQXjPOkuhjETxz/KTcHirQpWE9eldi0jHcKUa
+FVu9YqMPAjIUd1Jj4vC5bgH7v5cLeEMm/AetMvKsJs+rhY9NZaKpiqOqU2m6Geb+
+sQSXHNTeA8uOlrHim4SmYHtmfglVbH5lIroiUqtRzjbOhMhqUb+yN9+aAxe0bwmN
+VcFMSThlbmYokb9bkQryY2I/FfXb997vxgF6v15Z8d9e8HH2zc2Irj1HYXG4Bf3o
+WCiSvd8+Tr/FxS2Gn8qj/vgSPWXT0d0Hy4zHW9JeT/jn3RtIYhU=
+=EnoG
+-----END PGP SIGNATURE-----
--- a/openssh-askpass-gnome.changes
+++ b/openssh-askpass-gnome.changes
@ -1,3 +1,10 @@
+-------------------------------------------------------------------
+Tue Sep 28 19:05:15 UTC 2021 - Hans Petter Jansson <hpj@suse.com>
+
+- Version upgrade to 8.8p1
+  * No changes for askpass, see main package changelog for
+    details
+
 -------------------------------------------------------------------
 Thu Sep 17 20:41:39 UTC 2020 - Jan Engelhardt <jengelh@inai.de>

--- a/openssh-askpass-gnome.spec
+++ b/openssh-askpass-gnome.spec
@ -18,7 +18,7 @@

 %define _name openssh
 Name:           openssh-askpass-gnome
-Version:        8.4p1
+Version:        8.8p1
 Release:        0
 Summary:        A GNOME-Based Passphrase Dialog for OpenSSH
 License:        BSD-2-Clause
--- a/openssh-fips-ensure-approved-moduli.patch
+++ b/openssh-fips-ensure-approved-moduli.patch
@ -4,11 +4,11 @@ Date:   Mon Oct 26 22:26:46 2020 +0100

    Ensure DHGs are approved in FIPS mode using OpenSSL's DH_check_params()

-diff --git a/dh.c b/dh.c
-index 7cb135d..3fe7f75 100644
--- a/dh.c
-+++ b/dh.c
-@@ -143,6 +143,28 @@ parse_prime(int linenum, char *line, struct dhgroup *dhg)
+Index: openssh-8.8p1/dh.c
+===================================================================
+--- openssh-8.8p1.orig/dh.c
+++ openssh-8.8p1/dh.c
+@@ -155,6 +155,28 @@ parse_prime(int linenum, char *line, str
 	return 0;
 }
 
@ -37,7 +37,7 @@ index 7cb135d..3fe7f75 100644
 DH *
 choose_dh(int min, int wantbits, int max)
 {
-@@ -161,12 +183,20 @@ choose_dh(int min, int wantbits, int max)
+@@ -173,12 +195,20 @@ choose_dh(int min, int wantbits, int max
 	linenum = 0;
 	best = bestcount = 0;
 	while (getline(&line, &linesize, f) != -1) {
@ -58,7 +58,7 @@ index 7cb135d..3fe7f75 100644
 		if (dhg.size > max || dhg.size < min)
 			continue;
 
-@@ -193,10 +223,16 @@ choose_dh(int min, int wantbits, int max)
+@@ -206,10 +236,16 @@ choose_dh(int min, int wantbits, int max
 	linenum = 0;
 	bestcount = 0;
 	while (getline(&line, &linesize, f) != -1) {
--- a/openssh-fix-ssh-copy-id.patch
+++ b/openssh-fix-ssh-copy-id.patch
@ -1,30 +0,0 @@
-From 66f16e5425eb881570e82bfef7baeac2e7accc0a Mon Sep 17 00:00:00 2001
-From: Oleg <Fallmay@users.noreply.github.com>
-Date: Thu, 1 Oct 2020 12:09:08 +0300
-Subject: [PATCH] Fix `EOF: command not found` error in ssh-copy-id
-
---
- contrib/ssh-copy-id | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/contrib/ssh-copy-id b/contrib/ssh-copy-id
-index 392f64f94..a76907717 100644
--- a/contrib/ssh-copy-id
-+++ b/contrib/ssh-copy-id
-@@ -247,7 +247,7 @@ installkeys_sh() {
-   #    the -z `tail ...` checks for a trailing newline. The echo adds one if was missing
-   #    the cat adds the keys we're getting via STDIN
-   #    and if available restorecon is used to restore the SELinux context
-  INSTALLKEYS_SH=$(tr '\t\n' ' ' <<-EOF)
-+  INSTALLKEYS_SH=$(tr '\t\n' ' ' <<-EOF
- 	cd;
- 	umask 077;
- 	mkdir -p $(dirname "${AUTH_KEY_FILE}") &&
-@@ -258,6 +258,7 @@ installkeys_sh() {
- 	  restorecon -F .ssh ${AUTH_KEY_FILE};
- 	fi
- EOF
-+  )
- 
-   # to defend against quirky remote shells: use 'exec sh -c' to get POSIX;
-   printf "exec sh -c '%s'" "${INSTALLKEYS_SH}"
--- a/openssh-link-with-sk.patch
+++ b/openssh-link-with-sk.patch
@ -1,15 +1,15 @@
-diff --git a/Makefile.in b/Makefile.in
-index 6dec09c..25e74ac 100644
--- a/Makefile.in
-+++ b/Makefile.in
-@@ -251,8 +251,8 @@ ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a $(SSHKEYSCAN_OBJS)
+Index: openssh-8.8p1/Makefile.in
+===================================================================
+--- openssh-8.8p1.orig/Makefile.in
+++ openssh-8.8p1/Makefile.in
+@@ -252,8 +252,8 @@ ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libss
 ssh-ldap-helper$(EXEEXT): $(LIBCOMPAT) libssh.a ldapconf.o ldapbody.o ldapmisc.o ldap-helper.o
 	$(LD) -o $@ ldapconf.o ldapbody.o ldapmisc.o ldap-helper.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS)
 
 -sftp-server$(EXEEXT): $(LIBCOMPAT) libssh.a $(SFTPSERVER_OBJS)
-	$(LD) -o $@ $(SFTPSERVER_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
+-	$(LD) -o $@ $(SFTPSERVER_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS)
 +sftp-server$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-sk.o sk-usbhid.o $(SFTPSERVER_OBJS)
-+	$(LD) -o $@ $(SFTPSERVER_OBJS) ssh-sk.o sk-usbhid.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS) $(LIBFIDO2)
+	$(LD) -o $@ $(SFTPSERVER_OBJS) ssh-sk.o sk-usbhid.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS) $(LIBFIDO2)
 
 sftp$(EXEEXT): $(LIBCOMPAT) libssh.a $(SFTP_OBJS)
 	$(LD) -o $@ $(SFTP_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS) $(LIBEDIT)
--- a/openssh-reenable-dh-group14-sha1-default.patch
+++ b/openssh-reenable-dh-group14-sha1-default.patch
@ -1,7 +1,7 @@
-diff --git a/myproposal.h b/myproposal.h
-index 5312e60..83fd62d 100644
--- a/myproposal.h
-+++ b/myproposal.h
+Index: openssh-8.8p1/myproposal.h
+===================================================================
+--- openssh-8.8p1.orig/myproposal.h
+++ openssh-8.8p1/myproposal.h
@@ -33,7 +33,8 @@
 	"diffie-hellman-group-exchange-sha256," \
 	"diffie-hellman-group16-sha512," \
@ -12,11 +12,11 @@ index 5312e60..83fd62d 100644
 
 #define KEX_CLIENT_KEX KEX_SERVER_KEX
 
-diff --git a/ssh_config.5 b/ssh_config.5
-index d5888f2..100563e 100644
--- a/ssh_config.5
-+++ b/ssh_config.5
-@@ -1170,7 +1170,8 @@ ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,
+Index: openssh-8.8p1/ssh_config.5
+===================================================================
+--- openssh-8.8p1.orig/ssh_config.5
+++ openssh-8.8p1/ssh_config.5
+@@ -1227,7 +1227,8 @@ ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
 diffie-hellman-group-exchange-sha256,
 diffie-hellman-group16-sha512,
 diffie-hellman-group18-sha512,
@ -26,11 +26,11 @@ index d5888f2..100563e 100644
 .Ed
 .Pp
 The list of available key exchange algorithms may also be obtained using
-diff --git a/sshd_config.5 b/sshd_config.5
-index 0f5fe53..97364f5 100644
--- a/sshd_config.5
-+++ b/sshd_config.5
-@@ -986,7 +986,7 @@ curve25519-sha256,curve25519-sha256@libssh.org,
+Index: openssh-8.8p1/sshd_config.5
+===================================================================
+--- openssh-8.8p1.orig/sshd_config.5
+++ openssh-8.8p1/sshd_config.5
+@@ -997,7 +997,7 @@ curve25519-sha256,curve25519-sha256@libs
 ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,
 diffie-hellman-group-exchange-sha256,
 diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,
--- a/openssh-whitelist-syscalls.patch
+++ b/openssh-whitelist-syscalls.patch
@ -1,6 +1,8 @@
--- a/sandbox-seccomp-filter.c
-+++ b/sandbox-seccomp-filter.c
-@@ -195,6 +195,9 @@
+Index: openssh-8.8p1/sandbox-seccomp-filter.c
+===================================================================
+--- openssh-8.8p1.orig/sandbox-seccomp-filter.c
+++ openssh-8.8p1/sandbox-seccomp-filter.c
+@@ -201,6 +201,9 @@ static const struct sock_filter preauth_
 #ifdef __NR_close
 	SC_ALLOW(__NR_close),
 #endif
@ -10,9 +12,9 @@
 #ifdef __NR_exit
 	SC_ALLOW(__NR_exit),
 #endif
-@@ -204,6 +207,9 @@
- #ifdef __NR_futex
- 	SC_ALLOW(__NR_futex),
+@@ -213,6 +216,9 @@ static const struct sock_filter preauth_
+ #ifdef __NR_futex_time64
+ 	SC_ALLOW(__NR_futex_time64),
 #endif
 +#ifdef __NR_futex_time64
 +	SC_ALLOW(__NR_futex_time64),
@ -20,13 +22,13 @@
 #ifdef __NR_geteuid
 	SC_ALLOW(__NR_geteuid),
 #endif
-@@ -282,6 +288,9 @@
- #ifdef __NR_pselect6
- 	SC_ALLOW(__NR_pselect6),
+@@ -293,6 +299,9 @@ static const struct sock_filter preauth_
 #endif
+ #ifdef __NR_pselect6_time64
+ 	SC_ALLOW(__NR_pselect6_time64),
+#endif
 +#ifdef __NR_pselect6_time64
 +	SC_ALLOW(__NR_pselect6_time64),
-+#endif
+ #endif
 #ifdef __NR_read
 	SC_ALLOW(__NR_read),
- #endif
--- a/openssh.changes
+++ b/openssh.changes
@ -1,3 +1,362 @@
+-------------------------------------------------------------------
+Tue Sep 28 17:50:57 UTC 2021 - Hans Petter Jansson <hpj@suse.com>
+
+- Version update to 8.8p1:
+  = Security
+  * sshd(8) from OpenSSH 6.2 through 8.7 failed to correctly initialise
+    supplemental groups when executing an AuthorizedKeysCommand or
+    AuthorizedPrincipalsCommand, where a AuthorizedKeysCommandUser or
+    AuthorizedPrincipalsCommandUser directive has been set to run the
+    command as a different user. Instead these commands would inherit
+    the groups that sshd(8) was started with.
+
+    Depending on system configuration, inherited groups may allow
+    AuthorizedKeysCommand/AuthorizedPrincipalsCommand helper programs to
+    gain unintended privilege.
+
+    Neither AuthorizedKeysCommand nor AuthorizedPrincipalsCommand are
+    enabled by default in sshd_config(5).
+
+  = Potentially-incompatible changes
+  * This release disables RSA signatures using the SHA-1 hash algorithm
+    by default. This change has been made as the SHA-1 hash algorithm is
+    cryptographically broken, and it is possible to create chosen-prefix
+    hash collisions for <USD$50K.
+
+    For most users, this change should be invisible and there is
+    no need to replace ssh-rsa keys. OpenSSH has supported RFC8332
+    RSA/SHA-256/512 signatures since release 7.2 and existing ssh-rsa keys
+    will automatically use the stronger algorithm where possible.
+
+    Incompatibility is more likely when connecting to older SSH
+    implementations that have not been upgraded or have not closely tracked
+    improvements in the SSH protocol. For these cases, it may be necessary
+    to selectively re-enable RSA/SHA1 to allow connection and/or user
+    authentication via the HostkeyAlgorithms and PubkeyAcceptedAlgorithms
+    options.
+
+  = New features
+  * ssh(1): allow the ssh_config(5) CanonicalizePermittedCNAMEs
+    directive to accept a "none" argument to specify the default
+    behaviour.
+
+  = Bugfixes
+  * scp(1): when using the SFTP protocol, continue transferring files
+    after a transfer error occurs, better matching original scp/rcp
+    behaviour.
+  * ssh(1): fixed a number of memory leaks in multiplexing,
+  * ssh-keygen(1): avoid crash when using the -Y find-principals
+    command.
+  * A number of documentation and manual improvements, including
+    bz#3340, PR139, PR215, PR241, PR257
+
+- Additional changes from 8.7p1 release:
+  = Potentially-incompatible changes
+  * scp(1): this release changes the behaviour of remote to remote
+    copies (e.g. "scp host-a:/path host-b:") to transfer through the
+    local host by default. This was previously available via the -3
+    flag. This mode avoids the need to expose credentials on the
+    origin hop, avoids triplicate interpretation of filenames by the
+    shell (by the local system, the copy origin and the destination)
+    and, in conjunction with the SFTP support for scp(1) mentioned
+    below, allows use of all authentication methods to the remote
+    hosts (previously, only non-interactive methods could be used).
+    A -R flag has been added to select the old behaviour.
+  * ssh(1)/sshd(8): both the client and server are now using a
+    stricter configuration file parser. The new parser uses more
+    shell-like rules for quotes, space and escape characters. It is
+    also more strict in rejecting configurations that include options
+    lacking arguments. Previously some options (e.g. DenyUsers) could
+    appear on a line with no subsequent arguments. This release will
+    reject such configurations. The new parser will also reject
+    configurations with unterminated quotes and multiple '='
+    characters after the option name.
+  * ssh(1): when using SSHFP DNS records for host key verification,
+    ssh(1) will verify all matching records instead of just those
+    with the specific signature type requested. This may cause host
+    key verification problems if stale SSHFP records of a different
+    or legacy signature type exist alongside other records for a
+    particular host. bz#3322
+  * ssh-keygen(1): when generating a FIDO key and specifying an
+    explicit attestation challenge (using -Ochallenge), the challenge
+    will now be hashed by the builtin security key middleware. This
+    removes the (undocumented) requirement that challenges be exactly
+    32 bytes in length and matches the expectations of libfido2.
+  * sshd(8): environment="..." directives in authorized_keys files are
+    now first-match-wins and limited to 1024 discrete environment
+    variable names.
+
+  = New features
+  * scp(1): experimental support for transfers using the SFTP protocol
+    as a replacement for the venerable SCP/RCP protocol that it has
+    traditionally used. SFTP offers more predictable filename handling
+    and does not require expansion of glob(3) patterns via the shell
+    on the remote side.
+  * sftp-server(8): add a protocol extension to support expansion of
+    ~/ and ~user/ prefixed paths. This was added to support these
+    paths when used by scp(1) while in SFTP mode.
+  * ssh(1): add a ForkAfterAuthentication ssh_config(5) counterpart to
+    the ssh(1) -f flag. GHPR231
+  * ssh(1): add a StdinNull directive to ssh_config(5) that allows the
+    config file to do the same thing as -n does on the ssh(1) command-
+    line. GHPR231
+  * ssh(1): add a SessionType directive to ssh_config, allowing the
+    configuration file to offer equivalent control to the -N (no
+    session) and -s (subsystem) command-line flags. GHPR231
+  * ssh-keygen(1): allowed signers files used by ssh-keygen(1)
+    signatures now support listing key validity intervals alongside
+    they key, and ssh-keygen(1) can optionally check during signature
+    verification whether a specified time falls inside this interval.
+    This feature is intended for use by git to support signing and
+    verifying objects using ssh keys.
+  * ssh-keygen(8): support printing of the full public key in a sshsig
+    signature via a -Oprint-pubkey flag.
+
+  = Bugfixes
+  * ssh(1)/sshd(8): start time-based re-keying exactly on schedule in
+    the client and server mainloops. Previously the re-key timeout
+    could expire but re-keying would not start until a packet was sent
+    or received, causing a spin in select() if the connection was
+    quiescent.
+  * ssh-keygen(1): avoid Y2038 problem in printing certificate
+    validity lifetimes. Dates past 2^31-1 seconds since epoch were
+    displayed incorrectly on some platforms. bz#3329
+  * scp(1): allow spaces to appear in usernames for local to remote
+    and scp -3 remote to remote copies. bz#1164
+  * ssh(1)/sshd(8): remove references to ChallengeResponseAuthentication
+    in favour of KbdInteractiveAuthentication. The former is what was in
+    SSHv1, the latter is what is in SSHv2 (RFC4256) and they were
+    treated as somewhat but not entirely equivalent. We retain the old
+    name as a deprecated alias so configuration files continue to work
+    as well as a reference in the man page for people looking for it.
+    bz#3303
+  * ssh(1)/ssh-add(1)/ssh-keygen(1): fix decoding of X.509 subject name
+    when extracting a key from a PKCS#11 certificate. bz#3327
+  * ssh(1): restore blocking status on stdio fds before close. ssh(1)
+    needs file descriptors in non-blocking mode to operate but it was
+    not restoring the original state on exit. This could cause
+    problems with fds shared with other programs via the shell,
+    bz#3280 and GHPR246
+  * ssh(1)/sshd(8): switch both client and server mainloops from
+    select(3) to pselect(3). Avoids race conditions where a signal
+    may arrive immediately before select(3) and not be processed until
+    an event fires. bz#2158
+  * ssh(1): sessions started with ControlPersist were incorrectly
+    executing a shell when the -N (no shell) option was specified.
+    bz#3290
+  * ssh(1): check if IPQoS or TunnelDevice are already set before
+    overriding. Prevents values in config files from overriding values
+    supplied on the command line. bz#3319
+  * ssh(1): fix debug message when finding a private key to match a
+    certificate being attempted for user authentication. Previously it
+    would print the certificate's path, whereas it was supposed to be
+    showing the private key's path. GHPR247
+  * sshd(8): match host certificates against host public keys, not
+    private keys. Allows use of certificates with private keys held in
+    a ssh-agent.  bz#3524
+  * ssh(1): add a workaround for a bug in OpenSSH 7.4 sshd(8), which
+    allows RSA/SHA2 signatures for public key authentication but fails
+    to advertise this correctly via SSH2_MSG_EXT_INFO. This causes
+    clients of these server to incorrectly match
+    PubkeyAcceptedAlgorithmse and potentially refuse to offer valid
+    keys. bz#3213
+  * sftp(1)/scp(1): degrade gracefully if a sftp-server offers the
+    limits@openssh.com extension but fails when the client tries to
+    invoke it. bz#3318
+  * ssh(1): allow ssh_config SetEnv to override $TERM, which is
+    otherwise handled specially by the protocol. Useful in ~/.ssh/config
+    to set TERM to something generic (e.g. "xterm" instead of
+    "xterm-256color") for destinations that lack terminfo entries.
+  * sftp-server(8): the limits@openssh.com extension was incorrectly
+    marked as an operation that writes to the filesystem, which made it
+    unavailable in sftp-server read-only mode. bz#3318
+  * ssh(1): fix SEGV in UpdateHostkeys debug() message, triggered when
+    the update removed more host keys than remain present.
+  * Many manual page fixes.
+
+- Additional changes from 8.6p1 release:
+  = Security
+  * sshd(8): OpenSSH 8.5 introduced the LogVerbose keyword. When this
+    option was enabled with a set of patterns that activated logging
+    in code that runs in the low-privilege sandboxed sshd process, the
+    log messages were constructed in such a way that printf(3) format
+    strings could effectively be specified the low-privilege code.
+
+  = New features
+  * sftp-server(8): add a new limits@openssh.com protocol extension
+    that allows a client to discover various server limits, including
+    maximum packet size and maximum read/write length.
+  * sftp(1): use the new limits@openssh.com extension (when available)
+    to select better transfer lengths in the client.
+  * sshd(8): Add ModuliFile keyword to sshd_config to specify the
+    location of the "moduli" file containing the groups for DH-GEX.
+  * unit tests: Add a TEST_SSH_ELAPSED_TIMES environment variable to
+    enable printing of the elapsed time in seconds of each test.
+
+  = Bugfixes
+  * ssh_config(5), sshd_config(5): sync CASignatureAlgorithms lists in
+    manual pages with the current default. GHPR174
+  * ssh(1): ensure that pkcs11_del_provider() is called before exit.
+    GHPR234
+  * ssh(1), sshd(8): fix problems in string->argv conversion. Multiple
+    backslashes were not being dequoted correctly and quoted space in
+    the middle of a string was being incorrectly split. GHPR223
+  * ssh(1): return non-zero exit status when killed by signal; bz#3281
+  * sftp-server(8): increase maximum SSH2_FXP_READ to match the maximum
+    packet size. Also handle zero-length reads that are not explicitly
+    banned by the spec.
+
+- Additional changes from 8.5p1 release:
+  = Security
+  * ssh-agent(1): fixed a double-free memory corruption that was
+    introduced in OpenSSH 8.2 . We treat all such memory faults as
+    potentially exploitable. This bug could be reached by an attacker
+    with access to the agent socket.
+
+  = Potentially-incompatible changes
+  * ssh(1), sshd(8): this release changes the first-preference signature
+    algorithm from ECDSA to ED25519.
+  * ssh(1), sshd(8): set the TOS/DSCP specified in the configuration
+    for interactive use prior to TCP connect. The connection phase of
+    the SSH session is time-sensitive and often explicitly interactive.
+    The ultimate interactive/bulk TOS/DSCP will be set after
+    authentication completes.
+  * ssh(1), sshd(8): remove the pre-standardization cipher
+    rijndael-cbc@lysator.liu.se. It is an alias for aes256-cbc before
+    it was standardized in RFC4253 (2006), has been deprecated and
+    disabled by default since OpenSSH 7.2 (2016) and was only briefly
+    documented in ssh.1 in 2001.
+  * ssh(1), sshd(8): update/replace the experimental post-quantum
+    hybrid key exchange method based on Streamlined NTRU Prime coupled
+    with X25519. The previous sntrup4591761x25519-sha512@tinyssh.org
+    method is replaced with sntrup761x25519-sha512@openssh.com.
+  * ssh(1): disable CheckHostIP by default. It provides insignificant
+    benefits while making key rotation significantly more difficult,
+    especially for hosts behind IP-based load-balancers.
+
+  = New features
+  * ssh(1): this release enables UpdateHostkeys by default subject to
+    some conservative preconditions:
+    - The key was matched in the UserKnownHostsFile (and not in the
+      GlobalKnownHostsFile).
+    - The same key does not exist under another name.
+    - A certificate host key is not in use.
+    - known_hosts contains no matching wildcard hostname pattern.
+    - VerifyHostKeyDNS is not enabled.
+    - The default UserKnownHostsFile is in use.
+  * ssh(1), sshd(8): add a new LogVerbose configuration directive for
+    that allows forcing maximum debug logging by file/function/line
+    pattern-lists.
+  * ssh(1): when prompting the user to accept a new hostkey, display
+    any other host names/addresses already associated with the key.
+  * ssh(1): allow UserKnownHostsFile=none to indicate that no
+    known_hosts file should be used to identify host keys.
+  * ssh(1): add a ssh_config KnownHostsCommand option that allows the
+    client to obtain known_hosts data from a command in addition to
+    the usual files.
+  * ssh(1): add a ssh_config PermitRemoteOpen option that allows the
+    client to restrict the destination when RemoteForward is used
+    with SOCKS.
+  * ssh(1): for FIDO keys, if a signature operation fails with a
+    "incorrect PIN" reason and no PIN was initially requested from the
+    user, then request a PIN and retry the operation. This supports
+    some biometric devices that fall back to requiring PIN when reading
+    of the biometric failed, and devices that require PINs for all
+    hosted credentials.
+  * sshd(8): implement client address-based rate-limiting via new
+    sshd_config(5) PerSourceMaxStartups and PerSourceNetBlockSize
+    directives that provide more fine-grained control on a per-origin
+    address basis than the global MaxStartups limit.
+
+  = Bugfixes
+   * ssh(1): Prefix keyboard interactive prompts with "(user@host)" to
+   make it easier to determine which connection they are associated
+   with in cases like scp -3, ProxyJump, etc. bz#3224
+  * sshd(8): fix sshd_config SetEnv directives located inside Match
+    blocks. GHPR201
+  * ssh(1): when requesting a FIDO token touch on stderr, inform the
+    user once the touch has been recorded.
+  * ssh(1): prevent integer overflow when ridiculously large
+    ConnectTimeout values are specified, capping the effective value
+    (for most platforms) at 24 days. bz#3229
+  * ssh(1): consider the ECDSA key subtype when ordering host key
+    algorithms in the client.
+  * ssh(1), sshd(8): rename the PubkeyAcceptedKeyTypes keyword to
+    PubkeyAcceptedAlgorithms. The previous name incorrectly suggested
+    that it control allowed key algorithms, when this option actually
+    specifies the signature algorithms that are accepted. The previous
+    name remains available as an alias. bz#3253
+  * ssh(1), sshd(8): similarly, rename HostbasedKeyTypes (ssh) and
+    HostbasedAcceptedKeyTypes (sshd) to HostbasedAcceptedAlgorithms.
+  * sftp-server(8): add missing lsetstat@openssh.com documentation
+    and advertisement in the server's SSH2_FXP_VERSION hello packet.
+  * ssh(1), sshd(8): more strictly enforce KEX state-machine by
+    banning packet types once they are received. Fixes memleak caused
+    by duplicate SSH2_MSG_KEX_DH_GEX_REQUEST (oss-fuzz #30078).
+  * sftp(1): allow the full range of UIDs/GIDs for chown/chgrp on 32bit
+    platforms instead of being limited by LONG_MAX. bz#3206
+  * Minor man page fixes (capitalization, commas, etc.) bz#3223
+  * sftp(1): when doing an sftp recursive upload or download of a
+    read-only directory, ensure that the directory is created with
+    write and execute permissions in the interim so that the transfer
+    can actually complete, then set the directory permission as the
+    final step. bz#3222
+  * ssh-keygen(1): document the -Z, check the validity of its argument
+    earlier and provide a better error message if it's not correct.
+    bz#2879
+  * ssh(1): ignore comments at the end of config lines in ssh_config,
+    similar to what we already do for sshd_config. bz#2320
+  * sshd_config(5): mention that DisableForwarding is valid in a
+    sshd_config Match block. bz3239
+  * sftp(1): fix incorrect sorting of "ls -ltr" under some
+    circumstances. bz3248.
+  * ssh(1), sshd(8): fix potential integer truncation of (unlikely)
+    timeout values. bz#3250
+  * ssh(1): make hostbased authentication send the signature algorithm
+    in its SSH2_MSG_USERAUTH_REQUEST packets instead of the key type.
+    This make HostbasedAcceptedAlgorithms do what it is supposed to -
+    filter on signature algorithm and not key type.
+
+- Rebased patches:
+  * openssh-7.7p1-IPv6_X_forwarding.patch
+  * openssh-7.7p1-X11_trusted_forwarding.patch
+  * openssh-7.7p1-X_forward_with_disabled_ipv6.patch
+  * openssh-7.7p1-cavstest-ctr.patch
+  * openssh-7.7p1-cavstest-kdf.patch
+  * openssh-7.7p1-disable_openssl_abi_check.patch
+  * openssh-7.7p1-eal3.patch
+  * openssh-7.7p1-enable_PAM_by_default.patch
+  * openssh-7.7p1-fips.patch
+  * openssh-7.7p1-fips_checks.patch
+  * openssh-7.7p1-host_ident.patch
+  * openssh-7.7p1-hostname_changes_when_forwarding_X.patch
+  * openssh-7.7p1-ldap.patch
+  * openssh-7.7p1-no_fork-no_pid_file.patch
+  * openssh-7.7p1-pam_check_locks.patch
+  * openssh-7.7p1-pts_names_formatting.patch
+  * openssh-7.7p1-remove_xauth_cookies_on_exit.patch
+  * openssh-7.7p1-seccomp_ipc_flock.patch
+  * openssh-7.7p1-seccomp_stat.patch
+  * openssh-7.7p1-send_locale.patch
+  * openssh-7.7p1-sftp_force_permissions.patch
+  * openssh-7.7p1-sftp_print_diagnostic_messages.patch
+  * openssh-7.7p1-systemd-notify.patch
+  * openssh-7.9p1-keygen-preserve-perms.patch
+  * openssh-7.9p1-revert-new-qos-defaults.patch
+  * openssh-8.0p1-gssapi-keyex.patch
+  * openssh-8.1p1-audit.patch
+  * openssh-8.1p1-seccomp-clock_gettime64.patch
+  * openssh-8.1p1-seccomp-clock_nanosleep.patch
+  * openssh-8.1p1-seccomp-clock_nanosleep_time64.patch
+  * openssh-8.1p1-use-openssl-kdf.patch
+  * openssh-8.4p1-vendordir.patch
+  * openssh-fips-ensure-approved-moduli.patch
+  * openssh-link-with-sk.patch
+  * openssh-reenable-dh-group14-sha1-default.patch
+  * openssh-whitelist-syscalls.patch
+
+- Removed openssh-fix-ssh-copy-id.patch (fixed upstream).
+
 -------------------------------------------------------------------
 Thu Aug 19 10:07:10 UTC 2021 - Thorsten Kukuk <kukuk@suse.com>

--- a/openssh.spec
+++ b/openssh.spec
@ -35,7 +35,7 @@
  %define _fillupdir %{_localstatedir}/adm/fillup-templates
 %endif
 Name:           openssh
-Version:        8.4p1
+Version:        8.8p1
 Release:        0
 Summary:        Secure Shell Client and Server (Remote Login Program)
 License:        BSD-2-Clause AND MIT
@ -105,7 +105,6 @@ Patch40:        openssh-8.1p1-ed25519-use-openssl-rng.patch
 Patch41:        openssh-fips-ensure-approved-moduli.patch
 Patch42:        openssh-link-with-sk.patch
 Patch43:        openssh-reenable-dh-group14-sha1-default.patch
-Patch44:        openssh-fix-ssh-copy-id.patch
 Patch45:        openssh-8.4p1-ssh_config_d.patch
 Patch46:        openssh-whitelist-syscalls.patch
 Patch47:        openssh-8.4p1-vendordir.patch