diff --git a/gnome-ssh-askpass.csh b/gnome-ssh-askpass.csh
deleted file mode 100644
index dd77712cdb3ace25992b38c1e65e24ea5108ad60..0000000000000000000000000000000000000000
--- a/gnome-ssh-askpass.csh
+++ /dev/null
@@ -1 +0,0 @@
-setenv SSH_ASKPASS /usr/libexec/openssh/gnome-ssh-askpass
diff --git a/gnome-ssh-askpass.sh b/gnome-ssh-askpass.sh
deleted file mode 100644
index 355189f45cbe75e4481dcbd6743cb6147fbd0693..0000000000000000000000000000000000000000
--- a/gnome-ssh-askpass.sh
+++ /dev/null
@@ -1,2 +0,0 @@
-SSH_ASKPASS=/usr/libexec/openssh/gnome-ssh-askpass
-export SSH_ASKPASS
diff --git a/openssh-5.8p2-sigpipe.patch b/openssh-5.8p2-sigpipe.patch
index 56af045eae3345321228940764359c0fa9c81759..554e346823032615b391193dcf42ab5da83929c9 100644
--- a/openssh-5.8p2-sigpipe.patch
+++ b/openssh-5.8p2-sigpipe.patch
@@ -1,12 +1,14 @@
 diff -up openssh-5.8p2/ssh-keyscan.c.sigpipe openssh-5.8p2/ssh-keyscan.c
 --- openssh-5.8p2/ssh-keyscan.c.sigpipe	2011-08-23 18:30:33.873025916 +0200
 +++ openssh-5.8p2/ssh-keyscan.c	2011-08-23 18:32:24.574025362 +0200
-@@ -715,6 +715,8 @@ main(int argc, char **argv)
+@@ -715,6 +715,9 @@ main(int argc, char **argv)
+	if (maxfd > fdlim_get(0))
  		fdlim_set(maxfd);
  	fdcon = xcalloc(maxfd, sizeof(con));
- 
++ 
 +	signal(SIGPIPE, SIG_IGN);
 +
- 	read_wait_nfdset = howmany(maxfd, NFDBITS);
- 	read_wait = xcalloc(read_wait_nfdset, sizeof(fd_mask));
+	read_wait = xcalloc(maxfd, sizeof(struct pollfd));
+	for (j = 0; j < maxfd; j++)
+		read_wait[j].fd = -1;
  
diff --git a/openssh-6.6.1p1-log-in-chroot.patch b/openssh-6.6.1p1-log-in-chroot.patch
index 426c1727d167a90f41107fcf67fe7191febecb13..941c69499ae80bddd73d7904a244691d100dfca1 100644
--- a/openssh-6.6.1p1-log-in-chroot.patch
+++ b/openssh-6.6.1p1-log-in-chroot.patch
@@ -207,8 +207,8 @@ diff -up openssh-8.6p1/sftp-server.c.log-in-chroot openssh-8.6p1/sftp-server.c
 -sftp_server_main(int argc, char **argv, struct passwd *user_pw)
 +sftp_server_main(int argc, char **argv, struct passwd *user_pw, int reset_handler)
  {
- 	fd_set *rset, *wset;
- 	int i, r, in, out, max, ch, skipargs = 0, log_stderr = 0;
+	int i, r, in, out, ch, skipargs = 0, log_stderr = 0;
+	ssize_t len, olen;
 @@ -1657,7 +1657,7 @@ sftp_server_main(int argc, char **argv,
  	extern char *__progname;
  
diff --git a/openssh-6.6p1-allow-ip-opts.patch b/openssh-6.6p1-allow-ip-opts.patch
index 953d6133e925b55e1288da9d4d3a9bea36ce5b97..be8d3409e666cd893d3921a8186413bace4d5c6c 100644
--- a/openssh-6.6p1-allow-ip-opts.patch
+++ b/openssh-6.6p1-allow-ip-opts.patch
@@ -1,7 +1,7 @@
 diff -up openssh/sshd.c.ip-opts openssh/sshd.c
 --- openssh/sshd.c.ip-opts	2016-07-25 13:58:48.998507834 +0200
 +++ openssh/sshd.c	2016-07-25 14:01:28.346469878 +0200
-@@ -1507,12 +1507,29 @@ check_ip_options(struct ssh *ssh)
+@@ -1507,12 +1507,32 @@ check_ip_options(struct ssh *ssh)
  
  	if (getsockopt(sock_in, IPPROTO_IP, IP_OPTIONS, opts,
  	    &option_size) >= 0 && option_size != 0) {
@@ -21,11 +21,14 @@ diff -up openssh/sshd.c.ip-opts openssh/sshd.c
 +				case 130:
 +				case 133:
 +				case 134:
-+					i += opts[i + 1];
-+					break;
++					if (i + 1 < option_size && opts[i + 1] >= 2) {
++						i += opts[i + 1];
++						break;
++					}
++					/* FALLTHROUGH */
 +				default:
 +				/* Fail, fatally, if we detect either loose or strict
-+			 	 * source routing options. */
++			 	 * or incorrect source routing options. */
 +					text[0] = '\0';
 +					for (i = 0; i < option_size; i++)
 +						snprintf(text + i*3, sizeof(text) - i*3,
diff --git a/openssh-6.6p1-keycat.patch b/openssh-6.6p1-keycat.patch
index 83d3ef468e771b3bd6ae58af9f4223285f9f8378..2aa14bd44e420e4e5a87f56dc6df9da1d935e5cd 100644
--- a/openssh-6.6p1-keycat.patch
+++ b/openssh-6.6p1-keycat.patch
@@ -237,8 +237,8 @@ diff -up openssh/ssh-keycat.c.keycat openssh/ssh-keycat.c
 + */
 +
 +/*
-+ * Copyright (c) 2011 R H, Inc.
-+ * Written by Tomas Mraz <tmraz@rt.com>
++ * Copyright (c) 2011 Red Hat, Inc.
++ * Written by Tomas Mraz <tmraz@redhat.com>
 +*/
 +
 +#define _GNU_SOURCE
diff --git a/openssh-6.6p1-kuserok.patch b/openssh-6.6p1-kuserok.patch
index e6d6210ad360c0c04023335fcb069212cd850fa2..f3231f932891964b82096d13ce17d35281653850 100644
--- a/openssh-6.6p1-kuserok.patch
+++ b/openssh-6.6p1-kuserok.patch
@@ -91,7 +91,7 @@ diff -up openssh-7.4p1/gss-serv-krb5.c.kuserok openssh-7.4p1/gss-serv-krb5.c
 + * configuring krb5.conf or using a suitable plugin to meet the needs of the
 + * given environment.
 + *
-+ * The Fa and RHEL version of openssh contain two patches which modify the
++ * The Fedora and RHEL version of openssh contain two patches which modify the
 + * access control behavior:
 + *  - openssh-6.6p1-kuserok.patch
 + *  - openssh-6.6p1-force_krb.patch
@@ -107,7 +107,7 @@ diff -up openssh-7.4p1/gss-serv-krb5.c.kuserok openssh-7.4p1/gss-serv-krb5.c
 + * no only check .k5login but other sources as well and checking .k5login can
 + * be disabled for all applications in krb5.conf as well. With this new
 + * option KerberosUseKuserok set to 'no' (and this is the default for RHEL7
-+ * and Fa 21) openssh can only use krb5_aname_to_localname() with the
++ * and Fedora 21) openssh can only use krb5_aname_to_localname() with the
 + * restrictions mentioned above.
 + *
 + * openssh-6.6p1-force_krb.patch adds a ksu like behaviour to ssh, i.e. when
diff --git a/openssh-6.7p1-coverity.patch b/openssh-6.7p1-coverity.patch
index 147d90d19c3ad0ff3cac198713039ecfc9a8d3bb..1923ac8c66eec84ff5d3807cd7fc9850ecb64345 100644
--- a/openssh-6.7p1-coverity.patch
+++ b/openssh-6.7p1-coverity.patch
@@ -1,37 +1,3 @@
-diff -up openssh-8.5p1/addr.c.coverity openssh-8.5p1/addr.c
---- openssh-8.5p1/addr.c.coverity	2021-03-02 11:31:47.000000000 +0100
-+++ openssh-8.5p1/addr.c	2021-03-24 12:03:33.782968159 +0100
-@@ -312,8 +312,10 @@ addr_pton(const char *p, struct xaddr *n
- 	if (p == NULL || getaddrinfo(p, NULL, &hints, &ai) != 0)
- 		return -1;
- 
--	if (ai == NULL || ai->ai_addr == NULL)
-+	if (ai == NULL || ai->ai_addr == NULL) {
-+		freeaddrinfo(ai);
- 		return -1;
-+	}
- 
- 	if (n != NULL && addr_sa_to_xaddr(ai->ai_addr, ai->ai_addrlen,
- 	    n) == -1) {
-@@ -336,12 +338,16 @@ addr_sa_pton(const char *h, const char *
- 	if (h == NULL || getaddrinfo(h, s, &hints, &ai) != 0)
- 		return -1;
- 
--	if (ai == NULL || ai->ai_addr == NULL)
-+	if (ai == NULL || ai->ai_addr == NULL) {
-+		freeaddrinfo(ai);
- 		return -1;
-+	}
- 
- 	if (sa != NULL) {
--		if (slen < ai->ai_addrlen)
-+		if (slen < ai->ai_addrlen) {
-+			freeaddrinfo(ai);
- 			return -1;
-+		}
- 		memcpy(sa, &ai->ai_addr, ai->ai_addrlen);
- 	}
- 
 diff -up openssh-8.5p1/auth-krb5.c.coverity openssh-8.5p1/auth-krb5.c
 --- openssh-8.5p1/auth-krb5.c.coverity	2021-03-24 12:03:33.724967756 +0100
 +++ openssh-8.5p1/auth-krb5.c	2021-03-24 12:03:33.782968159 +0100
@@ -65,15 +31,6 @@ diff -up openssh-8.5p1/auth-options.c.coverity openssh-8.5p1/auth-options.c
 diff -up openssh-7.4p1/channels.c.coverity openssh-7.4p1/channels.c
 --- openssh-7.4p1/channels.c.coverity	2016-12-23 16:40:26.881788686 +0100
 +++ openssh-7.4p1/channels.c	2016-12-23 16:42:36.244818763 +0100
-@@ -1875,7 +1875,7 @@ channel_post_connecting(struct ssh *ssh,
- 		debug("channel %d: connection failed: %s",
- 		    c->self, strerror(err));
- 		/* Try next address, if any */
--		if ((sock = connect_next(&c->connect_ctx)) > 0) {
-+		if ((sock = connect_next(&c->connect_ctx)) >= 0) {
- 			close(c->sock);
- 			c->sock = c->rfd = c->wfd = sock;
- 			channel_find_maxfd(ssh->chanctxt);
 @@ -3804,7 +3804,7 @@ int
  channel_request_remote_forwarding(struct ssh *ssh, struct Forward *fwd)
  {
@@ -411,30 +368,6 @@ diff -up openssh-7.4p1/sftp.c.coverity openssh-7.4p1/sftp.c
  				continue;
  			}
  			lname = ls_file(fname, g.gl_statv[i], 1,
-diff --git a/sftp-client.c b/sftp-client.c
-index 9de9afa20f..ea98d9f8d0 100644
---- a/sftp-client.c
-+++ b/sftp-client.c
-@@ -2195,6 +2195,7 @@ handle_dest_replies(struct sftp_conn *to, const char *to_path, int synchronous,
- 		(*nreqsp)--;
- 	}
- 	debug3_f("done: %u outstanding replies", *nreqsp);
-+	sshbuf_free(msg);
- }
- 
- int
-diff --git a/sftp-server.c b/sftp-server.c
-index 18d1949112..6380c4dd23 100644
---- a/sftp-server.c
-+++ b/sftp-server.c
-@@ -1553,6 +1553,7 @@ process_extended_expand(u_int32_t id)
- 			npath = xstrdup(path + 2);
- 			free(path);
- 			xasprintf(&path, "%s/%s", cwd, npath);
-+			free(npath);
- 		} else {
- 			/* ~user expansions */
- 			if (tilde_expand(path, pw->pw_uid, &npath) != 0) {
 diff -up openssh-8.5p1/sk-usbhid.c.coverity openssh-8.5p1/sk-usbhid.c
 --- openssh-8.5p1/sk-usbhid.c.coverity	2021-03-02 11:31:47.000000000 +0100
 +++ openssh-8.5p1/sk-usbhid.c	2021-03-24 12:03:33.786968187 +0100
@@ -494,16 +427,6 @@ diff -up openssh-7.4p1/sshd.c.coverity openssh-7.4p1/sshd.c
  
  		return 0;
  	}
-@@ -1386,6 +1388,9 @@ server_accept_loop(int *sock_in, int *so
- 			explicit_bzero(rnd, sizeof(rnd));
- 		}
- 	}
-+
-+	if (fdset != NULL)
-+		free(fdset);
- }
- 
- /*
 @@ -2519,8 +2524,11 @@ do_ssh2_kex(struct ssh *ssh)
  
  	if (newstr)
diff --git a/openssh-7.3p1-x11-max-displays.patch b/openssh-7.3p1-x11-max-displays.patch
index 5af3e3bfc223b20ddf77f7558f8f31fb67125324..ad181cb57bef73b71ff1a30c86a05e954d693f9b 100644
--- a/openssh-7.3p1-x11-max-displays.patch
+++ b/openssh-7.3p1-x11-max-displays.patch
@@ -10,8 +10,8 @@ diff -up openssh-7.4p1/channels.c.x11max openssh-7.4p1/channels.c
 +/* Minimum port number for X11 forwarding */
 +#define X11_PORT_MIN 6000
  
- /* Per-channel callback for pre/post select() actions */
- typedef void chan_fn(struct ssh *, Channel *c,
+ /* Per-channel callback for pre/post IO actions */
+ typedef void chan_fn(struct ssh *, Channel *c);
 @@ -4228,7 +4228,7 @@ channel_send_window_changes(void)
   */
  int
diff --git a/openssh-7.4p1-systemd.patch b/openssh-7.4p1-systemd.patch
index 5881057f172742689d4cdc7e933aa74324d9d8c2..4f9e58a99044003969ed299391e20206d395093e 100644
--- a/openssh-7.4p1-systemd.patch
+++ b/openssh-7.4p1-systemd.patch
@@ -1,5 +1,5 @@
 commit 0e22b79bfde45a7cf7a2e51a68ec11c4285f3b31
-Author: Jakub Jelen <jjelen@rt.com>
+Author: Jakub Jelen <jjelen@redhat.com>
 Date:   Mon Nov 21 15:04:06 2016 +0100
 
     systemd stuff
diff --git a/openssh-7.6p1-audit.patch b/openssh-7.6p1-audit.patch
index 6cc8a43389e20ccf3f9ded408fd804c6cb5f9632..2d3aae95df3c4f8a5d803973960baca3cc177f1c 100644
--- a/openssh-7.6p1-audit.patch
+++ b/openssh-7.6p1-audit.patch
@@ -676,7 +676,7 @@ diff -up openssh-8.6p1/auditstub.c.audit openssh-8.6p1/auditstub.c
 +/* $Id: auditstub.c,v 1.1 jfch Exp $ */
 +
 +/*
-+ * Copyright 2010 R H, Inc.  All rights reserved.
++ * Copyright 2010 Red Hat, Inc.  All rights reserved.
 + * Use is subject to license terms.
 + *
 + * Redistribution and use in source and binary forms, with or without
@@ -699,7 +699,7 @@ diff -up openssh-8.6p1/auditstub.c.audit openssh-8.6p1/auditstub.c
 + * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 + * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 + *
-+ * R H author: Jan F. Chadima <jchadima@rt.com>
++ * Red Hat author: Jan F. Chadima <jchadima@redhat.com>
 + */
 +
 +#include <sys/types.h>
@@ -729,7 +729,7 @@ diff -up openssh-8.6p1/auth2.c.audit openssh-8.6p1/auth2.c
 --- openssh-8.6p1/auth2.c.audit	2021-04-19 16:47:35.682061561 +0200
 +++ openssh-8.6p1/auth2.c	2021-04-19 16:47:35.754062114 +0200
 @@ -298,9 +298,6 @@ input_userauth_request(int type, u_int32
- 		} else {
+			authctxt->valid = 0;
  			/* Invalid user, fake password information */
  			authctxt->pw = fakepw();
 -#ifdef SSH_AUDIT_EVENTS
@@ -1195,9 +1195,9 @@ diff -up openssh-8.6p1/monitor.c.audit openssh-8.6p1/monitor.c
  
 -	ret = sshkey_verify(key, signature, signaturelen, data, datalen,
 -	    sigalg, ssh->compat, &sig_details);
-	debug3_f("%s %s signature %s%s%s", auth_method, sshkey_type(key),
+	debug3_f("%s %s signature using %s %s%s%s", auth_method,
+	    sshkey_type(key), sigalg == NULL ? "default" : sigalg,
 	    (ret == 0) ? "verified" : "unverified",
-	    (ret != 0) ? ": " : "", (ret != 0) ? ssh_err(ret) : "");
 @@ -1576,13 +1600,19 @@ mm_record_login(struct ssh *ssh, Session
  }
  
@@ -2040,7 +2040,7 @@ diff -up openssh-8.6p1/sshd.c.audit openssh-8.6p1/sshd.c
  
  static char *listener_proctitle;
 @@ -279,6 +280,15 @@ close_listen_socks(void)
- 	num_listen_socks = -1;
+ 	num_listen_socks = 0;
  }
  
 +/*
@@ -2049,16 +2049,16 @@ diff -up openssh-8.6p1/sshd.c.audit openssh-8.6p1/sshd.c
 + */
 +int listening_for_clients(void)
 +{
-+	return num_listen_socks >= 0;
++	return num_listen_socks > 0;
 +}
 +
  static void
  close_startup_pipes(void)
  {
 @@ -377,18 +387,45 @@ grace_alarm_handler(int sig)
- 	}
+	    ssh_remote_port(the_active_state));
  }
- 
+
 -/* Destroy the host and server keys.  They will no longer be needed. */
 +/*
 + * Destroy the host and server keys.  They will no longer be needed.  Careful,
@@ -2196,8 +2196,8 @@ diff -up openssh-8.6p1/sshd.c.audit openssh-8.6p1/sshd.c
 -server_accept_loop(int *sock_in, int *sock_out, int *newsock, int *config_s)
 +server_accept_loop(struct ssh *ssh, int *sock_in, int *sock_out, int *newsock, int *config_s)
  {
- 	fd_set *fdset;
- 	int i, j, ret, maxfd;
+	struct pollfd *pfd = NULL;
+	int i, j, ret, npfd;
 @@ -1204,6 +1259,7 @@ server_accept_loop(int *sock_in, int *so
  		if (received_sigterm) {
  			logit("Received signal %d; terminating.",
diff --git a/openssh-7.7p1-anolis.patch b/openssh-7.7p1-anolis.patch
index 48c74038e865e6414c003debe677031dff9b6bf3..bbd0c9ce5ae2bd648187d393681aa2309828ad32 100644
--- a/openssh-7.7p1-anolis.patch
+++ b/openssh-7.7p1-anolis.patch
@@ -15,7 +15,7 @@ diff -up openssh/ssh_config.anolis openssh/ssh_config
 diff -up openssh/ssh_config_anolis.anolis openssh/ssh_config_anolis
 --- openssh/ssh_config_anolis.anolis	2020-02-13 18:13:39.180641839 +0100
 +++ openssh/ssh_config_anolis	2020-02-13 18:13:39.180641839 +0100
-@@ -0,0 +1,21 @@
+@@ -0,0 +1,15 @@
 +# The options here are in the "Match final block" to be applied as the last
 +# options and could be potentially overwritten by the user configuration
 +Match final all
@@ -29,12 +29,6 @@ diff -up openssh/ssh_config_anolis.anolis openssh/ssh_config_anolis
 +# mode correctly we set this to yes.
 +	ForwardX11Trusted yes
 +
-+# Send locale-related environment variables
-+	SendEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
-+	SendEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
-+	SendEnv LC_IDENTIFICATION LC_ALL LANGUAGE
-+	SendEnv XMODIFIERS
-+
 +# Uncomment this if you want to use .local domain
 +# Host *.local
 diff -up openssh/sshd_config.0.anolis openssh/sshd_config.0
@@ -86,7 +80,7 @@ diff -up openssh/sshd_config.anolis openssh/sshd_config
 diff -up openssh/sshd_config_anolis.anolis openssh/sshd_config_anolis
 --- openssh/sshd_config_anolis.anolis	2020-02-13 18:14:02.268006439 +0100
 +++ openssh/sshd_config_anolis	2020-02-13 18:19:20.765035947 +0100
-@@ -0,0 +1,28 @@
+@@ -0,0 +1,22 @@
 +# This system is following system-wide crypto policy. The changes to
 +# crypto properties (Ciphers, MACs, ...) will not have any effect in
 +# this or following included files. To override some configuration option,
@@ -109,9 +103,4 @@ diff -up openssh/sshd_config_anolis.anolis openssh/sshd_config_anolis
 +# as it is more configurable and versatile than the built-in version.
 +PrintMotd no
 +
-+# Accept locale-related environment variables
-+AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
-+AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
-+AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
-+AcceptEnv XMODIFIERS
 +
diff --git a/openssh-7.7p1-fips.patch b/openssh-7.7p1-fips.patch
index cc513dbce89cc38ac401fb31de45f980a7252834..d1e44b00e6fbf9fcde3f0266d15e8d319fd29959 100644
--- a/openssh-7.7p1-fips.patch
+++ b/openssh-7.7p1-fips.patch
@@ -1,6 +1,14 @@
 diff -up openssh-8.6p1/dh.c.fips openssh-8.6p1/dh.c
 --- openssh-8.6p1/dh.c.fips	2021-04-16 05:55:25.000000000 +0200
-+++ openssh-8.6p1/dh.c	2021-04-19 16:58:47.750263410 +0200
++++ openssh-8.6p1/dh.c	2021-05-06 12:12:10.107634472 +0200
+@@ -36,6 +36,7 @@
+ 
+ #include <openssl/bn.h>
+ #include <openssl/dh.h>
++#include <openssl/fips.h>
+ 
+ #include "dh.h"
+ #include "pathnames.h"
 @@ -164,6 +164,12 @@ choose_dh(int min, int wantbits, int max
  	int best, bestcount, which, linenum;
  	struct dhgroup dhg;
@@ -54,8 +62,8 @@ diff -up openssh-8.6p1/dh.c.fips openssh-8.6p1/dh.c
 +
  #endif /* WITH_OPENSSL */
 diff -up openssh-8.6p1/dh.h.fips openssh-8.6p1/dh.h
---- openssh-8.6p1/dh.h.fips	2021-04-19 16:53:03.064577862 +0200
-+++ openssh-8.6p1/dh.h	2021-04-19 16:59:31.951616078 +0200
+--- openssh-8.6p1/dh.h.fips	2021-05-06 12:08:36.498926877 +0200
++++ openssh-8.6p1/dh.h	2021-05-06 12:11:28.393298005 +0200
 @@ -45,6 +45,7 @@ DH	*dh_new_group_fallback(int);
  
  int	 dh_gen_key(DH *, int);
@@ -65,8 +73,16 @@ diff -up openssh-8.6p1/dh.h.fips openssh-8.6p1/dh.h
  u_int	 dh_estimate(int);
  void	 dh_set_moduli_file(const char *);
 diff -up openssh-8.6p1/kex.c.fips openssh-8.6p1/kex.c
---- openssh-8.6p1/kex.c.fips	2021-04-19 16:53:03.058577815 +0200
-+++ openssh-8.6p1/kex.c	2021-04-19 16:53:03.065577869 +0200
+--- openssh-8.6p1/kex.c.fips	2021-05-06 12:08:36.489926807 +0200
++++ openssh-8.6p1/kex.c	2021-05-06 12:08:36.498926877 +0200
+@@ -39,6 +39,7 @@
+ 
+ #ifdef WITH_OPENSSL
+ #include <openssl/crypto.h>
++#include <openssl/fips.h>
+ #include <openssl/dh.h>
+ # ifdef HAVE_EVP_KDF_CTX_NEW_ID
+ # include <openssl/kdf.h>
 @@ -203,7 +203,10 @@ kex_names_valid(const char *names)
  	for ((p = strsep(&cp, ",")); p && *p != '\0';
  	    (p = strsep(&cp, ","))) {
@@ -81,12 +97,12 @@ diff -up openssh-8.6p1/kex.c.fips openssh-8.6p1/kex.c
  		}
 diff -up openssh-8.6p1/kexgexc.c.fips openssh-8.6p1/kexgexc.c
 --- openssh-8.6p1/kexgexc.c.fips	2021-04-16 05:55:25.000000000 +0200
-+++ openssh-8.6p1/kexgexc.c	2021-04-19 16:53:03.065577869 +0200
++++ openssh-8.6p1/kexgexc.c	2021-05-06 12:08:36.498926877 +0200
 @@ -28,6 +28,7 @@
  
  #ifdef WITH_OPENSSL
  
-+#include <openssl/crypto.h>
++#include <openssl/fips.h>
  #include <sys/types.h>
  
  #include <openssl/dh.h>
@@ -152,8 +168,16 @@ diff -up openssh-8.6p1/myproposal.h.fips openssh-8.6p1/myproposal.h
  #define	SSH_ALLOWED_CA_SIGALGS	\
  	"ssh-ed25519," \
 diff -up openssh-8.6p1/readconf.c.fips openssh-8.6p1/readconf.c
---- openssh-8.6p1/readconf.c.fips	2021-04-19 16:53:02.999577362 +0200
-+++ openssh-8.6p1/readconf.c	2021-04-19 16:53:03.065577869 +0200
+--- openssh-8.6p1/readconf.c.fips	2021-05-06 12:08:36.428926336 +0200
++++ openssh-8.6p1/readconf.c	2021-05-06 12:08:36.499926885 +0200
+@@ -39,6 +39,7 @@
+ #include <string.h>
+ #include <stdarg.h>
+ #include <unistd.h>
++#include <openssl/fips.h>
+ #ifdef USE_SYSTEM_GLOB
+ # include <glob.h>
+ #else
 @@ -2538,11 +2538,16 @@ fill_default_options(Options * options)
  	all_key = sshkey_alg_list(0, 0, 1, ',');
  	all_sig = sshkey_alg_list(0, 1, 1, ',');
@@ -177,8 +201,8 @@ diff -up openssh-8.6p1/readconf.c.fips openssh-8.6p1/readconf.c
  	do { \
  		if ((r = kex_assemble_names(&options->what, \
 diff -up openssh-8.6p1/sandbox-seccomp-filter.c.fips openssh-8.6p1/sandbox-seccomp-filter.c
---- openssh-8.6p1/sandbox-seccomp-filter.c.fips	2021-04-19 16:53:03.034577631 +0200
-+++ openssh-8.6p1/sandbox-seccomp-filter.c	2021-04-19 16:53:03.065577869 +0200
+--- openssh-8.6p1/sandbox-seccomp-filter.c.fips	2021-05-06 12:08:36.463926606 +0200
++++ openssh-8.6p1/sandbox-seccomp-filter.c	2021-05-06 12:08:36.499926885 +0200
 @@ -160,6 +160,9 @@ static const struct sock_filter preauth_
  #ifdef __NR_open
  	SC_DENY(__NR_open, EACCES),
@@ -190,8 +214,16 @@ diff -up openssh-8.6p1/sandbox-seccomp-filter.c.fips openssh-8.6p1/sandbox-secco
  	SC_DENY(__NR_openat, EACCES),
  #endif
 diff -up openssh-8.6p1/servconf.c.fips openssh-8.6p1/servconf.c
---- openssh-8.6p1/servconf.c.fips	2021-04-19 16:53:03.027577577 +0200
-+++ openssh-8.6p1/servconf.c	2021-04-19 16:53:03.066577877 +0200
+--- openssh-8.6p1/servconf.c.fips	2021-05-06 12:08:36.455926545 +0200
++++ openssh-8.6p1/servconf.c	2021-05-06 12:08:36.500926893 +0200
+@@ -38,6 +38,7 @@
+ #include <limits.h>
+ #include <stdarg.h>
+ #include <errno.h>
++#include <openssl/fips.h>
+ #ifdef HAVE_UTIL_H
+ #include <util.h>
+ #endif
 @@ -226,11 +226,16 @@ assemble_algorithms(ServerOptions *o)
  	all_key = sshkey_alg_list(0, 0, 1, ',');
  	all_sig = sshkey_alg_list(0, 1, 1, ',');
@@ -215,13 +247,13 @@ diff -up openssh-8.6p1/servconf.c.fips openssh-8.6p1/servconf.c
  	do { \
  		if ((r = kex_assemble_names(&o->what, defaults, all)) != 0) \
 diff -up openssh-8.6p1/ssh.c.fips openssh-8.6p1/ssh.c
---- openssh-8.6p1/ssh.c.fips	2021-04-19 16:53:03.038577662 +0200
-+++ openssh-8.6p1/ssh.c	2021-04-19 16:53:03.066577877 +0200
+--- openssh-8.6p1/ssh.c.fips	2021-05-06 12:08:36.467926637 +0200
++++ openssh-8.6p1/ssh.c	2021-05-06 12:08:36.500926893 +0200
 @@ -77,6 +77,7 @@
  #include <openssl/evp.h>
  #include <openssl/err.h>
  #endif
-+#include <openssl/crypto.h>
++#include <openssl/fips.h>
  #include "openbsd-compat/openssl-compat.h"
  #include "openbsd-compat/sys-queue.h"
  
@@ -237,13 +269,13 @@ diff -up openssh-8.6p1/ssh.c.fips openssh-8.6p1/ssh.c
  	if (options.sk_provider != NULL && *options.sk_provider == '$' &&
  	    strlen(options.sk_provider) > 1) {
 diff -up openssh-8.6p1/sshconnect2.c.fips openssh-8.6p1/sshconnect2.c
---- openssh-8.6p1/sshconnect2.c.fips	2021-04-19 16:53:03.055577792 +0200
-+++ openssh-8.6p1/sshconnect2.c	2021-04-19 16:53:03.066577877 +0200
+--- openssh-8.6p1/sshconnect2.c.fips	2021-05-06 12:08:36.485926777 +0200
++++ openssh-8.6p1/sshconnect2.c	2021-05-06 12:08:36.501926900 +0200
 @@ -45,6 +45,8 @@
  #include <vis.h>
  #endif
  
-+#include <openssl/crypto.h>
++#include <openssl/fips.h>
 +
  #include "openbsd-compat/sys-queue.h"
  
@@ -318,10 +350,10 @@ diff -up openssh-8.6p1/sshconnect2.c.fips openssh-8.6p1/sshconnect2.c
  	}
  #endif
 diff -up openssh-8.6p1/sshd.c.fips openssh-8.6p1/sshd.c
---- openssh-8.6p1/sshd.c.fips	2021-04-19 16:53:03.060577831 +0200
-+++ openssh-8.6p1/sshd.c	2021-04-19 16:57:45.827769340 +0200
+--- openssh-8.6p1/sshd.c.fips	2021-05-06 12:08:36.493926838 +0200
++++ openssh-8.6p1/sshd.c	2021-05-06 12:13:56.501492639 +0200
 @@ -66,6 +66,7 @@
- #include <grp.h>
+ #endif
  #include <pwd.h>
  #include <signal.h>
 +#include <syslog.h>
@@ -332,7 +364,7 @@ diff -up openssh-8.6p1/sshd.c.fips openssh-8.6p1/sshd.c
  #include <openssl/dh.h>
  #include <openssl/bn.h>
  #include <openssl/rand.h>
-+#include <openssl/crypto.h>
++#include <openssl/fips.h>
  #include "openbsd-compat/openssl-compat.h"
  #endif
  
@@ -389,13 +421,13 @@ diff -up openssh-8.6p1/sshd.c.fips openssh-8.6p1/sshd.c
  	if (gss && orig)
  		xasprintf(&newstr, "%s,%s", gss, orig);
 diff -up openssh-8.6p1/sshkey.c.fips openssh-8.6p1/sshkey.c
---- openssh-8.6p1/sshkey.c.fips	2021-04-19 16:53:03.061577838 +0200
-+++ openssh-8.6p1/sshkey.c	2021-04-19 16:53:03.067577885 +0200
+--- openssh-8.6p1/sshkey.c.fips	2021-05-06 12:08:36.493926838 +0200
++++ openssh-8.6p1/sshkey.c	2021-05-06 12:08:36.502926908 +0200
 @@ -34,6 +34,7 @@
  #include <openssl/evp.h>
  #include <openssl/err.h>
  #include <openssl/pem.h>
-+#include <openssl/crypto.h>
++#include <openssl/fips.h>
  #endif
  
  #include "crypto_api.h"
@@ -480,8 +512,16 @@ diff -up openssh-8.6p1/sshkey.c.fips openssh-8.6p1/sshkey.c
  		    compat, detailsp);
  #ifdef WITH_XMSS
 diff -up openssh-8.6p1/ssh-keygen.c.fips openssh-8.6p1/ssh-keygen.c
---- openssh-8.6p1/ssh-keygen.c.fips	2021-04-19 16:53:03.038577662 +0200
-+++ openssh-8.6p1/ssh-keygen.c	2021-04-19 16:53:03.068577892 +0200
+--- openssh-8.6p1/ssh-keygen.c.fips	2021-05-06 12:08:36.467926637 +0200
++++ openssh-8.6p1/ssh-keygen.c	2021-05-06 12:08:36.503926916 +0200
+@@ -20,6 +20,7 @@
+ 
+ #ifdef WITH_OPENSSL
+ #include <openssl/evp.h>
++#include <openssl/fips.h>
+ #include <openssl/pem.h>
+ #include "openbsd-compat/openssl-compat.h"
+ #endif
 @@ -205,6 +205,12 @@ type_bits_valid(int type, const char *na
  #endif
  	}
@@ -521,7 +561,7 @@ diff -up openssh-8.7p1/kexgen.c.fips3 openssh-8.7p1/kexgen.c
  #include <stdio.h>
  #include <string.h>
  #include <signal.h>
-+#include <openssl/crypto.h>
++#include <openssl/fips.h>
  
  #include "sshkey.h"
  #include "kex.h"
@@ -607,7 +647,7 @@ diff -up openssh-8.7p1/ssh-ed25519.c.fips3 openssh-8.7p1/ssh-ed25519.c
  
  #include <string.h>
  #include <stdarg.h>
-+#include <openssl/crypto.h>
++#include <openssl/fips.h>
  
  #include "log.h"
  #include "sshbuf.h"
diff --git a/openssh-7.8p1-UsePAM-warning.patch b/openssh-7.8p1-UsePAM-warning.patch
index 0ce8e275934cc442512b6941a031c4ceeb4c5224..a94419e10dc24580f92504764d9bf50de70fbea6 100644
--- a/openssh-7.8p1-UsePAM-warning.patch
+++ b/openssh-7.8p1-UsePAM-warning.patch
@@ -3,11 +3,11 @@ diff -up openssh-8.6p1/sshd.c.log-usepam-no openssh-8.6p1/sshd.c
 +++ openssh-8.6p1/sshd.c	2021-04-19 14:03:21.140920974 +0200
 @@ -1749,6 +1749,10 @@ main(int ac, char **av)
  	parse_server_config(&options, rexeced_flag ? "rexec" : config_file_name,
- 	    cfg, &includes, NULL);
+ 	    cfg, &includes, NULL, rexeced_flag);
  
-+	/* 'UsePAM no' is not supported in Fa */
++	/* 'UsePAM no' is not supported in Fedora */
 +	if (! options.use_pam)
-+		logit("WARNING: 'UsePAM no' is not supported in Fa and may cause several problems.");
++		logit("WARNING: 'UsePAM no' is not supported in Fedora and may cause several problems.");
 +
  #ifdef WITH_OPENSSL
  	if (options.moduli_file != NULL)
@@ -19,7 +19,7 @@ diff -up openssh-8.6p1/sshd_config.log-usepam-no openssh-8.6p1/sshd_config
  # If you just want the PAM account and session checks to run without
  # PAM authentication, then enable this but set PasswordAuthentication
  # and KbdInteractiveAuthentication to 'no'.
-+# WARNING: 'UsePAM no' is not supported in Fa and may cause several
++# WARNING: 'UsePAM no' is not supported in Fedora and may cause several
 +# problems.
  #UsePAM no
  
diff --git a/openssh-7.8p1-role-mls.patch b/openssh-7.8p1-role-mls.patch
index fca0d744917640d89e667e06df8fe7545aa0d267..4dc460a530f46109d540e3a586d4b329c6ef420e 100644
--- a/openssh-7.8p1-role-mls.patch
+++ b/openssh-7.8p1-role-mls.patch
@@ -93,7 +93,7 @@ diff -up openssh/auth2-hostbased.c.role-mls openssh/auth2-hostbased.c
  	    (r = sshbuf_put_cstring(b, authctxt->user)) != 0 ||
 +#endif
  	    (r = sshbuf_put_cstring(b, authctxt->service)) != 0 ||
- 	    (r = sshbuf_put_cstring(b, "hostbased")) != 0 ||
+ 	    (r = sshbuf_put_cstring(b, method)) != 0 ||
  	    (r = sshbuf_put_string(b, pkalg, alen)) != 0 ||
 diff -up openssh/auth2-pubkey.c.role-mls openssh/auth2-pubkey.c
 --- openssh/auth2-pubkey.c.role-mls	2018-08-22 11:14:56.816430924 +0200
@@ -240,14 +240,14 @@ diff -up openssh-8.6p1/monitor.c.role-mls openssh-8.6p1/monitor.c
  mm_answer_authpassword(struct ssh *ssh, int sock, struct sshbuf *m)
  {
 @@ -1251,7 +1280,7 @@ monitor_valid_userblob(struct ssh *ssh,
- {
  	struct sshbuf *b;
+	struct sshkey *hostkey = NULL;
  	const u_char *p;
 -	char *userstyle, *cp;
 +	char *userstyle, *s, *cp;
  	size_t len;
  	u_char type;
- 	int r, fail = 0;
+ 	int hostbound = 0, r, fail = 0;
 @@ -1282,6 +1311,8 @@ monitor_valid_userblob(struct ssh *ssh,
  		fail++;
  	if ((r = sshbuf_get_cstring(b, &cp, NULL)) != 0)
@@ -420,8 +420,8 @@ diff -up openssh/openbsd-compat/port-linux-sshd.c.role-mls openssh/openbsd-compa
 +++ openssh/openbsd-compat/port-linux-sshd.c	2018-08-22 11:14:56.819430949 +0200
 @@ -0,0 +1,421 @@
 +/*
-+ * Copyright (c) 2005 Daniel Walsh <dwalsh@rt.com>
-+ * Copyright (c) 2014 Petr Lautrbach <plautrba@rt.com>
++ * Copyright (c) 2005 Daniel Walsh <dwalsh@redhat.com>
++ * Copyright (c) 2014 Petr Lautrbach <plautrba@redhat.com>
 + *
 + * Permission to use, copy, modify, and distribute this software for any
 + * purpose with or without fee is hereby granted, provided that the above
diff --git a/openssh-8.0p1-crypto-policies.patch b/openssh-8.0p1-crypto-policies.patch
index 62616aaa5698c218e1552a41b4b40fa5bc5ce8b5..d4549f0ababcd1a8d08637d1eccf0c7b5a140fbc 100644
--- a/openssh-8.0p1-crypto-policies.patch
+++ b/openssh-8.0p1-crypto-policies.patch
@@ -92,7 +92,52 @@ diff --color -ru a/ssh_config.5 b/ssh_config.5
  .It Cm HashKnownHosts
  Indicates that
  .Xr ssh 1
-@@ -1219,29 +1216,25 @@
+@@ -913,36 +910,25 @@
+ but may be manually hashed using
+ .Xr ssh-keygen 1 .
+ .It Cm HostbasedAcceptedAlgorithms
++The default is handled system-wide by
++.Xr crypto-policies 7 .
++Information about defaults, how to modify the defaults and how to customize existing policies with sub-policies are present in manual page
++.Xr update-crypto-policies 8 .
++.Pp
+ Specifies the signature algorithms that will be used for hostbased
+ authentication as a comma-separated list of patterns.
+ Alternately if the specified list begins with a
+ .Sq +
+ character, then the specified signature algorithms will be appended
+-to the default set instead of replacing them.
++to the built-in openssh default set instead of replacing them.
+ If the specified list begins with a
+ .Sq -
+ character, then the specified signature algorithms (including wildcards)
+-will be removed from the default set instead of replacing them.
++will be removed from the built-in openssh default set instead of replacing them.
+ If the specified list begins with a
+ .Sq ^
+ character, then the specified signature algorithms will be placed
+-at the head of the default set.
+-The default for this option is:
+-.Bd -literal -offset 3n
+-ssh-ed25519-cert-v01@openssh.com,
+-ecdsa-sha2-nistp256-cert-v01@openssh.com,
+-ecdsa-sha2-nistp384-cert-v01@openssh.com,
+-ecdsa-sha2-nistp521-cert-v01@openssh.com,
+-sk-ssh-ed25519-cert-v01@openssh.com,
+-sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,
+-rsa-sha2-512-cert-v01@openssh.com,
+-rsa-sha2-256-cert-v01@openssh.com,
+-ssh-ed25519,
+-ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
+-sk-ssh-ed25519@openssh.com,
+-sk-ecdsa-sha2-nistp256@openssh.com,
+-rsa-sha2-512,rsa-sha2-256
+-.Ed
++at the head of the built-in openssh default set.
+ .Pp
+ The
+ .Fl Q
+@@ -1219,30 +1216,25 @@
  and
  .Cm pam .
  .It Cm KexAlgorithms
@@ -120,6 +165,7 @@ diff --color -ru a/ssh_config.5 b/ssh_config.5
 -default set.
 -The default is:
 -.Bd -literal -offset indent
+-sntrup761x25519-sha512@openssh.com,
 -curve25519-sha256,curve25519-sha256@libssh.org,
 -ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,
 -diffie-hellman-group-exchange-sha256,
@@ -224,6 +270,17 @@ diff --color -ru a/ssh_config.5 b/ssh_config.5
  .Pp
  The list of available signature algorithms may also be obtained using
  .Qq ssh -Q PubkeyAcceptedAlgorithms .
+@@ -2237,7 +2207,9 @@ for those users who do not have a config
+ This file must be world-readable.
+ .El
+ .Sh SEE ALSO
+-.Xr ssh 1
++.Xr ssh 1 ,
++.Xr crypto-policies 7 ,
++.Xr update-crypto-policies 8
+ .Sh AUTHORS
+ .An -nosplit
+ OpenSSH is a derivative of the original and free
 diff --color -ru a/sshd_config.5 b/sshd_config.5
 --- a/sshd_config.5	2022-07-12 15:05:22.535012771 +0200
 +++ b/sshd_config.5	2022-07-12 15:15:33.394809258 +0200
@@ -294,7 +351,7 @@ diff --color -ru a/sshd_config.5 b/sshd_config.5
  The list of available ciphers may also be obtained using
  .Qq ssh -Q cipher .
  .It Cm ClientAliveCountMax
-@@ -685,21 +679,22 @@
+@@ -685,53 +679,43 @@
  .Cm GSSAPIKeyExchange
  needs to be enabled in the server and also used by the client.
  .It Cm GSSAPIKexAlgorithms
@@ -326,8 +383,48 @@ diff --color -ru a/sshd_config.5 b/sshd_config.5
 -gss-curve25519-sha256-,gss-group14-sha1-,gss-gex-sha1- .
  This option only applies to connections using GSSAPI.
  .It Cm HostbasedAcceptedAlgorithms
++The default is handled system-wide by
++.Xr crypto-policies 7 .
++Information about defaults, how to modify the defaults and how to customize existing policies with sub-policies are present in manual page
++.Xr update-crypto-policies 8 .
++.Pp
  Specifies the signature algorithms that will be accepted for hostbased
-@@ -799,26 +794,13 @@
+ authentication as a list of comma-separated patterns.
+ Alternately if the specified list begins with a
+ .Sq +
+ character, then the specified signature algorithms will be appended to
+-the default set instead of replacing them.
++the built-in openssh default set instead of replacing them.
+ If the specified list begins with a
+ .Sq -
+ character, then the specified signature algorithms (including wildcards)
+-will be removed from the default set instead of replacing them.
++will be removed from the built-in openssh default set instead of replacing them.
+ If the specified list begins with a
+ .Sq ^
+ character, then the specified signature algorithms will be placed at
+-the head of the default set.
+-The default for this option is:
+-.Bd -literal -offset 3n
+-ssh-ed25519-cert-v01@openssh.com,
+-ecdsa-sha2-nistp256-cert-v01@openssh.com,
+-ecdsa-sha2-nistp384-cert-v01@openssh.com,
+-ecdsa-sha2-nistp521-cert-v01@openssh.com,
+-sk-ssh-ed25519-cert-v01@openssh.com,
+-sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,
+-rsa-sha2-512-cert-v01@openssh.com,
+-rsa-sha2-256-cert-v01@openssh.com,
+-ssh-ed25519,
+-ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
+-sk-ssh-ed25519@openssh.com,
+-sk-ecdsa-sha2-nistp256@openssh.com,
+-rsa-sha2-512,rsa-sha2-256
+-.Ed
++the head of the built-in openssh default set.
+ .Pp
+ The list of available signature algorithms may also be obtained using
+ .Qq ssh -Q HostbasedAcceptedAlgorithms .
+@@ -799,25 +794,14 @@
  .Ev SSH_AUTH_SOCK
  environment variable.
  .It Cm HostKeyAlgorithms
@@ -338,7 +435,7 @@ diff --color -ru a/sshd_config.5 b/sshd_config.5
 +.Pp
  Specifies the host key signature algorithms
  that the server offers.
--The default for this option is:
+ The default for this option is:
 -.Bd -literal -offset 3n
 -ssh-ed25519-cert-v01@openssh.com,
 -ecdsa-sha2-nistp256-cert-v01@openssh.com,
@@ -348,12 +445,11 @@ diff --color -ru a/sshd_config.5 b/sshd_config.5
 -sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,
 -rsa-sha2-512-cert-v01@openssh.com,
 -rsa-sha2-256-cert-v01@openssh.com,
--ssh-rsa-cert-v01@openssh.com,
 -ssh-ed25519,
 -ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
 -sk-ssh-ed25519@openssh.com,
 -sk-ecdsa-sha2-nistp256@openssh.com,
--rsa-sha2-512,rsa-sha2-256,ssh-rsa
+-rsa-sha2-512,rsa-sha2-256
 -.Ed
 -.Pp
  The list of available signature algorithms may also be obtained using
@@ -389,12 +485,13 @@ diff --color -ru a/sshd_config.5 b/sshd_config.5
  The supported algorithms are:
  .Pp
  .Bl -item -compact -offset indent
-@@ -1010,15 +997,6 @@
+@@ -1010,16 +997,6 @@
  sntrup761x25519-sha512@openssh.com
  .El
  .Pp
 -The default is:
 -.Bd -literal -offset indent
+-sntrup761x25519-sha512@openssh.com,
 -curve25519-sha256,curve25519-sha256@libssh.org,
 -ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,
 -diffie-hellman-group-exchange-sha256,
@@ -452,7 +549,7 @@ diff --color -ru a/sshd_config.5 b/sshd_config.5
  The list of available MAC algorithms may also be obtained using
  .Qq ssh -Q mac .
  .It Cm Match
-@@ -1548,37 +1522,25 @@
+@@ -1548,36 +1522,25 @@
  The default is
  .Cm yes .
  .It Cm PubkeyAcceptedAlgorithms
@@ -488,14 +585,24 @@ diff --color -ru a/sshd_config.5 b/sshd_config.5
 -sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,
 -rsa-sha2-512-cert-v01@openssh.com,
 -rsa-sha2-256-cert-v01@openssh.com,
--ssh-rsa-cert-v01@openssh.com,
 -ssh-ed25519,
 -ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
 -sk-ssh-ed25519@openssh.com,
 -sk-ecdsa-sha2-nistp256@openssh.com,
--rsa-sha2-512,rsa-sha2-256,ssh-rsa
+-rsa-sha2-512,rsa-sha2-256
 -.Ed
 +built-in openssh default set.
  .Pp
  The list of available signature algorithms may also be obtained using
  .Qq ssh -Q PubkeyAcceptedAlgorithms .
+@@ -2011,7 +1968,9 @@ This file should be writable by root onl
+ .El
+ .Sh SEE ALSO
+ .Xr sftp-server 8 ,
+-.Xr sshd 8
++.Xr sshd 8 ,
++.Xr crypto-policies 7 ,
++.Xr update-crypto-policies 8
+ .Sh AUTHORS
+ .An -nosplit
+ OpenSSH is a derivative of the original and free
diff --git a/openssh-8.0p1-gssapi-keyex.patch b/openssh-8.0p1-gssapi-keyex.patch
index e26bebdae03254946f6534bd8445d088bf1fdb5a..d5dfd7ed63e4af5567c8d5ab65415b25fba928fe 100644
--- a/openssh-8.0p1-gssapi-keyex.patch
+++ b/openssh-8.0p1-gssapi-keyex.patch
@@ -16,7 +16,7 @@ index e7549470..b68c1710 100644
  	monitor.o monitor_wrap.o auth-krb5.o \
 -	auth2-gss.o gss-serv.o gss-serv-krb5.o \
 +	auth2-gss.o gss-serv.o gss-serv-krb5.o kexgsss.o \
- 	loginrec.o auth-pam.o auth-shadow.o auth-sia.o md5crypt.o \
+ 	loginrec.o auth-pam.o auth-shadow.o auth-sia.o \
  	srclimit.o sftp-server.o sftp-common.o \
  	sandbox-null.o sandbox-rlimit.o sandbox-systrace.o sandbox-darwin.o \
 diff -up a/auth.c.gsskex b/auth.c
@@ -135,7 +135,7 @@ index 9351e042..d6446c0c 100644
 --- a/auth2-gss.c
 +++ b/auth2-gss.c
 @@ -1,7 +1,7 @@
- /* $OpenBSD: auth2-gss.c,v 1.32 2021/01/27 10:15:08 djm Exp $ */
+ /* $OpenBSD: auth2-gss.c,v 1.33 2021/12/19 22:12:07 djm Exp $ */
  
  /*
 - * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
@@ -224,7 +224,7 @@ index 9351e042..d6446c0c 100644
 +
  Authmethod method_gssapi = {
  	"gssapi-with-mic",
- 	userauth_gssapi,
+	NULL,
 diff --git a/auth2.c b/auth2.c
 index 0e776224..1c217268 100644
 --- a/auth2.c
@@ -375,8 +375,8 @@ index ebd0dbca..1bdac6a4 100644
 +#include "ssh-gss.h"
 +#endif
 +
- /* import options */
- extern Options options;
+ /* Permitted RSA signature algorithms for UpdateHostkeys proofs */
+ #define HOSTKEY_PROOF_RSA_ALGS	"rsa-sha2-512,rsa-sha2-256"
  
 @@ -1379,9 +1383,18 @@ client_loop(struct ssh *ssh, int have_pty, int escape_char_arg,
  			break;
@@ -384,7 +384,7 @@ index ebd0dbca..1bdac6a4 100644
  		/* Do channel operations unless rekeying in progress. */
 -		if (!ssh_packet_is_rekeying(ssh))
 +		if (!ssh_packet_is_rekeying(ssh)) {
- 			channel_after_select(ssh, readset, writeset);
+			channel_after_poll(ssh, pfd, npfd_active);
  
 +#ifdef GSSAPI
 +			if (options.gss_renewal_rekey &&
@@ -396,8 +396,8 @@ index ebd0dbca..1bdac6a4 100644
 +		}
 +
  		/* Buffer input from the connection.  */
- 		client_process_net_input(ssh, readset);
- 
+		if (conn_in_ready)
+			client_process_net_input(ssh);
 diff --git a/configure.ac b/configure.ac
 index b689db4b..efafb6bd 100644
 --- a/configure.ac
@@ -1370,9 +1370,9 @@ index ce85f043..574c7609 100644
 +#ifdef GSSAPI
 +	free(kex->gss_host);
 +#endif /* GSSAPI */
+	sshbuf_free(kex->initial_sig);
+	sshkey_free(kex->initial_hostkey);
  	free(kex->failed_choice);
- 	free(kex->hostkey_alg);
- 	free(kex->name);
 diff --git a/kex.h b/kex.h
 index a5ae6ac0..fe714141 100644
 --- a/kex.h
@@ -3011,7 +3011,7 @@ diff -up a/readconf.c.gsskex b/readconf.c
  	options->kbd_interactive_authentication = -1;
  	options->kbd_interactive_devices = NULL;
 @@ -2463,8 +2516,18 @@ fill_default_options(Options * options)
- 		options->pubkey_authentication = 1;
+ 		options->pubkey_authentication = SSH_PUBKEY_AUTH_ALL;
  	if (options->gss_authentication == -1)
  		options->gss_authentication = 0;
 +	if (options->gss_keyex == -1)
@@ -3886,7 +3886,7 @@ index 57995ee6..fd5b7724 100644
 --- a/sshkey.c
 +++ b/sshkey.c
 @@ -154,6 +154,7 @@ static const struct keytype keytypes[] = {
- 	    KEY_ECDSA_SK_CERT, NID_X9_62_prime256v1, 1, 0 },
+ #  endif /* ENABLE_SK */
  # endif /* OPENSSL_HAS_ECC */
  #endif /* WITH_OPENSSL */
 +	{ "null", "null", NULL, KEY_NULL, 0, 0, 0 },
diff --git a/openssh-8.0p1-openssl-evp.patch b/openssh-8.0p1-openssl-evp.patch
index 685070100310101bd81b33d1a016de67bd881b45..ade0bbb2118460071a8b8347c81363cbacd21bb3 100644
--- a/openssh-8.0p1-openssl-evp.patch
+++ b/openssh-8.0p1-openssl-evp.patch
@@ -1,5 +1,5 @@
 From ed7ec0cdf577ffbb0b15145340cf51596ca3eb89 Mon Sep 17 00:00:00 2001
-From: Jakub Jelen <jjelen@rt.com>
+From: Jakub Jelen <jjelen@redhat.com>
 Date: Tue, 14 May 2019 10:45:45 +0200
 Subject: [PATCH] Use high-level OpenSSL API for signatures
 
diff --git a/openssh-8.0p1-openssl-kdf.patch b/openssh-8.0p1-openssl-kdf.patch
index 6776d9ab782b4761d261df3f38fc4ae119c6c6b7..5d76a4f97f58261c0fec698e515f2d5be930d01b 100644
--- a/openssh-8.0p1-openssl-kdf.patch
+++ b/openssh-8.0p1-openssl-kdf.patch
@@ -1,5 +1,5 @@
 commit 2c3ef499bfffce3cfd315edeebf202850ba4e00a
-Author: Jakub Jelen <jjelen@rt.com>
+Author: Jakub Jelen <jjelen@redhat.com>
 Date:   Tue Apr 16 15:35:18 2019 +0200
 
     Use the new OpenSSL KDF
diff --git a/openssh-8.0p1-pkcs11-uri.patch b/openssh-8.0p1-pkcs11-uri.patch
index 48e0b35d09bf69fb88b983ba0b625c3feafa9e65..b3295a95acafe74fcc508c1f32176d7fb5d1c22e 100644
--- a/openssh-8.0p1-pkcs11-uri.patch
+++ b/openssh-8.0p1-pkcs11-uri.patch
@@ -92,9 +92,9 @@ diff -up openssh-8.7p1/Makefile.in.pkcs11-uri openssh-8.7p1/Makefile.in
  	rm -f regress/unittests/utf8/test_utf8
 +	rm -f regress/unittests/pkcs11/*.o
 +	rm -f regress/unittests/pkcs11/test_pkcs11
- 	(cd openbsd-compat && $(MAKE) distclean)
- 	if test -d pkg ; then \
- 		rm -fr pkg ; \
+	rm -f regress/misc/sk-dummy/*.o
+	rm -f regress/misc/sk-dummy/*.lo
+	rm -f regress/misc/sk-dummy/sk-dummy.so
 @@ -513,6 +517,7 @@ regress-prep:
  	$(MKDIR_P) `pwd`/regress/unittests/sshkey
  	$(MKDIR_P) `pwd`/regress/unittests/sshsig
@@ -172,9 +172,9 @@ diff -up openssh-8.7p1/regress/pkcs11.sh.pkcs11-uri openssh-8.7p1/regress/pkcs11
 +++ openssh-8.7p1/regress/pkcs11.sh	2021-08-30 13:07:43.663700096 +0200
 @@ -0,0 +1,349 @@
 +#
-+#  Copyright (c) 2017 R H
++#  Copyright (c) 2017 Red Hat
 +#
-+#  Authors: Jakub Jelen <jjelen@rt.com>
++#  Authors: Jakub Jelen <jjelen@redhat.com>
 +#
 +#  Permission to use, copy, modify, and distribute this software for any
 +#  purpose with or without fee is hereby granted, provided that the above
@@ -536,9 +536,9 @@ diff -up openssh-8.7p1/regress/unittests/pkcs11/tests.c.pkcs11-uri openssh-8.7p1
 +++ openssh-8.7p1/regress/unittests/pkcs11/tests.c	2021-08-30 13:07:43.664700104 +0200
 @@ -0,0 +1,337 @@
 +/*
-+ * Copyright (c) 2017 R H
++ * Copyright (c) 2017 Red Hat
 + *
-+ * Authors: Jakub Jelen <jjelen@rt.com>
++ * Authors: Jakub Jelen <jjelen@redhat.com>
 + *
 + * Permission to use, copy, modify, and distribute this software for any
 + * purpose with or without fee is hereby granted, provided that the above
@@ -876,22 +876,23 @@ diff -up openssh-8.7p1/ssh-add.c.pkcs11-uri openssh-8.7p1/ssh-add.c
 --- openssh-8.7p1/ssh-add.c.pkcs11-uri	2021-08-20 06:03:49.000000000 +0200
 +++ openssh-8.7p1/ssh-add.c	2021-08-30 13:07:43.664700104 +0200
 @@ -68,6 +68,7 @@
- #include "digest.h"
  #include "ssh-sk.h"
  #include "sk-api.h"
+ #include "hostfile.h"
 +#include "ssh-pkcs11-uri.h"
  
  /* argv0 */
  extern char *__progname;
-@@ -229,6 +230,32 @@ delete_all(int agent_fd, int qflag)
+@@ -229,6 +230,34 @@ delete_all(int agent_fd, int qflag)
  	return ret;
  }
  
 +#ifdef ENABLE_PKCS11
-+static int update_card(int, int, const char *, int, char *);
++static int update_card(int, int, const char *, int, struct dest_constraint **, size_t, char *);
 +
 +int
-+update_pkcs11_uri(int agent_fd, int adding, const char *pkcs11_uri, int qflag)
++update_pkcs11_uri(int agent_fd, int adding, const char *pkcs11_uri, int qflag,
++    struct dest_constraint **dest_constraints, size_t ndest_constraints)
 +{
 +	char *pin = NULL;
 +	struct pkcs11_uri *uri;
@@ -909,19 +910,20 @@ diff -up openssh-8.7p1/ssh-add.c.pkcs11-uri openssh-8.7p1/ssh-add.c
 +	}
 +	pkcs11_uri_cleanup(uri);
 +
-+	return update_card(agent_fd, adding, pkcs11_uri, qflag, pin);
++	return update_card(agent_fd, adding, pkcs11_uri, qflag, 
++	           dest_constraints, ndest_constraints, pin);
 +}
 +#endif
 +
  static int
  add_file(int agent_fd, const char *filename, int key_only, int qflag,
-     const char *skprovider)
+     const char *skprovider, struct dest_constraint **dest_constraints,
 @@ -445,12 +472,11 @@ add_file(int agent_fd, const char *filen
- }
  
  static int
--update_card(int agent_fd, int add, const char *id, int qflag)
-+update_card(int agent_fd, int add, const char *id, int qflag, char *pin)
+ update_card(int agent_fd, int add, const char *id, int qflag,
+-    struct dest_constraint **dest_constraints, size_t ndest_constraints)
++    struct dest_constraint **dest_constraints, size_t ndest_constraints, char *pin)
  {
 -	char *pin = NULL;
  	int r, ret = -1;
@@ -931,15 +933,16 @@ diff -up openssh-8.7p1/ssh-add.c.pkcs11-uri openssh-8.7p1/ssh-add.c
  		if ((pin = read_passphrase("Enter passphrase for PKCS#11: ",
  		    RP_ALLOW_STDIN)) == NULL)
  			return -1;
-@@ -630,6 +656,13 @@ static int
- do_file(int agent_fd, int deleting, int key_only, char *file, int qflag,
-     const char *skprovider)
+@@ -630,6 +656,14 @@ static int
+     const char *skprovider, struct dest_constraint **dest_constraints,
+     size_t ndest_constraints)
  {
 +#ifdef ENABLE_PKCS11
 +	if (strlen(file) >= strlen(PKCS11_URI_SCHEME) &&
 +	    strncmp(file, PKCS11_URI_SCHEME,
 +	    strlen(PKCS11_URI_SCHEME)) == 0) {
-+		return update_pkcs11_uri(agent_fd, !deleting, file, qflag);
++		return update_pkcs11_uri(agent_fd, !deleting, file, qflag,
++                   dest_constraints, ndest_constraints);
 +	}
 +#endif
  	if (deleting) {
@@ -949,8 +952,8 @@ diff -up openssh-8.7p1/ssh-add.c.pkcs11-uri openssh-8.7p1/ssh-add.c
  	}
  	if (pkcs11provider != NULL) {
  		if (update_card(agent_fd, !deleting, pkcs11provider,
--		    qflag) == -1)
-+		    qflag, NULL) == -1)
+-		    qflag, dest_constraints, ndest_constraints) == -1)
++		    qflag, dest_constraints, ndest_constraints, NULL) == -1)
  			ret = 1;
  		goto done;
  	}
@@ -1080,7 +1083,7 @@ diff -up openssh-8.7p1/ssh-agent.c.pkcs11-uri openssh-8.7p1/ssh-agent.c
 +	free(sane_uri);
  	free(keys);
  	free(comments);
- 	send_status(e, success);
+	free_dest_constraints(dest_constraints, ndest_constraints);
 @@ -918,7 +976,7 @@ send:
  static void
  process_remove_smartcard_key(SocketEntry *e)
@@ -1544,7 +1547,7 @@ diff -up openssh-8.7p1/ssh-pkcs11.c.pkcs11-uri openssh-8.7p1/ssh-pkcs11.c
  static RSA_METHOD *rsa_method;
 @@ -195,6 +286,55 @@ static EC_KEY_METHOD *ec_key_method;
  static int ec_key_idx = 0;
- #endif
+ #endif /* OPENSSL_HAS_ECC && HAVE_EC_KEY_METHOD_NEW */
  
 +/*
 + * This can't be in the ssh-pkcs11-uri, becase we can not depend on
@@ -1739,9 +1742,9 @@ diff -up openssh-8.7p1/ssh-pkcs11.c.pkcs11-uri openssh-8.7p1/ssh-pkcs11.c
  	struct pkcs11_key	*k11;
  
 @@ -614,6 +764,12 @@ pkcs11_ecdsa_wrap(struct pkcs11_provider
- 	k11->keyid = xmalloc(k11->keyid_len);
- 	memcpy(k11->keyid, keyid_attrib->pValue, k11->keyid_len);
- 
+ 		k11->keyid = xmalloc(k11->keyid_len);
+ 		memcpy(k11->keyid, keyid_attrib->pValue, k11->keyid_len);
+	}
 +	if (label_attrib->ulValueLen > 0 ) {
 +		k11->label = xmalloc(label_attrib->ulValueLen+1);
 +		memcpy(k11->label, label_attrib->pValue, label_attrib->ulValueLen);
@@ -2590,9 +2593,9 @@ diff -up openssh-8.7p1/ssh-pkcs11-uri.c.pkcs11-uri openssh-8.7p1/ssh-pkcs11-uri.
 +++ openssh-8.7p1/ssh-pkcs11-uri.c	2021-08-30 13:07:43.667700130 +0200
 @@ -0,0 +1,419 @@
 +/*
-+ * Copyright (c) 2017 R H
++ * Copyright (c) 2017 Red Hat
 + *
-+ * Authors: Jakub Jelen <jjelen@rt.com>
++ * Authors: Jakub Jelen <jjelen@redhat.com>
 + *
 + * Permission to use, copy, modify, and distribute this software for any
 + * purpose with or without fee is hereby granted, provided that the above
@@ -3013,9 +3016,9 @@ diff -up openssh-8.7p1/ssh-pkcs11-uri.h.pkcs11-uri openssh-8.7p1/ssh-pkcs11-uri.
 +++ openssh-8.7p1/ssh-pkcs11-uri.h	2021-08-30 13:07:43.667700130 +0200
 @@ -0,0 +1,42 @@
 +/*
-+ * Copyright (c) 2017 R H
++ * Copyright (c) 2017 Red Hat
 + *
-+ * Authors: Jakub Jelen <jjelen@rt.com>
++ * Authors: Jakub Jelen <jjelen@redhat.com>
 + *
 + * Permission to use, copy, modify, and distribute this software for any
 + * purpose with or without fee is hereby granted, provided that the above
diff --git a/openssh-8.7p1-host-based-auth.patch b/openssh-8.7p1-host-based-auth.patch
deleted file mode 100644
index 23efe915eb60669668ecdfba8906275de4670d43..0000000000000000000000000000000000000000
--- a/openssh-8.7p1-host-based-auth.patch
+++ /dev/null
@@ -1,151 +0,0 @@
-diff --color -rup a/sshconnect2.c b/sshconnect2.c
---- a/sshconnect2.c	2022-07-11 17:00:02.618575727 +0200
-+++ b/sshconnect2.c	2022-07-11 17:03:05.096085690 +0200
-@@ -2288,9 +2288,9 @@ userauth_hostbased(struct ssh *ssh)
- 			if (authctxt->sensitive->keys[i] == NULL ||
- 			    authctxt->sensitive->keys[i]->type == KEY_UNSPEC)
- 				continue;
--			if (match_pattern_list(
-+			if (!sshkey_match_keyname_to_sigalgs(
- 			    sshkey_ssh_name(authctxt->sensitive->keys[i]),
--			    authctxt->active_ktype, 0) != 1)
-+			    authctxt->active_ktype))
- 				continue;
- 			/* we take and free the key */
- 			private = authctxt->sensitive->keys[i];
-@@ -2316,7 +2316,8 @@ userauth_hostbased(struct ssh *ssh)
- 		error_f("sshkey_fingerprint failed");
- 		goto out;
- 	}
--	debug_f("trying hostkey %s %s", sshkey_ssh_name(private), fp);
-+	debug_f("trying hostkey %s %s using sigalg %s",
-+		sshkey_ssh_name(private), fp, authctxt->active_ktype);
- 
- 	/* figure out a name for the client host */
- 	lname = get_local_name(ssh_packet_get_connection_in(ssh));
-diff --color -rup a/sshkey.c b/sshkey.c
---- a/sshkey.c	2022-07-11 17:00:02.609575554 +0200
-+++ b/sshkey.c	2022-07-11 17:12:30.905976443 +0200
-@@ -252,6 +252,29 @@ sshkey_ecdsa_nid_from_name(const char *n
- 	return -1;
- }
- 
-+int
-+sshkey_match_keyname_to_sigalgs(const char *keyname, const char *sigalgs)
-+{
-+	int ktype;
-+
-+	if (sigalgs == NULL || *sigalgs == '\0' ||
-+	    (ktype = sshkey_type_from_name(keyname)) == KEY_UNSPEC)
-+		return 0;
-+	else if (ktype == KEY_RSA) {
-+		return match_pattern_list("ssh-rsa", sigalgs, 0) == 1 ||
-+		    match_pattern_list("rsa-sha2-256", sigalgs, 0) == 1 ||
-+		    match_pattern_list("rsa-sha2-512", sigalgs, 0) == 1;
-+	} else if (ktype == KEY_RSA_CERT) {
-+		return match_pattern_list("ssh-rsa-cert-v01@openssh.com",
-+		    sigalgs, 0) == 1 ||
-+		    match_pattern_list("rsa-sha2-256-cert-v01@openssh.com",
-+		    sigalgs, 0) == 1 ||
-+		    match_pattern_list("rsa-sha2-512-cert-v01@openssh.com",
-+		    sigalgs, 0) == 1;
-+	} else
-+		return match_pattern_list(keyname, sigalgs, 0) == 1;
-+}
-+
- char *
- sshkey_alg_list(int certs_only, int plain_only, int include_sigonly, char sep)
- {
-diff --color -rup a/sshkey.h b/sshkey.h
---- a/sshkey.h	2022-07-11 17:00:02.603575438 +0200
-+++ b/sshkey.h	2022-07-11 17:13:01.052556879 +0200
-@@ -194,6 +194,10 @@ int	 sshkey_is_cert(const struct sshkey
- int	 sshkey_is_sk(const struct sshkey *);
- int	 sshkey_type_is_cert(int);
- int	 sshkey_type_plain(int);
-+
-+/* Returns non-zero if key name match sigalgs pattern list. (handles RSA) */
-+int	 sshkey_match_keyname_to_sigalgs(const char *, const char *);
-+
- int	 sshkey_to_certified(struct sshkey *);
- int	 sshkey_drop_cert(struct sshkey *);
- int	 sshkey_cert_copy(const struct sshkey *, struct sshkey *);
-diff --color -rup a/ssh-keysign.c b/ssh-keysign.c
---- a/ssh-keysign.c	2021-08-20 06:03:49.000000000 +0200
-+++ b/ssh-keysign.c	2022-07-11 17:00:23.306973667 +0200
-@@ -62,7 +62,7 @@
- extern char *__progname;
- 
- static int
--valid_request(struct passwd *pw, char *host, struct sshkey **ret,
-+valid_request(struct passwd *pw, char *host, struct sshkey **ret, char **pkalgp,
-     u_char *data, size_t datalen)
- {
- 	struct sshbuf *b;
-@@ -75,6 +75,8 @@ valid_request(struct passwd *pw, char *h
- 
- 	if (ret != NULL)
- 		*ret = NULL;
-+	if (pkalgp != NULL)
-+		*pkalgp = NULL;
- 	fail = 0;
- 
- 	if ((b = sshbuf_from(data, datalen)) == NULL)
-@@ -122,8 +124,6 @@ valid_request(struct passwd *pw, char *h
- 		fail++;
- 	} else if (key->type != pktype)
- 		fail++;
--	free(pkalg);
--	free(pkblob);
- 
- 	/* client host name, handle trailing dot */
- 	if ((r = sshbuf_get_cstring(b, &p, &len)) != 0)
-@@ -154,8 +154,19 @@ valid_request(struct passwd *pw, char *h
- 
- 	if (fail)
- 		sshkey_free(key);
--	else if (ret != NULL)
--		*ret = key;
-+	else {
-+		if (ret != NULL) {
-+			*ret = key;
-+			key = NULL;
-+		}
-+		if (pkalgp != NULL) {
-+			*pkalgp = pkalg;
-+			pkalg = NULL;
-+		}
-+	}
-+	sshkey_free(key);
-+	free(pkalg);
-+	free(pkblob);
- 
- 	return (fail ? -1 : 0);
- }
-@@ -170,7 +181,7 @@ main(int argc, char **argv)
- 	struct passwd *pw;
- 	int r, key_fd[NUM_KEYTYPES], i, found, version = 2, fd;
- 	u_char *signature, *data, rver;
--	char *host, *fp;
-+	char *host, *fp, *pkalg;
- 	size_t slen, dlen;
- 
- 	if (pledge("stdio rpath getpw dns id", NULL) != 0)
-@@ -258,7 +269,7 @@ main(int argc, char **argv)
- 
- 	if ((r = sshbuf_get_string(b, &data, &dlen)) != 0)
- 		fatal_r(r, "%s: buffer error", __progname);
--	if (valid_request(pw, host, &key, data, dlen) < 0)
-+	if (valid_request(pw, host, &key, &pkalg, data, dlen) < 0)
- 		fatal("%s: not a valid request", __progname);
- 	free(host);
- 
-@@ -279,7 +290,7 @@ main(int argc, char **argv)
- 	}
- 
- 	if ((r = sshkey_sign(keys[i], &signature, &slen, data, dlen,
--	    NULL, NULL, NULL, 0)) != 0)
-+	    pkalg, NULL, NULL, 0)) != 0)
- 		fatal_r(r, "%s: sshkey_sign failed", __progname);
- 	free(data);
- 
diff --git a/openssh-8.7p1-ibmca.patch b/openssh-8.7p1-ibmca.patch
index c9c12eee54304a42696b3868884eff3028696d4d..88914bff1c860f1cbb2b88d5c872d5afa72c6a89 100644
--- a/openssh-8.7p1-ibmca.patch
+++ b/openssh-8.7p1-ibmca.patch
@@ -4,9 +4,8 @@
  
  #include "includes.h"
  
--#ifndef HAVE_CLOSEFROM
-+#if (!defined HAVE_CLOSEFROM) || (defined __s390__)
+-#if !defined(HAVE_CLOSEFROM) || defined(BROKEN_CLOSEFROM)
++#if !defined(HAVE_CLOSEFROM) || defined(BROKEN_CLOSEFROM) || (defined __s390__)
  
  #include <sys/types.h>
- #include <sys/param.h>
-
+ #include <unistd.h>
diff --git a/openssh-8.7p1-minimize-sha1-use.patch b/openssh-8.7p1-minimize-sha1-use.patch
deleted file mode 100644
index fc517da82994385a3a5aa1e30d7b2a97e5d6a852..0000000000000000000000000000000000000000
--- a/openssh-8.7p1-minimize-sha1-use.patch
+++ /dev/null
@@ -1,207 +0,0 @@
-diff --color -ru a/clientloop.c b/clientloop.c
---- a/clientloop.c	2022-06-29 16:35:06.677597259 +0200
-+++ b/clientloop.c	2022-06-29 16:40:29.737926205 +0200
-@@ -116,6 +116,9 @@
- #include "ssh-gss.h"
- #endif
- 
-+/* Permitted RSA signature algorithms for UpdateHostkeys proofs */
-+#define HOSTKEY_PROOF_RSA_ALGS	"rsa-sha2-512,rsa-sha2-256"
-+
- /* import options */
- extern Options options;
- 
-@@ -2110,8 +2113,10 @@
- 	struct hostkeys_update_ctx *ctx = (struct hostkeys_update_ctx *)_ctx;
- 	size_t i, ndone;
- 	struct sshbuf *signdata;
--	int r, kexsigtype, use_kexsigtype;
-+	int r, plaintype;
- 	const u_char *sig;
-+	const char *rsa_kexalg = NULL;
-+	char *alg = NULL;
- 	size_t siglen;
- 
- 	if (ctx->nnew == 0)
-@@ -2122,9 +2127,9 @@
- 		hostkeys_update_ctx_free(ctx);
- 		return;
- 	}
--	kexsigtype = sshkey_type_plain(
--	    sshkey_type_from_name(ssh->kex->hostkey_alg));
--
-+	if (sshkey_type_plain(sshkey_type_from_name(
-+	    ssh->kex->hostkey_alg)) == KEY_RSA)
-+		rsa_kexalg = ssh->kex->hostkey_alg;
- 	if ((signdata = sshbuf_new()) == NULL)
- 		fatal_f("sshbuf_new failed");
- 	/*
-@@ -2135,6 +2140,7 @@
- 	for (ndone = i = 0; i < ctx->nkeys; i++) {
- 		if (ctx->keys_match[i])
- 			continue;
-+		plaintype = sshkey_type_plain(ctx->keys[i]->type);
- 		/* Prepare data to be signed: session ID, unique string, key */
- 		sshbuf_reset(signdata);
- 		if ( (r = sshbuf_put_cstring(signdata,
-@@ -2148,19 +2154,33 @@
- 			error_fr(r, "parse sig");
- 			goto out;
- 		}
-+		if ((r = sshkey_get_sigtype(sig, siglen, &alg)) != 0) {
-+			error_fr(r, "server gave unintelligible signature "
-+				"for %s key %zu", sshkey_type(ctx->keys[i]), i);
-+			goto out;
-+		}
- 		/*
--		 * For RSA keys, prefer to use the signature type negotiated
--		 * during KEX to the default (SHA1).
-+		 * Special case for RSA keys: if a RSA hostkey was negotiated,
-+		 * then use its signature type for verification of RSA hostkey
-+		 * proofs. Otherwise, accept only RSA-SHA256/512 signatures.
- 		 */
--		use_kexsigtype = kexsigtype == KEY_RSA &&
--		    sshkey_type_plain(ctx->keys[i]->type) == KEY_RSA;
--		debug3_f("verify %s key %zu using %s sigalg",
--		    sshkey_type(ctx->keys[i]), i,
--		    use_kexsigtype ? ssh->kex->hostkey_alg : "default");
-+		if (plaintype == KEY_RSA && rsa_kexalg == NULL &&
-+		    match_pattern_list(alg, HOSTKEY_PROOF_RSA_ALGS, 0) != 1) {
-+			debug_f("server used untrusted RSA signature algorithm "
-+				"%s for key %zu, disregarding", alg, i);
-+			free(alg);
-+			/* zap the key from the list */
-+			sshkey_free(ctx->keys[i]);
-+			ctx->keys[i] = NULL;
-+			ndone++;
-+			continue;
-+		}
-+		debug3_f("verify %s key %zu using sigalg %s",
-+			sshkey_type(ctx->keys[i]), i, alg);
-+		free(alg);
- 		if ((r = sshkey_verify(ctx->keys[i], sig, siglen,
- 		    sshbuf_ptr(signdata), sshbuf_len(signdata),
--		    use_kexsigtype ? ssh->kex->hostkey_alg : NULL, 0,
--		    NULL)) != 0) {
-+		    plaintype == KEY_RSA ? rsa_kexalg : NULL, 0, NULL)) != 0) {
- 			error_fr(r, "server gave bad signature for %s key %zu",
- 			    sshkey_type(ctx->keys[i]), i);
- 			goto out;
-diff --git a/hostfile.c b/hostfile.c
-index a035b381..bd49e3ac 100644
---- a/hostfile.c
-+++ b/hostfile.c
-@@ -642,7 +642,7 @@ hostfile_replace_entries(const char *filename, const char *host, const char *ip,
- 	/* Re-add the requested keys */
- 	want = HKF_MATCH_HOST | (ip == NULL ? 0 : HKF_MATCH_IP);
- 	for (i = 0; i < nkeys; i++) {
--		if ((want & ctx.match_keys[i]) == want)
-+		if (keys[i] == NULL || (want & ctx.match_keys[i]) == want)
- 			continue;
- 		if ((fp = sshkey_fingerprint(keys[i], hash_alg,
- 		    SSH_FP_DEFAULT)) == NULL) {
-diff --color -ru a/kex.c b/kex.c
---- a/kex.c	2022-06-29 16:35:06.775599179 +0200
-+++ b/kex.c	2022-06-29 16:42:00.839710940 +0200
-@@ -959,6 +959,18 @@
- 	return (1);
- }
- 
-+/* returns non-zero if proposal contains any algorithm from algs */
-+static int
-+has_any_alg(const char *proposal, const char *algs)
-+{
-+	char *cp;
-+
-+	if ((cp = match_list(proposal, algs, NULL)) == NULL)
-+		return 0;
-+	free(cp);
-+	return 1;
-+}
-+
- static int
- kex_choose_conf(struct ssh *ssh)
- {
-@@ -994,6 +1006,16 @@
- 		free(ext);
- 	}
- 
-+	/* Check whether client supports rsa-sha2 algorithms */
-+	if (kex->server && (kex->flags & KEX_INITIAL)) {
-+		if (has_any_alg(peer[PROPOSAL_SERVER_HOST_KEY_ALGS],
-+		    "rsa-sha2-256,rsa-sha2-256-cert-v01@openssh.com"))
-+			kex->flags |= KEX_RSA_SHA2_256_SUPPORTED;
-+		if (has_any_alg(peer[PROPOSAL_SERVER_HOST_KEY_ALGS],
-+		    "rsa-sha2-512,rsa-sha2-512-cert-v01@openssh.com"))
-+			kex->flags |= KEX_RSA_SHA2_512_SUPPORTED;
-+	}
-+
- 	/* Algorithm Negotiation */
- 	if ((r = choose_kex(kex, cprop[PROPOSAL_KEX_ALGS],
- 	    sprop[PROPOSAL_KEX_ALGS])) != 0) {
-diff --color -ru a/kex.h b/kex.h
---- a/kex.h	2022-06-29 16:35:06.766599003 +0200
-+++ b/kex.h	2022-06-29 16:42:24.199168567 +0200
-@@ -116,6 +116,8 @@
- 
- #define KEX_INIT_SENT	0x0001
- #define KEX_INITIAL	0x0002
-+#define KEX_RSA_SHA2_256_SUPPORTED      0x0008 /* only set in server for now */
-+#define KEX_RSA_SHA2_512_SUPPORTED      0x0010 /* only set in server for now */
- 
- struct sshenc {
- 	char	*name;
-diff --color -ru a/serverloop.c b/serverloop.c
---- a/serverloop.c	2021-08-20 06:03:49.000000000 +0200
-+++ b/serverloop.c	2022-06-29 16:45:05.902336428 +0200
-@@ -684,16 +684,18 @@
- 	struct sshbuf *resp = NULL;
- 	struct sshbuf *sigbuf = NULL;
- 	struct sshkey *key = NULL, *key_pub = NULL, *key_prv = NULL;
--	int r, ndx, kexsigtype, use_kexsigtype, success = 0;
-+	int r, ndx, success = 0;
- 	const u_char *blob;
-+	const char *sigalg, *kex_rsa_sigalg = NULL;
- 	u_char *sig = 0;
- 	size_t blen, slen;
- 
- 	if ((resp = sshbuf_new()) == NULL || (sigbuf = sshbuf_new()) == NULL)
- 		fatal_f("sshbuf_new");
- 
--	kexsigtype = sshkey_type_plain(
--	    sshkey_type_from_name(ssh->kex->hostkey_alg));
-+	if (sshkey_type_plain(sshkey_type_from_name(
-+	    ssh->kex->hostkey_alg)) == KEY_RSA)
-+		kex_rsa_sigalg = ssh->kex->hostkey_alg;
- 	while (ssh_packet_remaining(ssh) > 0) {
- 		sshkey_free(key);
- 		key = NULL;
-@@ -726,16 +728,24 @@
- 		 * For RSA keys, prefer to use the signature type negotiated
- 		 * during KEX to the default (SHA1).
- 		 */
--		use_kexsigtype = kexsigtype == KEY_RSA &&
--		    sshkey_type_plain(key->type) == KEY_RSA;
-+		sigalg = NULL;
-+		if (sshkey_type_plain(key->type) == KEY_RSA) {
-+			if (kex_rsa_sigalg != NULL)
-+				sigalg = kex_rsa_sigalg;
-+			else if (ssh->kex->flags & KEX_RSA_SHA2_512_SUPPORTED)
-+				sigalg = "rsa-sha2-512";
-+			else if (ssh->kex->flags & KEX_RSA_SHA2_256_SUPPORTED)
-+				sigalg = "rsa-sha2-256";
-+		}
-+		debug3_f("sign %s key (index %d) using sigalg %s",
-+		sshkey_type(key), ndx, sigalg == NULL ? "default" : sigalg);
- 		if ((r = sshbuf_put_cstring(sigbuf,
- 		    "hostkeys-prove-00@openssh.com")) != 0 ||
- 		    (r = sshbuf_put_stringb(sigbuf,
- 		    ssh->kex->session_id)) != 0 ||
- 		    (r = sshkey_puts(key, sigbuf)) != 0 ||
- 		    (r = ssh->kex->sign(ssh, key_prv, key_pub, &sig, &slen,
--		    sshbuf_ptr(sigbuf), sshbuf_len(sigbuf),
--		    use_kexsigtype ? ssh->kex->hostkey_alg : NULL)) != 0 ||
-+		    sshbuf_ptr(sigbuf), sshbuf_len(sigbuf), sigalg)) != 0 ||
- 		    (r = sshbuf_put_string(resp, sig, slen)) != 0) {
- 			error_fr(r, "assemble signature");
- 			goto out;
diff --git a/openssh-8.7p1-minrsabits.patch b/openssh-8.7p1-minrsabits.patch
index b53c3837ace3e1f7347ed160b842089aede3d16e..ad91fe779c099b20161a903f8e442641bf4f70f4 100644
--- a/openssh-8.7p1-minrsabits.patch
+++ b/openssh-8.7p1-minrsabits.patch
@@ -214,9 +214,9 @@ index 559bf2af..25be53d5 100644
  	check_load(sshkey_load_public(p, &(sensitive_data.keys[o]), NULL), \
 -	    p, "pubkey"); \
 +	    &(sensitive_data.keys[o]), p, "pubkey"); \
- } while (0)
- #define L_CERT(p,o) do { \
- 	if ((o) >= sensitive_data.nkeys) \
+ 	if (sensitive_data.keys[o] != NULL) \
+ 		debug2("hostbased key %d: %s key from \"%s\"", o, \
+ 		    sshkey_ssh_name(sensitive_data.keys[o]), p); \
 @@ -1586,7 +1594,8 @@ main(int ac, char **av)
  #define L_CERT(p,o) do { \
  	if ((o) >= sensitive_data.nkeys) \
@@ -224,10 +224,10 @@ index 559bf2af..25be53d5 100644
 -	check_load(sshkey_load_cert(p, &(sensitive_data.keys[o])), p, "cert"); \
 +	check_load(sshkey_load_cert(p, &(sensitive_data.keys[o])), \
 +	    &(sensitive_data.keys[o]), p, "cert"); \
- } while (0)
- 
- 		if (options.hostbased_authentication == 1) {
-@@ -2244,7 +2253,7 @@ load_public_identity_files(const struct ssh_conn_info *cinfo)
+ 	if (sensitive_data.keys[o] != NULL) \
+ 		debug2("hostbased key %d: %s cert from \"%s\"", o, \
+ 		    sshkey_ssh_name(sensitive_data.keys[o]), p); \
+@@ -2265,7 +2274,7 @@ load_public_identity_files(const struct ssh_conn_info *cinfo)
  		filename = default_client_percent_dollar_expand(cp, cinfo);
  		free(cp);
  		check_load(sshkey_load_public(filename, &public, NULL),
@@ -285,8 +285,8 @@ index f9bd19ea..58fe98db 100644
  		    !(id->key && id->isprivate))
  			maybe_add_key_to_agent(id->filename, private, comment,
 @@ -1752,6 +1764,12 @@ pubkey_prepare(struct ssh *ssh, Authctxt *authctxt)
-		close(agent_fd);
-	} else {
+ 	/* list of keys supported by the agent */
+ 	if ((r = get_agent_identities(ssh, &agent_fd, &idlist)) == 0) {
  		for (j = 0; j < idlist->nkeys; j++) {
 +			if ((r = sshkey_check_rsa_length(idlist->keys[j],
 +			    options.required_rsa_size)) != 0) {
diff --git a/openssh-8.7p1-negotiate-supported-algs.patch b/openssh-8.7p1-negotiate-supported-algs.patch
index 2fb92970b9b454d14c149aa28d13c4852950152e..260ddb817beac4daadf63098fc9eb4ffec2ff5b8 100644
--- a/openssh-8.7p1-negotiate-supported-algs.patch
+++ b/openssh-8.7p1-negotiate-supported-algs.patch
@@ -2,8 +2,8 @@ diff --color -rup a/regress/hostkey-agent.sh b/regress/hostkey-agent.sh
 --- a/regress/hostkey-agent.sh	2021-08-20 06:03:49.000000000 +0200
 +++ b/regress/hostkey-agent.sh	2022-07-14 11:58:12.172786060 +0200
 @@ -13,8 +13,12 @@ r=$?
- grep -vi 'hostkey' $OBJ/sshd_proxy > $OBJ/sshd_proxy.orig
- echo "HostKeyAgent $SSH_AUTH_SOCK" >> $OBJ/sshd_proxy.orig
+ 
+ ${SSHKEYGEN} -qt ed25519 -f $OBJ/agent-ca -N '' || fatal "ssh-keygen CA"
  
 +PUBKEY_ACCEPTED_ALGOS=`$SSH -G "example.com" | \
 +    grep -i "PubkeyAcceptedAlgorithms" | cut -d ' ' -f2- | tr "," "|"`
@@ -12,18 +12,18 @@ diff --color -rup a/regress/hostkey-agent.sh b/regress/hostkey-agent.sh
  trace "load hostkeys"
 -for k in $SSH_KEYTYPES ; do
 +for k in $SSH_ACCEPTED_KEYTYPES ; do
- 	${SSHKEYGEN} -qt $k -f $OBJ/agent-key.$k -N '' || fatal "ssh-keygen $k"
- 	(
- 		printf 'localhost-with-alias,127.0.0.1,::1 '
+	${SSHKEYGEN} -qt $k -f $OBJ/agent-key.$k -N '' || fatal "ssh-keygen $k"
+	${SSHKEYGEN} -s $OBJ/agent-ca -qh -n localhost-with-alias \
+		-I localhost-with-alias $OBJ/agent-key.$k.pub || \
 @@ -31,7 +35,7 @@ cp $OBJ/known_hosts.orig $OBJ/known_host
+ 
  unset SSH_AUTH_SOCK
  
- for ps in yes; do
--	for k in $SSH_KEYTYPES ; do
-+	for k in $SSH_ACCEPTED_KEYTYPES ; do
- 		verbose "key type $k privsep=$ps"
- 		cp $OBJ/sshd_proxy.orig $OBJ/sshd_proxy
- 		echo "UsePrivilegeSeparation $ps" >> $OBJ/sshd_proxy
+-for k in $SSH_KEYTYPES ; do
++for k in $SSH_ACCEPTED_KEYTYPES ; do
+	verbose "key type $k"
+	cp $OBJ/sshd_proxy.orig $OBJ/sshd_proxy
+	echo "HostKeyAlgorithms $k" >> $OBJ/sshd_proxy
 diff --color -rup a/sshconnect2.c b/sshconnect2.c
 --- a/sshconnect2.c	2022-07-14 10:10:07.262975710 +0200
 +++ b/sshconnect2.c	2022-07-14 10:10:32.068452067 +0200
diff --git a/openssh-8.7p1-recursive-scp.patch b/openssh-8.7p1-recursive-scp.patch
index 25765fbdb048a1e8796e7a218745abd0510692ec..5b44d922dc1fccee34eb1f4ff8bdafc6da85de0b 100644
--- a/openssh-8.7p1-recursive-scp.patch
+++ b/openssh-8.7p1-recursive-scp.patch
@@ -7,9 +7,9 @@ diff -up openssh-8.7p1/scp.c.scp-sftpdirs openssh-8.7p1/scp.c
  		if (upload_dir(conn, src, abs_dst, pflag,
 -		    SFTP_PROGRESS_ONLY, 0, 0, 1) != 0) {
 +		    SFTP_PROGRESS_ONLY, 0, 0, 1, 1) != 0) {
- 			error("failed to upload directory %s to %s",
- 				src, abs_dst);
- 			errs = 1;
+			error("failed to upload directory %s to %s", src, targ);
+			errs = 1;
+		}
 diff -up openssh-8.7p1/sftp-client.c.scp-sftpdirs openssh-8.7p1/sftp-client.c
 --- openssh-8.7p1/sftp-client.c.scp-sftpdirs	2021-08-20 06:03:49.000000000 +0200
 +++ openssh-8.7p1/sftp-client.c	2022-02-07 12:47:59.117516131 +0100
@@ -22,11 +22,13 @@ diff -up openssh-8.7p1/sftp-client.c.scp-sftpdirs openssh-8.7p1/sftp-client.c
  {
  	struct sshbuf *msg;
  	u_int expected_id, count, id;
-@@ -1012,9 +1012,38 @@ do_realpath_expand(struct sftp_conn *con
- 
- 		if ((r = sshbuf_get_u32(msg, &status)) != 0)
+@@ -1033,11 +1033,43 @@ do_realpath_expand(struct sftp_conn *con
+ 		if ((r = sshbuf_get_u32(msg, &status)) != 0 ||
+ 		    (r = sshbuf_get_cstring(msg, &errmsg, NULL)) != 0)
  			fatal_fr(r, "parse status");
--		error("Couldn't canonicalize: %s", fx2txt(status));
+-		error("%s %s: %s", expand ? "expand" : "realpath",
+-		    path, *errmsg == '\0' ? fx2txt(status) : errmsg);
+-		free(errmsg);
 -		sshbuf_free(msg);
 -		return NULL;
 +		if ((status == SSH2_FX_NO_SUCH_FILE) && create_dir)  {
@@ -35,29 +37,34 @@ diff -up openssh-8.7p1/sftp-client.c.scp-sftpdirs openssh-8.7p1/sftp-client.c
 +				sshbuf_free(msg);
 +				return NULL;
 +			}
-+
++			debug2("Sending SSH2_FXP_REALPATH \"%s\" - create dir", path);
 +			send_string_request(conn, id, SSH2_FXP_REALPATH,
 +					path, strlen(path));
 +
 +			get_msg(conn, msg);
 +			if ((r = sshbuf_get_u8(msg, &type)) != 0 ||
-+					(r = sshbuf_get_u32(msg, &id)) != 0)
++			    (r = sshbuf_get_u32(msg, &id)) != 0)
 +				fatal_fr(r, "parse");
 +
 +			if (id != expected_id)
 +				fatal("ID mismatch (%u != %u)", id, expected_id);
 +
 +			if (type == SSH2_FXP_STATUS) {
-+				u_int status;
++				free(errmsg);
 +
-+				if ((r = sshbuf_get_u32(msg, &status)) != 0)
++				if ((r = sshbuf_get_u32(msg, &status)) != 0 ||
++				    (r = sshbuf_get_cstring(msg, &errmsg, NULL)) != 0)
 +					fatal_fr(r, "parse status");
-+				error("Couldn't canonicalize: %s", fx2txt(status));
++				error("%s %s: %s", expand ? "expand" : "realpath",
++				    path, *errmsg == '\0' ? fx2txt(status) : errmsg);
++				free(errmsg);
 +				sshbuf_free(msg);
 +				return NULL;
 +			}
 +		} else {
-+			error("Couldn't canonicalize: %s", fx2txt(status));
++			error("%s %s: %s", expand ? "expand" : "realpath",
++			    path, *errmsg == '\0' ? fx2txt(status) : errmsg);
++			free(errmsg);
 +			sshbuf_free(msg);
 +			return NULL;
 +		}
@@ -94,9 +101,9 @@ diff -up openssh-8.7p1/sftp-client.c.scp-sftpdirs openssh-8.7p1/sftp-client.c
  
 -	if ((src_canon = do_realpath(conn, src)) == NULL) {
 +	if ((src_canon = do_realpath(conn, src, 0)) == NULL) {
- 		error("Unable to canonicalize path \"%s\"", src);
- 		return -1;
- 	}
+		error("download \"%s\": path canonicalization failed", src);
+		return -1;
+	}
 @@ -2115,12 +2143,12 @@ upload_dir_internal(struct sftp_conn *co
  int
  upload_dir(struct sftp_conn *conn, const char *src, const char *dst,
@@ -109,18 +116,18 @@ diff -up openssh-8.7p1/sftp-client.c.scp-sftpdirs openssh-8.7p1/sftp-client.c
  
 -	if ((dst_canon = do_realpath(conn, dst)) == NULL) {
 +	if ((dst_canon = do_realpath(conn, dst, create_dir)) == NULL) {
- 		error("Unable to canonicalize path \"%s\"", dst);
- 		return -1;
- 	}
+		error("upload \"%s\": path canonicalization failed", dst);
+		return -1;
+	}
 @@ -2557,7 +2585,7 @@ crossload_dir(struct sftp_conn *from, st
  	char *from_path_canon;
  	int ret;
  
 -	if ((from_path_canon = do_realpath(from, from_path)) == NULL) {
 +	if ((from_path_canon = do_realpath(from, from_path, 0)) == NULL) {
- 		error("Unable to canonicalize path \"%s\"", from_path);
- 		return -1;
- 	}
+		error("crossload \"%s\": path canonicalization failed",
+		    from_path);
+		return -1;
 diff -up openssh-8.7p1/sftp-client.h.scp-sftpdirs openssh-8.7p1/sftp-client.h
 --- openssh-8.7p1/sftp-client.h.scp-sftpdirs	2021-08-20 06:03:49.000000000 +0200
 +++ openssh-8.7p1/sftp-client.h	2022-02-07 12:31:07.410740433 +0100
diff --git a/openssh-8.7p1-scp-clears-file.patch b/openssh-8.7p1-scp-clears-file.patch
index 4c033daf5dcc05b714681de9185b298285f42a25..3ecff1ebd960a6ff5465fc76e688cad844c508bb 100644
--- a/openssh-8.7p1-scp-clears-file.patch
+++ b/openssh-8.7p1-scp-clears-file.patch
@@ -1,21 +1,20 @@
 diff --color -rup a/scp.c b/scp.c
 --- a/scp.c	2022-07-26 14:51:40.560120817 +0200
 +++ b/scp.c	2022-07-26 14:52:37.118213004 +0200
-@@ -1324,12 +1324,12 @@ source_sftp(int argc, char *src, char *t
- 
- 	if (src_is_dir && iamrecursive) {
- 		if (upload_dir(conn, src, abs_dst, pflag,
+@@ -1324,11 +1324,11 @@ source_sftp(int argc, char *src, char *t
+
+	if (src_is_dir && iamrecursive) {
+		if (upload_dir(conn, src, abs_dst, pflag,
 -		    SFTP_PROGRESS_ONLY, 0, 0, 1, 1) != 0) {
 +		    SFTP_PROGRESS_ONLY, 0, 0, 1, 1, 1) != 0) {
- 			error("failed to upload directory %s to %s",
- 				src, abs_dst);
- 			errs = 1;
- 		}
+			error("failed to upload directory %s to %s", src, targ);
+			errs = 1;
+		}
 -	} else if (do_upload(conn, src, abs_dst, pflag, 0, 0) != 0) {
 +	} else if (do_upload(conn, src, abs_dst, pflag, 0, 0, 1) != 0) {
- 		error("failed to upload file %s to %s", src, abs_dst);
- 		errs = 1;
- 	}
+		error("failed to upload file %s to %s", src, targ);
+		errs = 1;
+	}
 @@ -1566,11 +1566,11 @@ sink_sftp(int argc, char *dst, const cha
  		debug("Fetching %s to %s\n", g.gl_pathv[i], abs_dst);
  		if (globpath_is_dir(g.gl_pathv[i]) && iamrecursive) {
@@ -83,9 +82,9 @@ diff --color -rup a/sftp-client.c b/sftp-client.c
 -	    O_WRONLY | O_CREAT | (resume_flag ? 0 : O_TRUNC), mode | S_IWUSR);
 +	local_fd = open(local_path, O_WRONLY | O_CREAT |
 +	((resume_flag || inplace_flag) ? 0 : O_TRUNC), mode | S_IWUSR);
- 	if (local_fd == -1) {
- 		error("Couldn't open local file \"%s\" for writing: %s",
- 		    local_path, strerror(errno));
+	if (local_fd == -1) {
+		error("open local \"%s\": %s", local_path, strerror(errno));
+		goto fail;
 @@ -1661,8 +1661,11 @@ do_download(struct sftp_conn *conn, cons
  	/* Sanity check */
  	if (TAILQ_FIRST(&requests) != NULL)
@@ -217,8 +216,8 @@ diff --color -rup a/sftp-client.c b/sftp-client.c
 +	}
 +
  	if (close(local_fd) == -1) {
- 		error("Couldn't close local file \"%s\": %s", local_path,
- 		    strerror(errno));
+		error("close local \"%s\": %s", local_path, strerror(errno));
+		status = SSH2_FX_FAILURE;
 @@ -2041,7 +2063,7 @@ do_upload(struct sftp_conn *conn, const
  static int
  upload_dir_internal(struct sftp_conn *conn, const char *src, const char *dst,
@@ -241,9 +240,9 @@ diff --color -rup a/sftp-client.c b/sftp-client.c
 -			    preserve_flag, resume, fsync_flag) == -1) {
 +			    preserve_flag, resume, fsync_flag,
 +			    inplace_flag) == -1) {
- 				error("Uploading of file %s to %s failed!",
- 				    new_src, new_dst);
- 				ret = -1;
+				error("upload \"%s\" to \"%s\" failed",
+				    new_src, new_dst);
+				ret = -1;
 @@ -2144,7 +2167,7 @@ upload_dir_internal(struct sftp_conn *co
  int
  upload_dir(struct sftp_conn *conn, const char *src, const char *dst,
diff --git a/openssh-8.7p1-sftp-default-protocol.patch b/openssh-8.7p1-sftp-default-protocol.patch
index c3527b1e5194eea9b23bcc49d2e6e2e278fe84aa..8837a7ba5ff83fe0e83d51aa30f53bc226936dce 100644
--- a/openssh-8.7p1-sftp-default-protocol.patch
+++ b/openssh-8.7p1-sftp-default-protocol.patch
@@ -57,7 +57,7 @@ index 68aac04b..a96e95ad 100644
  .Bx
  source code from the Regents of the University of California.
 +.Pp
-+Since OpenSSH 8.8 (8.7 in Red Hat/Fedora builds),
++Since OpenSSH 8.8 (8.7 in R H/Fa builds),
 +.Nm
 +has use the SFTP protocol for transfers by default.
  .Sh AUTHORS
diff --git a/openssh-8.7p1-sftpscp-dir-create.patch b/openssh-8.7p1-sftpscp-dir-create.patch
deleted file mode 100644
index bc504f9d3deeb9576268850e417484250a269bd9..0000000000000000000000000000000000000000
--- a/openssh-8.7p1-sftpscp-dir-create.patch
+++ /dev/null
@@ -1,135 +0,0 @@
-diff -up openssh-8.7p1/scp.c.sftpdirs openssh-8.7p1/scp.c
---- openssh-8.7p1/scp.c.sftpdirs	2022-02-02 14:11:12.553447509 +0100
-+++ openssh-8.7p1/scp.c	2022-02-02 14:12:56.081316414 +0100
-@@ -130,6 +130,7 @@
- #include "misc.h"
- #include "progressmeter.h"
- #include "utf8.h"
-+#include "sftp.h"
- 
- #include "sftp-common.h"
- #include "sftp-client.h"
-@@ -1264,13 +1265,18 @@ tolocal(int argc, char **argv, enum scp_
- static char *
- prepare_remote_path(struct sftp_conn *conn, const char *path)
- {
-+	size_t nslash;
-+
- 	/* Handle ~ prefixed paths */
--	if (*path != '~')
--		return xstrdup(path);
- 	if (*path == '\0' || strcmp(path, "~") == 0)
- 		return xstrdup(".");
--	if (strncmp(path, "~/", 2) == 0)
--		return xstrdup(path + 2);
-+	if (*path != '~')
-+		return xstrdup(path);
-+	if (strncmp(path, "~/", 2) == 0) {
-+		if ((nslash = strspn(path + 2, "/")) == strlen(path + 2))
-+			return xstrdup(".");
-+		return xstrdup(path + 2 + nslash);
-+	}
- 	if (can_expand_path(conn))
- 		return do_expand_path(conn, path);
- 	/* No protocol extension */
-@@ -1282,10 +1288,16 @@ void
- source_sftp(int argc, char *src, char *targ, struct sftp_conn *conn)
- {
- 	char *target = NULL, *filename = NULL, *abs_dst = NULL;
--	int target_is_dir;
--
-+	int src_is_dir, target_is_dir;
-+	Attrib a;
-+	struct stat st;
-+
-+	memset(&a, '\0', sizeof(a));
-+	if (stat(src, &st) != 0)
-+		fatal("stat local \"%s\": %s", src, strerror(errno));
-+	src_is_dir = S_ISDIR(st.st_mode);
- 	if ((filename = basename(src)) == NULL)
--		fatal("basename %s: %s", src, strerror(errno));
-+		fatal("basename \"%s\": %s", src, strerror(errno));
- 
- 	/*
- 	 * No need to glob here - the local shell already took care of
-@@ -1295,8 +1307,12 @@ source_sftp(int argc, char *src, char *t
- 		cleanup_exit(255);
- 	target_is_dir = remote_is_dir(conn, target);
- 	if (targetshouldbedirectory && !target_is_dir) {
--		fatal("Target is not a directory, but more files selected "
--		    "for upload");
-+		debug("target directory \"%s\" does not exist", target);
-+		a.flags = SSH2_FILEXFER_ATTR_PERMISSIONS;
-+		a.perm = st.st_mode | 0700; /* ensure writable */
-+		if (do_mkdir(conn, target, &a, 1) != 0)
-+			cleanup_exit(255); /* error already logged */
-+		target_is_dir = 1;
- 	}
- 	if (target_is_dir)
- 		abs_dst = path_append(target, filename);
-@@ -1306,7 +1322,7 @@ source_sftp(int argc, char *src, char *t
- 	}
- 	debug3_f("copying local %s to remote %s", src, abs_dst);
- 
--	if (local_is_dir(src) && iamrecursive) {
-+	if (src_is_dir && iamrecursive) {
- 		if (upload_dir(conn, src, abs_dst, pflag,
- 		    SFTP_PROGRESS_ONLY, 0, 0, 1) != 0) {
-			error("failed to upload directory %s to %s",
-@@ -1487,14 +1506,15 @@ sink_sftp(int argc, char *dst, const cha
- 	char *abs_dst = NULL;
- 	glob_t g;
- 	char *filename, *tmp = NULL;
--	int i, r, err = 0;
-+	int i, r, err = 0, dst_is_dir;
-+	struct stat st;
- 
- 	memset(&g, 0, sizeof(g));
-+
- 	/*
- 	 * Here, we need remote glob as SFTP can not depend on remote shell
- 	 * expansions
- 	 */
--
- 	if ((abs_src = prepare_remote_path(conn, src)) == NULL) {
- 		err = -1;
- 		goto out;
-@@ -1510,11 +1530,24 @@ sink_sftp(int argc, char *dst, const cha
- 		goto out;
- 	}
- 
--	if (g.gl_matchc > 1 && !local_is_dir(dst)) {
--		error("Multiple files match pattern, but destination "
--		    "\"%s\" is not a directory", dst);
--		err = -1;
--		goto out;
-+	if ((r = stat(dst, &st)) != 0)
-+		debug2_f("stat local \"%s\": %s", dst, strerror(errno));
-+	dst_is_dir = r == 0 && S_ISDIR(st.st_mode);
-+
-+	if (g.gl_matchc > 1 && !dst_is_dir) {
-+		if (r == 0) {
-+			error("Multiple files match pattern, but destination "
-+			    "\"%s\" is not a directory", dst);
-+			err = -1;
-+			goto out;
-+		}
-+		debug2_f("creating destination \"%s\"", dst);
-+		if (mkdir(dst, 0777) != 0) {
-+			error("local mkdir \"%s\": %s", dst, strerror(errno));
-+			err = -1;
-+			goto out;
-+		}
-+		dst_is_dir = 1;
- 	}
- 
- 	for (i = 0; g.gl_pathv[i] && !interrupted; i++) {
-@@ -1525,7 +1558,7 @@ sink_sftp(int argc, char *dst, const cha
- 			goto out;
- 		}
- 
--		if (local_is_dir(dst))
-+		if (dst_is_dir)
- 			abs_dst = path_append(dst, filename);
- 		else
- 			abs_dst = xstrdup(dst);
diff --git a/openssh-8.8p1-skip-some-tests.patch b/openssh-8.8p1-skip-some-tests.patch
deleted file mode 100644
index 7268eb393fcced60200150b27c3927d7e87452f4..0000000000000000000000000000000000000000
--- a/openssh-8.8p1-skip-some-tests.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-diff -up openssh-8.8p1/regress/hostkey-agent.sh.redhat openssh-8.8p1/regress/hostkey-agent.sh
---- openssh-8.8p1/regress/hostkey-agent.sh.redhat	2022-08-10 15:54:42.084777662 +0200
-+++ openssh-8.8p1/regress/hostkey-agent.sh	2022-08-10 17:01:25.651269994 +0200
-@@ -36,6 +36,8 @@ unset SSH_AUTH_SOCK
- 
- for ps in yes; do
- 	for k in $SSH_ACCEPTED_KEYTYPES ; do
-+		[ "$k" == "ssh-rsa" ] && continue
-+		[ "$k" == "ssh-dss" ] && continue
- 		verbose "key type $k privsep=$ps"
- 		cp $OBJ/sshd_proxy.orig $OBJ/sshd_proxy
- 		echo "UsePrivilegeSeparation $ps" >> $OBJ/sshd_proxy
-diff -up openssh-8.8p1/regress/hostkey-rotate.sh.redhat openssh-8.8p1/regress/hostkey-rotate.sh
---- openssh-8.8p1/regress/hostkey-rotate.sh.redhat	2022-08-10 16:57:12.720029146 +0200
-+++ openssh-8.8p1/regress/hostkey-rotate.sh	2022-08-10 17:15:48.274923865 +0200
-@@ -40,6 +40,8 @@ trace "prepare hostkeys"
- nkeys=0
- all_algs=""
- for k in $SSH_HOSTKEY_TYPES; do
-+	[ "$k" == "ssh-rsa" ] && continue
-+	[ "$k" == "ssh-dss" ] && continue
- 	${SSHKEYGEN} -qt $k -f $OBJ/hkr.$k -N '' || fatal "ssh-keygen $k"
- 	echo "Hostkey $OBJ/hkr.${k}" >> $OBJ/sshd_proxy.orig
- 	nkeys=`expr $nkeys + 1`
-@@ -87,11 +89,15 @@ dossh -oStrictHostKeyChecking=yes -oHost
- # Check that other keys learned
- expect_nkeys $nkeys "learn hostkeys"
- for k in $SSH_HOSTKEY_TYPES; do
-+	[ "$k" == "ssh-rsa" ] && continue
-+	[ "$k" == "ssh-dss" ] && continue
- 	check_key_present $k || fail "didn't learn keytype $k"
- done
- 
- # Check each key type
- for k in $SSH_HOSTKEY_TYPES; do
-+	[ "$k" == "ssh-rsa" ] && continue
-+	[ "$k" == "ssh-dss" ] && continue
- 	verbose "learn additional hostkeys, type=$k"
- 	dossh -oStrictHostKeyChecking=yes -oHostKeyAlgorithms=$k,$all_algs
- 	expect_nkeys $nkeys "learn hostkeys $k"
-
diff --git a/openssh-8.8p1.tar.gz b/openssh-8.8p1.tar.gz
deleted file mode 100644
index 85ba061dad5479b066f6e2164edc600f8aa0f6dd..0000000000000000000000000000000000000000
Binary files a/openssh-8.8p1.tar.gz and /dev/null differ
diff --git a/openssh-8.8p1.tar.gz.asc b/openssh-8.8p1.tar.gz.asc
deleted file mode 100644
index 9a1fd8e67da5cdb68c5401e903465b223a06b067..0000000000000000000000000000000000000000
--- a/openssh-8.8p1.tar.gz.asc
+++ /dev/null
@@ -1,16 +0,0 @@
------BEGIN PGP SIGNATURE-----
-
-iQIzBAABCgAdFiEEcWi5g4FaXu9ZpK39Kj9BTnNgYLoFAmFQfp8ACgkQKj9BTnNg
-YLq2SQ/8C3iOHTkyqX82FYt0SKkybebe9b2iBPr91HQOUmx+U3I+vgrSWArXabWJ
-uSu0b685RQKlcr7UjEtPk6g0cm45NoJFjju9ljvnOFfZw73V3a5qX15Lx4xRnkRx
-v1LJn6Yh12PKLWL4/A1qPQnfAObVwq/BF0BR01FfXLAOt5+lFwYvg79HpE+69b0r
-KtcIEpsyTEn2lSKSWD7q4lpe6Z/iR+XzBKfnB6JJXhKyHiDV63hlAJk9Pt3mIvS6
-tnE9/7GDawvi+Tsl018kw3wsf6aHVSQ+O+vzcDgfy0vDJVGjD6Ec9it9FvikXJh6
-3pSTBYuUJdt+CAQYvmEui73v4nrkfouHXsxqgzEDZaTwIZC4wPrvNYxUaIyirWlc
-l4/YSnxSxSiYbvPa5eYRBvXvoWbnQXjPOkuhjETxz/KTcHirQpWE9eldi0jHcKUa
-FVu9YqMPAjIUd1Jj4vC5bgH7v5cLeEMm/AetMvKsJs+rhY9NZaKpiqOqU2m6Geb+
-sQSXHNTeA8uOlrHim4SmYHtmfglVbH5lIroiUqtRzjbOhMhqUb+yN9+aAxe0bwmN
-VcFMSThlbmYokb9bkQryY2I/FfXb997vxgF6v15Z8d9e8HH2zc2Irj1HYXG4Bf3o
-WCiSvd8+Tr/FxS2Gn8qj/vgSPWXT0d0Hy4zHW9JeT/jn3RtIYhU=
-=EnoG
------END PGP SIGNATURE-----
diff --git a/openssh-9.0p1-audit-log.patch b/openssh-9.0p1-audit-log.patch
new file mode 100644
index 0000000000000000000000000000000000000000..fbf5094d883d0113ffa08e3702f3c7252d30763f
--- /dev/null
+++ b/openssh-9.0p1-audit-log.patch
@@ -0,0 +1,119 @@
+diff -up openssh-9.0p1/audit-bsm.c.patch openssh-9.0p1/audit-bsm.c
+--- openssh-9.0p1/audit-bsm.c.patch	2022-10-24 15:02:16.544858331 +0200
++++ openssh-9.0p1/audit-bsm.c	2022-10-24 14:51:43.685766639 +0200
+@@ -405,7 +405,7 @@ audit_session_close(struct logininfo *li
+ }
+ 
+ int
+-audit_keyusage(struct ssh *ssh, int host_user, char *fp, int rv)
++audit_keyusage(struct ssh *ssh, int host_user, char *key_fp, const struct sshkey_cert *cert, const char *issuer_fp, int rv)
+ {
+ 	/* not implemented */
+ }
+diff -up openssh-9.0p1/audit.c.patch openssh-9.0p1/audit.c
+--- openssh-9.0p1/audit.c.patch	2022-10-24 15:02:16.544858331 +0200
++++ openssh-9.0p1/audit.c	2022-10-24 15:20:38.854548226 +0200
+@@ -116,12 +116,22 @@ audit_event_lookup(ssh_audit_event_t ev)
+ void
+ audit_key(struct ssh *ssh, int host_user, int *rv, const struct sshkey *key)
+ {
+-	char *fp;
++	char *key_fp = NULL;
++	char *issuer_fp = NULL;
++	struct sshkey_cert *cert = NULL;
+ 
+-	fp = sshkey_fingerprint(key, options.fingerprint_hash, SSH_FP_HEX);
+-	if (audit_keyusage(ssh, host_user, fp, (*rv == 0)) == 0)
++	key_fp = sshkey_fingerprint(key, options.fingerprint_hash, SSH_FP_HEX);
++	if (sshkey_is_cert(key) && key->cert != NULL && key->cert->signature_key != NULL) {
++		cert = key->cert;
++		issuer_fp = sshkey_fingerprint(cert->signature_key,
++										options.fingerprint_hash, SSH_FP_DEFAULT);
++	}
++	if (audit_keyusage(ssh, host_user, key_fp, cert, issuer_fp, (*rv == 0)) == 0)
+ 		*rv = -SSH_ERR_INTERNAL_ERROR;
+-	free(fp);
++	if (key_fp)
++		free(key_fp);
++	if (issuer_fp)
++		free(issuer_fp);
+ }
+ 
+ void
+diff -up openssh-9.0p1/audit.h.patch openssh-9.0p1/audit.h
+--- openssh-9.0p1/audit.h.patch	2022-10-24 15:02:16.544858331 +0200
++++ openssh-9.0p1/audit.h	2022-10-24 14:58:20.887565518 +0200
+@@ -64,7 +64,7 @@ void	audit_session_close(struct logininf
+ int	audit_run_command(struct ssh *, const char *);
+ void 	audit_end_command(struct ssh *, int, const char *);
+ ssh_audit_event_t audit_classify_auth(const char *);
+-int	audit_keyusage(struct ssh *, int, char *, int);
++int	audit_keyusage(struct ssh *, int, const char *, const struct sshkey_cert *, const char *, int);
+ void	audit_key(struct ssh *, int, int *, const struct sshkey *);
+ void	audit_unsupported(struct ssh *, int);
+ void	audit_kex(struct ssh *, int, char *, char *, char *, char *);
+diff -up openssh-9.0p1/audit-linux.c.patch openssh-9.0p1/audit-linux.c
+--- openssh-9.0p1/audit-linux.c.patch	2022-10-24 15:02:16.544858331 +0200
++++ openssh-9.0p1/audit-linux.c	2022-10-24 15:21:58.165303951 +0200
+@@ -137,10 +137,12 @@ fatal_report:
+ }
+ 
+ int
+-audit_keyusage(struct ssh *ssh, int host_user, char *fp, int rv)
++audit_keyusage(struct ssh *ssh, int host_user, const char *key_fp, const struct sshkey_cert *cert, const char *issuer_fp, int rv)
+ {
+ 	char buf[AUDIT_LOG_SIZE];
+ 	int audit_fd, rc, saved_errno;
++	const char *rip;
++	u_int i;
+ 
+ 	audit_fd = audit_open();
+ 	if (audit_fd < 0) {
+@@ -150,14 +152,44 @@ audit_keyusage(struct ssh *ssh, int host
+ 		else
+ 			return 0; /* Must prevent login */
+ 	}
++	rip = ssh_remote_ipaddr(ssh);
+ 	snprintf(buf, sizeof(buf), "%s_auth grantors=auth-key", host_user ? "pubkey" : "hostbased");
+ 	rc = audit_log_acct_message(audit_fd, AUDIT_USER_AUTH, NULL,
+-		buf, audit_username(), -1, NULL, ssh_remote_ipaddr(ssh), NULL, rv);
++		buf, audit_username(), -1, NULL, rip, NULL, rv);
+ 	if ((rc < 0) && ((rc != -1) || (getuid() == 0)))
+ 		goto out;
+-	snprintf(buf, sizeof(buf), "op=negotiate kind=auth-key fp=%s", fp);
++	snprintf(buf, sizeof(buf), "op=negotiate kind=auth-key fp=%s", key_fp);
+ 	rc = audit_log_user_message(audit_fd, AUDIT_CRYPTO_KEY_USER, buf, NULL,
+-		ssh_remote_ipaddr(ssh), NULL, rv);
++		rip, NULL, rv);
++	if ((rc < 0) && ((rc != -1) || (getuid() == 0)))
++		goto out;
++
++	if (cert) {
++		char *pbuf;
++
++		pbuf = audit_encode_nv_string("key_id", cert->key_id, 0);
++		if (pbuf == NULL)
++			goto out;
++		snprintf(buf, sizeof(buf), "cert %s cert_serial=%llu cert_issuer_alg=\"%s\" cert_issuer_fp=\"%s\"",
++			pbuf, (unsigned long long)cert->serial, sshkey_type(cert->signature_key), issuer_fp);
++		free(pbuf);
++		rc = audit_log_acct_message(audit_fd, AUDIT_USER_AUTH, NULL,
++			buf, audit_username(), -1, NULL, rip, NULL, rv);
++		if ((rc < 0) && ((rc != -1) || (getuid() == 0)))
++			goto out;
++
++		for (i = 0; cert->principals != NULL && i < cert->nprincipals; i++) {
++			pbuf = audit_encode_nv_string("cert_principal", cert->principals[i], 0);
++			if (pbuf == NULL)
++				goto out;
++			snprintf(buf, sizeof(buf), "principal %s", pbuf);
++			free(pbuf);
++			rc = audit_log_acct_message(audit_fd, AUDIT_USER_AUTH, NULL,
++				buf, audit_username(), -1, NULL, rip, NULL, rv);
++			if ((rc < 0) && ((rc != -1) || (getuid() == 0)))
++				goto out;
++		}
++	}
+ out:
+ 	saved_errno = errno;
+ 	audit_close(audit_fd);
diff --git a/openssh-9.0p1.tar.gz b/openssh-9.0p1.tar.gz
new file mode 100644
index 0000000000000000000000000000000000000000..81cc006f4d2b24e4cd1f521fbf6afc838d6d96b9
Binary files /dev/null and b/openssh-9.0p1.tar.gz differ
diff --git a/openssh-9.0p1.tar.gz.asc b/openssh-9.0p1.tar.gz.asc
new file mode 100644
index 0000000000000000000000000000000000000000..617af2b9b54e8a672f3062f2719e027e7ba149bc
--- /dev/null
+++ b/openssh-9.0p1.tar.gz.asc
@@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABCgAdFiEEcWi5g4FaXu9ZpK39Kj9BTnNgYLoFAmJObeQACgkQKj9BTnNg
+YLqXsRAAyd18O0i9cBeMuzRY5df9rn+2iIl6FGYpwaPSXSn2t8UR9xad63G+5Wtm
+Qx5zxaWnPDkrKQvja6DzU7Zc58J/N0o9IMLEfXAP4eGXsuF4NZM/SEHjqRtQovTo
+26xRxbX4LryUBJ7tNCSJ81UGmNS3GfwuTroMB32WclChCMOdu1MzO8mHOrtOBB7B
+nc2F4Y7x4i71RXilTAMzpnzAzktOt5O74A16NZsfa8vJPyrFVav+hv4wYx2VROGa
+HDVwdvnxVqUSAQQ47bYiWequ0DYgVK4icvRsUm5FYkAfFu7H0/6s6CIKgaslkOJ8
+OodTa7u2doG/P7Seeol8eG8B9uKSHhwlKMO/24LEzs3AHSHW2bEL/n7XECXMNhWW
+lFPdHpJ1ieFjEuVcNidag9XQ8zj2V6Q2jnD/dpbegHHy3yVAjYKvgK+TmxNq/EGW
++b5hMo1sHPpX0p8fHpfxKbZxxzOD+KipoDINkvqmG2f9YPdeuEJgwbyCXFt5cEC2
+S3R3K0kpkb0j8wSPPZyGaezKTeKqKtA8oD/omWf4hJg+y4G0LQUAW/0/276uUcTA
+ZEzGE/KI3WSwdqAY4PvxsFxqLdp6a5s3FKQKsFXlsqEQfWaCpqMZRjmz3nskQSu/
+WF9X7yZzn/l4GNTj4E8zCcUQGrYkOzACPIMJ/nmWAMTesuB9AqI=
+=Agii
+-----END PGP SIGNATURE-----
diff --git a/openssh-server-systemd-sysusers.conf b/openssh-server-systemd-sysusers.conf
new file mode 100644
index 0000000000000000000000000000000000000000..419c5293322294145f0e168d150db0f080f2c2be
--- /dev/null
+++ b/openssh-server-systemd-sysusers.conf
@@ -0,0 +1,2 @@
+#Type Name ID  GECOS                     Home directory        Shell
+u     sshd 74  "Privilege-separated SSH" /usr/share/empty.sshd -
diff --git a/openssh.spec b/openssh.spec
index 4d45e453358c24ed0e5c77a6bf0dd94f5b8ed30a..01a671c2c283e89e408a337409a89bb7853a6381 100644
--- a/openssh.spec
+++ b/openssh.spec
@@ -1,4 +1,4 @@
-%define anolis_release 4
+%define anolis_release 1
 # Do we want SELinux & Audit
 %if 0%{?!noselinux:1}
 %global WITH_SELINUX 1
@@ -8,17 +8,13 @@
 
 %global _hardened_build 1
 
-# OpenSSH privilege separation requires a user & group ID
-%global sshd_uid    74
-%global sshd_gid    74
-
 # Do we want to disable building of gnome-askpass? (1=yes 0=no)
 %global no_gnome_askpass 0
 
 # Do we want to link against a static libcrypto? (1=yes 0=no)
 %global static_libcrypto 0
 
-# Use GTK3 instead of gtk2
+# Use GTK3 instead of GTK2 in gnome-ssh-askpass
 %global gtk3 1
 
 # Build position-independent executables (requires toolchain support)?
@@ -50,9 +46,9 @@
 %{?static_openssl:%global static_libcrypto 1}
 
 # Do not forget to bump pam_ssh_agent_auth release if you rewind the main package release to 1
-%global openssh_ver 8.8p1
+%global openssh_ver 9.0p1
 %global pam_ssh_agent_ver 0.10.4
-%global pam_ssh_agent_rel 6
+%global pam_ssh_agent_rel 7
 
 Summary: An open source implementation of SSH protocol version 2
 Name: openssh
@@ -75,8 +71,8 @@ Source12: sshd-keygen@.service
 Source13: sshd-keygen
 Source15: sshd-keygen.target
 Source16: ssh-agent.service
-Source17: gnome-ssh-askpass.sh
-Source18: gnome-ssh-askpass.csh
+Source17: ssh-agent.socket
+Source19: openssh-server-systemd-sysusers.conf
 
 #https://bugzilla.mindrot.org/show_bug.cgi?id=2581
 Patch100: openssh-6.7p1-coverity.patch
@@ -84,6 +80,8 @@ Patch100: openssh-6.7p1-coverity.patch
 Patch200: openssh-7.6p1-audit.patch
 # Audit race condition in forked child (#1310684)
 Patch201: openssh-7.1p2-audit-race-condition.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=2049947
+Patch202: openssh-9.0p1-audit-log.patch
 
 # --- pam_ssh-agent ---
 # make it build reusing the openssh sources
@@ -100,6 +98,7 @@ Patch306: pam_ssh_agent_auth-0.10.2-compat.patch
 # Fix NULL dereference from getpwuid() return value
 # https://sourceforge.net/p/pamsshagentauth/bugs/22/
 Patch307: pam_ssh_agent_auth-0.10.2-dereference.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=2070113
 Patch308: pam_ssh_agent_auth-0.10.4-rsasha2.patch
 
 #https://bugzilla.mindrot.org/show_bug.cgi?id=1641 (WONTFIX)
@@ -110,8 +109,6 @@ Patch502: openssh-6.6p1-keycat.patch
 
 #https://bugzilla.mindrot.org/show_bug.cgi?id=1644
 Patch601: openssh-6.6p1-allow-ip-opts.patch
-#https://bugzilla.mindrot.org/show_bug.cgi?id=1893 (WONTFIX)
-Patch604: openssh-6.6p1-keyperm.patch
 #(drop?) https://bugzilla.mindrot.org/show_bug.cgi?id=1925
 Patch606: openssh-5.9p1-ipv6man.patch
 #?
@@ -188,33 +185,15 @@ Patch966: openssh-8.2p1-x11-without-ipv6.patch
 Patch974: openssh-8.0p1-keygen-strip-doseol.patch
 # sshd provides PAM an incorrect error code (#1879503)
 Patch975: openssh-8.0p1-preserve-pam-errors.patch
-# Use SFTP protocol by default for scp command
-Patch976: openssh-8.7p1-sftp-default-protocol.patch
 # Implement kill switch for SCP protocol
 Patch977: openssh-8.7p1-scp-kill-switch.patch
-# upstream commits:
-# ba61123eef9c6356d438c90c1199a57a0d7bcb0a
-# 63670d4e9030bcee490d5a9cce561373ac5b3b23
-# ac7c9ec894ed0825d04ef69c55babb49bab1d32e
-Patch980: openssh-8.7p1-sftpscp-dir-create.patch
-# Workaround for lack of sftp_realpath in older versions of RHEL
-# https://bugzilla.redhat.com/show_bug.cgi?id=2038854
+
 # https://github.com/openssh/openssh-portable/pull/299
-# downstream only
 Patch981: openssh-8.7p1-recursive-scp.patch
 # https://github.com/djmdjm/openssh-wip/pull/13
 Patch982: openssh-8.7p1-minrsabits.patch
-# downstream only
 Patch983: openssh-8.7p1-evpgenkey.patch
-# downstream only, IBMCA tentative fix
-# From https://bugzilla.redhat.com/show_bug.cgi?id=1976202#c14
 Patch984: openssh-8.7p1-ibmca.patch
-
-# Minimize the use of SHA1 as a proof of possession for RSA key (#2031868)
-# upstream commits:
-# 291721bc7c840d113a49518f3fca70e86248b8e8
-# 0fa33683223c76289470a954404047bc762be84c
-Patch1000: openssh-8.7p1-minimize-sha1-use.patch
 # Fix for scp clearing file when src and dest are the same (#2056884)
 # upstream commits:
 # 7b1cbcb7599d9f6a3bbad79d412604aa1203b5ee
@@ -233,20 +212,15 @@ Patch1003: openssh-8.7p1-mem-leak.patch
 # upstream MR:
 # https://github.com/openssh-gsskex/openssh-gsskex/pull/21
 Patch1004: openssh-8.7p1-gssapi-auth.patch
-# Fix host-based authentication with rsa keys
-# upstream commits:
-# 7aa7b096cf2bafe2777085abdeed5ce00581f641
-# d9dbb5d9a0326e252d3c7bc13beb9c2434f59409
-# fdb1d58d0d3888b042e5a500f6ce524486aaf782
-Patch1005: openssh-8.7p1-host-based-auth.patch
+ 
 # Don't propose disallowed algorithms during hostkey negotiation
 # upstream MR:
 # https://github.com/openssh/openssh-portable/pull/323
 Patch1006: openssh-8.7p1-negotiate-supported-algs.patch
-
+ 
 # downstream only
 # we skip some ssh-rsa/ssh-dss tests to make native test suite pass
-Patch1100: openssh-8.8p1-skip-some-tests.patch
+#Patch1100: openssh-8.8p1-skip-some-tests.patch
 
 License: BSD
 Requires: /sbin/nologin
@@ -295,14 +269,14 @@ BuildRequires: gnupg2
 %package clients
 Summary: An open source SSH client applications
 Requires: openssh = %{version}-%{release}
-Requires: crypto-policies >= 20200610-1
+Requires: crypto-policies >= 20220824-1
 
 %package server
 Summary: An open source SSH server daemon
 Requires: openssh = %{version}-%{release}
 Requires(pre): /usr/sbin/useradd
 Requires: pam >= 1.0.1-3
-Requires: crypto-policies >= 20200610-1
+Requires: crypto-policies >= 20220824-1
 %{?systemd_requires}
 
 %package keycat
@@ -318,7 +292,6 @@ Summary:        Documentation files for %{name}
 Requires:       openssh = %{version}-%{release}
 BuildArch:      noarch
 
-
 %package -n pam_ssh_agent_auth
 Summary: PAM module for authentication with ssh-agent
 Version: %{pam_ssh_agent_ver}
@@ -394,7 +367,6 @@ popd
 %patch502 -p1 -b .keycat
 
 %patch601 -p1 -b .ip-opts
-%patch604 -p1 -b .keyperm
 %patch606 -p1 -b .ipv6man
 %patch607 -p1 -b .sigpipe
 %patch609 -p1 -b .x11
@@ -431,9 +403,8 @@ popd
 %patch966 -p1 -b .x11-ipv6
 %patch974 -p1 -b .keygen-strip-doseol
 %patch975 -p1 -b .preserve-pam-errors
-%patch976 -p1 -b .sftp-by-default
 %patch977 -p1 -b .kill-scp
-%patch980 -p1 -b .sftpdirs
+
 %patch981 -p1 -b .scp-sftpdirs
 %patch982 -p1 -b .minrsabits
 %patch983 -p1 -b .evpgenrsa
@@ -443,16 +414,13 @@ popd
 %patch201 -p1 -b .audit-race
 %patch700 -p1 -b .fips
 
-%patch1000 -p1 -b .minimize-sha1-use
 %patch1001 -p1 -b .scp-clears-file
 %patch1002 -p1 -b .ssh-manpage
 %patch1003 -p1 -b .mem-leak
 %patch1004 -p1 -b .gssapi-auth
-%patch1005 -p1 -b .host-based-auth
+ 
 %patch1006 -p1 -b .negotiate-supported-algs
-
-%patch1100 -p1 -b .skipsshrsadsstests
-
+ 
 %patch100 -p1 -b .coverity
 
 autoreconf
@@ -591,20 +559,22 @@ install -m644 %{SOURCE12} $RPM_BUILD_ROOT/%{_unitdir}/sshd-keygen@.service
 install -m644 %{SOURCE15} $RPM_BUILD_ROOT/%{_unitdir}/sshd-keygen.target
 install -d -m755 $RPM_BUILD_ROOT/%{_userunitdir}
 install -m644 %{SOURCE16} $RPM_BUILD_ROOT/%{_userunitdir}/ssh-agent.service
+install -m644 %{SOURCE17} $RPM_BUILD_ROOT/%{_userunitdir}/ssh-agent.socket
 install -m744 %{SOURCE13} $RPM_BUILD_ROOT/%{_libexecdir}/openssh/sshd-keygen
 install -m755 contrib/ssh-copy-id $RPM_BUILD_ROOT%{_bindir}/
 install contrib/ssh-copy-id.1 $RPM_BUILD_ROOT%{_mandir}/man1/
 install -d -m711 ${RPM_BUILD_ROOT}/%{_datadir}/empty.sshd
+install -p -D -m 0644 %{SOURCE19} %{buildroot}%{_sysusersdir}/openssh-server.conf
 
 %if ! %{no_gnome_askpass}
-install contrib/gnome-ssh-askpass $RPM_BUILD_ROOT%{_libexecdir}/openssh/gnome-ssh-askpass
+install -m755 contrib/gnome-ssh-askpass $RPM_BUILD_ROOT%{_libexecdir}/openssh/gnome-ssh-askpass
 %endif
 
 %if ! %{no_gnome_askpass}
 ln -s gnome-ssh-askpass $RPM_BUILD_ROOT%{_libexecdir}/openssh/ssh-askpass
 install -m 755 -d $RPM_BUILD_ROOT%{_sysconfdir}/profile.d/
-install -m 755 %{SOURCE18} $RPM_BUILD_ROOT%{_sysconfdir}/profile.d/
-install -m 755 %{SOURCE17} $RPM_BUILD_ROOT%{_sysconfdir}/profile.d/
+install -m 755 contrib/redhat/gnome-ssh-askpass.csh $RPM_BUILD_ROOT%{_sysconfdir}/profile.d/
+install -m 755 contrib/redhat/gnome-ssh-askpass.sh $RPM_BUILD_ROOT%{_sysconfdir}/profile.d/
 %endif
 
 %if %{no_gnome_askpass}
@@ -621,15 +591,13 @@ popd
 
 %generate_compatibility_deps
 
-%pre
-getent group ssh_keys >/dev/null || groupadd -r -g 101 ssh_keys || :
-
 %pre server
-getent group sshd >/dev/null || groupadd -g %{sshd_uid} -r sshd || :
-getent passwd sshd >/dev/null || \
-  useradd -c "Privilege-separated SSH" -u %{sshd_uid} -g sshd \
-  -s /sbin/nologin -r -d /usr/share/empty.sshd sshd 2> /dev/null || :
-
+%sysusers_create_compat %{SOURCE20}
+# We want to remove group ownership for standard host keys if they exist
+test -f /etc/ssh/ssh_host_rsa_key     && /usr/bin/chmod g-r /etc/ssh/ssh_host_rsa_key     || :
+test -f /etc/ssh/ssh_host_ecdsa_key   && /usr/bin/chmod g-r /etc/ssh/ssh_host_ecdsa_key   || :
+test -f /etc/ssh/ssh_host_ed25519_key && /usr/bin/chmod g-r /etc/ssh/ssh_host_ed25519_key || :
+ 
 %post server
 %systemd_post sshd.service sshd.socket
 # drop-in directory (in F32+).
@@ -651,9 +619,11 @@ test -f %{sysconfig_anaconda} && \
 
 %post clients
 %systemd_user_post ssh-agent.service
+%systemd_user_post ssh-agent.socket
 
 %preun clients
 %systemd_user_preun ssh-agent.service
+%systemd_user_preun ssh-agent.socket
 
 %files
 %dir %{abidir}
@@ -663,7 +633,7 @@ test -f %{sysconfig_anaconda} && \
 %attr(0755,root,root) %{_bindir}/ssh-keygen
 %attr(0644,root,root) %{_mandir}/man1/ssh-keygen.1*
 %attr(0755,root,root) %dir %{_libexecdir}/openssh
-%attr(2555,root,ssh_keys) %{_libexecdir}/openssh/ssh-keysign
+%attr(4555,root,root) %{_libexecdir}/openssh/ssh-keysign
 %attr(0644,root,root) %{_mandir}/man8/ssh-keysign.8*
 
 %files doc
@@ -693,6 +663,7 @@ test -f %{sysconfig_anaconda} && \
 %attr(0644,root,root) %{_mandir}/man8/ssh-pkcs11-helper.8*
 %attr(0644,root,root) %{_mandir}/man8/ssh-sk-helper.8*
 %attr(0644,root,root) %{_userunitdir}/ssh-agent.service
+%attr(0644,root,root) %{_userunitdir}/ssh-agent.socket
 
 %files server
 %dir %attr(0711,root,root) %{_datadir}/empty.sshd
@@ -713,6 +684,7 @@ test -f %{sysconfig_anaconda} && \
 %attr(0644,root,root) %{_unitdir}/sshd.socket
 %attr(0644,root,root) %{_unitdir}/sshd-keygen@.service
 %attr(0644,root,root) %{_unitdir}/sshd-keygen.target
+%attr(0644,root,root) %{_sysusersdir}/openssh-server.conf
 
 %files keycat
 %doc HOWTO.ssh-keycat
@@ -730,11 +702,14 @@ test -f %{sysconfig_anaconda} && \
 %files -n pam_ssh_agent_auth
 %license pam_ssh_agent_auth-pam_ssh_agent_auth-%{pam_ssh_agent_ver}/OPENSSH_LICENSE
 %attr(0755,root,root) %{_libdir}/security/pam_ssh_agent_auth.so
-%attr(0644,root,root) %{abidir}/pam_ssh_agent_auth.dump
 %attr(0644,root,root) %{_mandir}/man8/pam_ssh_agent_auth.8*
+%attr(0644,root,rooti) %{abidir}/pam_ssh_agent_auth.dump
 %endif
 
 %changelog
+* Thu Feb 02 2023 happy_orange <songnannan@linux.alibaba.com> - 9.0p1-1
+- update to 9.0p1
+
 * Thu Feb 02 2023 happy_orange <songnannan@linux.alibaba.com> - 8.8p1-4
 - add patches from upstream
 
diff --git a/ssh-agent.service b/ssh-agent.service
index c2150227fb5b25343f853eb3ee907e58f488b397..311f91dd758864d859fb92f470ade2dae1e8a15f 100644
--- a/ssh-agent.service
+++ b/ssh-agent.service
@@ -5,10 +5,15 @@
 ConditionEnvironment=!SSH_AGENT_PID
 Description=OpenSSH key agent
 Documentation=man:ssh-agent(1) man:ssh-add(1) man:ssh(1)
+Requires=ssh-agent.socket
 
 [Service]
 Environment=SSH_AUTH_SOCK=%t/ssh-agent.socket
+ExecStartPre=/usr/bin/rm -f $SSH_AUTH_SOCK
 ExecStart=/usr/bin/ssh-agent -a $SSH_AUTH_SOCK
 PassEnvironment=SSH_AGENT_PID
 SuccessExitStatus=2
 Type=forking
+
+[Install]
+Also=ssh-agent.socket
diff --git a/ssh-agent.socket b/ssh-agent.socket
new file mode 100644
index 0000000000000000000000000000000000000000..d589cbc8ebb8e461e0611a01c6d3e45af9345f05
--- /dev/null
+++ b/ssh-agent.socket
@@ -0,0 +1,14 @@
+[Unit]
+Description=OpenSSH key agent
+Documentation=man:ssh-agent(1) man:ssh-add(1) man:ssh(1)
+
+[Socket]
+ListenStream=%t/ssh-agent.socket
+Service=ssh-agent.service
+Priority=6
+Backlog=5
+SocketMode=0600
+DirectoryMode=0700
+
+[Install]
+WantedBy=sockets.target