diff --git a/openssh.spec b/openssh.spec
index a7687174ed9db28d906e40931df414e0cbbc2d01..714bd800f4c7223ded36801da7c7b03efadf093b 100644
--- a/openssh.spec
+++ b/openssh.spec
@@ -6,7 +6,7 @@
 %{?no_gtk2:%global gtk2 0}
 
 %global sshd_uid    74
-%global openssh_release 5
+%global openssh_release 6
 
 Name:           openssh
 Version:        8.8p1
@@ -27,9 +27,10 @@ Source10:       sshd.socket
 Source11:       sshd.service
 Source12:       sshd-keygen@.service
 Source13:       sshd-keygen
-Source14:	sshd.tmpfiles
+Source14:       sshd.tmpfiles
 Source15:       sshd-keygen.target
 Source16:       ssh-agent.service
+Source17:       ssh-keygen-bash-completion.sh
 Patch0:         backport-openssh-6.7p1-coverity.patch
 Patch1:         backport-openssh-7.6p1-audit.patch
 Patch2:         backport-openssh-7.1p2-audit-race-condition.patch
@@ -309,6 +310,7 @@ mkdir -p -m755 $RPM_BUILD_ROOT%{_sysconfdir}/ssh
 mkdir -p -m755 $RPM_BUILD_ROOT%{_sysconfdir}/ssh/ssh_config.d
 mkdir -p -m755 $RPM_BUILD_ROOT%{_libexecdir}/openssh
 mkdir -p -m755 $RPM_BUILD_ROOT%{_var}/empty/sshd
+mkdir -p -m755 $RPM_BUILD_ROOT%{_sysconfdir}/bash_completion.d
 
 %make_install
 
@@ -332,6 +334,7 @@ install -m755 contrib/ssh-copy-id $RPM_BUILD_ROOT%{_bindir}/
 install contrib/ssh-copy-id.1 $RPM_BUILD_ROOT%{_mandir}/man1/
 install -m644 -D %{SOURCE14} $RPM_BUILD_ROOT%{_tmpfilesdir}/%{name}.conf
 install contrib/gnome-ssh-askpass $RPM_BUILD_ROOT%{_libexecdir}/openssh/gnome-ssh-askpass
+install -m644 %{SOURCE17} $RPM_BUILD_ROOT/etc/bash_completion.d/ssh-keygen-bash-completion.sh
 
 ln -s gnome-ssh-askpass $RPM_BUILD_ROOT%{_libexecdir}/openssh/ssh-askpass
 install -m 755 -d $RPM_BUILD_ROOT%{_sysconfdir}/profile.d/
@@ -370,6 +373,7 @@ getent passwd sshd >/dev/null || \
 %attr(0755,root,root) %{_bindir}/ssh-keygen
 %attr(0755,root,root) %dir %{_libexecdir}/openssh
 %attr(2555,root,ssh_keys) %{_libexecdir}/openssh/ssh-keysign
+%attr(0644,root,root) %{_sysconfdir}/bash_completion.d/ssh-keygen-bash-completion.sh
 
 %files clients
 %attr(0755,root,root) %{_bindir}/ssh
@@ -426,6 +430,12 @@ getent passwd sshd >/dev/null || \
 %attr(0644,root,root) %{_mandir}/man8/sftp-server.8*
 
 %changelog
+* Wed Nov 2 2022 renmingshuai<renmingshuai@huawei.com> - 8.8p1-6
+- Type:requirement
+- CVE:NA
+- SUG:NA
+- DESC:add ssh-keygen bash completion
+
 * Tue Oct 18 2022 majun<majun65@huawei.com> - 8.8p1-5
 - Type:bugfix
 - CVE:NA
diff --git a/ssh-keygen-bash-completion.sh b/ssh-keygen-bash-completion.sh
new file mode 100644
index 0000000000000000000000000000000000000000..f6011741d4a428915ef926cbfc8bab949b9e0467
--- /dev/null
+++ b/ssh-keygen-bash-completion.sh
@@ -0,0 +1,63 @@
+# ssh-keygen(1) completion                                 -*- shell-script -*-
+
+_ssh_keygen()
+{
+    local cur prev words cword
+    _init_completion -n = || return
+
+    case $prev in
+        -*[abCIJjMNnrPSVWz])
+            return
+            ;;
+        -*E)
+            COMPREPLY=( $(compgen -W 'md5 sha256' -- "$cur") )
+            return
+            ;;
+        -*[FR])
+            # TODO: trim this down to actual entries in known hosts files
+            _known_hosts_real -- "$cur"
+            return
+            ;;
+        -*D)
+            _filedir so
+            return
+            ;;
+        -*[fGKsT])
+            _filedir
+            return
+            ;;
+        -*m)
+            COMPREPLY=( $(compgen -W 'PEM PKCS8 RFC4716' -- "$cur") )
+            return
+            ;;
+        -*O)
+            if [[ $cur != *=* ]]; then
+                COMPREPLY=( $(compgen -W 'clear force-command=
+                    no-agent-forwarding no-port-forwarding no-pty no-user-rc
+                    no-x11-forwarding permit-agent-forwarding
+                    permit-port-forwarding permit-pty permit-user-rc
+                    permit-x11-forwarding source-address=' -- "$cur") )
+                [[ $COMPREPLY == *= ]] && compopt -o nospace
+            fi
+            return
+            ;;
+        -*t)
+            local protocols=$(_xfunc ssh _ssh_query "$1" protocol-version)
+            local types='dsa ecdsa ed25519 rsa sm2'
+            if [[ $protocols == *1* ]]; then
+                types+=' rsa1'
+            fi
+            COMPREPLY=( $(compgen -W "$types" -- "$cur") )
+            return
+            ;;
+    esac
+
+    if [[ $cur == -* ]]; then
+        local opts=$(_parse_usage "$1" "-?")
+        [[ -z "$opts" ]] && opts=$(_parse_help "$1" "-?")  # OpenSSH < 7
+        COMPREPLY=( $(compgen -W "$opts" -- "$cur") )
+    fi
+} &&
+complete -F _ssh_keygen ssh-keygen
+
+# ex: filetype=sh