Fix `EOF: command not found` error in ssh-copy-id

Closes: #975540

5 files changed, 49 insertions, 3 deletions

diff --git a/contrib/ssh-copy-id b/contrib/ssh-copy-id
index 392f64f94..a76907717 100644
--- a/contrib/ssh-copy-id
+++ b/contrib/ssh-copy-id
@@ -247,7 +247,7 @@ installkeys_sh() {
   #    the -z `tail ...` checks for a trailing newline. The echo adds one if was missing
   #    the cat adds the keys we're getting via STDIN
   #    and if available restorecon is used to restore the SELinux context
-  INSTALLKEYS_SH=$(tr '\t\n' ' ' <<-EOF)
+  INSTALLKEYS_SH=$(tr '\t\n' ' ' <<-EOF
         cd;
         umask 077;
         mkdir -p $(dirname "${AUTH_KEY_FILE}") &&
@@ -258,6 +258,7 @@ installkeys_sh() {
           restorecon -F .ssh ${AUTH_KEY_FILE};
         fi
 EOF
+  )
 
   # to defend against quirky remote shells: use 'exec sh -c' to get POSIX;
   printf "exec sh -c '%s'" "${INSTALLKEYS_SH}"
diff --git a/debian/.git-dpm b/debian/.git-dpm
index 9ef08b0ae..2e5545893 100644
--- a/debian/.git-dpm
+++ b/debian/.git-dpm
@@ -1,6 +1,6 @@
 # see git-dpm(1) from git-dpm package
-67434174b3d64b352a794275f77489ebf1575849
-67434174b3d64b352a794275f77489ebf1575849
+27cf2f667b46a99f4469f41bcb8e004834a3d34f
+27cf2f667b46a99f4469f41bcb8e004834a3d34f
 2b2c99658e3e8ed452e28f88f9cdbcdfb2a461cb
 2b2c99658e3e8ed452e28f88f9cdbcdfb2a461cb
 openssh_8.4p1.orig.tar.gz
diff --git a/debian/changelog b/debian/changelog
index 7787f3643..4db425517 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+openssh (1:8.4p1-3) UNRELEASED; urgency=medium
+
+  * Backport from upstream:
+    - Fix `EOF: command not found` error in ssh-copy-id (closes: #975540).
+
+ -- Colin Watson <cjwatson@debian.org>  Wed, 02 Dec 2020 10:29:12 +0000
+
 openssh (1:8.4p1-2) unstable; urgency=medium
 
   * Revert incorrect upstream patch that claimed to fix the seccomp sandbox
diff --git a/debian/patches/series b/debian/patches/series
index 56019a479..5b00428bc 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -24,3 +24,4 @@ restore-authorized_keys2.patch
 conch-old-privkey-format.patch
 revert-ipqos-defaults.patch
 revert-x32-sandbox-breakage.patch
+ssh-copy-id-heredoc-syntax.patch
diff --git a/debian/patches/ssh-copy-id-heredoc-syntax.patch b/debian/patches/ssh-copy-id-heredoc-syntax.patch
new file mode 100644
index 000000000..e0259670a
--- /dev/null
+++ b/debian/patches/ssh-copy-id-heredoc-syntax.patch
@@ -0,0 +1,37 @@
+From 27cf2f667b46a99f4469f41bcb8e004834a3d34f Mon Sep 17 00:00:00 2001
+From: Oleg <Fallmay@users.noreply.github.com>
+Date: Thu, 1 Oct 2020 12:09:08 +0300
+Subject: Fix `EOF: command not found` error in ssh-copy-id
+
+Origin: upstream, https://anongit.mindrot.org/openssh.git/commit/?id=d9e727dcc04a52caaac87543ea1d230e9e6b5604
+Bug: https://github.com/openssh/openssh-portable/pull/206
+Bug-Debian: https://bugs.debian.org/975540
+Bug-Debian: https://bugs.debian.org/976242
+Last-Update: 2020-12-02
+
+Patch-Name: ssh-copy-id-heredoc-syntax.patch
+---
+ contrib/ssh-copy-id | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/contrib/ssh-copy-id b/contrib/ssh-copy-id
+index 392f64f94..a76907717 100644
+--- a/contrib/ssh-copy-id
++++ b/contrib/ssh-copy-id
+@@ -247,7 +247,7 @@ installkeys_sh() {
+   #    the -z `tail ...` checks for a trailing newline. The echo adds one if was missing
+   #    the cat adds the keys we're getting via STDIN
+   #    and if available restorecon is used to restore the SELinux context
+-  INSTALLKEYS_SH=$(tr '\t\n' ' ' <<-EOF)
++  INSTALLKEYS_SH=$(tr '\t\n' ' ' <<-EOF
+        cd;
+        umask 077;
+        mkdir -p $(dirname "${AUTH_KEY_FILE}") &&
+@@ -258,6 +258,7 @@ installkeys_sh() {
+          restorecon -F .ssh ${AUTH_KEY_FILE};
+        fi
+ EOF
++  )
+ 
+   # to defend against quirky remote shells: use 'exec sh -c' to get POSIX;
+   printf "exec sh -c '%s'" "${INSTALLKEYS_SH}"