Since ssh-keysign isn't used by default (you need to set EnableSSHKeysign

to "yes" in /etc/ssh/ssh_config), having a debconf question to ask whether
it should be setuid is overkill, and the question text had got out of date
anyway. Remove this question, ship ssh-keysign setuid in
openssh-client.deb, and set a statoverride if the debconf question was
previously set to false.

1 files changed, 14 insertions, 7 deletions

diff --git a/debian/openssh-client.config b/debian/openssh-client.config
index 7490526fa..736e464ed 100644
--- a/debian/openssh-client.config
+++ b/debian/openssh-client.config
@@ -3,17 +3,24 @@
 action=$1
 version=$2
 
-if [ -d /etc/ssh-nonfree ] && [ ! -d /etc/ssh ]; then
-  version=1.2.27
-  cp -a /etc/ssh-nonfree /etc/ssh
-fi
-
 # Source debconf library.
 . /usr/share/debconf/confmodule
 db_version 2.0
 
-db_input medium ssh/SUID_client || true
+if [ -d /etc/ssh-nonfree ] && [ ! -d /etc/ssh ]; then
+  version=1.2.27
+  cp -a /etc/ssh-nonfree /etc/ssh
+fi
 
-db_go
+# Was ssh-keysign's setuid bit turned off using the obsolete debconf
+# question? If so, turn this into a statoverride. (Ugh.)
+if dpkg --compare-versions "$2" lt 1:4.1p1-2 && \
+    db_get ssh/SUID_client && [ "$RET" = false ] &&
+    [ -x /usr/sbin/dpkg-statoverride ] && \
+    ! dpkg-statoverride --list /usr/lib/ssh-keysign && \
+    ! dpkg-statoverride --list /usr/lib/openssh/ssh-keysign; then
+        dpkg-statoverride --update --add root root 0755 \
+                /usr/lib/openssh/ssh-keysign
+fi
 
 exit 0