4 files changed, 7 insertions, 35 deletions

diff --git a/debian/changelog b/debian/changelog
index 02909e99f..603ca1a3e 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -49,6 +49,13 @@ openssh (1:5.4p1-1) UNRELEASED; urgency=low
   * Remove SSHD_OOM_ADJUST configuration.  sshd now unconditionally makes
     itself non-OOM-killable, and doesn't require configuration to avoid log
     spam in virtualisation containers (closes: #555625).
+  * Drop Debian-specific removal of OpenSSL version check.  Upstream ignores
+    the two patchlevel nybbles now, which is sufficient to address the
+    original reason this change was introduced, and it appears that any
+    change in the major/minor/fix nybbles would involve a new libssl package
+    name.  (We'd still lose if the status nybble were ever changed, but that
+    would mean somebody had packaged a development/beta version rather than
+    a proper release, which doesn't appear to be normal practice.)
 
  -- Colin Watson <cjwatson@debian.org>  Mon, 01 Mar 2010 12:24:41 +0000
 
diff --git a/debian/patches/no-openssl-version-check.patch b/debian/patches/no-openssl-version-check.patch
deleted file mode 100644
index 82f1fa472..000000000
--- a/debian/patches/no-openssl-version-check.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-Description: Disable OpenSSL version check
- It may be that this patch should be replaced by more accurate dependencies,
- and it certainly doesn't seem suitable for upstream.  This is a very old
- change, though, and needs review of current practices in Debian's OpenSSL
- package.
-Author: Philip Hands <phil@hands.com>
-Bug-Debian: http://bugs.debian.org/93581
-Forwarded: not-needed
-Last-Update: 2010-02-28
-
-Index: b/entropy.c
-===================================================================
---- a/entropy.c
-+++ b/entropy.c
-@@ -151,6 +151,8 @@
- void
- init_rng(void)
- {
-+#if defined (DISABLED_BY_DEBIAN)
-+  /* drow: Is this check still too strict for Debian?  */
-        /*
-         * OpenSSL version numbers: MNNFFPPS: major minor fix patch status
-         * We match major, minor, fix and status (not patch)
-@@ -158,6 +160,7 @@
-        if ((SSLeay() ^ OPENSSL_VERSION_NUMBER) & ~0xff0L)
-                fatal("OpenSSL version mismatch. Built against %lx, you "
-                    "have %lx", OPENSSL_VERSION_NUMBER, SSLeay());
-+#endif
- 
- #ifndef OPENSSL_PRNG_ONLY
-        original_uid = getuid();
diff --git a/debian/patches/series b/debian/patches/series
index aaee184ee..03a17ba91 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -44,6 +44,5 @@ doc-connection-sharing.patch
 doc-hash-tab-completion.patch
 
 # Debian-specific configuration
-no-openssl-version-check.patch
 gnome-ssh-askpass2-icon.patch
 debian-config.patch
diff --git a/entropy.c b/entropy.c
index 3f63239f4..8b705397f 100644
--- a/entropy.c
+++ b/entropy.c
@@ -151,8 +151,6 @@ seed_rng(void)
 void
 init_rng(void)
 {
-#if defined (DISABLED_BY_DEBIAN)
-  /* drow: Is this check still too strict for Debian?  */
         /*
          * OpenSSL version numbers: MNNFFPPS: major minor fix patch status
          * We match major, minor, fix and status (not patch)
@@ -160,7 +158,6 @@ init_rng(void)
         if ((SSLeay() ^ OPENSSL_VERSION_NUMBER) & ~0xff0L)
                 fatal("OpenSSL version mismatch. Built against %lx, you "
                     "have %lx", OPENSSL_VERSION_NUMBER, SSLeay());
-#endif
 
 #ifndef OPENSSL_PRNG_ONLY
         original_uid = getuid();