19 files changed, 83 insertions, 114 deletions

diff --git a/debian/patches/auth-log-verbosity.patch b/debian/patches/auth-log-verbosity.patch
index da940d9fa..bc2602306 100644
--- a/debian/patches/auth-log-verbosity.patch
+++ b/debian/patches/auth-log-verbosity.patch
@@ -47,7 +47,7 @@ Index: b/auth-options.c
                                 auth_debug_add("Your host '%.200s' is not "
                                     "permitted to use this key for login.",
                                     remote_host);
-@@ -526,11 +540,14 @@
+@@ -512,11 +526,14 @@
                                         break;
                                 case 0:
                                         /* no match */
@@ -104,7 +104,7 @@ Index: b/auth2-pubkey.c
         while (read_keyfile_line(f, file, line, sizeof(line), &linenum) != -1) {
                 /* Skip leading whitespace. */
                 for (cp = line; *cp == ' ' || *cp == '\t'; cp++)
-@@ -280,6 +281,8 @@
+@@ -281,6 +282,8 @@
         found_key = 0;
         found = key_new(key_is_cert(key) ? KEY_UNSPEC : key->type);
  
@@ -113,7 +113,7 @@ Index: b/auth2-pubkey.c
         while (read_keyfile_line(f, file, line, sizeof(line), &linenum) != -1) {
                 char *cp, *key_options = NULL;
  
-@@ -416,6 +419,7 @@
+@@ -417,6 +420,7 @@
         if (key_cert_check_authority(key, 0, 1,
             principals_file == NULL ? pw->pw_name : NULL, &reason) != 0)
                 goto fail_reason;
diff --git a/debian/patches/authorized-keys-man-symlink.patch b/debian/patches/authorized-keys-man-symlink.patch
index a9ca85407..08ba01e37 100644
--- a/debian/patches/authorized-keys-man-symlink.patch
+++ b/debian/patches/authorized-keys-man-symlink.patch
@@ -8,7 +8,7 @@ Index: b/Makefile.in
 ===================================================================
 --- a/Makefile.in
 +++ b/Makefile.in
-@@ -275,6 +275,7 @@
+@@ -276,6 +276,7 @@
         $(INSTALL) -m 644 sshd_config.5.out $(DESTDIR)$(mandir)/$(mansubdir)5/sshd_config.5
         $(INSTALL) -m 644 ssh_config.5.out $(DESTDIR)$(mandir)/$(mansubdir)5/ssh_config.5
         $(INSTALL) -m 644 sshd.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/sshd.8
diff --git a/debian/patches/cross-pkg-config.patch b/debian/patches/cross-pkg-config.patch
index 87818cd95..c25d2a6e5 100644
--- a/debian/patches/cross-pkg-config.patch
+++ b/debian/patches/cross-pkg-config.patch
@@ -8,7 +8,7 @@ Index: b/configure
 ===================================================================
 --- a/configure
 +++ b/configure
-@@ -8739,8 +8739,9 @@
+@@ -9194,8 +9194,9 @@
  if test "${with_libedit+set}" = set; then :
    withval=$with_libedit;  if test "x$withval" != "xno" ; then
                 if test "x$withval" = "xyes" ; then
@@ -20,7 +20,7 @@ Index: b/configure
  { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
  $as_echo_n "checking for $ac_word... " >&6; }
  if ${ac_cv_path_PKGCONFIG+:} false; then :
-@@ -8766,7 +8767,6 @@
+@@ -9221,7 +9222,6 @@
    done
  IFS=$as_save_IFS
  
@@ -28,7 +28,7 @@ Index: b/configure
    ;;
  esac
  fi
-@@ -8780,6 +8780,63 @@
+@@ -9235,6 +9235,63 @@
  fi
  
  
@@ -96,7 +96,7 @@ Index: b/configure.ac
 ===================================================================
 --- a/configure.ac
 +++ b/configure.ac
-@@ -1349,7 +1349,7 @@
+@@ -1434,7 +1434,7 @@
         [  --with-libedit[[=PATH]]   Enable libedit support for sftp],
         [ if test "x$withval" != "xno" ; then
                 if test "x$withval" = "xyes" ; then
diff --git a/debian/patches/debian-banner.patch b/debian/patches/debian-banner.patch
index 57ca35e87..a03ce23bb 100644
--- a/debian/patches/debian-banner.patch
+++ b/debian/patches/debian-banner.patch
@@ -71,7 +71,7 @@ Index: b/sshd.c
 ===================================================================
 --- a/sshd.c
 +++ b/sshd.c
-@@ -423,7 +423,8 @@
+@@ -424,7 +424,8 @@
                 minor = PROTOCOL_MINOR_1;
         }
         snprintf(buf, sizeof buf, "SSH-%d.%d-%.100s%s", major, minor,
diff --git a/debian/patches/debian-config.patch b/debian/patches/debian-config.patch
index 74aa53ecc..57ebbf540 100644
--- a/debian/patches/debian-config.patch
+++ b/debian/patches/debian-config.patch
@@ -24,7 +24,7 @@ Index: b/readconf.c
 ===================================================================
 --- a/readconf.c
 +++ b/readconf.c
-@@ -1268,7 +1268,7 @@
+@@ -1269,7 +1269,7 @@
         if (options->forward_x11 == -1)
                 options->forward_x11 = 0;
         if (options->forward_x11_trusted == -1)
diff --git a/debian/patches/gssapi.patch b/debian/patches/gssapi.patch
index dc293683e..d78835bd6 100644
--- a/debian/patches/gssapi.patch
+++ b/debian/patches/gssapi.patch
@@ -327,7 +327,7 @@ Index: b/clientloop.c
  /* import options */
  extern Options options;
  
-@@ -1508,6 +1512,15 @@
+@@ -1540,6 +1544,15 @@
                 /* Do channel operations unless rekeying in progress. */
                 if (!rekeying) {
                         channel_after_select(readset, writeset);
@@ -347,7 +347,7 @@ Index: b/config.h.in
 ===================================================================
 --- a/config.h.in
 +++ b/config.h.in
-@@ -1441,6 +1441,9 @@
+@@ -1465,6 +1465,9 @@
  /* Use btmp to log bad logins */
  #undef USE_BTMP
  
@@ -357,7 +357,7 @@ Index: b/config.h.in
  /* Use libedit for sftp */
  #undef USE_LIBEDIT
  
-@@ -1456,6 +1459,9 @@
+@@ -1480,6 +1483,9 @@
  /* Use PIPES instead of a socketpair() */
  #undef USE_PIPES
  
@@ -371,7 +371,7 @@ Index: b/configure
 ===================================================================
 --- a/configure
 +++ b/configure
-@@ -6521,6 +6521,63 @@
+@@ -6608,6 +6608,63 @@
  
  $as_echo "#define SSH_TUN_PREPEND_AF 1" >>confdefs.h
  
@@ -439,7 +439,7 @@ Index: b/configure.ac
 ===================================================================
 --- a/configure.ac
 +++ b/configure.ac
-@@ -515,6 +515,30 @@
+@@ -545,6 +545,30 @@
             [Use tunnel device compatibility to OpenBSD])
         AC_DEFINE([SSH_TUN_PREPEND_AF], [1],
             [Prepend the address family to IP tunnel traffic])
@@ -2059,7 +2059,7 @@ Index: b/monitor.c
         } else {
                 mon_dispatch = mon_dispatch_postauth15;
                 monitor_permit(mon_dispatch, MONITOR_REQ_TERM, 1);
-@@ -1802,6 +1819,13 @@
+@@ -1803,6 +1820,13 @@
         kex->kex[KEX_DH_GEX_SHA1] = kexgex_server;
         kex->kex[KEX_DH_GEX_SHA256] = kexgex_server;
         kex->kex[KEX_ECDH_SHA2] = kexecdh_server;
@@ -2073,7 +2073,7 @@ Index: b/monitor.c
         kex->server = 1;
         kex->hostkey_type = buffer_get_int(m);
         kex->kex_type = buffer_get_int(m);
-@@ -2008,6 +2032,9 @@
+@@ -2009,6 +2033,9 @@
         OM_uint32 major;
         u_int len;
  
@@ -2083,7 +2083,7 @@ Index: b/monitor.c
         goid.elements = buffer_get_string(m, &len);
         goid.length = len;
  
-@@ -2035,6 +2062,9 @@
+@@ -2036,6 +2063,9 @@
         OM_uint32 flags = 0; /* GSI needs this */
         u_int len;
  
@@ -2093,7 +2093,7 @@ Index: b/monitor.c
         in.value = buffer_get_string(m, &len);
         in.length = len;
         major = ssh_gssapi_accept_ctx(gsscontext, &in, &out, &flags);
-@@ -2052,6 +2082,7 @@
+@@ -2053,6 +2083,7 @@
                 monitor_permit(mon_dispatch, MONITOR_REQ_GSSSTEP, 0);
                 monitor_permit(mon_dispatch, MONITOR_REQ_GSSUSEROK, 1);
                 monitor_permit(mon_dispatch, MONITOR_REQ_GSSCHECKMIC, 1);
@@ -2101,7 +2101,7 @@ Index: b/monitor.c
         }
         return (0);
  }
-@@ -2063,6 +2094,9 @@
+@@ -2064,6 +2095,9 @@
         OM_uint32 ret;
         u_int len;
  
@@ -2111,7 +2111,7 @@ Index: b/monitor.c
         gssbuf.value = buffer_get_string(m, &len);
         gssbuf.length = len;
         mic.value = buffer_get_string(m, &len);
-@@ -2089,7 +2123,11 @@
+@@ -2090,7 +2124,11 @@
  {
         int authenticated;
  
@@ -2124,7 +2124,7 @@ Index: b/monitor.c
  
         buffer_clear(m);
         buffer_put_int(m, authenticated);
-@@ -2102,6 +2140,74 @@
+@@ -2103,6 +2141,74 @@
         /* Monitor loop will terminate if authenticated */
         return (authenticated);
  }
@@ -2326,7 +2326,7 @@ Index: b/readconf.c
  #endif
         { "fallbacktorsh", oDeprecated },
         { "usersh", oDeprecated },
-@@ -482,10 +493,30 @@
+@@ -483,10 +494,30 @@
                 intptr = &options->gss_authentication;
                 goto parse_flag;
  
@@ -2357,7 +2357,7 @@ Index: b/readconf.c
         case oBatchMode:
                 intptr = &options->batch_mode;
                 goto parse_flag;
-@@ -1138,7 +1169,12 @@
+@@ -1139,7 +1170,12 @@
         options->pubkey_authentication = -1;
         options->challenge_response_authentication = -1;
         options->gss_authentication = -1;
@@ -2370,7 +2370,7 @@ Index: b/readconf.c
         options->password_authentication = -1;
         options->kbd_interactive_authentication = -1;
         options->kbd_interactive_devices = NULL;
-@@ -1238,8 +1274,14 @@
+@@ -1239,8 +1275,14 @@
                 options->challenge_response_authentication = 1;
         if (options->gss_authentication == -1)
                 options->gss_authentication = 0;
@@ -2389,7 +2389,7 @@ Index: b/readconf.h
 ===================================================================
 --- a/readconf.h
 +++ b/readconf.h
-@@ -47,7 +47,12 @@
+@@ -48,7 +48,12 @@
         int     challenge_response_authentication;
                                         /* Try S/Key or TIS, authentication. */
         int     gss_authentication;     /* Try GSS authentication */
@@ -2893,7 +2893,7 @@ Index: b/sshd.c
  #ifdef LIBWRAP
  #include <tcpd.h>
  #include <syslog.h>
-@@ -1612,10 +1616,13 @@
+@@ -1616,10 +1620,13 @@
                 logit("Disabling protocol version 1. Could not load host key");
                 options.protocol &= ~SSH_PROTO_1;
         }
@@ -2907,7 +2907,7 @@ Index: b/sshd.c
         if (!(options.protocol & (SSH_PROTO_1|SSH_PROTO_2))) {
                 logit("sshd: no hostkeys available -- exiting.");
                 exit(1);
-@@ -1944,6 +1951,60 @@
+@@ -1948,6 +1955,60 @@
         /* Log the connection. */
         verbose("Connection from %.500s port %d", remote_ip, remote_port);
  
@@ -2968,7 +2968,7 @@ Index: b/sshd.c
         /*
          * We don't want to listen forever unless the other side
          * successfully authenticates itself.  So we set up an alarm which is
-@@ -2325,6 +2386,48 @@
+@@ -2329,6 +2390,48 @@
  
         myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = list_hostkey_types();
  
@@ -3017,7 +3017,7 @@ Index: b/sshd.c
         /* start key exchange */
         kex = kex_setup(myproposal);
         kex->kex[KEX_DH_GRP1_SHA1] = kexdh_server;
-@@ -2332,6 +2435,13 @@
+@@ -2336,6 +2439,13 @@
         kex->kex[KEX_DH_GEX_SHA1] = kexgex_server;
         kex->kex[KEX_DH_GEX_SHA256] = kexgex_server;
         kex->kex[KEX_ECDH_SHA2] = kexecdh_server;
diff --git a/debian/patches/keepalive-extensions.patch b/debian/patches/keepalive-extensions.patch
index d8362de70..eab9914f2 100644
--- a/debian/patches/keepalive-extensions.patch
+++ b/debian/patches/keepalive-extensions.patch
@@ -35,7 +35,7 @@ Index: b/readconf.c
  
         { NULL, oBadOption }
  };
-@@ -914,6 +917,8 @@
+@@ -915,6 +918,8 @@
                 goto parse_flag;
  
         case oServerAliveInterval:
@@ -44,7 +44,7 @@ Index: b/readconf.c
                 intptr = &options->server_alive_interval;
                 goto parse_time;
  
-@@ -1385,8 +1390,13 @@
+@@ -1386,8 +1391,13 @@
                 options->rekey_limit = 0;
         if (options->verify_host_key_dns == -1)
                 options->verify_host_key_dns = 0;
diff --git a/debian/patches/lintian-symlink-pickiness.patch b/debian/patches/lintian-symlink-pickiness.patch
index 7ee91cce8..12877d32f 100644
--- a/debian/patches/lintian-symlink-pickiness.patch
+++ b/debian/patches/lintian-symlink-pickiness.patch
@@ -9,7 +9,7 @@ Index: b/Makefile.in
 ===================================================================
 --- a/Makefile.in
 +++ b/Makefile.in
-@@ -282,9 +282,9 @@
+@@ -283,9 +283,9 @@
         $(INSTALL) -m 644 ssh-pkcs11-helper.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-pkcs11-helper.8
         $(INSTALL) -m 644 ssh-vulnkey.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-vulnkey.1
         -rm -f $(DESTDIR)$(bindir)/slogin
diff --git a/debian/patches/no-openssl-version-check.patch b/debian/patches/no-openssl-version-check.patch
deleted file mode 100644
index d88d0fff0..000000000
--- a/debian/patches/no-openssl-version-check.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-Description: Disable OpenSSL version check
- OpenSSL's SONAME is sufficient nowadays.
-Author: Philip Hands <phil@hands.com>
-Author: Colin Watson <cjwatson@debian.org>
-Bug-Debian: http://bugs.debian.org/93581
-Bug-Debian: http://bugs.debian.org/664383
-Forwarded: not-needed
-Last-Update: 2012-03-19
-
-Index: b/entropy.c
-===================================================================
---- a/entropy.c
-+++ b/entropy.c
-@@ -209,13 +209,6 @@
- #ifndef OPENSSL_PRNG_ONLY
-        unsigned char buf[RANDOM_SEED_SIZE];
- #endif
--       /*
--        * OpenSSL version numbers: MNNFFPPS: major minor fix patch status
--        * We match major, minor, fix and status (not patch)
--        */
--       if ((SSLeay() ^ OPENSSL_VERSION_NUMBER) & ~0xff0L)
--               fatal("OpenSSL version mismatch. Built against %lx, you "
--                   "have %lx", (u_long)OPENSSL_VERSION_NUMBER, SSLeay());
- 
- #ifndef OPENSSL_PRNG_ONLY
-        if (RAND_status() == 1) {
diff --git a/debian/patches/openbsd-docs.patch b/debian/patches/openbsd-docs.patch
index bda5f0c24..59fc441a7 100644
--- a/debian/patches/openbsd-docs.patch
+++ b/debian/patches/openbsd-docs.patch
@@ -34,7 +34,7 @@ Index: b/ssh-keygen.1
 ===================================================================
 --- a/ssh-keygen.1
 +++ b/ssh-keygen.1
-@@ -149,9 +149,7 @@
+@@ -150,9 +150,7 @@
  .Pa ~/.ssh/id_dsa
  or
  .Pa ~/.ssh/id_rsa .
@@ -45,7 +45,7 @@ Index: b/ssh-keygen.1
  .Pp
  Normally this program generates the key and asks for a file in which
  to store the private key.
-@@ -197,9 +195,7 @@
+@@ -198,9 +196,7 @@
  For each of the key types (rsa1, rsa, dsa and ecdsa) for which host keys
  do not exist, generate the host keys with the default key file path,
  an empty passphrase, default bits for the key type, and default comment.
@@ -56,7 +56,7 @@ Index: b/ssh-keygen.1
  .It Fl a Ar trials
  Specifies the number of primality tests to perform when screening DH-GEX
  candidates using the
-@@ -535,7 +531,7 @@
+@@ -544,7 +540,7 @@
  Valid generator values are 2, 3, and 5.
  .Pp
  Screened DH groups may be installed in
@@ -65,7 +65,7 @@ Index: b/ssh-keygen.1
  It is important that this file contains moduli of a range of bit lengths and
  that both ends of a connection share common moduli.
  .Sh CERTIFICATES
-@@ -661,7 +657,7 @@
+@@ -670,7 +666,7 @@
  where the user wishes to log in using public key authentication.
  There is no need to keep the contents of this file secret.
  .Pp
@@ -78,7 +78,7 @@ Index: b/ssh.1
 ===================================================================
 --- a/ssh.1
 +++ b/ssh.1
-@@ -731,6 +731,10 @@
+@@ -736,6 +736,10 @@
  .Sx HISTORY
  section of
  .Xr ssl 8
@@ -102,7 +102,7 @@ Index: b/sshd.8
  It forks a new
  daemon for each incoming connection.
  The forked daemons handle
-@@ -853,7 +853,7 @@
+@@ -856,7 +856,7 @@
  .Xr ssh 1 ) .
  It should only be writable by root.
  .Pp
@@ -111,7 +111,7 @@ Index: b/sshd.8
  Contains Diffie-Hellman groups used for the "Diffie-Hellman Group Exchange".
  The file format is described in
  .Xr moduli 5 .
-@@ -951,7 +951,6 @@
+@@ -954,7 +954,6 @@
  .Xr ssh-vulnkey 1 ,
  .Xr chroot 2 ,
  .Xr hosts_access 5 ,
diff --git a/debian/patches/package-versioning.patch b/debian/patches/package-versioning.patch
index 95444cbd4..64606e2e9 100644
--- a/debian/patches/package-versioning.patch
+++ b/debian/patches/package-versioning.patch
@@ -24,7 +24,7 @@ Index: b/sshd.c
 ===================================================================
 --- a/sshd.c
 +++ b/sshd.c
-@@ -423,7 +423,7 @@
+@@ -424,7 +424,7 @@
                 minor = PROTOCOL_MINOR_1;
         }
         snprintf(buf, sizeof buf, "SSH-%d.%d-%.100s%s", major, minor,
@@ -38,7 +38,7 @@ Index: b/version.h
 --- a/version.h
 +++ b/version.h
 @@ -3,4 +3,9 @@
- #define SSH_VERSION    "OpenSSH_5.9"
+ #define SSH_VERSION    "OpenSSH_6.0"
  
  #define SSH_PORTABLE   "p1"
 -#define SSH_RELEASE    SSH_VERSION SSH_PORTABLE
diff --git a/debian/patches/quieter-signals.patch b/debian/patches/quieter-signals.patch
index ff41f094d..db2cba1e1 100644
--- a/debian/patches/quieter-signals.patch
+++ b/debian/patches/quieter-signals.patch
@@ -16,7 +16,7 @@ Index: b/clientloop.c
 ===================================================================
 --- a/clientloop.c
 +++ b/clientloop.c
-@@ -1619,8 +1619,10 @@
+@@ -1651,8 +1651,10 @@
                 exit_status = 0;
         }
  
diff --git a/debian/patches/selinux-role.patch b/debian/patches/selinux-role.patch
index b14402199..0d696989a 100644
--- a/debian/patches/selinux-role.patch
+++ b/debian/patches/selinux-role.patch
@@ -108,7 +108,7 @@ Index: b/monitor.c
      {MONITOR_REQ_AUTH2_READ_BANNER, MON_ONCE, mm_answer_auth2_read_banner},
      {MONITOR_REQ_AUTHPASSWORD, MON_AUTH, mm_answer_authpassword},
  #ifdef USE_PAM
-@@ -810,6 +812,7 @@
+@@ -811,6 +813,7 @@
         else {
                 /* Allow service/style information on the auth context */
                 monitor_permit(mon_dispatch, MONITOR_REQ_AUTHSERV, 1);
@@ -116,7 +116,7 @@ Index: b/monitor.c
                 monitor_permit(mon_dispatch, MONITOR_REQ_AUTH2_READ_BANNER, 1);
         }
  #ifdef USE_PAM
-@@ -842,14 +845,37 @@
+@@ -843,14 +846,37 @@
  
         authctxt->service = buffer_get_string(m, NULL);
         authctxt->style = buffer_get_string(m, NULL);
@@ -156,7 +156,7 @@ Index: b/monitor.c
         return (0);
  }
  
-@@ -1437,7 +1463,7 @@
+@@ -1438,7 +1464,7 @@
         res = pty_allocate(&s->ptyfd, &s->ttyfd, s->tty, sizeof(s->tty));
         if (res == 0)
                 goto error;
@@ -256,18 +256,15 @@ Index: b/openbsd-compat/port-linux.c
  #include "log.h"
  #include "xmalloc.h"
  #include "port-linux.h"
-@@ -58,9 +64,9 @@
+@@ -58,7 +64,7 @@
  
  /* Return the default security context for the given username */
  static security_context_t
 -ssh_selinux_getctxbyname(char *pwname)
 +ssh_selinux_getctxbyname(char *pwname, const char *role)
  {
--       security_context_t sc;
-+       security_context_t sc = NULL;
+        security_context_t sc = NULL;
         char *sename = NULL, *lvl = NULL;
-        int r;
- 
 @@ -73,9 +79,16 @@
  #endif
  
@@ -287,7 +284,7 @@ Index: b/openbsd-compat/port-linux.c
  #endif
  
         if (r != 0) {
-@@ -106,7 +119,7 @@
+@@ -107,7 +120,7 @@
  
  /* Set the execution context to the default for the specified user */
  void
@@ -296,7 +293,7 @@ Index: b/openbsd-compat/port-linux.c
  {
         security_context_t user_ctx = NULL;
  
-@@ -115,7 +128,7 @@
+@@ -116,7 +129,7 @@
  
         debug3("%s: setting execution context", __func__);
  
@@ -305,7 +302,7 @@ Index: b/openbsd-compat/port-linux.c
         if (setexeccon(user_ctx) != 0) {
                 switch (security_getenforce()) {
                 case -1:
-@@ -137,7 +150,7 @@
+@@ -138,7 +151,7 @@
  
  /* Set the TTY context for the specified user */
  void
@@ -314,7 +311,7 @@ Index: b/openbsd-compat/port-linux.c
  {
         security_context_t new_tty_ctx = NULL;
         security_context_t user_ctx = NULL;
-@@ -148,7 +161,7 @@
+@@ -149,7 +162,7 @@
  
         debug3("%s: setting TTY context on %s", __func__, tty);
  
@@ -439,7 +436,7 @@ Index: b/sshd.c
 ===================================================================
 --- a/sshd.c
 +++ b/sshd.c
-@@ -730,7 +730,7 @@
+@@ -734,7 +734,7 @@
         RAND_seed(rnd, sizeof(rnd));
  
         /* Drop privileges */
diff --git a/debian/patches/series b/debian/patches/series
index ceeb32499..2c3fdb668 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -40,6 +40,5 @@ auth-log-verbosity.patch
 cross-pkg-config.patch
 
 # Debian-specific configuration
-no-openssl-version-check.patch
 gnome-ssh-askpass2-icon.patch
 debian-config.patch
diff --git a/debian/patches/ssh-argv0.patch b/debian/patches/ssh-argv0.patch
index a7750ed23..3cc1272ec 100644
--- a/debian/patches/ssh-argv0.patch
+++ b/debian/patches/ssh-argv0.patch
@@ -11,7 +11,7 @@ Index: b/ssh.1
 ===================================================================
 --- a/ssh.1
 +++ b/ssh.1
-@@ -1411,6 +1411,7 @@
+@@ -1425,6 +1425,7 @@
  .Xr sftp 1 ,
  .Xr ssh-add 1 ,
  .Xr ssh-agent 1 ,
diff --git a/debian/patches/ssh-vulnkey.patch b/debian/patches/ssh-vulnkey.patch
index 4245319c3..d60816d46 100644
--- a/debian/patches/ssh-vulnkey.patch
+++ b/debian/patches/ssh-vulnkey.patch
@@ -39,9 +39,9 @@ Index: b/Makefile.in
  
  LIBSSH_OBJS=acss.o authfd.o authfile.o bufaux.o bufbn.o buffer.o \
         canohost.o channels.o cipher.o cipher-acss.o cipher-aes.o \
-@@ -93,8 +95,8 @@
-        roaming_common.o roaming_serv.o \
-        sandbox-null.o sandbox-rlimit.o sandbox-systrace.o sandbox-darwin.o
+@@ -94,8 +96,8 @@
+        sandbox-null.o sandbox-rlimit.o sandbox-systrace.o sandbox-darwin.o \
+        sandbox-seccomp-filter.o
  
 -MANPAGES       = moduli.5.out scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-keysign.8.out ssh-pkcs11-helper.8.out sshd_config.5.out ssh_config.5.out
 -MANPAGES_IN    = moduli.5 scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-keysign.8 ssh-pkcs11-helper.8 sshd_config.5 ssh_config.5
@@ -50,7 +50,7 @@ Index: b/Makefile.in
  MANTYPE                = @MANTYPE@
  
  CONFIGFILES=sshd_config.out ssh_config.out moduli.out
-@@ -171,6 +173,9 @@
+@@ -172,6 +174,9 @@
  sftp$(EXEEXT): $(LIBCOMPAT) libssh.a sftp.o sftp-client.o sftp-common.o sftp-glob.o progressmeter.o
         $(LD) -o $@ progressmeter.o sftp.o sftp-client.o sftp-common.o sftp-glob.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS) $(LIBEDIT)
  
@@ -60,7 +60,7 @@ Index: b/Makefile.in
  # test driver for the loginrec code - not built by default
  logintest: logintest.o $(LIBCOMPAT) libssh.a loginrec.o
         $(LD) -o $@ logintest.o $(LDFLAGS) loginrec.o -lopenbsd-compat -lssh $(LIBS)
-@@ -259,6 +264,7 @@
+@@ -260,6 +265,7 @@
         $(INSTALL) -m 0755 $(STRIP_OPT) ssh-pkcs11-helper$(EXEEXT) $(DESTDIR)$(SSH_PKCS11_HELPER)$(EXEEXT)
         $(INSTALL) -m 0755 $(STRIP_OPT) sftp$(EXEEXT) $(DESTDIR)$(bindir)/sftp$(EXEEXT)
         $(INSTALL) -m 0755 $(STRIP_OPT) sftp-server$(EXEEXT) $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
@@ -68,7 +68,7 @@ Index: b/Makefile.in
         $(INSTALL) -m 644 ssh.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1
         $(INSTALL) -m 644 scp.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/scp.1
         $(INSTALL) -m 644 ssh-add.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-add.1
-@@ -273,6 +279,7 @@
+@@ -274,6 +280,7 @@
         $(INSTALL) -m 644 sftp-server.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/sftp-server.8
         $(INSTALL) -m 644 ssh-keysign.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8
         $(INSTALL) -m 644 ssh-pkcs11-helper.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-pkcs11-helper.8
@@ -76,7 +76,7 @@ Index: b/Makefile.in
         -rm -f $(DESTDIR)$(bindir)/slogin
         ln -s ./ssh$(EXEEXT) $(DESTDIR)$(bindir)/slogin
         -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/slogin.1
-@@ -354,6 +361,7 @@
+@@ -355,6 +362,7 @@
         -rm -f $(DESTDIR)$(bindir)/ssh-agent$(EXEEXT)
         -rm -f $(DESTDIR)$(bindir)/ssh-keygen$(EXEEXT)
         -rm -f $(DESTDIR)$(bindir)/ssh-keyscan$(EXEEXT)
@@ -84,7 +84,7 @@ Index: b/Makefile.in
         -rm -f $(DESTDIR)$(bindir)/sftp$(EXEEXT)
         -rm -f $(DESTDIR)$(sbindir)/sshd$(EXEEXT)
         -rm -r $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
-@@ -366,6 +374,7 @@
+@@ -367,6 +375,7 @@
         -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-keygen.1
         -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/sftp.1
         -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-keyscan.1
@@ -196,7 +196,7 @@ Index: b/auth2-pubkey.c
 ===================================================================
 --- a/auth2-pubkey.c
 +++ b/auth2-pubkey.c
-@@ -439,9 +439,10 @@
+@@ -440,9 +440,10 @@
         u_int success, i;
         char *file;
  
@@ -418,7 +418,7 @@ Index: b/readconf.c
         { "rsaauthentication", oRSAAuthentication },
         { "pubkeyauthentication", oPubkeyAuthentication },
         { "dsaauthentication", oPubkeyAuthentication },             /* alias */
-@@ -489,6 +491,10 @@
+@@ -490,6 +492,10 @@
                 intptr = &options->challenge_response_authentication;
                 goto parse_flag;
  
@@ -429,7 +429,7 @@ Index: b/readconf.c
         case oGssAuthentication:
                 intptr = &options->gss_authentication;
                 goto parse_flag;
-@@ -1180,6 +1186,7 @@
+@@ -1181,6 +1187,7 @@
         options->kbd_interactive_devices = NULL;
         options->rhosts_rsa_authentication = -1;
         options->hostbased_authentication = -1;
@@ -437,7 +437,7 @@ Index: b/readconf.c
         options->batch_mode = -1;
         options->check_host_ip = -1;
         options->strict_host_key_checking = -1;
-@@ -1290,6 +1297,8 @@
+@@ -1291,6 +1298,8 @@
                 options->rhosts_rsa_authentication = 0;
         if (options->hostbased_authentication == -1)
                 options->hostbased_authentication = 0;
@@ -450,7 +450,7 @@ Index: b/readconf.h
 ===================================================================
 --- a/readconf.h
 +++ b/readconf.h
-@@ -58,6 +58,7 @@
+@@ -59,6 +59,7 @@
         int     kbd_interactive_authentication; /* Try keyboard-interactive auth. */
         char    *kbd_interactive_devices; /* Keyboard-interactive auth devices. */
         int     zero_knowledge_password_authentication; /* Try jpake */
@@ -542,7 +542,7 @@ Index: b/ssh-add.1
  The options are as follows:
  .Bl -tag -width Ds
  .It Fl c
-@@ -183,6 +187,7 @@
+@@ -186,6 +190,7 @@
  .Xr ssh 1 ,
  .Xr ssh-agent 1 ,
  .Xr ssh-keygen 1 ,
@@ -555,12 +555,12 @@ Index: b/ssh-add.c
 --- a/ssh-add.c
 +++ b/ssh-add.c
 @@ -142,7 +142,7 @@
- add_file(AuthenticationConnection *ac, const char *filename)
+ add_file(AuthenticationConnection *ac, const char *filename, int key_only)
  {
         Key *private, *cert;
 -       char *comment = NULL;
 +       char *comment = NULL, *fp;
-        char msg[1024], *certpath;
+        char msg[1024], *certpath = NULL;
         int fd, perms_ok, ret = -1;
         Buffer keyblob;
 @@ -218,6 +218,14 @@
@@ -576,13 +576,13 @@ Index: b/ssh-add.c
 +               return -1;
 +       }
  
- 
-        /* Now try to add the certificate flavour too */
+        /* Skip trying to load the cert if requested */
+        if (key_only)
 Index: b/ssh-keygen.1
 ===================================================================
 --- a/ssh-keygen.1
 +++ b/ssh-keygen.1
-@@ -670,6 +670,7 @@
+@@ -679,6 +679,7 @@
  .Xr ssh 1 ,
  .Xr ssh-add 1 ,
  .Xr ssh-agent 1 ,
@@ -1233,7 +1233,7 @@ Index: b/ssh.1
 ===================================================================
 --- a/ssh.1
 +++ b/ssh.1
-@@ -1407,6 +1407,7 @@
+@@ -1421,6 +1421,7 @@
  .Xr ssh-agent 1 ,
  .Xr ssh-keygen 1 ,
  .Xr ssh-keyscan 1 ,
@@ -1245,7 +1245,7 @@ Index: b/ssh.c
 ===================================================================
 --- a/ssh.c
 +++ b/ssh.c
-@@ -1476,7 +1476,7 @@
+@@ -1492,7 +1492,7 @@
  static void
  load_public_identity_files(void)
  {
@@ -1254,7 +1254,7 @@ Index: b/ssh.c
         char *pwdir = NULL, *pwname = NULL;
         int i = 0;
         Key *public;
-@@ -1533,6 +1533,22 @@
+@@ -1549,6 +1549,22 @@
                 public = key_load_public(filename, NULL);
                 debug("identity file %s type %d", filename,
                     public ? public->type : -1);
@@ -1331,7 +1331,7 @@ Index: b/sshd.8
 ===================================================================
 --- a/sshd.8
 +++ b/sshd.8
-@@ -948,6 +948,7 @@
+@@ -951,6 +951,7 @@
  .Xr ssh-agent 1 ,
  .Xr ssh-keygen 1 ,
  .Xr ssh-keyscan 1 ,
@@ -1343,7 +1343,7 @@ Index: b/sshd.c
 ===================================================================
 --- a/sshd.c
 +++ b/sshd.c
-@@ -1598,6 +1598,11 @@
+@@ -1602,6 +1602,11 @@
                         sensitive_data.host_keys[i] = NULL;
                         continue;
                 }
diff --git a/debian/patches/ssh1-keepalive.patch b/debian/patches/ssh1-keepalive.patch
index d5a7fe07a..2acf9704f 100644
--- a/debian/patches/ssh1-keepalive.patch
+++ b/debian/patches/ssh1-keepalive.patch
@@ -7,7 +7,7 @@ Index: b/clientloop.c
 ===================================================================
 --- a/clientloop.c
 +++ b/clientloop.c
-@@ -545,16 +545,21 @@
+@@ -565,16 +565,21 @@
  static void
  server_alive_check(void)
  {
@@ -38,7 +38,7 @@ Index: b/clientloop.c
  }
  
  /*
-@@ -614,7 +619,7 @@
+@@ -634,7 +639,7 @@
          */
  
         timeout_secs = INT_MAX; /* we use INT_MAX to mean no timeout */
diff --git a/debian/patches/syslog-level-silent.patch b/debian/patches/syslog-level-silent.patch
index 90ddca4ad..07e2974aa 100644
--- a/debian/patches/syslog-level-silent.patch
+++ b/debian/patches/syslog-level-silent.patch
@@ -26,7 +26,7 @@ Index: b/ssh.c
 ===================================================================
 --- a/ssh.c
 +++ b/ssh.c
-@@ -678,7 +678,7 @@
+@@ -680,7 +680,7 @@
         /* Do not allocate a tty if stdin is not a tty. */
         if ((!isatty(fileno(stdin)) || stdin_null_flag) &&
             options.request_tty != REQUEST_TTY_FORCE) {
diff --git a/debian/patches/user-group-modes.patch b/debian/patches/user-group-modes.patch
index 01ba05526..8e4ee3eb1 100644
--- a/debian/patches/user-group-modes.patch
+++ b/debian/patches/user-group-modes.patch
@@ -24,7 +24,7 @@ Index: b/readconf.c
  
  #include "xmalloc.h"
  #include "ssh.h"
-@@ -1131,8 +1133,7 @@
+@@ -1132,8 +1134,7 @@
  
                 if (fstat(fileno(f), &sb) == -1)
                         fatal("fstat %s: %s", filename, strerror(errno));
@@ -38,7 +38,7 @@ Index: b/ssh.1
 ===================================================================
 --- a/ssh.1
 +++ b/ssh.1
-@@ -1298,6 +1298,8 @@
+@@ -1312,6 +1312,8 @@
  .Xr ssh_config 5 .
  Because of the potential for abuse, this file must have strict permissions:
  read/write for the user, and not accessible by others.