5 files changed, 71 insertions, 23 deletions

diff --git a/debian/changelog b/debian/changelog
index a588623bd..2c157e7ad 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,11 +1,28 @@
-openssh (1:3.8.1p1-6) UNRELEASED; urgency=low
+openssh (1:3.8.1p1-8) unstable; urgency=high
+
+  * Matthew Vernon:
+    - Add a GPL exception to the licensing terms of the Debian patch
+      (closes: #211644).
+
+ -- Colin Watson <cjwatson@debian.org>  Thu, 29 Jul 2004 13:28:47 +0100
+
+openssh (1:3.8.1p1-7) unstable; urgency=low
+
+  * Re-enable shadow password support in openssh-server-udeb, at Bastian
+    Blank's request (closes: #260800).
+
+ -- Colin Watson <cjwatson@debian.org>  Thu, 22 Jul 2004 10:56:06 +0100
+
+openssh (1:3.8.1p1-6) unstable; urgency=low
 
   * Implement hack in
     http://lists.debian.org/debian-boot/2004/07/msg01207.html to get
     openssh-client-udeb to show up as a retrievable debian-installer
     component.
+  * Generate host keys in postinst only if the relevant HostKey directives
+    are found in sshd_config (closes: #87946).
 
- -- Colin Watson <cjwatson@debian.org>  Mon, 19 Jul 2004 20:22:39 +0100
+ -- Colin Watson <cjwatson@debian.org>  Wed, 21 Jul 2004 15:14:46 +0100
 
 openssh (1:3.8.1p1-5) unstable; urgency=medium
 
diff --git a/debian/copyright.head b/debian/copyright.head
index 6d95c8ae2..31658dbdf 100644
--- a/debian/copyright.head
+++ b/debian/copyright.head
@@ -13,6 +13,16 @@ original ssh package, which has since been renamed as ssh-nonfree.
 The Debian patch is distributed under the terms of the GPL, which you
 can find in /usr/share/common-licenses/GPL.
 
+In addition, as a special exception, Matthew Vernon gives permission
+to link the code of the Debian patch with any version of the OpenSSH
+code which is distributed under a license identical to that listed in
+the included Copyright file, and distribute linked combinations
+including the two.  You must obey the GNU General Public License in
+all respects for all of the code used other than OpenSSH.  If you
+modify this file, you may extend this exception to your version of the
+file, but you are not obligated to do so.  If you do not wish to do
+so, delete this exception statement from your version.
+
 The upstream source for this package is a combination of the ssh
 branch that is being maintained by the OpenBSD team (starting from
 the last version of SSH that was distributed under a free license),
diff --git a/debian/openssh-client-udeb.isinstallable b/debian/openssh-client-udeb.isinstallable
deleted file mode 100644
index 7591b6245..000000000
--- a/debian/openssh-client-udeb.isinstallable
+++ /dev/null
@@ -1,10 +0,0 @@
-#! /bin/sh
-
-# This is a hack to arrange for openssh-client-udeb to show up as a
-# retrievable debian-installer component in expert mode (due to the
-# Installer-Menu-Item: control field) while not actually appearing on the
-# d-i main menu. See:
-#
-#   http://lists.debian.org/debian-boot/2004/07/msg01207.html
-
-exit 1
diff --git a/debian/postinst b/debian/postinst
index ac5e1c555..1baae1677 100644
--- a/debian/postinst
+++ b/debian/postinst
@@ -27,13 +27,45 @@ check_idea_key() {
 }
 
 
+get_config_option() {
+        option="$1"
+
+        # TODO: actually only one '=' allowed after option
+        perl -ne 'print if s/^[[:space:]]*'"$option"'[[:space:]=]+//i' \
+           /etc/ssh/sshd_config
+}
+
+
+host_keys_required() {
+        hostkeys="$(get_config_option HostKey)"
+        if [ "$hostkeys" ]; then
+                echo "$hostkeys"
+        else
+                # No HostKey directives at all, so the server picks some
+                # defaults depending on the setting of Protocol.
+                protocol="$(get_config_option Protocol)"
+                [ "$protocol" ] || protocol=1,2
+                if echo "$protocol" | grep 1 >/dev/null; then
+                        echo /etc/ssh/ssh_host_key
+                fi
+                if echo "$protocol" | grep 2 >/dev/null; then
+                        echo /etc/ssh/ssh_host_rsa_key
+                        echo /etc/ssh/ssh_host_dsa_key
+                fi
+        fi
+}
+
+
 create_key() {
         msg="$1"
         shift
+        hostkeys="$1"
+        shift
         file="$1"
         shift
 
-        if [ ! -f "$file" ] ; then
+        if echo "$hostkeys" | grep -x "$file" >/dev/null && \
+           [ ! -f "$file" ] ; then
                 echo -n $msg
                 ssh-keygen -q -f "$file" -N '' "$@"
                 echo
@@ -42,16 +74,15 @@ create_key() {
 
 
 create_keys() {
-        db_get ssh/protocol2_only
-        if [ "$RET" = "false" ] ; then
-                create_key "Creating SSH1 key; this may take some time ..." \
-                        /etc/ssh/ssh_host_key -t rsa1
-        fi
+        hostkeys="$(host_keys_required)"
+
+        create_key "Creating SSH1 key; this may take some time ..." \
+                "$hostkeys" /etc/ssh/ssh_host_key -t rsa1
 
         create_key "Creating SSH2 RSA key; this may take some time ..." \
-                /etc/ssh/ssh_host_rsa_key -t rsa
+                "$hostkeys" /etc/ssh/ssh_host_rsa_key -t rsa
         create_key "Creating SSH2 DSA key; this may take some time ..." \
-                /etc/ssh/ssh_host_dsa_key -t dsa
+                "$hostkeys" /etc/ssh/ssh_host_dsa_key -t dsa
 }
 
 
@@ -304,9 +335,9 @@ setup_init() {
         fi
 }
 
+create_sshdconfig
 check_idea_key
 create_keys
-create_sshdconfig
 fix_rsh_diversion
 fix_statoverride
 create_alternatives
diff --git a/debian/rules b/debian/rules
index 6fdfcc494..4960ad921 100755
--- a/debian/rules
+++ b/debian/rules
@@ -75,7 +75,7 @@ build-udeb: build-udeb-stamp
 build-udeb-stamp:
         dh_testdir
         mkdir -p build-udeb
-        cd build-udeb && $(FORCE_LIBS) ../configure --prefix=/usr --sysconfdir=/etc/ssh --without-xauth --with-default-path=/usr/local/bin:/bin:/usr/bin --with-superuser-path=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin --with-4in6 --with-privsep-path=/var/run/sshd --without-rand-helper --without-shadow
+        cd build-udeb && $(FORCE_LIBS) ../configure --prefix=/usr --sysconfdir=/etc/ssh --without-xauth --with-default-path=/usr/local/bin:/bin:/usr/bin --with-superuser-path=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin --with-4in6 --with-privsep-path=/var/run/sshd --without-rand-helper
         # Avoid libnsl linkage. Ugh.
         perl -pi -e 's/ +-lnsl//' build-udeb/config.status
         cd build-udeb && ./config.status
@@ -215,7 +215,7 @@ binary-openssh-client-udeb: build install
         dh_compress
         dh_fixperms
         dh_installdeb
-        cp -a debian/openssh-client-udeb.isinstallable debian/openssh-client-udeb/DEBIAN/isinstallable
+        install -p -o root -g root -m 755 debian/openssh-client-udeb.isinstallable debian/openssh-client-udeb/DEBIAN/isinstallable
         dh_shlibdeps
         dh_gencontrol -- -fdebian/files~
         dpkg-distaddfile $(CLIENT_UDEB) debian-installer optional