# Remember to check the upstream release/stable branches for patches

# to backport! See https://marc.info/?l=openssh-unix-dev&m=172723798122122&w=2.

inherit user-info flag-o-matic autotools optfeature pam systemd toolchain-funcs verify-sig eapi9-ver

	# Backports from upstream release branch

	#"${FILESDIR}/${PV}"

	# Our own backports

	"${FILESDIR}/${PN}-9.9_p1-x-forwarding-slow.patch"

	if ver_replacing -lt "5.8_p1"; then

		elog "Starting with openssh-5.8p1, the server will default to a newer key"

		elog "algorithm (ECDSA).  You are encouraged to manually update your stored"

		elog "keys list as servers update theirs.  See ssh-keyscan(1) for more info."

	fi

	if ver_replacing -lt "7.0_p1"; then

		elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."

		elog "Make sure to update any configs that you might have.  Note that xinetd might"

		elog "be an alternative for you as it supports USE=tcpd."

	fi

	if ver_replacing -lt "7.1_p1"; then #557388 #555518

		elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"

		elog "weak sizes.  If you rely on these key types, you can re-enable the key types by"

		elog "adding to your sshd_config or ~/.ssh/config files:"

		elog "	PubkeyAcceptedKeyTypes=+ssh-dss"

		elog "You should however generate new keys using rsa or ed25519."

		elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"

		elog "to 'prohibit-password'.  That means password auth for root users no longer works"

		elog "out of the box.  If you need this, please update your sshd_config explicitly."

	fi

	if ver_replacing -lt "7.6_p1"; then

		elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."

		elog "Furthermore, rsa keys with less than 1024 bits will be refused."

	fi

	if ver_replacing -lt "7.7_p1"; then

		elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality."

		elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option"

		elog "if you need to authenticate against LDAP."

		elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."

	fi

	if ver_replacing -lt "8.2_p1"; then

		ewarn "After upgrading to openssh-8.2p1 please restart sshd, otherwise you"

		ewarn "will not be able to establish new sessions. Restarting sshd over a ssh"

		ewarn "connection is generally safe."

	fi

	if ver_replacing -lt "9.2_p1-r1" && systemd_is_booted; then

		ewarn "From openssh-9.2_p1-r1 the supplied systemd unit file defaults to"

		ewarn "'Restart=on-failure', which causes the service to automatically restart if it"

		ewarn "terminates with an unclean exit code or signal. This feature is useful for most users,"

		ewarn "but it can increase the vulnerability of the system in the event of a future exploit."

		ewarn "If you have a web-facing setup or are concerned about security, it is recommended to"

		ewarn "set 'Restart=no' in your sshd unit file."

	fi