From d014df9577ee7807ff1b45dc0a7dbfe86d397f3c Mon Sep 17 00:00:00 2001
From: Upgrade Helper <auh@yoctoproject.org>
Date: Tue, 11 Aug 2026 05:27:02 +0000
Subject: [PATCH] openssh: upgrade 10.4p1 -> 10.5p1

Source: ChangeLog

depend
update version
upstream: add regress test for servers that hang durig banner write;
upstream: openssh-10.5
upstream: remove ml-dsa/x25519 from the default algorithm list for
upstream: make reading server banner non-blocking; prevents one
Use clang-20 when building hardenedmalloc for tests.
upstream: remove mlkem768brainpoolp256r1-sha256; requested by
upstream: move comment to a better place; suggested by markus@
upstream: add some options to allow setting or clearing the
upstream: Allow session-bind@openssh.com requests when the agent is
upstream: avoid potential realloc use-after-free in the client if a
upstream: fix up synopsis and tweak wording for -Z
upstream: document existence of
Re-allow PAMServiceName inside a Match block.
Rerun VM tests on regress Makefile change too
Run tests on regress Makefile changes too.
upstream: disable pubkey-priority test until I can fix it to not pick
upstream: Fix expected output for implicit ordering test. ok djm@
Don't enable Brainpool on AWS-LC or BoringSSL.
Correct filename in comment.
Fix OpenSSL ECC detection message.
Make EC_KEY_METHOD_new optional again.
upstream: crank up MaxAuthTries to avoid failures here
upstream: regression test for pubkey ordering in the client; ok
upstream: Tweak ordering of certificates tried during pubkey
upstream: Add a "ssh -Z user@host" mode that dumps the pubkeys that
upstream: fix ML-KEM/ECDH interop problem (does not affect
Require NISTP521 in libcrypto.
Remove support for libcrypto w/out ECC.
Add includes.h for compat interfaces.
upstream: Use ssh_mldsa44_ed25519_cleanup consistently to avoid
upstream: Fix $OpenBSD marker for easier syncing.
upstream: ssh: update kex unit test
upstream: Make mlkem768ecdh build with OPENSSL=no. ok djm@
upstream: pass back errors from ed25519 key generation, which
upstream: Move check of public key type against allowed algorithms
upstream: Fix double frees (impossible to reach outside of a test
upstream: ssh: implement mlkem768brainpoolp256r1-sha256; ok djm@
upstream: ssh: implement mlkem768nistp256-sha256; ok djm@
upstream: use sshpkt_fatal instead of plain fatal() for errors in
upstream: Automatically detect IPv6 support
upstream: Factor out all of the IPv6 addresses into variables.
Sync missed case-insensitivity changes.
Add obsd79 target.
Wording.
upstream: verify that ChannelTimeout in a Match block is effective
upstream: verify that RekeyLimit in a Match block is effective
upstream: Use -Ohashalg to restrict output to specfic hash instead
upstream: fix ChannelTimeout and RekeyLimit not being applied in
upstream: s/= - 1/= -1/; from serity---
upstream: move to a better place
upstream: use crypto_api.h #define constants for lengths; no
upstream: make authorized_keys "restrict" keyword apply correctly
upstream: in sshd config dump mode, write all directives in mixed
upstream: read ~/.ssh/id_mldsa44_ed25519 private key files by
upstream: document mldsa44-ed25519 host key and public key
upstream: when signing ho

[Changelog truncated as it exceeds 3000 characters;
the full changelog can be found in an attachment to the AUH email]
---
 ...1-regress-banner.sh-log-input-and-output-files-on-erro.patch | 2 +-
 .../openssh/{openssh_10.4p1.bb => openssh_10.5p1.bb}            | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)
 rename meta/recipes-connectivity/openssh/{openssh_10.4p1.bb => openssh_10.5p1.bb} (99%)

diff --git a/meta/recipes-connectivity/openssh/openssh/0001-regress-banner.sh-log-input-and-output-files-on-erro.patch b/meta/recipes-connectivity/openssh/openssh/0001-regress-banner.sh-log-input-and-output-files-on-erro.patch
index f424288e37..2c1c3f45ae 100644
--- a/meta/recipes-connectivity/openssh/openssh/0001-regress-banner.sh-log-input-and-output-files-on-erro.patch
+++ b/meta/recipes-connectivity/openssh/openssh/0001-regress-banner.sh-log-input-and-output-files-on-erro.patch
@@ -1,4 +1,4 @@
-From 5cc897fe2effe549e1e280c2f606bce8b532b61e Mon Sep 17 00:00:00 2001
+From 207d3428c1182de6c169f34a9e33a07c1bd00554 Mon Sep 17 00:00:00 2001
 From: Mikko Rapeli <mikko.rapeli@linaro.org>
 Date: Mon, 11 Sep 2023 09:55:21 +0100
 Subject: [PATCH] regress/banner.sh: log input and output files on error
diff --git a/meta/recipes-connectivity/openssh/openssh_10.4p1.bb b/meta/recipes-connectivity/openssh/openssh_10.5p1.bb
similarity index 99%
rename from meta/recipes-connectivity/openssh/openssh_10.4p1.bb
rename to meta/recipes-connectivity/openssh/openssh_10.5p1.bb
index 96903bbc0c..e4b6ddef9d 100644
--- a/meta/recipes-connectivity/openssh/openssh_10.4p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_10.5p1.bb
@@ -25,7 +25,7 @@ SRC_URI = "https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.ta
            file://sshd_check_keys \
            file://0001-regress-banner.sh-log-input-and-output-files-on-erro.patch \
            "
-SRC_URI[sha256sum] = "ef6026dd2aea8d56059638d5d3262902c892ceba9f88395835e0d06d3fb63238"
+SRC_URI[sha256sum] = "d44d28a839ea9daf969cc69150fde59910b2b39361dad81a3bd6cbd19218db11"
 
 CVE_STATUS[CVE-2007-2768] = "not-applicable-config: This CVE is specific to OpenSSH with the pam opie which we don't build/use here."
 
-- 
2.47.1

