From ec2f61e2cf68eec504d0d796610d08cf84b7fc53 Mon Sep 17 00:00:00 2001
From: Dmitry Belyavskiy <dbelyavs@redhat.com>
Date: Aug 03 2023 08:25:50 +0000
Subject: Split including crypto-policies to a separate config


Resolves: rhbz#1970566

---

diff --git a/openssh-7.7p1-redhat.patch b/openssh-7.7p1-redhat.patch
index 85ebc82..1d77f90 100644
--- a/openssh-7.7p1-redhat.patch
+++ b/openssh-7.7p1-redhat.patch
@@ -80,14 +80,7 @@ diff -up openssh/sshd_config.redhat openssh/sshd_config
 diff -up openssh/sshd_config_redhat.redhat openssh/sshd_config_redhat
 --- openssh/sshd_config_redhat.redhat	2020-02-13 18:14:02.268006439 +0100
 +++ openssh/sshd_config_redhat	2020-02-13 18:19:20.765035947 +0100
-@@ -0,0 +1,22 @@
-+# This system is following system-wide crypto policy. The changes to
-+# crypto properties (Ciphers, MACs, ...) will not have any effect in
-+# this or following included files. To override some configuration option,
-+# write it before this block or include it before this file.
-+# Please, see manual pages for update-crypto-policies(8) and sshd_config(5).
-+Include /etc/crypto-policies/back-ends/opensshserver.config
-+
+@@ -0,0 +1,15 @@
 +SyslogFacility AUTHPRIV
 +
 +ChallengeResponseAuthentication no
@@ -103,3 +96,14 @@ diff -up openssh/sshd_config_redhat.redhat openssh/sshd_config_redhat
 +# as it is more configurable and versatile than the built-in version.
 +PrintMotd no
 +
+diff -up openssh/sshd_config_redhat.redhat openssh/sshd_config_redhat
+--- openssh/sshd_config_redhat_cp.redhat	2020-02-13 18:14:02.268006439 +0100
++++ openssh/sshd_config_redhat_cp	2020-02-13 18:19:20.765035947 +0100
+@@ -0,0 +1,7 @@
++# This system is following system-wide crypto policy. The changes to
++# crypto properties (Ciphers, MACs, ...) will not have any effect in
++# this or following included files. To override some configuration option,
++# write it before this block or include it before this file.
++# Please, see manual pages for update-crypto-policies(8) and sshd_config(5).
++Include /etc/crypto-policies/back-ends/opensshserver.config
++
diff --git a/openssh.spec b/openssh.spec
index b51d10b..6a400e0 100644
--- a/openssh.spec
+++ b/openssh.spec
@@ -47,7 +47,7 @@
 
 # Do not forget to bump pam_ssh_agent_auth release if you rewind the main package release to 1
 %global openssh_ver 9.3p1
-%global openssh_rel 7
+%global openssh_rel 8
 %global pam_ssh_agent_ver 0.10.4
 %global pam_ssh_agent_rel 9
 
@@ -570,6 +570,7 @@ install -m644 %{SOURCE2} $RPM_BUILD_ROOT/etc/pam.d/sshd
 install -m644 %{SOURCE6} $RPM_BUILD_ROOT/etc/pam.d/ssh-keycat
 install -m644 %{SOURCE7} $RPM_BUILD_ROOT/etc/sysconfig/sshd
 install -m644 ssh_config_redhat $RPM_BUILD_ROOT%{_sysconfdir}/ssh/ssh_config.d/50-redhat.conf
+install -m644 sshd_config_redhat_cp $RPM_BUILD_ROOT%{_sysconfdir}/ssh/sshd_config.d/40-redhat-crypto-policies.conf
 install -m644 sshd_config_redhat $RPM_BUILD_ROOT%{_sysconfdir}/ssh/sshd_config.d/50-redhat.conf
 install -d -m755 $RPM_BUILD_ROOT/%{_unitdir}
 install -m644 %{SOURCE9} $RPM_BUILD_ROOT/%{_unitdir}/sshd@.service
@@ -706,6 +707,7 @@ test -f %{sysconfig_anaconda} && \
 %attr(0644,root,root) %{_mandir}/man8/sftp-server.8*
 %attr(0600,root,root) %config(noreplace) %{_sysconfdir}/ssh/sshd_config
 %dir %attr(0700,root,root) %{_sysconfdir}/ssh/sshd_config.d/
+%attr(0600,root,root) %config(noreplace) %{_sysconfdir}/ssh/sshd_config.d/40-redhat-crypto-policies.conf
 %attr(0600,root,root) %config(noreplace) %{_sysconfdir}/ssh/sshd_config.d/50-redhat.conf
 %attr(0644,root,root) %config(noreplace) /etc/pam.d/sshd
 %attr(0640,root,root) %config(noreplace) /etc/sysconfig/sshd
@@ -742,6 +744,9 @@ test -f %{sysconfig_anaconda} && \
 %endif
 
 %changelog
+* Thu Aug 03 2023 Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.3p1-8
+- Split including crypto-policies to a separate config (rhbz#1970566)
+
 * Tue Aug 01 2023 Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.3p1-7
 - Relax checks of OpenSSL version