gentoo resync : 25.11.2020

5 files changed, 214 insertions, 12 deletions

diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest
index 0151a6c4c54a..97314019114c 100644
--- a/net-misc/openssh/Manifest
+++ b/net-misc/openssh/Manifest
@@ -21,6 +21,9 @@ AUX openssh-8.2_p1-hpn-14.20-sctp-glue.patch 755 BLAKE2B 091a7cf60907c142d28b7f2
 AUX openssh-8.3_p1-X509-glue-12.5.1.patch 1721 BLAKE2B c67e6ce756d8febea9066ca52d47baff962075610ca87ee8ef9581940db020ab8889f1bb7e2809bac7c521058e835a25823f30bd6ee8b4948cbb19b7459e512c SHA512 bf356de43307cb48fd79427b22fff5bf40ad4fc72c6e906b517209f5f51bddf6a5f81d7617ad01e8434db5703df4fa45f68d4a70fd5869691536b9f82fb18b18
 AUX openssh-8.3_p1-hpn-14.20-glue.patch 6059 BLAKE2B 454178571fbf051fad6edff93c87d96f4fa62c687b03666a27e912e29c9f11d375935d0f830edff779ff73f0de16831bc54d2a7e747ff5e3951933b25f39b452 SHA512 0791c0936b4e316715e691b3ac0fa6dd03495fc30ddb68ba15a73c2f8aafb3892df5fa3c29d91e16d956f9aa3c9fd66ded8ad744834788f2fad08b807efe0a5b
 AUX openssh-8.3_p1-sha2-include.patch 370 BLAKE2B 3d9ee891d9d647f4ff3b42d47cae4c7a32533bce917b35101fd3c5549717a6b285423894b3372ecb6983d4425c712f4b0590fc95799fd521523d9d74860863c6 SHA512 a1edda5dc43af79e9e4e7d3bcd78cc1c2dbf40e94f22189022dcaf1107c8f2cb2a37c949af5955144f6ada210417a695fe0c4d05d52ba2dbafb1dddf6a1bac3f
+AUX openssh-8.4_p1-X509-glue-12.6.patch 1524 BLAKE2B de9de289b7a401726f92df2e23750df1cb26b3cc9595f1f2db7d74ffacbf4ca2a723d270ffbd0a085d44674375247f34efe04bbbd8150e67a82b6b96b8786065 SHA512 7b301e672cea87ecee89ed1eaea44ac35e2d8395696d7456690308ba1dfe671144488c7b9c79f5a238e2242eae54bca6abadd1ae448ac70cab976930f4ad5f4d
+AUX openssh-8.4_p1-fix-ssh-copy-id.patch 1070 BLAKE2B 2928bc4fbef7d70f57d1f77f4e79238dbe4b640ee891aae94ee767de98fbb04a9421bd9e071771c6d1f9818695ba329058284469ce2f01704b05351989274a1b SHA512 d6088a20e3d4cb597ca99c29fd761e06c16b8a54e7e5d0fa63a07f814fd21e831e0e5e4e3c643b99fe10e536ed98ef5f8179cab2ac79bc44e725327b8d5d5dba
+AUX openssh-8.4_p1-hpn-14.22-X509-glue.patch 4462 BLAKE2B ca35715fd95ec872e39964b499a6415065b291aa25695cc001add8da7687b73700e2c6735e1da21997fac2e31b0767b5cd44d3fcee72f4b5291546034acb1238 SHA512 e61e814646580c59a7acc7dce48250baa0c968869397582a8311ad8138180fbc3154a0bbf056c28ab7d488acf57c7dd0b3c3094bd7e9d78f5a67fdb6e195d064
 AUX openssh-8.4_p1-hpn-14.22-glue.patch 3335 BLAKE2B f5b179aaa82c17f820cdc057de4dbb832bb944668a35d37dc9ca6a390a5d3537026f816e7cb73f9474baa77f81b459af7933d0349eba9585aa9f50139f1d588c SHA512 9b1dff1150230353e7fae31a737b9d1090d3a2017ca04fdc510043fbfb962790b489204e7195f9feff0f4f16732d61ee5804b212776addee6caf7409bb9af017
 AUX openssh-8.4_p1-hpn-14.22-libressl.patch 794 BLAKE2B d204e6030a5cef333065d1c76a75a1e9d2a1a621b910fa6a2d85dc69d236abfa4448030cfb25c3965bf8851609af8f6d5217d04515c4d0ac699a6ce7be6395b6 SHA512 afeabef3df3d4a0f5dd0370477a9eff5e04abad3053e81bd88396956857669fac438474ebacb31dd41da4bb68aeff70dc9ca69f20cdb95c87ecb98d4e5fa2c37
 AUX openssh-8.4_p1-hpn-14.22-sctp-glue.patch 733 BLAKE2B 3262f5293611579202b31540eb4ff6bf24be5bd09a93d10f693b173b61eff371cce0be4ecea2ba873c7d5b250a73c032684345b53a41c369f2a5663ad15ecd41 SHA512 b39a5d76558af51db0e9b1daeaaab3d906a4c941886f8016fb7e5e89177fcd5c81904cb5b3c4d0d5935240bee43d4433ad42495f1aa21771e90013ab7726b6fe
@@ -40,6 +43,7 @@ DIST openssh-8.2p1.tar.gz 1701197 BLAKE2B 8b95cdebc87e8d14f655ed13c12b91b122adf4
 DIST openssh-8.3p1+x509-12.5.1.diff.gz 803054 BLAKE2B ec88959b4e3328e70d6f136f3d5bebced2e555de3ea40f55c535ca8a30a0eed84d177ad966e5bda46e1fc61d42141b13e96d068f5abfd069ae81b131dfb5a66c SHA512 28166a1a1aeff0c65f36263c0009e82cda81fc8f4efe3d11fabd0312d199a4f935476cf7074fbce68787d2fec0fd42f00fef383bf856a5767ce9d0ca6bbc8ef0
 DIST openssh-8.3p1-sctp-1.2.patch.xz 7668 BLAKE2B abbc65253d842c09a04811bdbafc175c5226996cdd190812b47ce9646853cd5c1b21d733e719b481cce9c7f4dc00894b6d6be732e311850963df23b9dc55a0e6 SHA512 4e0cc1707663f902dfbf331a431325da78759cc757a4aaae33e0c7f64f21830ec805168d8ae4d47a65a20c235fa534679e288f922df2b24655b7d1ee9a3bf014
 DIST openssh-8.3p1.tar.gz 1706358 BLAKE2B 0b53d92caa4a0f4cb40eee671ac889753d320b7c8e44df159a81dd8163c3663f07fa648f5dc506fb27d31893acf9701b997598c50bf204acf54172d72825a4d8 SHA512 b5232f7c85bf59ae2ff9d17b030117012e257e3b8c0d5ac60bb139a85b1fbf298b40f2e04203a2e13ca7273053ed668b9dedd54d3a67a7cb8e8e58c0228c5f40
+DIST openssh-8.4p1+x509-12.6.diff.gz 857479 BLAKE2B ac8c3e8c1087ca571e5459c9826903410ff2d45de60151d9bd8e59da15805b75752f8f3ffc231c9f8aaa8f2b2c07a97a8296684f885e0d14b54ff5d7bc585588 SHA512 e56516b376ecc3e5464895744ce0616cf4446a891fbd3cbcb090d5f61ebc349d74f9c01e855ccd22e574dbfeec0cb2ba7daf582983010ff991243a6371cc5fe3
 DIST openssh-8.4p1-sctp-1.2.patch.xz 7668 BLAKE2B 2e22d2a90723cea9ef958bd989b8c431fcb08b4dc5bfd3ebbf463ca9546dc37acdc185c35ddf3adbb90bde9b3902bf36524a456061a9bcbdef7a76ece79e2ff4 SHA512 90da34b7b86e52df9e0191c99c9d645a4d4671958adebeed46e1149102d4ba8c729eadb79d84fad9feac64aafa0541d2f1f4db8cdfe0af5ba893aac072ef2380
 DIST openssh-8.4p1.tar.gz 1742201 BLAKE2B 4b1e60d4962095df045c3a31bbf8af725b1c07324c4aa1f6b9a3ddb7e695c98e9aa01655b268f6fd6a400f511b23be91f6b89d07b14a6a2d92f873efb4d9c146 SHA512 d65275b082c46c5efe7cf3264fa6794d6e99a36d4a54b50554fc56979d6c0837381587fd5399195e1db680d2a5ad1ef0b99a180eac2b4de5637906cb7a89e9ce
 DIST openssh-8_1_P1-hpn-AES-CTR-14.20.diff 29935 BLAKE2B 79101c43601e41306c957481c0680a63357d93bededdf12a32229d50acd9c1f46a386cbb91282e9e7d7bb26a9f276f5a675fd2de7662b7cbd073322b172d3bca SHA512 94f011b7e654630e968a378375aa54fa1fde087b4426d0f2225813262e6667a1073814d6a83e9005f97b371c536e462e614bfe726b092ffed8229791592ca221
@@ -51,5 +55,5 @@ DIST openssh-8_3_P1-hpn-PeakTput-14.22.diff 2012 BLAKE2B 701f46da022e7ecf35b57f4
 EBUILD openssh-8.1_p1-r4.ebuild 16480 BLAKE2B a5e5d62c92081c5295cbbe035a83da2def0cdf22bd13da5621108d642f5537fd8c0c88849639267b0ee345c67926b6de44dd195e51bd56fdab15200eb5be7081 SHA512 a62ac99608dd98656ccf03834026af28f279eb635d7852fe2b0aea42f0d83ee0c776b63e48b14f09aa5c746ef7647ab2069edd151384ab8a2c260580ebc70873
 EBUILD openssh-8.2_p1-r7.ebuild 16906 BLAKE2B 8cd3c1a0712ebc989497e7f45b39551d07ee29928f5c64719c96cd4d1ea460259fdf437d828827954961596c4255041a65a0965db48e62b63bdf4d48c313e882 SHA512 ce10e972fa022f40ed1800eedf9f946322a993d1183a22ddd636f819da6a000594d1602a89bb4bbc7788dffce2d4a366013ac29a2ac09f1c09588ccd62965f90
 EBUILD openssh-8.3_p1-r5.ebuild 17637 BLAKE2B 53dcc07031b2379c21ad59ab66f118a048b3b2a3843ae024e473c334e4ba2975caf5756340a77a9ea7989bc040e6b3b1edddde9ecb7b3f6f1cea2e37a7406e35 SHA512 54ea55d5e87cf9beaeee2f9e8d289117200c841581ee7372eb6f0acb8c84c4d81bfc265eb7d15186494c19c3f700b87208d5a9ecbc6d41e57a0aa785239daae2
-EBUILD openssh-8.4_p1.ebuild 17654 BLAKE2B 3e5d4c01aa9a8c30ec97f5585a5161e383a9987859ea55567c8deaca194c60ff0492bdd72d28147248a894356c2d67df0fb07190a60d8bb23ba83943f4546549 SHA512 631da022c38e69469f68eebbdc06c3652248de9c55a4700708f38994e88c3be8d778aef7abde9f28f45da65cfffb210017ac3508810f5631ddf15564a7ee85a7
+EBUILD openssh-8.4_p1-r2.ebuild 17700 BLAKE2B faeeca3536a0640f46b7301e74737fce9e52aa9e7ac1c6715de2d0eda9f3d6cba356544da746d4bdd4c9f2c73758b20dd74bf9849f036218489deb75cd6b6105 SHA512 8bb9056d40334598037a9053c610cbd618f89adf2133012e8d0bb65f2497195c375815ea94deb1c1f9605e820003ffb25d968e64c23fa608370175de15d5c926
 MISC metadata.xml 2101 BLAKE2B fabe0e83b78f80666415646d7b85b296c8026f5e7465705555d03237a289208238e182919e75bec29d1113a5b7483a66b53a421e8881533af5d25c79521d9a08 SHA512 b9eb68f11fa10e763f529da88e252a94ccd89b41e857f39bf7c887ddc38c1bfd4aa9e9383a69c506080531f396ad5fdd9e1f811529a04864447a7b3e833c0e9f
diff --git a/net-misc/openssh/files/openssh-8.4_p1-X509-glue-12.6.patch b/net-misc/openssh/files/openssh-8.4_p1-X509-glue-12.6.patch
new file mode 100644
index 000000000000..f12a3096b64a
--- /dev/null
+++ b/net-misc/openssh/files/openssh-8.4_p1-X509-glue-12.6.patch
@@ -0,0 +1,34 @@
+diff -u a/openssh-8.4p1+x509-12.6.diff b/openssh-8.4p1+x509-12.6.diff
+--- a/openssh-8.4p1+x509-12.6.diff	2020-10-04 10:58:16.980495330 -0700
++++ b/openssh-8.4p1+x509-12.6.diff	2020-10-04 11:02:31.951966223 -0700
+@@ -39348,12 +39348,11 @@
+  
+  install-files:
+  	$(MKDIR_P) $(DESTDIR)$(bindir)
+-@@ -384,6 +365,8 @@
++@@ -384,6 +365,7 @@
+  	$(MKDIR_P) $(DESTDIR)$(mandir)/$(mansubdir)5
+  	$(MKDIR_P) $(DESTDIR)$(mandir)/$(mansubdir)8
+  	$(MKDIR_P) $(DESTDIR)$(libexecdir)
+ +	$(MKDIR_P) $(DESTDIR)$(sshcadir)
+-+	$(MKDIR_P) $(DESTDIR)$(piddir)
+  	$(MKDIR_P) -m 0755 $(DESTDIR)$(PRIVSEP_PATH)
+  	$(INSTALL) -m 0755 $(STRIP_OPT) ssh$(EXEEXT) $(DESTDIR)$(bindir)/ssh$(EXEEXT)
+  	$(INSTALL) -m 0755 $(STRIP_OPT) scp$(EXEEXT) $(DESTDIR)$(bindir)/scp$(EXEEXT)
+@@ -103950,16 +103949,6 @@
+ +int	 asnmprintf(char **, size_t, int *, const char *, ...)
+  	     __attribute__((format(printf, 4, 5)));
+  void	 msetlocale(void);
+-diff -ruN openssh-8.4p1/version.h openssh-8.4p1+x509-12.6/version.h
+---- openssh-8.4p1/version.h	2020-09-27 10:25:01.000000000 +0300
+-+++ openssh-8.4p1+x509-12.6/version.h	2020-10-03 10:07:00.000000000 +0300
+-@@ -2,5 +2,4 @@
+- 
+- #define SSH_VERSION	"OpenSSH_8.4"
+- 
+--#define SSH_PORTABLE	"p1"
+--#define SSH_RELEASE	SSH_VERSION SSH_PORTABLE
+-+#define SSH_RELEASE	PACKAGE_STRING ", " SSH_VERSION "p1"
+ diff -ruN openssh-8.4p1/version.m4 openssh-8.4p1+x509-12.6/version.m4
+ --- openssh-8.4p1/version.m4	1970-01-01 02:00:00.000000000 +0200
+ +++ openssh-8.4p1+x509-12.6/version.m4	2020-10-03 10:07:00.000000000 +0300
diff --git a/net-misc/openssh/files/openssh-8.4_p1-fix-ssh-copy-id.patch b/net-misc/openssh/files/openssh-8.4_p1-fix-ssh-copy-id.patch
new file mode 100644
index 000000000000..32713d43ff32
--- /dev/null
+++ b/net-misc/openssh/files/openssh-8.4_p1-fix-ssh-copy-id.patch
@@ -0,0 +1,30 @@
+From d9e727dcc04a52caaac87543ea1d230e9e6b5604 Mon Sep 17 00:00:00 2001
+From: Oleg <Fallmay@users.noreply.github.com>
+Date: Thu, 1 Oct 2020 12:09:08 +0300
+Subject: [PATCH] Fix `EOF: command not found` error in ssh-copy-id
+
+---
+ contrib/ssh-copy-id | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/contrib/ssh-copy-id b/contrib/ssh-copy-id
+index 392f64f94..a76907717 100644
+--- a/contrib/ssh-copy-id
++++ b/contrib/ssh-copy-id
+@@ -247,7 +247,7 @@ installkeys_sh() {
+   #    the -z `tail ...` checks for a trailing newline. The echo adds one if was missing
+   #    the cat adds the keys we're getting via STDIN
+   #    and if available restorecon is used to restore the SELinux context
+-  INSTALLKEYS_SH=$(tr '\t\n' ' ' <<-EOF)
++  INSTALLKEYS_SH=$(tr '\t\n' ' ' <<-EOF
+ 	cd;
+ 	umask 077;
+ 	mkdir -p $(dirname "${AUTH_KEY_FILE}") &&
+@@ -258,6 +258,7 @@ installkeys_sh() {
+ 	  restorecon -F .ssh ${AUTH_KEY_FILE};
+ 	fi
+ EOF
++  )
+ 
+   # to defend against quirky remote shells: use 'exec sh -c' to get POSIX;
+   printf "exec sh -c '%s'" "${INSTALLKEYS_SH}"
diff --git a/net-misc/openssh/files/openssh-8.4_p1-hpn-14.22-X509-glue.patch b/net-misc/openssh/files/openssh-8.4_p1-hpn-14.22-X509-glue.patch
new file mode 100644
index 000000000000..9bd600b6a1cc
--- /dev/null
+++ b/net-misc/openssh/files/openssh-8.4_p1-hpn-14.22-X509-glue.patch
@@ -0,0 +1,129 @@
+diff -u a/openssh-8_3_P1-hpn-AES-CTR-14.22.diff b/openssh-8_3_P1-hpn-AES-CTR-14.22.diff
+--- a/openssh-8_3_P1-hpn-AES-CTR-14.22.diff	2020-10-04 11:04:44.495171346 -0700
++++ b/openssh-8_3_P1-hpn-AES-CTR-14.22.diff	2020-10-04 11:48:05.099637206 -0700
+@@ -3,9 +3,9 @@
+ --- a/Makefile.in
+ +++ b/Makefile.in
+ @@ -46,7 +46,7 @@ CFLAGS=@CFLAGS@
+- CFLAGS_NOPIE=@CFLAGS_NOPIE@
+- CPPFLAGS=-I. -I$(srcdir) @CPPFLAGS@ $(PATHS) @DEFS@
+- PICFLAG=@PICFLAG@
++ LD=@LD@
++ CFLAGS=@CFLAGS@ $(CFLAGS_EXTRA)
++ CPPFLAGS=-I. -I$(srcdir) @CPPFLAGS@ @LDAP_CPPFLAGS@ $(PATHS) @DEFS@
+ -LIBS=@LIBS@
+ +LIBS=@LIBS@ -lpthread
+  K5LIBS=@K5LIBS@
+@@ -803,7 +803,7 @@
+  ssh_packet_set_connection(struct ssh *ssh, int fd_in, int fd_out)
+  {
+  	struct session_state *state;
+--	const struct sshcipher *none = cipher_by_name("none");
++-	const struct sshcipher *none = cipher_none();
+ +	struct sshcipher *none = cipher_by_name("none");
+  	int r;
+  
+@@ -901,17 +901,18 @@
+  }
+  
+  /*
+-@@ -2203,6 +2210,10 @@ fill_default_options(Options * options)
++@@ -2203,5 +2210,10 @@ fill_default_options(Options * options)
+  	if (options->sk_provider == NULL)
+  		options->sk_provider = xstrdup("$SSH_SK_PROVIDER");
+- #endif
++ 
+ +	if (options->update_hostkeys == -1)
+ +		options->update_hostkeys = 0;
+ +	if (options->disable_multithreaded == -1)
+ +		options->disable_multithreaded = 0;
+- 
+- 	/* Expand KEX name lists */
+- 	all_cipher = cipher_alg_list(',', 0);
+++
++ 	/* expand KEX and etc. name lists */
++ {	char *all;
++ #define ASSEMBLE(what, defaults, all) \
+ diff --git a/readconf.h b/readconf.h
+ index e143a108..1383a3cd 100644
+ --- a/readconf.h
+@@ -950,9 +951,9 @@
+  	/* Portable-specific options */
+  	sUsePAM,
+ +	sDisableMTAES,
+- 	/* Standard Options */
+- 	sPort, sHostKeyFile, sLoginGraceTime,
+- 	sPermitRootLogin, sLogFacility, sLogLevel,
++ 	/* X.509 Standard Options */
++ 	sHostbasedAlgorithms,
++ 	sPubkeyAlgorithms,
+ @@ -679,6 +683,7 @@ static struct {
+  	{ "authorizedprincipalsfile", sAuthorizedPrincipalsFile, SSHCFG_ALL },
+  	{ "kexalgorithms", sKexAlgorithms, SSHCFG_GLOBAL },
+diff -u a/openssh-8_3_P1-hpn-DynWinNoneSwitch-14.22.diff b/openssh-8_3_P1-hpn-DynWinNoneSwitch-14.22.diff
+--- a/openssh-8_3_P1-hpn-DynWinNoneSwitch-14.22.diff	2020-10-04 11:04:37.441213650 -0700
++++ b/openssh-8_3_P1-hpn-DynWinNoneSwitch-14.22.diff	2020-10-04 11:50:55.865616716 -0700
+@@ -382,7 +382,7 @@
+ @@ -888,6 +888,10 @@ kex_choose_conf(struct ssh *ssh)
+  	int nenc, nmac, ncomp;
+  	u_int mode, ctos, need, dh_need, authlen;
+- 	int r, first_kex_follows;
++ 	int r, first_kex_follows = 0;
+ +	int auth_flag;
+ +
+ +	auth_flag = packet_authentication_state(ssh);
+@@ -1193,14 +1193,3 @@
+  # Example of overriding settings on a per-user basis
+  #Match User anoncvs
+  #	X11Forwarding no
+-diff --git a/version.h b/version.h
+-index a2eca3ec..ff654fc3 100644
+---- a/version.h
+-+++ b/version.h
+-@@ -3,4 +3,5 @@
+- #define SSH_VERSION	"OpenSSH_8.3"
+- 
+- #define SSH_PORTABLE	"p1"
+--#define SSH_RELEASE	SSH_VERSION SSH_PORTABLE
+-+#define SSH_HPN         "-hpn14v22"
+-+#define SSH_RELEASE	SSH_VERSION SSH_PORTABLE SSH_HPN
+diff -u a/openssh-8_3_P1-hpn-PeakTput-14.22.diff b/openssh-8_3_P1-hpn-PeakTput-14.22.diff
+--- a/openssh-8_3_P1-hpn-PeakTput-14.22.diff	2020-10-04 11:51:46.409313155 -0700
++++ b/openssh-8_3_P1-hpn-PeakTput-14.22.diff	2020-10-04 11:56:57.407445258 -0700
+@@ -12,9 +12,9 @@
+  static long stalled;		/* how long we have been stalled */
+  static int bytes_per_second;	/* current speed in bytes per second */
+ @@ -127,6 +129,7 @@ refresh_progress_meter(int force_update)
++ 	off_t bytes_left;
+  	int cur_speed;
+- 	int hours, minutes, seconds;
+- 	int file_len;
++ 	int len;
+ +	off_t delta_pos;
+  
+  	if ((!force_update && !alarm_fired && !win_resized) || !can_output())
+@@ -30,15 +30,17 @@
+  	if (bytes_left > 0)
+  		elapsed = now - last_update;
+  	else {
+-@@ -166,7 +173,7 @@ refresh_progress_meter(int force_update)
++@@ -166,8 +173,8 @@ refresh_progress_meter(int force_update)
++ 	buf[1] = '\0';
+  
+  	/* filename */
+- 	buf[0] = '\0';
+--	file_len = win_size - 36;
+-+	file_len = win_size - 45;
+- 	if (file_len > 0) {
+- 		buf[0] = '\r';
+- 		snmprintf(buf+1, sizeof(buf)-1, &file_len, "%-*s",
++-	if (win_size > 36) {
++-		int file_len = win_size - 36;
+++	if (win_size > 45) {
+++		int file_len = win_size - 45;
++ 		snmprintf(buf+1, sizeof(buf)-1, &file_len, "%-*s ",
++ 		    file_len, file);
++ 	}
+ @@ -191,6 +198,15 @@ refresh_progress_meter(int force_update)
+  	    (off_t)bytes_per_second);
+  	strlcat(buf, "/s ", win_size);
diff --git a/net-misc/openssh/openssh-8.4_p1.ebuild b/net-misc/openssh/openssh-8.4_p1-r2.ebuild
index 6248805da228..4122763052b2 100644
--- a/net-misc/openssh/openssh-8.4_p1.ebuild
+++ b/net-misc/openssh/openssh-8.4_p1-r2.ebuild
@@ -21,7 +21,7 @@ HPN_PATCHES=(
 )
 
 SCTP_VER="1.2" SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
-#X509_VER="12.5.1" X509_PATCH="${PARCH}+x509-${X509_VER}.diff.gz"
+X509_VER="12.6" X509_PATCH="${PARCH}+x509-${X509_VER}.diff.gz"
 
 DESCRIPTION="Port of OpenBSD's free SSH release"
 HOMEPAGE="https://www.openssh.com/"
@@ -138,6 +138,9 @@ src_prepare() {
 	eapply "${FILESDIR}"/${PN}-8.0_p1-fix-putty-tests.patch
 	eapply "${FILESDIR}"/${PN}-8.0_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch
 
+	# https://bugs.gentoo.org/749026
+	use X509 || eapply "${FILESDIR}"/${PN}-8.4_p1-fix-ssh-copy-id.patch
+
 	# workaround for https://bugs.gentoo.org/734984
 	use X509 || eapply "${FILESDIR}"/${PN}-8.3_p1-sha2-include.patch
 
@@ -189,13 +192,7 @@ src_prepare() {
 		pushd "${hpn_patchdir}" &>/dev/null || die
 		eapply "${FILESDIR}"/${P}-hpn-${HPN_VER}-glue.patch
 		eapply "${FILESDIR}"/${PN}-8.4_p1-hpn-${HPN_VER}-libressl.patch
-		if use X509; then
-		#	einfo "Will disable MT AES cipher due to incompatbility caused by X509 patch set"
-		#	# X509 and AES-CTR-MT don't get along, let's just drop it
-		#	rm openssh-${HPN_PV//./_}-hpn-AES-CTR-${HPN_VER}.diff || die
-
-			eapply "${FILESDIR}"/${PN}-8.2_p1-hpn-${HPN_VER}-X509-glue.patch
-		fi
+		use X509 && eapply "${FILESDIR}"/${PN}-8.4_p1-hpn-${HPN_VER}-X509-glue.patch
 		use sctp && eapply "${FILESDIR}"/${PN}-8.4_p1-hpn-${HPN_VER}-sctp-glue.patch
 		popd &>/dev/null || die
 
@@ -323,8 +320,16 @@ src_configure() {
 		$(use_with !elibc_Cygwin hardening) #659210
 	)
 
-	# stackprotect is broken on musl x86 and ppc
-	use elibc_musl && ( use x86 || use ppc ) && myconf+=( --without-stackprotect )
+	if use elibc_musl; then
+		# stackprotect is broken on musl x86 and ppc
+		if use x86 || use ppc; then
+			myconf+=( --without-stackprotect )
+		fi
+
+		# musl defines bogus values for UTMP_FILE and WTMP_FILE
+		# https://bugs.gentoo.org/753230
+		myconf+=( --disable-utmp --disable-wtmp )
+	fi
 
 	# The seccomp sandbox is broken on x32, so use the older method for now. #553748
 	use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
@@ -436,7 +441,7 @@ src_install() {
 			|| die "failed to remove scp"
 	fi
 
-	keepdir /var/empty
+	rmdir "${ED}"/var/empty || die
 
 	systemd_dounit "${FILESDIR}"/sshd.{service,socket}
 	systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'