docs: refresh READMEs, fix stale build/output docs, add rollback section

AGENTS.md

@@ -17,7 +17,7 @@ Shell scripts to backport and build OpenSSH RPMs for CentOS/RHEL-like distros (E
 ./compile.sh el7
 
 # Docker-based build (see docker/README.md for per-version commands)
-docker build -t elssh:el8 -f ./docker/Dockerfile.centos --build-arg VERSION_NUM=8 --build-arg MIRROR=0 .
+docker build -t elssh:el8 -f ./docker/Dockerfile.centos-stream --build-arg VERSION_NUM=8 .
 docker run --rm -v .:/data elssh:el8
 ```
 
@@ -29,10 +29,10 @@ docker run --rm -v .:/data elssh:el8
 
 ## Key variables
 
-- `WITH_OPENSSL`: `0` = no OpenSSL (no ssh-rsa keys), `1` = system OpenSSL, `2` = static OpenSSL (default for EL5/6/7, EL8 defaults to `1`)
+- `WITH_OPENSSL`: `0` = no OpenSSL (no ssh-rsa keys), `1` = system OpenSSL, `2` = static OpenSSL. Only the `el7` spec dir (covering EL7/8/9) auto-detects in `compile.sh` TOPDIR_SELECT: system OpenSSL >= 3 -> `1`, else `2`. EL5/EL6 leave it unset and rpmbuild falls back to `2` via `${WITH_OPENSSL:-2}`. Note `docker/docker_compile.sh` has its own overlapping auto-detect (checks openssl-devel presence + version), so behavior inside Docker may differ from a direct `./compile.sh` run.
 - `PKGREL`: package release number (defaults to `1`)
 - `M32=1`: build 32-bit RPMs (EL5 only)
-- `DOCKERBUILD=1`: when set, `pullsrc.sh` skips downloading (assumes Docker image has the sources)
+- `DOCKERBUILD=1`: when set, `pullsrc.sh` skips the openssh/openssl/askpass downloads but still fetches PERLSRC
 - `UOS20=1`: build the UOS 20 variant — enables the kernel-panic patch (`openssh-uos20-kernel-panic-fix.patch`) and prefixes `PKGREL` with `uos20.` so resulting RPMs are distinguishable.
 
 ## Architecture notes

README.md

@@ -6,7 +6,7 @@ Similar Project: [Backport OpenSSH for Debian / Ubuntu distros](https://github.c
 
 ## Supported (tested) Distro:
 
-| Distro         | Version        | Arch                | Recommanded EL RPMs                                                  |
+| Distro         | Version        | Arch                | Recommended EL RPMs                                                  |
 |----------------|----------------|---------------------|----------------------------------------------------------------------|
 | CentOS          | 5               | x86_64 / i686        | EL 5 (`rpm-el5-x86_64`, `rpm-el5-i686`)              |
 | CentOS          | 6               | x86_64               | EL 6 (`rpm-el6-x86_64`)                              |
@@ -16,6 +16,11 @@ Similar Project: [Backport OpenSSH for Debian / Ubuntu distros](https://github.c
 | CentOS Stream   | 9               | x86_64 / aarch64     | EL 9 (`rpm-el9-x86_64`, `rpm-el9-aarch64`)           |
 | Rocky Linux     | 8               | x86_64 / aarch64     | EL 8 (`rpm-el8-x86_64`, `rpm-el8-aarch64`)           |
 | Rocky Linux     | 9               | x86_64 / aarch64     | EL 9 (`rpm-el9-x86_64`, `rpm-el9-aarch64`)           |
+| AlmaLinux       | 8               | x86_64 / aarch64     | EL 8 (`rpm-el8-x86_64`, `rpm-el8-aarch64`)           |
+| AlmaLinux       | 9               | x86_64 / aarch64     | EL 9 (`rpm-el9-x86_64`, `rpm-el9-aarch64`)           |
+| Oracle Linux    | 7               | x86_64 / aarch64     | EL 7 (`rpm-el7-x86_64`, `rpm-el7-aarch64`)           |
+| Oracle Linux    | 8               | x86_64 / aarch64     | EL 8 (`rpm-el8-x86_64`, `rpm-el8-aarch64`)           |
+| Oracle Linux    | 9               | x86_64 / aarch64     | EL 9 (`rpm-el9-x86_64`, `rpm-el9-aarch64`)           |
 | Amazon Linux    | 1               | x86_64               | EL 6 (`rpm-el6-x86_64`)                              |
 | Amazon Linux    | 2               | x86_64 / aarch64     | EL 7 (`rpm-el7-x86_64`, `rpm-el7-aarch64`)           |
 | Amazon Linux    | 2023            | x86_64 / aarch64     | EL 9 (`rpm-el9-x86_64`, `rpm-el9-aarch64`)           |
@@ -64,28 +69,31 @@ yum install -y systemd-devel
 yum install -y gcc44
 ```
 
+`libXt-devel`, `libX11-devel` and `gtk2-devel` are only relevant to the EL6/EL7-era askpass subpackages — the EL8+ spec skips them (`compile.sh` passes `no_gtk2` / `skip_gnome_askpass` / `skip_x11_askpass = 1`) and the centos-stream Dockerfile doesn't install them.
+
 ## Usage
 
 ### Download RPMs
 
-You can download the needed RPMs from the GitHub Release using the GitHub
+Go to the [Releases page](https://github.com/boypt/openssh-rpms/releases)
-API. The script below auto-detects your architecture and EL version from
+and download the zip file that matches your system. No script or GitHub
-the running system, then fetches the matching asset from the latest
+API needed.
-release.
+
+Each release provides one zip per tag, named like:
+
+```
+openssh_<version>_<tag>.zip
+```
+
+e.g. `openssh_v10.5p1_b1_rpm-el8-x86_64.zip`.
+
+1. Find your distro in the "Supported (tested) Distro" table above, and
+   note the tag in the "Recommended EL RPMs" column (e.g. `rpm-el8-x86_64`).
+2. Download the zip whose name ends with that tag.
+3. Unzip it and install:
 
 ```bash
-ARCH=$(uname -m)
+unzip openssh_*_rpm-el8-x86_64.zip
-# Read the system's own rpm dist tag (.el8 -> el8, .el7 -> el7, ...).
-# Override for non-elN dists (e.g. UOS 20) or when auto-detect fails.
-# If unsure which EL value to use, see the "Supported (tested) Distro"
-# table at the top of this README.
-EL=$(rpm --eval '%{?dist}' 2>/dev/null | grep -oE 'el[0-9]+' | head -1)
-[[ -z "$EL" ]] && EL=el7
-
-curl -s https://api.github.com/repos/boypt/openssh-rpms/releases/latest \
-| jq -r --arg el "$EL" --arg arch "$ARCH" \
-    '.assets[] | select(.name | ascii_downcase | contains($el) and contains($arch)) | .browser_download_url' \
-| wget -i - --show-progress -c
 ```
 
 ### Build RPMs
@@ -115,22 +123,22 @@ ls output
 # Backup current SSH config
 [[ -f /etc/ssh/sshd_config ]] && mv /etc/ssh/sshd_config /etc/ssh/sshd_config.$(date +%Y%m%d)
 
-# Install rpm packages.
+# Install rpm packages (`dnf` works the same on EL8/EL9).
 sudo yum --disablerepo=* localinstall -y ./openssh*.rpm
 
 # Check Installed version:
 ssh -V && /usr/sbin/sshd -V
 
 # Restart service
-sudo service sshd restart
+sudo systemctl restart sshd   # (`service sshd restart` also works)
 
 # Test a new ssh connection
 ssh localhost
 ```
 
-**DO NOT DISCONNECET** current ssh shell yet, open a **NEW** shell and login to you machine to verify that sshd is working properly.
+**DO NOT DISCONNECT** current ssh shell yet, open a **NEW** shell and login to you machine to verify that sshd is working properly.
 
-#### Trouble shooting
+#### Troubleshooting
 
 You may get complains during the `yum localinstall` process. It's mostly because some subpackages depend on the main openssh package, upgrading only the main package won't fit in their dependencies.
 
@@ -146,6 +154,44 @@ If still not satisfied, you may try the final weapon: FORCED INSTALL.
 rpm -ivh --force --nodeps --replacepkgs --replacefiles openssh-*.rpm
 ```
 
+### Rollback to distro stock OpenSSH
+
+If the custom build doesn't work for you, remove it and reinstall the
+version shipped by your distro. Keep your current SSH session open until
+the rollback is verified.
+
+```bash
+# 1. Remove the custom-built packages
+sudo rpm -e openssh openssh-clients openssh-server
+# If it complains about dependencies, erase the subpackages too
+# (same list as in Troubleshooting above), or add --nodeps.
+
+# 2. Reinstall the distro's own packages from its repos
+# (re-enable the repos if you disabled them during install)
+sudo yum install -y openssh openssh-clients openssh-server
+# On EL8/EL9, `dnf` works the same.
+
+# 3. Restore the sshd_config backed up before installing
+# (`ls /etc/ssh/sshd_config.*` to find the actual dated name)
+sudo cp /etc/ssh/sshd_config.YYYYMMDD /etc/ssh/sshd_config
+
+# 4. Restart and verify
+sudo systemctl restart sshd
+ssh -V && /usr/sbin/sshd -V
+ssh localhost
+```
+
+Notes:
+
+- The default build bundles OpenSSL statically (`WITH_OPENSSL=2`), so
+  the system OpenSSL is untouched — only the `openssh` packages need
+  rolling back.
+- If step 2 can't find the packages, your base repos may be disabled or
+  (on EOL releases like EL5/EL6) moved to vault — fix the repo config
+  first.
+- Same rule as install: **DO NOT** close your current shell, open a
+  **NEW** shell to verify that login works before disconnecting.
+
 ## Use Docker
 
 For more details, see [docker/README.md](docker/README.md)
@@ -183,7 +229,7 @@ unaffected. For the Docker-based build, see
 
 ### Install on uniontech UOS 20
 
-UOS's `openssh-help` subpackage has files that confilict with the package. It's must be removed before installing the compiled RPMs:
+UOS's `openssh-help` subpackage has files that conflict with the package. It's must be removed before installing the compiled RPMs:
 
 ```bash
 sudo rpm --nodeps -e openssh-help

docker/README.md

@@ -18,11 +18,11 @@ All built RPM packages will be automatically placed in the `./output/` directory
 You must download the source code and tarballs before building:
 
 ```bash
-# Download all required sources
+# Download the pinned sources from version.env
-env ALL=1 ./pullsrc.sh
+./pullsrc.sh
 ```
 
-> **Note**: Run this command only once before starting any builds. It prepares all necessary files for every supported platform.
+> **Note**: Run this command only once before starting any builds. It downloads the single pinned set of sources defined in `version.env`. With `DOCKERBUILD=1 ./pullsrc.sh` only the Perl tarball is fetched (used for EL5 image builds).
 
 ## Step 2: Building RPMs for Specific Platforms
 
@@ -66,6 +66,8 @@ docker build -t elssh:el8 -f ./docker/Dockerfile.centos-stream --build-arg VERSI
 docker run --rm -v .:/data -e "UOS20=1" elssh:el8
 ```
 
+The aarch64 UOS20 build (CI artifact `rpm-uos20-aarch64`) uses the aarch64 EL8 image with `-e "UOS20=1"`.
+
 #### For EL8 (CentOS 8 / RHEL 8 / Rocky 8 / AlmaLinux 8)
 
 ```bash
@@ -82,6 +84,17 @@ docker run --rm -v .:/data elssh:el9
 
 ### aarch64 (ARM64) Builds
 
+#### For EL7 aarch64
+
+```bash
+docker build -t elssh_aarch64:el7 \
+  --platform linux/arm64 \
+  -f ./docker/Dockerfile.centos \
+  --build-arg VERSION_NUM=7 .
+
+docker run --rm -v .:/data --platform linux/arm64 elssh_aarch64:el7
+```
+
 #### For EL8 aarch64
 
 ```bash
@@ -116,35 +129,23 @@ docker run --rm -v .:/data --platform linux/arm64 elssh_aarch64:el9
 
 ## Output Location
 
-After each successful build, the RPM packages are copied to:
+After each successful build, all built `.rpm` files land directly in `./output/` (flat, no per-version subdirs):
-
-```
-./output/
-```
-
-Typical output structure:
 
 ```
 output/
-├── el5/
+├── openssh-*.rpm
-│   ├── x86_64/
+├── openssh-clients-*.rpm
-│   └── i686/          # only if M32=1
+└── ...
-├── el6/
-├── el7/
-├── el8/
-├── el9/
-├── el8-aarch64/
-└── el9-aarch64/
 ```
 
-Each subdirectory contains the generated `.rpm` files (including debuginfo if available).
+Every build (native `./compile.sh` or Docker via `docker/docker_compile.sh`) funnels through the same copy step, so building another EL version adds to / overwrites the same flat directory — copy the files out first if you need to keep versions separate.
 
 ## Quick Start Examples
 
 ### Build only for modern systems (EL8 + EL9)
 
 ```bash
-env ALL=1 ./pullsrc.sh
+./pullsrc.sh
 
 docker build -t elssh:el8 -f ./docker/Dockerfile.centos-stream --build-arg VERSION_NUM=8 .
 docker run --rm -v .:/data elssh:el8
@@ -156,7 +157,7 @@ docker run --rm -v .:/data elssh:el9
 ### Build only for ARM64
 
 ```bash
-env ALL=1 ./pullsrc.sh
+./pullsrc.sh
 
 docker build -t elssh_aarch64:el9 --platform linux/arm64 -f ./docker/Dockerfile.centos-stream --build-arg VERSION_NUM=9 .
 docker run --rm -v .:/data --platform linux/arm64 elssh_aarch64:el9