docs: cover both sshd_config paths in Install RPMs

AGENTS.md

@@ -17,7 +17,7 @@ Shell scripts to backport and build OpenSSH RPMs for CentOS/RHEL-like distros (E
 ./compile.sh el7
 
 # Docker-based build (see docker/README.md for per-version commands)
-docker build -t elssh:el8 -f ./docker/Dockerfile.centos --build-arg VERSION_NUM=8 --build-arg MIRROR=0 .
+docker build -t elssh:el8 -f ./docker/Dockerfile.centos-stream --build-arg VERSION_NUM=8 .
 docker run --rm -v .:/data elssh:el8
 ```
 
@@ -29,10 +29,10 @@ docker run --rm -v .:/data elssh:el8
 
 ## Key variables
 
-- `WITH_OPENSSL`: `0` = no OpenSSL (no ssh-rsa keys), `1` = system OpenSSL, `2` = static OpenSSL (default for EL5/6/7, EL8 defaults to `1`)
+- `WITH_OPENSSL`: `0` = no OpenSSL (no ssh-rsa keys), `1` = system OpenSSL, `2` = static OpenSSL. Only the `el7` spec dir (covering EL7/8/9) auto-detects in `compile.sh` TOPDIR_SELECT: system OpenSSL >= 3 -> `1`, else `2`. EL5/EL6 leave it unset and rpmbuild falls back to `2` via `${WITH_OPENSSL:-2}`. Note `docker/docker_compile.sh` has its own overlapping auto-detect (checks openssl-devel presence + version), so behavior inside Docker may differ from a direct `./compile.sh` run.
 - `PKGREL`: package release number (defaults to `1`)
 - `M32=1`: build 32-bit RPMs (EL5 only)
-- `DOCKERBUILD=1`: when set, `pullsrc.sh` skips downloading (assumes Docker image has the sources)
+- `DOCKERBUILD=1`: when set, `pullsrc.sh` skips the openssh/openssl/askpass downloads but still fetches PERLSRC
 - `UOS20=1`: build the UOS 20 variant — enables the kernel-panic patch (`openssh-uos20-kernel-panic-fix.patch`) and prefixes `PKGREL` with `uos20.` so resulting RPMs are distinguishable.
 
 ## Architecture notes

README.md

@@ -6,7 +6,7 @@ Similar Project: [Backport OpenSSH for Debian / Ubuntu distros](https://github.c
 
 ## Supported (tested) Distro:
 
-| Distro         | Version        | Arch                | Recommanded EL RPMs                                                  |
+| Distro         | Version        | Arch                | Recommended EL RPMs                                                  |
 |----------------|----------------|---------------------|----------------------------------------------------------------------|
 | CentOS          | 5               | x86_64 / i686        | EL 5 (`rpm-el5-x86_64`, `rpm-el5-i686`)              |
 | CentOS          | 6               | x86_64               | EL 6 (`rpm-el6-x86_64`)                              |
@@ -16,6 +16,11 @@ Similar Project: [Backport OpenSSH for Debian / Ubuntu distros](https://github.c
 | CentOS Stream   | 9               | x86_64 / aarch64     | EL 9 (`rpm-el9-x86_64`, `rpm-el9-aarch64`)           |
 | Rocky Linux     | 8               | x86_64 / aarch64     | EL 8 (`rpm-el8-x86_64`, `rpm-el8-aarch64`)           |
 | Rocky Linux     | 9               | x86_64 / aarch64     | EL 9 (`rpm-el9-x86_64`, `rpm-el9-aarch64`)           |
+| AlmaLinux       | 8               | x86_64 / aarch64     | EL 8 (`rpm-el8-x86_64`, `rpm-el8-aarch64`)           |
+| AlmaLinux       | 9               | x86_64 / aarch64     | EL 9 (`rpm-el9-x86_64`, `rpm-el9-aarch64`)           |
+| Oracle Linux    | 7               | x86_64 / aarch64     | EL 7 (`rpm-el7-x86_64`, `rpm-el7-aarch64`)           |
+| Oracle Linux    | 8               | x86_64 / aarch64     | EL 8 (`rpm-el8-x86_64`, `rpm-el8-aarch64`)           |
+| Oracle Linux    | 9               | x86_64 / aarch64     | EL 9 (`rpm-el9-x86_64`, `rpm-el9-aarch64`)           |
 | Amazon Linux    | 1               | x86_64               | EL 6 (`rpm-el6-x86_64`)                              |
 | Amazon Linux    | 2               | x86_64 / aarch64     | EL 7 (`rpm-el7-x86_64`, `rpm-el7-aarch64`)           |
 | Amazon Linux    | 2023            | x86_64 / aarch64     | EL 9 (`rpm-el9-x86_64`, `rpm-el9-aarch64`)           |
@@ -64,28 +69,31 @@ yum install -y systemd-devel
 yum install -y gcc44
 ```
 
+`libXt-devel`, `libX11-devel` and `gtk2-devel` are only relevant to the EL6/EL7-era askpass subpackages — the EL8+ spec skips them (`compile.sh` passes `no_gtk2` / `skip_gnome_askpass` / `skip_x11_askpass = 1`) and the centos-stream Dockerfile doesn't install them.
+
 ## Usage
 
 ### Download RPMs
 
-You can download the needed RPMs from the GitHub Release using the GitHub
-API. The script below auto-detects your architecture and EL version from
-the running system, then fetches the matching asset from the latest
-release.
+Go to the [Releases page](https://github.com/boypt/openssh-rpms/releases)
+and download the zip file that matches your system. No script or GitHub
+API needed.
+
+Each release provides one zip per tag, named like:
+
+```
+openssh_<version>_<tag>.zip
+```
+
+e.g. `openssh_v10.5p1_b1_rpm-el8-x86_64.zip`.
+
+1. Find your distro in the "Supported (tested) Distro" table above, and
+   note the tag in the "Recommended EL RPMs" column (e.g. `rpm-el8-x86_64`).
+2. Download the zip whose name ends with that tag.
+3. Unzip it and install:
 
 ```bash
-ARCH=$(uname -m)
-# Read the system's own rpm dist tag (.el8 -> el8, .el7 -> el7, ...).
-# Override for non-elN dists (e.g. UOS 20) or when auto-detect fails.
-# If unsure which EL value to use, see the "Supported (tested) Distro"
-# table at the top of this README.
-EL=$(rpm --eval '%{?dist}' 2>/dev/null | grep -oE 'el[0-9]+' | head -1)
-[[ -z "$EL" ]] && EL=el7
-
-curl -s https://api.github.com/repos/boypt/openssh-rpms/releases/latest \
-| jq -r --arg el "$EL" --arg arch "$ARCH" \
-    '.assets[] | select(.name | ascii_downcase | contains($el) and contains($arch)) | .browser_download_url' \
-| wget -i - --show-progress -c
+unzip openssh*.zip
 ```
 
 ### Build RPMs
@@ -105,6 +113,10 @@ Note: It is unnecessary to build on each system, as most RPM-based Linux distrib
     ```
 5. The generated RPM files will be copied to the `output` directory.
 
+#### Use Docker
+
+For more details, see [docker/README.md](docker/README.md)
+
 ### Install RPMs
 
 ```bash
@@ -112,25 +124,37 @@ ls output
 # you will find multiple RPM files in this directory.
 # you may copy them to other machines, and continue following steps there.
 
-# Backup current SSH config
+# Backup current SSH config by moving it away — the new package then
+# lays down a fresh stock config, which also avoids breakage from old
+# directives (notably the GSSAPI* series) removed upstream.
 [[ -f /etc/ssh/sshd_config ]] && mv /etc/ssh/sshd_config /etc/ssh/sshd_config.$(date +%Y%m%d)
 
-# Install rpm packages.
+# Install rpm packages (`dnf` works the same on EL8/EL9).
 sudo yum --disablerepo=* localinstall -y ./openssh*.rpm
 
 # Check Installed version:
 ssh -V && /usr/sbin/sshd -V
 
+# If you skipped the backup step above, rpm kept your old config and
+# saved the package defaults as sshd_config.rpmnew (the spec marks it
+# %config(noreplace)). An old config can keep the new sshd from
+# starting, so test it — on failure either fix the offending
+# directives, or swap in the .rpmnew defaults, then re-test until it
+# passes silently:
+ls /etc/ssh/sshd_config.rpmnew
+sudo /usr/sbin/sshd -t -f /etc/ssh/sshd_config || sudo mv /etc/ssh/sshd_config{.rpmnew,}
+sudo /usr/sbin/sshd -t -f /etc/ssh/sshd_config
+
 # Restart service
-sudo service sshd restart
+sudo systemctl restart sshd   # (`service sshd restart` also works)
 
 # Test a new ssh connection
 ssh localhost
 ```
 
-**DO NOT DISCONNECET** current ssh shell yet, open a **NEW** shell and login to you machine to verify that sshd is working properly.
+**DO NOT DISCONNECT** current ssh shell yet, open a **NEW** shell and login to you machine to verify that sshd is working properly.
 
-#### Trouble shooting
+#### Troubleshooting
 
 You may get complains during the `yum localinstall` process. It's mostly because some subpackages depend on the main openssh package, upgrading only the main package won't fit in their dependencies.
 
@@ -146,9 +170,42 @@ If still not satisfied, you may try the final weapon: FORCED INSTALL.
 rpm -ivh --force --nodeps --replacepkgs --replacefiles openssh-*.rpm
 ```
 
-## Use Docker
+### Rollback to distro stock OpenSSH
 
-For more details, see [docker/README.md](docker/README.md)
+If the custom build doesn't work for you, remove it and reinstall the
+version shipped by your distro. Keep your current SSH session open until
+the rollback is verified.
+
+```bash
+# 1. Downgrade back to the distro's own versions in one yum transaction.
+# (Single yum transaction -> dependencies are handled properly and there
+# is no "RPMDB altered outside of yum" warning afterwards. If you
+# installed extra subpackages, list them here too.)
+sudo yum downgrade openssh openssh-clients openssh-server
+# On EL8/EL9, `dnf` works the same.
+
+# Fallback if downgrade is unavailable: erase first, then reinstall
+# from the distro repos (re-enable the repos if you disabled them).
+sudo rpm -e --nodeps openssh openssh-clients openssh-server
+sudo yum install -y openssh openssh-clients openssh-server
+
+# 2. Restart and verify
+sudo systemctl restart sshd   # EL7 and above (systemd)
+# sudo service sshd restart   # EL5/EL6 (SysVinit)
+ssh -V && /usr/sbin/sshd -V
+ssh localhost
+```
+
+Notes:
+
+- The default build bundles OpenSSL statically (`WITH_OPENSSL=2`), so
+  the system OpenSSL is untouched — only the `openssh` packages need
+  rolling back.
+- If the downgrade/install step can't find the packages, your base repos may be disabled or
+  (on EOL releases like EL5/EL6) moved to vault — fix the repo config
+  first.
+- Same rule as install: **DO NOT** close your current shell, open a
+  **NEW** shell to verify that login works before disconnecting.
 
 ## Other Notes
 
@@ -183,7 +240,7 @@ unaffected. For the Docker-based build, see
 
 ### Install on uniontech UOS 20
 
-UOS's `openssh-help` subpackage has files that confilict with the package. It's must be removed before installing the compiled RPMs:
+UOS's `openssh-help` subpackage has files that conflict with the package. It's must be removed before installing the compiled RPMs:
 
 ```bash
 sudo rpm --nodeps -e openssh-help

compile.sh

@@ -38,7 +38,10 @@ GUESS_DIST() {
 	fi
 
 	local dist
-	dist=$(rpm --eval '%{?dist}' | tr -d '.')
+	if ! dist=$(rpm --eval '%{?dist}' 2>/dev/null); then
+		dist=
+	fi
+	dist=${dist//./}
 
 	# Only el5/el6 have dedicated spec dirs; EL7+ (incl. EL-like rebuilds)
 	# all share the el7 systemd layout.
@@ -50,11 +53,17 @@ GUESS_DIST() {
 
 	# fallback via glibc version when %{?dist} is undefined:
 	# el5 uses glibc 2.5, el6 uses 2.12, anything newer maps to el7
-	local glibcver
-	glibcver=$(ldd --version | head -n1 | grep -Eo '[0-9]+' | tr -d '\n')
+	local glibcver ldd_version
+	ldd_version=$(ldd --version 2>&1) || true
+	ldd_version=${ldd_version%%$'\n'*}
+	if [[ $ldd_version =~ ([0-9]+\.[0-9]+) ]]; then
+		glibcver=${BASH_REMATCH[1]}
+	else
+		glibcver=
+	fi
 	case $glibcver in
-		25) echo 'el5' ;;
-		212) echo 'el6' ;;
+		2.5) echo 'el5' ;;
+		2.12) echo 'el6' ;;
 		*) echo 'el7' ;;
 	esac
 }
@@ -123,7 +132,10 @@ BUILD_RPM() {
 		[[ $(perl -e 'print $] >= 5.010 ? 1 : 0') -eq 1 ]] \
 			&& touch ./downloads/"$PERLSRC"
 
-		RPMBUILDOPTS+=('--define' "perlver ${PERLVER}" '--define' 'dist .el5')
+		RPMBUILDOPTS+=('--define' "perlver ${PERLVER}")
+		local dist
+		dist=$(rpm --eval '%{?dist}')
+		[[ -n $dist ]] || RPMBUILDOPTS+=('--define' 'dist .el5')
 		export CC=gcc44
 	fi
 

docker/README.md

@@ -18,11 +18,11 @@ All built RPM packages will be automatically placed in the `./output/` directory
 You must download the source code and tarballs before building:
 
 ```bash
-# Download all required sources
-env ALL=1 ./pullsrc.sh
+# Download the pinned sources from version.env
+./pullsrc.sh
 ```
 
-> **Note**: Run this command only once before starting any builds. It prepares all necessary files for every supported platform.
+> **Note**: Run this command only once before starting any builds. It downloads the single pinned set of sources defined in `version.env`. With `DOCKERBUILD=1 ./pullsrc.sh` only the Perl tarball is fetched (used for EL5 image builds).
 
 ## Step 2: Building RPMs for Specific Platforms
 
@@ -66,6 +66,8 @@ docker build -t elssh:el8 -f ./docker/Dockerfile.centos-stream --build-arg VERSI
 docker run --rm -v .:/data -e "UOS20=1" elssh:el8
 ```
 
+The aarch64 UOS20 build (CI artifact `rpm-uos20-aarch64`) uses the aarch64 EL8 image with `-e "UOS20=1"`.
+
 #### For EL8 (CentOS 8 / RHEL 8 / Rocky 8 / AlmaLinux 8)
 
 ```bash
@@ -82,6 +84,17 @@ docker run --rm -v .:/data elssh:el9
 
 ### aarch64 (ARM64) Builds
 
+#### For EL7 aarch64
+
+```bash
+docker build -t elssh_aarch64:el7 \
+  --platform linux/arm64 \
+  -f ./docker/Dockerfile.centos \
+  --build-arg VERSION_NUM=7 .
+
+docker run --rm -v .:/data --platform linux/arm64 elssh_aarch64:el7
+```
+
 #### For EL8 aarch64
 
 ```bash
@@ -116,35 +129,23 @@ docker run --rm -v .:/data --platform linux/arm64 elssh_aarch64:el9
 
 ## Output Location
 
-After each successful build, the RPM packages are copied to:
-
-```
-./output/
-```
-
-Typical output structure:
+After each successful build, all built `.rpm` files land directly in `./output/` (flat, no per-version subdirs):
 
 ```
 output/
-├── el5/
-│   ├── x86_64/
-│   └── i686/          # only if M32=1
-├── el6/
-├── el7/
-├── el8/
-├── el9/
-├── el8-aarch64/
-└── el9-aarch64/
+├── openssh-*.rpm
+├── openssh-clients-*.rpm
+└── ...
 ```
 
-Each subdirectory contains the generated `.rpm` files (including debuginfo if available).
+Every build (native `./compile.sh` or Docker via `docker/docker_compile.sh`) funnels through the same copy step, so building another EL version adds to / overwrites the same flat directory — copy the files out first if you need to keep versions separate.
 
 ## Quick Start Examples
 
 ### Build only for modern systems (EL8 + EL9)
 
 ```bash
-env ALL=1 ./pullsrc.sh
+./pullsrc.sh
 
 docker build -t elssh:el8 -f ./docker/Dockerfile.centos-stream --build-arg VERSION_NUM=8 .
 docker run --rm -v .:/data elssh:el8
@@ -156,7 +157,7 @@ docker run --rm -v .:/data elssh:el9
 ### Build only for ARM64
 
 ```bash
-env ALL=1 ./pullsrc.sh
+./pullsrc.sh
 
 docker build -t elssh_aarch64:el9 --platform linux/arm64 -f ./docker/Dockerfile.centos-stream --build-arg VERSION_NUM=9 .
 docker run --rm -v .:/data --platform linux/arm64 elssh_aarch64:el9