docs: cover both sshd_config paths in Install RPMs

docs: nest Use Docker under Build RPMs, add rollback and sshd -t config check
docs: simplify Download RPMs, add rollback section
2026-09-20 08:03:38 +08:00 · 2026-09-17 14:09:54 +08:00 · 2026-09-17 14:06:45 +08:00 · 2026-09-17 13:53:15 +08:00 · 2026-09-17 13:44:33 +08:00 · 2026-08-26 11:24:48 +08:00
43 changed files with 1597 additions and 1643 deletions
--- a/.github/workflows/build-images.yml
+++ b/.github/workflows/build-images.yml
@@ -19,47 +19,47 @@ jobs:
          - tag_suffix: el5
            dockerfile: ./docker/Dockerfile.centos5
            build_args: |
-              CHINA_MIRROR=0
          - tag_suffix: el6
            dockerfile: ./docker/Dockerfile.centos
            build_args: |
              VERSION_NUM=6
-              CHINA_MIRROR=0
          - tag_suffix: el7
            dockerfile: ./docker/Dockerfile.centos
            build_args: |
              VERSION_NUM=7
-              CHINA_MIRROR=0
          - tag_suffix: el8
-            dockerfile: ./docker/Dockerfile.centos
+            dockerfile: ./docker/Dockerfile.centos-stream
            build_args: |
              VERSION_NUM=8
-              CHINA_MIRROR=0
          - tag_suffix: el9
            dockerfile: ./docker/Dockerfile.centos-stream
            build_args: |
              VERSION_NUM=9
-              CHINA_MIRROR=0

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+          persist-credentials: false

-      - name: Run pullsrc.sh
-        run: env ALL=1 ./pullsrc.sh
+      - name: Pull Sources for CentOS 5
+        if: matrix.tag_suffix == 'el5'
+        run: |
+          env DOCKERBUILD=1 ./pullsrc.sh

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4

      - name: Log in to Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v7
        with:
          context: .
          file: ${{ matrix.dockerfile }}
@@ -69,74 +69,56 @@ jobs:
          cache-from: type=gha
          cache-to: type=gha,mode=max

-  build-arm64-el8:
+  build-arm64:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
+    strategy:
+      matrix:
+        include:
+          - tag_suffix: aarch64_el7
+            dockerfile: ./docker/Dockerfile.centos
+            build_args: |
+              VERSION_NUM=7
+          - tag_suffix: aarch64_el8
+            dockerfile: ./docker/Dockerfile.centos-stream
+            build_args: |
+              VERSION_NUM=8
+          - tag_suffix: aarch64_el9
+            dockerfile: ./docker/Dockerfile.centos-stream
+            build_args: |
+              VERSION_NUM=9
+
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+          persist-credentials: false

      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4

      - name: Log in to Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

-      - name: Build and push ARM64 EL8
-        uses: docker/build-push-action@v5
+      - name: Build and push ${{ matrix.tag_suffix }}
+        uses: docker/build-push-action@v7
        with:
          context: .
          platforms: linux/arm64
-          file: ./docker/Dockerfile.centos-stream
-          build-args: |
-            VERSION_NUM=8
-            CHINA_MIRROR=0
+          file: ${{ matrix.dockerfile }}
+          build-args: ${{ matrix.build_args }}
          push: true
-          tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:aarch64_el8
+          tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ matrix.tag_suffix }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

-  build-arm64-el9:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Log in to Container Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Build and push ARM64 EL9
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          platforms: linux/arm64
-          file: ./docker/Dockerfile.centos-stream
-          build-args: |
-            VERSION_NUM=9
-            CHINA_MIRROR=0
-          push: true
-          tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:aarch64_el9
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
--- a/.github/workflows/build-rpm.yml
+++ b/.github/workflows/build-rpm.yml
@@ -11,25 +11,44 @@ env:

 jobs:
  build-arm64:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04-arm
    permissions:
      contents: read
      packages: read
    strategy:
      matrix:
        include:
+          - tag: aarch64_el7
+            el: "7"
+            arch: aarch64
+            artifact: rpm-el7-aarch64
          - tag: aarch64_el8
-            platform: linux/arm64
+            el: "8"
+            arch: aarch64
+            artifact: rpm-el8-aarch64
          - tag: aarch64_el9
-            platform: linux/arm64
+            el: "9"
+            arch: aarch64
+            artifact: rpm-el9-aarch64
+          - tag: aarch64_el8
+            el: "uos20"
+            arch: aarch64
+            uos20: "1"
+            artifact: rpm-uos20-aarch64
+
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Run pullsrc.sh
+        run: env ALL=1 ./pullsrc.sh

      - name: Generate version-local.env
        run: |
          TAG=${{ github.ref_name }}
-          # Extract bX from tag (e.g., v1.0.0b5 -> b5)
          BUILD_NUM=$(echo "$TAG" | grep -oE 'b[0-9]+' | tail -1)
          if [ -z "$BUILD_NUM" ]; then
            BUILD_NUM="b1"
@@ -38,14 +57,11 @@ jobs:
          echo "PKGREL=$BUILD_NUM" >> version-local.env
          cat version-local.env

-      - name: Run pullsrc.sh
-        run: env ALL=1 ./pullsrc.sh
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4

      - name: Log in to Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
@@ -55,13 +71,13 @@ jobs:
        run: |
          docker run --rm \
            -v $(pwd):/data \
-            --platform ${{ matrix.platform }} \
+            -e "UOS20=${{ matrix.uos20 }}" \
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ matrix.tag }}

      - name: Upload RPM artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
        with:
-          name: rpm-${{ matrix.tag }}
+          name: ${{ matrix.artifact }}
          path: output/*.rpm
          if-no-files-found: ignore

@@ -74,18 +90,50 @@ jobs:
      matrix:
        include:
          - tag: el9
+            el: "9"
+            arch: x86_64
+            artifact: rpm-el9-x86_64
          - tag: el8
+            el: "8"
+            arch: x86_64
+            artifact: rpm-el8-x86_64
          - tag: el7
+            el: "7"
+            arch: x86_64
+            artifact: rpm-el7-x86_64
          - tag: el6
+            el: "6"
+            arch: x86_64
+            artifact: rpm-el6-x86_64
+          - tag: el8
+            el: "uos20"
+            arch: x86_64
+            uos20: "1"
+            artifact: rpm-uos20-x86_64
+
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+          persist-credentials: false

      - name: Run pullsrc.sh
-        run: env ALL=1 ./pullsrc.sh
+        run: ./pullsrc.sh
+
+      - name: Generate version-local.env
+        run: |
+          TAG=${{ github.ref_name }}
+          BUILD_NUM=$(echo "$TAG" | grep -oE 'b[0-9]+' | tail -1)
+          if [ -z "$BUILD_NUM" ]; then
+            BUILD_NUM="b1"
+          fi
+          echo "WITH_OPENSSL=2" > version-local.env
+          echo "PKGREL=$BUILD_NUM" >> version-local.env
+          cat version-local.env

      - name: Log in to Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
@@ -95,12 +143,13 @@ jobs:
        run: |
          docker run --rm \
            -v $(pwd):/data \
+            -e "UOS20=${{ matrix.uos20 }}" \
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ matrix.tag }}

      - name: Upload RPM artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
        with:
-          name: rpm-${{ matrix.tag }}
+          name: ${{ matrix.artifact }}
          path: output/*.rpm
          if-no-files-found: ignore

@@ -113,16 +162,37 @@ jobs:
      matrix:
        include:
          - m32: "0"
+            el: "5"
+            arch: x86_64
+            artifact: rpm-el5-x86_64
          - m32: "1"
+            el: "5"
+            arch: i686
+            artifact: rpm-el5-i686
+
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+          persist-credentials: false

      - name: Run pullsrc.sh
-        run: env ALL=1 ./pullsrc.sh
+        run: ./pullsrc.sh
+
+      - name: Generate version-local.env
+        run: |
+          TAG=${{ github.ref_name }}
+          BUILD_NUM=$(echo "$TAG" | grep -oE 'b[0-9]+' | tail -1)
+          if [ -z "$BUILD_NUM" ]; then
+            BUILD_NUM="b1"
+          fi
+          echo "WITH_OPENSSL=2" > version-local.env
+          echo "PKGREL=$BUILD_NUM" >> version-local.env
+          cat version-local.env

      - name: Log in to Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
@@ -136,33 +206,47 @@ jobs:
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:el5

      - name: Upload RPM artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
        with:
-          name: rpm-el5-m32-${{ matrix.m32 }}
+          name: ${{ matrix.artifact }}
          path: output/*.rpm
-          if-no-files-found: ignore
+          if-no-files-found: error

  release:
    needs: [build-arm64, build-amd64, build-el5]
    runs-on: ubuntu-latest
    permissions:
      contents: write
+
    steps:
      - name: Download all artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v7
        with:
          path: artifacts
-          merge-multiple: true

-      - name: List artifacts
+      - name: List downloaded artifacts
        run: |
-          echo "Downloaded artifacts:"
-          find artifacts -type f -name "*.rpm" || echo "No RPM files found"
+          echo "Downloaded artifact directories:"
+          find artifacts -mindepth 1 -maxdepth 1 -type d
+
+      - name: Repackage artifacts with prefixed names
+        run: |
+          TAG=${{ github.ref_name }}
+          mkdir -p release-assets
+          for dir in artifacts/*/; do
+            artifact_name=$(basename "$dir")
+            new_name="openssh_${TAG}_${artifact_name}"
+            echo "Packaging ${artifact_name} -> ${new_name}.zip"
+            (cd "$dir" && zip -r "${GITHUB_WORKSPACE}/release-assets/${new_name}.zip" .)
+          done
+          echo "Release assets:"
+          ls -la release-assets

      - name: Create Release
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@v2
        with:
-          files: artifacts/**/*.rpm
+          files: release-assets/*.zip
          generate_release_notes: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
--- a/.gitignore
+++ b/.gitignore
@@ -1,5 +1,6 @@
 BUILD/
 output/
+.*
 *-local*
 *.orig
 *.swp
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -0,0 +1,108 @@
+# AGENTS.md
+
+## What this repo is
+
+Shell scripts to backport and build OpenSSH RPMs for CentOS/RHEL-like distros (EL5 through EL9, also Rocky, AlmaLinux, Anolis, UOS, openEuler, Amazon Linux).
+
+## Essential commands
+
+```bash
+# Download source tarballs into downloads/
+./pullsrc.sh
+
+# Build RPMs (auto-detects the EL version from the running system)
+./compile.sh
+
+# Force a specific EL target (useful on non-RPM build hosts like Docker/Ubuntu)
+./compile.sh el7
+
+# Docker-based build (see docker/README.md for per-version commands)
+docker build -t elssh:el8 -f ./docker/Dockerfile.centos-stream --build-arg VERSION_NUM=8 .
+docker run --rm -v .:/data elssh:el8
+```
+
+## Configuration
+
+- `version.env` — source versions (OpenSSH, OpenSSL, Perl). Committed.
+- `version-local.env` — user overrides like `PKGREL`, `WITH_OPENSSL`. Gitignored (`*-local*`).
+- `compile.sh` sources `version.env` then `version-local.env` (if present), so `version-local.env` wins.
+
+## Key variables
+
+- `WITH_OPENSSL`: `0` = no OpenSSL (no ssh-rsa keys), `1` = system OpenSSL, `2` = static OpenSSL. Only the `el7` spec dir (covering EL7/8/9) auto-detects in `compile.sh` TOPDIR_SELECT: system OpenSSL >= 3 -> `1`, else `2`. EL5/EL6 leave it unset and rpmbuild falls back to `2` via `${WITH_OPENSSL:-2}`. Note `docker/docker_compile.sh` has its own overlapping auto-detect (checks openssl-devel presence + version), so behavior inside Docker may differ from a direct `./compile.sh` run.
+- `PKGREL`: package release number (defaults to `1`)
+- `M32=1`: build 32-bit RPMs (EL5 only)
+- `DOCKERBUILD=1`: when set, `pullsrc.sh` skips the openssh/openssl/askpass downloads but still fetches PERLSRC
+- `UOS20=1`: build the UOS 20 variant — enables the kernel-panic patch (`openssh-uos20-kernel-panic-fix.patch`) and prefixes `PKGREL` with `uos20.` so resulting RPMs are distinguishable.
+
+## Architecture notes
+
+- **EL8 and EL9 both use `el7/`** as the spec directory, since they share systemd. `compile.sh` GUESS_DIST returns `el7` for all versions >= EL7.
+- EL6 uses `el6/` (SysVinit).
+- EL5 uses `el5/` (SysVinit, requires Perl bootstrap for building OpenSSL).
+- **Supported architectures**: `x86_64` for all EL versions; `aarch64` for EL7/8/9 and UOS20 via per-arch tags (`aarch64_el7`, `aarch64_el8`, `aarch64_el9`). Docker tags are per-arch (e.g. `ghcr.io/boypt/openssh-rpms:aarch64_el7`), not multi-arch manifests.
+- `WITH_OPENSSL` auto-detection: for `el7` (which covers EL7/8/9), if system OpenSSL >= 3, defaults to `1` (system), otherwise `2` (static).
+- `compile.sh` has subcommands: `GETEL` (print detected distro), `GETRPM` (list RPM paths), `RPMDIR` (print RPM output dir).
+- `el7/SPECS/` has two spec files: `openssh.spec` (default, systemd) and `openssh.initv.spec` (SysVinit). The default spec is selected via `SPECFILE` env var. The UOS 20 build uses the default spec with `UOS20=1`.
+- `docker/docker_compile.sh` is the entrypoint inside Docker images — it copies the appropriate `el*` dir to `/BUILD` and runs `compile.sh` against it.
+- `docker/modify_vault_source.sh` handles vault mirrors; for `aarch64` it appends `/altarch` (CentOS AltArch vault, e.g. `.../centos-vault/altarch/7.9.2009/`). For EL5 `EPEL` always uses `http://mirrors.aliyun.com/epel-archive` (avoids Python 2.4 TLS 1.0 → 302 → https failure on `archives.fedoraproject.org`).
+
+## CI
+
+- `.github/workflows/build-images.yml` — manually triggered (`workflow_dispatch`), builds Docker images and pushes to `ghcr.io`. Matrix: `build-amd64` (5 images: `el5`, `el6`, `el7`, `el8`, `el9` on `ubuntu-latest`) + `build-arm64` (3 images: `aarch64_el7`, `aarch64_el8`, `aarch64_el9` on `ubuntu-latest` with `setup-qemu-action` + `platforms: linux/arm64`). Cache: `type=gha`.
+- `.github/workflows/build-rpm.yml` — runs on `v*` tags, builds RPMs inside Docker containers and creates a GitHub release. Jobs: `build-arm64` (`ubuntu-24.04-arm`, natively runs `aarch64_*` images), `build-amd64` (`ubuntu-latest`), `build-el5` (`ubuntu-latest`, handles `m32` for i686). Final `release` needs all three and zips artifacts as `openssh_<tag>_<artifact>.zip`.
+
+## Linting & formatting
+
+All shell scripts (`*.sh`) must pass `shellcheck` and `shfmt` before committing:
+
+```bash
+# Lint (warnings are errors)
+shellcheck -S warning compile.sh pullsrc.sh
+
+# Format check (must produce no diff)
+shfmt -d -i 0 -bn -ci compile.sh pullsrc.sh
+
+# Auto-fix formatting in-place
+shfmt -w -i 0 -bn -ci compile.sh pullsrc.sh
+```
+
+- **shellcheck** `-S warning`: treat warnings as failures; informational/style notes may be suppressed inline with `# shellcheck disable=SCxxxx`.
+- **shfmt** `-i 0 -bn -ci`: tabs for indentation (no extra indent), binary operators (`&&`, `||`, `|`) at start of next line, case body indented.
+- Both tools must exit 0 before any commit touching `*.sh` files.
+
+## Gitignore
+
+`*-local*` is gitignored — version-local.env, editor swap files, etc. `*.tar.gz` is gitignored everywhere, including `downloads/`. Generated RPMs go to `output/` (also gitignored).
+
+## Version bump workflow
+
+When the user says "update to &lt;version&gt;" (e.g. "update to 10.5", "update to 10.6p1"), perform the following steps autonomously. Only update `README.md` and `version.env` — do not touch other files unless explicitly asked.
+
+1. **Normalize the version**: append `p1` if not already present (all portable releases use `p1`). E.g. `10.5` → `10.5p1`.
+
+2. **Update `version.env`**: change the `OPENSSHSRC` line to `openssh-<version>.tar.gz`. `OPENSSHVER` is derived automatically from `OPENSSHSRC`. Do NOT change `OPENSSLSRC`/`OPENSSLVER` or any other line unless the user explicitly asks.
+
+3. **Update `README.md`**: in the "Current Version" section, update only the OpenSSH version line. Leave the OpenSSL line unchanged.
+
+4. **Determine the next build number**:
+   ```bash
+   TAG_PREFIX="v${NEW_VERSION}_b"
+   BUILD_NUM=$(git tag | grep "^${TAG_PREFIX}" | sed "s/^${TAG_PREFIX}//" | sort -n | tail -1)
+   BUILD_NUM=$(( ${BUILD_NUM:-0} + 1 ))
+   ```
+
+5. **Commit and tag** (do not push yet):
+   ```bash
+   git add version.env README.md
+   git commit -m "bump: OpenSSH ${NEW_VERSION}_b${BUILD_NUM}"
+   git tag "v${NEW_VERSION}_b${BUILD_NUM}"
+   ```
+
+6. **Ask the user for confirmation to push** to remote. This is the only confirmation needed — do not ask about file changes, commit message, tag name, or anything else.
+
+7. **After pushing**, the tag triggers `.github/workflows/build-rpm.yml` which builds RPMs for all EL versions and creates a GitHub release. Monitor CI using `gh` commands and report the status:
+   ```bash
+   gh run list --limit 5
+   gh run watch    # watch the latest run to completion
+   ```
--- a/README.md
+++ b/README.md
@@ -6,18 +6,39 @@ Similar Project: [Backport OpenSSH for Debian / Ubuntu distros](https://github.c

 ## Supported (tested) Distro:

- CentOS 5/6/7/8/Stream 8/9
- Rocky Linux 8/9
- Amazon Linux 1/2/2023
- UnionTech OS 20
- openEuler 22.03/24.03
- AnolisOS 7/8/2023
+| Distro         | Version        | Arch                | Recommended EL RPMs                                                  |
+|----------------|----------------|---------------------|----------------------------------------------------------------------|
+| CentOS          | 5               | x86_64 / i686        | EL 5 (`rpm-el5-x86_64`, `rpm-el5-i686`)              |
+| CentOS          | 6               | x86_64               | EL 6 (`rpm-el6-x86_64`)                              |
+| CentOS          | 7               | x86_64 / aarch64     | EL 7 (`rpm-el7-x86_64`, `rpm-el7-aarch64`)           |
+| CentOS          | 8               | x86_64 / aarch64     | EL 8 (`rpm-el8-x86_64`, `rpm-el8-aarch64`)           |
+| CentOS Stream   | 8               | x86_64 / aarch64     | EL 8 (`rpm-el8-x86_64`, `rpm-el8-aarch64`)           |
+| CentOS Stream   | 9               | x86_64 / aarch64     | EL 9 (`rpm-el9-x86_64`, `rpm-el9-aarch64`)           |
+| Rocky Linux     | 8               | x86_64 / aarch64     | EL 8 (`rpm-el8-x86_64`, `rpm-el8-aarch64`)           |
+| Rocky Linux     | 9               | x86_64 / aarch64     | EL 9 (`rpm-el9-x86_64`, `rpm-el9-aarch64`)           |
+| AlmaLinux       | 8               | x86_64 / aarch64     | EL 8 (`rpm-el8-x86_64`, `rpm-el8-aarch64`)           |
+| AlmaLinux       | 9               | x86_64 / aarch64     | EL 9 (`rpm-el9-x86_64`, `rpm-el9-aarch64`)           |
+| Oracle Linux    | 7               | x86_64 / aarch64     | EL 7 (`rpm-el7-x86_64`, `rpm-el7-aarch64`)           |
+| Oracle Linux    | 8               | x86_64 / aarch64     | EL 8 (`rpm-el8-x86_64`, `rpm-el8-aarch64`)           |
+| Oracle Linux    | 9               | x86_64 / aarch64     | EL 9 (`rpm-el9-x86_64`, `rpm-el9-aarch64`)           |
+| Amazon Linux    | 1               | x86_64               | EL 6 (`rpm-el6-x86_64`)                              |
+| Amazon Linux    | 2               | x86_64 / aarch64     | EL 7 (`rpm-el7-x86_64`, `rpm-el7-aarch64`)           |
+| Amazon Linux    | 2023            | x86_64 / aarch64     | EL 9 (`rpm-el9-x86_64`, `rpm-el9-aarch64`)           |
+| UnionTech UOS   | V20             | x86_64 / aarch64     | **UOS20** (`rpm-uos20-x86_64`, `rpm-uos20-aarch64`)  |
+| openEuler       | 20.03           | x86_64 / aarch64     | EL 8 (`rpm-el8-x86_64`, `rpm-el8-aarch64`)           |
+| openEuler       | 22.03           | x86_64 / aarch64     | EL 8 (`rpm-el8-x86_64`, `rpm-el8-aarch64`)           |
+| openEuler       | 24.03           | x86_64 / aarch64     | EL 9 (`rpm-el9-x86_64`, `rpm-el9-aarch64`)           |
+| AnolisOS        | 7               | x86_64 / aarch64     | EL 7 (`rpm-el7-x86_64`, `rpm-el7-aarch64`)           |
+| AnolisOS        | 8               | x86_64 / aarch64     | EL 8 (`rpm-el8-x86_64`, `rpm-el8-aarch64`)           |
+| AnolisOS        | 2023            | x86_64 / aarch64     | EL 9 (`rpm-el9-x86_64`, `rpm-el9-aarch64`)           |
+
+> `aarch64` RPMs are built from the same `el7/` spec via `aarch64_el7/8/9` Docker tags (`ghcr.io/boypt/openssh-rpms:aarch64_el7` etc., QEMU-built, per-arch tags — not multi-arch manifests).

 ## Project Structure 

 - `pullsrc.sh`: Script to download source packages.
 - `compile.sh`: Script to build RPMs.
- `version.env`: config file for variables (versions, release number, OPENSSL MODE, proxy ...)
+- `version.env`: config file for variables (versions, release number, OPENSSL MODE ...)

 The directory (`el5`, `el6`, `el7`) serve as functional templates for different environment types. The `openssh.spec` are modified based on the shipped spec file from OpenSSH project.

@@ -29,8 +50,8 @@ The directory (`el5`, `el6`, `el7`) serve as functional templates for different

 ## Current Version:

- OpenSSH 10.3p1 (see: [OpenSSH Official](https://www.openssh.com/))
- OpenSSL 3.5.6 (see: [OpenSSL Official](https://openssl-library.org/source/))
+- OpenSSH 10.5p1 (see: [OpenSSH Official](https://www.openssh.com/))
+- OpenSSL 3.5.8 (see: [OpenSSL Official](https://openssl-library.org/source/))

 The build script reads `version.env` for version definitions.

@@ -48,8 +69,33 @@ yum install -y systemd-devel
 yum install -y gcc44
 ```

+`libXt-devel`, `libX11-devel` and `gtk2-devel` are only relevant to the EL6/EL7-era askpass subpackages — the EL8+ spec skips them (`compile.sh` passes `no_gtk2` / `skip_gnome_askpass` / `skip_x11_askpass = 1`) and the centos-stream Dockerfile doesn't install them.
+
 ## Usage

+### Download RPMs
+
+Go to the [Releases page](https://github.com/boypt/openssh-rpms/releases)
+and download the zip file that matches your system. No script or GitHub
+API needed.
+
+Each release provides one zip per tag, named like:
+
+```
+openssh_<version>_<tag>.zip
+```
+
+e.g. `openssh_v10.5p1_b1_rpm-el8-x86_64.zip`.
+
+1. Find your distro in the "Supported (tested) Distro" table above, and
+   note the tag in the "Recommended EL RPMs" column (e.g. `rpm-el8-x86_64`).
+2. Download the zip whose name ends with that tag.
+3. Unzip it and install:
+
+```bash
+unzip openssh*.zip
+```
+
 ### Build RPMs

 Note: It is unnecessary to build on each system, as most RPM-based Linux distributions are glibc compatible. That is, RPMs built on `CentOS 8` can be installed and run on `Rocky Linux 8`/`AlmaLinux 8`/`Oracle Linux 8`, etc.
@@ -67,6 +113,10 @@ Note: It is unnecessary to build on each system, as most RPM-based Linux distrib
    ```
 5. The generated RPM files will be copied to the `output` directory.

+#### Use Docker
+
+For more details, see [docker/README.md](docker/README.md)
+
 ### Install RPMs

 ```bash
@@ -74,25 +124,37 @@ ls output
 # you will find multiple RPM files in this directory.
 # you may copy them to other machines, and continue following steps there.

-# Backup current SSH config
+# Backup current SSH config by moving it away — the new package then
+# lays down a fresh stock config, which also avoids breakage from old
+# directives (notably the GSSAPI* series) removed upstream.
 [[ -f /etc/ssh/sshd_config ]] && mv /etc/ssh/sshd_config /etc/ssh/sshd_config.$(date +%Y%m%d)

-# Install rpm packages.
+# Install rpm packages (`dnf` works the same on EL8/EL9).
 sudo yum --disablerepo=* localinstall -y ./openssh*.rpm

 # Check Installed version:
 ssh -V && /usr/sbin/sshd -V

+# If you skipped the backup step above, rpm kept your old config and
+# saved the package defaults as sshd_config.rpmnew (the spec marks it
+# %config(noreplace)). An old config can keep the new sshd from
+# starting, so test it — on failure either fix the offending
+# directives, or swap in the .rpmnew defaults, then re-test until it
+# passes silently:
+ls /etc/ssh/sshd_config.rpmnew
+sudo /usr/sbin/sshd -t -f /etc/ssh/sshd_config || sudo mv /etc/ssh/sshd_config{.rpmnew,}
+sudo /usr/sbin/sshd -t -f /etc/ssh/sshd_config
+
 # Restart service
-sudo service sshd restart
+sudo systemctl restart sshd   # (`service sshd restart` also works)

 # Test a new ssh connection
 ssh localhost
 ```

-**DO NOT DISCONNECET** current ssh shell yet, open a **NEW** shell and login to you machine to verify that sshd is working properly.
+**DO NOT DISCONNECT** current ssh shell yet, open a **NEW** shell and login to you machine to verify that sshd is working properly.

-#### Trouble shooting
+#### Troubleshooting

 You may get complains during the `yum localinstall` process. It's mostly because some subpackages depend on the main openssh package, upgrading only the main package won't fit in their dependencies.

@@ -108,9 +170,42 @@ If still not satisfied, you may try the final weapon: FORCED INSTALL.
 rpm -ivh --force --nodeps --replacepkgs --replacefiles openssh-*.rpm
 ```

-## Use Docker
+### Rollback to distro stock OpenSSH

-For more details, see [docker/README.md](docker/README.md)
+If the custom build doesn't work for you, remove it and reinstall the
+version shipped by your distro. Keep your current SSH session open until
+the rollback is verified.
+
+```bash
+# 1. Downgrade back to the distro's own versions in one yum transaction.
+# (Single yum transaction -> dependencies are handled properly and there
+# is no "RPMDB altered outside of yum" warning afterwards. If you
+# installed extra subpackages, list them here too.)
+sudo yum downgrade openssh openssh-clients openssh-server
+# On EL8/EL9, `dnf` works the same.
+
+# Fallback if downgrade is unavailable: erase first, then reinstall
+# from the distro repos (re-enable the repos if you disabled them).
+sudo rpm -e --nodeps openssh openssh-clients openssh-server
+sudo yum install -y openssh openssh-clients openssh-server
+
+# 2. Restart and verify
+sudo systemctl restart sshd   # EL7 and above (systemd)
+# sudo service sshd restart   # EL5/EL6 (SysVinit)
+ssh -V && /usr/sbin/sshd -V
+ssh localhost
+```
+
+Notes:
+
+- The default build bundles OpenSSL statically (`WITH_OPENSSL=2`), so
+  the system OpenSSL is untouched — only the `openssh` packages need
+  rolling back.
+- If the downgrade/install step can't find the packages, your base repos may be disabled or
+  (on EOL releases like EL5/EL6) moved to vault — fix the repo config
+  first.
+- Same rule as install: **DO NOT** close your current shell, open a
+  **NEW** shell to verify that login works before disconnecting.

 ## Other Notes

@@ -118,9 +213,34 @@ For more details, see [docker/README.md](docker/README.md)

 When built with `WITH_OPENSSL=0`, `ssh-rsa` keys are not supported. But the RPMs are much smaller, and the built process is much faster.

+### Build for uniontech UOS 20
+
+UOS 20 kernels have a `do_dup2()` bug that triggers a kernel NULL pointer
+dereference panic when `sshd` re-execs:
+
+```
+BUG: unable to handle kernel NULL pointer dereference at 000000000000003f
+IP: filp_close+0x9/0x70
+Call Trace: do_dup2+xxx sys_dup2 entry_SYSCALL_64
+PID: xxx Comm: sshd
+```
+
+To apply the workaround (`el7/SOURCES/openssh-uos20-kernel-panic-fix.patch`,
+which closes the target fd before each `dup2()` in `sshd.c`), set
+`UOS20=1`:
+
+```bash
+UOS20=1 ./compile.sh el8
+```
+
+The flag also prefixes `PKGREL` with `uos20.` so the resulting RPMs are distinguishable from the standard build (e.g. PKGREL `1` becomes `uos20.1`, producing `openssh-XXXXX-uos20.1.el7.x86_64.rpm`). The patch is only
+applied when the `uos20` macro is set, so ordinary EL7/8/9 builds are
+unaffected. For the Docker-based build, see
+[docker/README.md](docker/README.md#uos-20-variant-el8).
+
 ### Install on uniontech UOS 20

-UOS's `openssh-help` subpackage has files that confilict with the package. It's must be removed before installing the compiled RPMs:
+UOS's `openssh-help` subpackage has files that conflict with the package. It's must be removed before installing the compiled RPMs:

 ```bash
 sudo rpm --nodeps -e openssh-help
--- a/compile.sh
+++ b/compile.sh
@@ -11,12 +11,11 @@ trap 'echo -e "Aborted, error $? in command: $BASH_COMMAND"; trap ERR; exit 1' E
 # Set magic variables for current file & dir
 __dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 __file="${__dir}/$(basename "${BASH_SOURCE[0]}")"
-__base="$(basename ${__file} .sh)"
+__base="$(basename "${__file}" .sh)"
 __root="$(cd "$(dirname "${__dir}")" && pwd)" # <-- change this as it depends on your app

 arg1="${1:-}"
 rpmtopdir=
-specfile=${SPECFILE:-openssh.spec}

 # WITH_OPENSSL=
 # Control openssl dependency
@@ -25,168 +24,187 @@ specfile=${SPECFILE:-openssh.spec}
 # 2: build openssl statically

 CHECKEXISTS() {
-  if [[ ! -f $__dir/downloads/$1 ]];then
-    echo "$1 not found, run 'pullsrc.sh', or manually put it in the downloads dir."
-    exit 1
-  fi
+	if [[ ! -f $__dir/downloads/$1 ]]; then
+		echo "$1 not found, run 'pullsrc.sh', or manually put it in the downloads dir."
+		exit 1
+	fi
 }

-
 GUESS_DIST() {
-    # will not work if rpm cmd not exists
-    if ! type -p rpm > /dev/null;then
-      echo 'unknown' && return 0
-    fi
+	# will not work if rpm cmd not exists
+	if ! type -p rpm >/dev/null; then
+		echo 'unknown'
+		return 0
+	fi

-    local dist=$(rpm --eval '%{?dist}' | tr -d '.')
+	local dist
+	if ! dist=$(rpm --eval '%{?dist}' 2>/dev/null); then
+		dist=
+	fi
+	dist=${dist//./}

-    # fallback to el7
-    [[ $dist == "el9" ]] && dist="el8"
-    [[ $dist == "el8" ]] && dist="el8"
-    [[ $dist == "an8" ]] && dist="el8" # Anolis 8
-    [[ $dist == "an7" ]] && dist="el7" # Anolis 7
-    [[ $dist == uel* ]] && dist="el8"  # UOS20+
+	# Only el5/el6 have dedicated spec dirs; EL7+ (incl. EL-like rebuilds)
+	# all share the el7 systemd layout.
+	case $dist in
+		el5) echo 'el5' && return 0 ;;
+		el6) echo 'el6' && return 0 ;;
+		el*) echo 'el7' && return 0 ;;
+	esac

-    [[ -n $dist ]] && echo $dist && return 0
-
-    local glibcver=$(ldd --version | head -n1 | grep -Eo '[0-9]+' | tr -d '\n')
-
-    # centos 5 uses glibc 2.5
-    [[ $glibcver -eq 25 ]] && echo 'el5' && return 0
-
-    # centos 6 uses glibc 2.12
-    [[ $glibcver -eq 212 ]] && echo 'el6' && return 0
-
-    # centos 7 uses glibc 2.17
-    [[ $glibcver -eq 217 ]] && echo 'el7' && return 0
-
-    # centos 8 uses glibc 2.28, not yet to be in a seprate dir
-    [[ $glibcver -eq 228 ]] && echo 'el8' && return 0
-
-    # some centos-like dists ships higher version of glibc, fallback to el7
-    [[ $glibcver -gt 217 ]] && echo 'el8' && return 0
+	# fallback via glibc version when %{?dist} is undefined:
+	# el5 uses glibc 2.5, el6 uses 2.12, anything newer maps to el7
+	local glibcver ldd_version
+	ldd_version=$(ldd --version 2>&1) || true
+	ldd_version=${ldd_version%%$'\n'*}
+	if [[ $ldd_version =~ ([0-9]+\.[0-9]+) ]]; then
+		glibcver=${BASH_REMATCH[1]}
+	else
+		glibcver=
+	fi
+	case $glibcver in
+		2.5) echo 'el5' ;;
+		2.12) echo 'el6' ;;
+		*) echo 'el7' ;;
+	esac
 }

+# Map GUESS_DIST output to the spec dir and set per-dist build defaults.
+# Sets globals: rpmtopdir; WITH_OPENSSL (el7 only, unless already set)
 TOPDIR_SELECT() {
-    local DISTVER=$(GUESS_DIST)
-    case $DISTVER in
-        el8)
-            rpmtopdir=el7
-            WITH_OPENSSL=${WITH_OPENSSL:-1}
-            ;;
-        el7)
-            rpmtopdir=el7
-            WITH_OPENSSL=${WITH_OPENSSL:-2}
-            ;;
-        el6)
-            rpmtopdir=el6
-            WITH_OPENSSL=${WITH_OPENSSL:-2}
-            ;;
-        el5)
-            rpmtopdir=el5
-            WITH_OPENSSL=${WITH_OPENSSL:-2}
-            ;;
-        *)
-            echo "Distro undefined, please specify manually: el5 el6 el7"
-            echo -e "\nCurrent OS:"
-            [[ -f /etc/os-release ]] && cat /etc/os-release
-            [[ -f /etc/redhat-release ]] && cat /etc/redhat-release 
-            [[ -f /etc/system-release ]] && cat /etc/system-release
-            echo -e "Current OS vendor: $(rpm --eval '%{?_vendor}') \n"
-            return 1
-            ;;
-    esac
+	rpmtopdir=$(GUESS_DIST)
+	if [[ ! -d $rpmtopdir ]]; then
+		echo "Distro undefined, please specify manually: el5 el6 el7"
+		echo "eg: ${0} el7"
+		echo -e "\nCurrent OS:"
+		[[ -f /etc/os-release ]] && cat /etc/os-release
+		[[ -f /etc/redhat-release ]] && cat /etc/redhat-release
+		[[ -f /etc/system-release ]] && cat /etc/system-release
+		echo -e "Current OS vendor: $(rpm --eval '%{?_vendor}') \n"
+		return 1
+	fi
+	# default WITH_OPENSSL for el7: system openssl >=3 -> 1, else static(2);
+	# el5/el6 stay unset, BUILD_RPM defaults them to static(2)
+	if [[ $rpmtopdir == el7 && -z ${WITH_OPENSSL+x} ]]; then
+		local opensslver
+		opensslver=$(rpm -q openssl --qf "%{VERSION}" 2>/dev/null | cut -d. -f1)
+		[[ $opensslver -ge 3 ]] && WITH_OPENSSL=1 || WITH_OPENSSL=2
+	fi
 }

 BUILD_RPM() {

-    source version.env
-    [[ -f version-local.env ]] && source version-local.env
+	# shellcheck disable=SC1091
+	source version.env
+	# shellcheck disable=SC1091
+	[[ -f version-local.env ]] && source version-local.env

-    local SOURCES=( $OPENSSHSRC \
-          $OPENSSLSRC \
-          $ASKPASSSRC \
-        )
-    local RPMBUILDOPTS=( \
-        --define "with_openssl ${WITH_OPENSSL}" \
-        --define "opensslver ${OPENSSLVER}" \
-        --define "opensshver ${OPENSSHVER}" \
-        --define "opensshpkgrel ${PKGREL}" \
-        --define 'debug_package %{nil}' \
-        --define 'no_gtk2 1' \
-        --define 'skip_gnome_askpass 1' \
-        --define 'skip_x11_askpass 1' \
-        )
-
-    # EL5 dist fixes
-    if [[ $rpmtopdir == *el5 ]]; then
-        SOURCES+=($PERLSRC)
-        RPMBUILDOPTS+=('--define' "perlver ${PERLVER}" '--define' 'dist .el5')
-        export CC=gcc44
-	if [[ ${M32:-0} != 0 ]]; then
-	       RPMBUILDOPTS+=('--target' i686)
-	       export CFLAGS=-m32 LDFLAGS=-m32
+	local SOURCES=("$OPENSSHSRC"
+		"$OPENSSLSRC"
+		"$ASKPASSSRC"
+	)
+	# UOS20 build: prefix PKGREL with "uos20." so the resulting RPMs are
+	# distinguishable from the standard build (e.g. PKGREL `1` becomes
+	# `uos20.1`, not `uos201`), and pass `uos20 1` to the spec to enable
+	# the kernel-panic patch.
+	# NOTE: RPM does not allow '-' in the Release field (it is the
+	# Version/Release delimiter), so '.' is used as the separator.
+	local _pkgrel="${PKGREL:-1}"
+	if [[ ${UOS20:-0} == 1 ]]; then
+		_pkgrel="uos20.${_pkgrel}"
 	fi
-    fi
+	local RPMBUILDOPTS=(
+		--define "with_openssl ${WITH_OPENSSL:-2}"
+		--define "opensslver ${OPENSSLVER}"
+		--define "opensshver ${OPENSSHVER}"
+		--define "opensshpkgrel ${_pkgrel}"
+		--define 'debug_package %{nil}'
+		--define 'no_gtk2 1'
+		--define 'skip_gnome_askpass 1'
+		--define 'skip_x11_askpass 1'
+	)
+	[[ ${UOS20:-0} == 1 ]] && RPMBUILDOPTS+=('--define' 'uos20 1')

-    # add dist variable if not defined
-    [[ $rpmtopdir == *el7 ]] && [[ -z $(rpm --eval '%{?dist}') ]] && \
-         RPMBUILDOPTS+=('--define' "dist .$(rpm -q glibc | rev | cut -d. -f2 | rev)")
+	# EL5 dist fixes
+	if [[ $rpmtopdir == *el5 ]]; then
+		SOURCES+=("$PERLSRC")

-    pushd $rpmtopdir
-    RPMBUILDOPTS+=('--define' "_topdir $PWD")
-    for fn in ${SOURCES[@]}; do
-      CHECKEXISTS $fn && \
-        install -v -m666 $__dir/downloads/$fn ./SOURCES/
-    done
-    rpmbuild -ba ./SPECS/${specfile} "${RPMBUILDOPTS[@]}"
-    mkdir -p $__dir/output
-    find ./RPMS -type f -name '*.rpm' -exec install -v -m644 {} $__dir/output/ \;
-    popd
+		# Hack: fake the perl src when perl is ready already(docker images)
+		[[ $(perl -e 'print $] >= 5.010 ? 1 : 0') -eq 1 ]] \
+			&& touch ./downloads/"$PERLSRC"
+
+		RPMBUILDOPTS+=('--define' "perlver ${PERLVER}")
+		local dist
+		dist=$(rpm --eval '%{?dist}')
+		[[ -n $dist ]] || RPMBUILDOPTS+=('--define' 'dist .el5')
+		export CC=gcc44
+	fi
+
+	# add dist variable if not defined
+	[[ $rpmtopdir == *el7 ]] && [[ -z $(rpm --eval '%{?dist}') ]] \
+		&& RPMBUILDOPTS+=('--define' "dist .$(rpm -q glibc | rev | cut -d. -f2 | rev)")
+
+	pushd $rpmtopdir
+	# ensure the rpmbuild _topdir tree exists (fresh clone has no empty dirs)
+	mkdir -p BUILD RPMS SRPMS SOURCES SPECS
+	RPMBUILDOPTS+=('--define' "_topdir $PWD")
+	for fn in "${SOURCES[@]}"; do
+		CHECKEXISTS "$fn" \
+			&& install -v -m666 "$__dir"/downloads/"$fn" ./SOURCES/
+	done
+
+	if [[ ${M32:-0} != 0 ]]; then
+		local SETARCH="setarch i386"
+		RPMBUILDOPTS+=('--target' i686)
+		export CFLAGS="${CFLAGS:-} -m32" LDFLAGS="${LDFLAGS:-} -m32"
+	fi
+
+	if ! ${SETARCH:-} rpmbuild -bb ./SPECS/"${SPECFILE:-openssh.spec}" "${RPMBUILDOPTS[@]}"; then
+		echo "Error: rpmbuild failed with exit code $?"
+		exit 1
+	fi
+
+	mkdir -p "$__dir"/output
+	find ./RPMS -type f -name '*.rpm' -exec install -v -m644 {} "$__dir"/output/ \;
+	popd
 }

-LIST_RPMDIR(){
-    local RPMDIR=$__dir/${rpmtopdir}/RPMS/$(rpm --eval '%{_arch}')
-    [[ -d $RPMDIR ]] && echo $RPMDIR
+LIST_RPMDIR() {
+	local RPMDIR
+	RPMDIR=$__dir/${rpmtopdir}/RPMS/$(rpm --eval '%{_arch}')
+	[[ -d $RPMDIR ]] && echo "$RPMDIR"
 }

 LIST_RPMS() {
-    local RPMDIR=$(LIST_RPMDIR)
-    [[ -d $RPMDIR ]] && find $RPMDIR -type f -name '*.rpm'
+	local RPMDIR
+	RPMDIR=$(LIST_RPMDIR)
+	[[ -d $RPMDIR ]] && find "$RPMDIR" -type f -name '*.rpm'
 }

-# sub cmds
+# entry points
 case $arg1 in
-    GETEL)
-        GUESS_DIST
-        exit 0
-        ;;
-    GETRPM)
-        TOPDIR_SELECT
-        LIST_RPMS
-        exit 0
-        ;;
-    RPMDIR)
-        TOPDIR_SELECT
-        LIST_RPMDIR
-        exit 0
-        ;;
-    *)
-        [[ -n $arg1 && ! -d $arg1 ]] && \
-        echo -e "Subcmd: $arg1 not found.\n GETEL, GETRPM, RPMDIR" && \
-        exit 1
-        ;;
+	GETEL)
+		GUESS_DIST
+		;;
+	GETRPM)
+		TOPDIR_SELECT
+		LIST_RPMS
+		;;
+	RPMDIR)
+		TOPDIR_SELECT
+		LIST_RPMDIR
+		;;
+	"")
+		# auto select dist
+		TOPDIR_SELECT
+		BUILD_RPM
+		;;
+	*)
+		# manual specified dist dir
+		if [[ ! -d $arg1 ]]; then
+			echo -e "Subcmd: $arg1 not found.\n GETEL, GETRPM, RPMDIR"
+			exit 1
+		fi
+		rpmtopdir=$arg1
+		BUILD_RPM
+		;;
 esac
-
-# manual specified dist
-[[ -n $arg1 && -d $arg1 ]] && rpmtopdir=$arg1 && BUILD_RPM && exit 0
-
-# auto select dist
-TOPDIR_SELECT
-if [[ ! -d $rpmtopdir ]]; then 
-  echo "This script works only in el5/el6/el7"
-  echo "eg: ${0} el7"
-  exit 1
-fi
-
-[[ -d $rpmtopdir ]] && BUILD_RPM
--- a/docker/Dockerfile.amazonlinux
+++ b/docker/Dockerfile.amazonlinux
@@ -1,24 +0,0 @@
-ARG VERSION_NUM="2023"
-FROM amazonlinux:$VERSION_NUM
-ARG VERSION_NUM
-ARG CHINA_MIRROR=0
-LABEL Author="Rex Zhou <zrx879582094@gmail.com>"
-
-WORKDIR /data
-
-# Copy all files
-COPY . /data
-
-RUN export CHINA_MIRROR="$CHINA_MIRROR" && \
-    bash ./docker/modify_yum_source.sh && \
-    if [ "$VERSION_NUM" = "2023" ]; then \
-        yum makecache timer && yum install -y libnsl systemd-devel; \
-    elif [ "$VERSION_NUM" = "2" ]; then \
-        yum makecache fast && yum install -y gtk2-devel systemd-devel; \
-    elif [ "$VERSION_NUM" = "1" ]; then \
-        yum makecache fast \
-    fi && \
-    yum install -y wget autoconf automake gcc make rpm-build openssl-devel pam-devel krb5-devel zlib-devel libXt-devel libX11-devel perl perl-IPC-Cmd perl-Time-Piece && \
-    yum clean all
-
-CMD ["./docker/docker_compile.sh"]
--- a/docker/Dockerfile.centos
+++ b/docker/Dockerfile.centos
@@ -1,7 +1,6 @@
 ARG VERSION_NUM="7"
 FROM centos:$VERSION_NUM
 ARG VERSION_NUM
-ARG CHINA_MIRROR=0
 LABEL Author="Rex Zhou <zrx879582094@gmail.com>"

 WORKDIR /data
@@ -9,20 +8,13 @@ WORKDIR /data
 # Copy all files
 COPY ./docker/ /data/docker/

-RUN export CHINA_MIRROR="$CHINA_MIRROR" && \
-    bash ./docker/modify_yum_source.sh && \
-    if [ "$VERSION_NUM" = "8" ]; then \
-        yum install -y perl perl-IPC-Cmd perl-Time-Piece systemd-devel openssl-devel && \
-        yum install -y 'dnf-command(config-manager)' && \
-        yum config-manager --set-enabled powertools; \
-    elif [ "$VERSION_NUM" = "7" ]; then \
+RUN bash ./docker/modify_vault_source.sh && \
+    if [ "$VERSION_NUM" = "7" ]; then \
        yum install -y systemd-devel perl perl-IPC-Cmd perl-Time-Piece ;\
    elif [ "$VERSION_NUM" = "6" ]; then \
        yum install -y util-linux-ng perl perl-IPC-Cmd perl-Time-Piece ;\
-    elif [ "$VERSION_NUM" = "5" ]; then \
-        yum install -y gcc44; \
    fi && \
-    yum install -y wget autoconf automake gcc make rpm-build pam-devel krb5-devel zlib-devel libXt-devel libX11-devel gtk2-devel && \
+    yum install -y wget autoconf automake gcc make rpm-build pam-devel krb5-devel zlib-devel libXt-devel libX11-devel gtk2-devel e2fsprogs-devel && \
    yum clean all && \
    rm -rfv /data/

--- a/docker/Dockerfile.centos-stream
+++ b/docker/Dockerfile.centos-stream
@@ -2,7 +2,6 @@
 ARG VERSION_NUM="9"
 FROM quay.io/centos/centos:stream$VERSION_NUM
 ARG VERSION_NUM
-ARG CHINA_MIRROR=0
 LABEL Author="Rex Zhou <zrx879582094@gmail.com>"

 WORKDIR /data
@@ -10,25 +9,17 @@ WORKDIR /data
 # Copy all files
 COPY ./docker/ /data/docker/

-# CentOS 8 stream had NO valid mirrors.
+# CentOS 8 stream had NO valid mirrors; modify_vault_source.sh rewrites the
+# repo baseurls for .el8 (auto-detected via rpm --eval '%{?dist}').
 RUN if [ "$VERSION_NUM" = "8" ]; then \
-        MIRROR_URL="https://vault.centos.org" && \
-        sed -e 's|^mirrorlist=|#mirrorlist=|g' \
-            -e "s|^#baseurl=http://mirror.centos.org/\$contentdir|baseurl=$MIRROR_URL|g" \
-            -i.bak \
-            /etc/yum.repos.d/CentOS-*.repo && \
+        bash ./docker/modify_vault_source.sh && \
        yum install -y perl 'dnf-command(config-manager)' && \
        yum config-manager --set-enabled powertools; \
    else \
-        if [ "$CHINA_MIRROR" != "0" ]; then \
-            MIRROR_URL="https://mirrors.ustc.edu.cn" && \
-            sed -i "s|MIRROR_HOLDER|$MIRROR_URL/centos-stream|" /data/docker/modify_dnf_source.pl && \
-            yum install -y perl && \
-            perl /data/docker/modify_dnf_source.pl /etc/yum.repos.d/*.repo; \
-        fi; \
+        bash /data/docker/modify_live_source.sh /etc/yum.repos.d/*.repo; \
    fi && \
    yum clean all && yum makecache && \
-    yum install -y wget autoconf automake gcc make perl rpm-build pam-devel krb5-devel zlib-devel openssl-devel systemd-devel && \
+    yum install -y wget autoconf automake gcc make perl rpm-build pam-devel krb5-devel zlib-devel openssl-devel systemd-devel e2fsprogs-devel && \
    yum clean all

 CMD ["./docker/docker_compile.sh"]
--- a/docker/Dockerfile.centos5
+++ b/docker/Dockerfile.centos5
@@ -1,12 +1,10 @@
 FROM centos:5 AS builder
-ARG CHINA_MIRROR=1
 WORKDIR /data

 COPY ./docker/*.sh /data/docker/
 COPY ./downloads/perl* /data/

-RUN export CHINA_MIRROR="$CHINA_MIRROR" && \
-    bash ./docker/modify_yum_source.sh && \
+RUN bash ./docker/modify_vault_source.sh && \
    yum install -y gcc44 make

 RUN mkdir -p perl && tar xfz perl-*.tar.gz --strip-components=1 -C perl && pushd perl && \
@@ -16,19 +14,17 @@ RUN rm -rf perl-*.tar.gz perl


 FROM centos:5
-ARG CHINA_MIRROR=1
 ENV PATH=/usr/local/perl/bin:$PATH
 WORKDIR /data
 COPY --from=builder /usr/local/perl /usr/local/perl
 COPY ./docker/*.sh /data/docker/

-RUN export CHINA_MIRROR="$CHINA_MIRROR" && \
-    bash ./docker/modify_yum_source.sh && \
-    yum install -y gcc44 autoconf automake make rpm-build pam-devel krb5-devel zlib-devel
-
-RUN cat /etc/yum.repos.d/CentOS-Base.repo | sed 's|]$|-i386]|;s|\$basearch|i386|g' > /etc/yum.repos.d/CentOS-Base-i386.repo && \
-	yum makecache && \
-	yum install -y glibc-devel.i386 libgcc.i386 pam-devel.i386 krb5-devel.i386 zlib-devel.i386 && \
-	yum clean all
+RUN bash ./docker/modify_vault_source.sh && \
+    yum install -y gcc44 autoconf automake make rpm-build redhat-rpm-config setarch pam-devel krb5-devel zlib-devel && \
+    mkdir -p /etc/rpm && printf '%s\n' '%dist .el5' > /etc/rpm/macros.dist && \
+    sed 's|]$|-i386]|;s|\$basearch|i386|g' /etc/yum.repos.d/CentOS-Base.repo > /etc/yum.repos.d/CentOS-Base-i386.repo && \
+    yum makecache && \
+    yum install -y glibc-devel.i386 libgcc.i386 pam-devel.i386 krb5-devel.i386 zlib-devel.i386 e2fsprogs-devel.i386 && \
+    yum clean all

 CMD ["./docker/docker_compile.sh"]
--- a/docker/Dockerfile.openeuler
+++ b/docker/Dockerfile.openeuler
@@ -1,34 +0,0 @@
-# Official: https://hub.docker.com/r/openeuler/openeuler
-ARG VERSION_NUM="24.03"
-FROM openeuler/openeuler:$VERSION_NUM
-ARG VERSION_NUM
-ARG CHINA_MIRROR=0
-LABEL Author="Rex Zhou <zrx879582094@gmail.com>"
-
-WORKDIR /data
-
-# Copy all files
-COPY . /data
-
-# Official webpage: https://www.openeuler.openatom.cn/zh/blog/2024-10-15-boostYum/2024-10-15-boostYum.html
-RUN if [ "$CHINA_MIRROR" != "0" ]; then \
-        MIRROR_URL="mirrors.163.com/openeuler" && \
-        sed -i.bak \
-            "s|repo.openeuler.org|$MIRROR_URL|g;s|^metalink|#metalink|g" \
-            /etc/yum.repos.d/openEuler.repo; \
-    else \
-        MIRROR_URL="mirrors.ocf.berkeley.edu/openeuler" && \
-        sed -i.bak \
-            "s|repo.openeuler.org|$MIRROR_URL|g;s|^metalink|#metalink|g" \
-            /etc/yum.repos.d/openEuler.repo; \
-    fi && \
-    if [[ "$VERSION_NUM" == 20* ]]; then sed -i \
-            "s|gpgcheck=1|gpgcheck=0|g" /etc/yum.repos.d/openEuler.repo; \
-    fi && \
-    rm -rf /var/cache/yum/ && \
-    yum clean all && yum makecache timer && \
-    yum install -y autoconf automake gcc make rpm-build pam-devel krb5-devel zlib-devel systemd-devel openssl-devel \
-                   perl perl-IPC-Cmd perl-Time-Piece wget && \
-    yum clean all
-
-CMD ["./docker/docker_compile.sh"]
--- a/docker/Dockerfile.rockylinux
+++ b/docker/Dockerfile.rockylinux
@@ -1,32 +0,0 @@
-# Official: https://hub.docker.com/_/rockylinux
-ARG VERSION_NUM="9"
-FROM rockylinux:$VERSION_NUM
-ARG VERSION_NUM
-ARG CHINA_MIRROR=0
-LABEL Author="Rex Zhou <zrx879582094@gmail.com>"
-
-WORKDIR /data
-
-# Copy all files
-COPY . /data
-
-# Official webpage: https://developer.aliyun.com/mirror/rockylinux
-RUN if [ "$CHINA_MIRROR" != "0" ]; then \
-        MIRROR_URL="https://mirrors.aliyun.com/rockylinux" && \
-        sed -e 's|^mirrorlist=|#mirrorlist=|g' \
-            -e "s|^#baseurl=http://dl.rockylinux.org/\$contentdir|baseurl=$MIRROR_URL|g" \
-            -i.bak \
-            /etc/yum.repos.d/*.repo; \
-    else \
-        MIRROR_URL="https://mirrors.ocf.berkeley.edu/rocky" && \
-        sed -e 's|^mirrorlist=|#mirrorlist=|g' \
-            -e "s|^#baseurl=http://dl.rockylinux.org/\$contentdir|baseurl=$MIRROR_URL|g" \
-            -i.bak \
-            /etc/yum.repos.d/*.repo; \
-    fi && \
-    rm -rf /var/cache/yum/ && \
-    yum clean all && yum makecache timer && \
-    yum install -y wget autoconf automake gcc perl make rpm-build pam-devel krb5-devel zlib-devel libXt-devel libX11-devel gtk2-devel systemd-devel openssl-devel && \
-    yum clean all
-
-CMD ["./docker/docker_compile.sh"]
--- a/docker/README.md
+++ b/docker/README.md
@@ -1,442 +1,171 @@
-## Wanna 🐳Docker?
+# elssh Build Guide – Docker-based RPM Packaging

-### TLDR
+This document explains how to build **elssh** RPM packages for various Enterprise Linux versions using Docker.

-#### I JUST WANT RPMS
+You only need to build the versions you actually require. There is no need to run all commands.

-This script below can compile rpm packages for all systems.
+All built RPM packages will be automatically placed in the `./output/` directory on your host machine.
+
+## Prerequisites
+
+- Docker (version 20+ recommended)
+- Git
+- Sufficient disk space (~10 GB+ recommended)
+- Internet connection
+
+## Step 1: Download Sources
+
+You must download the source code and tarballs before building:

 ```bash
-# Download all src files
-source version.env
-PERLMIR=https://www.cpan.org/src/5.0
-if [[ ! -f downloads/$PERLSRC ]]; then
-	curl -k -o downloads/$PERLSRC $PERLMIR/$PERLSRC
-fi
-bash ./pullsrc.sh
-# Define whether to enable Tsinghua University mirror source. (Very useful for Chinese users)
-CHINA_MIRROR=1  # Setting this variable to non-zero means enabling
-OUTPUT="/tmp"
-
-# Specify build CentOS versions
-VERSIONS=("7" "6" "5")
-
-for VERSION in "${VERSIONS[@]}"
-do
-  echo "Building CentOS: ${VERSION}"
-  # Build docker image
-  docker build \
-         -t rpm-builder-centos:$VERSION \
-         --build-arg VERSION_NUM=$VERSION \
-         --build-arg CHINA_MIRROR=$CHINA_MIRROR \
-         -f docker/Dockerfile.centos .
-  mkdir -p $OUTPUT/centos/$VERSION
-  # Start container
-  docker run -it --rm \
-         -v $OUTPUT/centos/$VERSION:/data/el$VERSION/RPMS/$(uname -m) \
-         rpm-builder-centos:$VERSION
-done
-
-# Specify build CentOS Stream versions
-VERSIONS=("9" "8")
-
-for VERSION in "${VERSIONS[@]}"
-do
-  echo "Building CentOS Stream: ${VERSION}"
-  # Build docker image
-  docker build \
-         -t rpm-builder-centos-stream:$VERSION \
-         --build-arg VERSION_NUM=$VERSION \
-         --build-arg CHINA_MIRROR=$CHINA_MIRROR \
-         -f docker/Dockerfile.centos-stream .
-  mkdir -p $OUTPUT/centos-stream/$VERSION
-  # Start container
-  docker run -it --rm \
-         -v $OUTPUT/centos-stream/$VERSION:/data/el7/RPMS/$(uname -m) \
-         rpm-builder-centos-stream:$VERSION
-done
-
-# Specify build Amazon Linux versions
-VERSIONS=("2023" "2" "1")
-
-for VERSION in "${VERSIONS[@]}"
-do
-  echo "Building version: ${VERSION}"
-  # Build docker image
-  docker build \
-         -t rpm-builder-amazonlinux:$VERSION \
-         --build-arg VERSION_NUM=$VERSION \
-         --build-arg CHINA_MIRROR=$CHINA_MIRROR \
-         -f docker/Dockerfile.amazonlinux .
-  mkdir -p $OUTPUT/amazonlinux/$VERSION
-  # Start container
-  docker run -it --rm \
-         -v $OUTPUT/amazonlinux/$VERSION:/data/amzn$VERSION/RPMS/$(uname -m) \
-         rpm-builder-amazonlinux:$VERSION
-done
-
+# Download the pinned sources from version.env
+./pullsrc.sh
 ```

-#### I WANT UPLOAD TO NEXUS REPOSITORY
+> **Note**: Run this command only once before starting any builds. It downloads the single pinned set of sources defined in `version.env`. With `DOCKERBUILD=1 ./pullsrc.sh` only the Perl tarball is fetched (used for EL5 image builds).
+
+## Step 2: Building RPMs for Specific Platforms
+
+Choose only the platforms you need and run the corresponding commands.
+
+### x86_64 Builds
+
+#### For EL5 (CentOS 5)

 ```bash
-# Define output dir
-OUTPUT='/tmp'
-# Define upload auth info
-export NEXUS_REPOSITORY_URL='https://nexus.example.com/service/rest/v1/components?repository=my-yum-hosted'
-export NEXUS_USERNAME='uploader'
-export NEXUS_PASSWORD='Pa$$w0rD'
+# Build Docker image
+docker build -t elssh:el5 -f ./docker/Dockerfile.centos5 .

-declare -A MAPPING
-MAPPING["centos"]="7 6 5"
-MAPPING["centos-stream"]="9 8"
-MAPPING["amazonlinux"]="2023 2 1"
+# Build 64-bit packages (recommended)
+docker run --rm -v .:/data -e "M32=0" elssh:el5

-function upload_file(){
-  echo "Uploading: $1"
-  echo "Destination: $2"
-  curl \
-    --user "$NEXUS_USERNAME:$NEXUS_PASSWORD" \
-    $NEXUS_REPOSITORY_URL \
-    -H 'accept: application/json' \
-    -H 'Content-Type: multipart/form-data' \
-    -F "yum.directory=$2" \
-    -F "yum.asset=@$1;type=application/x-rpm" \
-    -F "yum.asset.filename=$(basename $1)"
-}
-export -f upload_file
-
-for OS_TYPE in "${!MAPPING[@]}"; do
-    VERSIONS=${MAPPING[$OS_TYPE]}
-    VERSIONS_ARRAY=($VERSIONS)
-
-    # If you need a clearer structure, uncomment the following
-    __OS_TYPE=$OS_TYPE
-    if [ "$OS_TYPE" = 'centos-stream' ];then __OS_TYPE='centos';fi
-    
-    for VERSION in "${VERSIONS_ARRAY[@]}"; do
-        echo "$OS_TYPE $VERSION"
-        find $OUTPUT/$OS_TYPE/$VERSION \
-          -type f \
-          -name '*.rpm' \
-          -exec bash -c 'upload_file "$1" "$2"' _ {} "$__OS_TYPE/$VERSION/$(uname -m)" \;
-    done
-done
+# Build 32-bit packages (optional)
+docker run --rm -v .:/data -e "M32=1" elssh:el5
 ```

-### Create image
-
-#### Login registry
-
-```shell
-# Login info
-USERNAME='User'
-PASSWORD='Pa$$W0rd'
-# Registry URL, leave it blank will use docker offcial registry: registry-1.docker.io
-SERVER='harbor.example.com'
-
-docker login -u "$USERNAME" -p "$PASSWORD" "$SERVER"
-
-# Define the path of compenent
-COMPONENT="$SERVER/cloudteam/openssh-rpm-builder"
-```
-
-#### CentOS
-
-##### Build images
-
-```shell
-# Specify build versions
-VERSIONS=("8" "7" "6" "5")
-# Define whether to enable Tsinghua University mirror source. (Very useful for Chinese users)
-CHINA_MIRROR=1  # Setting this variable to non-zero means enabling
-
-for VERSION in "${VERSIONS[@]}"
-do
-  echo "Building version: ${VERSION}"
-  # Build docker image
-  docker build \
-         -t $COMPONENT:centos$VERSION \
-         --build-arg VERSION_NUM=$VERSION \
-         --build-arg CHINA_MIRROR=$CHINA_MIRROR \
-         -f docker/Dockerfile.centos .
-done
-
-echo 'The building has been completed!'
-```
-
-##### Push images
-
-```shell
-# Specify build versions
-VERSIONS=("8" "7" "6" "5")
-
-for VERSION in "${VERSIONS[@]}"
-do
-  echo "Pushing version: ${VERSION}"
-  # Tag image
-  docker tag $COMPONENT:centos$VERSION $COMPONENT:centos.$VERSION
-  docker tag $COMPONENT:centos$VERSION $COMPONENT:centos.$VERSION.$(date +%Y%m%d)
-  docker tag $COMPONENT:centos$VERSION $COMPONENT:el$VERSION
-  # Push image
-  docker push $COMPONENT:centos$VERSION
-  docker push $COMPONENT:centos.$VERSION
-  docker push $COMPONENT:centos.$VERSION.$(date +%Y%m%d)
-  docker push $COMPONENT:el$VERSION
-done
-echo 'Push has been completed!'
-```
-
-#### CentOS Stream
-
-##### Build images
-
-```shell
-# Specify build versions
-VERSIONS=("9" "8")
-# Define whether to enable Tsinghua University mirror source. (Very useful for Chinese users)
-CHINA_MIRROR=1  # Setting this variable to non-zero means enabling
-
-for VERSION in "${VERSIONS[@]}"
-do
-  echo "Building version: ${VERSION}"
-  # Build docker image
-  docker build \
-         -t $COMPONENT:centos-stream$VERSION \
-         --build-arg VERSION_NUM=$VERSION \
-         --build-arg CHINA_MIRROR=$CHINA_MIRROR \
-         -f docker/Dockerfile.centos-stream .
-done
-
-echo 'The building has been completed!'
-```
-
-##### Push images
-
-```shell
-# Specify build versions
-VERSIONS=("9" "8")
-
-for VERSION in "${VERSIONS[@]}"
-do
-  echo "Pushing version: ${VERSION}"
-  # Tag image
-  docker tag $COMPONENT:centos-stream$VERSION $COMPONENT:centos-stream.$VERSION
-  docker tag $COMPONENT:centos-stream$VERSION $COMPONENT:centos-stream.$VERSION.$(date +%Y%m%d)
-  docker tag $COMPONENT:centos-stream$VERSION $COMPONENT:el$VERSION
-  # Push image
-  docker push $COMPONENT:centos-stream$VERSION
-  docker push $COMPONENT:centos-stream.$VERSION
-  docker push $COMPONENT:centos-stream.$VERSION.$(date +%Y%m%d)
-  docker push $COMPONENT:el$VERSION
-done
-echo 'Push has been completed!'
-```
-
-#### Amazon Linux
-
-##### Build images
-
-```shell
-# Specify build versions
-VERSIONS=("2023" "2" "1")
-# Define whether to enable China mirror source. (Very useful for Chinese users)
-CHINA_MIRROR=1  # Setting this variable to non-zero means enabling
-
-for VERSION in "${VERSIONS[@]}"
-do
-  echo "Building version: ${VERSION}"
-  # Build docker image
-  docker build \
-         -t $COMPONENT:amazonlinux$VERSION \
-         --build-arg VERSION_NUM=$VERSION \
-         --build-arg CHINA_MIRROR=$CHINA_MIRROR \
-         -f docker/Dockerfile.amazonlinux .
-done
-echo 'The building has been completed!'
-```
-
-##### Push images
-
-```shell
-# Specify build versions
-VERSIONS=("2023" "2" "1")
-
-for VERSION in "${VERSIONS[@]}"
-do
-  echo "Pushing version: ${VERSION}"
-  # Tag image
-  docker tag $COMPONENT:amazonlinux$VERSION $COMPONENT:amazonlinux.$VERSION
-  docker tag $COMPONENT:amazonlinux$VERSION $COMPONENT:amazonlinux.$VERSION.$(date +%Y%m%d)
-  docker tag $COMPONENT:amazonlinux$VERSION $COMPONENT:amzn$VERSION
-  docker tag $COMPONENT:amazonlinux$VERSION $COMPONENT:al$VERSION
-  # Push image
-  docker push $COMPONENT:amazonlinux$VERSION
-  docker push $COMPONENT:amazonlinux.$VERSION
-  docker push $COMPONENT:amazonlinux.$VERSION.$(date +%Y%m%d)
-  docker push $COMPONENT:amzn$VERSION
-  docker push $COMPONENT:al$VERSION
-done
-echo 'Push has been completed!'
-```
-
-### Use image
-
-#### Single OS
-
-```shell
-# Specify the name of tag.
-IMAGE_TAG="amzn2023"
-# Specify output path
-OUT_PATH="$PWD"
-
-mkdir -p $OUT_PATH
-
-# Start container
-docker run -it --rm \
-       -v $OUT_PATH:/data/$IMAGE_TAG/RPMS \
-       $COMPONENT:$IMAGE_TAG
-```
-
-#### Multi OS
-
-```shell
-# Specify output path
-OUT_PATH="$PWD"
-
-# Specify the name of tags.
-IMAGE_TAGS=("amzn2023" "amzn2" "amzn1" "el9" "el8" "el7" "el6" "el5")
-
-for IMAGE_TAG in "${IMAGE_TAGS[@]}"
-do
-  # Start container
-  docker run -it --rm \
-         -v $OUT_PATH:/data/$IMAGE_TAG/RPMS \
-         $COMPONENT:$IMAGE_TAG
-done
-```
-
-## For ARM users
-
- *CentOS 6 and lower operating systems **DO NOT** have an image of the ARM architecture.*
-
- *Amazon Linux 1 **DO NOT** have an image of the ARM architecture.*
-
-#### I JUST WANT RPMS
-
-This script below can compile rpm packages for all support systems.
+#### For EL6 (CentOS 6)

 ```bash
-# Download all src files
-source version.env
-PERLMIR=https://www.cpan.org/src/5.0
-if [[ ! -f downloads/$PERLSRC ]]; then
-	curl -k -o downloads/$PERLSRC $PERLMIR/$PERLSRC
-fi
-bash ./pullsrc.sh
-# Define whether to enable Tsinghua University mirror source. (Very useful for Chinese users)
-CHINA_MIRROR=1  # Setting this variable to non-zero means enabling
-OUTPUT="/tmp"
-
-# Specify build CentOS versions
-VERSION="7"
-
-echo "Building CentOS: ${VERSION}"
-# Build docker image
-docker build \
-       -t rpm-builder-centos:$VERSION \
-       --build-arg VERSION_NUM=$VERSION \
-       --build-arg CHINA_MIRROR=$CHINA_MIRROR \
-       -f docker/Dockerfile.centos .
-mkdir -p $OUTPUT/centos/$VERSION
-# Start container
-docker run -it --rm \
-       -v $OUTPUT/centos/$VERSION:/data/el7/RPMS/$(uname -m) \
-       rpm-builder-centos:$VERSION
-
-# Specify build CentOS Stream versions
-VERSIONS=("9" "8")
-
-for VERSION in "${VERSIONS[@]}"
-do
-  echo "Building CentOS Stream: ${VERSION}"
-  # Build docker image
-  docker build \
-         -t rpm-builder-centos-stream:$VERSION \
-         --build-arg VERSION_NUM=$VERSION \
-         --build-arg CHINA_MIRROR=$CHINA_MIRROR \
-         -f docker/Dockerfile.centos-stream .
-  mkdir -p $OUTPUT/centos-stream/$VERSION
-  # Start container
-  docker run -it --rm \
-         -v $OUTPUT/centos-stream/$VERSION:/data/el7/RPMS/$(uname -m) \
-         rpm-builder-centos-stream:$VERSION
-done
-
-# Specify build Amazon Linux versions
-VERSIONS=("2023" "2")
-
-for VERSION in "${VERSIONS[@]}"
-do
-  echo "Building version: ${VERSION}"
-  # Build docker image
-  docker build \
-         -t rpm-builder-amazonlinux:$VERSION \
-         --build-arg VERSION_NUM=$VERSION \
-         --build-arg CHINA_MIRROR=$CHINA_MIRROR \
-         -f docker/Dockerfile.amazonlinux .
-  mkdir -p $OUTPUT/amazonlinux/$VERSION
-  # Start container
-  docker run -it --rm \
-         -v $OUTPUT/amazonlinux/$VERSION:/data/amzn$VERSION/RPMS/$(uname -m) \
-         rpm-builder-amazonlinux:$VERSION
-done
-
+docker build -t elssh:el6 -f ./docker/Dockerfile.centos --build-arg VERSION_NUM=6 .
+docker run --rm -v .:/data elssh:el6
 ```

-#### I WANT UPLOAD TO NEXUS REPOSITORY
+#### For EL7 (CentOS 7)

 ```bash
-# Define output dir
-OUTPUT='/tmp'
-# Define upload auth info
-export NEXUS_REPOSITORY_URL='https://nexus.example.com/service/rest/v1/components?repository=my-yum-hosted'
-export NEXUS_USERNAME='uploader'
-export NEXUS_PASSWORD='Pa$$w0rD'
-
-declare -A MAPPING
-MAPPING["centos"]="7"
-MAPPING["centos-stream"]="9 8"
-MAPPING["amazonlinux"]="2023 2 1"
-
-function upload_file(){
-  echo "Uploading: $1"
-  echo "Destination: $2"
-  curl \
-    --user "$NEXUS_USERNAME:$NEXUS_PASSWORD" \
-    $NEXUS_REPOSITORY_URL \
-    -H 'accept: application/json' \
-    -H 'Content-Type: multipart/form-data' \
-    -F "yum.directory=$2" \
-    -F "yum.asset=@$1;type=application/x-rpm" \
-    -F "yum.asset.filename=$(basename $1)"
-}
-export -f upload_file
-
-for OS_TYPE in "${!MAPPING[@]}"; do
-    VERSIONS=${MAPPING[$OS_TYPE]}
-    VERSIONS_ARRAY=($VERSIONS)
-
-    # If you need a clearer structure, uncomment the following
-    __OS_TYPE=$OS_TYPE
-    if [ "$OS_TYPE" = 'centos-stream' ];then __OS_TYPE='centos';fi
-    
-    for VERSION in "${VERSIONS_ARRAY[@]}"; do
-        echo "$OS_TYPE $VERSION"
-        find $OUTPUT/$OS_TYPE/$VERSION \
-          -type f \
-          -name '*.rpm' \
-          -exec bash -c 'upload_file "$1" "$2"' _ {} "$__OS_TYPE/$VERSION/$(uname -m)" \;
-    done
-done
+docker build -t elssh:el7 -f ./docker/Dockerfile.centos --build-arg VERSION_NUM=7 .
+docker run --rm -v .:/data elssh:el7
 ```
+
+#### UOS 20 Variant (EL8)
+
+Reuse the EL8 image (CentOS Stream 8, `el7/` spec via `GUESS_DIST` mapping) and pass `UOS20=1` to enable the kernel-panic fix in `sshd.c` and prefix `PKGREL` with `uos20.` (so the resulting RPMs are distinguishable from the standard build).
+
+```bash
+docker build -t elssh:el8 -f ./docker/Dockerfile.centos-stream --build-arg VERSION_NUM=8 .
+docker run --rm -v .:/data -e "UOS20=1" elssh:el8
+```
+
+The aarch64 UOS20 build (CI artifact `rpm-uos20-aarch64`) uses the aarch64 EL8 image with `-e "UOS20=1"`.
+
+#### For EL8 (CentOS 8 / RHEL 8 / Rocky 8 / AlmaLinux 8)
+
+```bash
+docker build -t elssh:el8 -f ./docker/Dockerfile.centos-stream --build-arg VERSION_NUM=8 .
+docker run --rm -v .:/data elssh:el8
+```
+
+#### For EL9 (CentOS Stream 9 / RHEL 9 / Rocky 9 / AlmaLinux 9)
+
+```bash
+docker build -t elssh:el9 -f ./docker/Dockerfile.centos-stream --build-arg VERSION_NUM=9 .
+docker run --rm -v .:/data elssh:el9
+```
+
+### aarch64 (ARM64) Builds
+
+#### For EL7 aarch64
+
+```bash
+docker build -t elssh_aarch64:el7 \
+  --platform linux/arm64 \
+  -f ./docker/Dockerfile.centos \
+  --build-arg VERSION_NUM=7 .
+
+docker run --rm -v .:/data --platform linux/arm64 elssh_aarch64:el7
+```
+
+#### For EL8 aarch64
+
+```bash
+docker build -t elssh_aarch64:el8 \
+  --platform linux/arm64 \
+  -f ./docker/Dockerfile.centos-stream \
+  --build-arg VERSION_NUM=8 .
+
+docker run --rm -v .:/data --platform linux/arm64 elssh_aarch64:el8
+```
+
+#### For EL9 aarch64
+
+```bash
+docker build -t elssh_aarch64:el9 \
+  --platform linux/arm64 \
+  -f ./docker/Dockerfile.centos-stream \
+  --build-arg VERSION_NUM=9 .
+
+docker run --rm -v .:/data --platform linux/arm64 elssh_aarch64:el9
+```
+
+## Build Arguments
+
+| Argument          | Values | Description |
+|-------------------|--------|-----------|
+| `VERSION_NUM`     | 6,7,8,9| Specifies the target EL version (used in most Dockerfiles) |
+| `M32` (EL5 only)  | 0 or 1 | `0` = 64-bit, `1` = 32-bit |
+| `UOS20`           | 0 or 1 | `1` = build the UOS 20 variant (EL8 image); enables the kernel-panic patch and prefixes `PKGREL` with `uos20.` |
+
+> Note: Standalone Dockerfiles for Amazon Linux / openEuler / Rocky Linux have been consolidated into the generic EL images (reusing EL8/EL9 via glibc compatibility) and are no longer maintained separately.
+
+## Output Location
+
+After each successful build, all built `.rpm` files land directly in `./output/` (flat, no per-version subdirs):
+
+```
+output/
+├── openssh-*.rpm
+├── openssh-clients-*.rpm
+└── ...
+```
+
+Every build (native `./compile.sh` or Docker via `docker/docker_compile.sh`) funnels through the same copy step, so building another EL version adds to / overwrites the same flat directory — copy the files out first if you need to keep versions separate.
+
+## Quick Start Examples
+
+### Build only for modern systems (EL8 + EL9)
+
+```bash
+./pullsrc.sh
+
+docker build -t elssh:el8 -f ./docker/Dockerfile.centos-stream --build-arg VERSION_NUM=8 .
+docker run --rm -v .:/data elssh:el8
+
+docker build -t elssh:el9 -f ./docker/Dockerfile.centos-stream --build-arg VERSION_NUM=9 .
+docker run --rm -v .:/data elssh:el9
+```
+
+### Build only for ARM64
+
+```bash
+./pullsrc.sh
+
+docker build -t elssh_aarch64:el9 --platform linux/arm64 -f ./docker/Dockerfile.centos-stream --build-arg VERSION_NUM=9 .
+docker run --rm -v .:/data --platform linux/arm64 elssh_aarch64:el9
+```
+
+## Troubleshooting
+
+- **Permission issues**: Run `chown -R $USER output/` after building
+- **Docker build fails on first run**: This is normal — it needs to download base images and dependencies
+- **ARM64 builds**: Requires a machine with ARM64 support or Docker Buildx multi-platform enabled
+
--- a/docker/docker_compile.sh
+++ b/docker/docker_compile.sh
@@ -2,6 +2,19 @@
 DOCKER_BUILD_DIR=/BUILD
 mkdir -p $DOCKER_BUILD_DIR
 ELDIR=$(./compile.sh GETEL)
-[[ $ELDIR == el8 ]] && ELDIR=el7
-cp -r $ELDIR $DOCKER_BUILD_DIR
-./compile.sh $DOCKER_BUILD_DIR/$ELDIR
+
+if ! rpm -q openssl-devel; then
+	WITH_OPENSSL=2
+fi
+
+OPENSSLVER=$(rpm -q openssl --qf "%{VERSION}" | cut -d. -f1)
+if [[ ${WITH_OPENSSL+x} == "" ]]; then
+	if [[ $OPENSSLVER -ge 3 ]]; then
+		export WITH_OPENSSL=1
+	else
+		export WITH_OPENSSL=2
+	fi
+fi
+
+cp -r "$ELDIR" $DOCKER_BUILD_DIR
+./compile.sh "$DOCKER_BUILD_DIR/$ELDIR"
--- a/docker/modify_dnf_source.pl
+++ b/docker/modify_dnf_source.pl
@@ -1,37 +0,0 @@
-#!/usr/bin/perl
-
-use strict;
-use warnings;
-use autodie;
-
-my $mirrors = 'MIRROR_HOLDER';
-
-if (@ARGV < 1) {
-    die "Usage: $0 <filename1> <filename2> ...\n";
-}
-
-while (my $filename = shift @ARGV) {
-    my $backup_filename = $filename . '.bak';
-    rename $filename, $backup_filename;
-
-    open my $input, "<", $backup_filename;
-    open my $output, ">", $filename;
-
-    while (<$input>) {
-        s/^metalink/# metalink/;
-
-        if (m/^name/) {
-            my (undef, $repo, $arch) = split /-/;
-            $repo =~ s/^\s+|\s+$//g;
-            ($arch = defined $arch ? lc($arch) : '') =~ s/^\s+|\s+$//g;
-
-            if ($repo =~ /^Extras/) {
-                $_ .= "baseurl=${mirrors}/SIGs/\$releasever-stream/extras" . ($arch eq 'source' ? "/${arch}/" : "/\$basearch/") . "extras-common\n";
-            } else {
-                $_ .= "baseurl=${mirrors}/\$releasever-stream/$repo" . ($arch eq 'source' ? "/" : "/\$basearch/") . ($arch ne '' ? "${arch}/tree/" : "os") . "\n";
-            }
-        }
-
-        print $output $_;
-    }
-}
--- a/docker/modify_live_source.sh
+++ b/docker/modify_live_source.sh
@@ -0,0 +1,86 @@
+#!/bin/bash
+# Rewrite DNF repository baseurls for still-supported CentOS Stream EL
+# (e.g. 9-stream). Uses multiple failover baseurls; vault handling for
+# EOL 8-stream lives in docker/modify_vault_source.sh.
+#
+# DNF 4.x `baseurl` is `list` type: space-or-comma-separated URLs on ONE line;
+# repeated `baseurl=` keys overwrite (only the last survives) — see
+# dnf.readthedocs.io/conf_ref.html — so all mirrors go on a single baseurl= line.
+#
+# Note on mirror base paths: each entry is a prefix; the script appends
+# "/${path}" (e.g. "9-stream/BaseOS/x86_64/os") to build the final URL.
+# We use https://mirrors.kernel.org/centos (kernel.org official mirror) as
+# the second entry; https://mirrors.kernel.org/centos-stream is an equally
+# valid alternative that also resolves to the same kernel.org edge mirror.
+
+# Official-first mirror list for still-supported Stream releases
+LIVE_MIRRORS=(
+	"https://mirror.stream.centos.org"
+	"https://mirrors.kernel.org/centos"
+	"https://mirrors.aliyun.com/centos-stream"
+	"https://mirrors.ustc.edu.cn/centos-stream"
+	"https://ftp.iij.ad.jp/pub/linux/centos-stream"
+	"https://ftp.yandex.ru/centos-stream"
+)
+
+usage() {
+	echo "Usage: $0 <filename1> <filename2> ..." >&2
+	exit 1
+}
+
+if [[ $# -lt 1 ]]; then
+	usage
+fi
+
+# Trim leading/trailing whitespace from a string (result on stdout)
+trim() {
+	local s="$1"
+	s="${s#"${s%%[![:space:]]*}"}"
+	s="${s%"${s##*[![:space:]]}"}"
+	printf '%s' "$s"
+}
+
+while [[ $# -gt 0 ]]; do
+	filename="$1"
+	shift
+	backup="${filename}.bak"
+	mv "$filename" "$backup" || continue
+	while IFS= read -r line; do
+		# comment out any metalink line (mirrors are preferred)
+		if [[ $line == metalink* ]]; then
+			line="# ${line}"
+		fi
+		if [[ $line == name* ]]; then
+			# split the "name=... - <repo> - <arch>" line on dashes
+			IFS='-' read -ra parts <<<"$line"
+			repo=$(trim "${parts[1]:-}")
+			arch=$(trim "${parts[2]:-}")
+			arch=${arch,,}
+			if [[ $repo == Extras* ]]; then
+				if [[ $arch == source ]]; then
+					path="SIGs/\$releasever-stream/extras/${arch}/extras-common"
+				else
+					path="SIGs/\$releasever-stream/extras/\$basearch/extras-common"
+				fi
+			else
+				if [[ $arch == source ]]; then
+					path="\$releasever-stream/${repo}/source/tree/"
+				else
+					path="\$releasever-stream/${repo}/\$basearch/os"
+				fi
+			fi
+			printf '%s\n' "$line"
+			# Single baseurl= line with all mirrors space-separated (DNF `list`
+			# type: repeated `baseurl=` keys overwrite, so one line is required).
+			urls=""
+			sep=""
+			for mirror in "${LIVE_MIRRORS[@]}"; do
+				urls+="${sep}${mirror}/${path}"
+				sep=" "
+			done
+			printf 'baseurl=%s\n' "$urls"
+		else
+			printf '%s\n' "$line"
+		fi
+	done <"$backup" >"$filename"
+done
--- a/docker/modify_vault_source.sh
+++ b/docker/modify_vault_source.sh
@@ -0,0 +1,208 @@
+#!/bin/bash
+# Rewrite yum repository baseurls to use multiple (failover) mirrors.
+# yum/dnf try each baseurl in order, so listing several provides resilience.
+# EL5/EL6 use plain HTTP mirrors only (Python 2.4 / old curl cannot handle
+# HTTPS redirects); EL7/EL8 keep HTTPS mirrors. EL8-stream is also EOL and lives
+# in the vault, so it is handled here too. EL7 and EL8 share the VAULT array
+# (yandex has no altarch tree, but the earlier failover mirrors cover aarch64).
+# VAULT is ordered official-first (the canonical CentOS vault, then the kernel.org
+# archive) so GitHub CI uses the canonical source; the remaining mirrors are
+# failover only. Only EL5/EL6 fall back to VAULT_HTTP (plain HTTP) due to the
+# Python 2.4 TLS limitation; EL7/EL8 always use the HTTPS VAULT array.
+# EPEL archive mirrors (EPEL array) are plain HTTP and shared by EL7/EL6/EL5.
+#
+# Mirror base URLs are kept in the arrays below (no version suffix, no trailing
+# slash) so they are easy to add/remove when a mirror goes stale. Use the
+# join_baseurls / rewrite_baseurls helpers to turn an array + suffix into a
+# SINGLE "baseurl=<url1> <url2> ..." line (DNF 4.x `baseurl` is `list` type:
+# space-separated URLs on ONE line; repeated `baseurl=` keys overwrite — only
+# the last survives — see dnf.readthedocs.io/conf_ref.html. YUM also accepts
+# this form.)
+
+RELEASE_VER=$(rpm --eval '%{?dist}')
+[ -z "$RELEASE_VER" ] && RELEASE_VER=".el5"
+
+# aarch64 builds use the altarch (CentOS AltArch) vault tree
+ALTARCH=""
+[ "$(uname -m)" = "aarch64" ] && ALTARCH="/altarch"
+
+# CentOS vault mirrors - official-first HTTPS, shared by el7/el7-altarch/el8
+# Criteria: hosts 7.9.2009, altarch/7.9.2009 (aarch64) and 8-stream; HTTPS valid
+# (cert OK, no forced http->https 302, good for GitHub CI TLS); official priority
+# (canonical CentOS vault, then kernel.org archive)
+# shellcheck disable=SC2034
+VAULT=(
+	"https://vault.centos.org"
+	"https://archive.kernel.org/centos-vault"
+	"https://mirrors.aliyun.com/centos-vault"
+	"https://ftp.iij.ad.jp/pub/linux/centos-vault"
+)
+# CentOS vault mirrors - plain HTTP for EL5/6 (hosts 5.11, 6.10 and 6.10/sclo;
+# http only, no forced https redirect, avoids EL5 Python 2.4 / old curl TLS 1.0 failure)
+# shellcheck disable=SC2034
+VAULT_HTTP=(
+	"http://ftp.iij.ad.jp/pub/linux/centos-vault"
+	"http://mirrors.aliyun.com/centos-vault"
+	"http://ftp.yandex.ru/centos"
+	"http://ftp.pasteur.fr/mirrors/centos-vault"
+)
+# EPEL archive mirrors (plain HTTP for all EL, 7/6/5 share).
+# archives.fedoraproject.org is excluded: it 302-redirects http->https, which
+# EL5 Python 2.4 / M2Crypto cannot follow (uncaught SSLError aborts yum before
+# mirror failover). All remaining mirrors serve plain HTTP without redirect.
+# shellcheck disable=SC2034
+EPEL=(
+	"http://mirrors.aliyun.com/epel-archive"
+	"http://ftp.iij.ad.jp/pub/linux/Fedora/archive/epel"
+	"http://mirrors.sindad.cloud/epel-archive"
+	"http://ftp.yandex.ru/epel-archive"
+	"http://debian.sbor.net/epel-archive"
+)
+
+disable_fastestmirror() {
+	sed -e 's|enabled=1|enabled=0|' -i /etc/yum/pluginconf.d/fastestmirror.conf 2>/dev/null || true
+}
+
+# Join array elements into a SINGLE "baseurl=<url1> <url2> ..." line
+# (DNF 4.x `baseurl` is `list` type: space-or-comma-separated on ONE line;
+# repeated `baseurl=` keys overwrite — only the last survives — see
+# dnf.readthedocs.io/conf_ref.html. YUM also accepts this form.)
+# Usage: join_baseurls <suffix> <array_name>
+#   e.g. join_baseurls "/7.9.2009" VAULT
+# Uses eval instead of a nameref so it works on bash 4.2 (CentOS 7).
+join_baseurls() {
+	local suffix="$1"
+	local arr_name="$2"
+	local arr
+	eval "arr=(\"\${${arr_name}[@]}\")"
+	local out="baseurl="
+	local sep=""
+	for m in "${arr[@]}"; do
+		out+="${sep}${m}${suffix}"
+		sep=" "
+	done
+	printf '%s' "$out"
+}
+
+# For every "baseurl=<prefix>..." line (whatever its content or comment
+# format): comment the original line out by prepending "#", then add our own
+# SINGLE active "baseurl=<url1> <url2> ..." line right below it. This makes
+# the rewrite independent of how the repo file wrote the line ("#baseurl=",
+# "# baseurl=", or an active "baseurl="). DNF 4.x `baseurl` is `list` type:
+# space-separated URLs on ONE line; repeated `baseurl=` keys overwrite — only
+# the last survives — so our added line wins (see dnf.readthedocs.io/
+# conf_ref.html. YUM also accepts this form). Each added URL keeps the
+# remainder after <prefix>; <suffix> is inserted between mirror and remainder
+# (e.g. the vault version). Works on bash 3.2 (el5).
+# Usage: rewrite_baseurls <glob> <prefix> <suffix> <array_name>
+#   e.g. rewrite_baseurls "/etc/yum.repos.d/CentOS-*.repo" \
+#        "http://mirror.centos.org/\$contentdir" "" VAULT
+rewrite_baseurls() {
+	local glob="$1" prefix="$2" suffix="$3" arr_name="$4"
+	local arr out line rest m file urls sep
+	eval "arr=(\"\${${arr_name}[@]}\")"
+	for file in $glob; do
+		out=""
+		while IFS= read -r line || [ -n "$line" ]; do
+			if [[ $line == *"baseurl=$prefix"* ]]; then
+				rest="${line##*"$prefix"}"
+				urls=""
+				sep=""
+				for m in "${arr[@]}"; do
+					urls+="${sep}${m}${suffix}${rest}"
+					sep=" "
+				done
+				out+="#${line}\nbaseurl=${urls}\n"
+			else
+				out+="$line\n"
+			fi
+		done <"$file"
+		printf '%b' "$out" >"$file"
+	done
+}
+
+modify_el8() {
+	disable_fastestmirror
+	# Rewrite the repos BEFORE any dnf operation: the stream8/GA8 repo files
+	# still carry an active mirrorlist=http://mirrorlist.centos.org/... line,
+	# and that host is decommissioned (NXDOMAIN), so any dnf metadata refresh
+	# before the fixup aborts with "Couldn't resolve host name". (The
+	# dnf-plugins-core install for `dnf config-manager` lives in
+	# Dockerfile.centos-stream, AFTER this script.)
+	sed -e 's|^mirrorlist=|#mirrorlist=|g' \
+		-e 's|^metalink|#metalink|' \
+		-i.bak /etc/yum.repos.d/CentOS-*.repo
+	# EL8 GA repos use "$contentdir/$releasever" and EL8-stream repos use
+	# "$contentdir/$stream"; the remainder after the prefix (which contains
+	# $releasever or $stream) is preserved, so one rewrite covers both. Emits a
+	# single baseurl= line with space-separated URLs (DNF `list` type).
+	rewrite_baseurls "/etc/yum.repos.d/CentOS-*.repo" "http://mirror.centos.org/\$contentdir" "" VAULT
+}
+
+modify_el7() {
+	disable_fastestmirror
+	sed -e '/^mirrorlist=/s|^|#|g' \
+		-e 's|^metalink|#metalink|' \
+		-i.bak /etc/yum.repos.d/CentOS-*.repo
+	rewrite_baseurls "/etc/yum.repos.d/CentOS-*.repo" "http://mirror.centos.org/centos/\$releasever" "${ALTARCH}/7.9.2009" VAULT
+	rewrite_baseurls "/etc/yum.repos.d/CentOS-*.repo" "http://mirror.centos.org/altarch/\$releasever" "/altarch/7.9.2009" VAULT
+	yum install -y epel-release
+	sed -e '/^mirrorlist=/s|^|#|g' \
+		-e 's|^metalink|#metalink|' \
+		-i.bak /etc/yum.repos.d/epel*.repo 2>/dev/null || true
+	rewrite_baseurls "/etc/yum.repos.d/epel*.repo" "http://download.fedoraproject.org/pub/epel/7" "/7" EPEL
+	rm -rf /var/cache/yum/
+	yum makecache fast
+}
+
+modify_el6() {
+	disable_fastestmirror
+	sed -e "s|^mirrorlist=|#mirrorlist=|g" \
+		-e 's|^metalink|#metalink|' \
+		-i.bak /etc/yum.repos.d/CentOS-*.repo
+	rewrite_baseurls "/etc/yum.repos.d/CentOS-*.repo" "http://mirror.centos.org/centos/\$releasever" "/6.10" VAULT_HTTP
+	rewrite_baseurls "/etc/yum.repos.d/CentOS-*.repo" "http://mirror.centos.org/\$contentdir/\$releasever" "/6.10" VAULT_HTTP
+	yum install -y epel-release centos-release-scl-rh centos-release-scl
+	sed -e "s|^mirrorlist=|#mirrorlist=|g" \
+		-e 's|^metalink|#metalink|' \
+		-i.bak /etc/yum.repos.d/epel*.repo /etc/yum.repos.d/*scl*.repo 2>/dev/null || true
+	rewrite_baseurls "/etc/yum.repos.d/*scl*.repo" "http://mirror.centos.org/centos/6/sclo" "/6.10/sclo" VAULT_HTTP
+	rewrite_baseurls "/etc/yum.repos.d/epel*.repo" "http://download.fedoraproject.org/pub/epel/6" "/6" EPEL
+	rm -rf /var/cache/yum/
+	yum makecache fast
+}
+
+modify_el5() {
+	disable_fastestmirror
+	sed -e "s|^mirrorlist=|#mirrorlist=|g" \
+		-e 's|^metalink|#metalink|' \
+		-i.bak /etc/yum.repos.d/*.repo
+	rewrite_baseurls "/etc/yum.repos.d/*.repo" "http://mirror.centos.org/centos/\$releasever" "/5.11" VAULT_HTTP
+	rewrite_baseurls "/etc/yum.repos.d/*.repo" "http://mirror.centos.org/\$contentdir/\$releasever" "/5.11" VAULT_HTTP
+	yum install -y epel-release
+	sed -e "/^mirrorlist/s|^|#|g" \
+		-e 's|^metalink|#metalink|' \
+		-i.bak /etc/yum.repos.d/epel*.repo 2>/dev/null || true
+	rewrite_baseurls "/etc/yum.repos.d/epel*.repo" "http://download.fedoraproject.org/pub/epel/5" "/5" EPEL
+	rm -rf /var/cache/yum/
+	yum makecache
+}
+
+case $RELEASE_VER in
+	.el7)
+		modify_el7
+		;;
+	.el6)
+		modify_el6
+		;;
+	.el5)
+		modify_el5
+		;;
+	.el8)
+		modify_el8
+		;;
+	*)
+		echo "Unsupported dist: $RELEASE_VER, expected el5/el6/el7/el8"
+		exit 1
+		;;
+esac
--- a/docker/modify_yum_source.sh
+++ b/docker/modify_yum_source.sh
@@ -1,102 +0,0 @@
-#!/bin/bash
-
-# Author: Rex Chow
-# Modified: 2024-07-08 09:29:45
-# Description: This script will modify yum repositories to Tsinghua University mirror.
-# Copyright: Copyright © 2024 Rex Zhou. All rights reserved.
-
-RELEASE_VER=$(rpm --eval '%{?dist}')
-[ -z "$RELEASE_VER" ] && RELEASE_VER=".el5"
-
-# Cent OS 5 is NOT support modern SSL protocol, so use plain HTTP protocol.
-if [ "$RELEASE_VER" != ".el5" ]; then
-  if [ "$CHINA_MIRROR" != "0" ]; then
-    # Using USTC mirror, which is much useful for Chinese users.
-    MIRROR_URL="https://mirrors.ustc.edu.cn/centos-vault";
-    AWS_DOMAIN="amazonaws.com.cn"
-    AWS_REGION="cn-northwest-1"
-  else
-    # Default mirror, the official mirror link.
-    MIRROR_URL="https://vault.centos.org/";
-    AWS_DOMAIN="amazonaws.com"
-    AWS_REGION="us-east-2"
-  fi
-  else
-    MIRROR_URL="http://mirrors.huaweicloud.com"
-fi
-
-# For ARM platform, the mirror url needs a suffix `altarch`
-if [ "$(uname -m)" = "aarch64" ]; then
-  OS_KEY="altarch"
-  if [ "$RELEASE_VER" != ".el8" ]; then
-    MIRROR_URL="$MIRROR_URL/$OS_KEY";
-  fi
-else
-  OS_KEY="centos"
-fi
-
-function modify_el8() {
-  sed -e "s|^mirrorlist=|#mirrorlist=|g" \
-      -e "s|^#baseurl=http://mirror.centos.org/\$contentdir/\$releasever|baseurl=${MIRROR_URL}/8.5.2111|g" \
-      -i.bak /etc/yum.repos.d/CentOS-*.repo && \
-  rm -rf /var/cache/yum/ && \
-  yum makecache timer
-}
-
-function modify_el7() {
-  sed -e 's|^mirrorlist=|#mirrorlist=|g' \
-  -e "s@^#baseurl=http://mirror.centos.org/$OS_KEY/\$releasever@baseurl=${MIRROR_URL}/7.9.2009@g" \
-  -e "s|^#baseurl=http://mirror.centos.org/\$contentdir/\$releasever|baseurl=${MIRROR_URL}/7.9.2009|g" \
-      -i.bak /etc/yum.repos.d/CentOS-*.repo && \
-  rm -rf /var/cache/yum/ && \
-  yum makecache fast
-}
-
-function modify_el6() {
-  sed -e "s|^mirrorlist=|#mirrorlist=|g" \
-      -e "s|^#baseurl=http://mirror.centos.org/$OS_KEY/\$releasever|baseurl=${MIRROR_URL}/6.10|g" \
-      -e "s|^#baseurl=http://mirror.centos.org/\$contentdir/\$releasever|baseurl=${MIRROR_URL}/6.10|g" \
-      -i.bak /etc/yum.repos.d/CentOS-*.repo && \
-  rm -rf /var/cache/yum/ && \
-  yum makecache fast
-}
-
-function modify_el5() {
-  sed -e "s|^mirrorlist=|#mirrorlist=|g" \
-      -e "s|^#baseurl=http://mirror.centos.org/centos/\$releasever|baseurl=${MIRROR_URL}/centos-vault/5.11|g" \
-      -e "s|^#baseurl=http://mirror.centos.org/\$contentdir/\$releasever|baseurl=${MIRROR_URL}/centos-vault/5.11|g" \
-      -i.bak /etc/yum.repos.d/*.repo && \
-  rm -rf /var/cache/yum/ && \
-  yum makecache fast
-}
-
-case $RELEASE_VER in
-  .el8)
-    modify_el8
-    ;;
-  .el7)
-    modify_el7
-    ;;
-  .el6)
-    modify_el6
-    ;;
-  .el5)
-    modify_el5
-    ;;
-  .amzn1)
-    echo "$AWS_DOMAIN" > /etc/yum/vars/awsdomain
-    echo "$AWS_REGION" > /etc/yum/vars/awsregion
-    ;;
-  .amzn2)
-    echo "$AWS_DOMAIN" > /etc/yum/vars/awsdomain
-    echo "$AWS_REGION" > /etc/yum/vars/awsregion
-    ;;
-  .amzn2023)
-    echo "$AWS_DOMAIN" > /etc/dnf/vars/awsdomain
-    echo "$AWS_REGION" > /etc/dnf/vars/awsregion
-    ;;
-  *)
-    echo "rpm dist undefined, please specify: el5 el6 el7"
-    exit 1
-    ;;
-esac
--- a/downloads/.keep
+++ b/downloads/.keep
--- a/el5/BUILD/.keep
+++ b/el5/BUILD/.keep
--- a/el5/README.md
+++ b/el5/README.md
@@ -1,36 +1,17 @@
-# OpenSSH RPM Build for EL5
+# EL5 Build Tree (`el5/`)

-This project provides an RPM Spec file designed to build a modern version of OpenSSH on legacy Enterprise Linux 5 (EL5) systems.
+RPM spec for backporting OpenSSH on Enterprise Linux 5 (SysVinit).

-## Key Features
+## Notes

-### 1. Legacy Environment Support (EL5)
-Building modern software on EL5 is challenging due to outdated system libraries and build tools. This spec file contains specific logic to overcome these limitations without replacing core system packages.
+- **Perl bootstrap**: modern OpenSSL requires Perl >= 5.10, while EL5
+  ships Perl 5.8. If the system Perl is too old, a private Perl
+  (`PERLSRC` in `version.env`) is built inside the build tree and used
+  only to compile OpenSSL; it is neither packaged nor installed.
+  `compile.sh` adds `PERLSRC` to the source list automatically for this
+  directory.
+- **Toolchain**: built with `CC=gcc44`; OpenSSL is linked statically
+  (`WITH_OPENSSL=2`).

-### 2. Perl Bootstrap
-Modern versions of OpenSSL (which are required for modern OpenSSH) depend on Perl version 5.10.0 or higher for their build system. EL5 repositories typically provide Perl 5.8, which is insufficient.
-
-To address this, the spec file implements a **Perl bootstrap process**:
-*   It checks the version of the system's Perl.
-*   If the system Perl is too old, it compiles a modern version of Perl (default: 5.38.2) from source inside the build directory.
-*   This custom Perl is used exclusively during the build process to compile OpenSSL and is not installed into the final RPM or the system.
-
-### 3. Static OpenSSL Compilation
-Using the bootstrapped Perl, the spec file compiles a modern version of OpenSSL (default: 3.0.8).
-*   OpenSSL is built statically within the build tree.
-*   It is linked directly into the OpenSSH binaries.
-*   This ensures the new OpenSSH has access to modern cryptography (like TLS 1.3 support) while leaving the system's original OpenSSL libraries untouched to prevent dependency conflicts.
-
-### 4. Final OpenSSH Build
-The process culminates in building OpenSSH (default: 9.6p1), linked against the custom-built static OpenSSL library.
-
-## Build Flow Summary
-
-1.  **Detect Perl Version**: If system Perl < 5.10, build custom Perl.
-2.  **Build OpenSSL**: Use the custom Perl to configure and build OpenSSL.
-3.  **Build OpenSSH**: Configure OpenSSH to use the custom OpenSSL headers and libraries.
-
-## Default Versions
-*   **OpenSSH**: 9.6p1
-*   **OpenSSL**: 3.0.8
-*   **Perl**: 5.38.2
+Versions come from `version.env`. For usage, config variables, and
+supported distros see the root [README.md](../README.md).
--- a/el5/RPMS/.keep
+++ b/el5/RPMS/.keep
--- a/el5/SOURCES/10.4-fix-gssapi.patch
+++ b/el5/SOURCES/10.4-fix-gssapi.patch
@@ -0,0 +1,134 @@
+From c147093565634eae9f91e4df99e04a6b3513f9c6 Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Tue, 7 Jul 2026 01:00:22 +0000
+Subject: [PATCH 1/2] upstream: fix GSSAPI option names, that I somehow screwed
+ up while
+
+refactoring servconf.c bz3974 patch from Colin Watson
+
+OpenBSD-Commit-ID: be39ad3dbe36d9ecdb86f3811da5dfbdc9bcb1e6
+---
+ servconf.c | 18 +++++++++---------
+ servconf.h | 18 +++++++++---------
+ 2 files changed, 18 insertions(+), 18 deletions(-)
+
+diff --git a/servconf.c b/servconf.c
+index ce388f1dd..9b443bea0 100644
+--- a/servconf.c
+++ b/servconf.c
+@@ -1,4 +1,4 @@
+-/* $OpenBSD: servconf.c,v 1.450 2026/06/29 08:59:31 djm Exp $ */
+/* $OpenBSD: servconf.c,v 1.451 2026/07/07 01:00:22 djm Exp $ */
+ /*
+  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
+  *                    All rights reserved
+@@ -1433,19 +1433,19 @@ process_server_config_line_depth(ServerOptions *options, char *line,
+ #endif /* KRB5 */
+ 
+ #ifdef GSSAPI
+-	case sGssAuthentication:
+	case sGSSAPIAuthentication:
+ 		intptr = &options->gss_authentication;
+ 		goto parse_flag;
+ 
+-	case sGssCleanupCreds:
+	case sGSSAPICleanupCredentials:
+ 		intptr = &options->gss_cleanup_creds;
+ 		goto parse_flag;
+ 
+-	case sGssDelegateCreds:
+	case sGSSAPIDelegateCredentials:
+ 		intptr = &options->gss_deleg_creds;
+ 		goto parse_flag;
+ 
+-	case sGssStrictAcceptor:
+	case sGSSAPIStrictAcceptorCheck:
+ 		intptr = &options->gss_strict_acceptor;
+ 		goto parse_flag;
+ #endif /* GSSAPI */
+@@ -4215,10 +4215,10 @@ dump_config(ServerOptions *o)
+ # endif
+ #endif
+ #ifdef GSSAPI
+-	dump_cfg_fmtint(sGssAuthentication, o->gss_authentication);
+-	dump_cfg_fmtint(sGssCleanupCreds, o->gss_cleanup_creds);
+-	dump_cfg_fmtint(sGssDelegateCreds, o->gss_deleg_creds);
+-	dump_cfg_fmtint(sGssStrictAcceptor, o->gss_strict_acceptor);
+	dump_cfg_fmtint(sGSSAPIAuthentication, o->gss_authentication);
+	dump_cfg_fmtint(sGSSAPICleanupCredentials, o->gss_cleanup_creds);
+	dump_cfg_fmtint(sGSSAPIDelegateCredentials, o->gss_deleg_creds);
+	dump_cfg_fmtint(sGSSAPIStrictAcceptorCheck, o->gss_strict_acceptor);
+ #endif
+ 	dump_cfg_fmtint(sPasswordAuthentication, o->password_authentication);
+ 	dump_cfg_fmtint(sKbdInteractiveAuthentication,
+diff --git a/servconf.h b/servconf.h
+index 9e64e4673..a2345e88a 100644
+--- a/servconf.h
+++ b/servconf.h
+@@ -1,4 +1,4 @@
+-/* $OpenBSD: servconf.h,v 1.177 2026/05/31 11:30:50 djm Exp $ */
+/* $OpenBSD: servconf.h,v 1.179 2026/07/07 01:00:22 djm Exp $ */
+ 
+ /*
+  * Author: Tatu Ylonen <ylo@cs.hut.fi>
+@@ -314,16 +314,16 @@ SSHCONF_UNSUPPORTED_INT(kerberos_get_afs_token, KerberosGetAFSToken, SSHCFG_GLOB
+ 
+ #ifdef GSSAPI
+ #define SSHD_CONFIG_ENTRIES_GSS \
+-SSHCONF_INTFLAG(gss_authentication, GssAuthentication, SSHCFG_ALL, 0, SSHCFG_COPY_MATCH) \
+-SSHCONF_INTFLAG(gss_cleanup_creds, GssCleanupCreds, SSHCFG_GLOBAL, 1, SSHCFG_COPY_NONE) \
+-SSHCONF_INTFLAG(gss_deleg_creds, GssDelegateCreds, SSHCFG_GLOBAL, 1, SSHCFG_COPY_NONE) \
+-SSHCONF_INTFLAG(gss_strict_acceptor, GssStrictAcceptor, SSHCFG_GLOBAL, 1, SSHCFG_COPY_NONE)
+SSHCONF_INTFLAG(gss_authentication, GSSAPIAuthentication, SSHCFG_ALL, 0, SSHCFG_COPY_MATCH) \
+SSHCONF_INTFLAG(gss_cleanup_creds, GSSAPICleanupCredentials, SSHCFG_GLOBAL, 1, SSHCFG_COPY_NONE) \
+SSHCONF_INTFLAG(gss_deleg_creds, GSSAPIDelegateCredentials, SSHCFG_GLOBAL, 1, SSHCFG_COPY_NONE) \
+SSHCONF_INTFLAG(gss_strict_acceptor, GSSAPIStrictAcceptorCheck, SSHCFG_GLOBAL, 1, SSHCFG_COPY_NONE)
+ #else /* GSSAPI */
+ #define SSHD_CONFIG_ENTRIES_GSS \
+-SSHCONF_UNSUPPORTED_INT(gss_authentication, GssAuthentication, SSHCFG_ALL) \
+-SSHCONF_UNSUPPORTED_INT(gss_cleanup_creds, GssCleanupCreds, SSHCFG_GLOBAL) \
+-SSHCONF_UNSUPPORTED_INT(gss_deleg_creds, GssDelegateCreds, SSHCFG_GLOBAL) \
+-SSHCONF_UNSUPPORTED_INT(gss_strict_acceptor, GssStrictAcceptor, SSHCFG_GLOBAL)
+SSHCONF_UNSUPPORTED_INT(gss_authentication, GSSAPIAuthentication, SSHCFG_ALL) \
+SSHCONF_UNSUPPORTED_INT(gss_cleanup_creds, GSSAPICleanupCredentials, SSHCFG_GLOBAL) \
+SSHCONF_UNSUPPORTED_INT(gss_deleg_creds, GSSAPIDelegateCredentials, SSHCFG_GLOBAL) \
+SSHCONF_UNSUPPORTED_INT(gss_strict_acceptor, GSSAPIStrictAcceptorCheck, SSHCFG_GLOBAL)
+ #endif /* GSSAPI */
+ 
+ #define SSHD_CONFIG_ENTRIES \
+-- 
+2.47.3
+
+
+From c10e04980300eab089f71aaada8b28fd878ee729 Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Tue, 7 Jul 2026 02:17:18 +0000
+Subject: [PATCH 2/2] upstream: unused variables
+
+OpenBSD-Commit-ID: 03fc22fb427b7547ee7844907cf3257bce7fdc3c
+---
+ auth2-gss.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/auth2-gss.c b/auth2-gss.c
+index 85251b7d0..9e9496e53 100644
+--- a/auth2-gss.c
+++ b/auth2-gss.c
+@@ -1,4 +1,4 @@
+-/* $OpenBSD: auth2-gss.c,v 1.41 2026/07/06 07:53:30 djm Exp $ */
+/* $OpenBSD: auth2-gss.c,v 1.42 2026/07/07 02:17:18 djm Exp $ */
+ 
+ /*
+  * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
+@@ -215,8 +215,6 @@ input_gssapi_errtok(int type, uint32_t plen, struct ssh *ssh)
+ {
+ 	Authctxt *authctxt = ssh->authctxt;
+ 	int r;
+-	u_char *p;
+-	size_t len;
+ 
+ 	if (authctxt == NULL)
+ 		fatal("No authentication or GSSAPI context");
+-- 
+2.47.3
+
--- a/el5/SPECS/openssh.spec
+++ b/el5/SPECS/openssh.spec
@@ -29,9 +29,6 @@
 %global no_gnome_askpass 0


-# Do we want smartcard support (1=yes 0=no)
-%global scard 0
-
 # Use GTK2 instead of GNOME in gnome-ssh-askpass
 %global gtk2 1

@@ -54,7 +51,7 @@
 #%endif

 # Do we want kerberos5 support (1=yes 0=no)
-%global kerberos5 0
+%global kerberos5 1

 # Reserve options to override askpass settings with:
 # rpm -ba|--rebuild --define 'skip_xxx 1'
@@ -75,10 +72,6 @@
 %endif


-# Options for Smartcard support: (needs libsectok and openssl-engine)
-# rpm -ba|--rebuild --define "smartcard 1"
-%{?smartcard:%global scard 1}
-
 # Is this a build for the rescue CD (without PAM)? (1=yes 0=no)
 %global rescue 0
 %{?build_rescue:%global rescue 1}
@@ -105,8 +98,6 @@ Source3: https://www.openssl.org/source/openssl-%{opensslver}.tar.gz
 Source4: https://www.cpan.org/src/5.0/perl-%{perlver}.tar.gz
 %endif

-# glibc-headers-2.5 have endian.h but didn't define htole64
-Patch0: have_endian.patch
 License: BSD
 Group: Applications/Internet
 BuildRoot: %{_tmppath}/%{name}-%{version}-buildroot
@@ -144,6 +135,9 @@ BuildRequires: pkgconfig
 BuildRequires: krb5-devel
 BuildRequires: krb5-libs
 %endif
+Patch0: have_endian.patch
+Patch100: 10.4-fix-gssapi.patch
+

 %package clients
 Summary: OpenSSH clients.
@@ -211,20 +205,7 @@ into and executing commands on a remote machine. This package contains
 an X11 passphrase dialog for OpenSSH and the GNOME GUI desktop
 environment.

-%global perl_version_ok %( \
-    if command -v perl >/dev/null 2>&1; then \
-        perl -e ' \
-            if ($] >= 5.010) { \
-                print "1"; \
-            } else { \
-                print "0"; \
-            }; \
-        ' \
-    else \
-        echo "0"; \
-    fi \
-)
-
+%global perl_version_ok %(perl -e 'exit($] < 5.010)' && echo 1 || echo 0)

 %prep
 %if ! %{no_x11_askpass}
@@ -236,10 +217,17 @@ environment.
 # Applay a patch if glibc version is 2.5, not sure about other versions
 %global glibc_version %(ldd --version 2>&1 | head -n1 | grep -oP '[0-9.]+')
 echo "GLIBC version: %{glibc_version}"
+
 %if "%{glibc_version}" <= "2.5" && "%{opensshver}" == "9.9p2"
+# glibc-headers-2.5 have endian.h but didn't define htole64
 %patch0 -p0
 %endif

+# Apply GSSAPI option path for 10.4p1
+%if "%{opensshver}" == "10.4p1"
+%patch100 -p1
+%endif
+
 %if %{with_openssl} == 2

 # the OpenSSL build require perl version >= 5.10.0
@@ -283,10 +271,32 @@ popd
 CFLAGS="$RPM_OPT_FLAGS -Os"; export CFLAGS
 %endif

+# ==============================================================================
+# HACK: Fix conflicting 'krb5_free_error_message' macros under older distros (EL5)
+# When statically building against OpenSSL 3.x with Kerberos enabled, the ancient 
+# krb5 headers conflict with OpenSSL 3's new/deprecated APIs. This causes the 
+# './configure' compiler test to fail linking, making it mistakenly believe that 
+# the system lacks 'krb5_free_error_message'. 
+#
+# Consequently, OpenSSH injects a fallback macro:
+#   #define krb5_free_error_message(a,b) do { } while(0)
+# which directly results in syntax compilation errors later inside krb5.h.
+#
+# By forcing these autoconf cache variables to 'yes', we bypass the broken 
+# configure test and prevent the conflicting macro injection, as the functions 
+# are indeed natively present in the system's krb5-devel library.
+# ==============================================================================
+%global openssl_major %(echo "%{opensslver}" | cut -d. -f1)
+%if %{kerberos5} && %{openssl_major} >= 3
+    export ac_cv_func_krb5_free_error_message=yes
+    export ac_cv_func_krb5_get_error_message=yes
+%endif
+
 %if %{with_openssl} == 2
 # Add OpenSSL library
 export LD_LIBRARY_PATH="%{openssl_dir}"
 %endif
+
 %configure \
 %ifarch %{ix86}
 	--host=i686-linux-gnu \
@@ -297,7 +307,6 @@ export LD_LIBRARY_PATH="%{openssl_dir}"
 	--with-default-path=/usr/local/bin:/bin:/usr/bin \
 	--with-superuser-path=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin \
 	--with-privsep-path=%{_var}/empty/sshd \
-	--with-md5-passwords \
 	--mandir=%{_mandir} \
 	--with-mantype=man \
 	--disable-strip \
@@ -311,16 +320,13 @@ export LD_LIBRARY_PATH="%{openssl_dir}"
 	--with-ssl-engine \
 %endif
 	--with-zlib \
-%if %{scard}
-	--with-smartcard \
-%endif
 %if %{rescue}
 	--without-pam \
 %else
 	--with-pam \
 %endif
 %if %{kerberos5}
-	 --with-kerberos5=$K5DIR \
+	 --with-kerberos5 \
 %endif


@@ -406,9 +412,6 @@ ln -s x11-ssh-askpass $RPM_BUILD_ROOT%{_libexecdir}/openssh/ssh-askpass
 install contrib/gnome-ssh-askpass $RPM_BUILD_ROOT%{_libexecdir}/openssh/gnome-ssh-askpass
 %endif

-%if ! %{scard}
-	 rm -f $RPM_BUILD_ROOT/usr/share/openssh/Ssh.bin
-%endif

 %if ! %{no_gnome_askpass}
 install -m 755 -d $RPM_BUILD_ROOT%{_sysconfdir}/profile.d/
@@ -485,10 +488,6 @@ fi
 %attr(0644,root,root) %{_mandir}/man8/ssh-pkcs11-helper.8*
 %attr(0644,root,root) %{_mandir}/man8/ssh-sk-helper.8*
 %endif
-%if %{scard}
-%attr(0755,root,root) %dir %{_datadir}/openssh
-%attr(0644,root,root) %{_datadir}/openssh/Ssh.bin
-%endif

 %files clients
 %defattr(-,root,root)
--- a/el5/SRPMS/.keep
+++ b/el5/SRPMS/.keep
--- a/el6/BUILD/.keep
+++ b/el6/BUILD/.keep
--- a/el6/README.md
+++ b/el6/README.md
@@ -1,29 +1,13 @@
-# OpenSSH RPM Build for EL6
+# EL6 Build Tree (`el6/`)

-This project provides an RPM Spec file designed to build a modern version of OpenSSH on Enterprise Linux 6 (EL6) systems.
+RPM spec for backporting OpenSSH on Enterprise Linux 6 (SysVinit).

-## Key Features
+## Notes

-### 1. Legacy Environment Support (EL6)
-Building modern software on EL6 requires handling outdated system libraries. This spec file addresses these limitations to provide a secure, modern SSH server.
+- System Perl (>= 5.10) is sufficient, so unlike `el5/` no Perl
+  bootstrap is needed.
+- OpenSSL is built statically and linked into the OpenSSH binaries
+  (`WITH_OPENSSL=2`); system OpenSSL stays untouched.

-### 2. Static OpenSSL Compilation
-Modern versions of OpenSSH require newer OpenSSL libraries than those provided by EL6.
-*   The spec file compiles a modern version of OpenSSL from source within the build environment.
-*   **Static Linking**: OpenSSL is built statically and linked directly into the OpenSSH binaries.
-*   **System Integrity**: This ensures the new OpenSSH has access to modern cryptography while leaving the system's original OpenSSL libraries untouched to prevent dependency conflicts.
-
-### 3. System Perl
-Unlike the EL5 build process, EL6 provides a version of Perl (5.10+) that is sufficient for building modern OpenSSL. Therefore, the **Perl bootstrap process is not required**, and the system Perl is used directly.
-
-## Build Flow Summary
-
-1.  **Build OpenSSL**: Use system Perl to configure and build OpenSSL statically.
-2.  **Build OpenSSH**: Configure OpenSSH to use the custom OpenSSL headers and libraries.
-
-## Default Versions
-
-Versions are typically defined in the `version.env` file in the project root.
-
-*   **OpenSSH**: (e.g., 10.2p1)
-*   **OpenSSL**: (e.g., 3.0.18)
+Versions come from `version.env`. For usage and supported distros see
+the root [README.md](../README.md).
--- a/el6/RPMS/.keep
+++ b/el6/RPMS/.keep
--- a/el6/SOURCES/10.4-fix-gssapi.patch
+++ b/el6/SOURCES/10.4-fix-gssapi.patch
@@ -0,0 +1,134 @@
+From c147093565634eae9f91e4df99e04a6b3513f9c6 Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Tue, 7 Jul 2026 01:00:22 +0000
+Subject: [PATCH 1/2] upstream: fix GSSAPI option names, that I somehow screwed
+ up while
+
+refactoring servconf.c bz3974 patch from Colin Watson
+
+OpenBSD-Commit-ID: be39ad3dbe36d9ecdb86f3811da5dfbdc9bcb1e6
+---
+ servconf.c | 18 +++++++++---------
+ servconf.h | 18 +++++++++---------
+ 2 files changed, 18 insertions(+), 18 deletions(-)
+
+diff --git a/servconf.c b/servconf.c
+index ce388f1dd..9b443bea0 100644
+--- a/servconf.c
+++ b/servconf.c
+@@ -1,4 +1,4 @@
+-/* $OpenBSD: servconf.c,v 1.450 2026/06/29 08:59:31 djm Exp $ */
+/* $OpenBSD: servconf.c,v 1.451 2026/07/07 01:00:22 djm Exp $ */
+ /*
+  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
+  *                    All rights reserved
+@@ -1433,19 +1433,19 @@ process_server_config_line_depth(ServerOptions *options, char *line,
+ #endif /* KRB5 */
+ 
+ #ifdef GSSAPI
+-	case sGssAuthentication:
+	case sGSSAPIAuthentication:
+ 		intptr = &options->gss_authentication;
+ 		goto parse_flag;
+ 
+-	case sGssCleanupCreds:
+	case sGSSAPICleanupCredentials:
+ 		intptr = &options->gss_cleanup_creds;
+ 		goto parse_flag;
+ 
+-	case sGssDelegateCreds:
+	case sGSSAPIDelegateCredentials:
+ 		intptr = &options->gss_deleg_creds;
+ 		goto parse_flag;
+ 
+-	case sGssStrictAcceptor:
+	case sGSSAPIStrictAcceptorCheck:
+ 		intptr = &options->gss_strict_acceptor;
+ 		goto parse_flag;
+ #endif /* GSSAPI */
+@@ -4215,10 +4215,10 @@ dump_config(ServerOptions *o)
+ # endif
+ #endif
+ #ifdef GSSAPI
+-	dump_cfg_fmtint(sGssAuthentication, o->gss_authentication);
+-	dump_cfg_fmtint(sGssCleanupCreds, o->gss_cleanup_creds);
+-	dump_cfg_fmtint(sGssDelegateCreds, o->gss_deleg_creds);
+-	dump_cfg_fmtint(sGssStrictAcceptor, o->gss_strict_acceptor);
+	dump_cfg_fmtint(sGSSAPIAuthentication, o->gss_authentication);
+	dump_cfg_fmtint(sGSSAPICleanupCredentials, o->gss_cleanup_creds);
+	dump_cfg_fmtint(sGSSAPIDelegateCredentials, o->gss_deleg_creds);
+	dump_cfg_fmtint(sGSSAPIStrictAcceptorCheck, o->gss_strict_acceptor);
+ #endif
+ 	dump_cfg_fmtint(sPasswordAuthentication, o->password_authentication);
+ 	dump_cfg_fmtint(sKbdInteractiveAuthentication,
+diff --git a/servconf.h b/servconf.h
+index 9e64e4673..a2345e88a 100644
+--- a/servconf.h
+++ b/servconf.h
+@@ -1,4 +1,4 @@
+-/* $OpenBSD: servconf.h,v 1.177 2026/05/31 11:30:50 djm Exp $ */
+/* $OpenBSD: servconf.h,v 1.179 2026/07/07 01:00:22 djm Exp $ */
+ 
+ /*
+  * Author: Tatu Ylonen <ylo@cs.hut.fi>
+@@ -314,16 +314,16 @@ SSHCONF_UNSUPPORTED_INT(kerberos_get_afs_token, KerberosGetAFSToken, SSHCFG_GLOB
+ 
+ #ifdef GSSAPI
+ #define SSHD_CONFIG_ENTRIES_GSS \
+-SSHCONF_INTFLAG(gss_authentication, GssAuthentication, SSHCFG_ALL, 0, SSHCFG_COPY_MATCH) \
+-SSHCONF_INTFLAG(gss_cleanup_creds, GssCleanupCreds, SSHCFG_GLOBAL, 1, SSHCFG_COPY_NONE) \
+-SSHCONF_INTFLAG(gss_deleg_creds, GssDelegateCreds, SSHCFG_GLOBAL, 1, SSHCFG_COPY_NONE) \
+-SSHCONF_INTFLAG(gss_strict_acceptor, GssStrictAcceptor, SSHCFG_GLOBAL, 1, SSHCFG_COPY_NONE)
+SSHCONF_INTFLAG(gss_authentication, GSSAPIAuthentication, SSHCFG_ALL, 0, SSHCFG_COPY_MATCH) \
+SSHCONF_INTFLAG(gss_cleanup_creds, GSSAPICleanupCredentials, SSHCFG_GLOBAL, 1, SSHCFG_COPY_NONE) \
+SSHCONF_INTFLAG(gss_deleg_creds, GSSAPIDelegateCredentials, SSHCFG_GLOBAL, 1, SSHCFG_COPY_NONE) \
+SSHCONF_INTFLAG(gss_strict_acceptor, GSSAPIStrictAcceptorCheck, SSHCFG_GLOBAL, 1, SSHCFG_COPY_NONE)
+ #else /* GSSAPI */
+ #define SSHD_CONFIG_ENTRIES_GSS \
+-SSHCONF_UNSUPPORTED_INT(gss_authentication, GssAuthentication, SSHCFG_ALL) \
+-SSHCONF_UNSUPPORTED_INT(gss_cleanup_creds, GssCleanupCreds, SSHCFG_GLOBAL) \
+-SSHCONF_UNSUPPORTED_INT(gss_deleg_creds, GssDelegateCreds, SSHCFG_GLOBAL) \
+-SSHCONF_UNSUPPORTED_INT(gss_strict_acceptor, GssStrictAcceptor, SSHCFG_GLOBAL)
+SSHCONF_UNSUPPORTED_INT(gss_authentication, GSSAPIAuthentication, SSHCFG_ALL) \
+SSHCONF_UNSUPPORTED_INT(gss_cleanup_creds, GSSAPICleanupCredentials, SSHCFG_GLOBAL) \
+SSHCONF_UNSUPPORTED_INT(gss_deleg_creds, GSSAPIDelegateCredentials, SSHCFG_GLOBAL) \
+SSHCONF_UNSUPPORTED_INT(gss_strict_acceptor, GSSAPIStrictAcceptorCheck, SSHCFG_GLOBAL)
+ #endif /* GSSAPI */
+ 
+ #define SSHD_CONFIG_ENTRIES \
+-- 
+2.47.3
+
+
+From c10e04980300eab089f71aaada8b28fd878ee729 Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Tue, 7 Jul 2026 02:17:18 +0000
+Subject: [PATCH 2/2] upstream: unused variables
+
+OpenBSD-Commit-ID: 03fc22fb427b7547ee7844907cf3257bce7fdc3c
+---
+ auth2-gss.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/auth2-gss.c b/auth2-gss.c
+index 85251b7d0..9e9496e53 100644
+--- a/auth2-gss.c
+++ b/auth2-gss.c
+@@ -1,4 +1,4 @@
+-/* $OpenBSD: auth2-gss.c,v 1.41 2026/07/06 07:53:30 djm Exp $ */
+/* $OpenBSD: auth2-gss.c,v 1.42 2026/07/07 02:17:18 djm Exp $ */
+ 
+ /*
+  * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
+@@ -215,8 +215,6 @@ input_gssapi_errtok(int type, uint32_t plen, struct ssh *ssh)
+ {
+ 	Authctxt *authctxt = ssh->authctxt;
+ 	int r;
+-	u_char *p;
+-	size_t len;
+ 
+ 	if (authctxt == NULL)
+ 		fatal("No authentication or GSSAPI context");
+-- 
+2.47.3
+
--- a/el6/SPECS/openssh.spec
+++ b/el6/SPECS/openssh.spec
@@ -28,9 +28,6 @@
 # Do we want to disable building of gnome-askpass? (1=yes 0=no)
 %global no_gnome_askpass 0

-# Do we want smartcard support (1=yes 0=no)
-%global scard 0
-
 # Use GTK2 instead of GNOME in gnome-ssh-askpass
 %global gtk2 1

@@ -43,7 +40,7 @@
 %endif

 # Do we want kerberos5 support (1=yes 0=no)
-%global kerberos5 0
+%global kerberos5 1

 # Reserve options to override askpass settings with:
 # rpm -ba|--rebuild --define 'skip_xxx 1'
@@ -63,10 +60,6 @@
 %global _sysconfdir /etc
 %endif

-# Options for Smartcard support: (needs libsectok and openssl-engine)
-# rpm -ba|--rebuild --define "smartcard 1"
-%{?smartcard:%global scard 1}
-
 # Is this a build for the rescue CD (without PAM)? (1=yes 0=no)
 %global rescue 0
 %{?build_rescue:%global rescue 1}
@@ -128,6 +121,7 @@ BuildRequires: pkgconfig
 BuildRequires: krb5-devel
 BuildRequires: krb5-libs
 %endif
+Patch100: 10.4-fix-gssapi.patch

 %package clients
 Summary: OpenSSH clients.
@@ -203,6 +197,11 @@ environment.
 %setup -q
 %endif

+# Apply GSSAPI option path for 10.4p1
+%if "%{opensshver}" == "10.4p1"
+%patch100 -p1
+%endif
+
 %if %{with_openssl} == 2
 # Add content below to use source code of OpenSSL
 %define openssl_dir %{_builddir}/%{name}-%{version}/openssl
@@ -230,7 +229,6 @@ export LD_LIBRARY_PATH="%{openssl_dir}"
 	--with-default-path=/usr/local/bin:/bin:/usr/bin \
 	--with-superuser-path=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin \
 	--with-privsep-path=%{_var}/empty/sshd \
-	--with-md5-passwords \
 	--mandir=%{_mandir} \
 	--with-mantype=man \
 	--disable-strip \
@@ -244,16 +242,13 @@ export LD_LIBRARY_PATH="%{openssl_dir}"
 	--with-ssl-engine \
 %endif
 	--with-zlib \
-%if %{scard}
-	--with-smartcard \
-%endif
 %if %{rescue}
 	--without-pam \
 %else
 	--with-pam \
 %endif
 %if %{kerberos5}
-	 --with-kerberos5=$K5DIR \
+	 --with-kerberos5 \
 %endif


@@ -341,9 +336,6 @@ ln -s x11-ssh-askpass $RPM_BUILD_ROOT%{_libexecdir}/openssh/ssh-askpass
 install contrib/gnome-ssh-askpass $RPM_BUILD_ROOT%{_libexecdir}/openssh/gnome-ssh-askpass
 %endif

-%if ! %{scard}
-	 rm -f $RPM_BUILD_ROOT/usr/share/openssh/Ssh.bin
-%endif

 %if ! %{no_gnome_askpass}
 install -m 755 -d $RPM_BUILD_ROOT%{_sysconfdir}/profile.d/
@@ -420,10 +412,6 @@ fi
 %attr(0644,root,root) %{_mandir}/man8/ssh-pkcs11-helper.8*
 %attr(0644,root,root) %{_mandir}/man8/ssh-sk-helper.8*
 %endif
-%if %{scard}
-%attr(0755,root,root) %dir %{_datadir}/openssh
-%attr(0644,root,root) %{_datadir}/openssh/Ssh.bin
-%endif

 %files clients
 %defattr(-,root,root)
--- a/el6/SRPMS/.keep
+++ b/el6/SRPMS/.keep
--- a/el7/BUILD/.keep
+++ b/el7/BUILD/.keep
--- a/el7/README.md
+++ b/el7/README.md
@@ -1,46 +1,25 @@
-# OpenSSH RPM Build for EL7+ (EL8/EL9)
+# EL7+ Build Tree (`el7/`)

-This project provides an RPM Spec file designed to build a modern version of OpenSSH on Enterprise Linux 7 (EL7). Thanks to the implementation of **systemd**, this configuration is also compatible with newer distributions like EL8 and EL9 (including RHEL, CentOS, Rocky Linux, and AlmaLinux).
+RPM spec for backporting OpenSSH on Enterprise Linux 7 and newer
+(EL7/EL8/EL9 incl. RHEL, CentOS, Rocky, AlmaLinux) using native systemd
+services.

-## Key Features
+## Notes

-### 1. Systemd Native Support
-Unlike the EL5 and EL6 builds which rely on SysVinit scripts (`/etc/init.d/sshd`), this spec file configures OpenSSH to run as a native systemd service.
-*   **Unit File**: Installs a standard `sshd.service` unit file.
-*   **Management**: Fully integrated with `systemctl` for service management.
+- Installs systemd units into `%{_unitdir}`: `sshd.service`,
+  `sshd.socket` (socket activation), `sshd@.service`, and
+  `sshd-keygen.service`.
+- Two specs available: `openssh.spec` (default, systemd) and
+  `openssh.initv.spec` (SysVinit), selected via the `SPECFILE` env var.
+- OpenSSL mode: system OpenSSL >= 3 is used directly
+  (`WITH_OPENSSL=1`), otherwise OpenSSL is built statically
+  (`WITH_OPENSSL=2`). Override via env, see `version.env`.

-### 2. Forward Compatibility (EL8/EL9)
-Because EL7, EL8, and EL9 all share the systemd architecture, this spec file allows the same source configuration to be built and deployed across these major versions with minimal or no changes.
-
-### 3. Static OpenSSL Compilation
-To support the latest OpenSSH features (which require newer cryptography than what EL7 provides by default), this build process:
-*   Compiles a modern version of OpenSSL (e.g., 3.0.x) from source.
-*   Links it **statically** into the OpenSSH binaries.
-*   Ensures no conflict with the system's default OpenSSL libraries.
-
-## Systemd Integration Details
-
-The spec file utilizes specific RPM macros and configurations to handle the systemd lifecycle:
-
-*   **Unit Installation**: The `sshd.service` file is installed into `%{_unitdir}` (typically `/usr/lib/systemd/system/`).
-*   **Socket Activation**: (If configured) The spec may also include support for `sshd.socket` for on-demand activation, though the standard service is the default.
-
-## Usage
-
-After installing the generated RPM, manage the service using standard systemd commands:
+After installing the RPMs:

 ```bash
-# Enable the service to start at boot
-systemctl enable sshd
-
-# Start the service immediately
-systemctl start sshd
-
-# Check status
-systemctl status sshd
+systemctl enable --now sshd
 ```

-## Default Versions
-
-*   **OpenSSH**: (Defined in `version.env`, e.g., 10.2p1)
-*   **OpenSSL**: (Defined in `version.env`, e.g., 3.0.18)
+Versions come from `version.env`. For usage and supported distros see
+the root [README.md](../README.md).
--- a/el7/RPMS/.keep
+++ b/el7/RPMS/.keep
--- a/el7/SOURCES/10.4-fix-gssapi.patch
+++ b/el7/SOURCES/10.4-fix-gssapi.patch
@@ -0,0 +1,134 @@
+From c147093565634eae9f91e4df99e04a6b3513f9c6 Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Tue, 7 Jul 2026 01:00:22 +0000
+Subject: [PATCH 1/2] upstream: fix GSSAPI option names, that I somehow screwed
+ up while
+
+refactoring servconf.c bz3974 patch from Colin Watson
+
+OpenBSD-Commit-ID: be39ad3dbe36d9ecdb86f3811da5dfbdc9bcb1e6
+---
+ servconf.c | 18 +++++++++---------
+ servconf.h | 18 +++++++++---------
+ 2 files changed, 18 insertions(+), 18 deletions(-)
+
+diff --git a/servconf.c b/servconf.c
+index ce388f1dd..9b443bea0 100644
+--- a/servconf.c
+++ b/servconf.c
+@@ -1,4 +1,4 @@
+-/* $OpenBSD: servconf.c,v 1.450 2026/06/29 08:59:31 djm Exp $ */
+/* $OpenBSD: servconf.c,v 1.451 2026/07/07 01:00:22 djm Exp $ */
+ /*
+  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
+  *                    All rights reserved
+@@ -1433,19 +1433,19 @@ process_server_config_line_depth(ServerOptions *options, char *line,
+ #endif /* KRB5 */
+ 
+ #ifdef GSSAPI
+-	case sGssAuthentication:
+	case sGSSAPIAuthentication:
+ 		intptr = &options->gss_authentication;
+ 		goto parse_flag;
+ 
+-	case sGssCleanupCreds:
+	case sGSSAPICleanupCredentials:
+ 		intptr = &options->gss_cleanup_creds;
+ 		goto parse_flag;
+ 
+-	case sGssDelegateCreds:
+	case sGSSAPIDelegateCredentials:
+ 		intptr = &options->gss_deleg_creds;
+ 		goto parse_flag;
+ 
+-	case sGssStrictAcceptor:
+	case sGSSAPIStrictAcceptorCheck:
+ 		intptr = &options->gss_strict_acceptor;
+ 		goto parse_flag;
+ #endif /* GSSAPI */
+@@ -4215,10 +4215,10 @@ dump_config(ServerOptions *o)
+ # endif
+ #endif
+ #ifdef GSSAPI
+-	dump_cfg_fmtint(sGssAuthentication, o->gss_authentication);
+-	dump_cfg_fmtint(sGssCleanupCreds, o->gss_cleanup_creds);
+-	dump_cfg_fmtint(sGssDelegateCreds, o->gss_deleg_creds);
+-	dump_cfg_fmtint(sGssStrictAcceptor, o->gss_strict_acceptor);
+	dump_cfg_fmtint(sGSSAPIAuthentication, o->gss_authentication);
+	dump_cfg_fmtint(sGSSAPICleanupCredentials, o->gss_cleanup_creds);
+	dump_cfg_fmtint(sGSSAPIDelegateCredentials, o->gss_deleg_creds);
+	dump_cfg_fmtint(sGSSAPIStrictAcceptorCheck, o->gss_strict_acceptor);
+ #endif
+ 	dump_cfg_fmtint(sPasswordAuthentication, o->password_authentication);
+ 	dump_cfg_fmtint(sKbdInteractiveAuthentication,
+diff --git a/servconf.h b/servconf.h
+index 9e64e4673..a2345e88a 100644
+--- a/servconf.h
+++ b/servconf.h
+@@ -1,4 +1,4 @@
+-/* $OpenBSD: servconf.h,v 1.177 2026/05/31 11:30:50 djm Exp $ */
+/* $OpenBSD: servconf.h,v 1.179 2026/07/07 01:00:22 djm Exp $ */
+ 
+ /*
+  * Author: Tatu Ylonen <ylo@cs.hut.fi>
+@@ -314,16 +314,16 @@ SSHCONF_UNSUPPORTED_INT(kerberos_get_afs_token, KerberosGetAFSToken, SSHCFG_GLOB
+ 
+ #ifdef GSSAPI
+ #define SSHD_CONFIG_ENTRIES_GSS \
+-SSHCONF_INTFLAG(gss_authentication, GssAuthentication, SSHCFG_ALL, 0, SSHCFG_COPY_MATCH) \
+-SSHCONF_INTFLAG(gss_cleanup_creds, GssCleanupCreds, SSHCFG_GLOBAL, 1, SSHCFG_COPY_NONE) \
+-SSHCONF_INTFLAG(gss_deleg_creds, GssDelegateCreds, SSHCFG_GLOBAL, 1, SSHCFG_COPY_NONE) \
+-SSHCONF_INTFLAG(gss_strict_acceptor, GssStrictAcceptor, SSHCFG_GLOBAL, 1, SSHCFG_COPY_NONE)
+SSHCONF_INTFLAG(gss_authentication, GSSAPIAuthentication, SSHCFG_ALL, 0, SSHCFG_COPY_MATCH) \
+SSHCONF_INTFLAG(gss_cleanup_creds, GSSAPICleanupCredentials, SSHCFG_GLOBAL, 1, SSHCFG_COPY_NONE) \
+SSHCONF_INTFLAG(gss_deleg_creds, GSSAPIDelegateCredentials, SSHCFG_GLOBAL, 1, SSHCFG_COPY_NONE) \
+SSHCONF_INTFLAG(gss_strict_acceptor, GSSAPIStrictAcceptorCheck, SSHCFG_GLOBAL, 1, SSHCFG_COPY_NONE)
+ #else /* GSSAPI */
+ #define SSHD_CONFIG_ENTRIES_GSS \
+-SSHCONF_UNSUPPORTED_INT(gss_authentication, GssAuthentication, SSHCFG_ALL) \
+-SSHCONF_UNSUPPORTED_INT(gss_cleanup_creds, GssCleanupCreds, SSHCFG_GLOBAL) \
+-SSHCONF_UNSUPPORTED_INT(gss_deleg_creds, GssDelegateCreds, SSHCFG_GLOBAL) \
+-SSHCONF_UNSUPPORTED_INT(gss_strict_acceptor, GssStrictAcceptor, SSHCFG_GLOBAL)
+SSHCONF_UNSUPPORTED_INT(gss_authentication, GSSAPIAuthentication, SSHCFG_ALL) \
+SSHCONF_UNSUPPORTED_INT(gss_cleanup_creds, GSSAPICleanupCredentials, SSHCFG_GLOBAL) \
+SSHCONF_UNSUPPORTED_INT(gss_deleg_creds, GSSAPIDelegateCredentials, SSHCFG_GLOBAL) \
+SSHCONF_UNSUPPORTED_INT(gss_strict_acceptor, GSSAPIStrictAcceptorCheck, SSHCFG_GLOBAL)
+ #endif /* GSSAPI */
+ 
+ #define SSHD_CONFIG_ENTRIES \
+-- 
+2.47.3
+
+
+From c10e04980300eab089f71aaada8b28fd878ee729 Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Tue, 7 Jul 2026 02:17:18 +0000
+Subject: [PATCH 2/2] upstream: unused variables
+
+OpenBSD-Commit-ID: 03fc22fb427b7547ee7844907cf3257bce7fdc3c
+---
+ auth2-gss.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/auth2-gss.c b/auth2-gss.c
+index 85251b7d0..9e9496e53 100644
+--- a/auth2-gss.c
+++ b/auth2-gss.c
+@@ -1,4 +1,4 @@
+-/* $OpenBSD: auth2-gss.c,v 1.41 2026/07/06 07:53:30 djm Exp $ */
+/* $OpenBSD: auth2-gss.c,v 1.42 2026/07/07 02:17:18 djm Exp $ */
+ 
+ /*
+  * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
+@@ -215,8 +215,6 @@ input_gssapi_errtok(int type, uint32_t plen, struct ssh *ssh)
+ {
+ 	Authctxt *authctxt = ssh->authctxt;
+ 	int r;
+-	u_char *p;
+-	size_t len;
+ 
+ 	if (authctxt == NULL)
+ 		fatal("No authentication or GSSAPI context");
+-- 
+2.47.3
+
--- a/el7/SOURCES/openssh-aarch64-kernel-panic-fix.patch
+++ b/el7/SOURCES/openssh-aarch64-kernel-panic-fix.patch
--- a/el7/SPECS/openssh.initv.spec
+++ b/el7/SPECS/openssh.initv.spec
@@ -23,9 +23,6 @@
 # Do we want to disable building of gnome-askpass? (1=yes 0=no)
 %global no_gnome_askpass 0

-# Do we want smartcard support (1=yes 0=no)
-%global scard 0
-
 # Use GTK2 instead of GNOME in gnome-ssh-askpass
 %global gtk2 1

@@ -58,10 +55,6 @@
 %global _sysconfdir /etc
 %endif

-# Options for Smartcard support: (needs libsectok and openssl-engine)
-# rpm -ba|--rebuild --define "smartcard 1"
-%{?smartcard:%global scard 1}
-
 # Is this a build for the rescue CD (without PAM)? (1=yes 0=no)
 %global rescue 0
 %{?build_rescue:%global rescue 1}
@@ -223,7 +216,6 @@ export LD_LIBRARY_PATH="%{openssl_dir}"
 	--with-default-path=/usr/local/bin:/bin:/usr/bin \
 	--with-superuser-path=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin \
 	--with-privsep-path=%{_var}/empty/sshd \
-	--with-md5-passwords \
 	--mandir=%{_mandir} \
 	--with-mantype=man \
 	--disable-strip \
@@ -236,16 +228,13 @@ export LD_LIBRARY_PATH="%{openssl_dir}"
 	--with-ssl-engine \
 %endif
 	--with-zlib \
-%if %{scard}
-	--with-smartcard \
-%endif
 %if %{rescue}
 	--without-pam \
 %else
 	--with-pam \
 %endif
 %if %{kerberos5}
-	 --with-kerberos5=$K5DIR \
+	 --with-kerberos5 \
 %endif


@@ -332,9 +321,6 @@ ln -s x11-ssh-askpass $RPM_BUILD_ROOT%{_libexecdir}/openssh/ssh-askpass
 install contrib/gnome-ssh-askpass $RPM_BUILD_ROOT%{_libexecdir}/openssh/gnome-ssh-askpass
 %endif

-%if ! %{scard}
-	 rm -f $RPM_BUILD_ROOT/usr/share/openssh/Ssh.bin
-%endif

 %if ! %{no_gnome_askpass}
 install -m 755 -d $RPM_BUILD_ROOT%{_sysconfdir}/profile.d/
@@ -411,10 +397,6 @@ fi
 %attr(0644,root,root) %{_mandir}/man8/ssh-pkcs11-helper.8*
 %attr(0644,root,root) %{_mandir}/man8/ssh-sk-helper.8*
 %endif
-%if %{scard}
-%attr(0755,root,root) %dir %{_datadir}/openssh
-%attr(0644,root,root) %{_datadir}/openssh/Ssh.bin
-%endif

 %files clients
 %defattr(-,root,root)
--- a/el7/SPECS/openssh.spec
+++ b/el7/SPECS/openssh.spec
@@ -23,14 +23,11 @@
 # Do we want to disable building of gnome-askpass? (1=yes 0=no)
 %global no_gnome_askpass 0

-# Do we want smartcard support (1=yes 0=no)
-%global scard 0
-
 # Use GTK2 instead of GNOME in gnome-ssh-askpass
 %global gtk2 1

 # Do we want kerberos5 support (1=yes 0=no)
-%global kerberos5 0
+%global kerberos5 1

 # Reserve options to override askpass settings with:
 # rpm -ba|--rebuild --define 'skip_xxx 1'
@@ -42,10 +39,6 @@
 # rpm -ba|--rebuild --define 'no_gtk2 1'
 %{?no_gtk2:%global gtk2 0}

-# Options for Smartcard support: (needs libsectok and openssl-engine)
-# rpm -ba|--rebuild --define "smartcard 1"
-%{?smartcard:%global scard 1}
-
 # Is this a build for the rescue CD (without PAM)? (1=yes 0=no)
 %global rescue 0
 %{?build_rescue:%global rescue 1}
@@ -106,6 +99,26 @@ BuildRequires: pkgconfig
 BuildRequires: krb5-devel
 BuildRequires: krb5-libs
 %endif
+Patch100: 10.4-fix-gssapi.patch
+# Patch999: fix for kernel NULL pointer dereference panic in do_dup2() that
+# affects all UOS 20 systems (not just aarch64) when sshd performs a re-exec
+# with stdin/stdout/config fd dup2() before closing the existing descriptor.
+# Without this patch, certain UOS 20 kernels crash with:
+#
+#   BUG: unable to handle kernel NULL pointer dereference at 000000000000003f
+#   IP: filp_close+0x9/0x70
+#   Call Trace: do_dup2+xxx sys_dup2 entry_SYSCALL_64
+#   PID: xxx Comm: sshd
+#
+#   [<Txxxx>] Kernel panic - not syncing: Fatal exception
+#   [<Txxxx>] Kernel Offset: 0x13000000 from 0xffffffff81000000
+#   [<Txxxx>] kexec: Bye!
+#
+# The fix closes STDIN/STDOUT/REEXEC_CONFIG_PASS_FD before the corresponding
+# dup2() calls in sshd.c, so the kernel's filp_close() always operates on a
+# valid file pointer. Only applied when `uos20 1` is passed to rpmbuild
+# (compile.sh sets this from the UOS20=1 env var).
+%{?uos20:Patch999: openssh-uos20-kernel-panic-fix.patch}

 %package clients
 Summary: OpenSSH clients.
@@ -183,6 +196,14 @@ environment.
 %setup -q
 %endif

+# Apply GSSAPI option path for 10.4p1
+%if "%{opensshver}" == "10.4p1"
+%patch100 -p1
+%endif
+
+# Apply UOS 20 kernel NULL pointer dereference fix (see Patch999 above)
+%{?uos20:%patch999 -p0}
+
 %if %{with_openssl} == 2
 # Add content below to use source code of OpenSSL
 %define openssl_dir %{_builddir}/%{name}-%{version}/openssl
@@ -210,10 +231,8 @@ export LD_LIBRARY_PATH="%{openssl_dir}"
 	--with-default-path=/usr/local/bin:/bin:/usr/bin \
 	--with-superuser-path=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin \
 	--with-privsep-path=%{_var}/empty/sshd \
-	--with-md5-passwords \
 	--mandir=%{_mandir} \
 	--with-mantype=man \
-        --with-systemd \
 	--disable-strip \
 %if %{with_openssl} == 2
 	--with-ssl-dir="%{openssl_dir}" \
@@ -224,16 +243,13 @@ export LD_LIBRARY_PATH="%{openssl_dir}"
 	--with-ssl-engine \
 %endif
 	--with-zlib \
-%if %{scard}
-	--with-smartcard \
-%endif
 %if %{rescue}
 	--without-pam \
 %else
 	--with-pam \
 %endif
 %if %{kerberos5}
-	 --with-kerberos5=$K5DIR \
+	 --with-kerberos5 \
 %endif


@@ -330,9 +346,6 @@ ln -s x11-ssh-askpass $RPM_BUILD_ROOT%{_libexecdir}/openssh/ssh-askpass
 install contrib/gnome-ssh-askpass $RPM_BUILD_ROOT%{_libexecdir}/openssh/gnome-ssh-askpass
 %endif

-%if ! %{scard}
-	 rm -f $RPM_BUILD_ROOT/usr/share/openssh/Ssh.bin
-%endif

 %if ! %{no_gnome_askpass}
 install -m 755 -d $RPM_BUILD_ROOT%{_sysconfdir}/profile.d/
@@ -419,10 +432,6 @@ done
 %attr(0644,root,root) %{_mandir}/man8/ssh-pkcs11-helper.8*
 %attr(0644,root,root) %{_mandir}/man8/ssh-sk-helper.8*
 %endif
-%if %{scard}
-%attr(0755,root,root) %dir %{_datadir}/openssh
-%attr(0644,root,root) %{_datadir}/openssh/Ssh.bin
-%endif

 %files clients
 %defattr(-,root,root)
--- a/el7/SPECS/openssh.uos20.spec
+++ b/el7/SPECS/openssh.uos20.spec
@@ -1,487 +0,0 @@
-%{?!opensslver: %global opensslver 3.0.18}
-%{?!opensshver: %global opensshver 10.2p1}
-
-# Control openssl dependency
-# 0: build without openssl
-# 1: use system openssl
-# 2: build openssl statically
-%{!?with_openssl: %global with_openssl 2}
-
-%global ver %{?opensshver}
-%global rel %{?opensshpkgrel}%{?dist}
-
-# OpenSSH privilege separation requires a user & group ID
-%global sshd_uid    74
-%global sshd_gid    74
-
-# Version of ssh-askpass
-%global aversion 1.2.4.1
-
-# Do we want to disable building of x11-askpass? (1=yes 0=no)
-%global no_x11_askpass 0
-
-# Do we want to disable building of gnome-askpass? (1=yes 0=no)
-%global no_gnome_askpass 0
-
-# Do we want smartcard support (1=yes 0=no)
-%global scard 0
-
-# Use GTK2 instead of GNOME in gnome-ssh-askpass
-%global gtk2 1
-
-# Do we want kerberos5 support (1=yes 0=no)
-%global kerberos5 0
-
-# Reserve options to override askpass settings with:
-# rpm -ba|--rebuild --define 'skip_xxx 1'
-%{?skip_x11_askpass:%global no_x11_askpass 1}
-%{?skip_gnome_askpass:%global no_gnome_askpass 1}
-
-# Add option to build without GTK2 for older platforms with only GTK+.
-# RedHat <= 7.2 and Red Hat Advanced Server 2.1 are examples.
-# rpm -ba|--rebuild --define 'no_gtk2 1'
-%{?no_gtk2:%global gtk2 0}
-
-# Options for Smartcard support: (needs libsectok and openssl-engine)
-# rpm -ba|--rebuild --define "smartcard 1"
-%{?smartcard:%global scard 1}
-
-# Is this a build for the rescue CD (without PAM)? (1=yes 0=no)
-%global rescue 0
-%{?build_rescue:%global rescue 1}
-
-# Turn off some stuff for resuce builds
-%if %{rescue}
-%global kerberos5 0
-%endif
-
-Summary: The OpenSSH implementation of SSH protocol version 2.
-Name: openssh
-Version: %{ver}
-%if %{rescue}
-Release: %{rel}rescue
-%else
-Release: %{rel}
-%endif
-URL: https://www.openssh.com/portable.html
-Source0: https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz
-Source1: http://www.jmknoble.net/software/x11-ssh-askpass/x11-ssh-askpass-%{aversion}.tar.gz
-Source2: sshd.pam.el7
-%if %{with_openssl} == 2
-Source3: https://www.openssl.org/source/openssl-%{opensslver}.tar.gz
-%endif
-Patch100: openssh-aarch64-kernel-panic-fix.patch
-# systemd support
-Source7: sshd.sysconfig
-Source9: sshd@.service
-Source10: sshd.socket
-Source11: sshd.service
-Source12: sshd-keygen.service
-Source13: sshd-keygen
-
-License: BSD
-Group: Applications/Internet
-BuildRoot: %{_tmppath}/%{name}-%{version}-buildroot
-Obsoletes: ssh
-Requires: initscripts >= 5.20
-BuildRequires: systemd-devel
-BuildRequires: perl
-%if %{with_openssl} == 1
-BuildRequires: openssl-devel
-%endif
-BuildRequires: /bin/login
-BuildRequires: glibc-devel, pam
-%if ! %{no_x11_askpass}
-BuildRequires: /usr/include/X11/Xlib.h
-# Xt development tools
-BuildRequires: libXt-devel
-# Provides xmkmf
-BuildRequires: imake
-# Rely on relatively recent gtk
-BuildRequires: gtk2-devel
-%endif
-%if ! %{no_gnome_askpass}
-BuildRequires: pkgconfig
-%endif
-%if %{kerberos5}
-BuildRequires: krb5-devel
-BuildRequires: krb5-libs
-%endif
-
-%package clients
-Summary: OpenSSH clients.
-Requires: openssh = %{version}-%{release}
-Group: Applications/Internet
-Obsoletes: ssh-clients
-
-%package server
-Summary: The OpenSSH server daemon.
-Group: System Environment/Daemons
-Obsoletes: ssh-server
-Requires: openssh = %{version}-%{release}, chkconfig >= 0.9
-Requires: /etc/pam.d/system-auth
-Requires(post): systemd-units
-Requires(preun): systemd-units
-Requires(postun): systemd-units
-
-
-%package askpass
-Summary: A passphrase dialog for OpenSSH and X.
-Group: Applications/Internet
-Requires: openssh = %{version}-%{release}
-Obsoletes: ssh-extras
-
-%package askpass-gnome
-Summary: A passphrase dialog for OpenSSH, X, and GNOME.
-Group: Applications/Internet
-Requires: openssh = %{version}-%{release}
-Obsoletes: ssh-extras
-
-%description
-SSH (Secure SHell) is a program for logging into and executing
-commands on a remote machine. SSH is intended to replace rlogin and
-rsh, and to provide secure encrypted communications between two
-untrusted hosts over an insecure network. X11 connections and
-arbitrary TCP/IP ports can also be forwarded over the secure channel.
-
-OpenSSH is OpenBSD's version of the last free version of SSH, bringing
-it up to date in terms of security and features, as well as removing
-all patented algorithms to separate libraries.
-
-This package includes the core files necessary for both the OpenSSH
-client and server. To make this package useful, you should also
-install openssh-clients, openssh-server, or both.
-
-%description clients
-OpenSSH is a free version of SSH (Secure SHell), a program for logging
-into and executing commands on a remote machine. This package includes
-the clients necessary to make encrypted connections to SSH servers.
-You'll also need to install the openssh package on OpenSSH clients.
-
-%description server
-OpenSSH is a free version of SSH (Secure SHell), a program for logging
-into and executing commands on a remote machine. This package contains
-the secure shell daemon (sshd). The sshd daemon allows SSH clients to
-securely connect to your SSH server. You also need to have the openssh
-package installed.
-
-%description askpass
-OpenSSH is a free version of SSH (Secure SHell), a program for logging
-into and executing commands on a remote machine. This package contains
-an X11 passphrase dialog for OpenSSH.
-
-%description askpass-gnome
-OpenSSH is a free version of SSH (Secure SHell), a program for logging
-into and executing commands on a remote machine. This package contains
-an X11 passphrase dialog for OpenSSH and the GNOME GUI desktop
-environment.
-
-%prep
-
-%if ! %{no_x11_askpass}
-%setup -q -a 1
-%else
-%setup -q
-%endif
-%patch100 -p0
-
-%if %{with_openssl} == 2
-# Add content below to use source code of OpenSSL
-%define openssl_dir %{_builddir}/%{name}-%{version}/openssl
-mkdir -p openssl
-tar xfz %{SOURCE3} --strip-components=1 -C openssl
-pushd openssl
-./config no-dgram no-tests shared zlib -fPIC
-make %{?_smp_mflags}
-popd
-%endif
-
-%build
-%if %{rescue}
-CFLAGS="$RPM_OPT_FLAGS -Os"; export CFLAGS
-%endif
-
-%if %{with_openssl} == 2
-# Add OpenSSL library
-export LD_LIBRARY_PATH="%{openssl_dir}"
-%endif
-%configure \
-	--sysconfdir=%{_sysconfdir}/ssh \
-	--libexecdir=%{_libexecdir}/openssh \
-	--datadir=%{_datadir}/openssh \
-	--with-default-path=/usr/local/bin:/bin:/usr/bin \
-	--with-superuser-path=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin \
-	--with-privsep-path=%{_var}/empty/sshd \
-	--with-md5-passwords \
-	--mandir=%{_mandir} \
-	--with-mantype=man \
-        --with-systemd \
-	--disable-strip \
-%if %{with_openssl} == 2
-	--with-ssl-dir="%{openssl_dir}" \
-%endif
-%if %{with_openssl} == 0
-	--without-openssl \
-%else
-	--with-ssl-engine \
-%endif
-	--with-zlib \
-%if %{scard}
-	--with-smartcard \
-%endif
-%if %{rescue}
-	--without-pam \
-%else
-	--with-pam \
-%endif
-%if %{kerberos5}
-	 --with-kerberos5=$K5DIR \
-%endif
-
-
-%if %{with_openssl} == 2
-# Add OpenSSL library
-perl -pi -e "s|-lcrypto|%{openssl_dir}/libcrypto.a -lpthread|g" Makefile
-%endif
-
-make %{?_smp_mflags}
-
-%if ! %{no_x11_askpass}
-pushd x11-ssh-askpass-%{aversion}
-%configure --libexecdir=%{_libexecdir}/openssh
-xmkmf -a
-make -j
-popd
-%endif
-
-# Define a variable to toggle gnome1/gtk2 building.  This is necessary
-# because RPM doesn't handle nested %if statements.
-%if %{gtk2}
-	gtk2=yes
-%else
-	gtk2=no
-%endif
-
-%if ! %{no_gnome_askpass}
-pushd contrib
-if [ $gtk2 = yes ] ; then
-	make gnome-ssh-askpass2
-	mv gnome-ssh-askpass2 gnome-ssh-askpass
-else
-	make gnome-ssh-askpass1
-	mv gnome-ssh-askpass1 gnome-ssh-askpass
-fi
-popd
-%endif
-
-%install
-rm -rf $RPM_BUILD_ROOT
-mkdir -p -m755 $RPM_BUILD_ROOT%{_sysconfdir}/ssh
-mkdir -p -m755 $RPM_BUILD_ROOT%{_libexecdir}/openssh
-mkdir -p -m755 $RPM_BUILD_ROOT%{_var}/empty/sshd
-
-make install DESTDIR=$RPM_BUILD_ROOT
-# Modify sshd config file.
-cat << EOF >> $RPM_BUILD_ROOT/etc/ssh/sshd_config
-%if %{with_openssl} > 0
-PubkeyAcceptedAlgorithms +ssh-rsa
-%endif
-PermitRootLogin yes
-PasswordAuthentication yes
-UseDNS no
-UsePAM yes
-KexAlgorithms -diffie-hellman-group1-sha1,diffie-hellman-group1-sha256,diffie-hellman-group14-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha256,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha512
-EOF
-%if %{with_openssl} > 0
-# Modify ssh config file, to ensure that traditional RSA-type key authentication is available to avoid git clone failures.
-# See: https://support.genymotion.com/hc/en-us/articles/9500420360093-I-get-the-error-no-matching-host-key-type-found-Their-offer-ssh-rsa-when-trying-to-connect-with-SSH
-cat << EOF >> $RPM_BUILD_ROOT/etc/ssh/ssh_config
-Host *
-    HostKeyAlgorithms = +ssh-rsa
-    PubkeyAcceptedAlgorithms = +ssh-rsa
-EOF
-%endif
-
-install -m755 contrib/ssh-copy-id $RPM_BUILD_ROOT%{_bindir}/
-install -m644 contrib/ssh-copy-id.1 $RPM_BUILD_ROOT%{_mandir}/man1/
-install -d $RPM_BUILD_ROOT/etc/pam.d/
-install -d $RPM_BUILD_ROOT/etc/rc.d/init.d
-install -d $RPM_BUILD_ROOT%{_libexecdir}/openssh
-# Using custom PAM file
-install -m644 %{SOURCE2}     $RPM_BUILD_ROOT/etc/pam.d/sshd
-
-# init-v
-install -m755 contrib/redhat/sshd.init $RPM_BUILD_ROOT/etc/rc.d/init.d/sshd
-
-# systemd support 
-install -d $RPM_BUILD_ROOT/etc/sysconfig/
-install -m644 %{SOURCE7} $RPM_BUILD_ROOT/etc/sysconfig/sshd
-install -m755 %{SOURCE13} $RPM_BUILD_ROOT/%{_sbindir}/sshd-keygen
-install -d -m755 $RPM_BUILD_ROOT/%{_unitdir}
-install -m644 %{SOURCE9} $RPM_BUILD_ROOT/%{_unitdir}/sshd@.service
-install -m644 %{SOURCE10} $RPM_BUILD_ROOT/%{_unitdir}/sshd.socket
-install -m644 %{SOURCE11} $RPM_BUILD_ROOT/%{_unitdir}/sshd.service
-install -m644 %{SOURCE12} $RPM_BUILD_ROOT/%{_unitdir}/sshd-keygen.service
-
-%if ! %{no_x11_askpass}
-install x11-ssh-askpass-%{aversion}/x11-ssh-askpass $RPM_BUILD_ROOT%{_libexecdir}/openssh/x11-ssh-askpass
-ln -s x11-ssh-askpass $RPM_BUILD_ROOT%{_libexecdir}/openssh/ssh-askpass
-%endif
-
-%if ! %{no_gnome_askpass}
-install contrib/gnome-ssh-askpass $RPM_BUILD_ROOT%{_libexecdir}/openssh/gnome-ssh-askpass
-%endif
-
-%if ! %{scard}
-	 rm -f $RPM_BUILD_ROOT/usr/share/openssh/Ssh.bin
-%endif
-
-%if ! %{no_gnome_askpass}
-install -m 755 -d $RPM_BUILD_ROOT%{_sysconfdir}/profile.d/
-install -m 755 contrib/redhat/gnome-ssh-askpass.csh $RPM_BUILD_ROOT%{_sysconfdir}/profile.d/
-install -m 755 contrib/redhat/gnome-ssh-askpass.sh $RPM_BUILD_ROOT%{_sysconfdir}/profile.d/
-%endif
-
-perl -pi -e "s|$RPM_BUILD_ROOT||g" $RPM_BUILD_ROOT%{_mandir}/man*/*
-
-%clean
-rm -rf $RPM_BUILD_ROOT
-
-%triggerun server -- ssh-server
-if [ "$1" != 0 -a -r /var/run/sshd.pid ] ; then
-	touch /var/run/sshd.restart
-fi
-
-%triggerun server -- openssh-server < 2.5.0p1
-# Count the number of HostKey and HostDsaKey statements we have.
-gawk	'BEGIN {IGNORECASE=1}
-	 /^hostkey/ || /^hostdsakey/ {sawhostkey = sawhostkey + 1}
-	 END {exit sawhostkey}' /etc/ssh/sshd_config
-# And if we only found one, we know the client was relying on the old default
-# behavior, which loaded the the SSH2 DSA host key when HostDsaKey wasn't
-# specified.  Now that HostKey is used for both SSH1 and SSH2 keys, specifying
-# one nullifies the default, which would have loaded both.
-if [ $? -eq 1 ] ; then
-	echo HostKey /etc/ssh/ssh_host_rsa_key >> /etc/ssh/sshd_config
-	echo HostKey /etc/ssh/ssh_host_dsa_key >> /etc/ssh/sshd_config
-fi
-
-%triggerpostun server -- ssh-server
-if [ "$1" != 0 ] ; then
-	/sbin/chkconfig --add sshd
-	if test -f /var/run/sshd.restart ; then
-		rm -f /var/run/sshd.restart
-		/sbin/service sshd start > /dev/null 2>&1 || :
-	fi
-fi
-
-%pre server
-%{_sbindir}/groupadd -r -g %{sshd_gid} sshd 2>/dev/null || :
-%{_sbindir}/useradd -d /var/empty/sshd -s /bin/false -u %{sshd_uid} \
-	-g sshd -M -r sshd 2>/dev/null || :
-
-%post server
-# Fix permissions and ownership for private host key files.
-# This ensures that even if an old package had incorrect permissions (like 0640),
-# or if %config(noreplace) prevented %files from re-applying permissions during an upgrade,
-# these critical security permissions are corrected.
-for keyfile in \
-    /etc/ssh/ssh_host_rsa_key \
-    /etc/ssh/ssh_host_ed25519_key \
-    /etc/ssh/ssh_host_dsa_key \
-    /etc/ssh/ssh_host_ecdsa_key; do
-    if [ -f "$keyfile" ]; then
-        chmod 0600 "$keyfile"
-        chown root:root "$keyfile"
-    fi
-done
-%systemd_post sshd.service sshd.socket
-
-%preun server
-%systemd_preun sshd.service sshd.socket
-
-%postun server
-%systemd_postun_with_restart sshd.service
-
-%files
-%defattr(-,root,root)
-%doc CREDITS ChangeLog INSTALL LICENCE OVERVIEW README* PROTOCOL* TODO
-%attr(0755,root,root) %{_bindir}/scp
-%attr(0644,root,root) %{_mandir}/man1/scp.1*
-%attr(0755,root,root) %dir %{_sysconfdir}/ssh
-%attr(0600,root,root) %config(noreplace) %{_sysconfdir}/ssh/moduli
-%if ! %{rescue}
-%attr(0755,root,root) %{_bindir}/ssh-keygen
-%attr(0644,root,root) %{_mandir}/man1/ssh-keygen.1*
-%attr(0755,root,root) %dir %{_libexecdir}/openssh
-%attr(4711,root,root) %{_libexecdir}/openssh/ssh-keysign
-%attr(0755,root,root) %{_libexecdir}/openssh/ssh-pkcs11-helper
-%attr(0755,root,root) %{_libexecdir}/openssh/ssh-sk-helper
-%attr(0644,root,root) %{_mandir}/man8/ssh-keysign.8*
-%attr(0644,root,root) %{_mandir}/man8/ssh-pkcs11-helper.8*
-%attr(0644,root,root) %{_mandir}/man8/ssh-sk-helper.8*
-%endif
-%if %{scard}
-%attr(0755,root,root) %dir %{_datadir}/openssh
-%attr(0644,root,root) %{_datadir}/openssh/Ssh.bin
-%endif
-
-%files clients
-%defattr(-,root,root)
-%attr(0755,root,root) %{_bindir}/ssh
-%attr(0644,root,root) %{_mandir}/man1/ssh.1*
-%attr(0644,root,root) %{_mandir}/man5/ssh_config.5*
-%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ssh/ssh_config
-%if ! %{rescue}
-%attr(2755,root,nobody) %{_bindir}/ssh-agent
-%attr(0755,root,root) %{_bindir}/ssh-add
-%attr(0755,root,root) %{_bindir}/ssh-keyscan
-%attr(0755,root,root) %{_bindir}/sftp
-%attr(0755,root,root) %{_bindir}/ssh-copy-id
-%attr(0644,root,root) %{_mandir}/man1/ssh-agent.1*
-%attr(0644,root,root) %{_mandir}/man1/ssh-add.1*
-%attr(0644,root,root) %{_mandir}/man1/ssh-keyscan.1*
-%attr(0644,root,root) %{_mandir}/man1/sftp.1*
-%attr(0644,root,root) %{_mandir}/man1/ssh-copy-id.1*
-%endif
-
-%if ! %{rescue}
-%files server
-%defattr(-,root,root)
-%dir %attr(0111,root,root) %{_var}/empty/sshd
-%attr(0755,root,root) %{_sbindir}/sshd
-%attr(0755,root,root) %{_sbindir}/sshd-keygen
-%attr(0755,root,root) %{_libexecdir}/openssh/sshd-session
-%attr(0755,root,root) %{_libexecdir}/openssh/sshd-auth
-%attr(0755,root,root) %{_libexecdir}/openssh/sftp-server
-%attr(0644,root,root) %{_mandir}/man8/sshd.8*
-%attr(0644,root,root) %{_mandir}/man5/moduli.5*
-%attr(0644,root,root) %{_mandir}/man5/sshd_config.5*
-%attr(0644,root,root) %{_mandir}/man8/sftp-server.8*
-%attr(0755,root,root) %dir %{_sysconfdir}/ssh
-%attr(0600,root,root) %config(noreplace) %{_sysconfdir}/ssh/sshd_config
-%attr(0640,root,root) %config(noreplace) /etc/sysconfig/sshd
-%attr(0600,root,root) %config(noreplace) /etc/pam.d/sshd
-%attr(0755,root,root) %config /etc/rc.d/init.d/sshd
-%attr(0644,root,root) %{_unitdir}/sshd.service
-%attr(0644,root,root) %{_unitdir}/sshd@.service
-%attr(0644,root,root) %{_unitdir}/sshd.socket
-%attr(0644,root,root) %{_unitdir}/sshd-keygen.service
-%endif
-
-%if ! %{no_x11_askpass}
-%files askpass
-%defattr(-,root,root)
-%doc x11-ssh-askpass-%{aversion}/README
-%doc x11-ssh-askpass-%{aversion}/ChangeLog
-%doc x11-ssh-askpass-%{aversion}/SshAskpass*.ad
-%{_libexecdir}/openssh/ssh-askpass
-%attr(0755,root,root) %{_libexecdir}/openssh/x11-ssh-askpass
-%endif
-
-%if ! %{no_gnome_askpass}
-%files askpass-gnome
-%defattr(-,root,root)
-%attr(0755,root,root) %config %{_sysconfdir}/profile.d/gnome-ssh-askpass.*
-%attr(0755,root,root) %{_libexecdir}/openssh/gnome-ssh-askpass
-%endif
--- a/el7/SRPMS/.keep
+++ b/el7/SRPMS/.keep
--- a/output/.keep
+++ b/output/.keep
--- a/pullsrc.sh
+++ b/pullsrc.sh
@@ -11,7 +11,7 @@ trap 'echo -e "Aborted, error $? in command: $BASH_COMMAND"; trap ERR; exit 1' E
 # Set magic variables for current file & dir
 __dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 __file="${__dir}/$(basename "${BASH_SOURCE[0]}")"
-__base="$(basename ${__file} .sh)"
+__base="$(basename "${__file}" .sh)"
 __root="$(cd "$(dirname "${__dir}")" && pwd)" # <-- change this as it depends on your app

 arg1="${1:-}"
@@ -20,37 +20,59 @@ arg1="${1:-}"
 # allow command fail:
 # fail_command || true

+# shellcheck disable=SC1091
 source version.env
+# shellcheck disable=SC1091
 [[ -f version-local.env ]] && source version-local.env

 OPENSSHMIR=https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable
 OPENSSLMIR=https://www.openssl.org/source/
-OPENSSLMIR=${GH_PROXY:-}https://github.com/openssl/openssl/releases/download/openssl-${OPENSSLVER}/
 ASKPASSMIR=https://src.fedoraproject.org/repo/pkgs/openssh/x11-ssh-askpass-1.2.4.1.tar.gz/8f2e41f3f7eaa8543a2440454637f3c3
 PERLMIR=https://www.cpan.org/src/5.0

+LATEST_OPENSSH() {
+	curl -s "$OPENSSHMIR/" 2>/dev/null \
+		| grep -o 'openssh-[0-9.]*p[0-9]*\.tar\.gz' \
+		| sed 's/openssh-//; s/\.tar\.gz//' \
+		| sort -Vu | tail -1 || true
+}
+
+if [[ $arg1 == "--latest" ]]; then
+	latest=$(LATEST_OPENSSH)
+	# shellcheck disable=SC2153
+	current="${OPENSSHVER}"
+	echo "Current version: $current"
+	echo "Latest  version: $latest"
+	if [[ "$latest" == "$current" ]]; then
+		echo "Already up to date."
+	else
+		echo "NEW VERSION AVAILABLE: $latest"
+	fi
+	exit 0
+fi
+
 mkdir -p downloads
 pushd downloads
-if [[ ! -f $OPENSSLSRC ]]; then
-  echo "Get:" $OPENSSLMIR/$OPENSSLSRC
-  wget --no-check-certificate $OPENSSLMIR/$OPENSSLSRC || \
-	  echo "!!! Please download $OPENSSLSRC in $PWD by yourself."
+if [[ ! -f $OPENSSLSRC && ${DOCKERBUILD:-0} == 0 ]]; then
+	echo "Get:" "$OPENSSLMIR"/"$OPENSSLSRC"
+	wget --no-check-certificate "$OPENSSLMIR"/"$OPENSSLSRC" \
+		|| echo "!!! Please download $OPENSSLSRC in $PWD by yourself."
 fi

-if [[ ! -f $OPENSSHSRC  ]]; then
-  echo Get: $OPENSSHMIR/$OPENSSHSRC
-  wget --no-check-certificate $OPENSSHMIR/$OPENSSHSRC || \
-	  echo "!!! Please download $OPENSSHSRC in $PWD by yourself."
+if [[ ! -f $OPENSSHSRC && ${DOCKERBUILD:-0} == 0 ]]; then
+	echo Get: "$OPENSSHMIR"/"$OPENSSHSRC"
+	wget --no-check-certificate "$OPENSSHMIR"/"$OPENSSHSRC" \
+		|| echo "!!! Please download $OPENSSHSRC in $PWD by yourself."
 fi

-if [[ ! -f $ASKPASSSRC  ]]; then
-  echo Get: $ASKPASSMIR/$ASKPASSSRC
-  wget --no-check-certificate $ASKPASSMIR/$ASKPASSSRC || \
-	  echo "!!! Please download $ASKPASSSRC in $PWD by yourself."
+if [[ ! -f $ASKPASSSRC && ${DOCKERBUILD:-0} == 0 ]]; then
+	echo Get: "$ASKPASSMIR"/"$ASKPASSSRC"
+	wget --no-check-certificate "$ASKPASSMIR"/"$ASKPASSSRC" \
+		|| echo "!!! Please download $ASKPASSSRC in $PWD by yourself."
 fi

-if [[ $($__dir/compile.sh GETEL) == "el5" || ${ALL:-0} == 1 && ! -f $PERLSRC ]]; then
-  echo Get: $PERLMIR/$PERLSRC
-  wget --no-check-certificate $PERLMIR/$PERLSRC || \
-	  echo "!!! Please download $PERLSRC in $PWD by yourself."
+if [[ ${DOCKERBUILD:-0} == 1 && ! -f $PERLSRC ]]; then
+	echo Get: "$PERLMIR"/"$PERLSRC"
+	wget --no-check-certificate "$PERLMIR"/"$PERLSRC" \
+		|| echo "!!! Please download $PERLSRC in $PWD by yourself."
 fi
--- a/version.env
+++ b/version.env
@@ -1,10 +1,10 @@
 # custom defined components
-OPENSSLSRC=openssl-3.5.6.tar.gz
-OPENSSHSRC=openssh-10.3p1.tar.gz
+OPENSSLSRC=openssl-3.5.8.tar.gz
+OPENSSHSRC=openssh-10.5p1.tar.gz
 ASKPASSSRC=x11-ssh-askpass-1.2.4.1.tar.gz

 # Package release version
-PKGREL=1
+#PKGREL=1

 # WITH_OPENSSL:
 #   0: build without openssl (using openssh internal crypto)
@@ -23,7 +23,3 @@ OPENSSLVER=${OPENSSLSRC%%.tar.gz}
 OPENSSLVER=${OPENSSLVER##openssl-}
 PERLVER=${PERLSRC%%.tar.gz}
 PERLVER=${PERLVER##perl-}
-
-# Github Proxy, this arg is very useful for Chinese users.
-# You can try this: https://github.akams.cn/
-# GH_PROXY=""
Author	SHA1	Message	Date
boypt	c2568133b5	docs: cover both sshd_config paths in Install RPMs	2026-09-17 14:09:54 +08:00
boypt	1376163c2b	docs: nest Use Docker under Build RPMs, add rollback and sshd -t config check	2026-09-17 14:06:45 +08:00
boypt	c31ccb379a	docs: simplify Download RPMs, add rollback section	2026-09-17 13:53:15 +08:00
boypt	c4ee83e77e	docs: refresh READMEs, fix stale build/output docs, add rollback section	2026-09-17 13:44:33 +08:00
boypt	cbc4df8b79	fix: harden distro detection fallback	2026-08-26 11:24:48 +08:00
boypt	3efa0bc606	fix: drop redundant EL5 dist define	2026-08-26 11:11:02 +08:00
boypt	754acf8bb6	fix: define EL5 dist macro	2026-08-26 10:50:17 +08:00
boypt	a8dec15f45	fix: restore EL5 distro detection	2026-08-26 10:35:48 +08:00
boypt	db84b53e9e	version bump: 10.5p1/openssl 3.5.8	2026-08-26 10:21:01 +08:00
boypt	5235c2cf1d	docs: trim el5/el6/el7 READMEs to per-dir specifics Drop stale hardcoded versions (point to version.env) and content already covered by the root README; fix el7 socket-activation wording, document the openssh.initv.spec variant and SPECFILE switch.	2026-08-24 14:14:30 +08:00
boypt	370f4310df	refactor: drop .keep placeholder files in favor of explicit mkdir BUILD_RPM now creates the rpmbuild _topdir subdirs (BUILD/RPMS/SRPMS/ SOURCES/SPECS) itself, so the 11 tracked .keep placeholders (downloads, output, el*/{BUILD,RPMS,SRPMS}) are no longer needed; output/ and downloads/ were already created by compile.sh/pullsrc.sh.	2026-08-24 14:07:09 +08:00
boypt	a3be02a209	refactor: flatten GUESS_DIST -> TOPDIR_SELECT call chain TOPDIR_SELECT now assigns rpmtopdir from GUESS_DIST directly and uses a single -d guard instead of a 4-branch identity-mapping case; the el5/el6 WITH_OPENSSL=2 default is dropped (BUILD_RPM already falls back to 2), keeping only the el7 system-openssl auto-detection. Main flow collapses case fallthrough + manual-dir + trailing checks into one dispatch case.	2026-08-24 14:00:11 +08:00
boypt	e9a25bd29a	refactor: simplify GUESS_DIST to generic el5/el6/el7 mapping Drop per-distro special cases (Anolis an7/an8, UOS uel*) in favor of a generic rule: only el5/el6 keep dedicated spec dirs, everything else maps to el7. Collapse the redundant glibc fallback chain into default branches.	2026-08-24 13:49:24 +08:00
boypt	568202d282	refactor: remove GH_PROXY mechanism	2026-08-22 00:12:13 +08:00
boypt	a33c6b5efe	docs(docker): document repos must be rewritten before any dnf operation in modify_el8	2026-08-21 17:59:25 +08:00
boypt	ff80eac7f7	refactor(docker): rewrite_baseurls comments out original line and appends own baseurl	2026-08-21 16:47:00 +08:00
boypt	cabaf74682	fix(docker): match '# baseurl=' with space in rewrite_baseurls for el6 sclo	2026-08-21 16:29:56 +08:00
boypt	af284228a1	fix(docker): drop archives.fedoraproject.org from EPEL to avoid el5 https redirect	2026-08-21 16:24:20 +08:00
boypt	aa02c16f46	fix: use single-line baseurl list for DNF 4.x compatibility DNF 4.x baseurl is list type (space-separated on one line per dnf.readthedocs.io); repeated baseurl= keys overwrite and only the last survives. Rewrite join_baseurls and add rewrite_baseurls helper to emit single baseurl= line with space-separated mirrors while preserving remainder after prefix (fixes multi-line sed truncation). Keep official-first ordering for GitHub CI. Also quote ELDIR in docker_compile.sh to pass shellcheck.	2026-08-21 16:10:27 +08:00
boypt	f85590a72e	refactor(docker): rename to modify_vault/live_source and unify to bash - git mv modify_yum_source.sh -> modify_vault_source.sh (vault: EL5/6/7/8) - git mv modify_dnf_source.pl -> modify_live_source.sh and rewrite perl logic in bash (LIVE_MIRRORS array official-first: mirror.stream.centos.org, mirrors.kernel.org/centos, aliyun/ustc/iij/yandex; bash -n clean) - update Dockerfile.centos/centos5 to call modify_vault_source.sh - update Dockerfile.centos-stream EL8 to call modify_vault_source.sh and EL9 to call modify_live_source.sh via bash (drop perl dep for Stream 9) - AGENTS.md: update vault script reference	2026-08-21 14:01:21 +08:00
boypt	4dbb7babec	docs(docker): add live-source official mirrors and clarify vault/live scope - modify_dnf_source.pl: prioritize official live mirrors https://mirror.stream.centos.org and https://mirrors.kernel.org/centos before aliyun/ustc/iij/yandex; add header comment that live handling is for still-supported Stream EL and vault handling lives in modify_yum_source.sh	2026-08-21 13:52:00 +08:00
boypt	67dbf9ae04	refactor(docker): reorganize vault mirrors to top arrays, merge shared vault/epel - move EL8 vault sed from Dockerfile.centos-stream into modify_yum_source.sh:modify_el8() and simplify Dockerfile EL8 branch to bash ./docker/modify_yum_source.sh - extract hardcoded one-line baseurl strings into top-level arrays for easy maintenance: VAULT (official-first HTTPS shared by el7/altarch/8-stream; yandex excluded), VAULT_HTTP (plain HTTP for el5/6), EPEL (merged EPEL_EL7+EPEL_HTTP) - merge VAULT_EL7+VAULT_EL8 (verified 5/5 cross-available, domestic not prioritized for CI) and EPEL_EL7+EPEL_HTTP (both http); de-duplicate aliyun - reprioritize VAULT official-first: vault.centos.org -> archive.kernel.org -> aliyun/iij (yandex excluded from VAULT, kept only in VAULT_HTTP/EPEL) - rewrite VAULT/VAULT_HTTP header comments with selection rationale	2026-08-21 13:38:57 +08:00
boypt	88a11ca9ca	docs: fix markdown table separator (use ---- not ====)	2026-08-21 12:13:10 +08:00
boypt	7ae3bb4d1e	docs: align UOS20 to EL8 image and map Recommended RPMs to CI artifacts - README.md table: replace meaningless aarch64_el7/8/9 tags with actual CI artifacts (rpm-el5-x86_64/i686, rpm-el6-x86_64, rpm-el7/8/9-, rpm-uos20-), fuzzy version via artifact name; fix UOS20 row from aarch64_el7 to rpm-uos20-* - README.md: UOS20=1 ./compile.sh el7 -> el8 (spec remains el7 via GUESS_DIST), anchor #uos-20-variant-el7-family -> #uos-20-variant-el8 - docker/README.md: UOS 20 Variant (EL7-family) -> (EL8), reuse EL7 image / Dockerfile.centos:7 -> reuse EL8 image via Dockerfile.centos-stream:8 (with GUESS_DIST note), uos20- -> uos20., build-args table EL7 -> EL8	2026-08-21 12:09:34 +08:00
boypt	ad677a79a3	docs(docker): translate Chinese note to English for consistency - Standalone Dockerfiles for Amazon Linux / openEuler / Rocky Linux have been consolidated into the generic EL images (reusing EL8/EL9 via glibc compatibility) and are no longer maintained separately.	2026-08-21 11:31:03 +08:00
boypt	234a5acf00	fix(docker): correct 8-stream vault baseurl to avoid duplication - revert EL8 sed to use vault roots without /8-stream suffix: https://mirrors.aliyun.com/centos-vault https://ftp.iij.ad.jp/pub/linux/centos-vault https://ftp.yandex.ru/centos/centos (previously included /8-stream causing 8-stream/8-stream duplication since repo file retains /$releasever suffix; vault.centos.org logic confirmed single vault root works) - fixes buildx failure in 32441214302 (el8 sed exit 1)	2026-08-21 10:52:50 +08:00
boypt	e062237c5c	fix(docker): use verified vault/stream mirrors for 8/9-stream - 8-stream (EOL): switch from single vault.centos.org to 3 verified vault mirrors https://mirrors.aliyun.com/centos-vault/8-stream/ https://ftp.iij.ad.jp/pub/linux/centos-vault/8-stream/ https://ftp.yandex.ru/centos/centos/8-stream/ (dual-path validated) via multi-baseurl sed in Dockerfile.centos-stream EL8 branch - 9-stream: update modify_dnf_source.pl @mirrors to 4 verified stream mirrors (mirrors.aliyun, mirrors.ustc, ftp.iij, ftp.yandex /centos-stream) drop vault.centos.org (404 for active 9-stream, verified via HEAD) - verified repodata (BaseOS/$basearch/os/repodata/repomd.xml) on both arches	2026-08-21 10:49:44 +08:00
boypt	464f44b1ed	refactor(docker): remove MIRROR branching, use multi-baseurl failover - drop ARG MIRROR / MIRROR_HOLDER sed injection across all Dockerfiles - modify_yum_source.sh: EL5/6 use 4x HTTP centos-vault + 5x HTTP epel (ftp.iij, mirrors.aliyun, ftp.yandex, ftp.pasteur / sindad, debian.sbor) to avoid TLS/302 on Python2.4; EL7 keep 2x HTTPS vault + 2x epel - modify_dnf_source.pl: replace single mirror holder with @mirrors array (vault.centos.org, mirrors.ustc, mirrors.aliyun) emitting multi baseurl - Dockerfile.centos-stream: EL9 now unconditional perl, EL8 vault direct - workflows/README: drop MIRROR docs and build-args - shfmt fix docker_compile.sh (tabs)	2026-08-21 10:12:41 +08:00
boypt	e1da586e03	docs: update README/AGENTS for aarch64 support - README: expand supported distro table to 4 cols with Arch (x86_64/aarch64) and per-arch tags aarch64_el7/8/9, add altarch note - AGENTS: add Supported architectures (per-arch tags) and altarch vault handling, expand CI matrix details for build-images (5+3) and build-rpm (arm64@ubuntu-24.04-arm)	2026-08-20 17:28:34 +08:00
boypt	9e54e5d205	style: shfmt docker/modify_yum_source.sh (tabs)	2026-08-20 16:50:07 +08:00
boypt	c52b9968ed	fix(docker): handle el7 aarch64 altarch baseurl and make epel sed robust	2026-08-20 16:42:48 +08:00
boypt	116e7ec791	fix(docker): use HTTP aliyun EPEL for el5 to avoid Python2.4 HTTPS redirect (302)	2026-08-20 16:38:52 +08:00
boypt	f961f49444	fix(pullsrc): download perl for DOCKERBUILD without GETEL check (fix el5 lstat)	2026-08-20 16:27:46 +08:00
boypt	d551b20885	ci: remove redundant Replace Mirror URL steps, keep source intact	2026-08-20 16:19:35 +08:00
boypt	f82afb75b3	fix(ci): correct Replace Mirror URL regex to avoid Dockerfile truncation	2026-08-20 16:17:27 +08:00
boypt	1a6c26eeba	refactor(docker): simplify images, move el8 to centos-stream, isolate el5, fix altarch/metalink	2026-08-20 16:09:50 +08:00
boypt	43ff05ed49	fix: ignore dot files	2026-08-16 11:24:29 +08:00
boypt	cbb519644d	lint: add shellcheck/shfmt rules to AGENTS.md, format compile.sh and pullsrc.sh	2026-08-16 11:21:01 +08:00
boypt	277ccf7ec4	cleanup: remove deprecated --with-md5-passwords, --with-smartcard, --with-systemd, and fix kerberos5 in initv spec	2026-08-16 10:59:00 +08:00
boypt	385c677425	config: add .opencode/opencode.json for edit/bash/external_directory permissions Allow editing version.env without confirmation, allow /tmp external directory access, and default bash commands to ask.	2026-08-11 15:42:00 +08:00
boypt	4c8b1fb2e9	fix: use '.' separator in UOS20 PKGREL prefix to avoid illegal '-' in Release field RPM does not allow '-' in the Release field (it is the Version/Release delimiter). The 'uos20-' prefix produced Release values like 'uos20-b1.el8' which rpmbuild rejects with 'Illegal char '-' (0x2d)'. Switch to 'uos20.'.	2026-08-11 15:17:39 +08:00
boypt	31c5e61c6e	ver bump: 10.5p1	2026-08-11 15:09:58 +08:00
boypt	b0690b2822	docs: mark UnionTech UOS V20 as UOS20 variant in Supported Distro The standard EL 8 build does not include the do_dup2() kernel-panic workaround needed on UOS 20 kernels. Point UOS 20 users at the UOS20 variant instead, matching the dedicated 'Build for uniontech UOS 20' section in Other Notes.	2026-08-07 17:05:07 +08:00
boypt	f7b7dfccc2	docs: auto-detect ARCH and EL when downloading from latest release Replace the hardcoded 'el7' / 'x86_64' filter with ARCH and EL variables, populated from `uname -m` and `./compile.sh GETEL` respectively. UOS 20 still requires manually setting EL=uos20 since it's not auto-detectable from the running system.	2026-08-07 17:04:12 +08:00
boypt	d6bcab2809	fix: use 'uos20-' as PKGREL prefix to avoid unreadable 'uos201' PKGREL=1 + 'uos20' prefix concatenated to 'uos201', which reads as 'uos two hundred one' rather than 'uos20 version 1'. Add a hyphen ('uos20-') so the resulting release tag is 'uos20-1' / 'uos20-b12' etc. Update compile.sh logic and the three doc references (README, AGENTS.md, docker/README.md) to match.	2026-08-07 16:48:38 +08:00
boypt	1dddf9eb4a	docs: document UOS20=1 build variant in README Add an 'Other Notes' subsection describing the UOS 20 kernel do_dup2() panic, the openssh-uos20-kernel-panic-fix.patch workaround, and how to opt in via UOS20=1 (which also prefixes PKGREL with uos20). Note that ordinary EL7/8/9 builds are unaffected, and link to the Docker build instructions for the same variant.	2026-08-07 16:46:04 +08:00
boypt	761cc835d7	ci: decouple artifact name from matrix.el/arch via explicit field The upload-artifact template hardcoded 'el' as a prefix (rpm-el${el}-${arch}), which glued 'el' to non-numeric el values like 'uos20' and produced ugly artifact names such as 'rpm-eluos20-x86_64'. Add an explicit 'artifact' field to each matrix entry carrying the full artifact name, and reference it directly in the upload step. This keeps naming fully self-describing per entry and lets future variants pick their own label without touching the template.	2026-08-07 16:34:30 +08:00
boypt	59870bad71	ci: build UOS 20 RPMs in build-rpm workflow (x86_64 + aarch64) Add a UOS 20 matrix entry to both build-arm64 and build-amd64 jobs, reusing the existing el8 / aarch64_el8 base images and passing -e UOS20=1 to the container. Artifact names use 'uos20' (rpm-uos20-x86_64, rpm-uos20-aarch64) so they are distinguishable from the standard el8 builds in releases. The release job already downloads everything under artifacts/, so no changes there.	2026-08-07 16:19:28 +08:00
boypt	422e850fe0	docs: document UOS20=1 docker build variant Add a UOS 20 Variant subsection in the EL7 build area and a row in the Build Arguments table, showing how to reuse the elssh:el7 image with -e UOS20=1 to produce UOS 20 RPMs.	2026-08-07 16:15:27 +08:00
boypt	ef31f9cb53	refactor: consolidate UOS20 spec into main openssh.spec via UOS20=1 The UOS 20 build was previously a near-duplicate spec (openssh.uos20.spec) with only the kernel-panic patch as an intentional difference. The kerberos5 and gssapi drift was unintentional and caused maintenance pain upstream changes had to be applied in two places. Now there is one spec. The kernel-panic patch is gated on a uos20 macro that compile.sh sets only when UOS20=1 is in the environment, so non-UOS builds cannot accidentally pick it up. When UOS20=1, PKGREL is prefixed with 'uos20' so the resulting RPMs are distinguishable from the standard build (e.g. PKGREL=1 -> uos201). Delete openssh.uos20.spec, document UOS20=1 in AGENTS.md.	2026-08-07 16:12:21 +08:00
boypt	fc0fd802a6	refactor: rename aarch64-kernel-panic patch to uos20-kernel-panic, switch to Patch999 The do_dup2() NULL pointer dereference panic affects all UOS 20 systems, not just aarch64, so the patch name is generalized. Move the patch slot from Patch100 (which collides with 10.4-fix-gssapi.patch in other specs) to Patch999. Add an inline comment documenting the panic call trace and fix mechanism.	2026-08-07 16:01:40 +08:00
boypt	7f1af1b7d0	feat: add --latest to check upstream OpenSSH version, document release workflow	2026-07-29 10:08:22 +08:00
boypt	6eb13e831a	refactor: map el8+ to el7 in GUESS_DIST, add AGENTS.md	2026-07-29 09:49:14 +08:00
boypt	75c8793cb4	fix: revert unnecess pkg	2026-07-10 16:30:35 +08:00
boypt	b4e4764bb9	fix: patch applying	2026-07-10 16:01:47 +08:00
boypt	4d8cac9a2d	fix: docker detect openssl	2026-07-10 15:48:11 +08:00
boypt	aa5a4b8162	fix: upstream bug with GSSAPI options	2026-07-10 15:47:02 +08:00
boypt	fd02898584	fix: force gssapi enabled	2026-07-10 14:13:18 +08:00
boypt	e631cda76c	fix: move the el5 krb5 linking hack to SPCE	2026-07-10 09:09:14 +08:00
boypt	fb9940fc8c	fix: remove tab indent	2026-07-09 16:42:26 +08:00
boypt	ed95794b1f	fix: el5 perl ver check	2026-07-09 16:12:38 +08:00
boypt	2d5684db77	fix: el5 fake perl src	2026-07-09 16:08:10 +08:00
boypt	9227ec48d8	fix: el5 build hacks	2026-07-09 15:59:10 +08:00
boypt	26bb728182	fix: el5 build	2026-07-09 15:48:02 +08:00
boypt	f4b0b367ef	fix: only download for el5	2026-07-09 15:15:54 +08:00
boypt	8f963924f8	fix: only el5 install setarch	2026-07-09 15:11:43 +08:00
boypt	74407594eb	fix: avoid action stragy	2026-07-09 15:07:49 +08:00
boypt	eefd89e9f1	fix: typo	2026-07-09 14:18:43 +08:00
boypt	82140f9776	fix: workflow strategy configuration	2026-07-09 14:16:57 +08:00
boypt	b26ae9911a	gh: update actions	2026-07-09 14:03:51 +08:00
boypt	018d9130ab	fix: krb5 in el5 hack	2026-07-09 13:48:41 +08:00
boypt	df886d8efe	doc: use docker image tag	2026-07-09 13:18:13 +08:00
boypt	196031cca0	fix: support krb5 in M32=1	2026-07-09 13:14:52 +08:00
boypt	0317be588e	fix: script may fail to report error code in EL5	2026-07-07 16:06:26 +08:00
boypt	25ce45ddf0	fix: el5 krb5 support disable	2026-07-07 15:50:17 +08:00
boypt	34ddbb4ad4	update workflow actions	2026-07-07 15:27:51 +08:00
boypt	97fe71453a	fix: set kerberos5=1 as default	2026-07-07 13:40:53 +08:00
boypt	a76ff4e992	fix: K5DIR was nerver defined	2026-07-07 11:58:48 +08:00
boypt	8928da2c9b	workflow: refact with matrix; add arm64 EL7	2026-07-07 09:29:18 +08:00
boypt	fcc105165b	fix: rename build artifact	2026-07-07 09:23:05 +08:00
boypt	87491ab5ab	version bump: 10.4p1/openssl 3.5.7	2026-07-07 09:08:02 +08:00
boypt	c18c992355	fix: release with zip	2026-07-07 09:07:04 +08:00
boypt	b40aa4309d	fix: docker compile var	2026-04-10 18:06:08 +08:00
boypt	edca0cfa30	fix: docker compile	2026-04-10 16:37:02 +08:00
boypt	50a8e37784	fix: default env vars	2026-04-10 16:12:24 +08:00
boypt	2d0b39e180	doc: update compat table	2026-04-10 15:27:54 +08:00
boypt	b3f3bc9427	update doc	2026-04-10 13:53:38 +08:00
boypt	cc0713dad0	rewrite docker build doc	2026-04-10 13:32:34 +08:00
boypt	53207f21b5	docker: use system openssl if versiono 3	2026-04-10 13:16:03 +08:00
boypt	daad9a414b	action: run arm64 build on arm image	2026-04-10 12:00:25 +08:00
boypt	8aea4ef71b	action: fix version-local	2026-04-10 10:47:45 +08:00