diff --git a/.gitignore b/.gitignore
index 6988bb2..f760b87 100644
--- a/.gitignore
+++ b/.gitignore
@@ -60,3 +60,5 @@ pam_ssh_agent_auth-0.9.2.tar.bz2
 /openssh-9.3p1.tar.gz.asc
 /openssh-9.6p1.tar.gz
 /openssh-9.6p1.tar.gz.asc
+/openssh-9.8p1.tar.gz
+/openssh-9.8p1.tar.gz.asc
diff --git a/CVE-2024-6387.patch b/CVE-2024-6387.patch
deleted file mode 100644
index 0b976c0..0000000
--- a/CVE-2024-6387.patch
+++ /dev/null
@@ -1,18 +0,0 @@
-diff --git a/log.c b/log.c
-index 9fc1a2e2e..191ff4a5a 100644
---- a/log.c
-+++ b/log.c
-@@ -451,12 +451,14 @@ void
- sshsigdie(const char *file, const char *func, int line, int showfunc,
-     LogLevel level, const char *suffix, const char *fmt, ...)
- {
-+#ifdef SYSLOG_R_SAFE_IN_SIGHAND
- 	va_list args;
- 
- 	va_start(args, fmt);
- 	sshlogv(file, func, line, showfunc, SYSLOG_LEVEL_FATAL,
- 	    suffix, fmt, args);
- 	va_end(args);
-+#endif
- 	_exit(1);
- }
diff --git a/openssh-6.6.1p1-log-in-chroot.patch b/openssh-6.6.1p1-log-in-chroot.patch
index 941c694..0f65279 100644
--- a/openssh-6.6.1p1-log-in-chroot.patch
+++ b/openssh-6.6.1p1-log-in-chroot.patch
@@ -237,11 +237,11 @@ diff -up openssh-8.6p1/sftp-server-main.c.log-in-chroot openssh-8.6p1/sftp-serve
 -	return (sftp_server_main(argc, argv, user_pw));
 +	return (sftp_server_main(argc, argv, user_pw, 0));
  }
-diff -up openssh-8.6p1/sshd.c.log-in-chroot openssh-8.6p1/sshd.c
---- openssh-8.6p1/sshd.c.log-in-chroot	2021-04-19 14:43:08.543843426 +0200
-+++ openssh-8.6p1/sshd.c	2021-04-19 14:43:08.545843441 +0200
+diff -up openssh-8.6p1/sshd-session.c.log-in-chroot openssh-8.6p1/sshd-session.c
+--- openssh-8.6p1/sshd-session.c.log-in-chroot	2021-04-19 14:43:08.543843426 +0200
++++ openssh-8.6p1/sshd-session.c	2021-04-19 14:43:08.545843441 +0200
 @@ -559,7 +559,7 @@ privsep_postauth(struct ssh *ssh, Authct
- 	}
+ #endif
  
  	/* New socket pair */
 -	monitor_reinit(pmonitor);
diff --git a/openssh-6.6.1p1-selinux-contexts.patch b/openssh-6.6.1p1-selinux-contexts.patch
index eab724a..96161cb 100644
--- a/openssh-6.6.1p1-selinux-contexts.patch
+++ b/openssh-6.6.1p1-selinux-contexts.patch
@@ -116,10 +116,10 @@ index cb51f99..8b7cda2 100644
  #endif
  
  #ifdef LINUX_OOM_ADJUST
-diff --git a/sshd.c b/sshd.c
+diff --git a/sshd-session.c b/sshd-session.c
 index 2871fe9..39b9c08 100644
---- a/sshd.c
-+++ b/sshd.c
+--- a/sshd-session.c
++++ b/sshd-session.c
 @@ -629,7 +629,7 @@ privsep_preauth_child(void)
  	demote_sensitive_data();
  
diff --git a/openssh-6.6p1-GSSAPIEnablek5users.patch b/openssh-6.6p1-GSSAPIEnablek5users.patch
index cccb3e0..7fef831 100644
--- a/openssh-6.6p1-GSSAPIEnablek5users.patch
+++ b/openssh-6.6p1-GSSAPIEnablek5users.patch
@@ -38,16 +38,16 @@ diff -up openssh-7.4p1/servconf.c.GSSAPIEnablek5users openssh-7.4p1/servconf.c
  	if (options->password_authentication == -1)
  		options->password_authentication = 1;
  	if (options->kbd_interactive_authentication == -1)
-@@ -418,7 +421,7 @@ typedef enum {
- 	sHostbasedUsesNameFromPacketOnly, sHostbasedAcceptedAlgorithms,
+@@ -578,7 +578,7 @@ typedef enum {
  	sHostKeyAlgorithms, sPerSourceMaxStartups, sPerSourceNetBlockSize,
+ 	sPerSourcePenalties, sPerSourcePenaltyExemptList,
  	sClientAliveInterval, sClientAliveCountMax, sAuthorizedKeysFile,
 -	sGssAuthentication, sGssCleanupCreds, sGssStrictAcceptor,
 +	sGssAuthentication, sGssCleanupCreds, sGssEnablek5users, sGssStrictAcceptor,
  	sGssKeyEx, sGssKexAlgorithms, sGssStoreRekey,
  	sAcceptEnv, sSetEnv, sPermitTunnel,
  	sMatch, sPermitOpen, sPermitListen, sForceCommand, sChrootDirectory,
-@@ -497,14 +500,16 @@ static struct {
+@@ -600,14 +600,16 @@ static struct {
  	{ "gssapikeyexchange", sGssKeyEx, SSHCFG_GLOBAL },
  	{ "gssapistorecredentialsonrekey", sGssStoreRekey, SSHCFG_GLOBAL },
  	{ "gssapikexalgorithms", sGssKexAlgorithms, SSHCFG_GLOBAL },
@@ -129,3 +129,6 @@ diff -up openssh-7.4p1/sshd_config.GSSAPIEnablek5users openssh-7.4p1/sshd_config
  
  # Set this to 'yes' to enable PAM authentication, account processing,
  # and session processing. If this is enabled, PAM authentication will
+diff -up openssh-9.8p1/servconf.c.xxx openssh-9.8p1/servconf.c
+--- openssh-9.8p1/servconf.c.xxx	2024-07-11 13:51:19.969960781 +0200
++++ openssh-9.8p1/servconf.c	2024-07-11 13:51:30.938231250 +0200
diff --git a/openssh-6.6p1-allow-ip-opts.patch b/openssh-6.6p1-allow-ip-opts.patch
index be8d340..d969b5c 100644
--- a/openssh-6.6p1-allow-ip-opts.patch
+++ b/openssh-6.6p1-allow-ip-opts.patch
@@ -1,6 +1,6 @@
 diff -up openssh/sshd.c.ip-opts openssh/sshd.c
---- openssh/sshd.c.ip-opts	2016-07-25 13:58:48.998507834 +0200
-+++ openssh/sshd.c	2016-07-25 14:01:28.346469878 +0200
+--- openssh/sshd-session.c.ip-opts	2016-07-25 13:58:48.998507834 +0200
++++ openssh/sshd-session.c	2016-07-25 14:01:28.346469878 +0200
 @@ -1507,12 +1507,32 @@ check_ip_options(struct ssh *ssh)
  
  	if (getsockopt(sock_in, IPPROTO_IP, IP_OPTIONS, opts,
diff --git a/openssh-6.6p1-keycat.patch b/openssh-6.6p1-keycat.patch
index 529b508..7339185 100644
--- a/openssh-6.6p1-keycat.patch
+++ b/openssh-6.6p1-keycat.patch
@@ -39,9 +39,9 @@ diff -up openssh/Makefile.in.keycat openssh/Makefile.in
  SFTP_SERVER=$(libexecdir)/sftp-server
  SSH_KEYSIGN=$(libexecdir)/ssh-keysign
 +SSH_KEYCAT=$(libexecdir)/ssh-keycat
+ SSHD_SESSION=$(libexecdir)/sshd-session
  SSH_PKCS11_HELPER=$(libexecdir)/ssh-pkcs11-helper
  SSH_SK_HELPER=$(libexecdir)/ssh-sk-helper
- PRIVSEP_PATH=@PRIVSEP_PATH@
 @@ -52,6 +52,7 @@ K5LIBS=@K5LIBS@
  K5LIBS=@K5LIBS@
  GSSLIBS=@GSSLIBS@
@@ -54,8 +54,8 @@ diff -up openssh/Makefile.in.keycat openssh/Makefile.in
  
  .SUFFIXES: .lo
  
--TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-sk-helper$(EXEEXT)
-+TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-sk-helper$(EXEEXT) ssh-keycat$(EXEEXT)
+-TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) sshd-session$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-sk-helper$(EXEEXT)
++TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) sshd-session$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-sk-helper$(EXEEXT) ssh-keycat$(EXEEXT)
  
  XMSS_OBJS=\
  	ssh-xmss.o \
diff --git a/openssh-6.6p1-kuserok.patch b/openssh-6.6p1-kuserok.patch
index eaf4453..e43128b 100644
--- a/openssh-6.6p1-kuserok.patch
+++ b/openssh-6.6p1-kuserok.patch
@@ -266,8 +266,8 @@ diff -up openssh-7.4p1/sshd_config.5.kuserok openssh-7.4p1/sshd_config.5
 +The default is
 +.Cm yes .
  .It Cm KexAlgorithms
- Specifies the available KEX (Key Exchange) algorithms.
- Multiple algorithms must be comma-separated.
+ Specifies the permitted KEX (Key Exchange) algorithms that the server will
+ offer to clients.
 @@ -1078,6 +1082,7 @@ Available keywords are
  .Cm IPQoS ,
  .Cm KbdInteractiveAuthentication ,
diff --git a/openssh-6.6p1-privsep-selinux.patch b/openssh-6.6p1-privsep-selinux.patch
index 8047fc3..023dd5c 100644
--- a/openssh-6.6p1-privsep-selinux.patch
+++ b/openssh-6.6p1-privsep-selinux.patch
@@ -96,8 +96,8 @@ diff -up openssh-7.4p1/session.c.privsep-selinux openssh-7.4p1/session.c
  	}
  
 diff -up openssh-7.4p1/sshd.c.privsep-selinux openssh-7.4p1/sshd.c
---- openssh-7.4p1/sshd.c.privsep-selinux	2016-12-23 18:58:52.973122201 +0100
-+++ openssh-7.4p1/sshd.c	2016-12-23 18:59:13.808124269 +0100
+--- openssh-7.4p1/sshd-session.c.privsep-selinux	2016-12-23 18:58:52.973122201 +0100
++++ openssh-7.4p1/sshd-session.c	2016-12-23 18:59:13.808124269 +0100
 @@ -540,6 +540,10 @@ privsep_preauth_child(void)
  	/* Demote the private keys to public keys. */
  	demote_sensitive_data();
@@ -109,13 +109,12 @@ diff -up openssh-7.4p1/sshd.c.privsep-selinux openssh-7.4p1/sshd.c
  	/* Demote the child */
  	if (privsep_chroot) {
  		/* Change our root directory */
-@@ -633,6 +637,9 @@ privsep_postauth(Authctxt *authctxt)
- {
- #ifdef DISABLE_FD_PASSING
- 	if (1) {
-+#elif defined(WITH_SELINUX)
-+	if (0) {
-+		/* even root user can be confined by SELinux */
- #else
- 	if (authctxt->pw->pw_uid == 0) {
+@@ -403,7 +403,7 @@ privsep_postauth(struct ssh *ssh, Authct
+ 	 * fd passing, as AFAIK PTY allocation on this platform doesn't require
+ 	 * special privileges to begin with.
+ 	 */
+-#if defined(DISABLE_FD_PASSING) && !defined(HAVE_CYGWIN)
++#if defined(DISABLE_FD_PASSING) && !defined(HAVE_CYGWIN) && !defined(WITH_SELINUX)
+ 	skip_privdrop = 1;
  #endif
+ 
diff --git a/openssh-6.7p1-coverity.patch b/openssh-6.7p1-coverity.patch
index 01a061b..7cbdb2a 100644
--- a/openssh-6.7p1-coverity.patch
+++ b/openssh-6.7p1-coverity.patch
@@ -221,9 +221,9 @@ diff -up openssh-7.4p1/ssh-agent.c.coverity openssh-7.4p1/ssh-agent.c
  			return NULL;
  		}
  		/* validate also provider from URI */
-diff -up openssh-7.4p1/sshd.c.coverity openssh-7.4p1/sshd.c
---- openssh-7.4p1/sshd.c.coverity	2016-12-23 16:40:26.897788690 +0100
-+++ openssh-7.4p1/sshd.c	2016-12-23 16:40:26.904788692 +0100
+diff -up openssh-7.4p1/sshd-session.c.coverity openssh-7.4p1/sshd-session.c
+--- openssh-7.4p1/sshd-session.c.coverity	2016-12-23 16:40:26.897788690 +0100
++++ openssh-7.4p1/sshd-session.c	2016-12-23 16:40:26.904788692 +0100
 @@ -691,8 +691,10 @@ privsep_preauth(Authctxt *authctxt)
  
  		privsep_preauth_child(ssh);
diff --git a/openssh-7.1p2-audit-race-condition.patch b/openssh-7.1p2-audit-race-condition.patch
index b5895f7..1d2bf3b 100644
--- a/openssh-7.1p2-audit-race-condition.patch
+++ b/openssh-7.1p2-audit-race-condition.patch
@@ -109,7 +109,7 @@ diff -up openssh-7.4p1/session.c.audit-race openssh-7.4p1/session.c
 @@ -717,6 +728,8 @@ do_exec(Session *s, const char *command)
  	}
  	if (s->command != NULL && s->ptyfd == -1)
- 		s->command_handle = PRIVSEP(audit_run_command(ssh, s->command));
+ 		s->command_handle = mm_audit_run_command(ssh, s->command);
 +	if (pipe(paudit) < 0)
 +		fatal("pipe: %s", strerror(errno));
  #endif
diff --git a/openssh-7.3p1-x11-max-displays.patch b/openssh-7.3p1-x11-max-displays.patch
index 2b702d4..e28c62e 100644
--- a/openssh-7.3p1-x11-max-displays.patch
+++ b/openssh-7.3p1-x11-max-displays.patch
@@ -2,7 +2,7 @@ diff -up openssh-7.4p1/channels.c.x11max openssh-7.4p1/channels.c
 --- openssh-7.4p1/channels.c.x11max	2016-12-23 15:46:32.071506625 +0100
 +++ openssh-7.4p1/channels.c	2016-12-23 15:46:32.139506636 +0100
 @@ -152,8 +152,8 @@ static int all_opens_permitted = 0;
- #define FWD_PERMIT_ANY_HOST	"*"
+ #define	NUM_SOCKS	10
  
  /* -- X11 forwarding */
 -/* Maximum number of fake X11 displays to try. */
diff --git a/openssh-7.6p1-audit.patch b/openssh-7.6p1-audit.patch
index cec5b23..8d06a6d 100644
--- a/openssh-7.6p1-audit.patch
+++ b/openssh-7.6p1-audit.patch
@@ -733,7 +733,7 @@ diff -up openssh-8.6p1/auth2.c.audit openssh-8.6p1/auth2.c
  			/* Invalid user, fake password information */
  			authctxt->pw = fakepw();
 -#ifdef SSH_AUDIT_EVENTS
--			PRIVSEP(audit_event(ssh, SSH_INVALID_USER));
+-			mm_audit_event(ssh, SSH_INVALID_USER);
 -#endif
  		}
  #ifdef USE_PAM
@@ -743,11 +743,11 @@ diff -up openssh-8.6p1/auth2-hostbased.c.audit openssh-8.6p1/auth2-hostbased.c
 +++ openssh-8.6p1/auth2-hostbased.c	2021-04-19 16:47:35.754062114 +0200
 @@ -158,7 +158,7 @@ userauth_hostbased(struct ssh *ssh)
  	authenticated = 0;
- 	if (PRIVSEP(hostbased_key_allowed(ssh, authctxt->pw, cuser,
- 	    chost, key)) &&
--	    PRIVSEP(sshkey_verify(key, sig, slen,
-+	    PRIVSEP(hostbased_key_verify(ssh, key, sig, slen,
- 	    sshbuf_ptr(b), sshbuf_len(b), pkalg, ssh->compat, NULL)) == 0)
+ 	if (mm_hostbased_key_allowed(ssh, authctxt->pw, cuser,
+ 	    chost, key) &&
+-	    mm_sshkey_verify(key, sig, slen,
++	    mm_hostbased_key_verify(ssh, key, sig, slen,
+ 	    sshbuf_ptr(b), sshbuf_len(b), pkalg, ssh->compat, NULL) == 0)
  		authenticated = 1;
  
 @@ -175,6 +175,20 @@ done:
@@ -777,12 +777,12 @@ diff -up openssh-8.6p1/auth2-pubkey.c.audit openssh-8.6p1/auth2-pubkey.c
 @@ -213,7 +213,7 @@ userauth_pubkey(struct ssh *ssh)
  		/* test for correct signature */
  		authenticated = 0;
- 		if (PRIVSEP(user_key_allowed(ssh, pw, key, 1, &authopts)) &&
--		    PRIVSEP(sshkey_verify(key, sig, slen,
-+		    PRIVSEP(user_key_verify(ssh, key, sig, slen,
+ 		if (mm_user_key_allowed(ssh, pw, key, 1, &authopts) &&
+-		    mm_sshkey_verify(key, sig, slen,
++		    mm_user_key_verify(ssh, key, sig, slen,
  		    sshbuf_ptr(b), sshbuf_len(b),
  		    (ssh->compat & SSH_BUG_SIGTYPE) == 0 ? pkalg : NULL,
- 		    ssh->compat, &sig_details)) == 0) {
+ 		    ssh->compat, &sig_details) == 0) {
 @@ -305,6 +305,20 @@ done:
  	return authenticated;
  }
@@ -828,7 +828,7 @@ diff -up openssh-8.6p1/auth.h.audit openssh-8.6p1/auth.h
 +    const u_char *, size_t, const char *, u_int, struct sshkey_sig_details **);
  
  /* Key / cert options linkage to auth layer */
- const struct sshauthopt *auth_options(struct ssh *);
+ int	 auth_activate_options(struct ssh *, struct sshauthopt *);
 @@ -239,6 +241,8 @@ struct passwd * getpwnamallow(struct ssh
      char *, const char *, const char *, const char *, struct sshauthopt **);
  int	 auth_check_authkeys_file(struct passwd *, FILE *, char *,
@@ -915,8 +915,8 @@ diff -up openssh-8.6p1/kex.c.audit openssh-8.6p1/kex.c
  #include "xmalloc.h"
 +#include "audit.h"
  
- #ifdef GSSAPI
- #include "ssh-gss.h"
+ /* prototype */
+ static int kex_choose_conf(struct ssh *, uint32_t seq);
 @@ -816,12 +817,16 @@ kex_start_rekex(struct ssh *ssh)
  }
  
@@ -1536,9 +1536,9 @@ diff -up openssh-8.6p1/monitor_wrap.c.audit openssh-8.6p1/monitor_wrap.c
  }
  #endif /* SSH_AUDIT_EVENTS */
 @@ -1095,3 +1137,83 @@ mm_ssh_gssapi_update_creds(ssh_gssapi_cc
+ 	return &ci;
  }
  
- #endif /* GSSAPI */
 +#ifdef SSH_AUDIT_EVENTS
 +void
 +mm_audit_unsupported_body(struct ssh *ssh, int what)
@@ -1632,7 +1632,7 @@ diff -up openssh-8.6p1/monitor_wrap.h.audit openssh-8.6p1/monitor_wrap.h
 +int mm_user_key_verify(struct ssh*, const struct sshkey *, const u_char *, size_t,
      const u_char *, size_t, const char *, u_int, struct sshkey_sig_details **);
  
- #ifdef GSSAPI
+ void mm_decode_activate_server_options(struct ssh *ssh, struct sshbuf *m);
 @@ -86,7 +88,12 @@ void mm_sshpam_free_ctx(void *);
  #ifdef SSH_AUDIT_EVENTS
  #include "audit.h"
@@ -1843,18 +1843,18 @@ diff -up openssh-8.6p1/session.c.audit openssh-8.6p1/session.c
 +	if (s->command != NULL || s->command_handle != -1)
 +		fatal("do_exec: command already set");
  	if (command != NULL)
--		PRIVSEP(audit_run_command(command));
+-		mm_audit_run_command(command);
 +		s->command = xstrdup(command);
  	else if (s->ttyfd == -1) {
  		char *shell = s->pw->pw_shell;
  
  		if (shell[0] == '\0')	/* empty shell means /bin/sh */
  			shell =_PATH_BSHELL;
--		PRIVSEP(audit_run_command(shell));
+-		mm_audit_run_command(shell);
 +		s->command = xstrdup(shell);
  	}
 +	if (s->command != NULL && s->ptyfd == -1)
-+		s->command_handle = PRIVSEP(audit_run_command(ssh, s->command));
++		s->command_handle = mm_audit_run_command(ssh, s->command);
  #endif
  	if (s->ttyfd != -1)
  		ret = do_exec_pty(ssh, s, command);
@@ -1981,7 +1981,7 @@ diff -up openssh-8.6p1/session.c.audit openssh-8.6p1/session.c
 @@ -2734,7 +2804,7 @@ do_cleanup(struct ssh *ssh, Authctxt *au
  	 * or if running in monitor.
  	 */
- 	if (!use_privsep || mm_is_monitor())
+ 	if (mm_is_monitor())
 -		session_destroy_all(ssh, session_pty_cleanup2);
 +		session_destroy_all(ssh, do_cleanup_one_session);
  }
@@ -2020,25 +2020,6 @@ diff -up openssh-8.6p1/session.h.audit openssh-8.6p1/session.h
 diff -up openssh-8.6p1/sshd.c.audit openssh-8.6p1/sshd.c
 --- openssh-8.6p1/sshd.c.audit	2021-04-19 16:47:35.727061907 +0200
 +++ openssh-8.6p1/sshd.c	2021-04-19 16:47:35.759062152 +0200
-@@ -122,6 +122,7 @@
- #include "ssh-gss.h"
- #endif
- #include "monitor_wrap.h"
-+#include "audit.h"
- #include "ssh-sandbox.h"
- #include "auth-options.h"
- #include "version.h"
-@@ -260,8 +261,8 @@ struct sshbuf *loginmsg;
- struct passwd *privsep_pw = NULL;
- 
- /* Prototypes for various functions defined later in this file. */
--void destroy_sensitive_data(void);
--void demote_sensitive_data(void);
-+void destroy_sensitive_data(struct ssh *, int);
-+void demote_sensitive_data(struct ssh *);
- static void do_ssh2_kex(struct ssh *);
- 
- static char *listener_proctitle;
 @@ -279,6 +280,15 @@ close_listen_socks(void)
  	num_listen_socks = 0;
  }
@@ -2052,11 +2033,59 @@ diff -up openssh-8.6p1/sshd.c.audit openssh-8.6p1/sshd.c
 +	return num_listen_socks > 0;
 +}
 +
+ /* Allocate and initialise the children array */
  static void
- close_startup_pipes(void)
+ child_alloc(void)
+@@ -1143,7 +1198,7 @@ server_listen(void)
+  * from this function are in a forked subprocess.
+  */
+ static void
+-server_accept_loop(int *sock_in, int *sock_out, int *newsock, int *config_s,
++server_accept_loop(struct ssh *ssh, int *sock_in, int *sock_out, int *newsock, int *config_s,
+     int log_stderr)
  {
+	struct pollfd *pfd = NULL;
+@@ -1204,6 +1259,7 @@ server_accept_loop(int *sock_in, int *so
+ 		if (received_sigterm) {
+ 			logit("Received signal %d; terminating.",
+ 			    (int) received_sigterm);
++			destroy_sensitive_data(ssh, 0);
+ 			close_listen_socks();
+ 			if (options.pid_file != NULL)
+ 				unlink(options.pid_file);
+@@ -2189,7 +2189,7 @@
+ 		}
+ 
+ 		/* Accept a connection and return in a forked child */
+-		server_accept_loop(&sock_in, &sock_out,
++		server_accept_loop(ssh, &sock_in, &sock_out,
+ 		    &newsock, config_s, log_stderr);
+ 	}
+ 
+diff -up openssh-8.6p1/sshd-session.c.audit openssh-8.6p1/sshd-session.c
+--- openssh-8.6p1/sshd-session.c.audit	2021-04-19 16:47:35.727061907 +0200
++++ openssh-8.6p1/sshd-session.c	2021-04-19 16:47:35.759062152 +0200
+@@ -122,6 +122,7 @@
+ #include "ssh-gss.h"
+ #endif
+ #include "monitor_wrap.h"
++#include "audit.h"
+ #include "ssh-sandbox.h"
+ #include "auth-options.h"
+ #include "version.h"
+@@ -260,8 +261,8 @@ struct sshbuf *loginmsg;
+ struct sshbuf *loginmsg;
+ 
+ /* Prototypes for various functions defined later in this file. */
+-void destroy_sensitive_data(void);
+-void demote_sensitive_data(void);
++void destroy_sensitive_data(struct ssh *, int);
++void demote_sensitive_data(struct ssh *);
+ static void do_ssh2_kex(struct ssh *);
+ 
+ /*
 @@ -377,18 +387,45 @@ grace_alarm_handler(int sig)
-	    ssh_remote_port(the_active_state));
+ 	_exit(EXIT_LOGIN_GRACE);
  }
 
 -/* Destroy the host and server keys.  They will no longer be needed. */
@@ -2163,9 +2192,9 @@ diff -up openssh-8.6p1/sshd.c.audit openssh-8.6p1/sshd.c
  #ifdef WITH_SELINUX
  	sshd_selinux_change_privsep_preauth_context();
 @@ -492,7 +547,7 @@ privsep_preauth(struct ssh *ssh)
+ 	pmonitor->m_pkex = &ssh->kex;
  
- 	if (use_privsep == PRIVSEP_ON)
- 		box = ssh_sandbox_init(pmonitor);
+ 	box = ssh_sandbox_init(pmonitor);
 -	pid = fork();
 +	pmonitor->m_pid = pid = fork();
  	if (pid == -1) {
@@ -2189,32 +2218,6 @@ diff -up openssh-8.6p1/sshd.c.audit openssh-8.6p1/sshd.c
  
  	reseed_prngs();
  
-@@ -1143,7 +1198,7 @@ server_listen(void)
-  * from this function are in a forked subprocess.
-  */
- static void
--server_accept_loop(int *sock_in, int *sock_out, int *newsock, int *config_s)
-+server_accept_loop(struct ssh *ssh, int *sock_in, int *sock_out, int *newsock, int *config_s)
- {
-	struct pollfd *pfd = NULL;
-	int i, j, ret, npfd;
-@@ -1204,6 +1259,7 @@ server_accept_loop(int *sock_in, int *so
- 		if (received_sigterm) {
- 			logit("Received signal %d; terminating.",
- 			    (int) received_sigterm);
-+			destroy_sensitive_data(ssh, 0);
- 			close_listen_socks();
- 			if (options.pid_file != NULL)
- 				unlink(options.pid_file);
-@@ -2189,7 +2189,7 @@
- 		}
- 
- 		/* Accept a connection and return in a forked child */
--		server_accept_loop(&sock_in, &sock_out,
-+		server_accept_loop(ssh, &sock_in, &sock_out,
- 		    &newsock, config_s);
- 	}
- 
 @@ -2333,6 +2389,9 @@ main(int ac, char **av)
  	do_authenticated(ssh, authctxt);
  
@@ -2238,24 +2241,17 @@ diff -up openssh-8.6p1/sshd.c.audit openssh-8.6p1/sshd.c
 +	if (in_cleanup)
 +		_exit(i);
 +	in_cleanup = 1;
+ 	extern int auth_attempted; /* monitor.c */
+ 
  	if (the_active_state != NULL && the_authctxt != NULL) {
- 		do_cleanup(the_active_state, the_authctxt);
- 		if (use_privsep && privsep_is_preauth &&
-@@ -2525,9 +2593,16 @@ cleanup_exit(int i)
- 			}
- 		}
- 	}
-+	is_privsep_child = use_privsep && pmonitor != NULL && pmonitor->m_pid == 0;
-+	if (sensitive_data.host_keys != NULL && the_active_state != NULL)
-+		destroy_sensitive_data(the_active_state, is_privsep_child);
-+	if (the_active_state != NULL)
-+		packet_destroy_all(the_active_state, 1, is_privsep_child);
+@@ -2525,7 +2593,9 @@ cleanup_exit(int i)
+		_exit(EXIT_AUTH_ATTEMPTED);
  #ifdef SSH_AUDIT_EVENTS
  	/* done after do_cleanup so it can cancel the PAM auth 'thread' */
--	if (the_active_state != NULL && (!use_privsep || mm_is_monitor()))
+-	if (the_active_state != NULL && mm_is_monitor())
 +	if (the_active_state != NULL &&
 +	    (the_authctxt == NULL || !the_authctxt->authenticated) &&
-+	    (!use_privsep || mm_is_monitor()))
++	    mm_is_monitor())
  		audit_event(the_active_state, SSH_CONNECTION_ABANDON);
  #endif
  	_exit(i);
diff --git a/openssh-7.6p1-cleanup-selinux.patch b/openssh-7.6p1-cleanup-selinux.patch
index f7cd50f..5b8aaca 100644
--- a/openssh-7.6p1-cleanup-selinux.patch
+++ b/openssh-7.6p1-cleanup-selinux.patch
@@ -8,9 +8,9 @@ diff -up openssh/auth2-pubkey.c.refactor openssh/auth2-pubkey.c
 +extern int inetd_flag;
 +extern int rexeced_flag;
 +extern Authctxt *the_authctxt;
+ extern struct authmethod_cfg methodcfg_pubkey;
  
  static char *
- format_key(const struct sshkey *key)
 @@ -511,7 +514,8 @@ match_principals_command(struct ssh *ssh
  	if ((pid = subprocess("AuthorizedPrincipalsCommand", command,
  	    ac, av, &f,
@@ -217,15 +217,15 @@ diff -up openssh/platform.c.refactor openssh/platform.c
 --- openssh/platform.c.refactor	2019-04-04 13:19:12.204821389 +0200
 +++ openssh/platform.c	2019-04-04 13:19:12.277822088 +0200
 @@ -32,6 +32,9 @@
+ #include "openbsd-compat/openbsd-compat.h"
  
- extern int use_privsep;
  extern ServerOptions options;
 +extern int inetd_flag;
 +extern int rexeced_flag;
 +extern Authctxt *the_authctxt;
  
- void
- platform_pre_listen(void)
+ /* return 1 if we are running with privilege to swap UIDs, 0 otherwise */
+ int
 @@ -183,7 +186,9 @@ platform_setusercontext_post_groups(stru
  	}
  #endif /* HAVE_SETPCRED */
@@ -237,27 +237,18 @@ diff -up openssh/platform.c.refactor openssh/platform.c
  #endif
  }
  
-diff -up openssh/sshd.c.refactor openssh/sshd.c
---- openssh/sshd.c.refactor	2019-04-04 13:19:12.275822068 +0200
-+++ openssh/sshd.c	2019-04-04 13:19:51.270195262 +0200
+diff -up openssh/sshd-session.c.refactor openssh/sshd-session.c
+--- openssh/sshd-session.c.refactor	2019-04-04 13:19:12.275822068 +0200
++++ openssh/sshd-session.c	2019-04-04 13:19:51.270195262 +0200
 @@ -158,7 +158,7 @@ int debug_flag = 0;
- static int test_flag = 0;
+ int debug_flag = 0;
  
  /* Flag indicating that the daemon is being started from inetd. */
 -static int inetd_flag = 0;
 +int inetd_flag = 0;
  
- /* Flag indicating that sshd should not detach and become a daemon. */
- static int no_daemon_flag = 0;
-@@ -171,7 +171,7 @@ static char **saved_argv;
- static int saved_argc;
- 
- /* re-exec */
--static int rexeced_flag = 0;
-+int rexeced_flag = 0;
- static int rexec_flag = 1;
- static int rexec_argc = 0;
- static char **rexec_argv;
+ /* debug goes to stderr unless inetd_flag is set */
+ static int log_stderr = 0;
 @@ -2192,7 +2192,9 @@ main(int ac, char **av)
  	}
  #endif
diff --git a/openssh-7.7p1-fips.patch b/openssh-7.7p1-fips.patch
index b1007b2..80a68d9 100644
--- a/openssh-7.7p1-fips.patch
+++ b/openssh-7.7p1-fips.patch
@@ -72,17 +72,17 @@ diff -up openssh-8.6p1/dh.h.fips openssh-8.6p1/dh.h
  
  u_int	 dh_estimate(int);
  void	 dh_set_moduli_file(const char *);
-diff -up openssh-8.6p1/kex.c.fips openssh-8.6p1/kex.c
---- openssh-8.6p1/kex.c.fips	2021-05-06 12:08:36.489926807 +0200
-+++ openssh-8.6p1/kex.c	2021-05-06 12:08:36.498926877 +0200
+diff -up openssh-8.6p1/kex-names.c.fips openssh-8.6p1/kex-names.c
+--- openssh-8.6p1/kex-names.c.fips	2021-05-06 12:08:36.489926807 +0200
++++ openssh-8.6p1/kex-names.c	2021-05-06 12:08:36.498926877 +0200
 @@ -39,6 +39,7 @@
  
  #ifdef WITH_OPENSSL
  #include <openssl/crypto.h>
 +#include <openssl/fips.h>
- #include <openssl/dh.h>
- # ifdef HAVE_EVP_KDF_CTX_NEW
- # include <openssl/kdf.h>
+ #include <openssl/evp.h>
+ #endif
+ 
 @@ -203,7 +203,10 @@ kex_names_valid(const char *names)
  	for ((p = strsep(&cp, ",")); p && *p != '\0';
  	    (p = strsep(&cp, ","))) {
@@ -361,8 +361,8 @@ diff -up openssh-8.6p1/sshd.c.fips openssh-8.6p1/sshd.c
  #include <stdio.h>
  #include <stdlib.h>
 @@ -77,6 +78,7 @@
- #include <openssl/dh.h>
- #include <openssl/bn.h>
+ #ifdef WITH_OPENSSL
+ #include <openssl/evp.h>
  #include <openssl/rand.h>
 +#include <openssl/fips.h>
  #include "openbsd-compat/openssl-compat.h"
@@ -393,7 +393,18 @@ diff -up openssh-8.6p1/sshd.c.fips openssh-8.6p1/sshd.c
  	/*
  	 * Chdir to the root directory so that the current disk can be
  	 * unmounted if desired.
-@@ -2494,10 +2501,14 @@ do_ssh2_kex(struct ssh *ssh)
+diff -up openssh-8.6p1/sshd-session.c.fips openssh-8.6p1/sshd-session.c
+--- a/sshd-session.c.fips	2021-05-06 12:08:36.493926838 +0200
++++ b/sshd-session.c	2021-05-06 12:13:56.501492639 +0200
+@@ -78,6 +79,7 @@
+ #include <openssl/bn.h>
+ #include <openssl/evp.h>
+ #include <openssl/rand.h>
++#include <openssl/fips.h>
+ #include "openbsd-compat/openssl-compat.h"
+ #endif
+ 
+@@ -2506,10 +2513,14 @@ do_ssh2_kex(struct ssh *ssh)
  	if (strlen(myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS]) == 0)
  		orig = NULL;
  
diff --git a/openssh-7.7p1-gssapi-new-unique.patch b/openssh-7.7p1-gssapi-new-unique.patch
index 544932b..1f70be2 100644
--- a/openssh-7.7p1-gssapi-new-unique.patch
+++ b/openssh-7.7p1-gssapi-new-unique.patch
@@ -579,9 +579,9 @@ diff -up openssh-8.6p1/session.c.ccache_name openssh-8.6p1/session.c
  		child_set_env(&env, &envsize, "KRB5CCNAME",
  		    s->authctxt->krb5_ccname);
  #endif
-diff -up openssh-8.6p1/sshd.c.ccache_name openssh-8.6p1/sshd.c
---- openssh-8.6p1/sshd.c.ccache_name	2021-04-19 14:05:10.849744540 +0200
-+++ openssh-8.6p1/sshd.c	2021-04-19 14:05:10.855744584 +0200
+diff -up openssh-8.6p1/sshd-session.c.ccache_name openssh-8.6p1/sshd-session.c
+--- openssh-8.6p1/sshd-session.c.ccache_name	2021-04-19 14:05:10.849744540 +0200
++++ openssh-8.6p1/sshd-session.c	2021-04-19 14:05:10.855744584 +0200
 @@ -2284,7 +2284,7 @@ main(int ac, char **av)
  #ifdef GSSAPI
  	if (options.gss_authentication) {
@@ -607,8 +607,8 @@ diff -up openssh-8.6p1/sshd_config.5.ccache_name openssh-8.6p1/sshd_config.5
 +can lead to overwriting previous tickets by subseqent connections to the same
 +user account.
  .It Cm KexAlgorithms
- Specifies the available KEX (Key Exchange) algorithms.
- Multiple algorithms must be comma-separated.
+ Specifies the permitted KEX (Key Exchange) algorithms that the server will
+ offer to clients.
 diff -up openssh-8.6p1/ssh-gss.h.ccache_name openssh-8.6p1/ssh-gss.h
 --- openssh-8.6p1/ssh-gss.h.ccache_name	2021-04-19 14:05:10.852744562 +0200
 +++ openssh-8.6p1/ssh-gss.h	2021-04-19 14:05:10.855744584 +0200
diff --git a/openssh-7.8p1-UsePAM-warning.patch b/openssh-7.8p1-UsePAM-warning.patch
index a94419e..f8d7042 100644
--- a/openssh-7.8p1-UsePAM-warning.patch
+++ b/openssh-7.8p1-UsePAM-warning.patch
@@ -1,13 +1,13 @@
 diff -up openssh-8.6p1/sshd.c.log-usepam-no openssh-8.6p1/sshd.c
---- openssh-8.6p1/sshd.c.log-usepam-no	2021-04-19 14:00:45.099735129 +0200
-+++ openssh-8.6p1/sshd.c	2021-04-19 14:03:21.140920974 +0200
+--- openssh-8.6p1/sshd-session.c.log-usepam-no	2021-04-19 14:00:45.099735129 +0200
++++ openssh-8.6p1/sshd-session.c	2021-04-19 14:03:21.140920974 +0200
 @@ -1749,6 +1749,10 @@ main(int ac, char **av)
- 	parse_server_config(&options, rexeced_flag ? "rexec" : config_file_name,
- 	    cfg, &includes, NULL, rexeced_flag);
+ 			    "enabled authentication methods");
+ 	}
  
-+	/* 'UsePAM no' is not supported in Fedora */
++	/* 'UsePAM no' is not supported in our builds */
 +	if (! options.use_pam)
-+		logit("WARNING: 'UsePAM no' is not supported in Fedora and may cause several problems.");
++		logit("WARNING: 'UsePAM no' is not supported in this build and may cause several problems.");
 +
  #ifdef WITH_OPENSSL
  	if (options.moduli_file != NULL)
@@ -19,7 +19,7 @@ diff -up openssh-8.6p1/sshd_config.log-usepam-no openssh-8.6p1/sshd_config
  # If you just want the PAM account and session checks to run without
  # PAM authentication, then enable this but set PasswordAuthentication
  # and KbdInteractiveAuthentication to 'no'.
-+# WARNING: 'UsePAM no' is not supported in Fedora and may cause several
++# WARNING: 'UsePAM no' is not supported in this build and may cause several
 +# problems.
  #UsePAM no
  
diff --git a/openssh-7.8p1-role-mls.patch b/openssh-7.8p1-role-mls.patch
index 347766d..e2a3fa2 100644
--- a/openssh-7.8p1-role-mls.patch
+++ b/openssh-7.8p1-role-mls.patch
@@ -23,20 +23,17 @@ diff -up openssh/auth2.c.role-mls openssh/auth2.c
  	if ((style = strchr(user, ':')) != NULL)
  		*style++ = 0;
  
-@@ -314,8 +314,15 @@ input_userauth_request(int type, u_int32
- 		    use_privsep ? " [net]" : "");
+@@ -314,7 +314,13 @@ input_userauth_request(int type, u_int32
+ 		setproctitle("%s [net]", authctxt->valid ? user : "unknown");
  		authctxt->service = xstrdup(service);
  		authctxt->style = style ? xstrdup(style) : NULL;
--		if (use_privsep)
 +#ifdef WITH_SELINUX
 +		authctxt->role = role ? xstrdup(role) : NULL;
 +#endif
-+		if (use_privsep) {
- 			mm_inform_authserv(service, style);
+ 		mm_inform_authserv(service, style);
 +#ifdef WITH_SELINUX
 +         	mm_inform_authrole(role);
 +#endif
-+        }
  		userauth_banner(ssh);
  		if ((r = kex_server_update_ext_info(ssh)) != 0)
  			fatal_fr(r, "kex_server_update_ext_info failed");
@@ -50,7 +47,7 @@ diff -up openssh/auth2-gss.c.role-mls openssh/auth2-gss.c
 +	char *micuser;
  	struct sshbuf *b;
  	gss_buffer_desc mic, gssbuf;
- 	const char *displayname;
+ 	u_char *p;
 @@ -298,7 +299,13 @@ input_gssapi_mic(int type, u_int32_t ple
  		fatal_f("sshbuf_new failed");
  	mic.value = p;
@@ -74,7 +71,7 @@ diff -up openssh/auth2-gss.c.role-mls openssh/auth2-gss.c
 +		free(micuser);
  	free(mic.value);
  
- 	if ((!use_privsep || mm_is_monitor()) &&
+ 	authctxt->postponed = 0;
 diff -up openssh/auth2-hostbased.c.role-mls openssh/auth2-hostbased.c
 --- openssh/auth2-hostbased.c.role-mls	2018-08-20 07:57:29.000000000 +0200
 +++ openssh/auth2-hostbased.c	2018-08-22 11:14:56.816430924 +0200
@@ -147,7 +144,7 @@ diff -up openssh/auth-pam.h.role-mls openssh/auth-pam.h
 +++ openssh/auth-pam.h	2018-08-22 11:14:56.817430932 +0200
 @@ -33,7 +33,7 @@ u_int do_pam_account(void);
  void do_pam_session(struct ssh *);
- void do_pam_setcred(int );
+ void do_pam_setcred(void);
  void do_pam_chauthtok(void);
 -int do_pam_putenv(char *, char *);
 +int do_pam_putenv(char *, const char *);
@@ -853,8 +850,8 @@ diff -up openssh/platform.c.role-mls openssh/platform.c
  }
  
 diff -up openssh/sshd.c.role-mls openssh/sshd.c
---- openssh/sshd.c.role-mls	2018-08-20 07:57:29.000000000 +0200
-+++ openssh/sshd.c	2018-08-22 11:14:56.820430957 +0200
+--- openssh/sshd-session.c.role-mls	2018-08-20 07:57:29.000000000 +0200
++++ openssh/sshd-session.c	2018-08-22 11:14:56.820430957 +0200
 @@ -2186,6 +2186,9 @@ main(int ac, char **av)
  		restore_uid();
  	}
@@ -864,4 +861,4 @@ diff -up openssh/sshd.c.role-mls openssh/sshd.c
 +#endif
  #ifdef USE_PAM
  	if (options.use_pam) {
- 		do_pam_setcred(1);
+ 		do_pam_setcred();
diff --git a/openssh-8.0p1-crypto-policies.patch b/openssh-8.0p1-crypto-policies.patch
index 86c08db..fd1e59d 100644
--- a/openssh-8.0p1-crypto-policies.patch
+++ b/openssh-8.0p1-crypto-policies.patch
@@ -155,7 +155,7 @@ diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x
  .It Cm HostKeyAlias
  Specifies an alias that should be used instead of the
  real host name when looking up or saving the host key
-@@ -1232,30 +1229,25 @@
+@@ -1330,6 +1330,11 @@ it may be zero or more of:
  and
  .Cm pam .
  .It Cm KexAlgorithms
@@ -164,8 +164,11 @@ diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x
 +Information about defaults, how to modify the defaults and how to customize existing policies with sub-policies are present in manual page
 +.Xr update-crypto-policies 8 .
 +.Pp
- Specifies the available KEX (Key Exchange) algorithms.
- Multiple algorithms must be comma-separated.
+ Specifies the permitted KEX (Key Exchange) algorithms that will be used and
+ their preference order.
+ The selected algorithm will the the first algorithm in this list that
+@@ -1338,28 +1343,17 @@ Multiple algorithms must be comma-separa
+ .Pp
  If the specified list begins with a
  .Sq +
 -character, then the specified algorithms will be appended to the default set
@@ -181,6 +184,7 @@ diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x
  .Sq ^
  character, then the specified algorithms will be placed at the head of the
 -default set.
+-.Pp
 -The default is:
 -.Bd -literal -offset indent
 -sntrup761x25519-sha512@openssh.com,
@@ -191,10 +195,11 @@ diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x
 -diffie-hellman-group18-sha512,
 -diffie-hellman-group14-sha256
 -.Ed
-+built-in openssh default set.
  .Pp
- The list of available key exchange algorithms may also be obtained using
++built-in openssh default set.
+ The list of supported key exchange algorithms may also be obtained using
  .Qq ssh -Q kex .
+ .It Cm KnownHostsCommand
 @@ -1365,37 +1357,33 @@
  file.
  This option is intended for debugging and no overrides are enabled by default.
@@ -479,7 +484,7 @@ diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x
  The list of available signature algorithms may also be obtained using
  .Qq ssh -Q HostKeyAlgorithms .
  .It Cm IgnoreRhosts
-@@ -1044,20 +1017,25 @@
+@@ -1025,6 +1025,11 @@ Specifies whether to look at .k5login fi
  The default is
  .Cm yes .
  .It Cm KexAlgorithms
@@ -488,9 +493,12 @@ diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x
 +Information about defaults, how to modify the defaults and how to customize existing policies with sub-policies are present in manual page
 +.Xr update-crypto-policies 8 .
 +.Pp
- Specifies the available KEX (Key Exchange) algorithms.
- Multiple algorithms must be comma-separated.
- Alternately if the specified list begins with a
+ Specifies the permitted KEX (Key Exchange) algorithms that the server will
+ offer to clients.
+ The ordering of this list is not important, as the client specifies the
+@@ -1033,16 +1038,16 @@ Multiple algorithms must be comma-separa
+ .Pp
+ If the specified list begins with a
  .Sq +
 -character, then the specified algorithms will be appended to the default set
 -instead of replacing them.
@@ -506,10 +514,10 @@ diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x
  character, then the specified algorithms will be placed at the head of the
 -default set.
 +built-in openssh default set.
+ .Pp
  The supported algorithms are:
  .Pp
- .Bl -item -compact -offset indent
-@@ -1089,16 +1067,6 @@
+@@ -1075,16 +1080,6 @@ ecdh-sha2-nistp521
  sntrup761x25519-sha512@openssh.com
  .El
  .Pp
@@ -523,7 +531,7 @@ diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x
 -diffie-hellman-group14-sha256
 -.Ed
 -.Pp
- The list of available key exchange algorithms may also be obtained using
+ The list of supported key exchange algorithms may also be obtained using
  .Qq ssh -Q KexAlgorithms .
  .It Cm ListenAddress
 @@ -1184,21 +1152,26 @@
diff --git a/openssh-8.0p1-gssapi-keyex.patch b/openssh-8.0p1-gssapi-keyex.patch
index 3e5ccec..821ea49 100644
--- a/openssh-8.0p1-gssapi-keyex.patch
+++ b/openssh-8.0p1-gssapi-keyex.patch
@@ -3,7 +3,7 @@ index e7549470..b68c1710 100644
 --- a/Makefile.in
 +++ b/Makefile.in
 @@ -109,6 +109,7 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \
- 	kex.o kexdh.o kexgex.o kexecdh.o kexc25519.o \
+ 	kex.o kex-names.o kexdh.o kexgex.o kexecdh.o kexc25519.o \
  	kexgexc.o kexgexs.o \
  	kexsntrup761x25519.o sntrup761.o kexgen.o \
 +	kexgssc.o \
@@ -11,14 +11,14 @@ index e7549470..b68c1710 100644
  	sshbuf-io.o
  
 @@ -125,7 +126,7 @@ SSHDOBJS=sshd.o auth-rhosts.o auth-passwd.o \
+ 	auth2-chall.o groupaccess.o \
  	auth-bsdauth.o auth2-hostbased.o auth2-kbdint.o \
  	auth2-none.o auth2-passwd.o auth2-pubkey.o auth2-pubkeyfile.o \
- 	monitor.o monitor_wrap.o auth-krb5.o \
--	auth2-gss.o gss-serv.o gss-serv-krb5.o \
-+	auth2-gss.o gss-serv.o gss-serv-krb5.o kexgsss.o \
+-	monitor.o monitor_wrap.o auth-krb5.o \
++	monitor.o monitor_wrap.o auth-krb5.o kexgsss.o \
+ 	auth2-gss.o gss-serv.o gss-serv-krb5.o \
  	loginrec.o auth-pam.o auth-shadow.o auth-sia.o \
- 	srclimit.o sftp-server.o sftp-common.o \
- 	sandbox-null.o sandbox-rlimit.o sandbox-systrace.o sandbox-darwin.o \
+ 	sftp-server.o sftp-common.o \
 @@ -523,7 +523,7 @@ regress-prep:
  	    ln -s `cd $(srcdir) && pwd`/regress/Makefile `pwd`/regress/Makefile
  
@@ -41,117 +41,10 @@ diff -up a/auth.c.gsskex b/auth.c
  			return 1;
  		break;
  	case PERMIT_FORCED_ONLY:
-@@ -730,97 +731,6 @@ fakepw(void)
- }
- 
- /*
-- * Returns the remote DNS hostname as a string. The returned string must not
-- * be freed. NB. this will usually trigger a DNS query the first time it is
-- * called.
-- * This function does additional checks on the hostname to mitigate some
-- * attacks on based on conflation of hostnames and IP addresses.
-- */
--
--static char *
--remote_hostname(struct ssh *ssh)
--{
--	struct sockaddr_storage from;
--	socklen_t fromlen;
--	struct addrinfo hints, *ai, *aitop;
--	char name[NI_MAXHOST], ntop2[NI_MAXHOST];
--	const char *ntop = ssh_remote_ipaddr(ssh);
--
--	/* Get IP address of client. */
--	fromlen = sizeof(from);
--	memset(&from, 0, sizeof(from));
--	if (getpeername(ssh_packet_get_connection_in(ssh),
--	    (struct sockaddr *)&from, &fromlen) == -1) {
--		debug("getpeername failed: %.100s", strerror(errno));
--		return xstrdup(ntop);
--	}
--
--	ipv64_normalise_mapped(&from, &fromlen);
--	if (from.ss_family == AF_INET6)
--		fromlen = sizeof(struct sockaddr_in6);
--
--	debug3("Trying to reverse map address %.100s.", ntop);
--	/* Map the IP address to a host name. */
--	if (getnameinfo((struct sockaddr *)&from, fromlen, name, sizeof(name),
--	    NULL, 0, NI_NAMEREQD) != 0) {
--		/* Host name not found.  Use ip address. */
--		return xstrdup(ntop);
--	}
--
--	/*
--	 * if reverse lookup result looks like a numeric hostname,
--	 * someone is trying to trick us by PTR record like following:
--	 *	1.1.1.10.in-addr.arpa.	IN PTR	2.3.4.5
--	 */
--	memset(&hints, 0, sizeof(hints));
--	hints.ai_socktype = SOCK_DGRAM;	/*dummy*/
--	hints.ai_flags = AI_NUMERICHOST;
--	if (getaddrinfo(name, NULL, &hints, &ai) == 0) {
--		logit("Nasty PTR record \"%s\" is set up for %s, ignoring",
--		    name, ntop);
--		freeaddrinfo(ai);
--		return xstrdup(ntop);
--	}
--
--	/* Names are stored in lowercase. */
--	lowercase(name);
--
--	/*
--	 * Map it back to an IP address and check that the given
--	 * address actually is an address of this host.  This is
--	 * necessary because anyone with access to a name server can
--	 * define arbitrary names for an IP address. Mapping from
--	 * name to IP address can be trusted better (but can still be
--	 * fooled if the intruder has access to the name server of
--	 * the domain).
--	 */
--	memset(&hints, 0, sizeof(hints));
--	hints.ai_family = from.ss_family;
--	hints.ai_socktype = SOCK_STREAM;
--	if (getaddrinfo(name, NULL, &hints, &aitop) != 0) {
--		logit("reverse mapping checking getaddrinfo for %.700s "
--		    "[%s] failed.", name, ntop);
--		return xstrdup(ntop);
--	}
--	/* Look for the address from the list of addresses. */
--	for (ai = aitop; ai; ai = ai->ai_next) {
--		if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop2,
--		    sizeof(ntop2), NULL, 0, NI_NUMERICHOST) == 0 &&
--		    (strcmp(ntop, ntop2) == 0))
--				break;
--	}
--	freeaddrinfo(aitop);
--	/* If we reached the end of the list, the address was not there. */
--	if (ai == NULL) {
--		/* Address not found for the host name. */
--		logit("Address %.100s maps to %.600s, but this does not "
--		    "map back to the address.", ntop, name);
--		return xstrdup(ntop);
--	}
--	return xstrdup(name);
--}
--
--/*
-  * Return the canonical name of the host in the other side of the current
-  * connection.  The host name is cached, so it is efficient to call this
-  * several times.
 diff --git a/auth2-gss.c b/auth2-gss.c
 index 9351e042..d6446c0c 100644
 --- a/auth2-gss.c
 +++ b/auth2-gss.c
-@@ -1,7 +1,7 @@
- /* $OpenBSD: auth2-gss.c,v 1.34 2023/03/31 04:22:27 djm Exp $ */
-
- /*
-- * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
-+ * Copyright (c) 2001-2007 Simon Wilkinson. All rights reserved.
-  *
-  * Redistribution and use in source and binary forms, with or without
-  * modification, are permitted provided that the following conditions
 @@ -54,6 +54,48 @@ static int input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh);
  static int input_gssapi_exchange_complete(int type, u_int32_t plen, struct ssh *ssh);
  static int input_gssapi_errtok(int, u_int32_t, struct ssh *);
@@ -201,23 +94,21 @@ index 9351e042..d6446c0c 100644
  /*
   * We only support those mechanisms that we know about (ie ones that we know
   * how to check local user kuserok and the like)
-@@ -260,7 +302,8 @@ input_gssapi_exchange_complete(int type, u_int32_t plen, struct ssh *ssh)
+@@ -260,7 +302,7 @@ input_gssapi_exchange_complete(int type, u_int32_t plen, struct ssh *ssh)
  	if ((r = sshpkt_get_end(ssh)) != 0)
  		fatal_fr(r, "parse packet");
  
--	authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user));
-+	authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user,
-+	    authctxt->pw, 1));
+-	authenticated = mm_ssh_gssapi_userok(authctxt->user);
++ 	authenticated = mm_ssh_gssapi_userok(authctxt->user, authctxt->pw, 1);
  
- 	if ((!use_privsep || mm_is_monitor()) &&
- 	    (displayname = ssh_gssapi_displayname()) != NULL)
-@@ -306,7 +349,8 @@ input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh)
+ 	authctxt->postponed = 0;
+ 	ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
+@@ -306,7 +349,7 @@ input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh)
  	gssbuf.length = sshbuf_len(b);
  
- 	if (!GSS_ERROR(PRIVSEP(ssh_gssapi_checkmic(gssctxt, &gssbuf, &mic))))
--		authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user));
-+		authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user,
-+		    authctxt->pw, 0));
+ 	if (!GSS_ERROR(mm_ssh_gssapi_checkmic(gssctxt, &gssbuf, &mic)))
+-		authenticated = mm_ssh_gssapi_userok(authctxt->user);
++		authenticated = mm_ssh_gssapi_userok(authctxt->user, authctxt->pw, 0);
  	else
  		logit("GSSAPI MIC check failed");
  
@@ -233,8 +124,8 @@ index 9351e042..d6446c0c 100644
 +};
 +
  Authmethod method_gssapi = {
- 	"gssapi-with-mic",
- 	NULL,
+ 	&methodcfg_gssapi,
+ 	userauth_gssapi,
 diff --git a/auth2.c b/auth2.c
 index 0e776224..1c217268 100644
 --- a/auth2.c
@@ -442,15 +333,6 @@ diff --git a/gss-genr.c b/gss-genr.c
 index d56257b4..763a63ff 100644
 --- a/gss-genr.c
 +++ b/gss-genr.c
-@@ -1,7 +1,7 @@
- /* $OpenBSD: gss-genr.c,v 1.28 2021/01/27 10:05:28 djm Exp $ */
- 
- /*
-- * Copyright (c) 2001-2007 Simon Wilkinson. All rights reserved.
-+ * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved.
-  *
-  * Redistribution and use in source and binary forms, with or without
-  * modification, are permitted provided that the following conditions
 @@ -41,9 +41,33 @@
  #include "sshbuf.h"
  #include "log.h"
@@ -735,8 +617,8 @@ index d56257b4..763a63ff 100644
 +		ctx = &intctx;
  
  	/* RFC 4462 says we MUST NOT do SPNEGO */
- 	if (oid->length == spnego_oid.length && 
-@@ -287,6 +519,10 @@ ssh_gssapi_check_mechanism(Gssctxt **ctx, gss_OID oid, const char *host)
+ 	if (oid->length == spnego_oid.length &&
+@@ -500,6 +500,10 @@ ssh_gssapi_check_mechanism(Gssctxt **ctx, gss_OID oid, const char *host)
  	ssh_gssapi_build_ctx(ctx);
  	ssh_gssapi_set_oid(*ctx, oid);
  	major = ssh_gssapi_import_name(*ctx, host);
@@ -745,13 +627,13 @@ index d56257b4..763a63ff 100644
 +		major = ssh_gssapi_client_identity(*ctx, client);
 +
  	if (!GSS_ERROR(major)) {
- 		major = ssh_gssapi_init_ctx(*ctx, 0, GSS_C_NO_BUFFER, &token, 
+ 		major = ssh_gssapi_init_ctx(*ctx, 0, GSS_C_NO_BUFFER, &token,
  		    NULL);
-@@ -296,10 +532,66 @@ ssh_gssapi_check_mechanism(Gssctxt **ctx, gss_OID oid, const char *host)
+@@ -527,10 +527,66 @@ ssh_gssapi_check_mechanism(Gssctxt **ctx
  			    GSS_C_NO_BUFFER);
  	}
  
--	if (GSS_ERROR(major)) 
+-	if (GSS_ERROR(major))
 +	if (GSS_ERROR(major) || intctx != NULL)
  		ssh_gssapi_delete_ctx(ctx);
  
@@ -1256,20 +1138,34 @@ index ab3a15f0..6ce56e92 100644
  
  /* Privileged */
 diff --git a/kex.c b/kex.c
-index ce85f043..574c7609 100644
+index a5ae6ac0..fe714141 100644
 --- a/kex.c
 +++ b/kex.c
+@@ -698,6 +755,9 @@ kex_free(struct kex *kex)
+ 	sshbuf_free(kex->server_version);
+ 	sshbuf_free(kex->client_pub);
+ 	sshbuf_free(kex->session_id);
++#ifdef GSSAPI
++	free(kex->gss_host);
++#endif /* GSSAPI */
+ 	sshbuf_free(kex->initial_sig);
+ 	sshkey_free(kex->initial_hostkey);
+ 	free(kex->failed_choice);
+diff --git a/kex-names.c b/kex-names.c
+index ce85f043..574c7609 100644
+--- a/kex-names.c
++++ b/kex-names.c
 @@ -57,6 +57,10 @@
- #include "digest.h"
+ #include "ssherr.h"
  #include "xmalloc.h"
  
 +#ifdef GSSAPI
 +#include "ssh-gss.h"
 +#endif
 +
- /* prototype */
- static int kex_choose_conf(struct ssh *, uint32_t seq);
- static int kex_input_newkeys(int, u_int32_t, struct ssh *);
+ struct kexalg {
+ 	char *name;
+ 	u_int type;
 @@ -115,15 +120,28 @@ static const struct kexalg kexalgs[] = {
  #endif /* HAVE_EVP_SHA256 || !WITH_OPENSSL */
  	{ NULL, 0, -1, -1},
@@ -1332,10 +1228,11 @@ index ce85f043..574c7609 100644
  	return NULL;
  }
  
-@@ -315,6 +349,29 @@ kex_assemble_names(char **listp, const char *def, const char *all)
+@@ -315,3 +349,26 @@ kex_assemble_names(char **listp, const char *def, const char *all)
+ 	free(ret);
  	return r;
  }
- 
++ 
 +/* Validate GSS KEX method name list */
 +int
 +kex_gss_names_valid(const char *names)
@@ -1358,20 +1255,6 @@ index ce85f043..574c7609 100644
 +	free(s);
 +	return 1;
 +}
-+
- /*
-  * Fill out a proposal array with dynamically allocated values, which may
-  * be modified as required for compatibility reasons.
-@@ -698,6 +755,9 @@ kex_free(struct kex *kex)
- 	sshbuf_free(kex->server_version);
- 	sshbuf_free(kex->client_pub);
- 	sshbuf_free(kex->session_id);
-+#ifdef GSSAPI
-+	free(kex->gss_host);
-+#endif /* GSSAPI */
- 	sshbuf_free(kex->initial_sig);
- 	sshkey_free(kex->initial_hostkey);
- 	free(kex->failed_choice);
 diff --git a/kex.h b/kex.h
 index a5ae6ac0..fe714141 100644
 --- a/kex.h
@@ -1406,16 +1289,16 @@ index a5ae6ac0..fe714141 100644
  	int	(*verify_host_key)(struct sshkey *, struct ssh *);
  	struct sshkey *(*load_host_public_key)(int, int, struct ssh *);
 @@ -174,8 +189,10 @@ struct kex {
- 
+ int	 kex_nid_from_name(const char *);
  int	 kex_names_valid(const char *);
  char	*kex_alg_list(char);
 +char	*kex_gss_alg_list(char);
  char	*kex_names_cat(const char *, const char *);
- int	 kex_assemble_names(char **, const char *, const char *);
+ int	 kex_has_any_alg(const char *, const char *);
 +int	 kex_gss_names_valid(const char *);
+ int	 kex_assemble_names(char **, const char *, const char *);
  void	 kex_proposal_populate_entries(struct ssh *, char *prop[PROPOSAL_MAX],
      const char *, const char *, const char *, const char *, const char *);
- void	 kex_proposal_free_entries(char *prop[PROPOSAL_MAX]);
 @@ -202,6 +219,12 @@ int	 kexgex_client(struct ssh *);
  int	 kexgex_server(struct ssh *);
  int	 kex_gen_client(struct ssh *);
@@ -2873,7 +2756,7 @@ index 001a8fa1..6edb509a 100644
  
  	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_GSSUSEROK, m);
  	mm_request_receive_expect(pmonitor->m_recvfd,
-@@ -1012,4 +1014,57 @@ mm_ssh_gssapi_userok(char *user)
+@@ -1012,6 +1014,59 @@ mm_ssh_gssapi_userok(char *user)
  	debug3_f("user %sauthenticated", authenticated ? "" : "not ");
  	return (authenticated);
  }
@@ -2931,6 +2814,8 @@ index 001a8fa1..6edb509a 100644
 +}
 +
  #endif /* GSSAPI */
+ 
+ /*
 diff --git a/monitor_wrap.h b/monitor_wrap.h
 index 23ab096a..485590c1 100644
 --- a/monitor_wrap.h
@@ -3107,8 +2992,8 @@ diff -up a/servconf.c.gsskex b/servconf.c
  #include "digest.h"
 +#include "ssh-gss.h"
  
- static void add_listen_addr(ServerOptions *, const char *,
-     const char *, int);
+ #if !defined(SSHD_PAM_SERVICE)
+ # define SSHD_PAM_SERVICE		"sshd"
 @@ -136,8 +137,11 @@ initialize_server_options(ServerOptions
  	options->kerberos_ticket_cleanup = -1;
  	options->kerberos_get_afs_token = -1;
@@ -3141,7 +3026,7 @@ diff -up a/servconf.c.gsskex b/servconf.c
  		options->password_authentication = 1;
  	if (options->kbd_interactive_authentication == -1)
 @@ -506,6 +518,7 @@ typedef enum {
- 	sHostKeyAlgorithms, sPerSourceMaxStartups, sPerSourceNetBlockSize,
+ 	sPerSourcePenalties, sPerSourcePenaltyExemptList,
  	sClientAliveInterval, sClientAliveCountMax, sAuthorizedKeysFile,
  	sGssAuthentication, sGssCleanupCreds, sGssStrictAcceptor,
 +	sGssKeyEx, sGssKexAlgorithms, sGssStoreRekey,
@@ -3262,14 +3147,6 @@ diff --git a/ssh-gss.h b/ssh-gss.h
 index 36180d07..70dd3665 100644
 --- a/ssh-gss.h
 +++ b/ssh-gss.h
-@@ -1,6 +1,6 @@
- /* $OpenBSD: ssh-gss.h,v 1.15 2021/01/27 10:05:28 djm Exp $ */
- /*
-- * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
-+ * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved.
-  *
-  * Redistribution and use in source and binary forms, with or without
-  * modification, are permitted provided that the following conditions
 @@ -61,10 +61,34 @@
  
  #define SSH_GSS_OIDTYPE 0x06
@@ -3523,17 +3400,8 @@ diff --git a/sshconnect2.c b/sshconnect2.c
 index af00fb30..03bc87eb 100644
 --- a/sshconnect2.c
 +++ b/sshconnect2.c
-@@ -80,8 +80,6 @@
- #endif
- 
- /* import */
--extern char *client_version_string;
--extern char *server_version_string;
- extern Options options;
- 
- /*
 @@ -163,6 +161,11 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port)
- 	char *s, *all_key, *hkalgs = NULL;
+ 	char *all_key, *hkalgs = NULL;
  	int r, use_known_hosts_order = 0;
  
 +#if defined(GSSAPI) && defined(WITH_OPENSSL)
@@ -3545,8 +3413,8 @@ index af00fb30..03bc87eb 100644
  	xxx_hostaddr = hostaddr;
  	xxx_conn_info = cinfo;
 @@ -206,6 +209,42 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port)
- 	kex_proposal_populate_entries(ssh, myproposal, s, options.ciphers,
- 	    options.macs, compression_alg_list(options.compression),
+ 	    options.kex_algorithms, options.ciphers, options.macs,
+ 	    compression_alg_list(options.compression),
  	    hkalgs ? hkalgs : options.hostkeyalgorithms);
 +
 +#if defined(GSSAPI) && defined(WITH_OPENSSL)
@@ -3587,7 +3455,7 @@ index af00fb30..03bc87eb 100644
  
  	free(hkalgs);
  
-@@ -224,17 +256,47 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port)
+@@ -224,14 +256,44 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port)
  # ifdef OPENSSL_HAS_ECC
  	ssh->kex->kex[KEX_ECDH_SHA2] = kex_gen_client;
  # endif
@@ -3618,11 +3486,8 @@ index af00fb30..03bc87eb 100644
 +#endif
 +
  	ssh_dispatch_run_fatal(ssh, DISPATCH_BLOCK, &ssh->kex->done);
+ 	kex_proposal_free_entries(myproposal);
  
- 	/* remove ext-info from the KEX proposals for rekeying */
- 	free(myproposal[PROPOSAL_KEX_ALGS]);
- 	myproposal[PROPOSAL_KEX_ALGS] =
- 	    compat_kex_proposal(ssh, options.kex_algorithms);
 +#if defined(GSSAPI) && defined(WITH_OPENSSL)
 +	/* repair myproposal after it was crumpled by the */
 +	/* ext-info removal above */
@@ -3633,9 +3498,9 @@ index af00fb30..03bc87eb 100644
 +		free(gss);
 +	}
 +#endif
- 	if ((r = kex_prop2buf(ssh->kex->my, myproposal)) != 0)
- 		fatal_r(r, "kex_prop2buf");
- 
+ #ifdef DEBUG_KEXDH
+ 	/* send 1st encrypted/maced/compressed message */
+ 	if ((r = sshpkt_start(ssh, SSH2_MSG_IGNORE)) != 0 ||
 @@ -330,6 +392,7 @@ static int input_gssapi_response(int type, u_int32_t, struct ssh *);
  static int input_gssapi_token(int type, u_int32_t, struct ssh *);
  static int input_gssapi_error(int, u_int32_t, struct ssh *);
@@ -3767,6 +3632,20 @@ diff --git a/sshd.c b/sshd.c
 index 60b2aaf7..d92f03aa 100644
 --- a/sshd.c
 +++ b/sshd.c
+@@ -1852,7 +1852,8 @@ main(int ac, char **av)
+ 		free(fp);
+ 	}
+ 	accumulate_host_timing_secret(cfg, NULL);
+-	if (!sensitive_data.have_ssh2_key) {
++	/* The GSSAPI key exchange can run without a host key */
++	if (!sensitive_data.have_ssh2_key && !options.gss_keyex) {
+ 		logit("sshd: no hostkeys available -- exiting.");
+ 		exit(1);
+ 	}
+diff --git a/sshd-session.c b/sshd-session.c
+index 60b2aaf7..d92f03aa 100644
+--- a/sshd-session.c
++++ b/sshd-session.c
 @@ -817,8 +817,8 @@ notify_hostkeys(struct ssh *ssh)
  	}
  	debug3_f("sent %u hostkeys", nkeys);
@@ -3778,16 +3657,6 @@ index 60b2aaf7..d92f03aa 100644
  		sshpkt_fatal(ssh, r, "%s: send", __func__);
  	sshbuf_free(buf);
  }
-@@ -1852,7 +1852,8 @@ main(int ac, char **av)
- 		free(fp);
- 	}
- 	accumulate_host_timing_secret(cfg, NULL);
--	if (!sensitive_data.have_ssh2_key) {
-+	/* The GSSAPI key exchange can run without a host key */
-+	if (!sensitive_data.have_ssh2_key && !options.gss_keyex) {
- 		logit("sshd: no hostkeys available -- exiting.");
- 		exit(1);
- 	}
 @@ -2347,6 +2348,48 @@ do_ssh2_kex(struct ssh *ssh)
  
  	free(hkalgs);
@@ -3838,9 +3707,9 @@ index 60b2aaf7..d92f03aa 100644
  	if ((r = kex_setup(ssh, myproposal)) != 0)
  		fatal_r(r, "kex_setup");
 @@ -2362,7 +2405,18 @@ do_ssh2_kex(struct ssh *ssh)
- # ifdef OPENSSL_HAS_ECC
+  #ifdef OPENSSL_HAS_ECC
  	kex->kex[KEX_ECDH_SHA2] = kex_gen_server;
- # endif
+  #endif
 -#endif
 +# ifdef GSSAPI
 +	if (options.gss_keyex) {
@@ -4036,9 +3905,9 @@ diff --git a/packet.h b/packet.h
 
  int      ssh_packet_read(struct ssh *);
 +int	 ssh_packet_read_expect(struct ssh *, u_int type);
- int      ssh_packet_read_poll(struct ssh *);
  int ssh_packet_read_poll2(struct ssh *, u_char *, u_int32_t *seqnr_p);
  int	 ssh_packet_process_incoming(struct ssh *, const char *buf, u_int len);
+ int	 ssh_packet_process_read(struct ssh *, int);
 diff --git a/packet.c b/packet.c
 --- a/packet.c	(revision 8241b9c0529228b4b86d88b1a6076fb9f97e4a99)
 +++ b/packet.c	(date 1703172586447)
diff --git a/openssh-8.0p1-pkcs11-uri.patch b/openssh-8.0p1-pkcs11-uri.patch
index 1e7940d..c3958cd 100644
--- a/openssh-8.0p1-pkcs11-uri.patch
+++ b/openssh-8.0p1-pkcs11-uri.patch
@@ -965,9 +965,9 @@ diff -up openssh-9.6p1/ssh-agent.c.pkcs11-uri openssh-9.6p1/ssh-agent.c
 --- openssh-9.6p1/ssh-agent.c.pkcs11-uri	2023-12-18 15:59:50.000000000 +0100
 +++ openssh-9.6p1/ssh-agent.c	2024-01-12 14:25:25.234942360 +0100
 @@ -1549,10 +1549,72 @@ add_p11_identity(struct sshkey *key, cha
+ 	idtab->nentries++;
  }
  
- #ifdef ENABLE_PKCS11
 +static char *
 +sanitize_pkcs11_provider(const char *provider)
 +{
diff --git a/openssh-8.7p1-minrsabits.patch b/openssh-8.7p1-minrsabits.patch
index 479b55d..d8577d2 100644
--- a/openssh-8.7p1-minrsabits.patch
+++ b/openssh-8.7p1-minrsabits.patch
@@ -19,4 +19,4 @@ diff --git a/servconf.c b/servconf.c
 +	{ "rsaminsize", sRequiredRSASize, SSHCFG_ALL }, /* alias */
  	{ "channeltimeout", sChannelTimeout, SSHCFG_ALL },
  	{ "unusedconnectiontimeout", sUnusedConnectionTimeout, SSHCFG_ALL },
- 	{ NULL, sBadOption, 0 }
+ 	{ "sshdsessionpath", sSshdSessionPath, SSHCFG_GLOBAL },
diff --git a/openssh-8.7p1-negotiate-supported-algs.patch b/openssh-8.7p1-negotiate-supported-algs.patch
index ee3637f..c4d86e7 100644
--- a/openssh-8.7p1-negotiate-supported-algs.patch
+++ b/openssh-8.7p1-negotiate-supported-algs.patch
@@ -79,12 +79,12 @@ diff -up openssh-9.3p1/sshconnect2.c.xxx openssh-9.3p1/sshconnect2.c
      const struct ssh_conn_info *cinfo)
  {
  	char *myproposal[PROPOSAL_MAX];
--	char *s, *all_key, *hkalgs = NULL;
-+	char *s, *all_key, *hkalgs = NULL, *filtered_algs = NULL;
+-	char *all_key, *hkalgs = NULL;
++	char *all_key, *hkalgs = NULL, *filtered_algs = NULL;
  	int r, use_known_hosts_order = 0;
  
  #if defined(GSSAPI) && defined(WITH_OPENSSL)
-@@ -260,9 +260,21 @@ ssh_kex2(struct ssh *ssh, char *host, st
+@@ -260,10 +260,22 @@ ssh_kex2(struct ssh *ssh, char *host, st
  	if (use_known_hosts_order)
  		hkalgs = order_hostkeyalgs(host, hostaddr, port, cinfo);
  
@@ -100,8 +100,9 @@ diff -up openssh-9.3p1/sshconnect2.c.xxx openssh-9.3p1/sshconnect2.c
 +			        options.hostkeyalgorithms, options.pubkey_accepted_algos);
 +	}
 +
- 	kex_proposal_populate_entries(ssh, myproposal, s, options.ciphers,
- 	    options.macs, compression_alg_list(options.compression),
+ 	kex_proposal_populate_entries(ssh, myproposal,
+ 	    options.kex_algorithms, options.ciphers, options.macs,
+ 	    compression_alg_list(options.compression),
 -	    hkalgs ? hkalgs : options.hostkeyalgorithms);
 +	    filtered_algs);
  
diff --git a/openssh-8.7p1-nohostsha1proof.patch b/openssh-8.7p1-nohostsha1proof.patch
index 6a6b63d..d23e3e6 100644
--- a/openssh-8.7p1-nohostsha1proof.patch
+++ b/openssh-8.7p1-nohostsha1proof.patch
@@ -148,15 +148,6 @@ diff -up openssh-8.7p1/regress/unittests/kex/test_kex.c.sshrsacheck openssh-8.7p
  	ASSERT_PTR_NE(keyname, NULL);
  	kex_params.proposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = keyname;
  	ASSERT_INT_EQ(ssh_init(&client, 0, &kex_params), 0);
-@@ -180,7 +181,7 @@ do_kex(char *kex)
- {
- #ifdef WITH_OPENSSL
- 	do_kex_with_key(kex, KEY_RSA, 2048);
--	do_kex_with_key(kex, KEY_DSA, 1024);
-+	/* do_kex_with_key(kex, KEY_DSA, 1024); */
- #ifdef OPENSSL_HAS_ECC
- 	do_kex_with_key(kex, KEY_ECDSA, 256);
- #endif /* OPENSSL_HAS_ECC */
 diff -up openssh-8.7p1/regress/unittests/sshkey/test_file.c.sshrsacheck openssh-8.7p1/regress/unittests/sshkey/test_file.c
 --- openssh-8.7p1/regress/unittests/sshkey/test_file.c.sshrsacheck	2023-01-26 12:04:55.946343408 +0100
 +++ openssh-8.7p1/regress/unittests/sshkey/test_file.c	2023-01-26 12:06:35.235164432 +0100
@@ -196,22 +187,6 @@ diff -up openssh-8.7p1/regress/unittests/sshkey/test_fuzz.c.sshrsacheck openssh-
  
  	TEST_START("fuzz RSA SHA256 sig");
  	buf = load_file("rsa_1");
-@@ -357,6 +358,7 @@ sshkey_fuzz_tests(void)
- 	sshkey_free(k1);
- 	TEST_DONE();
- 
-+	/* Skip this test, SHA1 signatures are not supported
- 	TEST_START("fuzz DSA sig");
- 	buf = load_file("dsa_1");
- 	ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k1, NULL), 0);
-@@ -364,6 +366,7 @@ sshkey_fuzz_tests(void)
- 	sig_fuzz(k1, NULL);
- 	sshkey_free(k1);
- 	TEST_DONE();
-+	*/
- 
- #ifdef OPENSSL_HAS_ECC
- 	TEST_START("fuzz ECDSA sig");
 diff -up openssh-8.7p1/regress/unittests/sshkey/test_sshkey.c.sshrsacheck openssh-8.7p1/regress/unittests/sshkey/test_sshkey.c
 --- openssh-8.7p1/regress/unittests/sshkey/test_sshkey.c.sshrsacheck	2023-01-26 11:02:52.339413463 +0100
 +++ openssh-8.7p1/regress/unittests/sshkey/test_sshkey.c	2023-01-26 11:58:42.324253896 +0100
@@ -277,21 +252,6 @@ diff -up openssh-8.7p1/regress/unittests/sshkey/test_sshkey.c.sshrsacheck openss
  	ASSERT_INT_EQ(sshkey_from_blob(sshbuf_ptr(b), sshbuf_len(b), &k4),
  	    SSH_ERR_KEY_CERT_INVALID_SIGN_KEY);
  	ASSERT_PTR_EQ(k4, NULL);
-diff -up openssh-8.7p1/regress/unittests/sshsig/tests.c.sshrsacheck openssh-8.7p1/regress/unittests/sshsig/tests.c
---- openssh-8.7p1/regress/unittests/sshsig/tests.c.sshrsacheck	2023-01-26 12:19:23.659513651 +0100
-+++ openssh-8.7p1/regress/unittests/sshsig/tests.c	2023-01-26 12:20:28.021044803 +0100
-@@ -102,9 +102,11 @@ tests(void)
- 	check_sig("rsa.pub", "rsa.sig", msg, namespace);
- 	TEST_DONE();
- 
-+	/* Skip this test, SHA1 signatures are not supported
- 	TEST_START("check DSA signature");
- 	check_sig("dsa.pub", "dsa.sig", msg, namespace);
- 	TEST_DONE();
-+	*/
- 
- #ifdef OPENSSL_HAS_ECC
- 	TEST_START("check ECDSA signature");
 diff -up openssh-8.7p1/serverloop.c.sshrsacheck openssh-8.7p1/serverloop.c
 --- openssh-8.7p1/serverloop.c.sshrsacheck	2023-01-12 14:57:08.118400073 +0100
 +++ openssh-8.7p1/serverloop.c	2023-01-12 14:59:17.330470518 +0100
@@ -336,13 +296,13 @@ diff -up openssh-8.7p1/sshd.c.sshrsacheck openssh-8.7p1/sshd.c
 --- openssh-8.7p1/sshd.c.sshrsacheck	2023-01-12 13:29:06.355711140 +0100
 +++ openssh-8.7p1/sshd.c	2023-01-12 13:29:06.358711178 +0100
 @@ -1640,6 +1651,7 @@ main(int ac, char **av)
- 	Authctxt *authctxt;
- 	struct connection_info *connection_info = NULL;
+ 	struct sshkey *pubkey;
+ 	struct connection_info connection_info;
  	sigset_t sigmask;
 +	int forbid_ssh_rsa = 0;
  
+ 	memset(&connection_info, 0, sizeof(connection_info));
  #ifdef HAVE_SECUREWARE
- 	(void)set_auth_parameters(ac, av);
 @@ -1938,6 +1950,33 @@ main(int ac, char **av)
  		    key = NULL;
  		    continue;
@@ -377,16 +337,6 @@ diff -up openssh-8.7p1/sshd.c.sshrsacheck openssh-8.7p1/sshd.c
  		if (sshkey_is_sk(key) &&
  		    key->sk_flags & SSH_SK_USER_PRESENCE_REQD) {
  			debug("host key %s requires user presence, ignoring",
-@@ -2275,6 +2306,9 @@ main(int ac, char **av)
- 
- 	check_ip_options(ssh);
- 
-+	if (forbid_ssh_rsa)
-+		ssh->compat |= SSH_RH_RSASIGSHA;
-+
- 	/* Prepare the channels layer */
- 	channel_init_channels(ssh);
- 	channel_set_af(ssh, options.address_family);
 diff -up openssh-8.7p1/ssh-rsa.c.sshrsacheck openssh-8.7p1/ssh-rsa.c
 --- openssh-8.7p1/ssh-rsa.c.sshrsacheck	2023-01-20 13:07:54.180676144 +0100
 +++ openssh-8.7p1/ssh-rsa.c	2023-01-20 13:07:54.290677074 +0100
diff --git a/openssh-9.8p1-systemd.patch b/openssh-9.8p1-systemd.patch
deleted file mode 100644
index b20624e..0000000
--- a/openssh-9.8p1-systemd.patch
+++ /dev/null
@@ -1,201 +0,0 @@
-diff --git a/configure.ac b/configure.ac
-index 379cd746b..15e2ecdb7 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -907,6 +907,7 @@ int main(void) { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16))
- 	AC_DEFINE([_PATH_BTMP], ["/var/log/btmp"], [log for bad login attempts])
- 	AC_DEFINE([USE_BTMP])
- 	AC_DEFINE([LINUX_OOM_ADJUST], [1], [Adjust Linux out-of-memory killer])
-+	AC_DEFINE([SYSTEMD_NOTIFY], [1], [Have sshd notify systemd on start/reload])
- 	inet6_default_4in6=yes
- 	case `uname -r` in
- 	1.*|2.0.*)
-diff --git a/openbsd-compat/port-linux.c b/openbsd-compat/port-linux.c
-index 0457e28d0..df7290246 100644
---- a/openbsd-compat/port-linux.c
-+++ b/openbsd-compat/port-linux.c
-@@ -21,16 +21,23 @@
- 
- #include "includes.h"
- 
--#if defined(WITH_SELINUX) || defined(LINUX_OOM_ADJUST)
-+#if defined(WITH_SELINUX) || defined(LINUX_OOM_ADJUST) || \
-+    defined(SYSTEMD_NOTIFY)
-+#include <sys/socket.h>
-+#include <sys/un.h>
-+
- #include <errno.h>
-+#include <inttypes.h>
- #include <stdarg.h>
- #include <string.h>
- #include <stdio.h>
- #include <stdlib.h>
-+#include <time.h>
- 
- #include "log.h"
- #include "xmalloc.h"
- #include "port-linux.h"
-+#include "misc.h"
- 
- #ifdef WITH_SELINUX
- #include <selinux/selinux.h>
-@@ -310,4 +317,90 @@ oom_adjust_restore(void)
- 	return;
- }
- #endif /* LINUX_OOM_ADJUST */
--#endif /* WITH_SELINUX || LINUX_OOM_ADJUST */
-+
-+#ifdef SYSTEMD_NOTIFY
-+
-+static void ssh_systemd_notify(const char *, ...)
-+    __attribute__((__format__ (printf, 1, 2))) __attribute__((__nonnull__ (1)));
-+
-+static void
-+ssh_systemd_notify(const char *fmt, ...)
-+{
-+	char *s = NULL;
-+	const char *path;
-+	struct stat sb;
-+	struct sockaddr_un addr;
-+	int fd = -1;
-+	va_list ap;
-+
-+	if ((path = getenv("NOTIFY_SOCKET")) == NULL || strlen(path) == 0)
-+		return;
-+
-+	va_start(ap, fmt);
-+	xvasprintf(&s, fmt, ap);
-+	va_end(ap);
-+
-+	/* Only AF_UNIX is supported, with path or abstract sockets */
-+	if (path[0] != '/' && path[0] != '@') {
-+		error_f("socket \"%s\" is not compatible with AF_UNIX", path);
-+		goto out;
-+	}
-+
-+	if (path[0] == '/' && stat(path, &sb) != 0) {
-+		error_f("socket \"%s\" stat: %s", path, strerror(errno));
-+		goto out;
-+	}
-+
-+	memset(&addr, 0, sizeof(addr));
-+	addr.sun_family = AF_UNIX;
-+	if (strlcpy(addr.sun_path, path,
-+	    sizeof(addr.sun_path)) >= sizeof(addr.sun_path)) {
-+		error_f("socket path \"%s\" too long", path);
-+		goto out;
-+	}
-+	/* Support for abstract socket */
-+	if (addr.sun_path[0] == '@')
-+		addr.sun_path[0] = 0;
-+	if ((fd = socket(PF_UNIX, SOCK_DGRAM, 0)) == -1) {
-+		error_f("socket \"%s\": %s", path, strerror(errno));
-+		goto out;
-+	}
-+	if (connect(fd, &addr, sizeof(addr)) != 0) {
-+		error_f("socket \"%s\" connect: %s", path, strerror(errno));
-+		goto out;
-+	}
-+	if (write(fd, s, strlen(s)) != (ssize_t)strlen(s)) {
-+		error_f("socket \"%s\" write: %s", path, strerror(errno));
-+		goto out;
-+	}
-+	debug_f("socket \"%s\" notified %s", path, s);
-+ out:
-+	if (fd != -1)
-+		close(fd);
-+	free(s);
-+}
-+
-+void
-+ssh_systemd_notify_ready(void)
-+{
-+	ssh_systemd_notify("READY=1");
-+}
-+
-+void
-+ssh_systemd_notify_reload(void)
-+{
-+	struct timespec now;
-+
-+	monotime_ts(&now);
-+	if (now.tv_sec < 0 || now.tv_nsec < 0) {
-+		error_f("monotime returned negative value");
-+		ssh_systemd_notify("RELOADING=1");
-+	} else {
-+		ssh_systemd_notify("RELOADING=1\nMONOTONIC_USEC=%llu",
-+		    ((uint64_t)now.tv_sec * 1000000ULL) +
-+		    ((uint64_t)now.tv_nsec / 1000ULL));
-+	}
-+}
-+#endif /* SYSTEMD_NOTIFY */
-+
-+#endif /* WITH_SELINUX || LINUX_OOM_ADJUST || SYSTEMD_NOTIFY */
-diff --git a/openbsd-compat/port-linux.h b/openbsd-compat/port-linux.h
-index 3c22a854d..14064f87d 100644
---- a/openbsd-compat/port-linux.h
-+++ b/openbsd-compat/port-linux.h
-@@ -30,4 +30,9 @@ void oom_adjust_restore(void);
- void oom_adjust_setup(void);
- #endif
- 
-+#ifdef SYSTEMD_NOTIFY
-+void ssh_systemd_notify_ready(void);
-+void ssh_systemd_notify_reload(void);
-+#endif
-+
- #endif /* ! _PORT_LINUX_H */
-diff --git a/platform.c b/platform.c
-index 4fe8744ee..9cf818153 100644
---- a/platform.c
-+++ b/platform.c
-@@ -44,6 +44,14 @@ platform_pre_listen(void)
- #endif
- }
- 
-+void
-+platform_post_listen(void)
-+{
-+#ifdef SYSTEMD_NOTIFY
-+	ssh_systemd_notify_ready();
-+#endif
-+}
-+
- void
- platform_pre_fork(void)
- {
-@@ -55,6 +63,9 @@ platform_pre_fork(void)
- void
- platform_pre_restart(void)
- {
-+#ifdef SYSTEMD_NOTIFY
-+	ssh_systemd_notify_reload();
-+#endif
- #ifdef LINUX_OOM_ADJUST
- 	oom_adjust_restore();
- #endif
-diff --git a/platform.h b/platform.h
-index 7fef8c983..5dec23276 100644
---- a/platform.h
-+++ b/platform.h
-@@ -21,6 +21,7 @@
- void platform_pre_listen(void);
- void platform_pre_fork(void);
- void platform_pre_restart(void);
-+void platform_post_listen(void);
- void platform_post_fork_parent(pid_t child_pid);
- void platform_post_fork_child(void);
- int  platform_privileged_uidswap(void);
-diff --git a/sshd.c b/sshd.c
-index 9cbe92293..3c3f2dd6b 100644
---- a/sshd.c
-+++ b/sshd.c
-@@ -2077,6 +2077,8 @@ main(int ac, char **av)
- 		ssh_signal(SIGTERM, sigterm_handler);
- 		ssh_signal(SIGQUIT, sigterm_handler);
- 
-+		platform_post_listen();
-+
- 		/*
- 		 * Write out the pid file after the sigterm handler
- 		 * is setup and the listen sockets are bound
diff --git a/openssh.spec b/openssh.spec
index 08b1b4a..9548925 100644
--- a/openssh.spec
+++ b/openssh.spec
@@ -46,15 +46,15 @@
 %{?static_openssl:%global static_libcrypto 1}
 
 # Do not forget to bump pam_ssh_agent_auth release if you rewind the main package release to 1
-%global openssh_ver 9.6p1
+%global openssh_ver 9.8p1
 %global openssh_rel 1
 %global pam_ssh_agent_ver 0.10.4
-%global pam_ssh_agent_rel 9
+%global pam_ssh_agent_rel 10
 
 Summary: An open source implementation of SSH protocol version 2
 Name: openssh
 Version: %{openssh_ver}
-Release: %{openssh_rel}%{?dist}.13
+Release: %{openssh_rel}%{?dist}
 URL: http://www.openssh.com/portable.html
 #URL1: https://github.com/jbeverly/pam_ssh_agent_auth/
 Source0: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz
@@ -177,8 +177,6 @@ Patch926: openssh-6.7p1-sftp-force-permission.patch
 Patch939: openssh-7.2p2-s390-closefrom.patch
 # Move MAX_DISPLAYS to a configuration option (#1341302)
 Patch944: openssh-7.3p1-x11-max-displays.patch
-# Help systemd to track the running service
-Patch948: openssh-9.8p1-systemd.patch
 # Pass inetd flags for SELinux down to openbsd compat level
 Patch949: openssh-7.6p1-cleanup-selinux.patch
 # Sandbox adjustments for s390 and audit
@@ -236,8 +234,6 @@ Patch1014: openssh-8.7p1-nohostsha1proof.patch
 
 Patch1015: openssh-9.6p1-pam-rhost.patch
 
-Patch1016: CVE-2024-6387.patch
-
 License: BSD-3-Clause AND BSD-2-Clause AND ISC AND SSH-OpenSSH AND ssh-keyscan AND sprintf AND LicenseRef-Fedora-Public-Domain AND X11-distribute-modifications-variant
 Requires: /sbin/nologin
 
@@ -312,7 +308,7 @@ Requires: openssh = %{version}-%{release}
 %package -n pam_ssh_agent_auth
 Summary: PAM module for authentication with ssh-agent
 Version: %{pam_ssh_agent_ver}
-Release: %{pam_ssh_agent_rel}.%{openssh_rel}%{?dist}.13
+Release: %{pam_ssh_agent_rel}.%{openssh_rel}%{?dist}
 License: BSD-3-Clause AND BSD-2-Clause AND ISC AND SSH-OpenSSH AND ssh-keyscan AND sprintf AND LicenseRef-Fedora-Public-Domain AND X11-distribute-modifications-variant AND OpenSSL
 
 %description
@@ -409,7 +405,6 @@ popd
 %patch -P 926 -p1 -b .sftp-force-mode
 %patch -P 939 -p1 -b .s390-dev
 %patch -P 944 -p1 -b .x11max
-%patch -P 948 -p1 -b .systemd
 %patch -P 949 -p1 -b .refactor
 %patch -P 950 -p1 -b .sandbox
 %patch -P 951 -p1 -b .pkcs11-uri
@@ -442,7 +437,6 @@ popd
 %patch -P 1013 -p1 -b .evp-fips-ecdh
 %patch -P 1014 -p1 -b .nosha1hostproof
 %patch -P 1015 -p1 -b .pam-rhost
-%patch -P 1016 -p1 -b .cve-2024-6387
 
 %patch -P 100 -p1 -b .coverity
 
@@ -751,6 +745,9 @@ test -f %{sysconfig_anaconda} && \
 %endif
 
 %changelog
+* Wed Jul 10 2024 Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.8p1-1
+- Update to OpenSSH 9.8p1
+
 * Tue Jul 02 2024 Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.6p1-1.13
 - rebuilt
 
diff --git a/sources b/sources
index 62f22c0..dc4d818 100644
--- a/sources
+++ b/sources
@@ -1,4 +1,4 @@
-SHA512 (openssh-9.6p1.tar.gz) = 0ebf81e39914c3a90d7777a001ec7376a94b37e6024baf3e972c58f0982b7ddef942315f5e01d56c00ff95603b4a20ee561ab918ecc55511df007ac138160509
-SHA512 (openssh-9.6p1.tar.gz.asc) = aec5a5bd6ce480a8e5b5879dc55f8186aec90fe61f085aa92ad7d07f324574aa781be09c83b7443a32848d091fd44fb12c1842d49cee77afc351e550ffcc096d
+SHA512 (openssh-9.8p1.tar.gz) = 95dec2f18e58eb47994f3de4430253e0665e185564b65088ca5f4108870e05feddef8cda8d3c0a4b75f18b98cc2c024df0e27de53b48c1a16da8da483cb8292a
+SHA512 (openssh-9.8p1.tar.gz.asc) = 4df1f1be2c6ab7f3aebaedd0a773b0e8c8929abb30cd3415873ad55d012cfa113f792e888e5e772dd468c394aeb7e35d62893a514dbc0ab1a03acd79918657f7
 SHA512 (pam_ssh_agent_auth-0.10.4.tar.gz) = caccf72174d15e43f4c86a459ac6448682e62116557cf1e1e828955f3d1731595b238df42adec57860e7f341e92daf5d8285020bcb5018f3b8a5145aa32ee1c2
 SHA512 (gpgkey-736060BA.gpg) = df44f3fdbcd1d596705348c7f5aed3f738c5f626a55955e0642f7c6c082995cf36a1b1891bb41b8715cb2aff34fef1c877e0eff0d3507dd00a055ba695757a21