ssh_config(5) contains outdated information

This has been fixed upstream, as shown in [1] and is available in jammy.

[1] https://github.com/openssh/openssh-portable/commit/53ea05e09b04fd7b6dea66b42b34d65fe61b9636

As the fix is in Jammy I think we can mark the devel task as Fix Released.

I doubt this is SRU material as the impact of the bug is really low; maybe it could be done with a staged upload [1]. I'm marking the SRU tasks as Triaged as the bug is well understood.

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Staging_an_upload

Both Hirsute and Impish are End of Life.
So there is no possibility to fix these ones.

Change will be SRUd to Focal for sure.

MP in inner review for some days

With Michal: Marked block-proposed, added SRU content, re-reviewed and sponsored the upload to Focal-unapproved.

> Fixing this is nice for the users, but OTOH very low severity and would cause a package download and update on almost every Ubuntu in the world. Therefore we will mark this as block-proposed and keep it in focal-proposed so that a later real update (security or functional) will pick this up from -proposed and then fix it in the field for real.

Note that then the tag should be block-proposed-focal, not block-proposed.

Hello iBug, or anyone else affected,

Accepted openssh into focal-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/openssh/1:8.2p1-4ubuntu0.6 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-focal to verification-done-focal. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-focal. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

All autopkgtests for the newly accepted openssh (1:8.2p1-4ubuntu0.6) for focal have finished running.
The following regressions have been reported in tests triggered by the package:

gvfs/1.44.1-1ubuntu1.1 (arm64, amd64, ppc64el)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/focal/update_excuses.html#openssh

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!

Retrigerred tests and no regressions now.

First of all, I have changed the SRU description in 'Test Plan' section a bit, to be more precisely. We could assume the fix didn't work if I would leave it as it did before.
I've added information that we should look for the changes within the specific area in the manpage, so the steps are obvious now.

Fix works, package 1:8.2p1-4ubuntu0.6 fixes the bug.

I've created the focal container using steps from the [Test Plan] section listed above in the Bug Description and inside that container I typed in:

$ apt policy openssh-server

The output:

Installed: 1:8.2p1-4ubuntu0.5
  Candidate: 1:8.2p1-4ubuntu0.6
  Version table:
     1:8.2p1-4ubuntu0.6 500
        500 http://archive.ubuntu.com/ubuntu focal-proposed/main amd64 Packages
 *** 1:8.2p1-4ubuntu0.5 500
        500 http://archive.ubuntu.com/ubuntu focal-updates/main amd64 Packages
        100 /var/lib/dpkg/status
     1:8.2p1-4ubuntu0.2 500
        500 http://security.ubuntu.com/ubuntu focal-security/main amd64 Packages
     1:8.2p1-4 500
        500 http://archive.ubuntu.com/ubuntu focal/main amd64 Packages

Then I have typed in:

$ man sshd_config
and
$ man ssh_config

I've noticed that nothing has changed there and ssh-rsa entries still exist in the manpage within the CASignatureAlgorithms section. So the problem still existed, because as we could see in the output, the package version was not the one where the fix is.

Then I've upgraded both openssh-server and openssh-client using:
$ apt install openssh-server=1:8.2p1-4ubuntu0.6
$ apt install openssh-client=1:8.2p1-4ubuntu0.6

Later I've typed in:

$ apt policy openssh-server
to check if installed version is changed and we see that we have new version installed (with fix)

 Installed: 1:8.2p1-4ubuntu0.6
  Candidate: 1:8.2p1-4ubuntu0.6
  Version table:
 *** 1:8.2p1-4ubuntu0.6 500
        500 http://archive.ubuntu.com/ubuntu focal-proposed/main amd64 Packages
        100 /var/lib/dpkg/status
     1:8.2p1-4ubuntu0.5 500
        500 http://archive.ubuntu.com/ubuntu focal-updates/main amd64 Packages
     1:8.2p1-4ubuntu0.2 500
        500 http://security.ubuntu.com/ubuntu focal-security/main amd64 Packages
     1:8.2p1-4 500
        500 http://archive.ubuntu.com/ubuntu focal/main amd64 Packages

Finally when I opened the manpage, typing:
$ man ssh_config

the problem did not exist, so the fix works.

This popped up in triage as a stale bug, but looks like everything looks good here: openssh 1:8.2p1-4ubuntu0.6 is in focal-proposed, verification is done, migration is blocked by the block-proposed-focal tag (staged SRU).

Unblocking since the fix for (LP: #2012298) is now available

This bug was fixed in the package openssh - 1:8.2p1-4ubuntu0.7

---------------
openssh (1:8.2p1-4ubuntu0.7) focal; urgency=medium

  * d/p/lp2012298-upstream-fix-match-in-d-config.patch: Allow ssh_config.d/
    configuration files to correctly update the PasswordAuthentication setting
    (LP: #2012298)

 -- Lena Voytek <email address hidden> Mon, 03 Apr 2023 15:47:13 -0700