22c22
< KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
---
> KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
229a230,260
> insert_include() {
> 	local src_config=${1} options=${2} includedir=${3}
> 	local name copy regexp_options regexp lineno comment_options
> 
> 	name=${src_config##*/}
> 	copy="${T}/${name}"
> 	cp -a "${src_config}" "${copy}" || die
> 
> 	# Catch "Option ", "#Option " or "# Option ".
> 	regexp_options=${options//,/'\|'}
> 	regexp='^[[:space:]]*#\?[[:space:]]*\('"${regexp_options}"'\)[[:space:]]'
> 	lineno=$(set -o pipefail; grep -ne "${regexp}" -m 1 "${copy}" | cut -d : -f 1 || die)
> 	# We have found a first line with the option, now find a first
> 	# non-comment line just above the comments of the option. The
> 	# lineno - 2 is here to ignore the line just above the option
> 	# in case the comment block is separated by an empty line.
> 	lineno=$(set -o pipefail; head -n $((lineno - 2)) "${copy}" | grep -ne '^[[:space:]]*\([^#]\|$\)' | tail -n 1 | cut -d : -f 1 || die)
> 
> 	comment_options=${options//,/ or }
> 	{
> 		head -n "${lineno}" "${copy}" || die
> 		cat <<-EOF || die
> 		# Make sure that all ${comment_options} options are below this Include!
> 		Include "${EPREFIX}/${includedir}/*.conf"
> 
> 		EOF
> 		tail -n "+${lineno}" "${copy}" || die
> 	} >"${src_config}"
> 	rm -f "${copy}" || die
> }
> 
243,248c274,276
< 	cat <<-EOF >> "${ED}"/etc/ssh/ssh_config || die
< 	Include "${EPREFIX}/etc/ssh/ssh_config.d/*.conf"
< 	EOF
< 	cat <<-EOF >> "${ED}"/etc/ssh/sshd_config || die
< 	Include "${EPREFIX}/etc/ssh/sshd_config.d/*.conf"
< 	EOF
---
> 
> 	insert_include "${ED}"/etc/ssh/ssh_config 'Host,Match' '/etc/ssh/ssh_config.d'
> 	insert_include "${ED}"/etc/ssh/sshd_config 'Match' '/etc/ssh/sshd_config.d'
266a295,298
> 	# Move sshd's Subsystem option to a drop-in file.
> 	grep -ie 'subsystem' "${ED}"/etc/ssh/sshd_config >"${ED}"/etc/ssh/sshd_config.d/9999999gentoo-subsystem.conf || die
> 	sed -i -e '/[Ss]ubsystem/d' "${ED}"/etc/ssh/sshd_config
> 
291a324,327
> 
> 	local sshd_drop_ins=("${ED}"/etc/ssh/sshd_config.d/*.conf)
> 	fperms 0700 /etc/ssh/sshd_config.d
> 	fperms 0600 "${sshd_drop_ins[@]#${ED}}"

342a343,373
> insert_include() {
> 	local src_config=${1} options=${2} includedir=${3}
> 	local name copy regexp_options regexp lineno comment_options
> 
> 	name=${src_config##*/}
> 	copy="${T}/${name}"
> 	cp -a "${src_config}" "${copy}" || die
> 
> 	# Catch "Option ", "#Option " or "# Option ".
> 	regexp_options=${options//,/'\|'}
> 	regexp='^[[:space:]]*#\?[[:space:]]*\('"${regexp_options}"'\)[[:space:]]'
> 	lineno=$(set -o pipefail; grep -ne "${regexp}" -m 1 "${copy}" | cut -d : -f 1 || die)
> 	# We have found a first line with the option, now find a first
> 	# non-comment line just above the comments of the option. The
> 	# lineno - 2 is here to ignore the line just above the option
> 	# in case the comment block is separated by an empty line.
> 	lineno=$(set -o pipefail; head -n $((lineno - 2)) "${copy}" | grep -ne '^[[:space:]]*\([^#]\|$\)' | tail -n 1 | cut -d : -f 1 || die)
> 
> 	comment_options=${options//,/ or }
> 	{
> 		head -n "${lineno}" "${copy}" || die
> 		cat <<-EOF || die
> 		# Make sure that all ${comment_options} options are below this Include!
> 		Include "${EPREFIX}/${includedir}/*.conf"
> 
> 		EOF
> 		tail -n "+${lineno}" "${copy}" || die
> 	} >"${src_config}"
> 	rm -f "${copy}" || die
> }
> 
356,361c387,389
< 	cat <<-EOF >> "${ED}"/etc/ssh/ssh_config || die
< 	Include "${EPREFIX}/etc/ssh/ssh_config.d/*.conf"
< 	EOF
< 	cat <<-EOF >> "${ED}"/etc/ssh/sshd_config || die
< 	Include "${EPREFIX}/etc/ssh/sshd_config.d/*.conf"
< 	EOF
---
> 
> 	insert_include "${ED}"/etc/ssh/ssh_config 'Host,Match' '/etc/ssh/ssh_config.d'
> 	insert_include "${ED}"/etc/ssh/sshd_config 'Match' '/etc/ssh/sshd_config.d'
379a408,411
> 	# Move sshd's Subsystem option to a drop-in file.
> 	grep -ie 'subsystem' "${ED}"/etc/ssh/sshd_config >"${ED}"/etc/ssh/sshd_config.d/9999999gentoo-subsystem.conf || die
> 	sed -i -e '/[Ss]ubsystem/d' "${ED}"/etc/ssh/sshd_config
> 
404a437,440
> 
> 	local sshd_drop_ins=("${ED}"/etc/ssh/sshd_config.d/*.conf)
> 	fperms 0700 /etc/ssh/sshd_config.d
> 	fperms 0600 "${sshd_drop_ins[@]#${ED}}"

--- openssh-9.7_p1-r2.ebuild    2024-04-18 18:07:48.688948905 +0100
+++ openssh-9.7_p1-r3.ebuild    2024-05-17 15:11:57.455234035 +0100
@@ -217,15 +217,21 @@
        econf "${myconf[@]}"
 }
 
-tweak_ssh_configs() {
-       cat <<-EOF >> ssh_config.out || die
+insert_include() {
+       local file=${1} options=${2} includedir=${3}
 
-       Include "${EPREFIX}/etc/ssh/ssh_config.d/*.conf"
+       local snippet=$(cat <<-EOF || die
+       # Make sure that all ${options//,/ or } options are below this Include!
+       Include "${includedir}/*.conf"
        EOF
-       cat <<-EOF >> sshd_config.out || die
+       )
 
-       Include "${EPREFIX}/etc/ssh/sshd_config.d/*.conf"
-       EOF
+       # Catch "Option ", "#Option " or "# Option ".
+       local regexp_options=${options//,/|}
+
+       # Insert the snippet before the comment block immediately preceeding the
+       # first matching option. There may be blank lines in-between.
+       sed -i -z -r "s:\n(#[^\n]*\n)*\s*#?\s*(${regexp_options})\b:\n${snippet//$'\n'/\\n}\n\0:" "${file}" || die
 }
 
 create_config_dropins() {
@@ -258,6 +264,11 @@
        ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==
        EOF
 
+       # Move sshd's Subsystem option to a drop-in file.
+       sed -i "/[Ss]ubsystem/{
+               w ${WORKDIR}/etc/ssh/sshd_config.d/9999999gentoo-subsystem.conf
+               d }" "${S}"/sshd_config || die
+
        cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo.conf || die
        # Allow client to pass locale environment variables (bug #367017)
        AcceptEnv ${locale_vars[*]}
@@ -287,7 +298,10 @@
 
 src_compile() {
        default
-       tweak_ssh_configs
+
+       insert_include "${S}"/ssh_config 'Host,Match' "${EPREFIX}"/etc/ssh/ssh_config.d
+       insert_include "${S}"/sshd_config 'Match' "${EPREFIX}"/etc/ssh/sshd_config.d
+
        create_config_dropins
 }
 

--- openssh-9.7_p1-r3.ebuild    2024-06-10 16:02:00.897892259 +0100
+++ openssh-9.7_p1-r4.ebuild    2024-06-10 16:39:15.468810717 +0100
@@ -78,6 +78,7 @@
 PATCHES=(
        "${FILESDIR}/${PN}-9.4_p1-Allow-MAP_NORESERVE-in-sandbox-seccomp-filter-maps.patch"
        "${FILESDIR}/${PN}-9.6_p1-fix-xmss-c99.patch"
+       "${FILESDIR}/${PN}-9.7_p1-config-tweaks.patch"
 )
 
 pkg_pretend() {
@@ -217,17 +218,6 @@
        econf "${myconf[@]}"
 }
 
-tweak_ssh_configs() {
-       cat <<-EOF >> ssh_config.out || die
-
-       Include "${EPREFIX}/etc/ssh/ssh_config.d/*.conf"
-       EOF
-       cat <<-EOF >> sshd_config.out || die
-
-       Include "${EPREFIX}/etc/ssh/sshd_config.d/*.conf"
-       EOF
-}
-
 create_config_dropins() {
        local locale_vars=(
                # These are language variables that POSIX defines.
@@ -266,6 +256,11 @@
        AcceptEnv COLORTERM
        EOF
 
+       cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo-subsystem.conf || die
+       # override default of no subsystems
+       Subsystem       sftp    ${EPREFIX}/usr/libexec/sftp-server
+       EOF
+
        if use pam ; then
                cat <<-EOF > "${WORKDIR}"/etc/ssh/sshd_config.d/9999999gentoo-pam.conf || die
                UsePAM yes
@@ -287,7 +282,6 @@
 
 src_compile() {
        default
-       tweak_ssh_configs
        create_config_dropins
 }