gentoo resync : 16.06.2018

9 files changed, 50 insertions, 1192 deletions

diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest
index 2c83cbbfaa5e..f37cddb096ae 100644
--- a/net-misc/openssh/Manifest
+++ b/net-misc/openssh/Manifest
@@ -3,6 +3,7 @@ AUX openssh-7.3-mips-seccomp-n32.patch 634 BLAKE2B 12e931e6c2364d4cdd3f0d9ef8cf7
 AUX openssh-7.5_p1-CVE-2017-15906.patch 1180 BLAKE2B 37fca347fc1fa969f410d514a76b3d7133914aa14c7ef577e6eb0b2f96b936313b20635c6cc23b5e91e3643e26c899e992b82769a5df6568d058eb4f7a43fab8 SHA512 dfba25e9962e4398688d5e6f9311de44931ea5292d7d50c69d8056838ceb41ce099c44f849c204f7b421515c3aa40bde6e9b98b80b9e99aa113c222841daecd4
 AUX openssh-7.5_p1-GSSAPI-dns.patch 11137 BLAKE2B a54ed4d6f81632ae03523b7b61f750402d178d3213ec310bc0e57c0705ed67607a89a786d429599395722eaf40b2fb591c5b8de87ffc4f1dd7f6713b543c31c2 SHA512 f84e1d3fdda7a534d9351884caaefc136be7599e735200f0393db0acad03a57abe6585f9402018b50e3454e6842c3281d630120d479ff819f591c4693252dd0e
 AUX openssh-7.5_p1-cross-cache.patch 1220 BLAKE2B 7176b86024b072ff601421143f8567e4e47de3d89b1d865bc92405da75bf7c64fa50b9f746d9c494dbf64bc09e04afc1960f673e68ea1d072a5381027afea63d SHA512 03cf3b5556fcf43c7053d1550c8aa35189759a0a2274a67427b28176ba7938b8d0019992de25fb614dc556c5f45a67649bb5d2d82889ac2c37edd986fc632550
+AUX openssh-7.5_p1-disable-conch-interop-tests.patch 554 BLAKE2B f5f45c000ec26c1f783669c3447ea3c80c5c0f9b971b86ca1e79e99e906a90a519abb6b14db462f5766572e9759180719ea44f048ef5aa8efc37efb61d2b6ef7 SHA512 f35b15f1e8d0eb276d748ee14c71004c6599ddb124c33e2f84623bc9eb02bb4fd4680d25d0ba0289d6a723a526c95c9a56b30496bdaa565bae853bf3d1bab61f
 AUX openssh-7.5_p1-hpn-x509-10.2-glue.patch 2847 BLAKE2B 8a6151ab121871e4f2d93ace0e07dce1106c6841031cacfb197e00cc76fc1d0cf153aae52757dcf98a5fb89971125493d0572bd4964d0e59cb3f391fd1256aef SHA512 bc23fdf5995ae38ff166f12f64082f79a2135ca28f2240e89bee42b1e3ba39ce94467ece9ddea99173f1829b09b069dbf56a0bce7dfd1ae5f63c12f73b5ffba7
 AUX openssh-7.5_p1-s390-seccomp.patch 624 BLAKE2B 0bf595d72cd65993dde4e5aae0a3e091bb48021ef8affa84c988d55d9fe6a823b0329b6d9707c88e1556d45c304b6630ade7008f63fd649975594a75f570bb33 SHA512 058dc269eb032151e88e0ac79a0b0fd6fcd56d489e90e299ee431b1475a8f8080e8f4649244864af33e743820b081c9f90b32a1a93b8b60feeb491c0201a4d61
 AUX openssh-7.5_p1-x32-typo.patch 772 BLAKE2B 3f27d669ee76e191f2f6f7c7d86b1d9cb7297cecf17b2d88d86ef498c9ca35231adb0edc9fb811698ec86fd65527cc3fe9f2ce514836aebe5dc27bca2a3a55dc SHA512 20d19301873d4b8e908527f462f40c2f4a513d0bb89d4c7b885f9fc7eb5d483eea544eb108d87ff6aaa3d988d360c2029910c18f7125c96e8367485553f59a5e
@@ -27,20 +28,16 @@ DIST openssh-7.6_p1-sctp.patch.xz 6996 BLAKE2B 4a857afdc8fa5cb2bfb9dd1805ac6343e
 DIST openssh-7.6p1+x509-11.2.diff.gz 466657 BLAKE2B 3f4f108e2d97eb292c215bc3a6e2c64ae6b9e49704f46f46a21496a71d5ebd051ab648446bf71ef141e2114f4a03363d8cd043f5813f957c2c5f2e2eb193931d SHA512 1c0fea91037bfcaed7aa3f0cb01d262410a99d3e1b98a25a012db5d683f3275ab52f78f1e446bd7e543c78f9d406b1dce2bb3997214534ae94e11c254658080f
 DIST openssh-7.6p1-hpnssh14v12-r1.tar.xz 15440 BLAKE2B e140852a3ce63e4f744ed4b18b474cf88d09ca55509e5a16d26eef5cf8574466b472073eef56e19467932959d9ba7e941ab561d9ea0704dfee3fd08a6ba7ba8c SHA512 9d0450ec99fe550d790e471cb7815d0863788cf9c41dfef653d102f02be3d38a09e5103e537658279216a5815c1a075ded9f011e05ce216beee2c7daeea8c75a
 DIST openssh-7.6p1.tar.gz 1489788 BLAKE2B 938bfeeff0a0aaa2fc7e4c345f04561c6c071c526e354a7d344a08742cb70ab1f4a41d325b31720f2fba5c4afa4db11f3fc87055c8c9c8bea37b29cc11dc8f39 SHA512 de17fdcb8239401f76740c8d689a8761802f6df94e68d953f3c70b9f4f8bdb403617c48c1d01cc8c368d88e9d50aee540bf03d5a36687dfb39dfd28d73029d72
-DIST openssh-7.7p1-hpnssh14v14-gentoo1.patch.xz 21448 BLAKE2B 51d9324990d8098707359f355b9212679db38569e566f47659ffdae8046bdbb4e6873bd67ecb7da0b5706c5243f44f82089f08ecbc59c7e39062fceb4be78316 SHA512 63d2ffbcfe121ddedaa07955b1025d2c6e196ea694464610437368835cf46dd507d4d17361548cae93db53a1e3d93d9c409910620bbd0cd619d82b6215c833b5
 DIST openssh-7.7p1-hpnssh14v15-gentoo1.patch.xz 22060 BLAKE2B 81a7f3d1346718c154b39920c126eb0b00ae43f1369d882b8a1bd0b885668805639d869581fb49a8e7c67b61d72a904fde45841e4396af426b136d6d2f0a0dc3 SHA512 7b437bc061677aeabe561ad74bb19bc6f85369119ad8a92fb430fb5c1394c2bb3afd472ee66b285362b2041f871c56633dc94fec33cb062c6b1817d63c1d4a78
-DIST openssh-7.7p1-patches-1.0.tar.xz 8176 BLAKE2B 196b756f72bb3fccc927e31ae1b94adc3c9116de25258ac599c3653cd1234ff33f3dc608515a5ef56bea05191621974342bdb164b721c94d2c29a0de74731742 SHA512 9d56e306a5886a19d58c7a42389a82d8b912bb9250f97f64e9bf9752fc92e671539b24b0568f21072fb1ba7185e6bd1ec33511a39d26d48a699a911b910121c9
+DIST openssh-7.7p1-ldap-20180327.patch.xz 19760 BLAKE2B f316ea65de3415b9ee19a621f36c5ce7e4bda7e1fe06e9edbc1e96e9d7296facf1a59dc79822939035c333a07b04a21d33c116fb74f36f1a93ac6849a4182166 SHA512 6439057839341169f9a198b25fdcbbddd50b0db0834aa762c16fb9b9b2e6b95b4ee9b4c6ad1cf2723750aacded4e6cba7f6036cdd91cf8d5e88eb21ea83790dd
 DIST openssh-7.7p1-patches-1.1.tar.xz 16476 BLAKE2B fca2885a9e29faec40700ece37a995ba83e40bd2a6875129a5327770d8ee43663a7c063de33b4653994ed7332adb03730f613c047550d874190b95c66e2e9efa SHA512 aa5e33ce4bb4be16abf27ac1bade1dc85c51d82002be546402e0b8b0685de3ec7029f0f56bf1295ec346eb3960a6bed7cfc882722e57957a19a732f3174b3039
 DIST openssh-7.7p1-sctp-1.0.patch.xz 7380 BLAKE2B 6ad40972ece131ff148ede6ba94d63bffc606e0bcabb959d4c9056196cb6f4fddc285f97d7b49b73fde7ee84e3c981c07bddb058ad88eb7c7c2fe716e657c630 SHA512 bc5f50805ba25415f93f61b6654e5bcbaef673b0af48d339116ca9c94b6152afae294c5a9144adeb40190da97c2fc73b43e3ac7ac34feb4a647628327a7cac0a
 DIST openssh-7.7p1-x509-11.3.1.patch.xz 362672 BLAKE2B 55b8b0ef00dc4d962a0db1115406b7b1e84110870c74198e9e4cb081b2ffde8daca67cb281c69d73b4c5cbffde361429d62634be194b57e888a0b434a0f42a37 SHA512 f84744f6d2e5a15017bce37bfa65ebb47dbafeac07ea9aab46bdc780b4062ff70687512d9d512cab81e3b9c701adb6ce17c5474f35cb4b49f57db2e2d45ac9ac
 DIST openssh-7.7p1.tar.gz 1536900 BLAKE2B 7aee360f2cea5bfa3f8426fcbd66fde2568f05f9c8e623326b60f03b7c5f8abf223e178aa1d5958015b51627565bf5b1ace35b57f309638c908f5a7bf5500d21 SHA512 597252cb48209a0cb98ca1928a67e8d63e4275252f25bc37269204c108f034baade6ba0634e32ae63422fddd280f73096a6b31ad2f2e7a848dde75ca30e14261
 DIST openssh-lpk-7.5p1-0.3.14.patch.xz 17040 BLAKE2B 5b2204316dd244bb8dd11db50d5bc3a194e2cc4b64964a2d3df68bbe54c53588f15fc5176dbc3811e929573fa3e41cf91f412aa2513bb9a4b6ed02c2523c1e24 SHA512 9ce5d7e5d831c972f0f866b686bf93a048a03979ab38627973f5491eeeaa45f9faab0520b3a7ed90a13a67213fdc9cd4cf11e423acad441ea91b71037c8b435b
 DIST openssh-lpk-7.6p1-0.3.14.patch.xz 17044 BLAKE2B a31dcb15848d3a22306108a4e181b1d52b195e6adcd2a78d5c7bf57f33c8ed62c3affa434c8d31c07eae84b59f1a3968a3f2a92e702f9225b121127616cb9d61 SHA512 e9a2b18fd6a58354198b6e48199059d055451a5f09c99bf7293d0d54137a59c581a9cb3bd906f31589e03d8450fb017b9015e18c67b7b6ae840e336039436974
-EBUILD openssh-7.5_p1-r4.ebuild 11115 BLAKE2B 31bfee62343a2124e48733c4db1367fcce121d5eff25008135d2e715a34a45a176c02a5fcee99271db723d437a62d0e79297cb17df1b1ab6a12534ad2cb0c0b5 SHA512 00dbc65bf70747906f2ae5ae538579b5bd4935bae224c59ad2de92820fc64f969ca2bddc1bf0ed8924f7b6825e5665730e3fa65b5682a7f7a170233b41b73acb
-EBUILD openssh-7.6_p1-r4.ebuild 11099 BLAKE2B 975314f6b62e9191bf6300becb51f6282e52edc889407996ba640b07755dc713f28f9669e84a7f269d2be58764c561d7c2a14ff9af03ea7664794eb7f8656d9a SHA512 40276711daceea7e595a57b9805d5a4099e644650c6d2b501d581f5297bfc59bc20b325db455ce9e959d1a8d85bc25471e873177af5feadf1813f50205d6bb35
-EBUILD openssh-7.6_p1-r5.ebuild 11292 BLAKE2B 0f8a0e888c539172a72cba3fbc08727de705df525c188e71f6f3e0fc7a4f314fc18b60e2c5fa09c35953b0684dc0ab69c0413172463588deba215af2688d22b1 SHA512 5fdc1fe303b7e183da3948fb177c5963e13df98cb61f24a81f291ff67c4820dc0afd8bc9d34077a966ccf5fc9fb7ff8f936689246f54686512ec45f61e3b7a97
-EBUILD openssh-7.7_p1-r1.ebuild 14657 BLAKE2B b7539268f745f7edf9f654992a0971dd6d77c609b19f945ba3230a3901b85a675f8c951d146089efc238d66e9a0b5d38e1ab5272133e2af8aa4c7989dad8461d SHA512 e2bd77e37b10bb12350da25468a7f1733985dd375824e572a2de0df84cefdeb7bb1fda30014f9a5a3b86aa546c8419264f2b5b761a77482bf3a4fa65bf8a4e72
-EBUILD openssh-7.7_p1-r2.ebuild 15138 BLAKE2B d11f235d48f444750b33cc0964a997caf441601cde53249dea80ab060690562a596f8c1f99acc41d12bd8ecbe96aa4f3bcb328f123899de28d37667ae60d268a SHA512 833d01ce84557187c1109091ae04f3b53b6119debd412c14424219d7054f88aa6ab01644ab0ebe2beda50cec22f6c7bffbbee13091c369137aebb15542d250d9
-EBUILD openssh-7.7_p1-r3.ebuild 15119 BLAKE2B 76116b847961f3e5d57f47245a3edab2e86b81aa7906d4fd8cbc894d7f300d87fe6c9f8323821d5652d85971ec3e249a8b67568c9e4fa74550123df6f164461a SHA512 bd61079fc0731c03c57300696a7cad1ba75052139971cded7a7fe99b91d428a86350fe2979962e27a664a56957b8ee99f73131b9dc22881b40f66d417aca6ef8
-EBUILD openssh-7.7_p1-r4.ebuild 15571 BLAKE2B 43136015d7a9110d2910ad13be455cd21e469d980d20ab2abdbc09f0b3aa33d57cd191444c679eda08dd232767f6c9b45aca9f96f9cd12d4edf079a4396d1305 SHA512 e7db97cefb29d6cc5264365f85d950035ac7978ec93f0d62723f244bd8f5483e7f4c6348fc169b7e63201ff331d48b22122f134d7083fb3fd315d9e01124cfc7
+EBUILD openssh-7.5_p1-r4.ebuild 11184 BLAKE2B c6725a371359485803c89cb73b9efad9a69ed6255ff8f411574e218af71880c507567010a749c22bea5f1a12043acb01cbfe452e9aba50e0b508b737f7fb7576 SHA512 414033d873ea94e0a3f087a8739d4266bdb96b6e02702a0385f09911ee2c279666baa837048e825489478b7774126b1dafa48e1f354f50d0d6cfc73b446da286
+EBUILD openssh-7.6_p1-r5.ebuild 11361 BLAKE2B e8f1c1c092beba9ded4301c500d85b25a06ffefd854e1142a0f60c3389aa648cee54b865c8f0ffbf3a45848e5c2f26b0bafd9f0d1e3a982db0a8dd0782cd6b69 SHA512 3389c069d119242c624ff93f6f2de1e74e582f761ccf810819d77035dc77273b87b036252c3daba824e38ad9ffa854dc1c0d8c259056cdabfcd40405c5d66072
+EBUILD openssh-7.7_p1-r100.ebuild 15950 BLAKE2B 3affcb3ffafa9acc8597d77d0cb0deb738e7b954abda30524b5b331de5dee3b2a3f4a12061bbbe9c467acc30d7fbe96267be0324875be7b2ef662fe52e5c5727 SHA512 c02ad19bafa70a55ca6d3484a6341efba7f71256fe2103ea48fc3e4de399307229aadd2a79b13ad53b9ed6b79cfdeb4f678c654cfbdb6f78bfc9cc54e7505ecb
+EBUILD openssh-7.7_p1-r4.ebuild 15636 BLAKE2B 214ea3d110b66919cd6a81927136cf059ea920a75f178b36f3de1468d177218e9af25f5c8cf100265baec50999e187ad63eeb13242fcc408beb4f9c5f6f5f1ef SHA512 48814f9719a2c799e731212dbc35a8712e7dc2ae6d859ad80270c0e5d4b45b8feaf5c24961e560958839626c9855508f7684a9897199b7485ba9c533c47bc697
 MISC metadata.xml 2212 BLAKE2B 889550b17d2ba8072686ca5f398c64946fc04721fd7093c88fd7c1c5c7e4610fb01964f8e3d78e20cd0e9b9343895439772fee43b5635db893f3fc13ae9437cb SHA512 958845fbdfb4f1d267fdbc3a005c6338da54c6a0715180a1982416a841ab4865c536de5f10bb8493d07830e182786d0c3f2ac710c9168434b3d077a59ed2ddd5
diff --git a/net-misc/openssh/files/openssh-7.5_p1-disable-conch-interop-tests.patch b/net-misc/openssh/files/openssh-7.5_p1-disable-conch-interop-tests.patch
new file mode 100644
index 000000000000..a5647ce9d8d3
--- /dev/null
+++ b/net-misc/openssh/files/openssh-7.5_p1-disable-conch-interop-tests.patch
@@ -0,0 +1,20 @@
+Disable conch interop tests which are failing when called
+via portage for yet unknown reason and because using conch
+seems to be flaky (test is failing when using Python2 but
+passing when using Python3).
+
+Bug: https://bugs.gentoo.org/605446
+
+--- a/regress/conch-ciphers.sh
++++ b/regress/conch-ciphers.sh
+@@ -3,6 +3,10 @@
+ 
+ tid="conch ciphers"
+ 
++# https://bugs.gentoo.org/605446
++echo "conch interop tests skipped due to Gentoo bug #605446"
++exit 0
++
+ if test "x$REGRESS_INTEROP_CONCH" != "xyes" ; then
+ 	echo "conch interop tests not enabled"
+ 	exit 0
diff --git a/net-misc/openssh/openssh-7.5_p1-r4.ebuild b/net-misc/openssh/openssh-7.5_p1-r4.ebuild
index 5574b9b318ca..3deb8a130f70 100644
--- a/net-misc/openssh/openssh-7.5_p1-r4.ebuild
+++ b/net-misc/openssh/openssh-7.5_p1-r4.ebuild
@@ -130,6 +130,7 @@ src_prepare() {
 
 	epatch "${FILESDIR}"/${PN}-7.5_p1-GSSAPI-dns.patch #165444 integrated into gsskex
 	epatch "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
+	epatch "${FILESDIR}"/${PN}-7.5_p1-disable-conch-interop-tests.patch
 	epatch "${FILESDIR}"/${PN}-7.5_p1-cross-cache.patch
 	epatch "${FILESDIR}"/${PN}-7.5_p1-CVE-2017-15906.patch
 	use X509 || epatch "${FILESDIR}"/${PN}-7.5_p1-s390-seccomp.patch # already included in X509 patch set, #644252
diff --git a/net-misc/openssh/openssh-7.6_p1-r4.ebuild b/net-misc/openssh/openssh-7.6_p1-r4.ebuild
deleted file mode 100644
index 01600c378d29..000000000000
--- a/net-misc/openssh/openssh-7.6_p1-r4.ebuild
+++ /dev/null
@@ -1,335 +0,0 @@
-# Copyright 1999-2018 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=6
-
-inherit user flag-o-matic multilib autotools pam systemd versionator
-
-# Make it more portable between straight releases
-# and _p? releases.
-PARCH=${P/_}
-
-HPN_PATCH="${PARCH}-hpnssh14v12-r1.tar.xz"
-SCTP_PATCH="${PN}-7.6_p1-sctp.patch.xz"
-LDAP_PATCH="${PN}-lpk-7.6p1-0.3.14.patch.xz"
-X509_VER="11.2" X509_PATCH="${PN}-${PV/_}+x509-${X509_VER}.diff.gz"
-
-DESCRIPTION="Port of OpenBSD's free SSH release"
-HOMEPAGE="http://www.openssh.org/"
-SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
-	${SCTP_PATCH:+https://dev.gentoo.org/~polynomial-c/${SCTP_PATCH}}
-	${HPN_PATCH:+hpn? ( https://dev.gentoo.org/~chutzpah/${HPN_PATCH} )}
-	${LDAP_PATCH:+ldap? ( https://dev.gentoo.org/~polynomial-c/${LDAP_PATCH} )}
-	${X509_PATCH:+X509? ( https://dev.gentoo.org/~chutzpah/${X509_PATCH} )}
-	"
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey +ssl static test X X509"
-REQUIRED_USE="ldns? ( ssl )
-	pie? ( !static )
-	static? ( !kerberos !pam )
-	X509? ( !ldap !sctp ssl )
-	test? ( ssl )"
-
-LIB_DEPEND="
-	audit? ( sys-process/audit[static-libs(+)] )
-	ldns? (
-		net-libs/ldns[static-libs(+)]
-		!bindist? ( net-libs/ldns[ecdsa,ssl(+)] )
-		bindist? ( net-libs/ldns[-ecdsa,ssl(+)] )
-	)
-	libedit? ( dev-libs/libedit:=[static-libs(+)] )
-	sctp? ( net-misc/lksctp-tools[static-libs(+)] )
-	selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
-	skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] )
-	ssl? (
-		!libressl? (
-			>=dev-libs/openssl-1.0.1:0=[bindist=]
-			dev-libs/openssl:0=[static-libs(+)]
-		)
-		libressl? ( dev-libs/libressl:0=[static-libs(+)] )
-	)
-	>=sys-libs/zlib-1.2.3:=[static-libs(+)]"
-RDEPEND="
-	!static? ( ${LIB_DEPEND//\[static-libs(+)]} )
-	pam? ( virtual/pam )
-	kerberos? ( virtual/krb5 )
-	ldap? ( net-nds/openldap )"
-DEPEND="${RDEPEND}
-	static? ( ${LIB_DEPEND} )
-	virtual/pkgconfig
-	virtual/os-headers
-	sys-devel/autoconf"
-RDEPEND="${RDEPEND}
-	pam? ( >=sys-auth/pambase-20081028 )
-	userland_GNU? ( virtual/shadow )
-	X? ( x11-apps/xauth )"
-
-S="${WORKDIR}/${PARCH}"
-
-pkg_pretend() {
-	# this sucks, but i'd rather have people unable to `emerge -u openssh`
-	# than not be able to log in to their server any more
-	maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
-	local fail="
-		$(use X509 && maybe_fail X509 X509_PATCH)
-		$(use ldap && maybe_fail ldap LDAP_PATCH)
-		$(use hpn && maybe_fail hpn HPN_PATCH)
-	"
-	fail=$(echo ${fail})
-	if [[ -n ${fail} ]] ; then
-		eerror "Sorry, but this version does not yet support features"
-		eerror "that you requested:	 ${fail}"
-		eerror "Please mask ${PF} for now and check back later:"
-		eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
-		die "booooo"
-	fi
-
-	# Make sure people who are using tcp wrappers are notified of its removal. #531156
-	if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
-		ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
-		ewarn "you're trying to use it.  Update your ${EROOT}etc/hosts.{allow,deny} please."
-	fi
-}
-
-save_version() {
-	# version.h patch conflict avoidence
-	mv version.h version.h.$1
-	cp -f version.h.pristine version.h
-}
-
-src_prepare() {
-	sed -i \
-		-e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
-		pathnames.h || die
-	# keep this as we need it to avoid the conflict between LPK and HPN changing
-	# this file.
-	cp version.h version.h.pristine
-
-	eapply "${FILESDIR}/${P}-warnings.patch"
-
-	# don't break .ssh/authorized_keys2 for fun
-	sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
-
-	if use X509 ; then
-		if use hpn ; then
-			pushd "${WORKDIR}" >/dev/null
-			eapply "${FILESDIR}"/${P}-hpn-x509-${X509_VER}-glue.patch
-			popd >/dev/null
-			save_version X509
-		fi
-		eapply "${WORKDIR}"/${X509_PATCH%.*}
-	fi
-
-	if use ldap ; then
-		eapply "${WORKDIR}"/${LDAP_PATCH%.*}
-		save_version LPK
-	fi
-
-	eapply "${FILESDIR}"/${PN}-7.5_p1-GSSAPI-dns.patch #165444 integrated into gsskex
-	eapply "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
-	use X509 || eapply "${WORKDIR}"/${SCTP_PATCH%.*}
-	use abi_mips_n32 && eapply "${FILESDIR}"/${PN}-7.3-mips-seccomp-n32.patch
-
-	if use hpn ; then
-		elog "Applying HPN patchset ..."
-		eapply "${WORKDIR}"/${HPN_PATCH%.*.*}
-		save_version HPN
-	fi
-
-	tc-export PKG_CONFIG
-	local sed_args=(
-		-e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
-		# Disable PATH reset, trust what portage gives us #254615
-		-e 's:^PATH=/:#PATH=/:'
-		# Disable fortify flags ... our gcc does this for us
-		-e 's:-D_FORTIFY_SOURCE=2::'
-	)
-	# The -ftrapv flag ICEs on hppa #505182
-	use hppa && sed_args+=(
-		-e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
-		-e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
-	)
-	# _XOPEN_SOURCE causes header conflicts on Solaris
-	[[ ${CHOST} == *-solaris* ]] && sed_args+=(
-		-e 's/-D_XOPEN_SOURCE//'
-	)
-	sed -i "${sed_args[@]}" configure{.ac,} || die
-
-	eapply_user #473004
-
-	# Now we can build a sane merged version.h
-	(
-		sed '/^#define SSH_RELEASE/d' version.h.* | sort -u
-		macros=()
-		for p in HPN LPK X509; do [[ -e version.h.${p} ]] && macros+=( SSH_${p} ) ; done
-		printf '#define SSH_RELEASE SSH_VERSION SSH_PORTABLE %s\n' "${macros[*]}"
-	) > version.h
-
-	eautoreconf
-}
-
-src_configure() {
-	addwrite /dev/ptmx
-
-	use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
-	use static && append-ldflags -static
-
-	local myconf=(
-		--with-ldflags="${LDFLAGS}"
-		--disable-strip
-		--with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
-		--sysconfdir="${EPREFIX}"/etc/ssh
-		--libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
-		--datadir="${EPREFIX}"/usr/share/openssh
-		--with-privsep-path="${EPREFIX}"/var/empty
-		--with-privsep-user=sshd
-		$(use_with audit audit linux)
-		$(use_with kerberos kerberos5 "${EPREFIX}"/usr)
-		# We apply the ldap patch conditionally, so can't pass --without-ldap
-		# unconditionally else we get unknown flag warnings.
-		$(use ldap && use_with ldap)
-		$(use_with ldns)
-		$(use_with libedit)
-		$(use_with pam)
-		$(use_with pie)
-		$(use X509 || use_with sctp)
-		$(use_with selinux)
-		$(use_with skey)
-		$(use_with ssl openssl)
-		$(use_with ssl md5-passwords)
-		$(use_with ssl ssl-engine)
-	)
-
-	# The seccomp sandbox is broken on x32, so use the older method for now. #553748
-	use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
-
-	econf "${myconf[@]}"
-}
-
-src_install() {
-	emake install-nokeys DESTDIR="${D}"
-	fperms 600 /etc/ssh/sshd_config
-	dobin contrib/ssh-copy-id
-	newinitd "${FILESDIR}"/sshd.rc6.4 sshd
-	newconfd "${FILESDIR}"/sshd.confd sshd
-
-	newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
-	if use pam ; then
-		sed -i \
-			-e "/^#UsePAM /s:.*:UsePAM yes:" \
-			-e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
-			-e "/^#PrintMotd /s:.*:PrintMotd no:" \
-			-e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
-			"${ED}"/etc/ssh/sshd_config || die
-	fi
-
-	# Gentoo tweaks to default config files
-	cat <<-EOF >> "${ED}"/etc/ssh/sshd_config
-
-	# Allow client to pass locale environment variables #367017
-	AcceptEnv LANG LC_*
-	EOF
-	cat <<-EOF >> "${ED}"/etc/ssh/ssh_config
-
-	# Send locale environment variables #367017
-	SendEnv LANG LC_*
-	EOF
-
-	if use livecd ; then
-		sed -i \
-			-e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
-			"${ED}"/etc/ssh/sshd_config || die
-	fi
-
-	if ! use X509 && [[ -n ${LDAP_PATCH} ]] && use ldap ; then
-		insinto /etc/openldap/schema/
-		newins openssh-lpk_openldap.schema openssh-lpk.schema
-	fi
-
-	doman contrib/ssh-copy-id.1
-	dodoc CREDITS OVERVIEW README* TODO sshd_config
-	use X509 || dodoc ChangeLog
-
-	diropts -m 0700
-	dodir /etc/skel/.ssh
-
-	systemd_dounit "${FILESDIR}"/sshd.{service,socket}
-	systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
-}
-
-src_test() {
-	local t skipped=() failed=() passed=()
-	local tests=( interop-tests compat-tests )
-
-	local shell=$(egetshell "${UID}")
-	if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
-		elog "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
-		elog "user, so we will run a subset only."
-		skipped+=( tests )
-	else
-		tests+=( tests )
-	fi
-
-	# It will also attempt to write to the homedir .ssh.
-	local sshhome=${T}/homedir
-	mkdir -p "${sshhome}"/.ssh
-	for t in "${tests[@]}" ; do
-		# Some tests read from stdin ...
-		HOMEDIR="${sshhome}" HOME="${sshhome}" \
-		emake -k -j1 ${t} </dev/null \
-			&& passed+=( "${t}" ) \
-			|| failed+=( "${t}" )
-	done
-
-	einfo "Passed tests: ${passed[*]}"
-	[[ ${#skipped[@]} -gt 0 ]] && ewarn "Skipped tests: ${skipped[*]}"
-	[[ ${#failed[@]}  -gt 0 ]] && die "Some tests failed: ${failed[*]}"
-}
-
-pkg_preinst() {
-	enewgroup sshd 22
-	enewuser sshd 22 -1 /var/empty sshd
-}
-
-pkg_postinst() {
-	if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then
-		elog "Starting with openssh-5.8p1, the server will default to a newer key"
-		elog "algorithm (ECDSA).  You are encouraged to manually update your stored"
-		elog "keys list as servers update theirs.  See ssh-keyscan(1) for more info."
-	fi
-	if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then
-		elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
-		elog "Make sure to update any configs that you might have.  Note that xinetd might"
-		elog "be an alternative for you as it supports USE=tcpd."
-	fi
-	if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518
-		elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
-		elog "weak sizes.  If you rely on these key types, you can re-enable the key types by"
-		elog "adding to your sshd_config or ~/.ssh/config files:"
-		elog "	PubkeyAcceptedKeyTypes=+ssh-dss"
-		elog "You should however generate new keys using rsa or ed25519."
-
-		elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
-		elog "to 'prohibit-password'.  That means password auth for root users no longer works"
-		elog "out of the box.  If you need this, please update your sshd_config explicitly."
-	fi
-	if has_version "<${CATEGORY}/${PN}-7.6_p1" ; then
-		elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
-		elog "Furthermore, rsa keys with less than 1024 bits will be refused."
-	fi
-	if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then
-		elog "Be aware that by disabling openssl support in openssh, the server and clients"
-		elog "no longer support dss/rsa/ecdsa keys.  You will need to generate ed25519 keys"
-		elog "and update all clients/servers that utilize them."
-	fi
-
-	# remove this if aes-ctr-mt gets fixed
-	if use hpn; then
-		elog "The multithreaded AES-CTR cipher has been temporarily dropped from the HPN patch"
-		elog "set since it does not (yet) work with >=openssh-7.6p1."
-	fi
-}
diff --git a/net-misc/openssh/openssh-7.6_p1-r5.ebuild b/net-misc/openssh/openssh-7.6_p1-r5.ebuild
index 46f1d676f5f3..4c84767d1169 100644
--- a/net-misc/openssh/openssh-7.6_p1-r5.ebuild
+++ b/net-misc/openssh/openssh-7.6_p1-r5.ebuild
@@ -111,6 +111,7 @@ src_prepare() {
 
 	eapply "${FILESDIR}/${P}-warnings.patch"
 	eapply "${FILESDIR}/${P}-permitopen.patch"
+	eapply "${FILESDIR}"/${PN}-7.5_p1-disable-conch-interop-tests.patch
 
 	# don't break .ssh/authorized_keys2 for fun
 	sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
diff --git a/net-misc/openssh/openssh-7.7_p1-r1.ebuild b/net-misc/openssh/openssh-7.7_p1-r1.ebuild
deleted file mode 100644
index cfcfc30327fc..000000000000
--- a/net-misc/openssh/openssh-7.7_p1-r1.ebuild
+++ /dev/null
@@ -1,414 +0,0 @@
-# Copyright 1999-2018 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=6
-
-inherit user flag-o-matic multilib autotools pam systemd versionator
-
-# Make it more portable between straight releases
-# and _p? releases.
-PARCH=${P/_}
-
-HPN_VER="14v14-gentoo1" HPN_PATCH="${PARCH}-hpnssh${HPN_VER}.patch.xz" HPN_DISABLE_MTAES=1
-SCTP_VER="1.0" SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
-X509_VER="11.3.1" X509_PATCH="${PARCH}-x509-${X509_VER}.patch.xz"
-
-# Disable LDAP support until someone will rewrite the patch,
-# upstream removed auth_parse_options() via commit 7c856857607112a3dfe6414696bf4c7ab7fb0cb3
-#LDAP_VER="0.3.14" LDAP_PATCH="${PN}-lpk-7.7p1-${LDAP_VER}.patch.xz"
-
-DESCRIPTION="Port of OpenBSD's free SSH release"
-HOMEPAGE="https://www.openssh.com/"
-SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
-	${SCTP_PATCH:+sctp? ( https://dev.gentoo.org/~whissi/dist/openssh/${SCTP_PATCH} )}
-	${HPN_PATCH:+hpn? ( https://dev.gentoo.org/~whissi/dist/openssh/${HPN_PATCH} )}
-	${LDAP_PATCH:+ldap? ( https://dev.gentoo.org/~whissi/dist/openssh/${LDAP_PATCH} )}
-	${X509_PATCH:+X509? ( https://dev.gentoo.org/~whissi/dist/openssh/${X509_PATCH} )}
-	"
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey +ssl static test X X509"
-REQUIRED_USE="ldns? ( ssl )
-	pie? ( !static )
-	static? ( !kerberos !pam )
-	X509? ( !ldap !sctp ssl )
-	test? ( ssl )"
-
-LIB_DEPEND="
-	audit? ( sys-process/audit[static-libs(+)] )
-	ldns? (
-		net-libs/ldns[static-libs(+)]
-		!bindist? ( net-libs/ldns[ecdsa,ssl(+)] )
-		bindist? ( net-libs/ldns[-ecdsa,ssl(+)] )
-	)
-	libedit? ( dev-libs/libedit:=[static-libs(+)] )
-	sctp? ( net-misc/lksctp-tools[static-libs(+)] )
-	selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
-	skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] )
-	ssl? (
-		!libressl? (
-			>=dev-libs/openssl-1.0.1:0=[bindist=]
-			dev-libs/openssl:0=[static-libs(+)]
-		)
-		libressl? ( dev-libs/libressl:0=[static-libs(+)] )
-	)
-	>=sys-libs/zlib-1.2.3:=[static-libs(+)]"
-RDEPEND="
-	!static? ( ${LIB_DEPEND//\[static-libs(+)]} )
-	pam? ( virtual/pam )
-	kerberos? ( virtual/krb5 )
-	ldap? ( net-nds/openldap )"
-DEPEND="${RDEPEND}
-	static? ( ${LIB_DEPEND} )
-	virtual/pkgconfig
-	virtual/os-headers
-	sys-devel/autoconf"
-RDEPEND="${RDEPEND}
-	pam? ( >=sys-auth/pambase-20081028 )
-	userland_GNU? ( virtual/shadow )
-	X? ( x11-apps/xauth )"
-
-S="${WORKDIR}/${PARCH}"
-
-pkg_pretend() {
-	# this sucks, but i'd rather have people unable to `emerge -u openssh`
-	# than not be able to log in to their server any more
-	maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
-	local fail="
-		$(use hpn && maybe_fail hpn HPN_PATCH)
-		$(use ldap && maybe_fail ldap LDAP_PATCH)
-		$(use sctp && maybe_fail sctp SCTP_PATCH)
-		$(use X509 && maybe_fail X509 X509_PATCH)
-	"
-	fail=$(echo ${fail})
-	if [[ -n ${fail} ]] ; then
-		eerror "Sorry, but this version does not yet support features"
-		eerror "that you requested:	 ${fail}"
-		eerror "Please mask ${PF} for now and check back later:"
-		eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
-		die "booooo"
-	fi
-
-	# Make sure people who are using tcp wrappers are notified of its removal. #531156
-	if grep -qs '^ *sshd *:' "${EROOT%/}"/etc/hosts.{allow,deny} ; then
-		ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
-		ewarn "you're trying to use it.  Update your ${EROOT}etc/hosts.{allow,deny} please."
-	fi
-}
-
-src_prepare() {
-	sed -i \
-		-e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX%/}/usr/bin/xauth:" \
-		pathnames.h || die
-
-	# don't break .ssh/authorized_keys2 for fun
-	sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
-
-	eapply "${FILESDIR}"/${PN}-7.7_p1-GSSAPI-dns.patch #165444 integrated into gsskex
-	eapply "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
-
-	local PATCHSET_VERSION_MACROS=()
-
-	if use X509 ; then
-		eapply "${WORKDIR}"/${X509_PATCH%.*}
-
-		# We need to patch package version or any X.509 sshd will reject our ssh client
-		# with "userauth_pubkey: could not parse key: string is too large [preauth]"
-		# error
-		einfo "Patching package version for X.509 patch set ..."
-		sed -i \
-			-e "s/^AC_INIT(\[OpenSSH\], \[Portable\]/AC_INIT([OpenSSH], [${X509_VER}]/" \
-			"${S}"/configure.ac || die "Failed to patch package version for X.509 patch"
-
-		einfo "Patching version.h to expose X.509 patch set ..."
-		sed -i \
-			-e "/^#define SSH_PORTABLE.*/a #define SSH_X509               \"-PKIXSSH-${X509_VER}\"" \
-			"${S}"/version.h || die "Failed to sed-in X.509 patch version"
-		PATCHSET_VERSION_MACROS+=( 'SSH_X509' )
-
-		einfo "Disabling broken X.509 agent test ..."
-		sed -i \
-			-e "/^ agent$/d" \
-			"${S}"/tests/CA/config || die "Failed to disable broken X.509 agent test"
-	fi
-
-	if use ldap ; then
-		eapply "${WORKDIR}"/${LDAP_PATCH%.*}
-
-		einfo "Patching version.h to expose LDAP patch set ..."
-		sed -i \
-			-e "/^#define SSH_PORTABLE.*/a #define SSH_LDAP               \"-ldap-${LDAP_VER}\"" \
-			"${S}"/version.h || die "Failed to sed-in LDAP patch version"
-		PATCHSET_VERSION_MACROS+=( 'SSH_LDAP' )
-	fi
-
-	if use sctp ; then
-		eapply "${WORKDIR}"/${SCTP_PATCH%.*}
-
-		einfo "Patching version.h to expose SCTP patch set ..."
-		sed -i \
-			-e "/^#define SSH_PORTABLE/a #define SSH_SCTP        \"-sctp-${SCTP_VER}\"" \
-			"${S}"/version.h || die "Failed to sed-in SCTP patch version"
-		PATCHSET_VERSION_MACROS+=( 'SSH_SCTP' )
-
-		einfo "Disabling know failing test (cfgparse) caused by SCTP patch ..."
-		sed -i \
-			-e "/\t\tcfgparse \\\/d" \
-			"${S}"/regress/Makefile || die "Failed to disable known failing test (cfgparse) caused by SCTP patch"
-	fi
-
-	if use hpn ; then
-		eapply "${WORKDIR}"/${HPN_PATCH%.*}
-
-		einfo "Patching Makefile.in for HPN patch set ..."
-		sed -i \
-			-e "/^LIBS=/ s/\$/ -lpthread/" \
-			"${S}"/Makefile.in || die "Failed to patch Makefile.in"
-
-		einfo "Patching version.h to expose HPN patch set ..."
-		sed -i \
-			-e "/^#define SSH_PORTABLE/a #define SSH_HPN         \"-hpn${HPN_VER}\"" \
-			"${S}"/version.h || die "Failed to sed-in HPN patch version"
-		PATCHSET_VERSION_MACROS+=( 'SSH_HPN' )
-
-		if [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
-			einfo "Disabling known non-working MT AES cipher per default ..."
-
-			cat > "${T}"/disable_mtaes.conf <<- EOF
-			
-			# HPN's Multi-Threaded AES CTR cipher is currently known to be broken
-			# and therefore disabled per default.
-			DisableMTAES yes
-			EOF
-			sed -i \
-				-e "/^#HPNDisabled.*/r ${T}/disable_mtaes.conf" \
-				"${S}"/sshd_config || die "Failed to disabled MT AES ciphers in sshd_config"
-
-			sed -i \
-				-e "/AcceptEnv.*_XXX_TEST$/a \\\tDisableMTAES\t\tyes" \
-				"${S}"/regress/test-exec.sh || die "Failed to disable MT AES ciphers in test config"
-		fi
-	fi
-
-	if use X509 || use hpn ; then
-		einfo "Patching packet.c for X509 and/or HPN patch set ..."
-		sed -i \
-			-e "s/const struct sshcipher/struct sshcipher/" \
-			"${S}"/packet.c || die "Failed to patch ssh_packet_set_connection() (packet.c)"
-	fi
-
-	if use X509 || use sctp || use ldap || use hpn ; then
-		einfo "Patching sshconnect.c to use SSH_RELEASE in send_client_banner() ..."
-		sed -i \
-			-e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
-			"${S}"/sshconnect.c || die "Failed to patch send_client_banner() to use SSH_RELEASE (sshconnect.c)"
-
-		einfo "Patching sshd.c to use SSH_RELEASE in sshd_exchange_identification() ..."
-		sed -i \
-			-e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
-			"${S}"/sshd.c || die "Failed to patch sshd_exchange_identification() to use SSH_RELEASE (sshd.c)"
-
-		einfo "Patching version.h to add our patch sets to SSH_RELEASE ..."
-		sed -i \
-			-e "s/^#define SSH_RELEASE.*/#define SSH_RELEASE     SSH_VERSION SSH_PORTABLE ${PATCHSET_VERSION_MACROS[*]}/" \
-			"${S}"/version.h || die "Failed to patch SSH_RELEASE (version.h)"
-	fi
-
-	eapply_user #473004
-
-	tc-export PKG_CONFIG
-	local sed_args=(
-		-e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
-		# Disable PATH reset, trust what portage gives us #254615
-		-e 's:^PATH=/:#PATH=/:'
-		# Disable fortify flags ... our gcc does this for us
-		-e 's:-D_FORTIFY_SOURCE=2::'
-	)
-
-	# The -ftrapv flag ICEs on hppa #505182
-	use hppa && sed_args+=(
-		-e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
-		-e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
-	)
-	# _XOPEN_SOURCE causes header conflicts on Solaris
-	[[ ${CHOST} == *-solaris* ]] && sed_args+=(
-		-e 's/-D_XOPEN_SOURCE//'
-	)
-	sed -i "${sed_args[@]}" configure{.ac,} || die
-
-	eautoreconf
-}
-
-src_configure() {
-	addwrite /dev/ptmx
-
-	use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
-	use static && append-ldflags -static
-
-	local myconf=(
-		--with-ldflags="${LDFLAGS}"
-		--disable-strip
-		--with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
-		--sysconfdir="${EPREFIX%/}"/etc/ssh
-		--libexecdir="${EPREFIX%/}"/usr/$(get_libdir)/misc
-		--datadir="${EPREFIX%/}"/usr/share/openssh
-		--with-privsep-path="${EPREFIX%/}"/var/empty
-		--with-privsep-user=sshd
-		$(use_with audit audit linux)
-		$(use_with kerberos kerberos5 "${EPREFIX%/}"/usr)
-		# We apply the ldap and sctp patch conditionally, so can't pass --without-{ldap,sctp}
-		# unconditionally else we get unknown flag warnings.
-		$(use ldap && use_with ldap)
-		$(use sctp && use_with sctp)
-		$(use_with ldns)
-		$(use_with libedit)
-		$(use_with pam)
-		$(use_with pie)
-		$(use_with selinux)
-		$(use_with skey)
-		$(use_with ssl openssl)
-		$(use_with ssl md5-passwords)
-		$(use_with ssl ssl-engine)
-	)
-
-	# The seccomp sandbox is broken on x32, so use the older method for now. #553748
-	use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
-
-	econf "${myconf[@]}"
-}
-
-src_test() {
-	local t skipped=() failed=() passed=()
-	local tests=( interop-tests compat-tests )
-
-	local shell=$(egetshell "${UID}")
-	if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
-		elog "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
-		elog "user, so we will run a subset only."
-		skipped+=( tests )
-	else
-		tests+=( tests )
-	fi
-
-	# It will also attempt to write to the homedir .ssh.
-	local sshhome=${T}/homedir
-	mkdir -p "${sshhome}"/.ssh
-	for t in "${tests[@]}" ; do
-		# Some tests read from stdin ...
-		HOMEDIR="${sshhome}" HOME="${sshhome}" \
-		emake -k -j1 ${t} </dev/null \
-			&& passed+=( "${t}" ) \
-			|| failed+=( "${t}" )
-	done
-
-	einfo "Passed tests: ${passed[*]}"
-	[[ ${#skipped[@]} -gt 0 ]] && ewarn "Skipped tests: ${skipped[*]}"
-	[[ ${#failed[@]}  -gt 0 ]] && die "Some tests failed: ${failed[*]}"
-}
-
-src_install() {
-	emake install-nokeys DESTDIR="${D}"
-	fperms 600 /etc/ssh/sshd_config
-	dobin contrib/ssh-copy-id
-	newinitd "${FILESDIR}"/sshd.rc6.5 sshd
-	newconfd "${FILESDIR}"/sshd-r1.confd sshd
-
-	newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
-	if use pam ; then
-		sed -i \
-			-e "/^#UsePAM /s:.*:UsePAM yes:" \
-			-e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
-			-e "/^#PrintMotd /s:.*:PrintMotd no:" \
-			-e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
-			"${ED%/}"/etc/ssh/sshd_config || die
-	fi
-
-	# Gentoo tweaks to default config files
-	cat <<-EOF >> "${ED%/}"/etc/ssh/sshd_config
-
-	# Allow client to pass locale environment variables #367017
-	AcceptEnv LANG LC_*
-	EOF
-	cat <<-EOF >> "${ED%/}"/etc/ssh/ssh_config
-
-	# Send locale environment variables #367017
-	SendEnv LANG LC_*
-	EOF
-
-	if use livecd ; then
-		sed -i \
-			-e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
-			"${ED%/}"/etc/ssh/sshd_config || die
-	fi
-
-	if use ldap && [[ -n ${LDAP_PATCH} ]] ; then
-		insinto /etc/openldap/schema/
-		newins openssh-lpk_openldap.schema openssh-lpk.schema
-	fi
-
-	doman contrib/ssh-copy-id.1
-	dodoc CREDITS OVERVIEW README* TODO sshd_config
-	use hpn && dodoc HPN-README
-	use X509 || dodoc ChangeLog
-
-	diropts -m 0700
-	dodir /etc/skel/.ssh
-
-	keepdir /var/empty
-
-	systemd_dounit "${FILESDIR}"/sshd.{service,socket}
-	systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
-}
-
-pkg_preinst() {
-	enewgroup sshd 22
-	enewuser sshd 22 -1 /var/empty sshd
-}
-
-pkg_postinst() {
-	if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then
-		elog "Starting with openssh-5.8p1, the server will default to a newer key"
-		elog "algorithm (ECDSA).  You are encouraged to manually update your stored"
-		elog "keys list as servers update theirs.  See ssh-keyscan(1) for more info."
-	fi
-	if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then
-		elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
-		elog "Make sure to update any configs that you might have.  Note that xinetd might"
-		elog "be an alternative for you as it supports USE=tcpd."
-	fi
-	if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518
-		elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
-		elog "weak sizes.  If you rely on these key types, you can re-enable the key types by"
-		elog "adding to your sshd_config or ~/.ssh/config files:"
-		elog "	PubkeyAcceptedKeyTypes=+ssh-dss"
-		elog "You should however generate new keys using rsa or ed25519."
-
-		elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
-		elog "to 'prohibit-password'.  That means password auth for root users no longer works"
-		elog "out of the box.  If you need this, please update your sshd_config explicitly."
-	fi
-	if has_version "<${CATEGORY}/${PN}-7.6_p1" ; then
-		elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
-		elog "Furthermore, rsa keys with less than 1024 bits will be refused."
-	fi
-	if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then
-		elog "Be aware that by disabling openssl support in openssh, the server and clients"
-		elog "no longer support dss/rsa/ecdsa keys.  You will need to generate ed25519 keys"
-		elog "and update all clients/servers that utilize them."
-	fi
-
-	if use hpn && [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
-		elog ""
-		elog "HPN's multi-threaded AES CTR cipher is currently known to be broken"
-		elog "and therefore disabled at runtime per default."
-		elog "Make sure your sshd_config is up to date and contains"
-		elog ""
-		elog "  DisableMTAES yes"
-		elog ""
-		elog "Otherwise you maybe unable to connect to this sshd using any AES CTR cipher."
-		elog ""
-	fi
-}
diff --git a/net-misc/openssh/openssh-7.7_p1-r3.ebuild b/net-misc/openssh/openssh-7.7_p1-r100.ebuild
index b06772ba1b8c..8aa36a58819a 100644
--- a/net-misc/openssh/openssh-7.7_p1-r3.ebuild
+++ b/net-misc/openssh/openssh-7.7_p1-r100.ebuild
@@ -12,12 +12,9 @@ PARCH=${P/_}
 HPN_VER="14v15-gentoo1" HPN_PATCH="${PARCH}-hpnssh${HPN_VER}.patch.xz"
 SCTP_VER="1.0" SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
 X509_VER="11.3.1" X509_PATCH="${PARCH}-x509-${X509_VER}.patch.xz"
+LDAP_VER="20180327" LDAP_PATCH="${PARCH}-ldap-${LDAP_VER}.patch.xz"
 
-# Disable LDAP support until someone will rewrite the patch,
-# upstream removed auth_parse_options() via commit 7c856857607112a3dfe6414696bf4c7ab7fb0cb3
-#LDAP_VER="0.3.14" LDAP_PATCH="${PN}-lpk-7.7p1-${LDAP_VER}.patch.xz"
-
-PATCH_SET="openssh-7.7p1-patches-1.0"
+PATCH_SET="openssh-7.7p1-patches-1.1"
 
 DESCRIPTION="Port of OpenBSD's free SSH release"
 HOMEPAGE="https://www.openssh.com/"
@@ -31,7 +28,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
 
 LICENSE="BSD GPL-2"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
 # Probably want to drop ssl defaulting to on in a future version.
 IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey +ssl static test X X509"
 REQUIRED_USE="ldns? ( ssl )
@@ -112,6 +109,7 @@ src_prepare() {
 
 	eapply "${FILESDIR}"/${PN}-7.7_p1-GSSAPI-dns.patch #165444 integrated into gsskex
 	eapply "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
+	eapply "${FILESDIR}"/${PN}-7.5_p1-disable-conch-interop-tests.patch
 
 	local PATCHSET_VERSION_MACROS=()
 
@@ -140,9 +138,17 @@ src_prepare() {
 		# The following patches don't apply on top of X509 patch
 		rm "${WORKDIR}"/patch/2002_all_openssh-7.7p1_upstream_bug2840.patch || die
 		rm "${WORKDIR}"/patch/2009_all_openssh-7.7p1_make-shell-tests-portable.patch || die
+		rm "${WORKDIR}"/patch/2016_all_openssh-7.7p1_implement-EMFILE-mitigation-for-ssh-agent.patch || die
+		rm "${WORKDIR}"/patch/2025_all_openssh-7.7p1_prefer-argv0-to-ssh-when-re-executing-ssh-for-proxyjump.patch || die
+	else
+		rm "${WORKDIR}"/patch/2016_all_openssh-7.7p1-X509_implement-EMFILE-mitigation-for-ssh-agent.patch || die
+		rm "${WORKDIR}"/patch/2025_all_openssh-7.7p1-X509_prefer-argv0-to-ssh-when-re-executing-ssh-for-proxyjump.patch || die
 	fi
 
 	if use ldap ; then
+		sed -i \
+			-e "s/ -lfipscheck//" \
+			"${WORKDIR}"/${LDAP_PATCH%.*} || die "Failed to remove fipscheck from LDAP patch"
 		eapply "${WORKDIR}"/${LDAP_PATCH%.*}
 
 		einfo "Patching version.h to expose LDAP patch set ..."
@@ -359,7 +365,7 @@ src_install() {
 
 	if use ldap && [[ -n ${LDAP_PATCH} ]] ; then
 		insinto /etc/openldap/schema/
-		newins openssh-lpk_openldap.schema openssh-lpk.schema
+		doins openssh-lpk-{sun,openldap}.schema
 	fi
 
 	doman contrib/ssh-copy-id.1
@@ -424,4 +430,11 @@ pkg_postinst() {
 		elog "Otherwise you maybe unable to connect to this sshd using any AES CTR cipher."
 		elog ""
 	fi
+
+	if use ldap && [[ -n ${LDAP_PATCH} ]] && has_version "<${CATEGORY}/${PN}-7.7_p1" ; then
+		elog "Starting with openssh-7.7_p1, the LDAP implementation was changed."
+		elog "You must revise your configuration or your previous LDAP setup will stop working."
+		elog ""
+		elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for migration details."
+	fi
 }
diff --git a/net-misc/openssh/openssh-7.7_p1-r2.ebuild b/net-misc/openssh/openssh-7.7_p1-r2.ebuild
deleted file mode 100644
index cb49cc970e0b..000000000000
--- a/net-misc/openssh/openssh-7.7_p1-r2.ebuild
+++ /dev/null
@@ -1,426 +0,0 @@
-# Copyright 1999-2018 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=6
-
-inherit user flag-o-matic multilib autotools pam systemd versionator
-
-# Make it more portable between straight releases
-# and _p? releases.
-PARCH=${P/_}
-
-HPN_VER="14v14-gentoo1" HPN_PATCH="${PARCH}-hpnssh${HPN_VER}.patch.xz" HPN_DISABLE_MTAES=1
-SCTP_VER="1.0" SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
-X509_VER="11.3.1" X509_PATCH="${PARCH}-x509-${X509_VER}.patch.xz"
-
-# Disable LDAP support until someone will rewrite the patch,
-# upstream removed auth_parse_options() via commit 7c856857607112a3dfe6414696bf4c7ab7fb0cb3
-#LDAP_VER="0.3.14" LDAP_PATCH="${PN}-lpk-7.7p1-${LDAP_VER}.patch.xz"
-
-PATCH_SET="openssh-7.7p1-patches-1.0"
-
-DESCRIPTION="Port of OpenBSD's free SSH release"
-HOMEPAGE="https://www.openssh.com/"
-SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
-	https://dev.gentoo.org/~whissi/dist/${PN}/${PATCH_SET}.tar.xz
-	${SCTP_PATCH:+sctp? ( https://dev.gentoo.org/~whissi/dist/openssh/${SCTP_PATCH} )}
-	${HPN_PATCH:+hpn? ( https://dev.gentoo.org/~whissi/dist/openssh/${HPN_PATCH} )}
-	${LDAP_PATCH:+ldap? ( https://dev.gentoo.org/~whissi/dist/openssh/${LDAP_PATCH} )}
-	${X509_PATCH:+X509? ( https://dev.gentoo.org/~whissi/dist/openssh/${X509_PATCH} )}
-	"
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey +ssl static test X X509"
-REQUIRED_USE="ldns? ( ssl )
-	pie? ( !static )
-	static? ( !kerberos !pam )
-	X509? ( !ldap !sctp ssl )
-	test? ( ssl )"
-
-LIB_DEPEND="
-	audit? ( sys-process/audit[static-libs(+)] )
-	ldns? (
-		net-libs/ldns[static-libs(+)]
-		!bindist? ( net-libs/ldns[ecdsa,ssl(+)] )
-		bindist? ( net-libs/ldns[-ecdsa,ssl(+)] )
-	)
-	libedit? ( dev-libs/libedit:=[static-libs(+)] )
-	sctp? ( net-misc/lksctp-tools[static-libs(+)] )
-	selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
-	skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] )
-	ssl? (
-		!libressl? (
-			>=dev-libs/openssl-1.0.1:0=[bindist=]
-			dev-libs/openssl:0=[static-libs(+)]
-		)
-		libressl? ( dev-libs/libressl:0=[static-libs(+)] )
-	)
-	>=sys-libs/zlib-1.2.3:=[static-libs(+)]"
-RDEPEND="
-	!static? ( ${LIB_DEPEND//\[static-libs(+)]} )
-	pam? ( virtual/pam )
-	kerberos? ( virtual/krb5 )
-	ldap? ( net-nds/openldap )"
-DEPEND="${RDEPEND}
-	static? ( ${LIB_DEPEND} )
-	virtual/pkgconfig
-	virtual/os-headers
-	sys-devel/autoconf"
-RDEPEND="${RDEPEND}
-	pam? ( >=sys-auth/pambase-20081028 )
-	userland_GNU? ( virtual/shadow )
-	X? ( x11-apps/xauth )"
-
-S="${WORKDIR}/${PARCH}"
-
-pkg_pretend() {
-	# this sucks, but i'd rather have people unable to `emerge -u openssh`
-	# than not be able to log in to their server any more
-	maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
-	local fail="
-		$(use hpn && maybe_fail hpn HPN_PATCH)
-		$(use ldap && maybe_fail ldap LDAP_PATCH)
-		$(use sctp && maybe_fail sctp SCTP_PATCH)
-		$(use X509 && maybe_fail X509 X509_PATCH)
-	"
-	fail=$(echo ${fail})
-	if [[ -n ${fail} ]] ; then
-		eerror "Sorry, but this version does not yet support features"
-		eerror "that you requested:	 ${fail}"
-		eerror "Please mask ${PF} for now and check back later:"
-		eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
-		die "booooo"
-	fi
-
-	# Make sure people who are using tcp wrappers are notified of its removal. #531156
-	if grep -qs '^ *sshd *:' "${EROOT%/}"/etc/hosts.{allow,deny} ; then
-		ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
-		ewarn "you're trying to use it.  Update your ${EROOT}etc/hosts.{allow,deny} please."
-	fi
-}
-
-src_prepare() {
-	sed -i \
-		-e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX%/}/usr/bin/xauth:" \
-		pathnames.h || die
-
-	# don't break .ssh/authorized_keys2 for fun
-	sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
-
-	eapply "${FILESDIR}"/${PN}-7.7_p1-GSSAPI-dns.patch #165444 integrated into gsskex
-	eapply "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
-
-	local PATCHSET_VERSION_MACROS=()
-
-	if use X509 ; then
-		eapply "${WORKDIR}"/${X509_PATCH%.*}
-
-		# We need to patch package version or any X.509 sshd will reject our ssh client
-		# with "userauth_pubkey: could not parse key: string is too large [preauth]"
-		# error
-		einfo "Patching package version for X.509 patch set ..."
-		sed -i \
-			-e "s/^AC_INIT(\[OpenSSH\], \[Portable\]/AC_INIT([OpenSSH], [${X509_VER}]/" \
-			"${S}"/configure.ac || die "Failed to patch package version for X.509 patch"
-
-		einfo "Patching version.h to expose X.509 patch set ..."
-		sed -i \
-			-e "/^#define SSH_PORTABLE.*/a #define SSH_X509               \"-PKIXSSH-${X509_VER}\"" \
-			"${S}"/version.h || die "Failed to sed-in X.509 patch version"
-		PATCHSET_VERSION_MACROS+=( 'SSH_X509' )
-
-		einfo "Disabling broken X.509 agent test ..."
-		sed -i \
-			-e "/^ agent$/d" \
-			"${S}"/tests/CA/config || die "Failed to disable broken X.509 agent test"
-
-		# The following patches don't apply on top of X509 patch
-		rm "${WORKDIR}"/patch/2002_all_openssh-7.7p1_upstream_bug2840.patch || die
-		rm "${WORKDIR}"/patch/2009_all_openssh-7.7p1_make-shell-tests-portable.patch || die
-	fi
-
-	if use ldap ; then
-		eapply "${WORKDIR}"/${LDAP_PATCH%.*}
-
-		einfo "Patching version.h to expose LDAP patch set ..."
-		sed -i \
-			-e "/^#define SSH_PORTABLE.*/a #define SSH_LDAP               \"-ldap-${LDAP_VER}\"" \
-			"${S}"/version.h || die "Failed to sed-in LDAP patch version"
-		PATCHSET_VERSION_MACROS+=( 'SSH_LDAP' )
-	fi
-
-	if use sctp ; then
-		eapply "${WORKDIR}"/${SCTP_PATCH%.*}
-
-		einfo "Patching version.h to expose SCTP patch set ..."
-		sed -i \
-			-e "/^#define SSH_PORTABLE/a #define SSH_SCTP        \"-sctp-${SCTP_VER}\"" \
-			"${S}"/version.h || die "Failed to sed-in SCTP patch version"
-		PATCHSET_VERSION_MACROS+=( 'SSH_SCTP' )
-
-		einfo "Disabling know failing test (cfgparse) caused by SCTP patch ..."
-		sed -i \
-			-e "/\t\tcfgparse \\\/d" \
-			"${S}"/regress/Makefile || die "Failed to disable known failing test (cfgparse) caused by SCTP patch"
-	fi
-
-	if use hpn ; then
-		eapply "${WORKDIR}"/${HPN_PATCH%.*}
-
-		einfo "Patching Makefile.in for HPN patch set ..."
-		sed -i \
-			-e "/^LIBS=/ s/\$/ -lpthread/" \
-			"${S}"/Makefile.in || die "Failed to patch Makefile.in"
-
-		einfo "Patching version.h to expose HPN patch set ..."
-		sed -i \
-			-e "/^#define SSH_PORTABLE/a #define SSH_HPN         \"-hpn${HPN_VER}\"" \
-			"${S}"/version.h || die "Failed to sed-in HPN patch version"
-		PATCHSET_VERSION_MACROS+=( 'SSH_HPN' )
-
-		if [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
-			einfo "Disabling known non-working MT AES cipher per default ..."
-
-			cat > "${T}"/disable_mtaes.conf <<- EOF
-			
-			# HPN's Multi-Threaded AES CTR cipher is currently known to be broken
-			# and therefore disabled per default.
-			DisableMTAES yes
-			EOF
-			sed -i \
-				-e "/^#HPNDisabled.*/r ${T}/disable_mtaes.conf" \
-				"${S}"/sshd_config || die "Failed to disabled MT AES ciphers in sshd_config"
-
-			sed -i \
-				-e "/AcceptEnv.*_XXX_TEST$/a \\\tDisableMTAES\t\tyes" \
-				"${S}"/regress/test-exec.sh || die "Failed to disable MT AES ciphers in test config"
-		fi
-	fi
-
-	if use X509 || use hpn ; then
-		einfo "Patching packet.c for X509 and/or HPN patch set ..."
-		sed -i \
-			-e "s/const struct sshcipher/struct sshcipher/" \
-			"${S}"/packet.c || die "Failed to patch ssh_packet_set_connection() (packet.c)"
-	fi
-
-	if use X509 || use sctp || use ldap || use hpn ; then
-		einfo "Patching sshconnect.c to use SSH_RELEASE in send_client_banner() ..."
-		sed -i \
-			-e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
-			"${S}"/sshconnect.c || die "Failed to patch send_client_banner() to use SSH_RELEASE (sshconnect.c)"
-
-		einfo "Patching sshd.c to use SSH_RELEASE in sshd_exchange_identification() ..."
-		sed -i \
-			-e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
-			"${S}"/sshd.c || die "Failed to patch sshd_exchange_identification() to use SSH_RELEASE (sshd.c)"
-
-		einfo "Patching version.h to add our patch sets to SSH_RELEASE ..."
-		sed -i \
-			-e "s/^#define SSH_RELEASE.*/#define SSH_RELEASE     SSH_VERSION SSH_PORTABLE ${PATCHSET_VERSION_MACROS[*]}/" \
-			"${S}"/version.h || die "Failed to patch SSH_RELEASE (version.h)"
-	fi
-
-	sed -i \
-		-e "/#UseLogin no/d" \
-		"${S}"/sshd_config || die "Failed to remove removed UseLogin option (sshd_config)"
-	eapply "${WORKDIR}"/patch/*.patch
-
-	eapply_user #473004
-
-	tc-export PKG_CONFIG
-	local sed_args=(
-		-e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
-		# Disable PATH reset, trust what portage gives us #254615
-		-e 's:^PATH=/:#PATH=/:'
-		# Disable fortify flags ... our gcc does this for us
-		-e 's:-D_FORTIFY_SOURCE=2::'
-	)
-
-	# The -ftrapv flag ICEs on hppa #505182
-	use hppa && sed_args+=(
-		-e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
-		-e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
-	)
-	# _XOPEN_SOURCE causes header conflicts on Solaris
-	[[ ${CHOST} == *-solaris* ]] && sed_args+=(
-		-e 's/-D_XOPEN_SOURCE//'
-	)
-	sed -i "${sed_args[@]}" configure{.ac,} || die
-
-	eautoreconf
-}
-
-src_configure() {
-	addwrite /dev/ptmx
-
-	use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
-	use static && append-ldflags -static
-
-	local myconf=(
-		--with-ldflags="${LDFLAGS}"
-		--disable-strip
-		--with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
-		--sysconfdir="${EPREFIX%/}"/etc/ssh
-		--libexecdir="${EPREFIX%/}"/usr/$(get_libdir)/misc
-		--datadir="${EPREFIX%/}"/usr/share/openssh
-		--with-privsep-path="${EPREFIX%/}"/var/empty
-		--with-privsep-user=sshd
-		$(use_with audit audit linux)
-		$(use_with kerberos kerberos5 "${EPREFIX%/}"/usr)
-		# We apply the ldap and sctp patch conditionally, so can't pass --without-{ldap,sctp}
-		# unconditionally else we get unknown flag warnings.
-		$(use ldap && use_with ldap)
-		$(use sctp && use_with sctp)
-		$(use_with ldns)
-		$(use_with libedit)
-		$(use_with pam)
-		$(use_with pie)
-		$(use_with selinux)
-		$(use_with skey)
-		$(use_with ssl openssl)
-		$(use_with ssl md5-passwords)
-		$(use_with ssl ssl-engine)
-	)
-
-	# The seccomp sandbox is broken on x32, so use the older method for now. #553748
-	use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
-
-	econf "${myconf[@]}"
-}
-
-src_test() {
-	local t skipped=() failed=() passed=()
-	local tests=( interop-tests compat-tests )
-
-	local shell=$(egetshell "${UID}")
-	if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
-		elog "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
-		elog "user, so we will run a subset only."
-		skipped+=( tests )
-	else
-		tests+=( tests )
-	fi
-
-	# It will also attempt to write to the homedir .ssh.
-	local sshhome=${T}/homedir
-	mkdir -p "${sshhome}"/.ssh
-	for t in "${tests[@]}" ; do
-		# Some tests read from stdin ...
-		HOMEDIR="${sshhome}" HOME="${sshhome}" \
-		emake -k -j1 ${t} </dev/null \
-			&& passed+=( "${t}" ) \
-			|| failed+=( "${t}" )
-	done
-
-	einfo "Passed tests: ${passed[*]}"
-	[[ ${#skipped[@]} -gt 0 ]] && ewarn "Skipped tests: ${skipped[*]}"
-	[[ ${#failed[@]}  -gt 0 ]] && die "Some tests failed: ${failed[*]}"
-}
-
-src_install() {
-	emake install-nokeys DESTDIR="${D}"
-	fperms 600 /etc/ssh/sshd_config
-	dobin contrib/ssh-copy-id
-	newinitd "${FILESDIR}"/sshd.rc6.5 sshd
-	newconfd "${FILESDIR}"/sshd-r1.confd sshd
-
-	newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
-	if use pam ; then
-		sed -i \
-			-e "/^#UsePAM /s:.*:UsePAM yes:" \
-			-e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
-			-e "/^#PrintMotd /s:.*:PrintMotd no:" \
-			-e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
-			"${ED%/}"/etc/ssh/sshd_config || die
-	fi
-
-	# Gentoo tweaks to default config files
-	cat <<-EOF >> "${ED%/}"/etc/ssh/sshd_config
-
-	# Allow client to pass locale environment variables #367017
-	AcceptEnv LANG LC_*
-	EOF
-	cat <<-EOF >> "${ED%/}"/etc/ssh/ssh_config
-
-	# Send locale environment variables #367017
-	SendEnv LANG LC_*
-	EOF
-
-	if use livecd ; then
-		sed -i \
-			-e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
-			"${ED%/}"/etc/ssh/sshd_config || die
-	fi
-
-	if use ldap && [[ -n ${LDAP_PATCH} ]] ; then
-		insinto /etc/openldap/schema/
-		newins openssh-lpk_openldap.schema openssh-lpk.schema
-	fi
-
-	doman contrib/ssh-copy-id.1
-	dodoc CREDITS OVERVIEW README* TODO sshd_config
-	use hpn && dodoc HPN-README
-	use X509 || dodoc ChangeLog
-
-	diropts -m 0700
-	dodir /etc/skel/.ssh
-
-	keepdir /var/empty
-
-	systemd_dounit "${FILESDIR}"/sshd.{service,socket}
-	systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
-}
-
-pkg_preinst() {
-	enewgroup sshd 22
-	enewuser sshd 22 -1 /var/empty sshd
-}
-
-pkg_postinst() {
-	if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then
-		elog "Starting with openssh-5.8p1, the server will default to a newer key"
-		elog "algorithm (ECDSA).  You are encouraged to manually update your stored"
-		elog "keys list as servers update theirs.  See ssh-keyscan(1) for more info."
-	fi
-	if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then
-		elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
-		elog "Make sure to update any configs that you might have.  Note that xinetd might"
-		elog "be an alternative for you as it supports USE=tcpd."
-	fi
-	if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518
-		elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
-		elog "weak sizes.  If you rely on these key types, you can re-enable the key types by"
-		elog "adding to your sshd_config or ~/.ssh/config files:"
-		elog "	PubkeyAcceptedKeyTypes=+ssh-dss"
-		elog "You should however generate new keys using rsa or ed25519."
-
-		elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
-		elog "to 'prohibit-password'.  That means password auth for root users no longer works"
-		elog "out of the box.  If you need this, please update your sshd_config explicitly."
-	fi
-	if has_version "<${CATEGORY}/${PN}-7.6_p1" ; then
-		elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
-		elog "Furthermore, rsa keys with less than 1024 bits will be refused."
-	fi
-	if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then
-		elog "Be aware that by disabling openssl support in openssh, the server and clients"
-		elog "no longer support dss/rsa/ecdsa keys.  You will need to generate ed25519 keys"
-		elog "and update all clients/servers that utilize them."
-	fi
-
-	if use hpn && [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
-		elog ""
-		elog "HPN's multi-threaded AES CTR cipher is currently known to be broken"
-		elog "and therefore disabled at runtime per default."
-		elog "Make sure your sshd_config is up to date and contains"
-		elog ""
-		elog "  DisableMTAES yes"
-		elog ""
-		elog "Otherwise you maybe unable to connect to this sshd using any AES CTR cipher."
-		elog ""
-	fi
-}
diff --git a/net-misc/openssh/openssh-7.7_p1-r4.ebuild b/net-misc/openssh/openssh-7.7_p1-r4.ebuild
index e884e0b9d3e6..d48f83135200 100644
--- a/net-misc/openssh/openssh-7.7_p1-r4.ebuild
+++ b/net-misc/openssh/openssh-7.7_p1-r4.ebuild
@@ -31,7 +31,7 @@ SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
 
 LICENSE="BSD GPL-2"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
 # Probably want to drop ssl defaulting to on in a future version.
 IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey +ssl static test X X509"
 REQUIRED_USE="ldns? ( ssl )
@@ -112,6 +112,7 @@ src_prepare() {
 
 	eapply "${FILESDIR}"/${PN}-7.7_p1-GSSAPI-dns.patch #165444 integrated into gsskex
 	eapply "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
+	eapply "${FILESDIR}"/${PN}-7.5_p1-disable-conch-interop-tests.patch
 
 	local PATCHSET_VERSION_MACROS=()