commit 166456cedad3962b83b848b1e9caf80794831f0f
Author: Damien Miller <djm@mindrot.org>
Date:   Wed Feb 23 22:31:11 2022 +1100

    makedepend

commit 32ebaa0dbca5d0bb86e384e72bebc153f48413e4
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Wed Feb 23 11:18:13 2022 +0000

    upstream: avoid integer overflow of auth attempts (harmless, caught
    
    by monitor)
    
    OpenBSD-Commit-ID: 488ad570b003b21e0cd9e7a00349cfc1003b4d86

commit 6e0258c64c901753df695e06498b26f9f4812ea6
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Wed Feb 23 11:17:10 2022 +0000

    upstream: randomise the password used in fakepw
    
    OpenBSD-Commit-ID: 34e159f73b1fbf0a924a9c042d8d61edde293947

commit bf114d6f0a9df0b8369823d9a0daa6c72b0c4cc9
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Wed Feb 23 11:15:57 2022 +0000

    upstream: use asprintf to construct .rhosts paths
    
    OpenBSD-Commit-ID: 8286e8d3d2c6ff916ff13d041d1713073f738a8b

commit c07e154fbdc7285e9ec54e78d8a31f7325d43537
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Wed Feb 23 11:07:09 2022 +0000

    upstream: openssh-8.9
    
    OpenBSD-Commit-ID: 5c5f791c87c483cdab6d9266b43acdd9ca7bde0e

commit bc16667b4a1c3cad7029304853c143a32ae04bd4
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Tue Feb 22 15:29:22 2022 +1100

    Extend select+rlimit sanbox test to include poll.
    
    POSIX specifies that poll() shall fail if "nfds argument is greater
    than {OPEN_MAX}".  The setrlimit sandbox sets this to effectively zero
    so this causes poll() to fail in the preauth privsep process.
    
    This is likely the underlying cause for the previously observed similar
    behaviour of select() on plaforms where it is implement in userspace on
    top of poll().

commit 6520c488de95366be031d49287ed243620399e23
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Tue Feb 22 13:08:59 2022 +1100

    Add Alpine Linux test VM.

commit a4b325a3fc82d11e0f5d61f62e7fde29415f7afb
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Tue Feb 22 12:27:07 2022 +1100

    Include sys/param.h if present.
    
    Needed for howmany() on MUSL systems such as Alpine.

commit 5a102e9cb287a43bd7dfe594b775a89a8e94697c
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Tue Feb 22 12:25:52 2022 +1100

    Only include sys/poll.h if we don't have poll.h.
    
    Prevents warnings on MUSL based systems such as Alpine.

commit 7c0d4ce911d5c58b6166b2db754a4e91f352adf5
Author: Damien Miller <djm@mindrot.org>
Date:   Tue Feb 22 11:14:51 2022 +1100

    disable agent-restrict test on minix3
    
    Minix seems to have a platform-wide limit on the number of
    select(2) syscalls that can be concurrently issued. This test
    seems to exceed this limit.
    
    Refer to:
    
    https://github.com/Stichting-MINIX-Research-Foundation/minix/blob/R3.3.0/minix/servers/vfs/select.c#L114
    https://github.com/Stichting-MINIX-Research-Foundation/minix/blob/R3.3.0/minix/servers/vfs/select.c#L30-L31

commit 81d33d8e3cf7ea5ce3a5653c6102b623e019428a
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Mon Feb 21 21:27:20 2022 +1100

    Skip agent-getpeereid when running as root.

commit fbd772570a25436a33924d91c164d2b24021f010
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date:   Sun Feb 20 03:47:26 2022 +0000

    upstream: Aproximate realpath on the expected output by deduping
    
    leading slashes. Fixes test failure when user's home dir is / which is
    possible in some portable configurations.
    
    OpenBSD-Regress-ID: 53b8c53734f8893806961475c7106397f98d9f63

commit 336685d223a59f893faeedf0a562e053fd84058e
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Sun Feb 20 13:30:52 2022 +1100

    Really move DSA to end of list.
    
    In commit ad16a84e syncing from OpenBSD, RSA was accidentally moved to
    the end of the list instead of DSA.  Spotted by andrew at fyfe.gb.net.

commit 63bf4f49ed2fdf2da6f97136c9df0c8168546eb3
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Fri Feb 18 12:12:21 2022 +1100

    Add test configs for MUSL C library.

commit f7fc6a43f1173e8b2c38770bf6cee485a562d03b
Author: Damien Miller <djm@mindrot.org>
Date:   Thu Feb 17 22:54:19 2022 +1100

    minix needs BROKEN_POLL too; chokes on /dev/null

commit 667fec5d4fe4406745750a32f69b5d2e1a75e94b
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Thu Feb 17 10:58:27 2022 +0000

    upstream: check for EINTR/EAGAIN failures in the rfd fast-path; caught
    
    by dtucker's minix3 vm :) ok dtucker@
    
    OpenBSD-Commit-ID: 2e2c895a3e82ef347aa6694394a76a438be91361

commit 41417dbda9fb55a0af49a8236e3ef9d50d862644
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Thu Feb 17 22:05:29 2022 +1100

    Comment hurd test, the VM is currently broken.

commit b2aee35a1f0dc798339b3fcf96136da71b7e3f6d
Author: Damien Miller <djm@mindrot.org>
Date:   Thu Feb 17 21:15:16 2022 +1100

    find sk-dummy.so when build_dir != src_dir
    
    spotted by Corinna Vinschen; feedback & ok dtucker@

commit 62a2d4e50b2e89f2ef04576931895d5139a5d037
Author: Damien Miller <djm@mindrot.org>
Date:   Wed Feb 16 16:26:17 2022 +1100

    update versions in preparation for 8.9 release

commit dd6d3dded721ac653ea73c017325e5bfeeec837f
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Tue Feb 15 05:13:36 2022 +0000

    upstream: document the unbound/host-bound options to
    
    PubkeyAuthentication; spotted by HARUYAMA Seigo
    
    OpenBSD-Commit-ID: 298f681b66a9ecd498f0700082c7a6c46e948981

commit df93529dd727fdf2fb290700cd4f1adb0c3c084b
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Mon Feb 14 14:19:40 2022 +1100

    Test if sshd accidentally acquires controlling tty
    
    When SSHD_ACQUIRES_CTTY is defined, test for the problematic behaviour
    in the STREAMS code before activating the workaround.  ok djm@

commit 766176cfdbfd7ec38bb6118dde6e4daa0df34888
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Sat Feb 12 10:24:56 2022 +1100

    Add cygwin-release test config.
    
    This tests the flags used to build the cygwin release binaries.

commit b30698662b862f5397116d23688aac0764e0886e
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Fri Feb 11 21:00:35 2022 +1100

    Move SSHD_ACQUIRES_CTTY workaround into compat.
    
    On some (most? all?) SysV based systems with STREAMS based ptys,
    sshd could acquire a controlling terminal during pty setup when
    it pushed the "ptem" module, due to what is probably a bug in
    the STREAMS driver that's old enough to vote.  Because it was the
    privileged sshd's controlling terminal, it was not available for
    the user's session, which ended up without one.  This is known to
    affect at least Solaris <=10, derivatives such as OpenIndiana and
    several other SysV systems.  See bz#245 for the backstory.
    
    In the we past worked around that by not calling setsid in the
    privileged sshd child, which meant it was not a session or process
    group leader.  This solved controlling terminal problem because sshd
    was not eligble to acquire one, but had other side effects such as
    not cleaning up helper subprocesses in the SIGALRM handler since it
    was not PG leader.  Recent cleanups in the signal handler uncovered
    this, resulting in the LoginGraceTime timer not cleaning up privsep
    unprivileged processes.
    
    This change moves the workaround into the STREAMS pty allocation code,
    by allocating a sacrificial pty to act as sshd's controlling terminal
    before allocating user ptys, so those are still available for users'
    sessions.
    
    On the down side:
     - this will waste a pty per ssh connection on affected platforms.
    
    On the up side:
     - it makes the process group behaviour consistent between platforms.
    
     - it puts the workaround nearest the code that actually causes the
       problem and competely out of the mainline code.
    
     - the workaround is only activated if you use the STREAMS code.  If,
       say, Solaris 11 has the bug but also a working openpty() it doesn't
       matter that we defined SSHD_ACQUIRES_CTTY.
    
     - the workaround is only activated when the fist pty is allocated,
       ie in the post-auth privsep monitor.  This means there's no risk
       of fd leaks to the unprivileged processes, and there's no effect on
       sessions that do not allocate a pty.
    
    Based on analysis and work by djm@, ok djm@

commit cd00b48cf10f3565936a418c1e6d7e48b5c36140
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Fri Feb 11 20:09:32 2022 +1100

    Simplify handling of --with-ssl-dir.
    
    ok djm@

commit ea13fc830fc0e0dce2459f1fab2ec5099f73bdf0
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Fri Feb 11 13:39:29 2022 +1100

    Stop testing OpenBSD HEAD on 6.9 and 7.0.
    
    HEAD is not guaranteed to work on previous stable branches, and at the
    moment is broken due to libfido API changes.

commit 50b9e4a4514697ffb9592200e722de6b427cb9ff
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date:   Fri Feb 11 00:43:56 2022 +0000

    upstream: Always initialize delim before passing to hpdelim2 which
    
    might not set it. Found by the Valgrind tests on github, ok deraadt@
    
    OpenBSD-Commit-ID: c830c0db185ca43beff3f41c19943c724b4f636d

commit 6ee53064f476cf163acd5521da45b11b7c57321b
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Fri Feb 11 10:03:06 2022 +1100

    Fix helper include path and remove excess code.
    
    Looks like test_hpdelim.c was imported twice into the same file.
    Spotted by kevin.brott at gmail com and chris at cataclysmal org.

commit 9fa63a19f68bc87452d3cf5c577cafad2921b7a4
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Thu Feb 10 23:27:02 2022 +1100

    Put poll.h inside ifdef.

commit 3ac00dfeb54b252c15dcbf1971582e9e3b946de6
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Thu Feb 10 22:17:31 2022 +1100

    We now support POLLPRI so actually define it.

commit 25bd659cc72268f2858c5415740c442ee950049f
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date:   Sun Feb 6 22:58:33 2022 +0000

    upstream: Add test for empty hostname with port.
    
    OpenBSD-Regress-ID: e19e89d3c432b68997667efea44cf015bbe2a7e3

commit a29af853cff41c0635f0378c00fe91bf9c91dea4
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date:   Fri Feb 4 07:53:44 2022 +0000

    upstream: Add unit tests for hpdelim.
    
    OpenBSD-Regress-ID: be97b85c19895e6a1ce13c639765a3b48fd95018

commit 9699151b039ecc5fad9ac6c6c02e9afdbd26f15f
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Thu Feb 10 04:12:38 2022 +0000

    upstream: revert for imminent OpenSSH release, which wil ship with
    
    scp in RCP mode.
    
    > revision 1.106
    > date: 2021/10/15 14:46:46;  author: deraadt;  state: Exp;  lines: +13 -9;  commitid: w5n9B2RE38tFfggl;
    > openbsd 7.0 release shipped with the (hopefully last) scp that uses RCP
    > protocol for copying.  Let's get back to testing the SFTP protocol.
    
    This will be put back once the OpenSSH release is done.
    
    OpenBSD-Commit-ID: 0c725481a78210aceecff1537322c0b2df03e768

commit 45279abceb37c3cbfac8ba36dde8b2c8cdd63d32
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date:   Tue Feb 8 08:59:12 2022 +0000

    upstream: Switch hpdelim interface to accept only ":" as delimiter.
    
    Historicallly, hpdelim accepted ":" or "/" as a port delimiter between
    hosts (or addresses) and ports.  These days most of the uses for "/"
    are no longer accepted, so there are several places where it checks the
    delimiter to disallow it.  Make hpdelim accept only ":" and use hpdelim2
    in the other cases.  ok djm@
    
    OpenBSD-Commit-ID: 7e6420bd1be87590b6840973f5ad5305804e3102

commit a1bcbf04a7c2d81944141db7ecd0ba292d175a66
Author: pedro martelletto <pedro@yubico.com>
Date:   Mon Feb 7 09:09:59 2022 +0100

    fix typos in previous

commit 56192518e329b39f063487bc2dc4d796f791eca0
Author: Damien Miller <djm@mindrot.org>
Date:   Mon Feb 7 12:53:47 2022 +1100

    compat code for fido_assert_set_clientdata()

commit d6b5aa08fdcf9b527f8b8f932432941d5b76b7ab
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Mon Feb 7 01:25:12 2022 +0000

    upstream: use libfido2 1.8.0+ fido_assert_set_clientdata() instead
    
    of manually hashing data outselves. Saves a fair bit of code and makes life
    easier for some -portable platforms.
    
    OpenBSD-Commit-ID: 351dfaaa5ab1ee928c0e623041fca28078cff0e0

commit 86cc93fd3c26b2e0c7663c6394995fb04ebfbf3b
Author: jsg@openbsd.org <jsg@openbsd.org>
Date:   Sun Feb 6 00:29:03 2022 +0000

    upstream: remove please from manual pages ok jmc@ sthen@ millert@
    
    OpenBSD-Commit-ID: 6543acb00f4f38a23472538e1685c013ca1a99aa

commit ad16a84e64a8cf1c69c63de3fb9008320a37009c
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date:   Fri Feb 4 02:49:17 2022 +0000

    upstream: Since they are deprecated, move DSA to the end of the
    
    default list of public keys so that they will be tried last.  From github
    PR#295 from "ProBackup-nl", ok djm@
    
    OpenBSD-Commit-ID: 7e5d575cf4971d4e2de92e0b6d6efaba53598bf0

commit 253de42753de85dde266e061b6fec12ca6589f7d
Author: Damien Miller <djm@mindrot.org>
Date:   Wed Feb 2 16:52:07 2022 +1100

    portable-specific string array constification
    
    from Mike Frysinger

commit dfdcc2220cf359c492d5d34eb723370e8bd8a19e
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Tue Feb 1 23:37:15 2022 +0000

    upstream: test 'ssh-keygen -Y find-principals' with wildcard
    
    principals; from Fabian Stelzer
    
    OpenBSD-Regress-ID: fbe4da5f0032e7ab496527a5bf0010fd700f8f40

commit 968e508967ef42480cebad8cf3172465883baa77
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date:   Fri Jan 21 02:54:41 2022 +0000

    upstream: Enable all supported ciphers and macs in the server
    
    before trying to benchmark them.  Increase the data file size to get more
    signal.
    
    OpenBSD-Regress-ID: dc3697d9f7defdfc51c608782c8e750128e46eb6

commit 15b7199a1fd37eff4c695e09d573f3db9f4274b7
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Tue Feb 1 23:34:47 2022 +0000

    upstream: allow 'ssh-keygen -Y find-principals' to match wildcard
    
    principals in allowed_signers files; from Fabian Stelzer
    
    OpenBSD-Commit-ID: 1e970b9c025b80717dddff5018fe5e6f470c5098

commit 541667fe6dc26d7881e55f0bb3a4baa6f3171645
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Tue Feb 1 23:32:51 2022 +0000

    upstream: mark const string array contents const too, i.e. static
    
    const char *array => static const char * const array from Mike Frysinger
    
    OpenBSD-Commit-ID: a664e31ea6a795d7c81153274a5f47b22bdc9bc1

commit 8cfa73f8a2bde4c98773f33f974c650bdb40dd3c
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Tue Feb 1 23:11:11 2022 +0000

    upstream: better match legacy scp behaviour: show un-expanded paths
    
    in error messages. Spotted by and ok tb@
    
    OpenBSD-Commit-ID: 866c8ffac5bd7d38ecbfc3357c8adfa58af637b7

commit 4e62c13ab419b4b224c8bc6a761e91fcf048012d
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date:   Tue Feb 1 07:57:32 2022 +0000

    upstream: Remove explicit kill of privsep preauth child's PID in
    
    SIGALRM handler. It's no longer needed since the child will get terminated by
    the SIGTERM to the process group that cleans up any auth helpers, it
    simplifies the signal handler and removes the risk of a race when updating
    the PID. Based on analysis by HerrSpace in github PR#289, ok djm@
    
    OpenBSD-Commit-ID: 2be1ffa28b4051ad9e33bb4371e2ec8a31d6d663

commit 2a7ccd2ec4022917b745af7186f514f365b7ebe9
Author: guenther@openbsd.org <guenther@openbsd.org>
Date:   Fri Jan 28 06:18:42 2022 +0000

    upstream: When it's the possessive of 'it', it's spelled "its",
    
    without the apostrophe.
    
    OpenBSD-Commit-ID: fb6ab9c65bd31de831da1eb4631ddac018c5fae7

commit 8a0848cdd3b25c049332cd56034186b7853ae754
Author: Alex James <theracermaster@gmail.com>
Date:   Sun Jan 30 16:13:36 2022 -0600

    sandbox-seccomp-filter: allow gettid
    
    Some allocators (such as Scudo) use gettid while tracing allocations [1].
    Allow gettid in preauth to prevent sshd from crashing with Scudo.
    
    [1]: https://github.com/llvm/llvm-project/blob/llvmorg-13.0.0/compiler-rt/lib/gwp_asan/common.cpp#L46

commit b30d32159dc3c7052f4bfdf36357996c905af739
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Sat Jan 22 00:49:34 2022 +0000

    upstream: add a ssh_packet_process_read() function that reads from
    
    a fd directly into the transport input buffer.
    
    Use this in the client and server mainloops to avoid unnecessary
    copying. It also lets us use a more greedy read size without penalty.
    
    Yields a 2-3% performance gain on cipher-speed.sh (in a fairly
    unscientific test tbf)
    
    feedback dtucker@ ok markus@
    
    OpenBSD-Commit-ID: df4112125bf79d8e38e79a77113e1b373078e632

commit a1a8efeaaa9cccb15cdc0a2bd7c347a149a3a7e3
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Sat Jan 22 00:45:31 2022 +0000

    upstream: Use sshbuf_read() to read directly into the channel input
    
    buffer rather than into a stack buffer that needs to be copied again;
    Improves performance by about 1% on cipher-speed.sh feedback dtucker@ ok
    markus@
    
    OpenBSD-Commit-ID: bf5e6e3c821ac3546dc8241d8a94e70d47716572

commit 29a76994e21623a1f84d68ebb9dc5a3c909fa3a7
Author: Damien Miller <djm@mindrot.org>
Date:   Tue Jan 25 11:52:34 2022 +1100

    depend

commit 754e0d5c7712296a7a3a83ace863812604c7bc4f
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Sat Jan 22 00:43:43 2022 +0000

    upstream: Add a sshbuf_read() that attempts to read(2) directly in
    
    to a sshbuf; ok markus@
    
    OpenBSD-Commit-ID: 2d8f249040a4279f3bc23c018947384de8d4a45b

commit c7964fb9829d9ae2ece8b51a76e4a02e8449338d
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Fri Jan 21 07:04:19 2022 +0000

    upstream: add a helper for writing an error message to the
    
    stderr_buf and setting quit_pending; no functional change but saves a bunch
    of boilerplate
    
    OpenBSD-Commit-ID: 0747657cad6b9eabd514a6732adad537568e232d

commit d23b4f7fdb1bd87e2cd7a9ae7c198ae99d347916
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Fri Jan 21 06:58:06 2022 +0000

    upstream: correct comment and use local variable instead of long
    
    indirection; spotted by dtucker@
    
    OpenBSD-Commit-ID: 5f65f5f69db2b7d80a0a81b08f390a63f8845965

commit d069b020a02b6e3935080204ee44d233e8158ebb
Author: deraadt@openbsd.org <deraadt@openbsd.org>
Date:   Fri Jan 21 00:53:40 2022 +0000

    upstream: When poll(2) returns -1, for some error conditions
    
    pfd[].revents is not cleared.  There are subtle errors in various programs.
    In this particular case, the program should error out. ok djm millert
    
    OpenBSD-Commit-ID: 00f839b16861f7fb2adcf122e95e8a82fa6a375c

commit e204b34337a965feb439826157c191919fd9ecf8
Author: Damien Miller <djm@mindrot.org>
Date:   Sat Jan 22 11:38:21 2022 +1100

    restore tty force-read hack
    
    This portable-specific hack fixes a hang on exit for ttyful sessions
    on Linux and some SysVish Unix variants. It was accidentally disabled
    in commit 5c79952dfe1a (a precursor to the mainloop poll(2) conversion).
    
    Spotted by John in bz3383

commit 68085066b6bad43643b43f5957fcc5fd34782ccd
Author: Corinna Vinschen <vinschen@redhat.com>
Date:   Fri Jan 21 03:22:56 2022 +1100

    Fix signedness bug in Cygwin code
    
    The Cygwin-specific pattern match code has a bug.  It checks
    the size_t value returned by mbstowcs for being < 0.  The right
    thing to do is to check against (size_t) -1.  Fix that.
    
    Signed-off-by: Corinna Vinschen <vinschen@redhat.com>

commit 2e5cfed513e84444483baf1d8b31c40072b05103
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Thu Jan 20 13:26:27 2022 +1100

    Improve compatibility of early exit trap handling.
    
    Dash (as used by the github runners) has some differences in its trap
    builtin:
     - it doesn't have -p (which is fine, that's not in posix).
     - it doesn't work in a subshell (which turns out to be in compliance
       with posix, which means bash isn't).
     - it doesn't work in a pipeline, ie "trap|cat" produces no output.

commit 3fe6800b6027add478e648934cbb29d684e51943
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Thu Jan 20 00:49:57 2022 +1100

    Move more tests out of valgrind-1 runner.

commit 20da6ed136dd76e6a0b229ca3036ef9c7c7ef798
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Wed Jan 19 15:37:39 2022 +1100

    Invoke EXIT handler early when using Valgrind.
    
    When using Valgrind, we need to wait for all invoked programs to
    complete before checking their valgrind logs.  Some tests, notably
    agent-restrict, set an EXIT trap handler to clean up things like
    ssh-agent, but those do not get invoked until test-exec.sh exits.
    This causes the Valgrind wait to deadlock, so if present invoke
    the EXIT handler before checking the Valgrind logs.

commit ad2e0580c87b0714cf166bca9d926a95ddeee1c8
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Tue Jan 18 12:55:21 2022 +1100

    Remove line leftover from upstream sync.

commit d1051c0f11a6b749027e26bbeb61b07df4b67e15
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Mon Jan 17 22:56:04 2022 +0000

    upstream: when decompressing zlib compressed packets, use
    
    Z_SYNC_FLUSH instead of Z_PARTIAL_FLUSH as the latter is not actually
    specified as a valid mode for inflate(). There should be no practical change
    in behaviour as the compression side ensures a flush that should make all
    data available to the receiver in all cases.
    
    repoted by lamm AT ibm.com via bz3372; ok markus
    
    OpenBSD-Commit-ID: 67cfc1fa8261feae6d2cc0c554711c97867cc81b

commit d5981b1883746b1ae178a46229c26b53af99e37a
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Mon Jan 17 21:41:04 2022 +0000

    upstream: make most of the sftp errors more idiomatic, following
    
    the general form of "[local/remote] operation path: error message"; ok markus
    
    OpenBSD-Commit-ID: 61364cd5f3a9fecaf8d63b4c38a42c0c91f8b571

commit ac7c9ec894ed0825d04ef69c55babb49bab1d32e
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Mon Jan 17 21:39:51 2022 +0000

    upstream: when transferring multiple files in SFTP mode, create the
    
    destination directory if it doesn't already exist to match olde-scp(1)
    behaviour. noticed by deraadt@ ok markus@
    
    OpenBSD-Commit-ID: cf44dfa231d4112f697c24ff39d7ecf2e6311407

commit 39d17e189f8e72c34c722579d8d4e701fa5132da
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Fri Jan 14 03:43:48 2022 +0000

    upstream: allow pin-required FIDO keys to be added to ssh-agent(1).
    
    ssh-askpass will be used to request the PIN at authentication time.
    
    From Pedro Martelletto, ok djm
    
    OpenBSD-Commit-ID: de8189fcd35b45f632484864523c1655550e2950

commit 52423f64e13db2bdc31a51b32e999cb1bfcf1263
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Fri Jan 14 03:35:10 2022 +0000

    upstream: ssh-sk: free a resident key's user id
    
    From Pedro Martelletto; ok dtucker & me
    
    OpenBSD-Commit-ID: 47be40d602b7a6458c4c71114df9b53d149fc2e9

commit 014e2f147a2788bfb3cc58d1b170dcf2bf2ee493
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Fri Jan 14 03:34:00 2022 +0000

    upstream: sshsk_load_resident: don't preallocate resp
    
    resp is allocated by client_converse(), at which point we lose
    the original pointer.
    
    From Pedro Martelletto; ok dtucker & me
    
    OpenBSD-Commit-ID: 1f1b5ea3282017d6584dfed4f8370dc1db1f44b1

commit c88265f207dfe0e8bdbaf9f0eda63ed6b33781cf
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Fri Jan 14 03:32:52 2022 +0000

    upstream: sshsk_sign: trim call to sshkey_fingerprint()
    
    the resulting fingerprint doesn't appear to be used for anything,
    and we end up leaking it.
    
    from Pedro Martelletto; ok dtucker & me
    
    OpenBSD-Commit-ID: 5625cf6c68f082bc2cbbd348e69a3ed731d2f9b7

commit 1cd1b2eac39661b849d5a4b4b56363e22bb5f61e
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Fri Jan 14 03:31:52 2022 +0000

    upstream: use status error message to communicate ~user expansion
    
    failures; provides better experience for scp in sftp mode, where ~user paths
    are more likely to be used; spotted jsg, feedback jsg & deraadt ok jsg &
    markus
    
    (forgot to include this file in previous commit)
    
    OpenBSD-Commit-ID: d37cc4c8c861ce48cd6ea9899e96aaac3476847b

commit a1d42a6ce0398da3833bedf374ef2571af7fea50
Author: Damien Miller <djm@mindrot.org>
Date:   Fri Jan 14 13:49:32 2022 +1100

    fix edge case in poll(2) wrapper
    
    Correct handling of select(2) exceptfds. These should only be consulted
    for POLLPRI flagged pfds and not unconditionally converted to POLLERR.
    
    with and ok dtucker@

commit 976b9588b4b5babcaceec4767a241c11a67a5ccb
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Fri Jan 14 13:46:35 2022 +1100

    Wrap OpenSSL includes in unit tests in ifdef.
    
    Fixes unit test on systems that do not have OpenSSL headers installed.

commit c171879374b2e8b07157503f5639ed0bce59ce89
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Thu Jan 13 15:53:33 2022 +1100

    Remove sort wrapper.
    
    agent-restrict now takes care of this itself.

commit 9cc2654403f1a686bb26c07a6ac790edf334cef5
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date:   Thu Jan 13 04:53:16 2022 +0000

    upstream: Set LC_ALL in both local and remote shells so that sorted
    
    output matches regardless of what the user's shell sets it to.  ok djm@
    
    OpenBSD-Regress-ID: 4e97dd69a68b05872033175a4c2315345d01837f

commit 7a75f748cb2dd2f771bf70ea72698aa027996ab1
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date:   Thu Jan 13 04:22:10 2022 +0000

    upstream: Avoid %'s in commands (not used in OpenBSD, but used in
    
    -portable's Valgrind test) being interpretted as printf format strings.
    
    OpenBSD-Regress-ID: dc8655db27ac4acd2c386c4681bf42a10d80b043

commit 6c435bd4994d71442192001483a1cdb846e5ffcd
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Wed Jan 12 16:58:13 2022 +1100

    Stop on first test failure to minimize logs.

commit 4bc2ba6095620a4484b708ece12842afd8c7685b
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date:   Wed Jan 12 07:18:37 2022 +0000

    upstream: Use egrep when searching for an anchored string.
    
    OpenBSD-Regress-ID: dd114a2ac27ac4b06f9e4a586d3f6320c54aeeb4

commit 6bf2efa2679da1e8e60731f41677b2081dedae2c
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Wed Jan 12 18:25:06 2022 +1100

    Add "rev" command replacement if needed.

commit 72bcd7993dadaf967bb3d8564ee31cbf38132b5d
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date:   Wed Jan 12 03:30:32 2022 +0000

    upstream: Don't log NULL hostname in restricted agent code,
    
    printf("%s", NULL) is not safe on all platforms.  with & ok djm
    
    OpenBSD-Commit-ID: faf10cdae4adde00cdd668cd1f6e05d0a0e32a02

commit acabefe3f8fb58c867c99fed9bbf84dfa1771727
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Tue Jan 11 22:33:16 2022 +0000

    upstream: remove hardcoded domain and use window.location.host, so this
    
    can be run anywhere
    
    OpenBSD-Regress-ID: 2ac2ade3b6227d9c547351d3ccdfe671e62b7f92

commit 96da0946e44f34adc0397eb7caa6ec35a3e79891
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date:   Tue Jan 11 02:56:19 2022 +0000

    upstream: "void" functions should not return anything. From Tim Rice
    
    via -portable.
    
    OpenBSD-Commit-ID: ce6616304f4c9881b46413e616b226c306830e2a

commit a882a09722c9f086c9edb65d0c4022fd965ec1ed
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Tue Jan 11 01:26:47 2022 +0000

    upstream: suppress "Connection to xxx closed" messages at LogLevel >=
    
    error bz3378; ok dtucker@
    
    OpenBSD-Commit-ID: d5bf457d5d2eb927b81d0663f45248a31028265c

commit 61a1a6af22e17fc94999a5d1294f27346e6c4668
Author: Damien Miller <djm@mindrot.org>
Date:   Wed Jan 12 08:57:49 2022 +1100

    OS X poll(2) is broken; use compat replacement
    
    Darwin's poll(2) implementation is broken. For character-special
    devices like /dev/null, it returns POLLNVAL when polled with
    POLLIN.
    
    Apparently this is Apple bug 3710161, which is AFAIK not public,
    but a websearch will find other OSS projects rediscovering it
    periodically since it was first identified in 2005 (!!)

commit 613a6545fc5a9542753b503cbe5906538a640b60
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Tue Jan 11 20:56:01 2022 +1100

    libhardended_malloc.so moved into out dir.

commit 61761340be5e11046556623f8f5412b236cefa95
Author: Tim Rice <tim@multitalents.net>
Date:   Mon Jan 10 11:07:04 2022 -0800

    Make USL compilers happy
    UX:acomp: ERROR: "sftp-server.c", line 567: void function cannot return value

commit 3ef403f351e80a59b6f7e9d43cb82c181855483c
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Mon Jan 10 21:07:38 2022 +1100

    Add wrapper for "sort" to set LC_ALL=C.
    
    Found by djm, this should make sorts stable and reduce test flakiness.

commit bd69e29f5716090181dbe0b8272eb7eab1a383bb
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date:   Sat Jan 8 07:55:26 2022 +0000

    upstream: Remove errant "set -x" left over from debugging.
    
    OpenBSD-Regress-ID: cd989268e034264cec5df97be7581549032c87dc

commit 1a7c88e26fd673813dc5f61c4ac278564845e004
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date:   Sat Jan 8 07:01:13 2022 +0000

    upstream: Enable all supported hostkey algorithms (but no others).
    
    Allows hostbased test to pass when built without OpenSSL.
    
    OpenBSD-Regress-ID: 5ddd677a68b672517e1e78460dc6ca2ccc0a9562

commit 12b457c2a42ff271e7967d9bedd068cebb048db9
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Sat Jan 8 07:37:32 2022 +0000

    upstream: use status error message to communicate ~user expansion
    
    failures; provides better experience for scp in sftp mode, where ~user paths
    are more likely to be used; spotted jsg, feedback jsg & deraadt ok jsg &
    markus
    
    OpenBSD-Commit-ID: fc610ce00ca0cdc2ecdabbd49ce7cb82033f905f

commit 63670d4e9030bcee490d5a9cce561373ac5b3b23
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Sat Jan 8 07:36:11 2022 +0000

    upstream: fix some corner-case bugs in scp sftp-mode handling of
    
    ~-prefixed paths; spotted by jsg; feedback jsg & deraadt, ok jsg & markus
    
    OpenBSD-Commit-ID: d1697dbaaa9f0f5649d69be897eab25c7d37c222

commit e14940bbec57fc7d3ce0644dbefa35f5a8ec97d0
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Sat Jan 8 07:34:57 2022 +0000

    upstream: more idiomatic error messages; spotted by jsg & deraadt
    
    ok jsg & markus
    
    OpenBSD-Commit-ID: 43618c692f3951747b4151c477c7df22afe2bcc8

commit 9acddcd5918c623f7ebf454520ffe946a8f15e90
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Sat Jan 8 07:33:54 2022 +0000

    upstream: add a variant of send_status() that allows overriding the
    
    default, generic error message. feedback/ok markus & jsg
    
    OpenBSD-Commit-ID: 81f251e975d759994131b717ee7c0b439659c40f

commit 961411337719d4cd78f1ab33e4ac549f3fa22f50
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Sat Jan 8 07:32:45 2022 +0000

    upstream: refactor tilde_expand_filename() and make it handle ~user
    
    paths with no trailing slash; feedback/ok markus and jsg
    
    OpenBSD-Commit-ID: a2ab365598a902f0f14ba6a4f8fb2d07a9b5d51d

commit dc38236ab6827dec575064cac65c8e7035768773
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date:   Thu Jan 6 22:14:25 2022 +0000

    upstream: Don't explicitly set HostbasedAuthentication in
    
    sshd_config. It defaults to "no", and not explicitly setting it allows us to
    enable it for the (optional) hostbased test.
    
    OpenBSD-Regress-ID: aa8e3548eb5793721641d26e56c29f363b767c0c

commit e12d912ddf1c873cb72e5de9a197afbe0b6622d2
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date:   Thu Jan 6 21:46:56 2022 +0000

    upstream: Add test for hostbased auth. It requires some external
    
    setup (see comments at the top) and thus is disabled unless
    TEST_SSH_HOSTBASED_AUTH and SUDO are set.
    
    OpenBSD-Regress-ID: 3ec8ba3750c5b595fc63e7845d13483065a4827a

commit a48533a8da6a0f4f05ecd055dc8048047e53569e
Author: Damien Miller <djm@mindrot.org>
Date:   Fri Jan 7 09:24:26 2022 +1100

    depend

commit d9dbb5d9a0326e252d3c7bc13beb9c2434f59409
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Thu Jan 6 22:06:51 2022 +0000

    upstream: allow hostbased auth to select RSA keys when only
    
    RSA/SHA2 are configured (this is the default case); ok markus@
    
    OpenBSD-Commit-ID: 411c18c7bde40c60cc6dfb7017968577b4d4a827

commit fdb1d58d0d3888b042e5a500f6ce524486aaf782
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Thu Jan 6 22:05:42 2022 +0000

    upstream: add a helper function to match a key type to a list of
    
    signature algorithms. RSA keys can make signatures with multiple algorithms,
    so some special handling is required. ok markus@
    
    OpenBSD-Commit-ID: 03b41b2bda06fa4cd9c84cef6095033b9e49b6ff

commit 11e8c4309a5086a45fbbbc87d0af5323c6152914
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Thu Jan 6 22:04:20 2022 +0000

    upstream: log some details on hostkeys that ssh loads for
    
    hostbased authn ok markus@
    
    OpenBSD-Commit-ID: da17061fa1f0e58cb31b88478a40643e18233e38

commit c6706f661739514a34125aa3136532a958929510
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Thu Jan 6 22:03:59 2022 +0000

    upstream: log signature algorithm during verification by monitor;
    
    ok markus
    
    OpenBSD-Commit-ID: 02b92bb42c4d4bf05a051702a56eb915151d9ecc

commit 8832402bd500d1661ccc80a476fd563335ef6cdc
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Thu Jan 6 22:02:52 2022 +0000

    upstream: piece of UpdateHostkeys client strictification: when
    
    updating known_hosts with new keys, ignore NULL keys (forgot to include in
    prior commit)
    
    OpenBSD-Commit-ID: 49d2eda6379490e1ceec40c3b670b973f63dea08

commit c2d9ced1da0276961d86690b3bd7ebdaca7fdbf7
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Thu Jan 6 22:01:14 2022 +0000

    upstream: include rejected signature algorithm in error message
