commit 8241b9c0529228b4b86d88b1a6076fb9f97e4a99
Author: Damien Miller <djm@mindrot.org>
Date:   Tue Dec 19 01:59:50 2023 +1100

    crank versions

commit 2f2c65cb5f1518a9c556d3e8efa27ea0ca305c6b
Author: Damien Miller <djm@mindrot.org>
Date:   Tue Dec 19 01:59:06 2023 +1100

    depend

commit e48cdee8e19059203b1aeeabec2350b8375fa61f
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Mon Dec 18 14:50:08 2023 +0000

    upstream: regress test for agent PKCS#11-backed certificates
    
    OpenBSD-Regress-ID: 38f681777cb944a8cc3bf9d0ad62959a16764df9

commit 2f512f862df1d5f456f82a0334c9e8cc7208a2a1
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Mon Dec 18 14:49:39 2023 +0000

    upstream: regress test for constrained PKCS#11 keys
    
    OpenBSD-Regress-ID: b2f26ae95d609d12257b43aef7cd7714c82618ff

commit cdddd66412ca5920ed4d3ebbfa6ace12dbd9b82f
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Mon Dec 18 14:48:44 2023 +0000

    upstream: openssh-9.6
    
    OpenBSD-Commit-ID: 21759837cf0e0092d9a2079f8fb562071c11016b

commit 6d51feab157cedf1e7ef5b3f8781ca8ff9c4ab1b
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Mon Dec 18 14:48:08 2023 +0000

    upstream: ssh-agent: record failed session-bind attempts
    
    Record failed attempts to session-bind a connection and refuse signing
    operations on that connection henceforth.
    
    Prevents a future situation where we add a new hostkey type that is not
    recognised by an older ssh-agent, that consequently causes session-bind
    to fail (this situation is only likely to arise when people mix ssh(1)
    and ssh-agent(1) of different versions on the same host). Previously,
    after such a failure the agent socket would be considered unbound and
    not subject to restriction.
    
    Spotted by Jann Horn
    
    OpenBSD-Commit-ID: b0fdd023e920aa4831413f640de4c5307b53552e

commit 7ef3787c84b6b524501211b11a26c742f829af1a
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Mon Dec 18 14:47:44 2023 +0000

    upstream: ban user/hostnames with most shell metacharacters
    
    This makes ssh(1) refuse user or host names provided on the
    commandline that contain most shell metacharacters.
    
    Some programs that invoke ssh(1) using untrusted data do not filter
    metacharacters in arguments they supply. This could create
    interactions with user-specified ProxyCommand and other directives
    that allow shell injection attacks to occur.
    
    It's a mistake to invoke ssh(1) with arbitrary untrusted arguments,
    but getting this stuff right can be tricky, so this should prevent
    most obvious ways of creating risky situations. It however is not
    and cannot be perfect: ssh(1) has no practical way of interpreting
    what shell quoting rules are in use and how they interact with the
    user's specified ProxyCommand.
    
    To allow configurations that use strange user or hostnames to
    continue to work, this strictness is applied only to names coming
    from the commandline. Names specified using User or Hostname
    directives in ssh_config(5) are not affected.
    
    feedback/ok millert@ markus@ dtucker@ deraadt@
    
    OpenBSD-Commit-ID: 3b487348b5964f3e77b6b4d3da4c3b439e94b2d9

commit 0cb50eefdd29f0fec31d0e71cc4b004a5f704e67
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Mon Dec 18 14:47:20 2023 +0000

    upstream: stricter handling of channel window limits
    
    This makes ssh/sshd more strict in handling non-compliant peers that
    send more data than the advertised channel window allows. Previously
    the additional data would be silently discarded. This change will
    cause ssh/sshd to terminate the connection if the channel window is
    exceeded by more than a small grace allowance.
    
    ok markus@
    
    OpenBSD-Commit-ID: 811e21b41831eba3dd7f67b3d409a438f20d3037

commit 4448a2938abc76e6bd33ba09b2ec17a216dfb491
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Mon Dec 18 14:46:56 2023 +0000

    upstream: Make it possible to load certs from PKCS#11 tokens
    
    Adds a protocol extension to allow grafting certificates supplied by
    ssh-add to keys loaded from PKCS#11 tokens in the agent.
    
    feedback/ok markus@
    
    OpenBSD-Commit-ID: bb5433cd28ede2bc910996eb3c0b53e20f86037f

commit 881d9c6af9da4257c69c327c4e2f1508b2fa754b
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Mon Dec 18 14:46:12 2023 +0000

    upstream: apply destination constraints to all p11 keys
    
    Previously applied only to the first key returned from each token.
    
    ok markus@
    
    OpenBSD-Commit-ID: 36df3afb8eb94eec6b2541f063d0d164ef8b488d

commit a7ed931caeb68947d30af8a795f4108b6efad761
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Mon Dec 18 14:45:49 2023 +0000

    upstream: add "ext-info-in-auth@openssh.com" extension
    
    This adds another transport protocol extension to allow a sshd to send
    SSH2_MSG_EXT_INFO during user authentication, after the server has
    learned the username that is being logged in to.
    
    This lets sshd to update the acceptable signature algoritms for public
    key authentication, and allows these to be varied via sshd_config(5)
    "Match" directives, which are evaluated after the server learns the
    username being authenticated.
    
    Full details in the PROTOCOL file
    
    OpenBSD-Commit-ID: 1de7da7f2b6c32a46043d75fcd49b0cbb7db7779

commit 1edb00c58f8a6875fad6a497aa2bacf37f9e6cd5
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Mon Dec 18 14:45:17 2023 +0000

    upstream: implement "strict key exchange" in ssh and sshd
    
    This adds a protocol extension to improve the integrity of the SSH
    transport protocol, particular in and around the initial key exchange
    (KEX) phase.
    
    Full details of the extension are in the PROTOCOL file.
    
    with markus@
    
    OpenBSD-Commit-ID: 2a66ac962f0a630d7945fee54004ed9e9c439f14

commit 59d691b886c79e70b1d1c4ab744e81fd176222fd
Author: Damien Miller <djm@mindrot.org>
Date:   Mon Dec 18 14:49:11 2023 +1100

    better detection of broken -fzero-call-used-regs
    
    Use OSSH_CHECK_CFLAG_LINK() for detection of these flags and extend
    test program to exercise varargs, which seems to catch more stuff.
    
    ok dtucker@

commit aa7b21708511a6d4aed3839fc9f6e82e849dd4a1
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Wed Dec 13 03:28:19 2023 +0000

    upstream: when invoking KnownHostsCommand to determine the order of
    
    host key algorithms to request, ensure that the hostname passed to the
    command is decorated with the port number for ports other than 22.
    
    This matches the behaviour of KnownHostsCommand when invoked to look
    up the actual host key.
    
    bz3643, ok dtucker@
    
    OpenBSD-Commit-ID: 5cfabc0b7c6c7ab473666df314f377b1f15420b1

commit 4086bd6652c0badccc020218a62190a7798fb72c
Author: markus@openbsd.org <markus@openbsd.org>
Date:   Fri Dec 8 09:18:39 2023 +0000

    upstream: prevent leak in sshsig_match_principals; ok djm@
    
    OpenBSD-Commit-ID: 594f61ad4819ff5c72dfe99ba666a17f0e1030ae

commit 19d3ee2f3adf7d9a606ff015c1e153744702c4c9
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Wed Dec 6 21:06:48 2023 +0000

    upstream: short circuit debug log processing early if we're not going
    
    to log anything. From Kobe Housen
    
    OpenBSD-Commit-ID: 2bcddd695872a1bef137cfff7823044dcded90ea

commit 947affad4831df015c498c00c6351ea6f13895d5
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Mon Nov 27 09:37:28 2023 +1100

    Add tests for OpenSSL 3.2.0 and 3.2 stable branch.

commit 747dce36206675ca6b885010a835733df469351b
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Sat Nov 25 09:03:38 2023 +1100

    Use non-zero arg in compiler test program.
    
    Now that we're running the test program, passing zero to the test function
    can cause divide-by-zero exceptions which might show up in logs.

commit 3d44a5c56585d1c351dbc006240a591b6da502b1
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date:   Fri Nov 24 00:31:30 2023 +0000

    upstream: Plug mem leak of msg when processing a quit message.
    
    Coverity CID#427852, ok djm@
    
    OpenBSD-Commit-ID: bf85362addbe2134c3d8c4b80f16601fbff823b7

commit 1d7f9b6e297877bd00973e6dc5c0642dbefc3b5f
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date:   Thu Nov 23 03:37:05 2023 +0000

    upstream: Include existing mux path in debug message.
    
    OpenBSD-Commit-ID: 1c3641be10c2f4fbad2a1b088a441d072e18bf16

commit f29934066bd0e561a2e516b7e584fb92d2eedee0
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Thu Nov 23 19:41:27 2023 +1100

    Add an Ubuntu 22.04 test VM.
    
    This is the same version as Github's runners so most of the testing on
    it is over there, but having a local VM makes debugging much easier.

commit a93284a780cd3972afe5f89086b75d564ba157f3
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Thu Nov 23 19:36:22 2023 +1100

    Add gcc-12 -Werror test on Ubuntu 22.04.
    
    Explictly specify gcc-11 on Ubuntu 22.04 (it's the system compiler).

commit 670f5a647e98b6fd95ad64f789f87ee3274b481b
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Thu Nov 23 19:34:57 2023 +1100

    Check return value from write to prevent warning.
    
    ... and since we're testing for flags with -Werror, this caused
    configure to mis-detect compiler flags.

commit cea007d691cfedfa07a5b8599f97ce0511f53fc9
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Wed Nov 22 21:18:55 2023 +1100

    Run compiler test program when compiling natively.
    
    ok djm@

commit ee0d305828f13536c0a416bbf9c3e81039d9ea55
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Wed Nov 22 21:18:07 2023 +1100

    Factor out compiler test program into a macro.
    
    ok djm@

commit de304c76316b029df460673725a9104224b9959b
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Wed Nov 22 08:55:36 2023 +1100

    Add fbsd14 VM to test pool.

commit 99a2df5e1994cdcb44ba2187b5f34d0e9190be91
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Tue Nov 21 16:19:29 2023 +1100

    Expand -fzero-call-used-regs test to cover gcc 11.
    
    It turns out that gcc also has some problems with -fzero-call-used-regs,
    at least v11 on mips.  Previously the test in OSSH_CHECK_CFLAG_COMPILE
    was sufficient to catch it with "=all", but not sufficient for "=used".
    Expand the testcase and include it in the other tests for good measure.
    See bz#3629.  ok djm@.

commit ff220d4010717f7bfbbc02a2400666fb9d24f250
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Tue Nov 21 14:04:34 2023 +1100

    Stop using -fzero-call-used-regs=all
    
    ... since it seems to be problematic with several different versions of
    clang.  Only use -fzero-call-used-regs=used which is less
    problematic, except with Apple's clang where we don't use it at all.
    bz#3629, ok djm@

commit 2a19e02f36b16f0f6cc915f7d1e60ead5e36303b
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Tue Nov 21 14:02:18 2023 +1100

    Allow for vendor prefix on clang version numbers.
    
    Correctly detects the version of OpenBSD's native clang, as well as
    Apple's.  Spotted tb@, ok djm@.

commit c52db0114826d73eff6cdbf205e9c1fa4f7ca6c6
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Mon Nov 20 02:50:00 2023 +0000

    upstream: set errno=EAFNOSUPPORT when filtering addresses that don't
    
    match AddressFamily; yields slightly better error message if no address
    matches. bz#3526
    
    OpenBSD-Commit-ID: 29cea900ddd8b04a4d1968da5c4a893be2ebd9e6

commit 26f3f3bbc69196d908cad6558c8c7dc5beb8d74a
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Wed Nov 15 23:03:38 2023 +0000

    upstream: when connecting via socket (the default case), filter
    
    addresses by AddressFamily if one was specified. Fixes the case where, if
    CanonicalizeHostname is enabled, ssh may ignore AddressFamily. bz5326; ok
    dtucker
    
    OpenBSD-Commit-ID: 6c7d7751f6cd055126b2b268a7b64dcafa447439

commit 050c335c8da43741ed0df2570ebfbd5d1dfd0a31
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Wed Nov 15 22:51:49 2023 +0000

    upstream: when deciding whether to enable keystroke timing
    
    obfuscation, only consider enabling it when a channel with a tty is open.
    
    Avoids turning on the obfucation when X11 forwarding only is in use,
    which slows it right down. Reported by Roger Marsh
    
    OpenBSD-Commit-ID: c292f738db410f729190f92de100c39ec931a4f1

commit 676377ce67807a24e08a54cd60ec832946cc6cae
Author: tobhe@openbsd.org <tobhe@openbsd.org>
Date:   Mon Nov 13 09:18:19 2023 +0000

    upstream: Make sure sftp_get_limits() only returns 0 if 'limits'
    
    was initialized. This fixes a potential uninitialized use of 'limits' in
    sftp_init() if sftp_get_limits() returned early because of an unexpected
    message type.
    
    ok djm@
    
    OpenBSD-Commit-ID: 1c177d7c3becc1d71bc8763eecf61873a1d3884c

commit 64e0600f23c6dec36c3875392ac95b8a9100c2d6
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Mon Nov 13 20:03:31 2023 +1100

    Test current releases of LibreSSL and OpenSSL.
    
    Retire some of the older releases.

commit c8ed7cc545879ac15f6ce428be4b29c35598bb2a
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date:   Wed Nov 1 02:08:38 2023 +0000

    upstream: Specify ssh binary to use
    
    ... instead of relying on installed one.  Fixes test failures in -portable
    when running tests prior to installation.
    
    OpenBSD-Regress-ID: b6d6ba71c23209c616efc805a60d9a445d53a685

commit e9fc2c48121cada1b4dcc5dadea5d447fe0093c3
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Wed Nov 1 13:11:31 2023 +1100

    Put long-running test targets on hipri runners.
    
    Some of the selfhosted test targets take a long time to run for various
    reasons, so label them for "libvirt-hipri" runners so that they can
    start immediately.  This should reduce the time to complete all tests.

commit 7ddf27668f0e21233f08c0ab2fe9ee3fdd6ab1e2
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Wed Nov 1 00:29:46 2023 +0000

    upstream: add some tests of forced commands overriding Subsystem
    
    directives
    
    OpenBSD-Regress-ID: eb48610282f6371672bdf2a8b5d2aa33cfbd322b

commit fb06f9b5a065dfbbef5916fc4accc03c0bf026dd
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date:   Tue Oct 31 04:15:40 2023 +0000

    upstream: Don't try to use sudo inside sshd log wrapper.
    
    We still need to check if we're using sudo since we don't want to chown
    unecessarily, as on some platforms this causes an error which pollutes
    stderr. We also don't want to unnecessarily invoke sudo, since it's
    running in the context of the proxycommand, on *other* platforms it
    may not be able to authenticate, and if we're using SUDO then it should
    already be privileged.
    
    OpenBSD-Regress-ID: 70d58df7503db699de579a9479300e5f3735f4ee

commit fc3cc33e88c242c704781c6c48087838f1dcfa2a
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date:   Tue Oct 31 02:58:45 2023 +0000

    upstream: Only try to chmod logfile if we have sudo. If we don't have
    
    sudo then we won't need to chmod.
    
    OpenBSD-Regress-ID: dbad2f5ece839658ef8af3376cb1fb1cabe2e324

commit 3a506598fddd3f18f9095af3fe917f24cbdd32e0
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Mon Oct 30 23:00:25 2023 +0000

    upstream: move PKCS#11 setup code to test-exec.sh so it can be reused
    
    elsewhere
    
    OpenBSD-Regress-ID: 1d29e6be40f994419795d9e660a8d07f538f0acb

commit f82fa227a52661c37404a6d33bbabf14fed05db0
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Mon Oct 30 17:32:00 2023 +0000

    upstream: tidy and refactor PKCS#11 setup code
    
    Replace the use of a perl script to delete the controlling TTY with a
    SSH_ASKPASS script to directly load the PIN.
    
    Move PKCS#11 setup code to functions in anticipation of it being used
    elsewhere in additional tests.
    
    Reduce stdout spam
    
    OpenBSD-Regress-ID: 07705c31de30bab9601a95daf1ee6bef821dd262

commit 3cf698c6d4ffa9be1da55672a3519e2135a6366a
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Mon Oct 30 21:35:03 2023 +1100

    Add obsd74 test VM and retire obsd69 and obsd70.

commit 3e21d58a09894acb38dc69ed615d101131f473d0
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Mon Oct 30 18:34:12 2023 +1100

    Add OpenSSL 3.3.0 as a known dev version.

commit 917ba181c2cbdb250a443589ec732aa36fd51ffa
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Mon Oct 30 13:32:03 2023 +1100

    Restore nopasswd sudo rule on Mac OS X.
    
    This seems to be missing from some (but not all) github runners, so
    restore it if it seems to be missing.

commit c5698abad6d4ec98ca20bcaaabaeacd5e1ec3f4f
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Mon Oct 30 13:26:52 2023 +1100

    Don't exit early when setting up on Mac OS X.
    
    We probably need some of the other bits in there (specifically, setting
    the perms on the home directory) so make it less of a special snowflake.

commit 1d6a878ceba60b9dc14037dddc8f036070c0065f
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date:   Sun Oct 29 06:22:07 2023 +0000

    upstream: Only try to chown logfiles that exist to prevent spurious
    
    errors.
    
    OpenBSD-Regress-ID: f1b20a476734e885078c481f1324c9ea03af991e

commit e612376427a66f835e284f6b426d16d7c85301bc
Author: anton@openbsd.org <anton@openbsd.org>
Date:   Thu Oct 26 18:52:45 2023 +0000

    upstream: make use of bsd.regress.mk in extra and interop targets; ok
    
    dtucker@
    
    OpenBSD-Regress-ID: 7ea21b5f6fc4506165093b2123d88d20ff13a4f0

commit ea0039173957d0edcd6469b9614dcedb44dcb4f9
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date:   Thu Oct 26 12:44:07 2023 +0000

    upstream: Skip conch interop tests when not enabled instead of fatal.
    
    OpenBSD-Regress-ID: b0abf81c24ac6c21f367233663228ba16fa96a46

commit d220b9ed5494252b26b95f05be118472bc3ab5c0
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date:   Wed Oct 25 05:38:08 2023 +0000

    upstream: Import regenerated moduli.
    
    OpenBSD-Commit-ID: 95f5dd6107e8902b87dc5b005ef2b53f1ff378b8

commit a611e4db4009447a0151f31a44e235ca32ed4429
Author: anton@openbsd.org <anton@openbsd.org>
Date:   Wed Oct 25 08:01:59 2023 +0000

    upstream: ssh conch interop tests requires a controlling terminal;
    
    ok dtucker@
    
    OpenBSD-Regress-ID: cbf2701bc347c2f19d907f113779c666f1ecae4a

commit da951b5e08c167acb5d6e2eec6f146502f5d6ed8
Author: anton@openbsd.org <anton@openbsd.org>
Date:   Mon Oct 23 11:30:49 2023 +0000

    upstream: Use private key that is allowed by sshd defaults in conch
    
    interop tests.
    
    ok dtucker@
    
    OpenBSD-Regress-ID: 3b7f65c8f409c328bcd4b704f60cb3d31746f045

commit 1ca166dbb3c0ce632b98869cd955f69320aa6fe8
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Fri Oct 20 20:43:00 2023 +1100

    Install Dropbear for interop testing.

commit f993bb58351c5cb71e61aede63805a34a6d4daea
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Fri Oct 20 20:39:03 2023 +1100

    Resync PuTTY and Conch path handling with upstream.
    
    Now that configure finds these for us we can remove these -portable
    specific changes.

commit ff85becd5f5f06a76efa45d30fb204a3c5e5215c
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Fri Oct 20 20:35:46 2023 +1100

    Have configure find PuTTY and Conch binaries.
    
    This will let us remove some -portable specific changes from
    test-exec.sh.

commit c54a50359b9cecddbf3ffcdc26efcb3cd6071ec1
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date:   Fri Oct 20 07:37:07 2023 +0000

    upstream: Allow overriding the locations of the Dropbear binaries
    
    similar to what we do for the PuTTY ones.
    
    OpenBSD-Regress-ID: 7de0e00518fb0c8fdc5f243b7f82f523c936049c

commit fbaa707d455a61d0aef8ae65e02a25bac5351e5c
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date:   Fri Oct 20 06:56:45 2023 +0000

    upstream: Add interop test with Dropbear.
    
    Right now this is only dbclient not the Dropbear server since it won't
    currently run as a ProxyCommand.
    
    OpenBSD-Regress-ID: 8cb898c414fcdb252ca6328896b0687acdaee496

commit c2003d0dbdcdb61ca336c3f90c5c2b4a09c8e73f
Author: Fabio Pedretti <pedretti.fabio@gmail.com>
Date:   Mon Oct 16 11:59:53 2023 +0200

    Update openssl-devel dependency in RPM spec.
    
    Since openssh 9.4p1, openssl >= 1.1.1 is required, so
    build with --without-openssl elsewhere.
    According to https://repology.org/project/openssl/versions
    openssl 1.1.1 is available on fedora >= 29 and rhel >= 8.
    Successfully build tested, installed and run on rhel 6

commit 064e09cd632721c7e6889904e07767443ee23821
Author: Fabio Pedretti <pedretti.fabio@gmail.com>
Date:   Mon Oct 16 10:13:06 2023 +0200

    Remove reference of dropped sshd.pam.old file
    
    The file was removed in openssh 8.8

commit 62db354b696b378a164b6e478cb6b0171dcb0c3d
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date:   Mon Oct 16 08:40:00 2023 +0000

    upstream: Move declaration of "len" into the block where it's used.
    
    This lets us compile Portable with -Werror with when OpenSSL doesn't have
    Ed25519 support.
    
    OpenBSD-Commit-ID: e02e4b4af351946562a7caee905da60eff16ba29

commit 6eee8c972d5901d10e80634a006b4e346b2c8c19
Author: Damien Miller <djm@mindrot.org>
Date:   Fri Oct 13 15:15:05 2023 +1100

    run t-extra regress tests
    
    This exposes the t-extra regress tests (including agent-pkcs11.sh) as
    a new extra-tests target in the top level Makefile and runs them by
    default. ok dtucker@

commit 637624dbbac13f2bc3c8ec5b15c9d627d07f2935
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Thu Oct 12 22:01:23 2023 +1100

    Don't use make -j2.
    
    While we have 2 cores available on github runners, not using it means
    that the most recent log message is the actual failure, rather than
    having to search back through the log for it.

commit 971e0cfcfd52ef1d73cf5244074c306a60006e89
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Thu Oct 12 16:23:05 2023 +1100

    Correct arg order for ED255519 AC_LINK_IFELSE test.

commit c616e64688b2a0c1b4daad69b056099be998d121
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Thu Oct 12 03:51:08 2023 +0000

    upstream: typos and extra debug trace calls
    
    OpenBSD-Regress-ID: 98a2a6b9333743274359e3c0f0e65cf919a591d1

commit c49a3fbf10162128c67c59562348de2041188974
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Thu Oct 12 03:48:53 2023 +0000

    upstream: ensure logs are owned by correct user; feedback/ok
    
    dtucker@
    
    OpenBSD-Regress-ID: c3297af8f07717f1d400a5d34529962f1a76b5a3

commit 5ec0ed79ac074c3437b25f6cba8b8cf21c8d4587
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Thu Oct 12 03:36:32 2023 +0000

    upstream: 64 %-expansion keys ought to be enough for anybody; ok
    
    dtucker (we just hit the previous limit in some cases)
    
    OpenBSD-Commit-ID: 84070f8001ec22ff5d669f836b62f206e08c5787

commit f59a94e22e46db2c23eddeb871aa9e8d93ab0016
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Thu Oct 12 02:48:43 2023 +0000

    upstream: don't dereference NULL pointer when hashing jumphost
    
    OpenBSD-Commit-ID: 251c0263e1759a921341c7efe7f1d4c73e1c70f4

commit 281c79168edcc303abfd5bca983616eaa24c5f32
Author: Damien Miller <djm@mindrot.org>
Date:   Thu Oct 12 13:20:01 2023 +1100

    Solaris: prefer PRIV_XPOLICY to PRIV_LIMIT
    
    If the system support PRIV_XPOLICY and one is set, then don't
    modify PRIV_LIMIT. bz2833, patch from Ron Jordan, ok dtucker@

commit 98fc34df837f3a3b79d2a111b96fe8a39adcab55
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Thu Oct 12 02:18:18 2023 +0000

    upstream: add %j token that expands to the configured ProxyJump
    
    hostname (or the empty string if this option is not being used). bz3610, ok
    dtucker
    
    OpenBSD-Commit-ID: ce9983f7efe6a178db90dc5c1698df025df5e339

commit 7f3180be8a85320b5d3221714b40c16e66881249
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Thu Oct 12 02:15:53 2023 +0000

    upstream: release GSS OIDs only at end of authentication; bz2982,
    
    ok dtucker@
    
    OpenBSD-Commit-ID: 0daa41e0525ae63cae4483519ecaa37ac485d94c

commit a612b93de5d86e955bfb6e24278f621118eea500
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Thu Oct 12 02:12:53 2023 +0000

    upstream: mask SIGINT/TERM/QUIT/HUP before checking quit_pending
    
    and use ppoll() to unmask them in the mainloop. Avoids race condition between
    signaling ssh to exit and polling. bz3531; ok dtucker
    
    OpenBSD-Commit-ID: 5c14e1aabcddedb95cdf972283d9c0d5083229e7

commit 531b27a006116fe7aff325510aaa576f24844452
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Wed Oct 11 23:23:58 2023 +0000

    upstream: sync usage() with ssh.1; spotted by kn@
    
    OpenBSD-Commit-ID: 191a85639477dcb5fa1616d270d93b7c8d5c1dfd

commit 64f7ca881b19be754425dca60d1590d306c9d1d0
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Wed Oct 11 23:14:33 2023 +0000

    upstream: ssh -Q does not make sense with other command-line options,
    
    so give it its own line in the manpage
    
    OpenBSD-Commit-ID: 00a747f0655c12122bbb77c2796be0013c105361

commit a752a6c0e1001f93696d7025f0c867f0376e2ecf
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Wed Oct 11 22:42:26 2023 +0000

    upstream: add ChannelTimeout support to the client, mirroring the
    
    same option in the server. ok markus@
    
    OpenBSD-Commit-ID: 55630b26f390ac063980cfe7ad8c54b03284ef02

commit 76e91e7238cdc5662bc818e2a48d466283840d23
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Wed Oct 11 22:41:05 2023 +0000

    upstream: add support for reading ED25519 private keys in PEM PKCS8
    
    format; ok markus@ tb@
    
    OpenBSD-Commit-ID: 01b85c91757e6b057e9b23b8a23f96415c3c7174

commit fc77c8e352c0f44125425c05265e3a00c183d78a
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Wed Oct 11 06:40:54 2023 +0000

    upstream: mention "none" is a valid argument to IdentityFile; bz3080
    
    OpenBSD-Commit-ID: 1b4fb590ef731099349a7d468b77f02b240ac926

commit c97520d23d1fe53d30725a2af25d2dddd6f2faff
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Wed Oct 11 05:42:08 2023 +0000

    upstream: in olde rcp/scp protocol mode, when rejecting a path from the
    
    server as not matching the glob that the client sent, log (at debug level)
    the received pathname as well as the list of possible expected paths expanded
    from the glob. bz2966
    
    OpenBSD-Commit-ID: 0bd8db8a595334ca86bca8f36e23fc0395315765

commit 208c2b719879805983398160791d6a1ef9c2c3fc
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Wed Oct 11 04:46:29 2023 +0000

    upstream: s/%.100s/%s/ in SSH- banner construction as there's no
    
    reason to limit its size: the version string bring included is a compile time
    constant going into an allocated banner string.
    
    OpenBSD-Commit-ID: 0ef73304b9bf3e534c60900cd84ab699f859ebcd

commit 0354790826b97c41bbd171a965574e159b58d83e
Author: tb@openbsd.org <tb@openbsd.org>
Date:   Tue Oct 10 06:49:54 2023 +0000

    upstream: Garbage collect cipher_get_keyiv_len()
    
    This is a compat20 leftover, unused since 2017.
    
    ok djm
    
    OpenBSD-Commit-ID: 91fa5497c9dc6883064624ac27813a567883fdce

commit 8d29ee4115001a02641386ae394992c65ed279e0
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Tue Oct 10 03:57:45 2023 +0000

    upstream: Reserve a range of "local extension" message numbers that
    
    OpenSSH promises not to use (comment change only)
    
    OpenBSD-Commit-ID: e61795b453d4892d2c99ce1039112c4a00250e03

commit 90b0d73d63a706e85f6431f05a62d2ce1b476472
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Fri Oct 6 03:32:15 2023 +0000

    upstream: typo in error message
    
    OpenBSD-Regress-ID: 6a8edf0dc39941298e3780b147b10c0a600b4fee

commit e84517f51532ec913d8fb01a8aab7307134774bb
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Fri Oct 6 03:25:14 2023 +0000

    upstream: Perform the softhsm2 setup as discrete steps rather than
    
    as a long shell pipeline. Makes it easier to figure out what has happened
    when it breaks.
    
    OpenBSD-Regress-ID: b3f1292115fed65765d0a95414df16e27772d81c

commit cb54becff4d776238e0e9072943ba0872260535d
Author: claudio@openbsd.org <claudio@openbsd.org>
Date:   Sun Sep 24 08:14:13 2023 +0000

    upstream: REGRESS_FAIL_EARLY defaults to yes now. So no need to
    
    overload the value here anymore. OK tb@ bluhm@
    
    OpenBSD-Regress-ID: f063330f1bebbcd373100afccebc91a965b14496

commit f01f5137ceba65baf34ceac5a298c12ac01b1fef
Author: jmc@openbsd.org <jmc@openbsd.org>
Date:   Wed Oct 4 05:42:10 2023 +0000

    upstream: spelling fix;
    
    OpenBSD-Commit-ID: 493f95121567e5ab0d9dd1150f873b5535ca0195

commit 80a2f64b8c1d27383cc83d182b73920d1e6a91f1
Author: Damien Miller <djm@mindrot.org>
Date:   Wed Oct 4 15:34:10 2023 +1100

    crank version numbers

commit f65f187b105d9b5c12fd750a211397d08c17c6d4
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Wed Oct 4 04:04:09 2023 +0000

    upstream: openssh-9.5
    
    OpenBSD-Commit-ID: 5e0af680480bd3b6f5560cf840ad032d48fd6b16

commit ffe27e54a4bb18d5d3bbd3f4cc93a41b8d94dfd2
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Wed Oct 4 04:03:50 2023 +0000

    upstream: add some cautionary text about % token expansion and
    
    shell metacharacters; based on report from vinci AT protonmail.ch
    
    OpenBSD-Commit-ID: aa1450a54fcee2f153ef70368d90edb1e7019113

commit 60ec3d54fd1ebfe2dda75893fa1e870b8dffbb0d
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Tue Oct 3 23:56:10 2023 +0000

    upstream: fix link to agent draft; spotted by Jann Horn
    
    OpenBSD-Commit-ID: ff5bda21a83ec013db683e282256a85201d2dc4b

commit 12e2d4b13f6f63ce2de13cbfcc9e4d0d4b4ab231
Author: Damien Miller <djm@mindrot.org>
Date:   Wed Oct 4 10:54:04 2023 +1100

    use portable provider allowlist path in manpage
    
    spotted by Jann Horn

commit 6c2c6ffde75df95fd838039850d3dd3d84956d87
Author: deraadt@openbsd.org <deraadt@openbsd.org>
Date:   Tue Sep 19 20:37:07 2023 +0000

    upstream: typo; from Jim Spath
    
    OpenBSD-Commit-ID: 2f5fba917b5d4fcf93d9e0b0756c7f63189e228e

commit b6b49130a0089b297245ee39e769231d7c763014
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Sun Sep 10 23:12:32 2023 +0000

    upstream: rename remote_glob() -> sftp_glob() to match other API
    
    OpenBSD-Commit-ID: d9dfb3708d824ec02970a84d96cf5937e0887229

commit 21b79af6c8d2357c822c84cef3fbdb8001ed263b
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Sun Sep 10 03:51:55 2023 +0000

    upstream: typo in comment
    
    OpenBSD-Commit-ID: 69285e0ce962a7c6b0ab5f17a293c60a0a360a18

commit 41232d25532b4d2ef6c5db62efc0cf50a79d26ca
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Sun Sep 10 15:45:38 2023 +1000

    Use zero-call-used-regs=used with Apple compilers.
    
    Apple's versions of clang have version numbers that do not match the
    corresponding upstream clang versions.  Unfortunately, they do still
    have the clang-15 zero-call-used-regs=all bug, so for now use the value
    that doesn't result in segfaults.  We could allowlist future versions
    that are known to work.  bz#3584 (and probably also our github CI
    failures).

commit 90ccc5918ea505bf156c31148b6b59a1bf5d6dc6
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Sun Sep 10 03:25:53 2023 +0000

    upstream: randomise keystroke obfuscation intervals and average
    
    interval rate. ok dtucker@
    
    OpenBSD-Commit-ID: 05f61d051ab418fcfc4857ff306e420037502382

commit bd1b9e52f5fa94d87223c90905c5fdc1a7c32aa6
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Fri Sep 8 06:34:24 2023 +0000

    upstream: fix sizeof(*ptr) instead sizeof(ptr) in realloc (pointer here
    
    is char**, so harmless); spotted in CID 416964
    
    OpenBSD-Commit-ID: c61caa4a5a667ee20bb1042098861e6c72c69002

commit c4f966482983e18601eec70a1563115de836616f
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Fri Sep 8 06:10:57 2023 +0000

    upstream: regress test recursive remote-remote directories copies where
    
    the directory contains a symlink to another directory.
    
    also remove errant `set -x` that snuck in at some point
    
    OpenBSD-Regress-ID: 1c94a48bdbd633ef2285954ee257725cd7bc456f

commit 5e1dfe5014ebc194641678303e22ab3bba15f4e5
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Fri Sep 8 06:10:02 2023 +0000

    upstream: fix recursive remote-remote copies of directories that
    
    contain symlinks to other directories (similar to bz3611)
    
    OpenBSD-Commit-ID: 7e19d2ae09b4f941bf8eecc3955c9120171da37f

commit 7c0ce2bf98b303b6ad91493ee3247d96c18ba1f6
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Fri Sep 8 05:50:57 2023 +0000

    upstream: regress test for recursive copies of directories containing
    
    symlinks to other directories. bz3611, ok dtucker@
    
    OpenBSD-Regress-ID: eaa4c29cc5cddff4e72a16bcce14aeb1ecfc94b9

commit 2de990142a83bf60ef694378b8598706bc654b08
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Fri Sep 8 05:56:13 2023 +0000

    upstream: the sftp code was one of my first contributions to
    
    OpenSSH and it shows - the function names are terrible.
    
    Rename do_blah() to sftp_blah() to make them less so.
    
    Completely mechanical except for sftp_stat() and sftp_lstat() which
    change from returning a pointer to a static variable (error-prone) to
    taking a pointer to a caller-provided receiver.
    
    OpenBSD-Commit-ID: eb54d6a72d0bbba4d623e2175cf5cc4c75dc2ba4

