Merge V10.3P1 - #877

Open

Tess Gauthier (tgauth) wants to merge 297 commits into

PowerShell:latestw_allfrom

tgauth:merge-v10.3P1

This pull request is big! We're only showing the most recent 250 commits

Commits on Oct 30, 2025

upstream: support ed25519 signatures via libcrypto. Mostly by Jeremy
Damien Miller (djmdjm)
committed
266647c
upstream: move crypto_hash_sha512() to be inline in crypto_api.h, saves
Damien Miller (djmdjm)
committed
94a7825

Commits on Oct 31, 2025

upstream: Check tmux version and skip if too old. ok djm@

Darren Tucker (daztucker)
authored and
Damien Miller (djmdjm)
committed
9dcd640
upstream: Prepare for gcc 3 leaving the building, COMPILER_VERSION

miod@openbsd.org
authored and
Damien Miller (djmdjm)
committed
249224a
upstream: don't link hash.c
Damien Miller (djmdjm)
committed
c2a1789
fix linking for sk-dummy.so, used in tests
Damien Miller (djmdjm)
committed
a5f6385
rename openbsd-compat sha2.h -> bsd-sha2.h
Damien Miller (djmdjm)
committed
57e347b
add sshlog() replacement to sk-dummy.so
Damien Miller (djmdjm)
committed
590a260
skip pkcs11 tests when built --without-openssl
Damien Miller (djmdjm)
committed
7e2f89b
check PAM user against previous user, not pw_name
Damien Miller (djmdjm)
committed
2425d7f
Add OpenBSD 7.8 test target.
Darren Tucker (daztucker)
committed
d87e7f0
Support using git for OpenBSD src tree tests.
Darren Tucker (daztucker)
committed
7e5d404

Commits on Nov 7, 2025

upstream: cleanup file descriptors across PKCS#11 client/helper
Damien Miller (djmdjm)
committed
f2ff1d9
upstream: move stringlist_append() and stringlist_free() to misc.c
Damien Miller (djmdjm)
committed
1399419
upstream: Remove some unnecessary checks in
Damien Miller (djmdjm)
committed
9bea081
upstream: Cope with recent changes and don't link hash.c.

anton@openbsd.org
authored and
Damien Miller (djmdjm)
committed
e57ef43
upstream: link against ed25519-openssl.c instead of ed25519.c
Damien Miller (djmdjm)
committed
9d8c686
upstream: unit test for stringlist_append() and stringlist_free()
Damien Miller (djmdjm)
committed
a1c526f
upstream: sk-dummy.so needs sshlog() stub after ed25519-openssl.c
Damien Miller (djmdjm)
committed
5794f2a
upstream: Escape SSH_AUTH_SOCK paths that are sent to the shell as
Damien Miller (djmdjm)
committed
1f1d63e
escape quotes in yaml
Damien Miller (djmdjm)
committed
48d8293
try single quotes instead of escaped quotes
Damien Miller (djmdjm)
committed
5a104d8
octal-escape the colon character
Damien Miller (djmdjm)
committed
d128133

Commits on Nov 12, 2025

Commits on Nov 13, 2025

upstream: sshkey_ec_validate_public: zap trailing blank I missed on

Theo Buehler (botovq)
authored and
Damien Miller (djmdjm)
committed
c09eeba
upstream: update our ML-KEM implementation to upstream libcrux
Damien Miller (djmdjm)
committed
84347d6
upstream: sync support for systems that lack __builtin_popcount() from
Damien Miller (djmdjm)
committed
6aba700
upstream: Remove calls to OpenSSL_add_all_algorithms()
Darren Tucker (daztucker)
committed
d9955e4
Remove remaining OpenSSL_add_all_algorithms() calls.
Darren Tucker (daztucker)
committed
90501bc
seccomp sandbox: allow uname(3)

Icenowy Zheng (Icenowy)
authored and
Darren Tucker (daztucker)
committed
ec41739
Move libcrypto init check into entropy.c.
Darren Tucker (daztucker)
committed
e2b93e1

Commits on Nov 17, 2025

Commits on Nov 18, 2025

upstream: don't strnvis() log messages that are going to be logged
Damien Miller (djmdjm)
committed
e4cc5ab
upstream: Export XDG_RUNTIME_DIR to child ssh sessions

Jérémie Courrèges-Anglas (jcourreges)
authored and
Damien Miller (djmdjm)
committed
58533bb
Pull in rev 1.17 for spelling fix.
Darren Tucker (daztucker)
committed
ccad76e

Commits on Nov 20, 2025

Commits on Nov 24, 2025

Commits on Nov 25, 2025

Commits on Nov 27, 2025

upstream: Add Escape option ~I that shows information about the current
Darren Tucker (daztucker)
committed
52037ed

Commits on Nov 29, 2025

Commits on Dec 3, 2025

upstream: correctly quote filenames in verbose output for local->local
Damien Miller (djmdjm)
committed
6662239

Commits on Dec 5, 2025

Commits on Dec 6, 2025

Commits on Dec 7, 2025

upstream: spaces->tab
Darren Tucker (daztucker)
committed
45aca67
upstream: Avoid "if ! thing || ! otherthing; then" constructs since
Darren Tucker (daztucker)
committed
f62868e
upstream: allow network programs select DSCP_VA for network ToS

phessler@openbsd.org
authored and
Darren Tucker (daztucker)
committed
f701869
Define IPTOS_DSCP_VA if not already defined.
Darren Tucker (daztucker)
committed
185459d
Remove generated compat includes during distclean.
Darren Tucker (daztucker)
committed
f086faf
Add OpenBSD 7.8 VM test target.
Darren Tucker (daztucker)
committed
d05b704

Commits on Dec 16, 2025

Commits on Dec 19, 2025

upstream: fix markup, .CM -> .Cm

jonathangray
authored and
Damien Miller (djmdjm)
committed
3ab346a
upstream: new sentence, new line

jonathangray
authored and
Damien Miller (djmdjm)
committed
4c9de15
upstream: detect invalid sshd_config Subsystem directives inside
Damien Miller (djmdjm)
committed
4e0f2de
upstream: don't crash at connection time if the main sshd_config
Damien Miller (djmdjm)
committed
831e6db
upstream: check that invalid subsystem directives inside Match
Damien Miller (djmdjm)
committed
81e5bb8
upstream: regression test for bz3906: sshd crashing at connection
Damien Miller (djmdjm)
committed
345892b
upstream: correctly check subsystem command is not the empty string
Damien Miller (djmdjm)
committed
0b98be7
upstream: typo in comment
Damien Miller (djmdjm)
committed
b652322

Commits on Dec 22, 2025

Commits on Dec 28, 2025

Update ssh-agent.1

Ludovic Rousseau (LudovicRousseau)
authored and
Darren Tucker (daztucker)
committed
6eafc52

Commits on Dec 30, 2025

Commits on Jan 4, 2026

upstream: rewrite SOCKS4/4A/5 parsing code to use sshbuf functions
Damien Miller (djmdjm)
committed
a6f8f79

Commits on Jan 20, 2026

upstream: Fill entropy in a single operation instead of hundreds.
Darren Tucker (daztucker)
committed
1cc936b

Commits on Jan 22, 2026

upstream: If editline has been switched to vi mode (i.e. via "bind

Stuart Henderson (sthen)
authored and
Damien Miller (djmdjm)
committed
b0d0b71
upstream: In ssh(1), don't try to match certificates held in an
Damien Miller (djmdjm)
committed
d7950ac

Commits on Jan 27, 2026

upstream: Make it clear that DenyUsers/DenyGroups overrides

Todd C. Miller (millert)
authored and
Damien Miller (djmdjm)
committed
409dc95
upstream: Implement "query" extension from
Damien Miller (djmdjm)
committed
832a770

Commits on Feb 5, 2026

upstream: Implement missing pieces of FIDO/webauthn signature support,
Damien Miller (djmdjm)
committed
6463960

Commits on Feb 6, 2026

upstream: remove vestige of when we supported running without privsep
Damien Miller (djmdjm)
committed
91c4d42
Add OpenIndiana VM test target.
Darren Tucker (daztucker)
committed
01bddc0
Run tests on older OmniOS version too.
Darren Tucker (daztucker)
committed
f0b7ecf
Remove obsolete comments.
Darren Tucker (daztucker)
committed
dfbb852
Split sudo out to its own install line.
Darren Tucker (daztucker)
committed
86e0f4a
Add a GSSAPI authentication test

Pavol Zacik (zacikpa)
authored and
Darren Tucker (daztucker)
committed
d84dbcc
Enable gss-auth tests on Kerberos test configs.
Darren Tucker (daztucker)
committed
b83c0bb

Commits on Feb 7, 2026

upstream: Typo fixes, mostly in comments.
Darren Tucker (daztucker)
committed
1160092
Typographical Fixes

THE Spellchecker (THE-Spellchecker)
authored and
Darren Tucker (daztucker)
committed
5b12d83
upstream: Fetch the error reason from libcrypto
Darren Tucker (daztucker)
committed
9c4949c
upstream: Adjust Makefiles to include just-added
Darren Tucker (daztucker)
committed
670f7d2
upstream: bit of webauthn support missed in previous commit
Damien Miller (djmdjm)
committed
15fe1ce
Fix ut_type for btmp records

Artem Savkov (sm00th)
authored and
Darren Tucker (daztucker)
committed
a393759
Resync with upstream (unused header and whitespace).
Darren Tucker (daztucker)
committed
77e41d0
Resync headers with upstream.
Darren Tucker (daztucker)
committed
3fd88ca
Resync minor format diffs with upstream.
Darren Tucker (daztucker)
committed
9e585f1
Move poll.h include to resync with upstream.
Darren Tucker (daztucker)
committed
4fe79e3
Move paths.h and poll.h includes to resync with upstream.
Darren Tucker (daztucker)
committed
6decbb9
upstream: Move ssherr.h to where portable needs it.
Darren Tucker (daztucker)
committed
ccc1faf
upstream: Also check for EWOULDBLOCK on system error. This is the
Darren Tucker (daztucker)
committed
9ebce88
Remove unused <netinet/in_systm.h> includes.

Jonas Termansen (sortie)
authored and
Darren Tucker (daztucker)
committed
ad63236
upstream: misc.h is needed for ForwardOptions in servconf.h.
Darren Tucker (daztucker)
committed
2a1a257

Commits on Feb 8, 2026

Commits on Feb 10, 2026

Commits on Feb 11, 2026

Commits on Feb 13, 2026

upstream: remove unneeded forward struct declaration ok djm@

jonathangray
authored and
Darren Tucker (daztucker)
committed
db47519
upstream: Replace <sys/mount.h> with <limits.h>
Darren Tucker (daztucker)
committed
8b3a055
Remove DragonFlyBSD workaround for sys/mount.h.
Darren Tucker (daztucker)
committed
c244769

Commits on Feb 15, 2026

auth-pam: Add debugging information when we receive PAM messages

Marco Trevisan (3v1n0)
authored and
Darren Tucker (daztucker)
committed
9b0e50b
auth-pam: Add an enum to define the PAM done status

Marco Trevisan (3v1n0)
authored and
Darren Tucker (daztucker)
committed
3e8a45e
Remove obsolete comment referencing auth-chall.c.
Darren Tucker (daztucker)
committed
d8b806a

Commits on Feb 16, 2026

upstream: remove unneeded includes; ok dtucker@

jonathangray
authored and
Darren Tucker (daztucker)
committed
07c6413
upstream: Add basic test for keyboard-interactive auth.
Darren Tucker (daztucker)
committed
c5cee49
upstream: Reorder headers to match KNF and Portable.
Darren Tucker (daztucker)
committed
7a59f55
fix duplicate PAM msgs, missing loginmsg reset

Matthew Heller
authored and
Darren Tucker (daztucker)
committed
a1158bb
auth-pam: Immediately report interactive instructions to clients

Marco Trevisan (3v1n0)
authored and
Darren Tucker (daztucker)
committed
b9a6dd4
Remove "draining" of PAM prompts.
Darren Tucker (daztucker)
committed
df2b281
Removed duplicate includes; spotted by jsg@.
Darren Tucker (daztucker)
committed
723b76c

Commits on Feb 17, 2026

Restore utf8.h removed earlier as it's needed.
Darren Tucker (daztucker)
committed
9eb778c
upstream: remove duplicate includes; ok dtucker@

jonathangray
authored and
Damien Miller (djmdjm)
committed
0e35095
upstream: make IPQoS first-match-wins in sshd_config as it's
Damien Miller (djmdjm)
committed
2b0f4a7

Commits on Feb 18, 2026

Commits on Feb 24, 2026

Commits on Feb 28, 2026

Commits on Mar 2, 2026

upstream: Move banner exchange to sshd-auth process
Damien Miller (djmdjm)
committed
bb781f0

Commits on Mar 3, 2026

upstream: Replace all remaining instances of u_intXX_t types with the
Darren Tucker (daztucker)
committed
2a387ba

Commits on Mar 5, 2026

Commits on Mar 6, 2026

Commits on Mar 10, 2026

stubs for OpenBSD unveil(2)
Damien Miller (djmdjm)
committed
73888af
upstream: Stop doing access() before execve(). It is a TOCTOU, but

deraadt@openbsd.org
authored and
Damien Miller (djmdjm)
committed
b75bf33
upstream: With it's own daemonization / fd cleaning code, ssh-agent

deraadt@openbsd.org
authored and
Damien Miller (djmdjm)
committed
46eb7dc
upstream: unveil ssh-pkcs11-helper too; fixes breakage spotted by
Damien Miller (djmdjm)
committed
2a9e1aa
upstream: When execve() failure is indicated on the pipe, replicate

deraadt@openbsd.org
authored and
Damien Miller (djmdjm)
committed
beba588
upstream: when unveils error our, use correct variable

deraadt@openbsd.org
authored and
Damien Miller (djmdjm)
committed
ef98b60

Commits on Mar 11, 2026

upstream: whitespace

Damien Miller (djmdjm)
authored and
Darren Tucker (daztucker)
committed
70a4126
upstream: Fix potential 1-byte array overrun
Darren Tucker (daztucker)
committed
2416827
upstream: Check return values of fcntl(... O_CLOEXEC)
Darren Tucker (daztucker)
committed
552a5c7

Commits on Mar 23, 2026

Commits on Mar 26, 2026

Upstream tests don't use the config file.
Darren Tucker (daztucker)
committed
12da685
Add a Valgrind test of the PAM config.
Darren Tucker (daztucker)
committed
4bb4f16
Add a VM-based test for OpenBSD-current.
Darren Tucker (daztucker)
committed
d3efbba

Commits on Mar 28, 2026

upstream: fix potential hang if /etc/moduli doesn't contain the
Damien Miller (djmdjm)
committed
c5182e3
upstream: mention that RevokedKeys is read by the server at each
Damien Miller (djmdjm)
committed
21ecb5f
upstream: fix base16 parsing; currently unused. From Renaud Allard
Damien Miller (djmdjm)
committed
8331cb9
upstream: ensure c->local_window doesn't underflow during updates;
Damien Miller (djmdjm)
committed
fd5018f
seccomp sandbox: allow riscv_hwprobe syscall if present

Icenowy Zheng (Icenowy)
authored and
Damien Miller (djmdjm)
committed
fd7d4b2
openbsd-compat: reword EAI_NONAME error string

Laurent Chardon (LaurentChardon)
authored and
Damien Miller (djmdjm)
committed
6eb5a68

Commits on Mar 29, 2026

fix state confusion between PAM and privsep code
Damien Miller (djmdjm)
committed
bdaf65a
use nonnull attribute when available
Damien Miller (djmdjm)
committed
c90f46b
depend
Damien Miller (djmdjm)
committed
54443b8

Commits on Mar 30, 2026

upstream: switch from int to long long for bandwidth calculations;
Damien Miller (djmdjm)
committed
b62a6cf
upstream: apply the same validity rules to usernames and hostnames
Damien Miller (djmdjm)
committed
0a0ef45
upstream: Add special handling of

Darren Tucker (daztucker)
authored and
Damien Miller (djmdjm)
committed
5576e26
upstream: Check if host keys exist before adding them, and expand

Darren Tucker (daztucker)
authored and
Damien Miller (djmdjm)
committed
2ecfcc0
upstream: Ensure known_hosts file exists when setting up.

Darren Tucker (daztucker)
authored and
Damien Miller (djmdjm)
committed
445db5c
upstream: Use ~/.shosts for Hostbased test.

Darren Tucker (daztucker)
authored and
Damien Miller (djmdjm)
committed
55fc7bf
upstream: add a regression test for ProxyJump/-J; ok dtucker
Damien Miller (djmdjm)
committed
607bd87
Add proxyjump.sh omitted from previous commit.
Darren Tucker (daztucker)
committed
1340d3f

Commits on Mar 31, 2026

add missing <stdio.h> include to unit tests for printf

Michael Forney (michaelforney)
authored and
Damien Miller (djmdjm)
committed
52c01f2

Commits on Apr 1, 2026

avoid k suffix in dd count operand in sftp-resume test

Michael Forney (michaelforney)
authored and
Damien Miller (djmdjm)
committed
fe86c39

Commits on Apr 2, 2026

properly bail out when PAM changes username
Damien Miller (djmdjm)
committed
5d72f18
upstream: Fix possible sshd crash when sshd_config set MaxStartups
Damien Miller (djmdjm)
committed
78d5498
upstream: add missing askpass check when using
Damien Miller (djmdjm)
committed
c805b97
upstream: when downloading files as root in legacy (-O) mode and
Damien Miller (djmdjm)
committed
487e8ac
upstream: correctly match ECDSA signature algorithms against
Damien Miller (djmdjm)
committed
fd1c7e1
upstream: move username validity check for usernames specified on
Damien Miller (djmdjm)
committed
76685c9
upstream: openssh-10.3
Damien Miller (djmdjm)
committed
eb3a5bb
upstream: adapt to username validity check change
Damien Miller (djmdjm)
committed
5aa0992
Update versions in RPM spec files
Damien Miller (djmdjm)
committed
f8b9d69
depend
Damien Miller (djmdjm)
committed
4168c90
update release notes URL
Damien Miller (djmdjm)
committed
500b203
autogenerated files for release
Damien Miller (djmdjm)
committed
2d98db9

Commits on Sep 1, 2026

Merge upstream OpenSSH V_10_3_P1
Tess Gauthier (tgauth)
committed
7c952d6