BSD Commit Log Search

   Clear tabs and wide characters cut by EL and ED, GitHub issue 5819 from
   Arkadiusz Miśkiewicz.

   update to vim-9.2.1251

   update to harper-3.0.0, from Alvar Penning (maintainer)

   Comment _nomad.

   rpki-client: rename the string containing the crldp to ... crldp

   ok job

   Fix long standing build breakage with a non-default WRKOBJDIR.

   rpki-client: rename cert->crl member to cert->crldp

   crl is generally used for struct crl, so this name is confusing to my aging
   brain.

   ok job

   Update to gke-gcloud-auth-plugin-37.2.3.

   Remove nomad.
   It's been unmaintained for a while and no one seems interested to pick it
   up.

   ok sthen@

   rpki-client: rename crldp to dps in cert_crldp()

   In a later commit I want to use crldp for something else. The one CRL
   distribution point is called dp, so call the stack of distribution points
   dps.

   ok job

   regress test for AuthorizedPrincipalsCommand with no command arguments.

   Anthropic ANT-2026-YX19N77E

   make a AuthorizedPrincipalsCommand with no specified arguments do what
   it is documented to do: supply the target username as a default argument.

   Anthropic ANT-2026-YX19N77E

   check RSA keys decoded from PEM against our hard size limits

   Anthropic ANT-2026-YPAO7WLH

   when updating known_hosts files for UpdateHostKeys, bail out if the
   unable to write to the first known_hosts file in the list.

   Avoids a situation where a host key could be fully removed from all
   known_hosts files.

   Anthropic ANT-2026-YH3JNW7S

   when uploading/crossloading, prefer to use LSETSTAT as it makes it more
   difficult for a local attacker on the destination play tricks where
   they replace paths around the time where the client is restoring
   permissions on things.

   Also skip setting permissions entirely when its not necessary to do so.

   Anthropic ANT-2026-Y4XK22QX

   Build teleport's RDP support code, and set ONLY_FOR_ARCHS to amd64 aarch64

   ok tb@

   regress test for properly-delimited %C token

   Anthropic ANT-2026-WLVAFTWQ

   nul-delemit the concatenation of user/hosts/port/etc that is hashed
   to generate the %C token. This avoids ambiguiuties like 10.0.0.1 port 2222,
   10.0.0.12 port 222 and 10.0.0.122 port 22 all hashing to the same value.

   Anthropic ANT-2026-WLVAFTWQ

   Use the lang/go MODULE as intended.

   when StrictHostkeyChecking=no and an changed/revoked host key was permitted
   by the user anyway, ssh(1) turns off a bunch of more risk options including
   various forwardings. Unfortunately we had previously neglected to turn them
   off over the mux channel.

   Anthropic ANT-2026-VFW3JCKW

   relayd: refactor config_getrelayfd

   Based on a GCC16 warning (Although it wasnt a useful warning, it did show that
   something was ugly here). Unknown fd types and imsgs without an fd are now
   treated as errors instead of being silently ignored.

   OK and tweak tb, OK kirill

   more completely close mux fds when the owning process goes away.
   Avoid case where the server could still write stderr data while in
   the DRAIN state if it never sent a CLOSE

   Anthropic ANT-2026-T8GUCMJY

   check for errors when writing known_hosts files and refuse to replace
   if the replacement is incomplete.

   Anthropic ANT-2026-SZY2YGUM

   @revoked markers in known_hosts should apply to VerifyHostKeyDNS hostkeys
   too

   Anthropic ANT-2026-S4RA7UNG

   `ssh -Z` is intended to be a purely local operation and shouldn't
   connect to a mux socket.

   Anthopic ANT-2026-R47M7VEU

   be more careful when killing a ProxyCommand (including implicit ProxyJump
   ones); observe if it already has exited via the main ssh.c SIGCHLD handler
   and wrap the kill in sigprocmask() to avoid races.

   Prevents SIGHUP from being delivered to an unrelated process if the proxy
   command's PID is recycled.

   Antropic ANT-2026-ODQD8QBH

   regress test for "PubkeyAcceptedAlgorithms -*" and friends

   Anthropic ANT-2026-O2RQ9GNA

   rpki-client: wrap two lines for consistency

   Correctly error on a algorithm allowlist that removes all algorithms, e.g.
   `PubkeyAcceptedAlgorithms -*` rather than defaulting back to the full list

   Anthropic ANT-2026-O2RQ9GNA

   set a glob(3) error callback when globbing Include files to allow
   discrimination between missing files/directories and failure to open
   a file or directory.

   Avoids possible (though unlikely) situation where a local attacker could
   cause an Include'd file from being processed by doing tricks like hitting
   fd limits at the right time.

   Anthropic ANT-2026-NF7CR4JX