- (djm) [sandbox-seccomp-filter.c sandbox-systrace.c] Allow shutdown(2)
   syscall from sandboxes; it may be called by packet_close.
 - (dtucker) [readconf.c] Include <arpa/inet.h> for the hton macros.  Fixes
   build with HP-UX's compiler.  Patch from Kevin Brott.
 - (tim) [Makefile.in] build regress/setuid-allow.
   - markus@cvs.openbsd.org 2014/01/27 18:58:14
     [Makefile.in digest.c digest.h hostfile.c kex.h mac.c hmac.c hmac.h]
     replace openssl HMAC with an implementation based on our ssh_digest_*
     ok and feedback djm@
   - markus@cvs.openbsd.org 2014/01/27 19:18:54
     [auth-rsa.c cipher.c ssh-agent.c sshconnect1.c sshd.c]
     replace openssl MD5 with our ssh_digest_*; ok djm@
   - markus@cvs.openbsd.org 2014/01/27 20:13:46
     [digest.c digest-openssl.c digest-libc.c Makefile.in]
     rename digest.c to digest-openssl.c and add libc variant; ok djm@
ignore a few more regress droppings
   - jmc@cvs.openbsd.org 2014/01/28 14:13:39
     [ssh-keyscan.1]
     kill some bad Pa;
     From: Jan Stary
   - djm@cvs.openbsd.org 2014/01/29 00:19:26
     [sshd.c]
     use kill(0, ...) instead of killpg(0, ...); on most operating systems
     they are equivalent, but SUSv2 describes the latter as having undefined
     behaviour; from portable; ok dtucker
     (Id sync only; change is already in portable)
   - djm@cvs.openbsd.org 2014/01/29 06:18:35
     [Makefile.in auth.h auth2-jpake.c auth2.c jpake.c jpake.h monitor.c]
     [monitor.h monitor_wrap.c monitor_wrap.h readconf.c readconf.h]
     [schnorr.c schnorr.h servconf.c servconf.h ssh2.h sshconnect2.c]
     remove experimental, never-enabled JPAKE code; ok markus@
   - jmc@cvs.openbsd.org 2014/01/29 14:04:51
     [sshd_config.5]
     document kbdinteractiveauthentication;
     requested From: Ross L Richardson

     dtucker/markus helped explain its workings;
   - djm@cvs.openbsd.org 2014/01/30 22:26:14
     [sandbox-systrace.c]
     allow shutdown(2) syscall in sandbox - it may be called by packet_close()
     from portable
     (Id sync only; change is already in portable)
   - tedu@cvs.openbsd.org 2014/01/31 16:39:19
     [auth2-chall.c authfd.c authfile.c bufaux.c bufec.c canohost.c]
     [channels.c cipher-chachapoly.c clientloop.c configure.ac hostfile.c]
     [kexc25519.c krl.c monitor.c sandbox-systrace.c session.c]
     [sftp-client.c ssh-keygen.c ssh.c sshconnect2.c sshd.c sshlogin.c]
     [openbsd-compat/explicit_bzero.c openbsd-compat/openbsd-compat.h]
     replace most bzero with explicit_bzero, except a few that cna be memset
     ok djm dtucker
   - djm@cvs.openbsd.org 2014/02/02 03:44:32
     [auth1.c auth2-chall.c auth2-passwd.c authfile.c bufaux.c bufbn.c]
     [buffer.c cipher-3des1.c cipher.c clientloop.c gss-serv.c kex.c]
     [kexdhc.c kexdhs.c kexecdhc.c kexgexc.c kexecdhs.c kexgexs.c key.c]
     [monitor.c monitor_wrap.c packet.c readpass.c rsa.c serverloop.c]
     [ssh-add.c ssh-agent.c ssh-dss.c ssh-ecdsa.c ssh-ed25519.c]
     [ssh-keygen.c ssh-rsa.c sshconnect.c sshconnect1.c sshconnect2.c]
     [sshd.c]
     convert memset of potentially-private data to explicit_bzero()
   - djm@cvs.openbsd.org 2014/02/03 23:28:00
     [ssh-ecdsa.c]
     fix memory leak; ECDSA_SIG_new() allocates 'r' and 's' for us, unlike
     DSA_SIG_new. Reported by Batz Spear; ok markus@
   - djm@cvs.openbsd.org 2014/02/02 03:44:31
     [digest-libc.c digest-openssl.c]
     convert memset of potentially-private data to explicit_bzero()
   - djm@cvs.openbsd.org 2014/02/04 00:24:29
     [ssh.c]
     delay lowercasing of hostname until right before hostname
     canonicalisation to unbreak case-sensitive matching of ssh_config;
     reported by Ike Devolder; ok markus@
   - djm@cvs.openbsd.org 2014/02/04 00:24:29
     [ssh.c]
     delay lowercasing of hostname until right before hostname
     canonicalisation to unbreak case-sensitive matching of ssh_config;
     reported by Ike Devolder; ok markus@
 - (djm) [openbsd-compat/Makefile.in] Add missing explicit_bzero.o
 - (djm) [regress/setuid-allowed.c] Missing string.h for strerror()