- djm@cvs.openbsd.org 2014/07/03 01:45:38
     [sshkey.c]
     make Ed25519 keys' title fit properly in the randomart border; bz#2247
     based on patch from Christian Hesse
   - djm@cvs.openbsd.org 2014/07/03 03:11:03
     [ssh-agent.c]
     Only cleanup agent socket in the main agent process and not in any
     subprocesses it may have started (e.g. forked askpass). Fixes
     agent sockets being zapped when askpass processes fatal();
     bz#2236 patch from Dmitry V. Levin
   - djm@cvs.openbsd.org 2014/07/03 03:15:01
     [ssh-add.c]
     make stdout line-buffered; saves partial output getting lost when
     ssh-add fatal()s part-way through (e.g. when listing keys from an
     agent that supports key types that ssh-add doesn't);
     bz#2234, reported by Phil Pennock
   - djm@cvs.openbsd.org 2014/07/03 03:26:43
     [digest-openssl.c]
     use EVP_Digest() for one-shot hash instead of creating, updating,
     finalising and destroying a context.
     bz#2231, based on patch from Timo Teras
   - djm@cvs.openbsd.org 2014/07/03 03:34:09
     [gss-serv.c session.c ssh-keygen.c]
     standardise on NI_MAXHOST for gethostname() string lengths; about
     1/2 the cases were using it already. Fixes bz#2239 en passant
   - djm@cvs.openbsd.org 2014/07/03 03:47:27
     [ssh-keygen.c]
     When hashing or removing hosts using ssh-keygen, don't choke on
     @revoked markers and don't remove @cert-authority markers;
     bz#2241, reported by mlindgren AT runelind.net
   - djm@cvs.openbsd.org 2014/07/03 04:36:45
     [digest.h]
     forward-declare struct sshbuf so consumers don't need to include sshbuf.h
   - djm@cvs.openbsd.org 2014/07/03 05:32:36
     [ssh_config.5]
     mention '%%' escape sequence in HostName directives and how it may
     be used to specify IPv6 link-local addresses
   - djm@cvs.openbsd.org 2014/07/03 05:38:17
     [ssh.1]
     document that -g will only work in the multiplexed case if applied to
     the mux master
   - djm@cvs.openbsd.org 2014/07/03 06:39:19
     [ssh.c ssh_config.5]
     Add a %C escape sequence for LocalCommand and ControlPath that expands
     to a unique identifer based on a has of the tuple of (local host,
     remote user, hostname, port).

     Helps avoid exceeding sockaddr_un's miserly pathname limits for mux
     control paths.

     bz#2220, based on patch from mancha1 AT zoho.com; ok markus@
   - jmc@cvs.openbsd.org 2014/07/03 07:45:27
     [ssh_config.5]
     escape %C since groff thinks it part of an Rs/Re block;
   - djm@cvs.openbsd.org 2014/07/03 11:16:55
     [auth.c auth.h auth1.c auth2.c]
     make the "Too many authentication failures" message include the
     user, source address, port and protocol in a format similar to the
     authentication success / failure messages; bz#2199, ok dtucker
   - jsing@cvs.openbsd.org 2014/07/03 12:42:16
     [cipher-chachapoly.c]
     Call chacha_ivsetup() immediately before chacha_encrypt_bytes() - this
     makes it easier to verify that chacha_encrypt_bytes() is only called once
     per chacha_ivsetup() call.
     ok djm@
   - djm@cvs.openbsd.org 2014/07/03 22:23:46
     [sshconnect.c]
     when rekeying, skip file/DNS lookup if it is the same as the key sent
     during initial key exchange. bz#2154 patch from Iain Morgan; ok markus@
   - djm@cvs.openbsd.org 2014/07/03 22:33:41
     [channels.c]
     allow explicit ::1 and 127.0.0.1 forwarding bind addresses when
     GatewayPorts=no; allows client to choose address family;
     bz#2222 ok markus@
   - djm@cvs.openbsd.org 2014/07/03 22:40:43
     [servconf.c servconf.h session.c sshd.8 sshd_config.5]
     Add a sshd_config PermitUserRC option to control whether ~/.ssh/rc is
     executed, mirroring the no-user-rc authorized_keys option;
     bz#2160; ok markus@