git: f2b0910a9831 - stable/15 - OpenSSH: Update to 10.4p1

Go to: [ bottom of page ] [ top of archives ] [ this month ]
From: Ed Maste <emaste_at_FreeBSD.org>
Date: Mon, 05 Oct 2026 13:58:21 UTC
The branch stable/15 has been updated by emaste:

URL: https://cgit.FreeBSD.org/src/commit/?id=f2b0910a9831d09404558611d20364456549a96f

commit f2b0910a9831d09404558611d20364456549a96f
Author:     Ed Maste <emaste@FreeBSD.org>
AuthorDate: 2026-07-09 17:17:11 +0000
Commit:     Ed Maste <emaste@FreeBSD.org>
CommitDate: 2026-10-05 13:47:51 +0000

    OpenSSH: Update to 10.4p1
    
    Full release notes are available at
    https://www.openssh.com/txt/release-10.4
    
    Selected highlights from the release notes:
    
    Potentially-incompatible changes
    --------------------------------
    
     * sshd(8): configuration dump mode ("sshd -G") now writes directives
       in mixed case (e.g. "PubkeyAuthentication") whereas previously it
       emitted only lower-case names.
    
     * ssh(1), sshd(8): make the transport protocol stricter by
       disconnecting if the peer sends non-KEX messages during a post-
       authentication key re-exchange. Previously a malicious peer could
       continue sending non-key exchange messages without penalty. These
       would be buffered, causing memory to be wasted up until the
       connection terminated or the server/client hit a memory limit.
       Implementations that do not restrict messages sent during key
       exchange as per RFC4253 section 7.1 may be disconnected.
       Reported by Marko Jevtic.
    
    Changes since OpenSSH 10.3
    ==========================
    
    This release contains a number of security fixes as well as general
    bugfixes and a couple of new features.
    
    Security
    ========
    
     * sftp(1): when downloading files on the command-line using
       "sftp host:/path .", a malicious server could cause the file to
       be downloaded to an unexpected location. This issue was identified
       by the Swival Security Scanner.
    
     * scp(1): when copying files between two remote destinations, do
       not allow a malicious server to write files to the parent
       directory of the intended target directory.  This issue was
       identified by the Swival Security Scanner.
    
     * sshd(8): DisableForwarding=yes didn't override PermitTunnel=yes
       as it was documented to do. Note that PermitTunnel is not enabled
       by default. Reported independently by Huzaifa Sidhpurwala of
       Redhat and Marko Jevtic.
    
     * sshd(8): avoid a potential pre-authentication denial of service
       when GSSAPIAuthentication was enabled (this feature is off by
       default). This was not mitigated by MaxAuthTries, but would be
       penalised by PerSourcePenalties. This was reported by Manfred
       Kaiser of the milCERT AT (Austrian Ministry of Defence).
    
     * sshd(8): fix a number of cases where the minimum authentication
       delay was not being enforced. Reported by the Orange Cyberdefense
       Vulnerability Team.
    
     * ssh(1): fix a possible client-side use-after-free if the server
       changes its host key during a key reexchange. This was reported by
       Zhenpeng (Leo) Lin of Depthfirst.
    
    New features
    ------------
    
     * All: add experimental support for a composite post-quantum
       signature scheme that combines ML-DSA 44 and Ed25519 as specified
       in draft-miller-sshm-mldsa44-ed25519-composite-sigs.
    
       This scheme is not enabled by default. To use it, you'll need
       to add it to HostKeyAlgorithms, PubkeyAcceptedAlgorithms, etc.
       Keys may be generated using "ssh-keygen -t mldsa44-ed25519".
    
    Bugfixes
    --------
    
     * sshd(8): avoid sending observably different messages for valid vs
       invalid users in GSSAPIAuthentication (disabled by default).
    
     * ssh(1), sshd(8): fix several bugs that incorrectly
       classified bulk traffic as interactive. bz3972, bz3958
    
     * ssh-keygen(1), ssh-add(1): skip unsupported key types when
       downloading resident keys from a FIDO token. Previously, downloads
       would abort when one was encountered. GHPR657
    
    Sponsored by:   The FreeBSD Foundation
    Differential Revision: https://reviews.freebsd.org/D58083
    
    (cherry picked from commit bb5c77e9d281d6def6835d48249898764bc6a5fe)
    (cherry picked from commit f7c08d8dd810d031e5b2e53cbaa102a9105ada3f)
    (cherry picked from commit 5792a639ab950fb7e6add09352e1cd41f1809bc2)
---
 crypto/openssh/.depend                             |     4 +-
 crypto/openssh/.git_allowed_signers.asc            |    26 +-
 crypto/openssh/.github/ci-status.md                |    12 +-
 crypto/openssh/.github/configs                     |     7 +-
 crypto/openssh/.github/install_dropbear.sh         |    35 +
 crypto/openssh/.github/install_libcrypto.sh        |     2 +-
 crypto/openssh/.github/pin_actions.sh              |    35 +
 crypto/openssh/.github/run_test.sh                 |    24 +-
 crypto/openssh/.github/setup_ci.sh                 |   167 +-
 crypto/openssh/.github/workflows/c-cpp.yml         |    42 +-
 crypto/openssh/.github/workflows/cifuzz.yml        |     6 +-
 crypto/openssh/.github/workflows/selfhosted.yml    |    10 +-
 crypto/openssh/.github/workflows/upstream.yml      |    20 +-
 crypto/openssh/.github/workflows/vm.yml            |   155 +-
 crypto/openssh/.skipped-commit-ids                 |     2 +
 crypto/openssh/ChangeLog                           | 14820 +++++-----
 crypto/openssh/Makefile.in                         |    42 +
 crypto/openssh/PROTOCOL.agent                      |     4 +-
 crypto/openssh/README                              |     2 +-
 crypto/openssh/README.privsep                      |   184 +-
 crypto/openssh/auth.h                              |     3 +-
 crypto/openssh/auth2-chall.c                       |     6 +-
 crypto/openssh/auth2-gss.c                         |    62 +-
 crypto/openssh/auth2.c                             |    12 +-
 crypto/openssh/authfd.c                            |     8 +-
 crypto/openssh/authfile.c                          |     9 +-
 crypto/openssh/chacha.c                            |     6 +-
 crypto/openssh/channels.c                          |    17 +-
 crypto/openssh/channels.h                          |     5 +-
 crypto/openssh/cipher.c                            |    44 +-
 crypto/openssh/cipher.h                            |     4 +-
 crypto/openssh/clientloop.c                        |    26 +-
 crypto/openssh/config.h                            |    13 +-
 crypto/openssh/configure.ac                        |    39 +-
 crypto/openssh/contrib/redhat/openssh.spec         |     2 +-
 crypto/openssh/contrib/suse/openssh.spec           |     2 +-
 crypto/openssh/crypto_api.h                        |   127 +-
 crypto/openssh/defines.h                           |    16 +-
 crypto/openssh/ed25519-openssl.c                   |    38 +-
 crypto/openssh/ed25519.c                           |    36 +-
 crypto/openssh/ed25519.sh                          |    74 +-
 crypto/openssh/kex.c                               |     9 +-
 crypto/openssh/kex.h                               |     3 +-
 crypto/openssh/kexmlkem768x25519.c                 |   100 +-
 crypto/openssh/libcrux-mlkem-mldsa.c               |   430 +
 crypto/openssh/libcrux_internal.h                  | 27332 +++++++++++++++++++
 crypto/openssh/libcrux_mlkem768_sha3.h             | 11752 --------
 crypto/openssh/mac.c                               |     8 +-
 crypto/openssh/match.c                             |   137 +-
 crypto/openssh/misc.c                              |     8 +-
 crypto/openssh/mlkem768.sh                         |   219 -
 crypto/openssh/mlkem_mldsa.sh                      |   341 +
 crypto/openssh/moduli                              |  1124 +-
 crypto/openssh/monitor.c                           |    58 +-
 crypto/openssh/monitor_wrap.c                      |    84 +-
 crypto/openssh/monitor_wrap.h                      |     6 +-
 crypto/openssh/openbsd-compat/bsd-cygwin_util.c    |     6 +-
 crypto/openssh/openbsd-compat/bsd-misc.c           |     2 +-
 crypto/openssh/openbsd-compat/fake-rfc2553.c       |     3 +-
 crypto/openssh/openbsd-compat/fmt_scaled.c         |    39 +-
 .../openssh/openbsd-compat/getrrsetbyname-ldns.c   |     3 +-
 crypto/openssh/openbsd-compat/getrrsetbyname.c     |    23 +-
 crypto/openssh/openbsd-compat/vis.c                |     2 +
 crypto/openssh/packet.c                            |    35 +-
 crypto/openssh/pathnames.h                         |     4 +-
 crypto/openssh/readconf.c                          |     6 +-
 crypto/openssh/regress/Makefile                    |     3 +
 crypto/openssh/regress/addrmatch.sh                |     4 +-
 crypto/openssh/regress/agent.sh                    |    21 +-
 crypto/openssh/regress/cert-hostkey.sh             |    15 +-
 crypto/openssh/regress/cert-userkey.sh             |    16 +-
 crypto/openssh/regress/cfgmatch.sh                 |     4 +-
 crypto/openssh/regress/dropbear-kex.sh             |    10 +-
 crypto/openssh/regress/dropbear-server.sh          |   202 +-
 crypto/openssh/regress/hostkey-agent.sh            |     8 +-
 crypto/openssh/regress/kbdint.sh                   |     4 +-
 crypto/openssh/regress/keyscan.sh                  |     6 +-
 crypto/openssh/regress/keytype.sh                  |     8 +-
 crypto/openssh/regress/knownhosts-command.sh       |     5 +-
 .../ssh-verify-attestation.c                       |     4 +-
 crypto/openssh/regress/sshsig.sh                   |     8 +-
 crypto/openssh/regress/test-exec.sh                |     8 +
 crypto/openssh/regress/unittests/Makefile          |     4 +-
 crypto/openssh/regress/unittests/Makefile.inc      |     3 +-
 crypto/openssh/regress/unittests/authopt/Makefile  |     4 +-
 crypto/openssh/regress/unittests/crypto/Makefile   |    26 +
 .../regress/unittests/crypto/test_ed25519.c        |    99 +
 .../openssh/regress/unittests/crypto/test_mldsa.c  |   140 +
 .../regress/unittests/crypto/test_mldsa_eddsa.c    |   197 +
 .../openssh/regress/unittests/crypto/test_mlkem.c  |   164 +
 .../draft-ietf-lamps-pq-composite-sigs.json        |     8 +
 .../unittests/crypto/testdata/nistkats-44.json     |   802 +
 crypto/openssh/regress/unittests/crypto/tests.c    |   123 +
 crypto/openssh/regress/unittests/hostkeys/Makefile |     4 +-
 crypto/openssh/regress/unittests/kex/Makefile      |     3 +-
 crypto/openssh/regress/unittests/match/tests.c     |   202 +-
 crypto/openssh/regress/unittests/servconf/Makefile |    26 +
 crypto/openssh/regress/unittests/servconf/tests.c  |   364 +
 crypto/openssh/regress/unittests/sshkey/Makefile   |     4 +-
 .../openssh/regress/unittests/sshkey/mktestdata.sh |    22 +-
 .../openssh/regress/unittests/sshkey/test_file.c   |    67 +-
 .../openssh/regress/unittests/sshkey/test_fuzz.c   |    58 +-
 .../openssh/regress/unittests/sshkey/test_sshkey.c |   111 +-
 .../unittests/sshkey/testdata/mldsa44_ed25519_1    |    58 +
 .../sshkey/testdata/mldsa44_ed25519_1-cert.fp      |     1 +
 .../sshkey/testdata/mldsa44_ed25519_1-cert.pub     |     1 +
 .../unittests/sshkey/testdata/mldsa44_ed25519_1.fp |     1 +
 .../sshkey/testdata/mldsa44_ed25519_1.fp.bb        |     1 +
 .../sshkey/testdata/mldsa44_ed25519_1.pub          |     1 +
 .../unittests/sshkey/testdata/mldsa44_ed25519_1_pw |    59 +
 .../unittests/sshkey/testdata/mldsa44_ed25519_2    |    58 +
 .../unittests/sshkey/testdata/mldsa44_ed25519_2.fp |     1 +
 .../sshkey/testdata/mldsa44_ed25519_2.fp.bb        |     1 +
 .../sshkey/testdata/mldsa44_ed25519_2.pub          |     1 +
 crypto/openssh/regress/unittests/sshkey/tests.c    |     2 +-
 crypto/openssh/regress/unittests/sshsig/Makefile   |     4 +-
 .../openssh/regress/unittests/sshsig/mktestdata.sh |     9 +-
 .../unittests/sshsig/testdata/mldsa44-ed25519      |    58 +
 .../unittests/sshsig/testdata/mldsa44-ed25519.pub  |     1 +
 .../unittests/sshsig/testdata/mldsa44-ed25519.sig  |    78 +
 crypto/openssh/regress/unittests/sshsig/tests.c    |     9 +-
 .../regress/unittests/test_helper/test_helper.c    |    18 +-
 .../regress/unittests/test_helper/test_helper.h    |     4 +-
 crypto/openssh/sandbox-seccomp-filter.c            |    17 +-
 crypto/openssh/scp.c                               |     8 +-
 crypto/openssh/servconf.c                          |  2011 +-
 crypto/openssh/servconf.h                          |   483 +-
 crypto/openssh/serverloop.c                        |     4 +-
 crypto/openssh/session.c                           |    70 +-
 crypto/openssh/sftp-client.c                       |    16 +-
 crypto/openssh/sftp-server.8                       |    15 +-
 crypto/openssh/sftp-server.c                       |    43 +-
 crypto/openssh/sftp.c                              |    40 +-
 crypto/openssh/sk-usbhid.c                         |    31 +-
 crypto/openssh/ssh-add.c                           |    33 +-
 crypto/openssh/ssh-agent.1                         |     8 +-
 crypto/openssh/ssh-agent.c                         |    42 +-
 crypto/openssh/ssh-keygen.1                        |    16 +-
 crypto/openssh/ssh-keygen.c                        |    12 +-
 crypto/openssh/ssh-keyscan.1                       |    13 +-
 crypto/openssh/ssh-keyscan.c                       |    15 +-
 crypto/openssh/ssh-keysign.c                       |     3 +-
 crypto/openssh/ssh-mldsa-eddsa.c                   |   506 +
 crypto/openssh/ssh.1                               |     9 +-
 crypto/openssh/ssh.c                               |    32 +-
 crypto/openssh/ssh_config.5                        |    96 +-
 crypto/openssh/ssh_namespace.h                     |    64 +-
 crypto/openssh/sshbuf-io.c                         |     7 +-
 crypto/openssh/sshbuf.h                            |     3 +-
 crypto/openssh/sshconnect.c                        |    50 +-
 crypto/openssh/sshconnect.h                        |     9 +-
 crypto/openssh/sshconnect2.c                       |    25 +-
 crypto/openssh/sshd-auth.c                         |    60 +-
 crypto/openssh/sshd-session.c                      |     3 +-
 crypto/openssh/sshd.c                              |     6 +-
 crypto/openssh/sshd_config                         |     2 +-
 crypto/openssh/sshd_config.5                       |    14 +-
 crypto/openssh/ssherr-libcrypto.c                  |     4 +-
 crypto/openssh/ssherr.c                            |     4 +-
 crypto/openssh/ssherr.h                            |     4 +-
 crypto/openssh/sshkey.c                            |    22 +-
 crypto/openssh/sshkey.h                            |     7 +-
 crypto/openssh/version.h                           |     6 +-
 secure/lib/libssh/Makefile                         |     1 +
 164 files changed, 43376 insertions(+), 21443 deletions(-)

diff --git a/crypto/openssh/.depend b/crypto/openssh/.depend
index 134a986596a0..03e8c423d3ab 100644
--- a/crypto/openssh/.depend
+++ b/crypto/openssh/.depend
@@ -73,6 +73,7 @@ kexgexs.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compa
 kexmlkem768x25519.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/bsd-sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h sshkey.h kex.h mac.h crypto_api.h sshbuf.h digest.h ssherr.h log.h
 kexsntrup761x25519.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/bsd-sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h ssherr.h
 krl.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/bsd-sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h sshbuf.h ssherr.h sshkey.h misc.h log.h digest.h bitmap.h utf8.h krl.h
+libcrux-mlkem-mldsa.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/bsd-sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h
 log.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/bsd-sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h log.h ssherr.h match.h
 loginrec.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/bsd-sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h xmalloc.h sshkey.h hostfile.h ssh.h loginrec.h log.h ssherr.h atomicio.h packet.h dispatch.h canohost.h auth.h auth-pam.h audit.h sshbuf.h misc.h
 logintest.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/bsd-sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h loginrec.h
@@ -126,7 +127,7 @@ sk-usbhid.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-com
 sntrup761.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/bsd-sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h
 srclimit.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/bsd-sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h addr.h canohost.h log.h ssherr.h misc.h srclimit.h xmalloc.h servconf.h match.h
 ssh-add.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/bsd-sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h xmalloc.h ssh.h log.h ssherr.h sshkey.h sshbuf.h authfd.h authfile.h pathnames.h misc.h digest.h ssh-sk.h sk-api.h hostfile.h
-ssh-agent.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/bsd-sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h xmalloc.h ssh.h ssh2.h sshbuf.h sshkey.h authfd.h log.h ssherr.h misc.h digest.h match.h msg.h pathnames.h ssh-pkcs11.h sk-api.h myproposal.h
+ssh-agent.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/bsd-sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h xmalloc.h ssh.h ssh2.h sshbuf.h sshkey.h authfd.h log.h ssherr.h misc.h digest.h match.h msg.h pathnames.h ssh-pkcs11.h sk-api.h myproposal.h version.h
 ssh-ecdsa-sk.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/bsd-sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h openbsd-compat/openssl-compat.h sshbuf.h ssherr.h digest.h sshkey.h
 ssh-ecdsa.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/bsd-sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h
 ssh-ed25519-sk.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/bsd-sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h crypto_api.h log.h ssherr.h sshbuf.h sshkey.h digest.h
@@ -136,6 +137,7 @@ ssh-keygen.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-co
 ssh-keyscan.o: atomicio.h misc.h hostfile.h ssh_api.h ssh2.h dns.h addr.h
 ssh-keyscan.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/bsd-sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h xmalloc.h ssh.h sshbuf.h sshkey.h cipher.h cipher-chachapoly.h chacha.h poly1305.h cipher-aesctr.h rijndael.h digest.h kex.h mac.h crypto_api.h compat.h myproposal.h packet.h dispatch.h log.h ssherr.h
 ssh-keysign.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/bsd-sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h xmalloc.h log.h ssherr.h sshkey.h ssh.h ssh2.h misc.h sshbuf.h authfile.h msg.h canohost.h pathnames.h readconf.h uidswap.h
+ssh-mldsa-eddsa.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/bsd-sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h
 ssh-pkcs11-client.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/bsd-sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h pathnames.h xmalloc.h sshbuf.h log.h ssherr.h misc.h sshkey.h authfd.h atomicio.h ssh-pkcs11.h
 ssh-pkcs11-helper.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/bsd-sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h xmalloc.h sshbuf.h log.h ssherr.h misc.h sshkey.h authfd.h ssh-pkcs11.h
 ssh-pkcs11.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/bsd-sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h log.h ssherr.h sshkey.h ssh-pkcs11.h
diff --git a/crypto/openssh/.git_allowed_signers.asc b/crypto/openssh/.git_allowed_signers.asc
index 1a8401b838a3..4d7269b1b485 100644
--- a/crypto/openssh/.git_allowed_signers.asc
+++ b/crypto/openssh/.git_allowed_signers.asc
@@ -1,16 +1,16 @@
 -----BEGIN PGP SIGNATURE-----
 
-iQIzBAABCgAdFiEEcWi5g4FaXu9ZpK39Kj9BTnNgYLoFAmYHnZ8ACgkQKj9BTnNg
-YLquuQ/6A8E6P2jcgn3wmbbCTXP7kmxoh3nmw/e6PC8CEua1512oT3GHOKVD5cGK
-cgYRObpWvjOjg7L1HRABftq7a9M2zfsGnY/WNe3/fbetfkyY8hG8c31vA1ePIOt2
-AjBLCWFblH0CtyH/MssoQ19JCLtXK/GmekB1Q0JzyOog7w/0r3CKuUnZ0juCYR1R
-4FBePl5l3nFSZEcFEdptGlNGeuolS5XBCqB9Y91TCzkVkH5eXUUW+shgjNhWCEhT
-pZvkxfhsmOEnwNofyPdgKVfDBVkHmvuC67EU395mJVN4c2NZ8pOztb9hOt3xr980
-q44I4kT2NpaApCx1dWIGhMy/37LJ8heI0W1B+ofTA5n34/RU8UXH3SCkj2AK6Ao5
-H2u8vbmuWKUCiECmrw35EeKGmtuK/bWJzx3KBP7fx5J9S3mWUgT4W4xlWNN9RWoU
-sSvH1ppie5ARINVaAWl5k44fk60ahTf80DbQBIOZBmQn7myZZka+yGcQbAiZZ1Gc
-0l8+Nf5Ao1ckmuyY5o8FyWdsyDeK3+MqjPn5Rr1CqbKCn2VnqrVWbI33Eyu8c96U
-bxVgU5H1BDhNjJC8UrT3LFPvJMO8p3a0IJ3eHydjk2jVOhOdBZmA0yoqUTrhPpXq
-ymIHESjDJR8TDe4TCfb46o9oEC3cdbDwgnzPqdg0n+0uIsJLYiU=
-=gl+l
+iQIzBAABCgAdFiEEcWi5g4FaXu9ZpK39Kj9BTnNgYLoFAmnevEAACgkQKj9BTnNg
+YLr72w//ay7JpFSfUF5h97Vi2T58fwkRO2aapXrK8f3mnzeelN9H09XBpRquFZCL
+o5S/8RSmVtRjCTXyo7GjwhaAF6+XyKiKgwvjTnY9EA4leCCoNdBJ2/77xlBZdPD4
+AuKPRQKpGjJi+P+2yB0ocgpT6MWXDlg0xkdLWaiQC4xpADUD9AlebUVHtCPOqXWb
+LgGampMjQu8usg9QX3x0oHpuMUot+wo3dTD2xjgWv03DmPK7wCUiA760GeEGibma
+jv3JT8JZnDtPk4J0PpoJecoJsMhH9Zoy55yi3d4y/SxBUSIBFs2qcw4tO3iixZwD
+mlZVW83KFhIlH6Q8GJtymrYrQ2Gw88wWZ6Oj3glzHCkrxUeO9MIbnTSzXekg6+O7
+qBxQC4xdlNtHFS+GvG3EZzztl8C4Qfmdl35bStQaVhWzygI5+o19yoeYi4lMTYQM
+CAH6ONeDFvm3SwlTJk41O/zXz7mO1vRpsn5QMCHt3KLBZkkMrSKl4C2r9iuq7MeY
+gx3mnPW6/yu1TzGUl5wtzeb6I2R1/zPK3ibhbGQyt4WggCio3D8xmcmhyxKL79fi
+Pb02QXRYplXrkR6Lf2HCRdJoNu3bodqelkeiAtgj0CLHlK355dtmya6txn4Ccoc1
++kH7vdHqPKJSrsMBZ/Qm+0dA9Kq4Qoib2tog9De09u5p8XQUdAY=
+=9i1L
 -----END PGP SIGNATURE-----
diff --git a/crypto/openssh/.github/ci-status.md b/crypto/openssh/.github/ci-status.md
index 00a1db0df76a..5d17f893761d 100644
--- a/crypto/openssh/.github/ci-status.md
+++ b/crypto/openssh/.github/ci-status.md
@@ -8,6 +8,11 @@ master :
 [![Coverity Status](https://scan.coverity.com/projects/21341/badge.svg)](https://scan.coverity.com/projects/openssh-portable)
 <br>
 
+10.3 :
+[![C/C++ CI](../../../actions/workflows/c-cpp.yml/badge.svg?branch=V_10_3)](../../../actions/workflows/c-cpp.yml?query=branch:V_10_3)
+[![VM CI](../../../actions/workflows/vm.yml/badge.svg?branch=V_10_3)](../../../actions/workflows/vm.yml?query=branch:V_10_3)
+[![C/C++ CI self-hosted](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/selfhosted.yml/badge.svg?branch=V_10_3)](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/selfhosted.yml?query=branch:V_10_3)
+
 10.2 :
 [![C/C++ CI](../../../actions/workflows/c-cpp.yml/badge.svg?branch=V_10_2)](../../../actions/workflows/c-cpp.yml?query=branch:V_10_2)
 [![VM CI](../../../actions/workflows/vm.yml/badge.svg?branch=V_10_2)](../../../actions/workflows/vm.yml?query=branch:V_10_2)
@@ -18,10 +23,3 @@ master :
 [![VM CI](../../../actions/workflows/vm.yml/badge.svg?branch=V_10_1)](../../../actions/workflows/vm.yml?query=branch:V_10_1)
 [![C/C++ CI self-hosted](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/selfhosted.yml/badge.svg?branch=V_10_1)](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/selfhosted.yml?query=branch:V_10_1)
 
-10.0 :
-[![C/C++ CI](../../../actions/workflows/c-cpp.yml/badge.svg?branch=V_10_0)](../../../actions/workflows/c-cpp.yml?query=branch:V_10_0)
-[![C/C++ CI self-hosted](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/selfhosted.yml/badge.svg?branch=V_10_0)](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/selfhosted.yml?query=branch:V_10_0)
-
-9.9 :
-[![C/C++ CI](../../../actions/workflows/c-cpp.yml/badge.svg?branch=V_9_9)](../../../actions/workflows/c-cpp.yml?query=branch:V_9_9)
-[![C/C++ CI self-hosted](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/selfhosted.yml/badge.svg?branch=V_9_9)](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/selfhosted.yml?query=branch:V_9_9)
diff --git a/crypto/openssh/.github/configs b/crypto/openssh/.github/configs
index 9ad2439df493..ece6441b1617 100755
--- a/crypto/openssh/.github/configs
+++ b/crypto/openssh/.github/configs
@@ -185,6 +185,11 @@ case "$config" in
     libressl-*)
 	LIBCRYPTOFLAGS="--with-ssl-dir=/opt/libressl --with-rpath=-Wl,-rpath,"
 	;;
+    dropbear-*)
+	CONFIGFLAGS="--with-dbclient=/usr/local/bin/plink --with-dropbear=/usr/local/sbin/dropbear"
+	# We don't need to rerun the regular tests, just the interop ones.
+	TEST_TARGET=interop-tests
+	;;
     putty-*)
 	CONFIGFLAGS="--with-plink=/usr/local/bin/plink --with-puttygen=/usr/local/bin/puttygen"
 	# We don't need to rerun the regular tests, just the interop ones.
@@ -203,7 +208,7 @@ case "$config" in
 	;;
     sk)
 	CONFIGFLAGS="--with-security-key-builtin --with-security-key-standalone"
-        ;;
+	;;
     without-openssl)
 	LIBCRYPTOFLAGS="--without-openssl"
 	TEST_TARGET=t-exec
diff --git a/crypto/openssh/.github/install_dropbear.sh b/crypto/openssh/.github/install_dropbear.sh
new file mode 100755
index 000000000000..ed91c52f7cdb
--- /dev/null
+++ b/crypto/openssh/.github/install_dropbear.sh
@@ -0,0 +1,35 @@
+#!/bin/sh
+#
+# Install specified Dropbear version into /usr/local.
+#
+
+ver="$1"
+
+echo
+echo ---------------------------------------------
+echo Installing dropbear version: ${ver}
+echo ---------------------------------------------
+
+set -e
+
+cd /tmp
+
+if [ ! -d dropbear-clean ]; then
+	git clone https://github.com/mkj/dropbear.git dropbear-clean
+	(cd dropbear-clean && git config --global advice.detachedHead false)
+fi
+
+rm -rf dropbear
+cp -a dropbear-clean dropbear
+cd dropbear
+git checkout "$ver"
+git status
+echo "Building Dropbear version '$ver'"
+(
+	autoreconf 2>&1 &&
+	./configure 2>&1 &&
+	make clean 2>&1 &&
+	make 2>&1 &&
+	sudo make install 2>&1) >/tmp/db-build.log 2>&1 || cat /tmp/db-build.log
+
+echo "Installed dropbear version: '$(/usr/local/bin/dbclient -V 2>&1)'"
diff --git a/crypto/openssh/.github/install_libcrypto.sh b/crypto/openssh/.github/install_libcrypto.sh
index d1aa23450679..cef9416808d8 100755
--- a/crypto/openssh/.github/install_libcrypto.sh
+++ b/crypto/openssh/.github/install_libcrypto.sh
@@ -51,7 +51,7 @@ if [ "${abi_compat_test}" = "y" ]; then
 		ver="${major}.$((${minor} + 1))"
 		echo selecting next release branch ${ver}
 		;;
-	openssl-3.*.*)
+	openssl-[34].*.*)
 		major=$(echo ${ver} | cut -f1 -d.)
 		minor=$(echo ${ver} | cut -f2 -d.)
 		patch=$(echo ${ver} | cut -f3 -d.)
diff --git a/crypto/openssh/.github/pin_actions.sh b/crypto/openssh/.github/pin_actions.sh
new file mode 100755
index 000000000000..8b64e823827e
--- /dev/null
+++ b/crypto/openssh/.github/pin_actions.sh
@@ -0,0 +1,35 @@
+#!/bin/sh
+#
+# Look up specified version of Github Actions an pin to that specific
+# revision.
+#
+
+set -e
+
+github=https://github.com
+
+for workflow in workflows/*.yml; do
+	sed 's/ - /   /' ${workflow} | grep -v '^#' | awk '/uses:/ {print}' | \
+	    while read line; do
+		action_ver=$(awk '{print $2}' <<<${line})
+		action=$(cut -f1 -d@ <<<${action_ver})
+		ver=$(cut -f2 -d@ <<<${action_ver})
+		intendedver=$(awk '{print $4}' <<<${line})
+		if [ -z "${intendedver}" ]; then
+			intendedver=${ver}
+		fi
+		case "${action}" in
+		google/oss-fuzz/*)	actiondir=google/oss-fuzz ;;
+		*)			actiondir="${action}" ;;
+		esac
+		if [ ! -d /tmp/${actiondir} ]; then
+			git clone ${github}/${actiondir} /tmp/${actiondir}
+		fi
+		hash=$(cd /tmp/${actiondir} && git rev-parse ${intendedver})
+		sed -i -e "s|uses: ${action}@.*|uses: ${action}@${hash} # ${intendedver}|" \
+		     ${workflow}
+	done
+done
+
+# Output actions for allowlist.
+awk 'BEGIN{IFS=":"} /^ +uses:.*@/{print $2","}' workflows/*.yml | sort -u
diff --git a/crypto/openssh/.github/run_test.sh b/crypto/openssh/.github/run_test.sh
index c67d00700f23..63aa31f6c004 100755
--- a/crypto/openssh/.github/run_test.sh
+++ b/crypto/openssh/.github/run_test.sh
@@ -15,8 +15,8 @@ if [ ! -z "$SUDO" ] && [ ! -z "$TEST_SSH_HOSTBASED_AUTH" ]; then
     $SUDO mkdir -p $sshconf
     $SUDO make install
     for key in $sshconf/ssh_host*key*.pub; do
-        echo `hostname` `cat $key` | \
-            $SUDO tee -a $sshconf/ssh_known_hosts >/dev/null
+	echo `hostname` `cat $key` | \
+	    $SUDO tee -a $sshconf/ssh_known_hosts >/dev/null
     done
 fi
 
@@ -45,6 +45,22 @@ if [ "$1" = "putty-versions" ]; then
 	exit 0
 fi
 
+if [ "$1" = "dropbear-versions" ]; then
+	make regress-binaries
+	# Work backward from current version to last version we support.
+	for ver in main `cd /tmp/dropbear && git tag | grep -E 'DROPBEAR_' | sort -rn`; do
+		year=`echo "$ver" | cut -f2 -d_ | cut -f1 -d.`
+		if [ "$ver" != "master" ] && [ "$year" -lt "2020" ]; then
+			exit 0
+		fi
+		.github/install_dropbear.sh "${ver}"
+		${env} make ${TEST_TARGET} \
+		    SKIP_LTESTS="${SKIP_LTESTS}" LTESTS="${LTESTS}"
+	done
+
+	exit 0
+fi
+
 if [ -z "${LTESTS}" ]; then
     ${env} make ${TEST_TARGET} SKIP_LTESTS="${SKIP_LTESTS}"
 else
@@ -59,8 +75,8 @@ fi
 if [ ! -z "${SSHD_CONFOPTS}" ]; then
     echo "rerunning t-exec with TEST_SSH_SSHD_CONFOPTS='${SSHD_CONFOPTS}'"
     if [ -z "${LTESTS}" ]; then
-        ${env} make t-exec SKIP_LTESTS="${SKIP_LTESTS}" TEST_SSH_SSHD_CONFOPTS="${SSHD_CONFOPTS}"
+	${env} make t-exec SKIP_LTESTS="${SKIP_LTESTS}" TEST_SSH_SSHD_CONFOPTS="${SSHD_CONFOPTS}"
     else
-        ${env} make t-exec SKIP_LTESTS="${SKIP_LTESTS}" LTESTS="${LTESTS}" TEST_SSH_SSHD_CONFOPTS="${SSHD_CONFOPTS}"
+	${env} make t-exec SKIP_LTESTS="${SKIP_LTESTS}" LTESTS="${LTESTS}" TEST_SSH_SSHD_CONFOPTS="${SSHD_CONFOPTS}"
     fi
 fi
diff --git a/crypto/openssh/.github/setup_ci.sh b/crypto/openssh/.github/setup_ci.sh
index e1b3dcf04a84..6ab4e4fb56f2 100755
--- a/crypto/openssh/.github/setup_ci.sh
+++ b/crypto/openssh/.github/setup_ci.sh
@@ -8,8 +8,8 @@ PACKAGES="tmux"
 echo Running as:
 id
 
-echo Environment:
-set
+echo Saving environment to runner-env.txt
+set >runner-env.txt
 
  . .github/configs ${config}
 
@@ -20,16 +20,36 @@ case "$host" in
 	PACKAGER=setup
 	echo Setting CYGWIN system environment variable.
 	setx CYGWIN "winsymlinks:native"
-	echo Removing extended ACLs so umask works as expected.
-	set -x
-	setfacl -b . regress
-	icacls regress /c /t /q /Inheritance:d
-	icacls regress /c /t /q /Grant ${USERNAME}:F
-	icacls regress /c /t /q /Remove:g "Authenticated Users" \
-	     BUILTIN\\Administrators BUILTIN Everyone System Users
-	takeown /F regress
+	echo Removing extended ACLs on regress so umask works as expected.
+	echo "Original ACLs"
 	icacls regress
-	set +x
+	setfacl -b regress
+	icacls regress /c /t /q /grant 'BUILTIN\Administrators:(RX)'
+	echo "Modifiled ACLs"
+	icacls regress
+
+	echo Enabling OpenSSL rh-allow-sha1-signatures for unit tests.
+	cp /etc/pki/tls/openssl.cnf /etc/pki/tls/openssl.cnf.bak
+	cat >>/etc/pki/tls/openssl.cnf <<EOD
+[openssl_init]
+alg_section = evp_properties
+
+[evp_properties]
+rh-allow-sha1-signatures = yes
+EOD
+	openssl list -providers -provider legacy
+	printf "Test openssl signing with RSA+SHA1: "
+	openssl genpkey -quiet -algorithm RSA -out private_key.pem -pkeyopt rsa_keygen_bits:2048
+	openssl pkey -in private_key.pem -pubout -out public_key.pem
+	if ! openssl dgst -sha1 -sign private_key.pem -out signature.sig public_key.pem; then
+		echo fail
+		echo "openssl could not sign with RSA+SHA1."
+		cp /etc/pki/tls/openssl.cnf /etc/pki/tls/openssl.cnf.bak regress/
+		exit 1
+	else
+		echo success
+	fi
+
 	PACKAGES="$PACKAGES,autoconf,automake,cygwin-devel,gcc-core"
 	PACKAGES="$PACKAGES,make,openssl,libssl-devel,zlib-devel"
 	;;
@@ -87,82 +107,88 @@ echo "Setting up for '$TARGETS'"
 for TARGET in $TARGETS; do
     case $TARGET in
     default|without-openssl|without-zlib|c89)
-        # nothing to do
-        ;;
+	# nothing to do
+	;;
     clang-sanitize*)
-        PACKAGES="$PACKAGES clang-12"
-        ;;
+	PACKAGES="$PACKAGES clang-12"
+	;;
     cygwin-release)
-        PACKAGES="$PACKAGES libcrypt-devel libfido2-devel libkrb5-devel"
-        ;;
+	PACKAGES="$PACKAGES libcrypt-devel libfido2-devel libkrb5-devel"
+	;;
     gcc-sanitize*)
-        ;;
+	;;
     clang-*|gcc-*)
-        compiler=$(echo $TARGET | sed 's/-Werror//')
-        PACKAGES="$PACKAGES $compiler"
-        ;;
+	compiler=$(echo $TARGET | sed 's/-Werror//')
+	PACKAGES="$PACKAGES $compiler"
+	;;
     krb5)
-        PACKAGES="$PACKAGES libkrb5-dev libnss-wrapper krb5-admin-server"
+	PACKAGES="$PACKAGES libkrb5-dev libnss-wrapper krb5-admin-server"
 	;;
     heimdal)
-        PACKAGES="$PACKAGES heimdal-dev libnss-wrapper krb5-admin-server"
-        ;;
+	PACKAGES="$PACKAGES heimdal-dev libnss-wrapper krb5-admin-server"
+	;;
     libedit)
 	case "$PACKAGER" in
 	setup)	PACKAGES="$PACKAGES libedit-devel" ;;
 	apt)	PACKAGES="$PACKAGES libedit-dev" ;;
 	esac
-        ;;
+	;;
     *pam)
 	case "$PACKAGER" in
 	apt)	PACKAGES="$PACKAGES libpam0g-dev" ;;
 	esac
-        ;;
+	;;
     sk)
-        INSTALL_FIDO_PPA="yes"
-        PACKAGES="$PACKAGES libfido2-dev libu2f-host-dev libcbor-dev"
-        ;;
+	INSTALL_FIDO_PPA="yes"
+	PACKAGES="$PACKAGES libfido2-dev libu2f-host-dev libcbor-dev"
+	;;
     selinux)
-        PACKAGES="$PACKAGES libselinux1-dev selinux-policy-dev libaudit-dev"
-        ;;
+	PACKAGES="$PACKAGES libselinux1-dev selinux-policy-dev libaudit-dev"
+	;;
     hardenedmalloc)
-        INSTALL_HARDENED_MALLOC=yes
-        ;;
+	INSTALL_HARDENED_MALLOC=yes
+	# Need clang >= 19 for constexpr.
+	PACKAGES="$PACKAGES clang-19"
+	;;
     musl)
 	PACKAGES="$PACKAGES musl-tools"
 	;;
     tcmalloc)
-        PACKAGES="$PACKAGES libgoogle-perftools-dev"
-        ;;
+	PACKAGES="$PACKAGES libgoogle-perftools-dev"
+	;;
     openssl-noec)
 	INSTALL_OPENSSL=OpenSSL_1_1_1k
 	SSLCONFOPTS="no-ec"
 	;;
     openssl-*)
-        INSTALL_OPENSSL=$(echo ${TARGET} | cut -f2 -d-)
-        case ${INSTALL_OPENSSL} in
-          1.1.1_stable)	INSTALL_OPENSSL="OpenSSL_1_1_1-stable" ;;
-          1.*)	INSTALL_OPENSSL="OpenSSL_$(echo ${INSTALL_OPENSSL} | tr . _)" ;;
-          3.*)	INSTALL_OPENSSL="openssl-${INSTALL_OPENSSL}" ;;
-        esac
-        PACKAGES="${PACKAGES} putty-tools dropbear-bin"
+	INSTALL_OPENSSL=$(echo ${TARGET} | cut -f2 -d-)
+	case ${INSTALL_OPENSSL} in
+	  1.1.1_stable)	INSTALL_OPENSSL="OpenSSL_1_1_1-stable" ;;
+	  1.*)	INSTALL_OPENSSL="OpenSSL_$(echo ${INSTALL_OPENSSL} | tr . _)" ;;
+	  master)	;;
+	  *)	INSTALL_OPENSSL="openssl-${INSTALL_OPENSSL}" ;;
+	esac
+	PACKAGES="${PACKAGES} putty-tools dropbear-bin"
        ;;
     libressl-*)
-        INSTALL_LIBRESSL=$(echo ${TARGET} | cut -f2 -d-)
-        case ${INSTALL_LIBRESSL} in
-          master) ;;
-          *) INSTALL_LIBRESSL="$(echo ${TARGET} | cut -f2 -d-)" ;;
-        esac
-        PACKAGES="${PACKAGES} putty-tools dropbear-bin"
+	INSTALL_LIBRESSL=$(echo ${TARGET} | cut -f2 -d-)
+	case ${INSTALL_LIBRESSL} in
+	  master) ;;
+	  *) INSTALL_LIBRESSL="$(echo ${TARGET} | cut -f2 -d-)" ;;
+	esac
+	PACKAGES="${PACKAGES} putty-tools dropbear-bin"
        ;;
     boringssl)
-        INSTALL_BORINGSSL=1
-        PACKAGES="${PACKAGES} cmake ninja-build"
+	INSTALL_BORINGSSL=1
+	PACKAGES="${PACKAGES} cmake ninja-build"
        ;;
     aws-lc)
-        INSTALL_AWSLC=1
-        PACKAGES="${PACKAGES} cmake ninja-build"
-        ;;
+	INSTALL_AWSLC=1
+	PACKAGES="${PACKAGES} cmake ninja-build"
+	;;
+    dropbear-versions)
+	INSTALL_DROPBEAR=main
+	;;
     putty-*)
 	INSTALL_PUTTY=0.83
 	PACKAGES="${PACKAGES} cmake"
@@ -173,8 +199,8 @@ for TARGET in $TARGETS; do
     zlib-*)
        ;;
     *) echo "Invalid option '${TARGET}'"
-        exit 1
-        ;;
+	exit 1
+	;;
     esac
 done
 
@@ -221,7 +247,7 @@ if [ "${INSTALL_HARDENED_MALLOC}" = "yes" ]; then
     (cd ${HOME} &&
      git clone https://github.com/GrapheneOS/hardened_malloc.git &&
      cd ${HOME}/hardened_malloc &&
-     make && sudo cp out/libhardened_malloc.so /usr/lib/)
+     make CC=clang-19 && sudo cp out/libhardened_malloc.so /usr/lib/)
 fi
 
 if [ ! -z "${INSTALL_OPENSSL}" ]; then
@@ -231,20 +257,20 @@ fi
 
 if [ ! -z "${INSTALL_LIBRESSL}" ]; then
     if [ "${INSTALL_LIBRESSL}" = "master" ]; then
-        (mkdir -p ${HOME}/libressl && cd ${HOME}/libressl &&
-         git clone https://github.com/libressl-portable/portable.git &&
-         cd ${HOME}/libressl/portable &&
-         git checkout ${INSTALL_LIBRESSL} &&
-         sh update.sh && sh autogen.sh &&
-         ./configure --prefix=/opt/libressl &&
-         make && sudo make install)
+	(mkdir -p ${HOME}/libressl && cd ${HOME}/libressl &&
+	 git clone https://github.com/libressl-portable/portable.git &&
+	 cd ${HOME}/libressl/portable &&
+	 git checkout ${INSTALL_LIBRESSL} &&
+	 sh update.sh && sh autogen.sh &&
+	 ./configure --prefix=/opt/libressl &&
+	 make && sudo make install)
     else
-        LIBRESSL_URLBASE=https://cdn.openbsd.org/pub/OpenBSD/LibreSSL
-        (cd ${HOME} &&
-         wget ${LIBRESSL_URLBASE}/libressl-${INSTALL_LIBRESSL}.tar.gz &&
-         tar xfz libressl-${INSTALL_LIBRESSL}.tar.gz &&
-         cd libressl-${INSTALL_LIBRESSL} &&
-         ./configure --prefix=/opt/libressl && make && sudo make install)
+	LIBRESSL_URLBASE=https://cdn.openbsd.org/pub/OpenBSD/LibreSSL
+	(cd ${HOME} &&
+	 wget ${LIBRESSL_URLBASE}/libressl-${INSTALL_LIBRESSL}.tar.gz &&
+	 tar xfz libressl-${INSTALL_LIBRESSL}.tar.gz &&
+	 cd libressl-${INSTALL_LIBRESSL} &&
+	 ./configure --prefix=/opt/libressl && make && sudo make install)
     fi
 fi
 
@@ -272,6 +298,9 @@ if [ ! -z "${INSTALL_ZLIB}" ]; then
      sudo make install prefix=/opt/zlib)
 fi
 
+if [ ! -z "${INSTALL_DROPBEAR}" ]; then
+	.github/install_dropbear.sh "${INSTALL_DROPBEAR}"
+fi
 if [ ! -z "${INSTALL_PUTTY}" ]; then
 	.github/install_putty.sh "${INSTALL_PUTTY}"
 fi
diff --git a/crypto/openssh/.github/workflows/c-cpp.yml b/crypto/openssh/.github/workflows/c-cpp.yml
index 02cd10bfbb6e..ffead602f5d3 100644
--- a/crypto/openssh/.github/workflows/c-cpp.yml
+++ b/crypto/openssh/.github/workflows/c-cpp.yml
@@ -9,6 +9,7 @@ name: CI
 #   fail immediately.
 #
 # LTESTS: Override the set of tests run.
+# TEST_SSH_TRACE: Set to yes for additional regress output.
 
 on:
   push:
@@ -51,7 +52,6 @@ jobs:
           - { target: ubuntu-22.04, config: gcc-12-Werror }
           - { target: ubuntu-22.04, config: gcc-sanitize-address }
           - { target: ubuntu-22.04, config: gcc-sanitize-undefined }
-          - { target: ubuntu-22.04, config: hardenedmalloc }
           - { target: ubuntu-22.04, config: heimdal }
           - { target: ubuntu-22.04, config: kitchensink }
           - { target: ubuntu-22.04, config: krb5 }
@@ -63,7 +63,7 @@ jobs:
           - { target: ubuntu-22.04, config: valgrind-2 }
           - { target: ubuntu-22.04, config: valgrind-3 }
           - { target: ubuntu-22.04, config: valgrind-4 }
-          - { target: ubuntu-22.04, config: valgrind-pam-1 }
+          # - { target: ubuntu-22.04, config: valgrind-pam-1 }
           - { target: ubuntu-22.04, config: valgrind-unit }
           - { target: ubuntu-22.04, config: without-openssl }
           - { target: ubuntu-latest, config: gcc-14 }
@@ -71,6 +71,7 @@ jobs:
           - { target: ubuntu-latest, config: clang-19 }
           - { target: ubuntu-latest, config: boringssl }
           - { target: ubuntu-latest, config: aws-lc }
+          - { target: ubuntu-latest, config: hardenedmalloc }
           - { target: ubuntu-latest, config: libressl-master }
           - { target: ubuntu-latest, config: libressl-3.2.7 }
           - { target: ubuntu-latest, config: libressl-3.3.6 }
@@ -83,6 +84,7 @@ jobs:
           - { target: ubuntu-latest, config: libressl-4.0.1 }
           - { target: ubuntu-latest, config: libressl-4.1.1 }
           - { target: ubuntu-latest, config: libressl-4.2.0 }
+          - { target: ubuntu-latest, config: libressl-4.3.2 }
           - { target: ubuntu-latest, config: openssl-master }
           - { target: ubuntu-latest, config: openssl-noec }
           - { target: ubuntu-latest, config: openssl-1.1.1 }
@@ -93,12 +95,14 @@ jobs:
           - { target: ubuntu-latest, config: openssl-3.1.0 }
           - { target: ubuntu-latest, config: openssl-3.1.8 }
           - { target: ubuntu-latest, config: openssl-3.2.6 }
-          - { target: ubuntu-latest, config: openssl-3.3.5 }
+          - { target: ubuntu-latest, config: openssl-3.3.7 }
           - { target: ubuntu-latest, config: openssl-3.4.0 }
-          - { target: ubuntu-latest, config: openssl-3.4.3 }
+          - { target: ubuntu-latest, config: openssl-3.4.5 }
           - { target: ubuntu-latest, config: openssl-3.5.0 }
           - { target: ubuntu-latest, config: openssl-3.5.3 }  # keep
-          - { target: ubuntu-latest, config: openssl-3.5.4 }
+          - { target: ubuntu-latest, config: openssl-3.5.6 }
+          - { target: ubuntu-latest, config: openssl-3.6.2 }
+          - { target: ubuntu-latest, config: openssl-4.0.0 }
           - { target: ubuntu-latest, config: openssl-1.1.1_stable }
           - { target: ubuntu-latest, config: openssl-3.0 }  # stable branch
           - { target: ubuntu-latest, config: openssl-3.1 }  # stable branch
@@ -107,6 +111,8 @@ jobs:
           - { target: ubuntu-latest, config: openssl-3.4 }  # stable branch
           - { target: ubuntu-latest, config: openssl-3.5 }  # stable branch
           - { target: ubuntu-latest, config: openssl-3.6 }  # stable branch
+          - { target: ubuntu-latest, config: openssl-4.0 }  # stable branch
+          - { target: ubuntu-latest, config: dropbear-versions }
           - { target: ubuntu-latest, config: putty-versions }
           - { target: ubuntu-latest, config: zlib-develop }
           - { target: ubuntu-latest, config: tcmalloc }
@@ -118,6 +124,7 @@ jobs:
     runs-on: ${{ matrix.target }}
     env:
       EPHEMERAL_VM: yes
+      CYGWIN: "winsymlinks:native"
     steps:
     - name: check RUN_ONLY_TARGET_CONFIG
       if: vars.RUN_ONLY_TARGET_CONFIG != ''
@@ -128,12 +135,12 @@ jobs:
     - name: install cygwin
       id: cygwin_install
       if: ${{ startsWith(matrix.target, 'windows') }}
-      uses: cygwin/cygwin-install-action@master
-      env:
-        CYGWIN: "winsymlinks:native"
-    - uses: actions/checkout@main
+      uses: cygwin/cygwin-install-action@a3d72946b163026bbd0fa9a88379ccbda4bd86bb # master
+    - name: checkout openssh git repo
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # main
     - name: setup CI system
-      run: sh ./.github/setup_ci.sh ${{ matrix.config }} ${{ matrix.target }}
+      run: |
+        sh -c "timeout 1200 .github/setup_ci.sh ${{ matrix.config }} ${{ matrix.target }} || .github/setup_ci.sh ${{ matrix.config }} ${{ matrix.target }}"
       env:
         CYGWIN_SETUP: ${{ steps.cygwin_install.outputs.setup }}
     - name: autoreconf
@@ -141,34 +148,35 @@ jobs:
     - name: configure
       run: sh ./.github/configure.sh ${{ matrix.config }}
     - name: save config
-      uses: actions/upload-artifact@main
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # main
       with:
         name: ${{ matrix.target }}-${{ matrix.config }}-config
         path: config.h
     - name: make clean
       run: make clean
     - name: make
-      run: make
+      run: make -j2
     - name: make tests
       run: sh ./.github/run_test.sh ${{ matrix.config }}
       env:
         TEST_SSH_UNSAFE_PERMISSIONS: 1
         TEST_SSH_HOSTBASED_AUTH: yes
+        TEST_SSH_TRACE: ${{ vars.TEST_SSH_TRACE }}
         LTESTS: ${{ vars.LTESTS }}
     - name: test OpenSSL3 ABI compatibility
       if: ${{ startsWith(matrix.config, 'openssl-3') }}
       run: |
        sh .github/install_libcrypto.sh -a ${{ matrix.config }} /opt/openssl
        sh .github/run_test.sh ${{ matrix.config }}
-    - name: show logs
-      if: failure()
-      run: for i in regress/failed*.log; do echo ====; echo logfile $i; echo =====; cat $i; done
     - name: chown logs
       if: failure()
-      run: test -x "$(which sudo 2>&1)" && sudo chown -R "${LOGNAME}" regress
+      run: sh -c 'SUDO="$(which sudo 2>/dev/null)"; $SUDO chown -R "${LOGNAME}" regress'
+    - name: show logs
+      if: failure()
+      run: sh -c "for i in regress/failed*.log; do echo ====; echo logfile $i; echo =====; cat $i; done"
     - name: save logs
       if: failure()
-      uses: actions/upload-artifact@main
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # main
       with:
         name: ${{ matrix.target }}-${{ matrix.config }}-logs
         path: |
diff --git a/crypto/openssh/.github/workflows/cifuzz.yml b/crypto/openssh/.github/workflows/cifuzz.yml
index ab8b1c6e0971..286b39c12cb0 100644
--- a/crypto/openssh/.github/workflows/cifuzz.yml
+++ b/crypto/openssh/.github/workflows/cifuzz.yml
@@ -12,20 +12,20 @@ jobs:
     steps:
     - name: Build Fuzzers
       id: build
-      uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@master
+      uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@b1836d5aed2e5aaae7f618ddd40bbcc477119825 # master
       with:
         oss-fuzz-project-name: 'openssh'
         dry-run: false
         language: c++
     - name: Run Fuzzers
-      uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@master
+      uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@b1836d5aed2e5aaae7f618ddd40bbcc477119825 # master
       with:
         oss-fuzz-project-name: 'openssh'
         fuzz-seconds: 600
         dry-run: false
         language: c++
     - name: Upload Crash
-      uses: actions/upload-artifact@main
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # main
       if: failure() && steps.build.outcome == 'success'
       with:
         name: artifacts
diff --git a/crypto/openssh/.github/workflows/selfhosted.yml b/crypto/openssh/.github/workflows/selfhosted.yml
index aa01c8b296a9..d9f38472c405 100644
--- a/crypto/openssh/.github/workflows/selfhosted.yml
+++ b/crypto/openssh/.github/workflows/selfhosted.yml
@@ -88,7 +88,7 @@ jobs:
           - { target: nbsd10, config: pam, host: libvirt }
           - { target: omnios, config: pam, host: libvirt }
           # ARM64 VMs
-          - { target: obsd-arm64, config: default, host: libvirt-arm64 }
+          - { target: obsdsnap-arm64, config: default, host: libvirt-arm64 }
           # VMs with persistent disks that have their own runner.
           - { target: win10, config: default,        host: persist-win10 }
           - { target: win10, config: cygwin-release, host: persist-win10 }
@@ -105,7 +105,7 @@ jobs:
     - name: shutdown VM if running
       if: env.VM == 'true'
       run: vmshutdown
-    - uses: actions/checkout@main
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # main
     - name: autoreconf
       run: autoreconf
     - name: startup VM
@@ -119,7 +119,7 @@ jobs:
     - name: configure
       run: vmrun ./.github/configure.sh ${{ matrix.config }}
 #    - name: save config
-#      uses: actions/upload-artifact@main
+#      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # main
 #      with:
 #        name: ${{ matrix.target }}-${{ matrix.config }}-config
 #        path: config.h
@@ -135,7 +135,7 @@ jobs:
       run: vmrun 'for i in regress/failed*.log; do echo ====; echo logfile $i; echo =====; cat $i; done'
     - name: save logs
*** 72252 LINES SKIPPED ***