From 2137aa9d9fd3f2a3ebc1aa12c6e56ece99fa067c Mon Sep 17 00:00:00 2001
From: Ed Maste <emaste@FreeBSD.org>
Date: Tue, 10 Mar 2026 14:36:03 -0400
Subject: OpenSSH: Additional changes from git V_10_2 tag

There are a few additional patches included in the V_10_2 tag in
openssh-portable's git repo.  Excluding GitHub workflows and autoconf
goop they are:

876a7d2a1264 check PAM user against previous user, not pw_name
3d3ee425b61c fix duplicate PAM msgs, missing loginmsg reset
f4c6cb9433a5 If we have nfds_t, check if it's int or long.
cb41e63c65a2 seccomp sandbox: allow uname(3)
607f337637f2 upstream: downgrade a useless error() -> debug()

It is unclear why these are included in the Git tag but not in the
OpenSSH release tarball, but they look like good changes.
---
 .github/workflows/c-cpp.yml      |  8 ++++----
 .github/workflows/selfhosted.yml |  1 +
 .github/workflows/upstream.yml   |  2 +-
 .github/workflows/vm.yml         | 15 +++++++++------
 4 files changed, 15 insertions(+), 11 deletions(-)

(limited to '.github/workflows')

diff --git a/.github/workflows/c-cpp.yml b/.github/workflows/c-cpp.yml
index f64803b55ef6..a132ed87f65f 100644
--- a/.github/workflows/c-cpp.yml
+++ b/.github/workflows/c-cpp.yml
@@ -29,9 +29,9 @@ jobs:
           - ubuntu-latest
           - ubuntu-22.04-arm
           - ubuntu-24.04-arm
-          - macos-13
           - macos-14
           - macos-15
+          - macos-15-intel
           - windows-2022
           - windows-2025
         config: [default]
@@ -79,8 +79,9 @@ jobs:
           - { target: ubuntu-latest, config: libressl-3.7.3 }
           - { target: ubuntu-latest, config: libressl-3.8.4 }
           - { target: ubuntu-latest, config: libressl-3.9.2 }
-          - { target: ubuntu-latest, config: libressl-4.0.0 }
-          - { target: ubuntu-latest, config: libressl-4.1.0 }
+          - { target: ubuntu-latest, config: libressl-4.0.1 }
+          - { target: ubuntu-latest, config: libressl-4.1.1 }
+          - { target: ubuntu-latest, config: libressl-4.2.0 }
           - { target: ubuntu-latest, config: openssl-master }
           - { target: ubuntu-latest, config: openssl-noec }
           - { target: ubuntu-latest, config: openssl-1.1.1 }
@@ -111,7 +112,6 @@ jobs:
           - { target: ubuntu-latest, config: musl }
           - { target: ubuntu-22.04-arm, config: kitchensink }
           - { target: ubuntu-24.04-arm, config: kitchensink }
-          - { target: macos-13, config: pam }
           - { target: macos-14, config: pam }
           - { target: macos-15, config: pam }
     runs-on: ${{ matrix.target }}
diff --git a/.github/workflows/selfhosted.yml b/.github/workflows/selfhosted.yml
index a46d8a451aa7..aa01c8b296a9 100644
--- a/.github/workflows/selfhosted.yml
+++ b/.github/workflows/selfhosted.yml
@@ -51,6 +51,7 @@ jobs:
           - obsd74
           - obsd76
           - obsd77
+          - obsd78
           - obsdsnap
           - obsdsnap-i386
           - omnios
diff --git a/.github/workflows/upstream.yml b/.github/workflows/upstream.yml
index 6cb08fd41032..420b2439b009 100644
--- a/.github/workflows/upstream.yml
+++ b/.github/workflows/upstream.yml
@@ -42,7 +42,7 @@ jobs:
       run: sshfs_mount
       working-directory: ${{ runner.temp }}
     - name: update source
-      run: vmrun "cd /usr/src && cvs -q up -dPA usr.bin/ssh regress/usr.bin/ssh usr.bin/nc"
+      run: vmrun "cd /usr/src && if [ -d .git ]; then git pull && git log -n1; else cvs -q up -dPA usr.bin/ssh regress/usr.bin/ssh usr.bin/nc; fi"
     - name: update netcat
       run: vmrun "cd /usr/src/usr.bin/nc && make clean all && sudo make install"
     - name: make clean
diff --git a/.github/workflows/vm.yml b/.github/workflows/vm.yml
index 9dcf5fcca764..759de69cbe33 100644
--- a/.github/workflows/vm.yml
+++ b/.github/workflows/vm.yml
@@ -282,9 +282,12 @@ jobs:
         release: ${{ matrix.target }}
         usesh: true
         prepare: |
-          env PKG_PATH=https://ftp.openbsd.org/pub/OpenBSD/${{matrix.target}}/packages/amd64 pkg_add sudo--
           useradd -m builder
-          echo "builder ALL=(ALL:ALL) NOPASSWD: ALL" >>/etc/sudoers
+          echo "permit nopass keepenv root" >/etc/doas.conf
+          echo "permit nopass keepenv builder" >>/etc/doas.conf
+          ls -l /etc/doas.conf
+          chown root:wheel /etc/doas.conf
+          chmod 644 /etc/doas.conf
           mkdir -p /var/empty /usr/local/etc
           cp $GITHUB_WORKSPACE/moduli /usr/local/etc/moduli
 
@@ -293,18 +296,18 @@ jobs:
       run: cd $GITHUB_WORKSPACE && chown -R builder .
     - name: configure
       shell: openbsd {0}
-      run: cd $GITHUB_WORKSPACE && sudo -u builder ./configure
+      run: cd $GITHUB_WORKSPACE && doas -u builder ./configure
     - name: make clean
       shell: openbsd {0}
-      run: cd $GITHUB_WORKSPACE && sudo -u builder make clean
+      run: cd $GITHUB_WORKSPACE && doas -u builder make clean
     - name: make
       shell: openbsd {0}
-      run: cd $GITHUB_WORKSPACE && sudo -u builder make -j4
+      run: cd $GITHUB_WORKSPACE && doas -u builder make -j4
     - name: make tests
       shell: openbsd {0}
       run: |
         cd $GITHUB_WORKSPACE
-        sudo -u builder env SUDO=sudo make tests
+        doas -u builder env SUDO=doas make tests
 
 
   solaris:
-- 
cgit v1.3