[BACK]Return to 74.html CVS log [TXT][DIR] Up to [local] / www

Annotation of www/74.html, Revision 1.37

1.1       deraadt     1: <!doctype html>
                      2: <html lang=en id=release>
                      3: <head>
                      4: <meta charset=utf-8>
                      5:
                      6: <title>OpenBSD 7.4</title>
                      7: <meta name="description" content="OpenBSD 7.4">
                      8: <meta name="viewport" content="width=device-width, initial-scale=1">
                      9: <link rel="stylesheet" type="text/css" href="openbsd.css">
                     10: <link rel="canonical" href="https://www.openbsd.org/74.html">
                     11: </head><body>
                     12: <h2 id=OpenBSD>
                     13: <a href="index.html">
                     14: <i>Open</i><b>BSD</b></a>
                     15: 7.4
                     16: </h2>
                     17:
                     18: <table>
                     19: <tr>
                     20: <td>
                     21: <a href="images/XXX.png">
                     22: <img width="227" height="303" src="images/XXX-s.gif" alt="XXX"></a>
                     23: <td>
                     24: Released Oct XXX, 2023. (55th OpenBSD release)<br>
                     25: Copyright 1997-2023, Theo de Raadt.<br>
                     26: <br>
1.4       job        27: Artwork by Jessica Scott.
1.1       deraadt    28: <br>
                     29: <ul>
                     30: <li>See the information on <a href="ftp.html">the FTP page</a> for
                     31:     a list of mirror machines.
                     32: <li>Go to the <code class=reldir>pub/OpenBSD/7.4/</code> directory on
                     33:     one of the mirror sites.
                     34: <li>Have a look at <a href="errata74.html">the 7.4 errata page</a> for a list
                     35:     of bugs and workarounds.
                     36: <li>See a <a href="plus74.html">detailed log of changes</a> between the
                     37:     7.3 and 7.4 releases.
                     38: <p>
                     39: <li><a href="https://man.openbsd.org/signify.1">signify(1)</a>
                     40:     pubkeys for this release:<p>
                     41:
                     42: <table class=signify>
                     43: <tr><td>
                     44: openbsd-74-base.pub:
                     45: <td>
                     46: <a href="https://ftp.openbsd.org/pub/OpenBSD/7.4/openbsd-74-base.pub">
                     47: RWRoyQmAD08ajTqgzK3UcWaVlwaJMckH9/CshU8Md5pN1GoIrcBdTF+c</a>
                     48: <tr><td>
                     49: openbsd-74-fw.pub:
                     50: <td>
                     51: RWTRA9KXRuZKunpXYK0ed5OxbE0K7rYWpDnTu+M8wZdqzRroFqed0U6I
                     52: <tr><td>
                     53: openbsd-74-pkg.pub:
                     54: <td>
                     55: RWR/h7gubZ9M/O46RNy3PzLTPevOCK24LGCPca41IHMwSH4YuVA+jnWO
                     56: <tr><td>
                     57: openbsd-74-syspatch.pub:
                     58: <td>
                     59: RWQqty2voy8V8afR9/v2RzuNr7r4y9cKwljABN7Tytd7JcPdBjnXg0Ue
                     60: </table>
                     61: </ul>
                     62: <p>
                     63: All applicable copyrights and credits are in the src.tar.gz,
                     64: sys.tar.gz, xenocara.tar.gz, ports.tar.gz files, or in the
                     65: files fetched via <code>ports.tar.gz</code>.
                     66: </table>
                     67:
                     68: <hr>
                     69:
                     70: <section id=new>
                     71: <h3>What's New</h3>
                     72: <p>
                     73: This is a partial list of new features and systems included in OpenBSD 7.4.
                     74: For a comprehensive list, see the <a href="plus74.html">changelog</a> leading
                     75: to 7.4.
                     76:
                     77: <ul>
                     78:
                     79: <li>New/extended platforms:
                     80:   <ul>
1.11      benno      81:   <li>On arm64, implement branch target protection using the branch
                     82:        target identification feature introduced in Armv8.5.  This provides
                     83:        "head-CFI" to complement the "tail-CFI" provided by retguard, and is
                     84:        supported on Apple M2.
1.1       deraadt    85:   </ul>
                     86:
                     87: <li>Various kernel improvements:
                     88:   <ul>
1.21      schwarze   89:   <li>On amd64, identify IBT capability in
                     90:       <a href="https://man.openbsd.org/amd64/cpu.4">cpu(4)</a> dmesg lines.
1.26      kn         91:   <li>On arm64, show BTI and SBSS features in
1.21      schwarze   92:       <a href="https://man.openbsd.org/dmesg.8">dmesg(8)</a>.
                     93:   <li>Map device tree read/write to unbreak root on
                     94:       <a href="https://man.openbsd.org/softraid.4">softraid(4)</a>.
1.34      krw        95:   <li>Correctly recognize <a href="https://man.openbsd.org/umass.4">umass(4)</a>.
                     96:       floppy disk devices as floppy disks.
1.35      benno      97:   <li>In wscons(4), catch up with box drawing characters which have
                     98:        been standardized in unicode after the original wscons code was
                     99:        written and chose placeholder values.
1.1       deraadt   100:   </ul>
                    101:
                    102: <li>SMP Improvements
                    103:   <ul>
1.15      benno     104:   <li>Protect struct clockintr(9)_queue with a mutex so that arbitrary CPUs
                    105:        can manipulate clock interrupts established on arbitrary CPU queues.
1.28      benno     106:   <li>Pushed kernel lock into nd6_resolve().
                    107:   <li>Removed kernel locks from the ARP input path.
                    108:   <li>Pulled MP-safe arprequest() out of kernel lock.
1.35      benno     109:   <li>Unlock more parts of ioctl(2) code in the network stack.
1.1       deraadt   110:   </ul>
                    111:
                    112: <li>Direct Rendering Manager and graphics drivers
                    113:   <ul>
1.18      jsg       114:   <li>Updated <a href="https://man.openbsd.org/drm.4">drm(4)</a>
                    115:       to Linux 6.1.55
                    116:   <li>Don't change end marker in sg_set_page().  Caused bad memory accesses
                    117:       when using page flipping on Alder Lake and Raptor Lake.
1.1       deraadt   118:   </ul>
                    119:
                    120: <li>VMM/VMD improvements
                    121:   <ul>
1.21      schwarze  122:   <li>Avoid use of uninitialised memory in
                    123:       <a href="https://man.openbsd.org/vmd.8">vmd(8)</a>.
1.15      benno     124:   <li>Migrate vmd_vm.vm_ttyname to char array allowing a vmd_vm
1.30      dv        125:         object to be transmitted over an ipc channel.
                    126:   <li>Cleaned up file descriptor closing in
                    127:         <a href="https://man.openbsd.org/vmd.8">vmd(8)</a> vmm process.
                    128:   <li>Fixed vm send/receive, restoring device virtqueue addresses on
                    129:        receive.
                    130:   <li>Introduced <a href="https://man.openbsd.org/execvp.3">execvp(3)</a>
                    131:        after fork for child vm processes.
1.32      schwarze  132:   <li>No longer generate an error in
                    133:       <a href="https://man.openbsd.org/vmd.8">vmd(8)</a> if
                    134:       <a href="https://man.openbsd.org/vm.conf.5">vm.conf(5)</a> is absent.
1.30      dv        135:   <li>Split <a href="https://man.openbsd.org/vmm.4">vmm(4)</a> into MI/MD
                    136:        parts.
                    137:   <li>Introduced multi-process model for
                    138:        <a href="https://man.openbsd.org/vmd.8">vmd(8)</a> virtio block and
                    139:        network devices.
                    140:   <li>Allowed vm owners to override boot kernel when using
                    141:        <a href="https://man.openbsd.org/vmctl.8">vmctl(8)</a> to start a
                    142:        vm.
                    143:   <li>Changed staggered start of vms to number of online CPUs.
                    144:   <li>Fixed a segfault on vm creation.
                    145:   <li>Switched to anonymous shared memory mappings for
                    146:        <a href="https://man.openbsd.org/vmd.8">vmd(8)</a> vm processes,
                    147:        introducing a new <a href="https://man.openbsd.org/vmm.4">vmm(4)</a>
                    148:        <a href="https://man.openbsd.org/ioctl.2">ioctl(2)</a>.
                    149:   <li>Relaxed absolute path requirements for
                    150:        <a href="https://man.openbsd.org/vmd.8">vmd(8)</a> configtest mode (-n).
                    151:   <li>Adjusted shutdown logic by vm id to function similarly as by name.
                    152:   <li>Moved validation of local network prefixes for the internal
                    153:        <a href="https://man.openbsd.org/vmd.8">vmd(8)</a> DHCP service into
                    154:        the config parser.
                    155:   <li>Fixed QCOW2 base images when used with the
                    156:        <a href="https://man.openbsd.org/vmd.8">vmd(8)</a> multi-process device
                    157:        model.
                    158:   <li>Fixed setting verbose logging in child processes.
                    159:   <li>Fixed a race condition related to the emulated i8259 interrupt controller
                    160:        by ignoring interrupt masks on assert.
                    161:   <li>Inlined pending interrupts in the
                    162:        <a href="https://man.openbsd.org/vmm.4">vmm(4)</a>
                    163:        <a href="https://man.openbsd.org/ioctl.2">ioctl(2)</a> for running the
                    164:        vcpu, reducing vm latency.
                    165:   <li>Added zero-copy, vectored io to the
                    166:        <a href="https://man.openbsd.org/vmd.8">vmd(8)</a> virtio block device.
                    167:   <li>Changed to logging <a href="https://man.openbsd.org/vmd.8">vmd(8)</a>
                    168:        vm ids in the vcpu run loop on error and not the ids used by
                    169:        <a href="https://man.openbsd.org/vmm.4">vmm(4)</a>.
                    170:   <li>Fixed a vm pause deadlock.
                    171:   <li>Changed <a href="https://man.openbsd.org/vmd.8">vmd(8)</a> logging format
                    172:        to disambiguate vm and device process by names and indices.
                    173:   <li>Fixed dynamically toggling verbose logging mode with
                    174:        <a href="https://man.openbsd.org/vmctl.8">vmctl(8)</a>.
1.1       deraadt   175:   </ul>
                    176:
                    177: <li>Various new userland features:
                    178:   <ul>
1.20      schwarze  179:   <li>New ISO C11 header <code>&lt;uchar.h&gt;</code> declaring the
                    180:       types <code>char32_t</code> and <code>char16_t</code> and the
                    181:       functions <a href="https://man.openbsd.org/c32rtomb.3">c32rtomb(3)</a>,
                    182:       <a href="https://man.openbsd.org/mbrtoc32.3">mbrtoc32(3)</a>,
                    183:       <a href="https://man.openbsd.org/c16rtomb.3">c16rtomb(3)</a>, and
                    184:       <a href="https://man.openbsd.org/mbrtoc16.3">mbrtoc16(3)</a>.
1.24      otto      185:   <li><a href="https://man.openbsd.org/malloc.3">malloc(3)</a> gains built-in leak detection.
1.11      benno     186:   <li>Update zoneinfo to tzdata2023c.
1.34      krw       187:   <li>Accept the <a href="https://man.openbsd.org/ucom.4">ucom(4)</a> fixed
                    188:       name format as a valid format for the
                    189:       <a href="https://man.openbsd.org/cu.1">cu(1)</a> -l option.
1.1       deraadt   190:   </ul>
                    191:
                    192: <li>Various bugfixes and tweaks in userland:
                    193:   <ul>
1.33      schwarze  194:   <li>In <a href="https://man.openbsd.org/pax.1">pax(1)</a> and
                    195:       <a href="https://man.openbsd.org/tar.1">tar(1)</a>,
                    196:       speed up archive creation when many files are skipped.
1.21      schwarze  197:   <li>Refactoring and documenting of
                    198:       <a href="https://man.openbsd.org/fdisk.8">fdisk(8)</a> code,
                    199:       to make it easier to maintain.
1.34      krw       200:   <li><a href="https://man.openbsd.org/fdisk.8">fdisk(8)</a>
                    201:        no longer adds extra blanks at the end of lines, eliminating
                    202:        spurious line wrapping.
1.21      schwarze  203:   <li>In <a href="https://man.openbsd.org/clang.1">clang(1)</a>,
                    204:       allow out-of-class defaulting of comparison operators,
1.11      benno     205:        by ways of backporting an upstream commit.
1.21      schwarze  206:   <li>Improve the code of
                    207:       <a href="https://man.openbsd.org/aucat.1">aucat(1)</a>
                    208:       and fix spelling mistakes.
1.11      benno     209:   <li>Improve the code quality of find(1).
1.21      schwarze  210:   <li>Many changes in <a href="https://man.openbsd.org/mg.1">mg(1)</a>:
1.11      benno     211:     <ul>
1.21      schwarze  212:     <li>Improve the readability of the code.
                    213:     <li>Fall back to /bin/sh if $SHELL is undefined.
                    214:     <li>Fix parsing of tag files with duplicate entries.
1.11      benno     215:        Instead of erroring out ignore duplicates. Fixes using
                    216:        /var/db/libc.tags again.
1.21      schwarze  217:     <li>Change tagvisit (aka visit-tag-table) to immediately
1.11      benno     218:        load the tag file, and drop the lazy mechanics.
1.21      schwarze  219:     <li>Remove useless global variable.
                    220:     <li>Plug memory leak.
                    221:     <li>Replace strncpy() with strlcpy().
1.11      benno     222:     <li>Skip checking permissions of conffile with access(2).
1.35      benno     223:     <li>Added a missing void.
1.11      benno     224:     </ul>
1.16      jsg       225:   <li>On aarch64 architectures improve how BTI control flow integrity
1.11      benno     226:        enforcement is implemented in the executable entry point and enable
1.16      jsg       227:        support for BTI control flow integrity checks in libc assembly
1.11      benno     228:        functions.
1.28      benno     229:   <li>In <a href="https://man.openbsd.org/ld.so.1">ld.so(1)</a> treat
                    230:        symlinks in $ORIGIN determination the same way as other OS linkers do.
1.34      krw       231:   <li>Fix a segfault when the
                    232:       <a href="https://man.openbsd.org/disklabel.8">disklabel(8)</a>
                    233:            simple editor encounters an incomplete partition line.
                    234:   <li>Fix <a href="https://man.openbsd.org/disklabel.8">disklabel(8)</a>
                    235:       handling of templates with partitions after a "N-* 100" entry.
                    236:   <li>Enable <a href="https://man.openbsd.org/disklabel.8">disklabel(8)</a>
                    237:       regress tests to work on sparc64.
                    238:   <li>Fix <a href="https://man.openbsd.org/fdisk.8">fdisk(8)</a>
                    239:       initialization of CHS/LBA fields in an MBR, allowing machines with
                    240:       a BIOS that uses CHS to boot from disks >8G.
                    241:   <li>Retire <a href="https://man.openbsd.org/disklabel.8">disklabel(8)</a>
                    242:       -E expert mode.
                    243:   <li>When displaying GPT partition attributes
                    244:       <a href="https://man.openbsd.org/fdisk.8">fdisk(8)</a> prefixes
                    245:       Microsoft partition attribute names with 'MS'.
                    246:   <li>In the absence of the 'disktype' command line parameter
                    247:       <a href="https://man.openbsd.org/disklabel.8">disklabel(8)</a>
                    248:       always uses the current media type provided by the kernel.
                    249:   <li>Ensure <a href="https://man.openbsd.org/fdisk.8">fdisk(8)</a> handles
                    250:       the case where a GPT partition name is not a valid C string.
1.35      benno     251:   <li>in ld.so(1), avoid an overflow in the ELF SYSV ABI hash function.
1.1       deraadt   252:   </ul>
                    253:
                    254: <li>Improved hardware support and driver bugfixes, including:
                    255:   <ul>
1.20      schwarze  256:   <li>New <a href="https://man.openbsd.org/sysctl.2">sysctl(2)</a>
                    257:       nodes for battery management, <code>hw.battery.charge*</code>.
                    258:   <li>Define fixed names for
                    259:       <a href="https://man.openbsd.org/ucom.4">ucom(4)</a> USB serial
1.34      krw       260:       ports, display them in attach messages and via the new
                    261:       <code>hw.ucomnames</code>
                    262:       <a href="https://man.openbsd.org/sysctl.2#HW_UCOMNAMES~2">sysctl(2)</a>.
1.28      benno     263:   <li>Add support for the RK3568 32k RTC and other clocks in
1.21      schwarze  264:       <a href="https://man.openbsd.org/rkclock.4">rkclock(4)</a>.
                    265:   <li>In <a href="https://man.openbsd.org/dwpcie.4">dwpcie(4)</a>,
                    266:       attach Baikal-M PCIe.
1.11      benno     267:   <li>In openfirmware, implement regulator notifiers which get called
                    268:        when the voltage/current for a regulator is changed or when the
                    269:        regulator gets initialized when it attaches for the first time. The
                    270:        latter makes it possible to register a notifier for a regulator that
                    271:        hasn't attached yet.
1.21      schwarze  272:   <li>Add <a href="https://man.openbsd.org/rkiovd.4">rkiovd(4)</a>,
                    273:       a driver for the I/O voltage domains on Rockchip SoCs.
                    274:   <li>Add support for TEMPerGold 3.4 temperature sensor to
                    275:       <a href="https://man.openbsd.org/ugold.4">ugold(4)</a>.
1.15      benno     276:   <li>Ignore duplicate ACPI lid transitions as they can happen on Dell
                    277:        Precision 5510 systems.
                    278:   <li>Make RK3568 PCIe controllers run at the maximum possible speed
                    279:        by using dwpcie_link_config() when initializing.
                    280:   <li>In the Universal Flash Storage Host Controller Interface
1.21      schwarze  281:       (<a href="https://man.openbsd.org/ufshci.4">ufshci(4)</a>),
                    282:       enable Force Unit Access (FUA) for write commands.
1.28      benno     283:   <li>Make SATA (<a href="https://man.openbsd.org/ahci.4">ahci(4)</a>)
                    284:        work on a Banana Pi BPI-R2 Pro.
                    285:   <li>In <a href="https://man.openbsd.org/umcs.4">umcs(4)</a>, set
                    286:        parity bits correctly.
1.35      benno     287:   <li>Enabled the caps lock LED on modern Apple laptop keyboards.
                    288:   <li>Added support for Rockchip "cryptov2-rng" random number generator in rkrng(4).
                    289:   <li>Fixed a double free in error path in the 'openssl(1) x509' command.
                    290:   <li>Fixed cpuperf on the Apple M2 Pro/Max.
1.36      jsg       291:   <li>Add support for the PCIe controller found on Apple M2 Pro/Max SoCs.
1.1       deraadt   292:   </ul>
                    293:
                    294: <li>New or improved network hardware support:
                    295:   <ul>
1.21      schwarze  296:   <li>Fix <a href="https://man.openbsd.org/dwqe.4">dwqe(4)</a>
                    297:       on several boards that use
                    298:       <a href="https://man.openbsd.org/rgephy.4">rgephy(4)</a> by configuring
1.11      benno     299:        the RGMII interface before taking the PHY out of reset.
1.28      benno     300:   <li>Improve <a href="https://man.openbsd.org/dwqe.4">dwqe(4)</a> and
                    301:        determine PHY mode and pass the appropriate flags down to the PHY when
                    302:        we attach it.
1.31      schwarze  303:   <li>Report in <a href="https://man.openbsd.org/dmesg.8">dmesg(8)</a> on
                    304:       which gmac the <a href="https://man.openbsd.org/dwqe.4">dwqe(4)</a>
                    305:       driver is attaching to.
1.21      schwarze  306:   <li>Document that Intel i226 adapters are supported by
                    307:       <a href="https://man.openbsd.org/igc.4">igc(4)</a>.
                    308:   <li>Add <a href="https://man.openbsd.org/ngbe.4">ngbe(4)</a>,
                    309:       a driver for WangXun WX1860 PCI Express 10/100/1Gb Ethernet devices.
                    310:       Also support it on amd64 install media.
                    311:   <li>Add <a href="https://man.openbsd.org/rkusbphy.4">rkusbphy(4)</a>,
                    312:       a driver for the usb2phy on Rockchip SoCs, and enable it on arm64.
                    313:   <li>Add support for the RTL8211F-VD PHY in
                    314:       <a href="https://man.openbsd.org/rgephy.4">rgephy(4)</a>.
1.15      benno     315:   <li>In openfirmware, add glue for network interfaces to be found by
                    316:        fdt/ofw node or phandle in order to support "switch chips" like the
                    317:        marvell link street.
1.31      schwarze  318:   <li>Add support for enabling both the usb2 and usb3 phys in
                    319:       <a href="https://man.openbsd.org/xhci.4">xhci(4)</a> and
                    320:       <a href="https://man.openbsd.org/ehci.4">ehci(4)</a>.
1.37    ! kevlo     321:   <li>Add support for RTL8153D devices to
        !           322:       <a href="https://man.openbsd.org/ure.4">ure(4)</a>.
1.1       deraadt   323:   </ul>
                    324:
                    325: <li>Added or improved wireless network drivers:
                    326:   <ul>
1.21      schwarze  327:   <li>Improve how Quectel LTE&5G devices attach to
                    328:       <a href="https://man.openbsd.org/umb.4">umb(4)</a>.
1.1       deraadt   329:   </ul>
                    330:
                    331: <li>IEEE 802.11 wireless stack improvements and bugfixes:
                    332:   <ul>
1.27      stsp      333:   <li> Add support for RTL8188FTV devices to the
                    334:       <a href="https://man.openbsd.org/urtwn.4">urtwn(4)</a> driver.
                    335:   <li>Attach Intel wireless devices with PCI product ID 0x51f1 to
                    336:       <a href="https://man.openbsd.org/iwx.4">iwx(4)</a>.
                    337:   <li>Fix a bug where <a href="https://man.openbsd.org/iwm.4">iwm(4)</a> and
                    338:       <a href="https://man.openbsd.org/iwx.4">iwx(4)</a> background
                    339:       scan tasks were added to the wrong task queue.
                    340:   <li>Fix a firmware error that occurred when an
                    341:       <a href="https://man.openbsd.org/iwx.4">iwx(4)</a> interface
                    342:       was brought down.
                    343:   <li>Fix <a href="https://man.openbsd.org/iwx.4">iwx(4)</a> firmware errors
                    344:       triggered during background scans.
                    345:   <li>Fix a crash in the <a href="https://man.openbsd.org/iwm.4">iwm(4)</a>
                    346:       driver when userland attempts to inject frames via bpf in monitor mode.
1.1       deraadt   347:   </ul>
                    348:
                    349: <li>Installer, upgrade and bootloader improvements:
                    350:   <ul>
1.11      benno     351:   <li>In the arm64 ramdisk, simplify apple firmware copying to make it
                    352:        easier to add new firmware.
1.21      schwarze  353:   <li>On armv7 and arm64, silence informational messages from
                    354:       <a href="https://man.openbsd.org/dd.1">dd(1)</a>
1.11      benno     355:        when zeroing a disk's first 1MB. Use character not block devices with
                    356:        dd(1) like on other architectures.
                    357:   <li>Refactor the code of md_installboot() on armv7 and arm64 to be
                    358:        more in line with other architectures.
                    359:   <li>Improve the dialogue of the installer without affecting
1.21      schwarze  360:       <a href="https://man.openbsd.org/autoinstall.8">autoinstall(8)</a>
                    361:        files.
                    362:   <li>Enable <a href="https://man.openbsd.org/ufshci.4">ufshci(4)</a>
                    363:       on arm64 install media.
1.15      benno     364:   <li>On arm64 pine64 boards, stop writing pine64 firmware to disk.
1.21      schwarze  365:   <li>Make root on
                    366:       <a href="https://man.openbsd.org/softraid.4">softraid(4)</a>
                    367:       installations boot out of the box on Raspberry Pis (arm64).
1.28      benno     368:   <li>Support installations with root on
                    369:       <a href="https://man.openbsd.org/softraid.4">softraid(4)</a>
                    370:       on arm64, tested on Pinebook Pro, Raspberry Pi 4b, and SolidRun CEX7.
                    371:   <li>When installing on encrypted
                    372:        <a href="https://man.openbsd.org/softraid.4">softraid(4)</a>, determine
                    373:        the disk for placing the root device automatically and make it default
                    374:        as it is the only legit choice.
1.26      kn        375:   <li>Add arm64 to the list of architectures with support for guided disk
                    376:       encryption.
                    377:   <li>Retain existing EFI System partitions on systems with APFSISC
                    378:       partitions (arm64 Apple M1/M2) during installation with root on
                    379:       <a href="https://man.openbsd.org/softraid.4">softraid(4)</a>.
1.34      krw       380:   <li>When media has neither a GPT nor an MBR
                    381:       <a href="https://man.openbsd.org/installboot.8">installboot(8)</a>.
                    382:       assumes OpenBSD occupies the entire disk starting at sector 0.
1.35      benno     383:   <li>Attempt to not overflow the ramdisk when extracting firmware on
                    384:        Apple arm64 systems.
1.1       deraadt   385:   </ul>
                    386:
                    387: <li>Security improvements:
                    388:   <ul>
1.21      schwarze  389:   <li>Change <a href="https://man.openbsd.org/malloc.3">malloc(3)</a>
1.24      otto      390:       chunk sizes to be fine grained: chunk sizes are closer to the
                    391:       requested allocation size.
1.21      schwarze  392:   <li>In <a href="https://man.openbsd.org/malloc.3">malloc(3)</a>,
                    393:       check all chunks in the delayed free list for write-after-free.
1.33      schwarze  394:   <li>In <a href="https://man.openbsd.org/ksh.1">ksh(1)</a>, escape
                    395:       control characters when displaying file name completions,
                    396:       even when there are multiple matches.
                    397:   <li>In <a href="https://man.openbsd.org/pax.1">pax(1)</a>,
                    398:       <a href="https://man.openbsd.org/tar.1">tar(1)</a>, and
                    399:       <a href="https://man.openbsd.org/cpio.1">cpio(1)</a> terminal
                    400:       output, escape non-printable characters in messages that may
                    401:       include file names.
1.1       deraadt   402:   </ul>
                    403:
                    404: <li>Changes in the network stack:
                    405:   <ul>
1.21      schwarze  406:   <li>In <a href="https://man.openbsd.org/pf.4">pf(4)</a>,
                    407:       when redirecting locally generated IP packets to
1.15      benno     408:        userland with divert-packet rules, the packets may have no checksum
1.17      jsg       409:        due to hardware offloading.  Calculate the checksum in that case.
1.21      schwarze  410:  <li>Sync the use of
                    411:      <a href="https://man.openbsd.org/getuptime.9">getuptime(9)</a>
                    412:      in the Neighbour Discovery (ND) code with ARP.
                    413:  <li>In the IPv6 forwarding code, call
                    414:      <a href="https://man.openbsd.org/getuptime.9">getuptime(9)</a>
                    415:      once for consistency with IPv4.
1.28      benno     416:  <li>ARP has a queue of packets that should be sent after name
                    417:        resolution. Neighbor discovery (ND6) did only hold a single packet.
                    418:        Unified the code, added a queue to ND6 and made the code MP safe.
1.31      schwarze  419:  <li>Implement a new <a href="https://man.openbsd.org/sysctl.2">sysctl(2)</a>
                    420:      <code>net.inet6.icmp6.nd6_queued</code> to show the number of packets
                    421:      waiting for an ND6 response, analogous to ARP.
1.15      benno     422:
1.1       deraadt   423:  </ul>
                    424:
                    425: <li>Routing daemons and other userland network improvements:
                    426:   <ul>
                    427:   <li>IPsec support was improved:
                    428:   <ul>
1.21      schwarze  429:        <li>In <a href="https://man.openbsd.org/isakmpd.8">isakmpd(8)</a>,
                    430:            avoid a double free in ec_init() when using the OpenSSL API.
                    431:        <li>In <a href="https://man.openbsd.org/iked.8">iked(8)</a>,
                    432:            do not treat the return value of
                    433:            <a href="https://man.openbsd.org/i2d_ECDSA_SIG.3"
                    434:            >i2d_ECDSA_SIG(3)</a> as a length as it can be negative.
                    435:        <li>Prepare <a href="https://man.openbsd.org/isakmpd.8">isakmpd(8)</a>
                    436:            for a libcrypto library that is lacking binary field support.
                    437:        <li>In <a href="https://man.openbsd.org/isakmpd.8">isakmpd(8)</a>,
                    438:            avoid a potential crash by adding a missing NULL check.
1.11      benno     439:
1.1       deraadt   440:   </ul>
                    441:   <li>In <a href="https://man.openbsd.org/bgpd.8">bgpd(8)</a>,
                    442:   <ul>
1.22      claudio   443:        <li>Add first version of flowspec support. Right now only announcement
                    444:            of flowspec rules is possible.
                    445:        <li>Update ASPA support to follow draft-ietf-sidrops-aspa-verification-16
                    446:            and draft-ietf-sidrops-aspa-profile-16 by making the ASPA lookup
                    447:            tables AFI-agnostic.
                    448:        <li>Rework UPDATE message generation to use the new ibuf API instead
                    449:            of the hand-rolled solution before.
                    450:        <li>Fix <code>ext-community * *</code> matching which also affects
1.29      jsg       451:            filters removing all ext-communities.
1.22      claudio   452:        <li>Improve and extend the bgpctl parser to handle commands like
                    453:            <code>bgpctl show rib 192.0.2.0/24 detail</code>.
                    454:            Also add various flowspec specific commands.
                    455:        <li>Introduce a semaphore to protect intermittent RTR session data
                    456:            from being published to the RDE.
                    457:        <li>Limit the socket buffer size to 64k for all sessions.
                    458:            Limiting the buffer size to a reasonable size ensures that not
                    459:            too many updates end up queued in the TCP stack.
                    460:        <li>Adjusted example <code>GRACEFUL_SHUTDOWN</code> filter rule in
                    461:            the example config to only match on ebgp sessions.
1.1       deraadt   462:   </ul>
                    463:   <li><a href="https://man.openbsd.org/rpki-client.8">rpki-client(8)</a> saw some changes:
                    464:   <ul>
1.23      claudio   465:        <li>A 30%-50% performance improvement was achieved through libcrypto's
                    466:            partial chains certificate validation feature. Already validated
                    467:            non-inheriting CA certificates are now marked as trusted roots. This
                    468:            way it can be ensured that a leaf's delegated resources are properly
                    469:            covered, and at the same time most validation paths are
                    470:            significantly shortened.
                    471:        <li>Support for gzip and deflate HTTP Content-Encoding compression was
                    472:            added. This allows web servers to send RRDP XML in compressed form,
                    473:            saving around 50% of bandwidth.
                    474:        <li>ASPA support was updated to draft-ietf-sidrops-aspa-profile-16.
                    475:            As part of supporting AFI-agnostic ASPAs, the JSON syntax for
                    476:            Validated ASPA Payloads changed in both filemode and normal output.
                    477:        <li>In filemode (-f option) the applicable manifests are now shown as
                    478:            part of the signature path.
                    479:        <li>A new -P option was added to manually specify a moment in time
                    480:            to use when parsing the validity window of certificates. Useful
                    481:            for regression testing. Default is invocation time of rpki-client.
                    482:        <li>The -A option will now also exclude ASPA data from the JSON output.
                    483:        <li>The synchronisation protocol used to sync the repository is now
                    484:            included in the OpenMetrics output.
                    485:        <li>Improved accounting by tracking objects both by repo and tal.
                    486:        <li>Check whether products listed on a manifest were issued by the same
                    487:            authority as the manifest itself.
                    488:        <li>File modification timestamps of objects retrieved via RRDP are now
                    489:            deterministically set to prepare the on-disk cache for seamless
                    490:            failovers from RRDP to RSYNC.
                    491:        <li>Improved detection of RRDP session desynchronization: a check was
                    492:            added to compare whether the delta hashes associated to previously
                    493:            seen serials are different in newly fetched notification files.
                    494:        <li>Improved handling of RRDP deltas in which objects are published,
                    495:            withdrawn, and published again.
                    496:        <li>Disallow X.509 v2 issuer and subject unique identifiers in certs.
                    497:            RPKI CAs will never issue certificates with V2 unique identifiers.
                    498:        <li>A check to disallow duplicate X.509 certificate extensions was
                    499:            added.
                    500:        <li>A check to disallow empty sets of IP Addresses or AS numbers in RFC
                    501:            3779 extensions was added.
                    502:        <li>A warning is printed when the CMS signing-time attribute in a Signed
                    503:            Object is missing.
                    504:        <li>Warnings about unrecoverable message digest mismatches now include
                    505:            the manifestNumber to aid debugging the cause.
                    506:        <li>A check was added to disallow multiple RRDP publish elements for the
                    507:            same file in RRDP snapshots. If this error condition is encountered,
                    508:            the RRDP transfer is failed and the RP falls back to rsync.
                    509:        <li>A compliance check for the proper X.509 Certificate version and CRL
                    510:            version was added.
                    511:        <li>A compliance check was added to ensure CMS Signed Objects contain
                    512:            SignedData, in accordance to RFC 6488 section 3 checklist item 1a.
                    513:        <li>Compliance checks were added for the version, KeyUsage, and
                    514:            ExtendedKeyUsage of EE certificates in Manifest, TAK, and GBR Signed
                    515:            Objects.
                    516:        <li>A CMS signing-time value being after the X.509 notAfter timestamp
                    517:            was downgraded from an error to a warning.
                    518:        <li>A bug was fixed in the handling of CA certificates which inherit IP
                    519:            resources.
                    520:        <li>A compliance check was added to ensure the X.509 Subject only
                    521:            contains commonName and optionally serialNumber.
                    522:        <li>A compliance check was added to ensure the CMS SignedData and
                    523:            SignerInfo versions to be 3.
                    524:        <li>Fisher-Yates shuffle the order in which Manifest entries are
                    525:            processed. Previously, work items were enqueued in the order the CA
                    526:            intended them to appear on a Manifest. However, there is no obvious
                    527:            benefit to third parties deciding the order in which things are
                    528:            processed.
1.1       deraadt   529:   </ul>
                    530:
                    531:   <li>In <a href="https://man.openbsd.org/snmpd.8">snmpd(8)</a>,
                    532:   <ul>
                    533:        <li>...
                    534:   </ul>
                    535:
1.21      schwarze  536:   <li>Make <a href="https://man.openbsd.org/dig.1">dig(1)</a>
                    537:       use less deprecated LibreSSL API.
                    538:   <li>In <a href="https://man.openbsd.org/ypldap.8">ypldap(8)</a>,
                    539:       reduce memory usage when updating larger directories.
                    540:   <li>Remove stylistic differences between
                    541:       <a href="https://man.openbsd.org/arp.8">arp(8)</a> and
                    542:       <a href="https://man.openbsd.org/ndp.8">ndp(8)</a> delete()
1.15      benno     543:        function.  This makes it easier to spot real changes in behavior.
1.21      schwarze  544:   <li>Make <a href="https://man.openbsd.org/ndp.8">ndp(8)</a>
                    545:       not remove cloning routes when no neighbor entry is
1.15      benno     546:        found with <code>ndp -d</code>.
1.1       deraadt   547:   </ul>
                    548:
                    549: <li><a href="https://man.openbsd.org/tmux.1">tmux(1)</a> improvements and bug fixes:
                    550:   <ul>
1.11      benno     551:   <li>For passthrough, don't write to clients attached to different sessions.
                    552:   <li>Add a format to show if there are unseen changes while in a mode.
1.1       deraadt   553:   </ul>
                    554:
1.7       tb        555: <li>LibreSSL version 3.8.2
1.1       deraadt   556:   <ul>
1.7       tb        557:   <li>Security fixes
                    558:     <ul>
                    559:     <li>Disabled TLSv1.0 and TLSv1.1 in libssl so that they may no longer
                    560:       be selected for use.
                    561:     <li>BN_is_prime{,_fasttest}_ex() refuse to check numbers larger than
                    562:       32 kbits for primality. This mitigates various DoS vectors.
                    563:     <li>Restricted the RFC 3779 code to IPv4 and IPv6. It was not written
                    564:       to be able to deal with anything else.
                    565:     </ul>
                    566:   <li>Portable changes
                    567:     <ul>
                    568:     <li>Extended the endian.h compat header with hto* and *toh macros.
                    569:     <li>Adapted more tests to the portable framework.
                    570:     <li>Internal tools are now statically linked.
                    571:     <li>Applications bundled as part of the LibreSSL package internally,
                    572:       nc(1) and openssl(1), now are linked statically if static libraries
                    573:       are built.
                    574:     <li>Internal compatibility function symbols are no longer exported from
                    575:       libcrypto. Instead, the libcompat library is linked to libcrypto,
                    576:       libssl, and libtls separately. This increases size a little, but
                    577:       ensures that the libraries are not exporting symbols to programs
                    578:       unintentionally.
                    579:     <li>Selective removal of CET implementation on platforms where it is
                    580:       not supported (macOS).
                    581:     <li>Integrated four more tests.
                    582:     <li>Added Windows ARM64 architecture to tested platforms.
                    583:     <li>Removed Solaris 10 support, fixed Solaris 11.
                    584:     <li>libtls no longer links statically to libcrypto / libssl unless
                    585:            <code>--enable-libtls-only</code> is specified at configure time.
                    586:     <li>Improved Windows compatibility library, namely handling of files vs
                    587:       sockets, correcting an exception when operating on a closed socket.
                    588:     <li>CMake builds no longer hardcode <code>-O2</code> into the compiler flags,
                    589:       instead using flags from the CMake build type instead.
                    590:     <li>Set the CMake default build type to <code>Release</code>. This can be overridden
                    591:       during configuration.
                    592:     <li>Fixed broken ASM support with MinGW builds.
                    593:     </ul>
1.1       deraadt   594:   <li>New features
                    595:     <ul>
1.7       tb        596:     <li>Added support for truncated SHA-2 and for SHA-3.
                    597:     <li>The BPSW primality test performs additional Miller-Rabin rounds
                    598:       with random bases to reduce the likelihood of composites passing.
                    599:     <li>Allow testing of ciphers and digests using badly aligned buffers
                    600:       in openssl speed using -unalign.
                    601:     <li>Ed25519 certificates are now supported in openssl(1) ca and req.
                    602:       Prepared Ed25519 support in libssl.
                    603:     <li>Add branch target information (BTI) support to amd64 and arm64
                    604:       assembly.
1.1       deraadt   605:     </ul>
                    606:   <li>Compatibility changes
                    607:     <ul>
1.7       tb        608:     <li>Added a workaround for a poorly thought-out change in OpenSSL 3 that
                    609:       broke privilege separation support in libtls.
                    610:     <li>Moved libtls from ECDSA_METHOD to EC_KEY_METHOD.
                    611:     <li>Removed GF2m support: BIGNUM no longer supports binary extension
                    612:       field arithmetic and all binary elliptic builtin curves were removed.
                    613:     <li>Removed dangerous, "fast" NIST prime and elliptic curve implementations.
                    614:       In particular, EC_GFp_nist_method() is no longer available.
                    615:     <li>Removed most public symbols that were deprecated in OpenSSL 0.9.8.
                    616:     <li>Removed the public X9.31 API (RSA_X931_PADDING is still available).
                    617:     <li>Removed Cipher Text Stealing mode.
                    618:     <li>Removed ENGINE support, including ECDH_METHOD and ECDSA_METHOD.
                    619:     <li>Removed COMP, DSO, dynamic loading of conf modules and support for
                    620:       custom ex_data and error stacks.
                    621:     <li>Removed proxy certificate (RFC 3820) support.
                    622:     <li>Removed SXNET and NETSCAPE_CERT_SEQUENCE support including the
1.8       tb        623:       openssl(1) nseq command.
1.7       tb        624:     <li>ENGINE support was removed and OPENSSL_NO_ENGINE is set. In spite
                    625:       of this, some stub functions are provided to avoid patching some
                    626:       applications that do not honor OPENSSL_NO_ENGINE.
                    627:     <li>The POLICY_TREE and its related structures and API were removed.
                    628:     <li>In X509_VERIFY_PARAM_inherit() copy hostflags independently of the
                    629:       host list.
                    630:     <li>Made CRYPTO_get_ex_new_index() not return 0 to allow applications
                    631:       to use *_{get,set}_app_data() and *_{get,set}_ex_data() alongside
                    632:       each other.
                    633:     <li>X509_NAME_get_text_by_{NID,OBJ}() now only succeed if they contain
                    634:       valid UTF-8 without embedded NUL.
                    635:     <li>The explicitText user notice uses UTF8String instead of VisibleString
                    636:       to reduce the risk of emitting certificates with invalid DER-encoding.
                    637:     <li>Initial fixes for RSA-PSS support to make the TLSv1.3 stack more
                    638:       compliant with RFC 8446.
                    639:     <li>Fixed EVP_CIPHER_CTX_iv_length() to return what was set with
                    640:       EVP_CTRL_AEAD_SET_IVLEN or one of its aliases.
1.1       deraadt   641:     </ul>
1.7       tb        642:   <li>Internal improvements
1.1       deraadt   643:     <ul>
1.7       tb        644:     <li>Improved sieve of Eratosthenes script used for generating a table
                    645:       of small primes.
                    646:     <li>Removed incomplete and dangerous BN_RECURSION code.
                    647:     <li>Imported RFC 5280 policy checking code from BoringSSL and used it
                    648:       to replace the old exponential time code.
                    649:     <li>Converted more of libcrypto to use CBB/CBS.
                    650:     <li>Started cleaning up and rewriting SHA internals.
                    651:     <li>Reduced the dependency of hash implementations on many layers of
                    652:       macros. This results in significant speedups since modern compilers
                    653:       are now less confused.
                    654:     <li>Improved BIGNUM internals and performance.
                    655:     <li>Significantly simplified the BN_BLINDING internals used in RSA.
                    656:     <li>Made BN_num_bits() independent of bn->top.
                    657:     <li>Rewrote and simplified bn_sqr().
                    658:     <li>Significantly improved Montgomery multiplication performance.
                    659:     <li>Rewrote and improved BN_exp() and BN_copy().
                    660:     <li>Changed ASN1_item_sign_ctx() and ASN1_item_verify() to work with
                    661:       Ed25519 and fixed a few bugs in there.
                    662:     <li>Lots of cleanup for DH, DSA, EC, RSA internals.  Plugged numerous
                    663:       memory leaks, fixed logic errors and inconsistencies.
                    664:     <li>Cleaned up and simplified various ECDH and ECDSA internals.
                    665:     <li>Removed EC_GROUP precomp machinery.
                    666:     <li>Fixed various issues with EVP_PKEY_CTX_{new,dup}().
                    667:     <li>Rewrote OBJ_find_sigid_algs() and OBJ_find_sigid_by_algs().
                    668:     <li>Improved X.509 certificate version checks.
                    669:     <li>Ensure no X.509v3 extensions appear more than once in certificates.
                    670:     <li>Replaced ASN1_bn_print with a cleaner internal implementation.
                    671:     <li>Fix OPENSSL_cpuid_setup() invocations on arm/aarch64.
                    672:     <li>Improved checks for commonName in libtls.
                    673:     <li>Fixed error check for X509_get_ext_d2i() failure in libtls.
                    674:     <li>Removed code guarded by #ifdef ZLIB.
                    675:     <li>Plug a potential memory leak in ASN1_TIME_normalize().
                    676:     <li>Fixed a use of uninitialized in i2r_IPAddrBlocks().
                    677:     <li>Rewrote CMS_SignerInfo_{sign,verify}().
1.1       deraadt   678:     </ul>
1.7       tb        679:   <li>Bug fixes
1.1       deraadt   680:     <ul>
1.7       tb        681:     <li>Correctly handle negative input to various BIGNUM functions.
                    682:     <li>Ensure ERR_load_ERR_strings() does not set errno unexpectedly.
                    683:     <li>Fix error checking of i2d_ECDSA_SIG() in ossl_ecdsa_sign().
1.8       tb        684:     <li>Fixed aliasing issue in BN_mod_inverse(). Disallowed aliasing of result
                    685:       and modulus in various BN_mod_* functions.
1.7       tb        686:     <li>Fixed detection of extended operations (XOP) on AMD hardware.
                    687:     <li>Ensure Montgomery exponentiation is used for the initial RSA blinding.
                    688:     <li>Policy is always checked in X509 validation. Critical policy extensions
                    689:       are no longer silently ignored.
                    690:     <li>Fixed error handling in tls_check_common_name().
                    691:     <li>Add missing pointer invalidation in SSL_free().
                    692:     <li>Fixed X509err() and X509V3err() and their internal versions.
                    693:     <li>Ensure that OBJ_obj2txt() always returns a C string again.
                    694:     <li>Made EVP_PKEY_set1_hkdf_key() fail on a NULL key.
                    695:     <li>On socket errors in the poll loop, netcat could issue system calls
                    696:       on invalidated file descriptors.
                    697:     <li>Allow IP addresses to be specified in a URI.
                    698:     <li>Fixed a copy-paste error in ASN1_TIME_compare() that could lead
                    699:       to two UTCTimes or two GeneralizedTimes incorrectly being compared
                    700:       as equal.
                    701:     </ul>
                    702:   <li>Documentation improvements
                    703:     <ul>
                    704:     <li>Improved documentation of BIO_ctrl(3), BIO_set_info_callback(3),
                    705:       BIO_get_info_callback(3), BIO_method_type(3), and BIO_method_name(3).
                    706:     <li>Marked BIO_CB_return(), BIO_cb_pre(), and BIO_cb_post() as intentionally
                    707:       undocumented.
                    708:     <li>Made it very explicit that the verify callback should not be used.
                    709:     <li>Called out that the CRL lastUpdate is standardized as thisUpdate.
                    710:     <li>Documented the RFC 3779 API and its shortcomings.
                    711:     </ul>
                    712:   <li>Testing and Proactive Security
                    713:     <ul>
                    714:     <li>Significantly improved test coverage of BN_mod_sqrt() and GCD.
                    715:     <li>As always, new test coverage is added as bugs are fixed and subsystems
                    716:       are cleaned up.
1.1       deraadt   717:     </ul>
                    718:   </ul>
                    719:
1.13      dtucker   720: <li>OpenSSH 9.5 and OpenSSH 9.4
1.1       deraadt   721:   <ul>
1.12      dtucker   722:   <li>Potentially incompatible changes
1.1       deraadt   723:     <ul>
1.12      dtucker   724:     <li><a href="https://man.openbsd.org/ssh-keygen.1">ssh-keygen(1)</a>:
                    725:         generate Ed25519 keys by default. Ed25519 public keys
                    726:         are very convenient due to their small size. Ed25519 keys are
                    727:         specified in RFC 8709 and OpenSSH has supported them since version 6.5
                    728:         (January 2014).
                    729:     <li><a href="https://man.openbsd.org/sshd.8">sshd(8)</a>:
                    730:         the Subsystem directive now accurately preserves quoting of
                    731:         subsystem commands and arguments. This may change behaviour for exotic
                    732:         configurations, but the most common subsystem configuration
                    733:         (sftp-server) is unlikely to be affected.
1.13      dtucker   734:     <li><a href="https://man.openbsd.org/ssh-agent.1">ssh-agent(1)</a>:
                    735:         PKCS#11 modules must now be specified by their full
                    736:         paths. Previously dlopen(3) could search for them in system
                    737:         library directories.
1.1       deraadt   738:     </ul>
1.12      dtucker   739:   <li>New features
1.1       deraadt   740:     <ul>
1.12      dtucker   741:     <li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>:
                    742:         add keystroke timing obfuscation to the client. This attempts
                    743:         to hide inter-keystroke timings by sending interactive traffic at
                    744:         fixed intervals (default: every 20ms) when there is only a small
                    745:         amount of data being sent. It also sends fake "chaff" keystrokes for
                    746:         a random interval after the last real keystroke. These are
                    747:         controlled by a new ssh_config ObscureKeystrokeTiming keyword.
                    748:     <li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>,
                    749:         <a href="https://man.openbsd.org/sshd.8">sshd(8)</a>:
                    750:         Introduce a transport-level ping facility. This adds
                    751:         a pair of SSH transport protocol messages SSH2_MSG_PING/PONG to
                    752:         implement a ping capability. These messages use numbers in the "local
                    753:         extensions" number space and are advertised using a "ping@openssh.com"
                    754:         ext-info message with a string version number of "0".
1.13      dtucker   755:     <li><a href="https://man.openbsd.org/sshd.8">sshd(8)</a>:
                    756:         allow override of Subsystem directives in sshd Match blocks.
                    757:     <li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>:
                    758:         allow forwarding Unix Domain sockets via ssh -W.
                    759:     <li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>:
                    760:         add support for configuration tags to ssh(1).
                    761:         This adds a ssh_config(5) "Tag" directive and corresponding
                    762:         "Match tag" predicate that may be used to select blocks of
                    763:         configuration similar to the pf.conf(5) keywords of the same
                    764:         name.
                    765:     <li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>:
                    766:          add a "match localnetwork" predicate. This allows matching
                    767:          on the addresses of available network interfaces and may be used to
                    768:          vary the effective client configuration based on network location.
                    769:     <li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>,
                    770:         <a href="https://man.openbsd.org/sshd.8">sshd(8)</a>,
                    771:         <a href="https://man.openbsd.org/ssh-keygen.1">ssh-keygen(1)</a>:
                    772:         infrastructure support for KRL
                    773:         extensions.  This defines wire formats for optional KRL extensions
                    774:         and implements parsing of the new submessages. No actual extensions
                    775:         are supported at this point.
                    776:     <li><a href="https://man.openbsd.org/sshd.8">sshd(8)</a>:
                    777:         AuthorizedPrincipalsCommand and AuthorizedKeysCommand now
                    778:         accept two additional %-expansion sequences: %D which expands to
                    779:         the routing domain of the connected session and %C which expands
                    780:         to the addresses and port numbers for the source and destination
                    781:         of the connection.
                    782:     <li><a href="https://man.openbsd.org/ssh-keygen.1">ssh-keygen(1)</a>:
                    783:         increase the default work factor (rounds) for the
                    784:         bcrypt KDF used to derive symmetric encryption keys for passphrase
                    785:         protected key files by 50%.
1.1       deraadt   786:     </ul>
                    787:   <li>Bugfixes
                    788:     <ul>
1.12      dtucker   789:     <li><a href="https://man.openbsd.org/scp.1">scp(1)</a>:
                    790:         fix scp in SFTP mode recursive upload and download of
                    791:         directories that contain symlinks to other directories. In scp mode,
                    792:         the links would be followed, but in SFTP mode they were not.
                    793:     <li><a href="https://man.openbsd.org/ssh-keygen.1">ssh-keygen(1)</a>:
                    794:         handle cr+lf (instead of just cr) line endings in
                    795:         sshsig signature files.
                    796:     <li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>:
                    797:         interactive mode for ControlPersist sessions if they
                    798:         originally requested a tty.
                    799:     <li><a href="https://man.openbsd.org/sshd.8">sshd(8)</a>:
                    800:         make PerSourceMaxStartups first-match-wins
                    801:     <li><a href="https://man.openbsd.org/sshd.8">sshd(8)</a>:
                    802:         limit artificial login delay to a reasonable maximum (5s)
                    803:         and don't delay at all for the "none" authentication mechanism.
1.13      dtucker   804:     <li><a href="https://man.openbsd.org/sshd.8">sshd(8)</a>:
                    805:         Log errors in kex_exchange_identification() with level
1.12      dtucker   806:         verbose instead of error to reduce preauth log spam. All of those
                    807:         get logged with a more generic error message by sshpkt_fatal().
                    808:     <li><a href="https://man.openbsd.org/sshd.8">sshd(8)</a>:
                    809:         correct math for ClientAliveInterval that caused the probes
                    810:         to be sent less frequently than configured.
1.13      dtucker   811:     <li><a href="https://man.openbsd.org/ssh-agent.1">ssh-agent(1)</a>:
                    812:         improve isolation between loaded PKCS#11 modules
                    813:         by running separate ssh-pkcs11-helpers for each loaded provider.
                    814:     <li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>:
                    815:         make -f (fork after authentication) work correctly with
                    816:         multiplexed connections, including ControlPersist.
                    817:     <li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>:
                    818:         make ConnectTimeout apply to multiplexing sockets and not
                    819:         just to network connections.
                    820:     <li><a href="https://man.openbsd.org/ssh-agent.1">ssh-agent(1)</a>,
                    821:         <a href="https://man.openbsd.org/ssh.1">ssh(1)</a>:
                    822:         improve defences against invalid PKCS#11
                    823:         modules being loaded by checking that the requested module
                    824:         contains the required symbol before loading it.
                    825:     <li><a href="https://man.openbsd.org/sshd.8">sshd(8)</a>:
                    826:         fix AuthorizedPrincipalsCommand when AuthorizedKeysCommand
                    827:         appears before it in sshd_config. Since OpenSSH 8.7 the
                    828:         AuthorizedPrincipalsCommand directive was incorrectly ignored in
                    829:         this situation.
                    830:     <li><a href="https://man.openbsd.org/sshd.8">sshd(8)</a>,
                    831:         <a href="https://man.openbsd.org/ssh.1">ssh(1)</a>,
                    832:         <a href="https://man.openbsd.org/ssh-keygen.1">ssh-keygen(1)</a>:
1.16      jsg       833:         remove vestigial support for KRL
1.13      dtucker   834:         signatures When the KRL format was originally defined, it included
                    835:         support for signing of KRL objects. However, the code to sign KRLs
1.16      jsg       836:         and verify KRL signatures was never completed in OpenSSH. This
1.13      dtucker   837:         release removes the partially-implemented code to verify KRLs.
                    838:         All OpenSSH tools now ignore KRL_SECTION_SIGNATURE sections in
                    839:         KRL files.
                    840:      <li>All: fix a number of memory leaks and unreachable/harmless integer
                    841:         overflows.
                    842:     <li><a href="https://man.openbsd.org/ssh-agent.1">ssh-agent(1)</a>,
                    843:         <a href="https://man.openbsd.org/ssh.1">ssh(1)</a>:
                    844:         don't truncate strings logged from PKCS#11 modules
                    845:     <li><a href="https://man.openbsd.org/sshd.8">sshd(8)</a>,
                    846:         <a href="https://man.openbsd.org/ssh.1">ssh(1)</a>:
                    847:         better validate CASignatureAlgorithms in
                    848:         ssh_config and sshd_config. Previously this directive would accept
                    849:         certificate algorithm names, but these were unusable in practice as
                    850:         OpenSSH does not support CA chains.
                    851:     <li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>:
                    852:         make <code>ssh -Q CASignatureAlgorithms</code> only list signature
                    853:         algorithms that are valid for CA signing. Previous behaviour was
                    854:         to list all signing algorithms, including certificate algorithms.
                    855:     <li><a href="https://man.openbsd.org/ssh-keyscan.1">ssh-keyscan(1)</a>:
                    856:         gracefully handle systems where rlimits or the
                    857:         maximum number of open files is larger than INT_MAX
                    858:     <li><a href="https://man.openbsd.org/ssh-keygen.1">ssh-keygen(1)</a>:
                    859:         fix "no comment" not showing on when running
                    860:         <code>ssh-keygen -l</code> on multiple keys where one has a comment
                    861:         and other following keys do not.
                    862:     <li><a href="https://man.openbsd.org/scp.1">scp(1)</a>,
1.14      dtucker   863:         <a href="https://man.openbsd.org/sftp.1">sftp(1)</a>:
1.13      dtucker   864:         adjust ftruncate() logic to handle servers that
                    865:         reorder requests. Previously, if the server reordered requests then
                    866:         the resultant file would be erroneously truncated.
                    867:     <li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>:
                    868:         don't incorrectly disable hostname canonicalization when
1.16      jsg       869:         CanonicalizeHostname=yes and ProxyJump was explicitly set to
1.13      dtucker   870:         "none".
                    871:     <li><a href="https://man.openbsd.org/scp.1">scp(1)</a>:
                    872:         when copying local to remote, check that the source file
                    873:         exists before opening an SFTP connection to the server.
1.1       deraadt   874:     </ul>
                    875:   </ul>
                    876:
                    877: <li>Ports and packages:
                    878:   <p>Many pre-built packages for each architecture:
                    879:   <!-- number of FTP packages minus SHA256, SHA256.sig, index.txt -->
                    880:   <ul style="column-count: 3">
1.25      naddy     881:     <li>aarch64:    11508
                    882:     <li>amd64:      11845
1.1       deraadt   883:     <li>arm:
1.25      naddy     884:     <li>i386:       10603
1.1       deraadt   885:     <li>mips64:
                    886:     <li>powerpc:
                    887:     <li>powerpc64:
                    888:     <li>riscv64:
                    889:     <li>sparc64:
                    890:   </ul>
                    891:
                    892:   <p>Some highlights:
1.7       tb        893:   <ul style="column-count: 3"><!-- XXX all need to be checked/updated 2023-03-04 -->
1.6       matthieu  894:     <li>Asterisk 16.30.1, 18.19.0 and 20.4.0
1.5       matthieu  895:     <li>Audacity 3.3.3
                    896:     <li>CMake 3.27.5
1.10      matthieu  897:     <li>Chromium 117.0.5838.149
1.5       matthieu  898:     <li>Emacs 29.1
                    899:     <li>FFmpeg 4.4.4
1.1       deraadt   900:     <li>GCC 8.4.0 and 11.2.0
1.5       matthieu  901:     <li>GHC 9.2.7
                    902:     <li>GNOME 44
                    903:     <li>Go 1.21.1
                    904:     <li>JDK 8u382, 11.0.20 and 17.0.8
                    905:     <li>KDE Applications 23.08.0
1.1       deraadt   906:     <li>KDE Frameworks 5.98.0
1.5       matthieu  907:     <li>Krita 5.1.5
                    908:     <li>LLVM/Clang 13.0.0 and 16.0.6
                    909:     <li>LibreOffice 7.6.2.1
                    910:     <li>Lua 5.1.5, 5.2.4, 5.3.6 and 5.4.6
                    911:     <li>MariaDB 10.9.6
                    912:     <li>Mono 6.12.0.199
                    913:     <li>Mozilla Firefox 118.0.1 and ESR 115.3.1
                    914:     <li>Mozilla Thunderbird 115.3.1
                    915:     <li>Mutt 2.2.12 and NeoMutt 20230517
                    916:     <li>Node.js 18.18.0
1.1       deraadt   917:     <li>OCaml 4.12.1
1.5       matthieu  918:     <li>OpenLDAP 2.6.6
                    919:     <li>PHP 7.4.33, 8.0.30, 8.1.24 and 8.2.11
                    920:     <li>Postfix 3.7.3
                    921:     <li>PostgreSQL 15.4
                    922:     <li>Python 2.7.18, 3.9.18, 3.10.13 and 3.11.5
                    923:     <li>Qt 5.15.10 and 6.5.2
                    924:     <li>R 4.2.3
                    925:     <li>Ruby 3.0.6, 3.1.4 and 3.2.2
                    926:     <li>Rust 1.72.1
1.9       lteo      927:     <li>SQLite 3.42.0
1.5       matthieu  928:     <li>Shotcut 23.07.29
                    929:     <li>Sudo 1.9.14.2
                    930:     <li>Suricata 6.0.12
                    931:     <li>Tcl/Tk 8.5.19 and 8.6.13
                    932:     <li>TeX Live 2022
                    933:     <li>Vim 9.0.1897 and Neovim 0.9.1
                    934:     <li>Xfce 4.18
1.1       deraadt   935:   </ul>
                    936:   <p>
                    937:
                    938: <li>As usual, steady improvements in manual pages and other documentation.
                    939:
                    940: <li>The system includes the following major components from outside suppliers:
1.7       tb        941:   <ul><!-- XXX all need to be checked/updated 2023-03-04 -->
1.5       matthieu  942:     <li>Xenocara (based on X.Org 7.7 with xserver 21.1.8 + patches,
                    943:         freetype 2.13.0, fontconfig 2.14.2, Mesa 22.3.7, xterm 378,
1.1       deraadt   944:         xkeyboard-config 2.20, fonttosfnt 1.2.2 and more)
                    945:     <li>LLVM/Clang 13.0.0 (+ patches)
                    946:     <li>GCC 4.2.1 (+ patches) and 3.3.6 (+ patches)
1.5       matthieu  947:     <li>Perl 5.36.1 (+ patches)
                    948:     <li>NSD 4.7.0
                    949:     <li>Unbound 1.18.0
1.1       deraadt   950:     <li>Ncurses 5.7
                    951:     <li>Binutils 2.17 (+ patches)
                    952:     <li>Gdb 6.3 (+ patches)
1.5       matthieu  953:     <li>Awk September 12, 2023
                    954:     <li>Expat 2.5.0
1.1       deraadt   955:   </ul>
                    956:
                    957: </ul>
                    958: </section>
                    959:
                    960: <hr>
                    961:
                    962: <section id=install>
                    963: <h3>How to install</h3>
                    964: <p>
                    965: Please refer to the following files on the mirror site for
                    966: extensive details on how to install OpenBSD 7.4 on your machine:
                    967:
                    968: <ul>
                    969: <li><a href="https://ftp.openbsd.org/pub/OpenBSD/7.4/alpha/INSTALL.alpha">
1.2       jsg       970:        .../OpenBSD/7.4/alpha/INSTALL.alpha</a>
1.1       deraadt   971: <li><a href="https://ftp.openbsd.org/pub/OpenBSD/7.4/amd64/INSTALL.amd64">
1.2       jsg       972:        .../OpenBSD/7.4/amd64/INSTALL.amd64</a>
1.1       deraadt   973: <li><a href="https://ftp.openbsd.org/pub/OpenBSD/7.4/arm64/INSTALL.arm64">
1.2       jsg       974:        .../OpenBSD/7.4/arm64/INSTALL.arm64</a>
1.1       deraadt   975: <li><a href="https://ftp.openbsd.org/pub/OpenBSD/7.4/armv7/INSTALL.armv7">
1.2       jsg       976:        .../OpenBSD/7.4/armv7/INSTALL.armv7</a>
1.1       deraadt   977: <li><a href="https://ftp.openbsd.org/pub/OpenBSD/7.4/hppa/INSTALL.hppa">
1.2       jsg       978:        .../OpenBSD/7.4/hppa/INSTALL.hppa</a>
1.1       deraadt   979: <li><a href="https://ftp.openbsd.org/pub/OpenBSD/7.4/i386/INSTALL.i386">
1.2       jsg       980:        .../OpenBSD/7.4/i386/INSTALL.i386</a>
1.1       deraadt   981: <li><a href="https://ftp.openbsd.org/pub/OpenBSD/7.4/landisk/INSTALL.landisk">
1.2       jsg       982:        .../OpenBSD/7.4/landisk/INSTALL.landisk</a>
1.1       deraadt   983: <li><a href="https://ftp.openbsd.org/pub/OpenBSD/7.4/loongson/INSTALL.loongson">
1.2       jsg       984:        .../OpenBSD/7.4/loongson/INSTALL.loongson</a>
1.1       deraadt   985: <li><a href="https://ftp.openbsd.org/pub/OpenBSD/7.4/luna88k/INSTALL.luna88k">
1.2       jsg       986:        .../OpenBSD/7.4/luna88k/INSTALL.luna88k</a>
1.1       deraadt   987: <li><a href="https://ftp.openbsd.org/pub/OpenBSD/7.4/macppc/INSTALL.macppc">
1.2       jsg       988:        .../OpenBSD/7.4/macppc/INSTALL.macppc</a>
1.1       deraadt   989: <li><a href="https://ftp.openbsd.org/pub/OpenBSD/7.4/octeon/INSTALL.octeon">
1.2       jsg       990:        .../OpenBSD/7.4/octeon/INSTALL.octeon</a>
1.1       deraadt   991: <li><a href="https://ftp.openbsd.org/pub/OpenBSD/7.4/powerpc64/INSTALL.powerpc64">
1.2       jsg       992:        .../OpenBSD/7.4/powerpc64/INSTALL.powerpc64</a>
1.1       deraadt   993: <li><a href="https://ftp.openbsd.org/pub/OpenBSD/7.4/riscv64/INSTALL.riscv64">
1.2       jsg       994:        .../OpenBSD/7.4/riscv64/INSTALL.riscv64</a>
1.1       deraadt   995: <li><a href="https://ftp.openbsd.org/pub/OpenBSD/7.4/sparc64/INSTALL.sparc64">
1.2       jsg       996:        .../OpenBSD/7.4/sparc64/INSTALL.sparc64</a>
1.1       deraadt   997: </ul>
                    998: </section>
                    999:
                   1000: <hr>
                   1001:
                   1002: <section id=quickinstall>
                   1003: <p>
                   1004: Quick installer information for people familiar with OpenBSD, and the use of
                   1005: the "<a href="https://man.openbsd.org/disklabel.8">disklabel</a> -E" command.
                   1006: If you are at all confused when installing OpenBSD, read the relevant
                   1007: INSTALL.* file as listed above!
                   1008:
                   1009: <h3>OpenBSD/alpha:</h3>
                   1010:
                   1011: <p>
                   1012: If your machine can boot from CD, you can write <i>install74.iso</i> or
                   1013: <i>cd74.iso</i> to a CD and boot from it.
                   1014: Refer to INSTALL.alpha for more details.
                   1015:
                   1016: <h3>OpenBSD/amd64:</h3>
                   1017:
                   1018: <p>
                   1019: If your machine can boot from CD, you can write <i>install74.iso</i> or
                   1020: <i>cd74.iso</i> to a CD and boot from it.
                   1021: You may need to adjust your BIOS options first.
                   1022:
                   1023: <p>
                   1024: If your machine can boot from USB, you can write <i>install74.img</i> or
                   1025: <i>miniroot74.img</i> to a USB stick and boot from it.
                   1026:
                   1027: <p>
                   1028: If you can't boot from a CD, floppy disk, or USB,
                   1029: you can install across the network using PXE as described in the included
                   1030: INSTALL.amd64 document.
                   1031:
                   1032: <p>
                   1033: If you are planning to dual boot OpenBSD with another OS, you will need to
                   1034: read INSTALL.amd64.
                   1035:
                   1036: <h3>OpenBSD/arm64:</h3>
                   1037:
                   1038: <p>
                   1039: Write <i>install74.img</i> or <i>miniroot74.img</i> to a disk and boot from it
                   1040: after connecting to the serial console.  Refer to INSTALL.arm64 for more
                   1041: details.
                   1042:
                   1043: <h3>OpenBSD/armv7:</h3>
                   1044:
                   1045: <p>
                   1046: Write a system specific miniroot to an SD card and boot from it after connecting
                   1047: to the serial console.  Refer to INSTALL.armv7 for more details.
                   1048:
                   1049: <h3>OpenBSD/hppa:</h3>
                   1050:
                   1051: <p>
                   1052: Boot over the network by following the instructions in INSTALL.hppa or the
                   1053: <a href="hppa.html#install">hppa platform page</a>.
                   1054:
                   1055: <h3>OpenBSD/i386:</h3>
                   1056:
                   1057: <p>
                   1058: If your machine can boot from CD, you can write <i>install74.iso</i> or
                   1059: <i>cd74.iso</i> to a CD and boot from it.
                   1060: You may need to adjust your BIOS options first.
                   1061:
                   1062: <p>
                   1063: If your machine can boot from USB, you can write <i>install74.img</i> or
                   1064: <i>miniroot74.img</i> to a USB stick and boot from it.
                   1065:
                   1066: <p>
                   1067: If you can't boot from a CD, floppy disk, or USB,
                   1068: you can install across the network using PXE as described in
                   1069: the included INSTALL.i386 document.
                   1070:
                   1071: <p>
                   1072: If you are planning on dual booting OpenBSD with another OS, you will need to
                   1073: read INSTALL.i386.
                   1074:
                   1075: <h3>OpenBSD/landisk:</h3>
                   1076:
                   1077: <p>
                   1078: Write <i>miniroot74.img</i> to the start of the CF
                   1079: or disk, and boot normally.
                   1080:
                   1081: <h3>OpenBSD/loongson:</h3>
                   1082:
                   1083: <p>
                   1084: Write <i>miniroot74.img</i> to a USB stick and boot bsd.rd from it
                   1085: or boot bsd.rd via tftp.
                   1086: Refer to the instructions in INSTALL.loongson for more details.
                   1087:
                   1088: <h3>OpenBSD/luna88k:</h3>
                   1089:
                   1090: <p>
                   1091: Copy 'boot' and 'bsd.rd' to a Mach or UniOS partition, and boot the bootloader
                   1092: from the PROM, and then bsd.rd from the bootloader.
                   1093: Refer to the instructions in INSTALL.luna88k for more details.
                   1094:
                   1095: <h3>OpenBSD/macppc:</h3>
                   1096:
                   1097: <p>
                   1098: Burn the image from a mirror site to a CDROM, and power on your machine
                   1099: while holding down the <i>C</i> key until the display turns on and
                   1100: shows <i>OpenBSD/macppc boot</i>.
                   1101:
                   1102: <p>
                   1103: Alternatively, at the Open Firmware prompt, enter <i>boot cd:,ofwboot
1.2       jsg      1104: /7.4/macppc/bsd.rd</i>
1.1       deraadt  1105:
                   1106: <h3>OpenBSD/octeon:</h3>
                   1107:
                   1108: <p>
                   1109: After connecting a serial port, boot bsd.rd over the network via DHCP/tftp.
                   1110: Refer to the instructions in INSTALL.octeon for more details.
                   1111:
                   1112: <h3>OpenBSD/powerpc64:</h3>
                   1113:
                   1114: <p>
                   1115: To install, write <i>install74.img</i> or <i>miniroot74.img</i> to a
                   1116: USB stick, plug it into the machine and choose the <i>OpenBSD
                   1117: install</i> menu item in Petitboot.
                   1118: Refer to the instructions in INSTALL.powerpc64 for more details.
                   1119:
                   1120: <h3>OpenBSD/riscv64:</h3>
                   1121:
                   1122: <p>
                   1123: To install, write <i>install74.img</i> or <i>miniroot74.img</i> to a
                   1124: USB stick, and boot with that drive plugged in.
                   1125: Make sure you also have the microSD card plugged in that shipped with the
                   1126: HiFive Unmatched board.
                   1127: Refer to the instructions in INSTALL.riscv64 for more details.
                   1128:
                   1129: <h3>OpenBSD/sparc64:</h3>
                   1130:
                   1131: <p>
                   1132: Burn the image from a mirror site to a CDROM, boot from it, and type
                   1133: <i>boot cdrom</i>.
                   1134:
                   1135: <p>
                   1136: If this doesn't work, or if you don't have a CDROM drive, you can write
                   1137: <i>floppy74.img</i> or <i>floppyB74.img</i>
                   1138: (depending on your machine) to a floppy and boot it with <i>boot
                   1139: floppy</i>. Refer to INSTALL.sparc64 for details.
                   1140:
                   1141: <p>
                   1142: Make sure you use a properly formatted floppy with NO BAD BLOCKS or your install
                   1143: will most likely fail.
                   1144:
                   1145: <p>
                   1146: You can also write <i>miniroot74.img</i> to the swap partition on
                   1147: the disk and boot with <i>boot disk:b</i>.
                   1148:
                   1149: <p>
                   1150: If nothing works, you can boot over the network as described in INSTALL.sparc64.
                   1151: </section>
                   1152:
                   1153: <hr>
                   1154:
                   1155: <section id=upgrade>
                   1156: <h3>How to upgrade</h3>
                   1157: <p>
1.3       jsg      1158: If you already have an OpenBSD 7.3 system, and do not want to reinstall,
1.1       deraadt  1159: upgrade instructions and advice can be found in the
                   1160: <a href="faq/upgrade74.html">Upgrade Guide</a>.
                   1161: </section>
                   1162:
                   1163: <hr>
                   1164:
                   1165: <section id=sourcecode>
                   1166: <h3>Notes about the source code</h3>
                   1167: <p>
                   1168: <code>src.tar.gz</code> contains a source archive starting at <code>/usr/src</code>.
                   1169: This file contains everything you need except for the kernel sources,
                   1170: which are in a separate archive.
                   1171: To extract:
                   1172: <blockquote><pre>
                   1173: # <kbd>mkdir -p /usr/src</kbd>
                   1174: # <kbd>cd /usr/src</kbd>
                   1175: # <kbd>tar xvfz /tmp/src.tar.gz</kbd>
                   1176: </pre></blockquote>
                   1177: <p>
                   1178: <code>sys.tar.gz</code> contains a source archive starting at <code>/usr/src/sys</code>.
                   1179: This file contains all the kernel sources you need to rebuild kernels.
                   1180: To extract:
                   1181: <blockquote><pre>
                   1182: # <kbd>mkdir -p /usr/src/sys</kbd>
                   1183: # <kbd>cd /usr/src</kbd>
                   1184: # <kbd>tar xvfz /tmp/sys.tar.gz</kbd>
                   1185: </pre></blockquote>
                   1186: <p>
                   1187: Both of these trees are a regular CVS checkout.  Using these trees it
                   1188: is possible to get a head-start on using the anoncvs servers as
                   1189: described <a href="anoncvs.html">here</a>.
                   1190: Using these files
                   1191: results in a much faster initial CVS update than you could expect from
                   1192: a fresh checkout of the full OpenBSD source tree.
                   1193: </section>
                   1194:
                   1195: <hr>
                   1196:
                   1197: <section id=ports>
                   1198: <h3>Ports Tree</h3>
                   1199: <p>
                   1200: A ports tree archive is also provided.  To extract:
                   1201: <blockquote><pre>
                   1202: # <kbd>cd /usr</kbd>
                   1203: # <kbd>tar xvfz /tmp/ports.tar.gz</kbd>
                   1204: </pre></blockquote>
                   1205: <p>
                   1206: Go read the <a href="faq/ports/index.html">ports</a> page
                   1207: if you know nothing about ports
                   1208: at this point.  This text is not a manual of how to use ports.
                   1209: Rather, it is a set of notes meant to kickstart the user on the
                   1210: OpenBSD ports system.
                   1211: <p>
                   1212: The <i>ports/</i> directory represents a CVS checkout of our ports.
                   1213: As with our complete source tree, our ports tree is available via
                   1214: <a href="anoncvs.html">AnonCVS</a>.
                   1215: So, in order to keep up to date with the -stable branch, you must make
                   1216: the <i>ports/</i> tree available on a read-write medium and update the tree
                   1217: with a command like:
                   1218: <blockquote><pre>
                   1219: # <kbd>cd /usr/ports</kbd>
1.2       jsg      1220: # <kbd>cvs -d anoncvs@server.openbsd.org:/cvs update -Pd -rOPENBSD_7_4</kbd>
1.1       deraadt  1221: </pre></blockquote>
                   1222: <p>
                   1223: [Of course, you must replace the server name here with a nearby anoncvs
                   1224: server.]
                   1225: <p>
                   1226: Note that most ports are available as packages on our mirrors. Updated
                   1227: ports for the 7.4 release will be made available if problems arise.
                   1228: <p>
                   1229: If you're interested in seeing a port added, would like to help out, or just
                   1230: would like to know more, the mailing list
                   1231: <a href="mail.html">ports@openbsd.org</a> is a good place to know.
                   1232: </section>
                   1233: </body>
                   1234: </html>