[openssh-commits] [openssh] branch master updated (2aee73ed9 -> e47a744c8)

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a change to branch master
in repository openssh.

    from 2aee73ed9 upstream: fix ML-KEM/ECDH interop problem (does not affect
     new 29f1b46e0 upstream: Add a "ssh -Z user at host" mode that dumps the pubkeys that
     new 6fe6ab77d upstream: Tweak ordering of certificates tried during pubkey
     new 129f5ac61 upstream: regression test for pubkey ordering in the client; ok
     new e47a744c8 upstream: crank up MaxAuthTries to avoid failures here

The 4 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails.  The revisions
listed as "add" were already present in the repository and have only
been added to this reference.


Detailed log of new commits:

commit e47a744c8b7051c56a9e46b487f68f1f803fe804
Author: djm at openbsd.org <djm at openbsd.org>
Date:   Mon Aug 3 06:53:11 2026 +0000

    upstream: crank up MaxAuthTries to avoid failures here
    
    OpenBSD-Regress-ID: 052b0c4cc8bd6ea2679fbc9f96f4cb7f48c73035

commit 129f5ac61f8b90639dedb264947153d1c4b9acf5
Author: djm at openbsd.org <djm at openbsd.org>
Date:   Mon Aug 3 06:52:50 2026 +0000

    upstream: regression test for pubkey ordering in the client; ok
    
    dtucker
    
    OpenBSD-Regress-ID: e55fa977be300307e6e03a001716b3dce8faa1a1

commit 6fe6ab77daa4472d0243580e355e0674a95b8acb
Author: djm at openbsd.org <djm at openbsd.org>
Date:   Mon Aug 3 06:50:49 2026 +0000

    upstream: Tweak ordering of certificates tried during pubkey
    
    authentication to prefer FIDO keys that do not require user presence (touch)
    first, followed by ones that do and with FIDO keys that require user
    verification via PIN or biometrics last.
    
    This effectively tries low-friction authenticators before higher
    friction authenticators.
    
    ok dtucker@
    
    OpenBSD-Commit-ID: 067076c652dbb4f2aa89c6e82b19d8cbfec1d1be

commit 29f1b46e0f6fb4aba9ae34e4b46532b5748f395e
Author: djm at openbsd.org <djm at openbsd.org>
Date:   Mon Aug 3 06:47:24 2026 +0000

    upstream: Add a "ssh -Z user at host" mode that dumps the pubkeys that
    
    will be tried for authentication in the order that they will be used.
    
    feedback tb@ ok dtucker@
    
    OpenBSD-Commit-ID: 617a7f149d1410980eac551e4780280190a5f218

Summary of changes:
 regress/Makefile           |   3 +-
 regress/agent.sh           |   3 +-
 regress/pubkey-priority.sh | 120 +++++++++++++++++++++++++++++++++++
 ssh.1                      |  10 ++-
 ssh.c                      |  73 ++++++++++++----------
 sshconnect.h               |   4 +-
 sshconnect2.c              | 151 ++++++++++++++++++++++++++++++++++++++++-----
 7 files changed, 312 insertions(+), 52 deletions(-)
 create mode 100644 regress/pubkey-priority.sh

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.