# changelog

author: Paul Howarth <paul@city-fan.org> - 1.10.0-1
changelog:
  - Update to 1.10.0
    - Adds agent forwarding support
    - Adds OpenSSH Agent support on Windows
    - Adds ECDSA key support using the Mbed TLS backend
    - Adds ECDSA cert authentication
    - Adds diffie-hellman-group14-sha256, diffie-hellman-group16-sha512,
      diffie-hellman-group18-sha512 key exchanges
    - Adds support for PKIX key reading when using ed25519 with OpenSSL
    - Adds support for EWOULDBLOCK on VMS systems
    - Adds support for building with OpenSSL 3
    - Adds support for using FIPS mode in OpenSSL
    - Adds debug symbols when building with MSVC
    - Adds support for building on the 3DS
    - Adds unicode build support on Windows
    - Restores os400 building
    - Increases min, max and opt Diffie Hellman group values
    - Improves portability of the make file
    - Improves timeout behaviour with 2FA keyboard auth
    - Various improvements to the Wincng backend
    - Fixes reading partial packet replies when using an agent
    - Fixes Diffie Hellman key exchange on Windows 1903+ builds
    - Fixes building tests with older versions of OpenSSL
    - Fixes possible multiple definition warnings
    - Fixes potential cast issues _libssh2_ecdsa_key_get_curve_type()
    - Fixes potential use after free if libssh2_init() is called twice
    - Improved linking when using Mbed TLS
    - Fixes call to libssh2_crypto_exit() if crypto hasn't been initialized
    - Fixes crash when loading public keys with no id
    - Fixes possible out of bounds read when exchanging keys
    - Fixes possible out of bounds read when reading packets
    - Fixes possible out of bounds read when opening an X11 connection
    - Fixes possible out of bounds read when ecdh host keys
    - Fixes possible hang when trying to read a disconnected socket
    - Fixes a crash when using the delayed compression option
    - Fixes read error with large known host entries
    - Fixes various warnings
    - Fixes various small memory leaks
    - Improved error handling, various detailed errors will now be reported
    - Builds are now using OSS-Fuzz
    - Builds now use autoreconf instead of a custom build script
    - cmake now respects install directory
    - Improved CI backend
    - Updated HACKING-CRYPTO documentation
    - Use markdown file extensions
    - Improved unit tests


author: Paul Howarth <paul@city-fan.org> - 1.10.0-4
changelog:
  - In 8.8 OpenSSH disabled sha1 rsa-sha keys out of the box,
    so we need to re-enable them as a workaround for the test
    suite until upstream updates the tests
    See: https://github.com/libssh2/libssh2/issues/630
  - Drop other test workarounds, none of them being needed any longer


author: Paul Howarth <paul@city-fan.org> - 1.11.0-1
changelog:
  - Update to 1.11.0 (rhbz#2211200)
    - Adds support for encrypt-then-mac (ETM) MACs
    - Adds support for AES-GCM crypto protocols
    - Adds support for sk-ecdsa-sha2-nistp256 and sk-ssh-ed25519 keys
    - Adds support for RSA certificate authentication
    - Adds FIDO support with *_sk() functions
    - Adds RSA-SHA2 key upgrading to OpenSSL, WinCNG, mbedTLS, OS400 backends
    - Adds Agent Forwarding and libssh2_agent_sign()
    - Adds support for Channel Signal message libssh2_channel_signal_ex()
    - Adds support to get the user auth banner message libssh2_userauth_banner()
    - Adds LIBSSH2_NO_{MD5, HMAC_RIPEMD, DSA, RSA, RSA_SHA1, ECDSA, ED25519,
      AES_CBC, AES_CTR, BLOWFISH, RC4, CAST, 3DES} options
    - Adds direct stream UNIX sockets with libssh2_channel_direct_streamlocal_ex()
    - Adds wolfSSL support to CMake file
    - Adds mbedTLS 3.x support
    - Adds LibreSSL 3.5 support
    - Adds support for CMake "unity" builds
    - Adds CMake support for building shared and static libs in a single pass
    - Adds symbol hiding support to CMake
    - Adds support for libssh2.rc for all build tools
    - Adds .zip, .tar.xz and .tar.bz2 release tarballs
    - Enables ed25519 key support for LibreSSL 3.7.0 or higher
    - Improves OpenSSL 1.1 and 3 compatibility
    - Now requires OpenSSL 1.0.2 or newer
    - Now requires CMake 3.1 or newer
    - SFTP: Adds libssh2_sftp_open_ex_r() and libssh2_sftp_open_r() extended APIs
    - SFTP: No longer has a packet limit when reading a directory
    - SFTP: Now parses attribute extensions if they exist
    - SFTP: No longer will busy loop if SFTP fails to initialize
    - SFTP: Now clear various errors as expected
    - SFTP: No longer skips files if the line buffer is too small
    - SCP: Add option to not quote paths
    - SCP: Enables 64-bit offset support unconditionally
    - Now skips leading \r and \n characters in banner_receive()
    - Enables secure memory zeroing with all build tools on all platforms
    - No longer logs SSH_MSG_REQUEST_FAILURE packets from keepalive
    - Speed up base64 encoding by 7x
    - Assert if there is an attempt to write a value that is too large
    - WinCNG: fix memory leak in _libssh2_dh_secret()
    - Added protection against possible null pointer dereferences
    - Agent now handles overly large comment lengths
    - Now ensure KEX replies don't include extra bytes
    - Fixed possible buffer overflow when receiving SSH_MSG_USERAUTH_BANNER
    - Fixed possible buffer overflow in keyboard interactive code path
    - Fixed overlapping memcpy()
    - Fixed Windows UWP builds
    - Fixed DLL import name
    - Renamed local RANDOM_PADDING macro to avoid unexpected define on Windows
    - Support for building with gcc versions older than 8
    - Improvements to CMake, Makefile, NMakefile, GNUmakefile, autoreconf files
    - Restores ANSI C89 compliance
    - Enabled new compiler warnings and fixed/silenced them
    - Improved error messages
    - Now uses CIFuzz
    - Numerous minor code improvements
    - Improvements to CI builds
    - Improvements to unit tests
    - Improvements to doc files
    - Improvements to example files
    - Removed "old gex" build option
    - Removed no-encryption/no-mac builds
    - Removed support for NetWare and Watcom wmake build files
  - Avoid use of deprecated patch syntax
  - Build static library but don't package it since it's required for the
    test suite (https://github.com/libssh2/libssh2/issues/1056)
  - Remove redundant references to %{_libdir} from pkgconfig file
  - Add patch to work around strict permissions issues for sshd tests


