libssh2_org-1.11.1-160000.3.2

- Update to 1.11.1:
  * build: enable '-pedantic-errors'
  * build: add 'LIBSSH2_NO_DEPRECATED' option
  * build: stop requiring libssl from openssl
  * disable DSA by default
  * hostkey: do not advertise ssh-rsa when SHA1 is disabled
  * kex: prevent possible double free of hostkey
  * kex: always check for null pointers before calling _libssh2_bn_set_word
  * kex: fix a memory leak in key exchange
  * kex: always add extension indicators to kex_algorithms
  * md5: allow disabling old-style encrypted private keys at build-time
  * openssl: free allocated resources when using openssl3
  * openssl: fix memory leaks in '_libssh2_ecdsa_curve_name_with_octal_new'
    and '_libssh2_ecdsa_verify'
  * openssl: fix calculating DSA public key with OpenSSL 3
  * openssl: initialize BIGNUMs to NULL in 'gen_publickey_from_dsa' for OpenSSL 3
  * openssl: fix cppcheck found NULL dereferences
  * openssl: delete internal 'read_openssh_private_key_from_memory()'
  * openssl: use OpenSSL 3 HMAC API, add 'no-deprecated' CI job
  * openssl: make a function static, add '#ifdef' comments
  * openssl: fix DSA code to use OpenSSL 3 API
  * openssl: fix 'EC_KEY' reference with OpenSSL 3 'no-deprecated' build
  * openssl: use non-deprecated APIs with OpenSSL 3.x
  * openssl: silence '-Wunused-value' warnings
  * openssl: add missing check for 'LIBRESSL_VERSION_NUMBER' before use
  * packet: properly bounds check packet_authagent_open()
  * pem: fix private keys encrypted with AES-GCM methods
  * reuse: provide SPDX identifiers
  * scp: fix missing cast for targets without large file support
  * session: support server banners up to 8192 bytes
  * session: add 'libssh2_session_callback_set2()'
  * session: handle EINTR from send/recv/poll/select to try again as the error is not fatal
  * sftp: increase SFTP_HANDLE_MAXLEN back to 4092
  * sftp: implement posix-rename@openssh.com
  * src: implement chacha20-poly1305@openssh.com
  * src: check the return value from '_libssh2_bn_*()' functions
  * src: support RSA-SHA2 cert-based authentication (rsa-sha2-512_cert and rsa-sha2-256_cert)
  * src: check hash update/final success
  * src: check hash init success
  * src: add 'strict KEX' to fix CVE-2023-48795 "Terrapin Attack"
  * transport: fix unstable connections over non-blocking sockets
  * transport: check ETM on remote end when receiving
  * transport: fix incorrect byte offset in debug message
  * userauth: avoid oob with huge interactive kbd response
  * userauth: add a new structure to separate memory read and file read
  * userauth: check whether '*key_method' is a NULL pointer instead of 'key_method'
  * Rebase libssh2-ocloexec.patch
  * Remove patches fixed upstream:
  - libssh2_org-CVE-2023-48795.patch
  - libssh2_org-CVE-2023-48795-ext.patch
  - libssh2_org-ETM-remote.patch

- Fix an issue with Encrypt-then-MAC family. [bsc#1221622]
  * Test the ETM feature in the remote end's configuration when
    receiving data. Upstream issue: #1331.
  * Add libssh2_org-ETM-remote.patch

- Always add the KEX pseudo-methods "ext-info-c" and "kex-strict-c-v00@openssh.com"
  when configuring custom method list. [bsc#1218971, CVE-2023-48795]
  * The strict-kex extension is announced in the list of available
    KEX methods. However, when the default KEX method list is modified
    or replaced, the extension is not added back automatically.
  * Add libssh2_org-CVE-2023-48795-ext.patch

- Security fix: [bsc#1218127, CVE-2023-48795]
  * Add 'strict KEX' to fix CVE-2023-48795 "Terrapin Attack"
  * Add libssh2_org-CVE-2023-48795.patch

- Update to 1.11.0:
  * Enhancements and bugfixes
  - Adds support for encrypt-then-mac (ETM) MACs
  - Adds support for AES-GCM crypto protocols
  - Adds support for sk-ecdsa-sha2-nistp256 and sk-ssh-ed25519 keys
  - Adds support for RSA certificate authentication
  - Adds FIDO support with *_sk() functions
  - Adds RSA-SHA2 key upgrading to OpenSSL, WinCNG, mbedTLS, OS400 backends
  - Adds Agent Forwarding and libssh2_agent_sign()
  - Adds support for Channel Signal message libssh2_channel_signal_ex()
  - Adds support to get the user auth banner message libssh2_userauth_banner()
  - Adds LIBSSH2_NO_{MD5, HMAC_RIPEMD, DSA, RSA, RSA_SHA1, ECDSA, ED25519,
    AES_CBC, AES_CTR, BLOWFISH, RC4, CAST, 3DES} options
  - Adds direct stream UNIX sockets with libssh2_channel_direct_streamlocal_ex()
  - Adds wolfSSL support to CMake file
  - Adds mbedTLS 3.x support
  - Adds LibreSSL 3.5 support
  - Adds support for CMake "unity" builds
  - Adds CMake support for building shared and static libs in a single pass
  - Adds symbol hiding support to CMake
  - Adds support for libssh2.rc for all build tools
  - Adds .zip, .tar.xz and .tar.bz2 release tarballs
  - Enables ed25519 key support for LibreSSL 3.7.0 or higher
  - Improves OpenSSL 1.1 and 3 compatibility
  - Now requires OpenSSL 1.0.2 or newer
  - Now requires CMake 3.1 or newer
  - SFTP: Adds libssh2_sftp_open_ex_r() and libssh2_sftp_open_r() extended APIs
  - SFTP: No longer has a packet limit when reading a directory
  - SFTP: now parses attribute extensions if they exist
  - SFTP: no longer will busy loop if SFTP fails to initialize
  - SFTP: now clear various errors as expected
  - SFTP: no longer skips files if the line buffer is too small
  - SCP: add option to not quote paths
  - SCP: Enables 64-bit offset support unconditionally
  - Now skips leading \r and \n characters in banner_receive()
  - Enables secure memory zeroing with all build tools on all platforms
  - No longer logs SSH_MSG_REQUEST_FAILURE packets from keepalive
  - Speed up base64 encoding by 7x
  - Assert if there is an attempt to write a value that is too large
  - WinCNG: fix memory leak in _libssh2_dh_secret()
  - Added protection against possible null pointer dereferences
  - Agent now handles overly large comment lengths
  - Now ensure KEX replies don't include extra bytes
  - Fixed possible buffer overflow when receiving SSH_MSG_USERAUTH_BANNER
  - Fixed possible buffer overflow in keyboard interactive code path
  - Fixed overlapping memcpy()
  - Fixed Windows UWP builds
  - Fixed DLL import name
  - Renamed local RANDOM_PADDING macro to avoid unexpected define on Windows
  - Support for building with gcc versions older than 8
  - Improvements to CMake, Makefile, NMakefile, GNUmakefile, autoreconf files
  - Restores ANSI C89 compliance
  - Enabled new compiler warnings and fixed/silenced them
  - Improved error messages
  - Now uses CIFuzz
  - Numerous minor code improvements
  - Improvements to CI builds
  - Improvements to unit tests
  - Improvements to doc files
  - Improvements to example files
  - Removed "old gex" build option
  - Removed no-encryption/no-mac builds
  - Removed support for NetWare and Watcom wmake build files
  * Rebase libssh2-ocloexec.patch

- Bump to version 1.10.0
    Enhancements and bugfixes:
  * support ECDSA certificate authentication
  * fix detailed _libssh2_error being overwritten by generic errors
  * unified error handling
  * fix _libssh2_random() silently discarding errors
  * don't error if using keys without RSA
  * avoid OpenSSL latent error in FIPS mode
  * fix EVP_Cipher interface change in openssl 3
  * fix potential overwrite of buffer when reading stdout of command
  * use string_buf in ecdh_sha2_nistp() to avoid attempting to parse malformed data
  * correct a typo which may lead to stack overflow
  * fix random big number generation to match openssl
  * added key exchange group16-sha512 and group18-sha512.
  * add support for an OSS Fuzzer fuzzing target
  * adds support for ECDSA for both key exchange and host key algorithms
  * clean up curve25519 code
  * update the min, preferred and max DH group values based on RFC 8270.
  * changed type of LIBSSH2_FX_* constants to unsigned long
  * added diffie-hellman-group14-sha256 kex
  * fix for use of uninitialized aes_ctr_cipher.key_len when using HAVE_OPAQUE_STRUCTS, regression
  * fixes memory leaks and use after free AES EVP_CIPHER contexts when using OpenSSL 1.0.x.
  * fixes crash with delayed compression option using Bitvise server.
  * adds support for PKIX key reading
  * use new API to parse data in packet_x11_open() for better bounds checking.
  * double the static buffer size when reading and writing known hosts
  * improved bounds checking in packet_queue_listener
  * improve message parsing (CVE-2019-17498)
  * improve bounds checking in kex_agree_methods()
  * adding SSH agent forwarding.
  * fix agent forwarding message, updated example.
  * added integration test code and cmake target. Added example to cmake list.
  * don't call `libssh2_crypto_exit()` until `_libssh2_initialized` count is down to zero.
  * add an EWOULDBLOCK check for better portability
  * fix off by one error when loading public keys with no id
  * fix use-after-free crash on reinitialization of openssl backend
  * preserve error info from agent_list_identities()
  * make sure the error code is set in _libssh2_channel_open()
  * fixed misspellings
  * fix potential typecast error for `_libssh2_ecdsa_key_get_curve_type`
  * rename _libssh2_ecdsa_key_get_curve_type to _libssh2_ecdsa_get_curve_type
- Rebased patch libssh2-ocloexec.path
- Removed patch libssh2_org-CVE-2019-17498.patch: the security fix
    is already included in the latest version.

- Drop man and groff BuildRequires: both are no longer used in
  current versions.

- Security fix: [bsc#1154862, CVE-2019-17498]
  * The SSH_MSG_DISCONNECT:packet.c logic has an integer overflow in
    a bounds check that might lead to disclose sensitive information
    or cause a denial of service
  * Add patch libssh2_org-CVE-2019-17498.patch

- Version update to 1.9.0:
  Enhancements and bugfixes:
  * adds ECDSA keys and host key support when using OpenSSL
  * adds ED25519 key and host key support when using OpenSSL 1.1.1
  * adds OpenSSH style key file reading
  * adds AES CTR mode support when using WinCNG
  * adds PEM passphrase protected file support for Libgcrypt and WinCNG
  * adds SHA256 hostkey fingerprint
  * adds libssh2_agent_get_identity_path() and libssh2_agent_set_identity_path()
  * adds explicit zeroing of sensitive data in memory
  * adds additional bounds checks to network buffer reads
  * adds the ability to use the server default permissions when creating sftp directories
  * adds support for building with OpenSSL no engine flag
  * adds support for building with LibreSSL
  * increased sftp packet size to 256k
  * fixed oversized packet handling in sftp
  * fixed building with OpenSSL 1.1
  * fixed a possible crash if sftp stat gets an unexpected response
  * fixed incorrect parsing of the KEX preference string value
  * fixed conditional RSA and AES-CTR support
  * fixed a small memory leak during the key exchange process
  * fixed a possible memory leak of the ssh banner string
  * fixed various small memory leaks in the backends
  * fixed possible out of bounds read when parsing public keys from the server
  * fixed possible out of bounds read when parsing invalid PEM files
  * no longer null terminates the scp remote exec command
  * now handle errors when diffie hellman key pair generation fails
  * improved building instructions
  * improved unit tests
- Rebased patch libssh2-ocloexec.patch

- Version update to 1.8.2: [bsc#1130103]
  Bug fixes:
  * Fixed the misapplied userauth patch that broke 1.8.1
  * moved the MAX size declarations from the public header