deadsimple BSD Security Advisories and Announcements

OpenBSD 7.0 released, Oct 14

- OpenBSD 7.0 RELEASED -------------------------------------------------

October 14, 2021.

We are pleased to announce the official release of OpenBSD 7.0.
This is our 51st release.  We remain proud of OpenBSD's record of more
than twenty years with only two remote holes in the default install.

As in our previous releases, 7.0 provides significant improvements,
including new features, in nearly all areas of the system:

 - New/extended platforms:
    o Added new riscv64 platform for 64-bit RISC-V systems.
    o The arm64 platform support was improved with the following
       - Support for Apple Silicon Macs has improved but is not ready
         for general use yet:
      # Added support for installing on a disk with a GPT.
      # Added apldart(4) support for a DART with two sets of
        registers, needed to support the Synopsis DesignWare USB
        3 controller.
      # Added apldwusb(4), a glue driver for the Synopsys
        DesignWare USB 3 controllers found on the Apple M1 SoC.
      # Added aplns(4) to provide support for Apple NVME storage
        as found in Apple M1 devices.
      # Added aplpinctrl(4) driver for the Apple GPIO controller
        found on the M1 SoCs.
      # Added aplpmu(4), a driver for the Apple "sera" SPMI
        power management unit that contains the RTC on Apple M1
      # Added aplspmi(4), a driver for the Apple SPMI
       - Enabled LEDs for the mue(4) LAN7800 chip as found on the
         Raspberry Pi 3 Model B+.
       - Added rktcphy(4), a driver for the Type-C PHY controller
         found on the Rockchip RK3399.
       - Implemented multicast support in mvpp(4).
    o Changes on other architectures:
       - Switched macppc to use ld.lld(1).
       - Fixed an issue preventing applications from selecting the
         non-ALTIVEC code path on macppc.
       - Made amd64 hw.setperf percentages proportional to the
         enhanced speed step frequencies on Intel processors. The
         default hw.setperf™ corresponds to the maximum ordinary
         speed, and setting it to 100 enables turbo mode.
       - Enabled cy(4) on amd64.
       - Disabled base-gcc on amd64.
       - Prevented crashes on amd64 when TLB entries which should have
         been invalidated were used.
       - Prevented a kernel panic in sparc64 due to page boundary
       - Forced luna88k to use the serial console when no graphics
         board is found.
       - Made additional free inodes on luna88k bsd.rd by specifying
       - Fixed strchr() and strrchr() on mips64.
       - Prevented watchdog resets on some i.MX 64-bit machines with a
         recent U-Boot and watchdog enabled on boot in imxdog(8).
       - Created audio devices on armv7.
       - Retired OpenBSD/sgi platform.
       - Enabled MSI-X support for powerpc64.
       - Fixed __ppc_lock for page faults that recursively grab the
         lock on powerpc.
       - Increased the maximum data size on powerpc64 to 32GB.
       - Disabled global page table mappings when using PCID to
         prevent crashes when not flushed from TLB on amd64.
       - Added cduart(4) driver for Cadence Universal Asynchronous
         Receiver/Transmitter on armv7.
       - Added zqclock(4) driver for Xilinx Zynq-7000 clock controller
         on armv7.
       - Added zqreset(4) driver for Xilinx Zynq-7000 reset controller
         on armv7.

 - Various kernel improvements:
    o Unlocked the top part of the VM fault handler on i386.
    o Enabled dt(4) for GENERIC kernels on amd64, arm64, i386, sparc64,
      and powerpc64.
    o Added kprobes provider for dt(4).
    o Implemented < and > operators in btrace(8) filters.
    o Added btrace(8) display of time spent in userland when analyzing
      the kernel stack in the flame graph tool and fixed a parsing bug.
    o Introduced /etc/, which can be used to configure
      the kernel using config(8), allowing use of KARL while making
      changes to the GENERIC kernel.
    o Identify TPM 2.0 devices and perform the 2.0-specific suspend
      command, allowing the ThinkPad X1 Carbon Gen 9 and ThinkPad X1
      Nano with the latest BIOS (which added S3) to resume.
    o Changed the printing of the hibernate image size from bytes to
    o Increased hibernate writeout speed.
    o Added "machine sysregs" command to ddb(4) on amd64.
    o Prevented interleaved stack traces in ddb(4) from multiple CPUs.
    o Delayed installation of sensors until a device with battery
      support is connected, allowing sensorsd(8) to pick up hotplugged
      uhidpp(4) devices.
    o Prevented a kernel panic after VFS shutdown.
    o Increased the setitimer(2) timer limit to UINT_MAX seconds.
    o Serialized the internals of kqueue(2) with a mutex.
    o Enabled pool cache on knote(9) pool.
    o Fixed futex(2) errno handling to match what Mesa expects and
      prevent failure to properly report timeouts.
    o Fixed a kernel crash in tty(4).
    o Increased the default buffer space on PF_UNIX sockets to 8k and
      made the values tuneable via sysctl(2).
    o Made kqueue(2) timer re-addition reset an existing timer to use
      the new timeout period.
    o In the build system, pass make flags to kernel and lib builds,
      making hacking on ramdisks/the installer much faster.

 - SMP Improvements
    o Made pmap_extract() mpsafe on hppa and amd64.
    o Introduced CPU_IS_RUNNING() and used it in scheduler-related code
      to prevent waiting on non-running CPUs.
    o Made anonymous object reference counting independent from the
    o Unlocked connect(2).
    o Unlocked setrtable(2).
    o Introduced per-CPU panic(9) message buffers.
    o Used so_lock to protect key management (PF_KEY) sockets.
    o Used so_lock to protect routing (PF_ROUTE) sockets.
    o Unlocked lseek(2).
    o Unlocked the top part of the fault handler.

 - Direct Rendering Manager
    o Updated drm(4) to Linux 5.10.65
    o inteldrm(4): better support for Tiger Lake
    o amdgpu(4): support for Navi 12, Navi 21 "Sienna Cichlid", Arcturus
    o amdgpu(4): support for Cezanne "Green Sardine" Ryzen 5000 APU

 - VMM/VMD improvements
    o Added a theoretical limit of 512 to the number of allocated vcpus
      in vmm(4).
    o Fixed vmm(4) vcpu locking issues.
    o Added vmd(8) support for variable length vionet rx descriptor
    o Prevented stack overflow in vmd(8) due to large DHCP packets on
      local interfaces.
    o Allowed locking of a randomly assigned lladdr in vmd(8).
    o Skipped inspecting non-udp packets on local interfaces for vmd(8).
    o Prevented guest virtio drivers from causing stack and buffer
      overflows in vmd(8).
    o Fixed a race condition in vmm(4) relating to incorrect physical
      cpu tracking.
    o Fixed vmctl(8) client "wait" state corruption in vmd(8) when a
      wait is canceled and restarted, allowing multiple waiting clients.
    o Added protections against guests with bad virtio drivers to vmd(8)
    o Unlocked the kernel in vmm(4) ioctl handlers and introduced vcpu

 - Various new userland features:
    o Imported timeout(1) utility from NetBSD. timeout(1) can be used to
      run commands with a time limit.
    o Added include and exclude options to openrsync(1).
    o Implemented reporting of supplemental groups in ps(1).
    o Added indication of whether an mg(1) function is unsuitable for a
      startup file.
    o Added "dired-jump" command to mg(1) to open a dired buffer
      containing the current buffer's directory location.

 - Various bugfixes and tweaks in userland:
    o Modified doas(1) to retry up to 3 times on password authentication
    o Made all vi(1) signal handler functions async-signal-safe.
    o Changed diff(1) to consider two files sharing the same inode
    o Allowed xenodm(1) login when ~/.Xauthority does not exist.
    o Disabled building all of the non-unicode fonts in Xenocara except
      for ISO8859-1.
    o Altered passwd(1) to use stderr for printer error and
      informational messages. This allows easier parsing of what
      passwd(1) is doing if spawned from a GUI.
    o Fixed iostat(8) per-device values when systat(1) is in boot time
      mode ('b'), not normalizing based on the sleep interval.
    o Made jot(1) -b, -c and -w mutually exclusive.
    o Made cdio(1) discard the current input line when Ctrl-C is used
      during line editing and provide a fresh prompt rather than exiting
      the program.
    o Let el_gets(3) honour the first Ctrl-C typed by the user rather
      than ignoring it.
    o Corrected awk(1) -F null string behavior to ensure -F '' behaves
      consistently with -v FS="".
    o Avoided a potential buffer overflow in backslash escaping in
    o Disallowed the use of an empty list between "while" and "do" in
    o Changed cwm(1) maximization and full-screen mode toggling to keep
      the cursor within the window, preventing focus loss.
    o Made rc(8) quietly attempt an early mount of /var/log in case
      someone has created it as a separate filesystem to avoid /var
      overflow issues.
    o Improved fdisk(8) to retain essential partitions on various
    o Improved fdisk(8) for disks with 4K sectors.
    o Cleaned up the fdisk(8) MBR/GPT initialization code, making -g
      independent of -i, leaving four mutually exclusive initialization
      options (-i, -g, -u and -A) with the last option specified
      executed (allowing the existing -i -g to work as intended).
    o Relaxed criteria for recognizing GPT formatted media, allowing GPT
      disk images added with dd(1) onto larger physical media to be
      recognized by fdisk(8) and the kernel.
    o Added the ability for fdisk(8) to recognize "BIOS Boot", "APFS",
      "APFS ISC", "APFS Recovry" (sic), "HiFive FSBL" and "HiFive BBL"
      GPT partitions.
    o Ensured the values for fdisk(8) -b and -l are treated as 512-byte
      block counts.
    o Added an fdisk(8) -A option to initialize a GPT without removing
      special boot partitions.
    o Made fdisk(8) -b option available to architectures other than
      amd64 and i386 and extended the syntax to allow specification of
      the boot partition type and offset.
    o Adjusted density for partitions on a 4k disk in newfs(8) when
      fragsize and density are not passed on the command line to ensure
      sufficient inodes to hold a src tree on a 2G fs.
    o Fixed disklabel(8) generation on sparc64.
    o Fixed overlap check in disklabel(1) autoalloc code.
    o Corrected various min/max cluster numbers for FAT12/16/32 in
    o Added libexecinfo, a library providing backtrace functions.
    o Updated C library support for character classification to Unicode
    o Let wcwidth(3) treat all characters in Unicode private use areas
      as single-width, even those in planes 15 and 16.
    o Limited the printf(1) \x escape sequence to two characters.
    o Corrected the output of date(1) -f %s which was wrongly affected
      by the local timezone.
    o Turn printing additional information into toggles for systat(1).

 - Improved hardware support and driver bugfixes, including:
    o Added a workaround to amdgpu(4) for machines where the framebuffer
      size reported by the hardware is incorrect.
    o In pchgpio(4), worked around a BIOS bug on Lenovo ThinkPads based
      on Intel's Tiger Lake platform to properly restore the GPIO pin
      used for the touchpad interrupt upon resume.
    o Stopped setting the highspeed bit on bcm2835-sdhci sdhc(4)
      controllers, fixing bwfm(4) wifi on the Raspberry Pi 3 Model B+.
    o Added support for obtaining sense status and source slot of a
      media to chio(1) and ch(4).
    o Fixed dwiic(4) timeouts requesting data from at least one
    o Added ucc(4), a driver for USB HID Consumer Control keyboards.
      Often used to expose volume, audio and application launch keys.
      Volume keys are handled by the kernel and all other keys are
      propagated to X11 and the console through wscons(4).
    o Set the uhidpp(4) battery level sensor status to unknown while
      charging to handle devices reporting zero during charge,
      preventing certain sensorsd.conf(5) actions from triggering
    o Added Tiger Lake LP (INT34C5) support to pchgpio(4).
    o Fixed a panic at shutdown relating to azalia(4) on the X1 Extreme
      Gen 1.
    o Fixed a panic reported in upd(4).
    o Fixed display of incorrect patterns on LUNA's wscons(4) with 1bpp
      framebuffer when backspace is typed.
    o Fixed an attachment problem for dwctwo(4) for certain devices
      issuing NAK interrupts during split transactions.
    o Added AMD 17h/6xh Root Complex to ksmn(4).
    o Ensured the TX FIFO isn't overrun for longer transfers in
    o Added titmp(4), a driver for the TI TMP451 temperature sensor.
    o Ensured a USB mouse will attach if otherwise qualified even if the
      usage report does not include X and Y usages.
    o Attached unsupported video devices to uvideo(4) but not video(1),
      rather than leaving it unmatched.
    o Added a -R flag to usbhidctl(1) to dump the raw report descriptor
    o Added hid_get_report_desc_data() to usbhid(3) to access raw report
      descriptor data.
    o Fixed overflows when reading multiple bytes from AML over an i2c
      bus in acpi(4).
    o Fixed uaudio(4) on certain machines such as the RPI4 by adding a
      pre-DMA-write barrier after data is stored to memory.
    o Worked around x86 machines that advertise the "hardware reduced"
      ACPI feature, advertise S4 and S5 support, but fail to populate
      the SLEEP_CONTROL_REG and SLEEP_STATUS_REG descriptions in the
      FADT. This fixed the ASUS Zenbook 14.
    o Added quirk to enable ThinkPad X1 Extreme 1 speakers and Dolby
      Atmos in azalia(4).
    o Fixed pchgpio(4) issues with dead touchpads after resume.
    o Fixed an mbuf leak in xnf(4).

 - New or improved network hardware support:
    o Fixed ix(4) with older amd64 and current riscv64 hardware if MSI
      is not enabled for the device.
    o Added the uaq(4) driver for Aquantia AQC111U/AQC112U USB Ethernet
    o Added the aq(4) driver to support Aquantia 1/2.5/5/10Gb/s PCIe
      Ethernet adapters.
    o Synced dwctwo(4) with the NetBSD-current code base, enabling the
      USB on-board Ethernet controller through mue(4), fixing uvideo(4),
      and enabling the two USB uhub3 ports on the Raspberry Pi 3 Model
    o Added cad(4), a driver for Cadence GEM.
    o Added Broadcom BCM5725 to brgphy(4).
    o Added support for RTL8168FP/RTL8111FP/RTL8117 to re(4).
    o Fixed ure(4) after a media link change on RTL8153/B devices.
    o Fixed bnxt(4) with a single queue in MSI-X mode.

 - Added or improved wireless network drivers:
    o Zeroed out iwx(4) Tx descriptors of frames which are done to
      prevent the device from writing to the former DMA address of a
      buffer which has been taken off the Tx ring.
    o Fixed a bug in iwx(4) Tx done interrupt processing which could
      cause fatal firmware errors under load and memory corruption.
    o Changed iwm(4) and iwx(4) to sleep for 1 second while loading
      firmware to match what iwn(4) does. This fixes some issues with
    o Ensured that iwm(4) and iwx(4) will reload firmware from disk on
      down/up and not during resume.
    o Fixed iwx(4) crystal latency values to match those used by Linux
    o Fixed an off-by-one error in bwfm(4).
    o Changed iwn(4), iwm(4), and iwx(4) devices to hide detailed
      firmware error reports by default.
    o Prevented a loop when bwfm(4) receives an unsolicited association
      status event right after successful association.
    o Fixed a leak with wg(4) keepalive.
    o Switched iwx(4) to -63 firmware images as shipped in
      iwx-firmware-20210512, including fixes addressing fragattacks
    o Supported the new iwx(4) firmware session protection command,
      required for successful associations with new firmware.
    o Stopped asking iwx(4) to send probe requests on passive channels,
      fixing firmware going unresponsive after association.
    o Fixed an iwx(4) edge case where devices failed to resume after
      system suspend.
    o Switched iwm(4) to newer firmware images available in
      iwm-firmware-20210512. This provides FragAttacks fixes for the
      updated devices.
    o Fixed iwx(4) against access points using TKIP as the group cipher.
    o Prevented athn(4) from calling ieee80211_find_rxnode() on bad
      frames in an attempt to prevent creation of bogus node cache
    o Implemented various fixes addressing firmware errors in iwm(4) and
    o Fixed node leaks in iwm(4) and iwx(4) which caused the drivers to
      get stuck when roaming between access points.
    o Fixed iwx(4) firmware reloading after a failure to parse the
      firmware file.
    o Avoided "mac clock not ready" panics in iwm(4) and iwx(4).
    o Worked around a problem with certain athn(4) hardware that caused
      problem when running in HostAP mode with clients that use Tx
    o Corrected multicast decryption for iwx(4).
    o Added 802.11n Tx aggregation support to iwm(4).
    o Made iwn(4), iwm(4) and iwx(4) keep track of beacon parameters at
    o Implemented support for Rx aggregation offload in iwm(4) and
      iwx(4) and re-enabled de-aggregation of A-MSDUs in net80211 for
      all drivers capable of 11n mode.
    o Changed error reporting for bwfm(4) to use the long version of the
      firmware path. This makes it easier to find the correct files to
      add to the bwfm-firmware port.

 - IEEE 802.11 wireless stack improvements and bugfixes:
    o Drop fragmented 802.11 frames.
    o Prevent frame injection via forged 802.11n A-MSDUs.
    o Tweaked net80211 RA heuristics to avoid picking Tx rate choices
      that may be too optimistic.

 - Generic network stack improvements and bugfixes:
    o Implemented reception of "VLAN 0 priority tagged" packets.
    o Fixed an alignment fault observed on an octeon machine while
      pppoe(4) negotiated a large MTU.
    o Display provider ID for a umb(4) SIM in ifconfig(8).

 - Installer and upgrade improvements:
    o Checked the installer's /tmp/i/hostname.* files for a configured
      IP address so that configurations without a broadcast address are
      detected as well.
    o Handled "inet autoconf" in the ramdisk.
    o Introduced a short wait in rc(8) after netstart(8) finishes until
      an IPv4 or IPv6 default route is present before continuing boot.
      Fixed setups depending on working network and DNS resolution
      during early boot when using autoconfiguration (dhcpleased(8) or
    o Made fdisk(8) always create an EFI SYS partition if the -b option
      is specified when initializing a GPT.
    o Allowed (w)hole disk allocation for GPT disks in arm64, using
      fdisk(8) -A when an Apple APFS ISC partition is detected and fdisk
      -ig otherwise. Created EFI SYS boot partitions only on ROOTDISK
      GPT disks.
    o Added installboot(8) "-p" to prepare by creating a new filesystem
      on the partition reserved for the bootloader on relevant
    o Added GPT support to armv7 installboot(8).
    o Added the Spleen 12x24 and 16x32 font on amd64's RAMDISK_CD and
      RAMDISK kernels.
    o Use installboot(8) on arm64 ramdisks.
    o Enable dhcpleased(8) on ramdisks, and activate resolvd(8),
      replacing dhclient(8).
    o Enable slaacd(8) to configure nameservers on ramdisks.

 - Security improvements:
    o Moved objcopy to base set to allow KARL to work on all installs.
    o Added unveil(2) calls to xterm in the case where there are no
      exec-formatted or exec-selected resources set.
    o Changed usage of %n from a syslog warning to syslog and abort for
      printf(3) (and associated variants).
    o Made kernel stop all threads when terminating via pledge_fail().

 - Routing daemons and other userland network improvements:
    o The bgpd(8) daemon saw the following changes:
       - Stop processing queued UPDATES when the max-prefix limit was
       - Improved negotiation for route refresh, graceful restart and
         multi-protocol capabilities
       - Correctly track 'rde evaluate all' and 'export' settings
         during reload.
       - Properly withdraw prefixes when 'rde evaluate all' is used.
       - Fixed MRT handling on initial startup for message dump types.
       - Fixed and use non-blocking connect for RTR sessions.
       - Fully implemented RFC 6286 by checking for BGP ID collisions.
       - Adjusted the 4-byte AS number handling to RFC 6793 by
         changing error behaviour from prefix witdraw to attribute
       - In bgpctl(8) print out both the sent "Neighbor capabilities"
         and the "Negotiated capabilities" for a session.
       - Print timestamps both as a formatted and a pure time in
         seconds field in various JSON objects.
       - Fixed a bug, where during bgpd(8) config reloads prefixes of
         the wrong address family could leak to peers resulting in
         session resets.
       - Added support for RFC 7313 - Enhanced Route Refresh Disabled
         by default, to enable use 'announce enhanced refresh yes'.
       - Improved output of Adj-RIB-Out by updating nexthop and ASPATH
         before adding the prefix to the RIB. This improves `bgpctl
         show rib out` output.
       - Added command line option to both bgpd(8) and bgpctl(8) to
         show the version.
       - Added support for RFC 9072 - Extended Optional Parameters
         Length for BGP OPEN Message
       - Added support for RFC 8050 - MRT Format with BGP Additional
         Path Extensions
       - Implemented receive side of RFC 7911 - Advertisement of
         Multiple Paths in BGP. OpenBGPD is currently not able to send
         multiple paths out.
       - Improved checks of VRPs loaded via RTR or from the roa-set
       - Allowed optionally specifying an expiry time for roa-set
         entries to mitigate BGP route decision making based on
         outdated RPKI data. OpenBGPD's companion rpki-client(8)
         produces roa-sets with the new 'expires' property
    o The pf(4) packet filter and its userland utility:
       - Corrected a potential memory leak associated with pfsync(4)
         update requests.
       - Introduced locks around the global pf(4) state list.
       - Fixed a panic due to pfsync(4) deferral timeout handling.
       - Added support for pf(4) divert-to on tpmr(4) and veb(4).
       - Fixed state key reference underflow when both state keys are
         identical in pf(4).
       - Only skipped pf(4) once for packets injected by a
         divert-packet socket, allowing pf to still act later on a
         diverted packet.
    o IPSEC support in the kernel and the iked(8) userland daemon:
       - Zeroed out potential passwords when freeing memory or
         handling parsing errors in iked(8).
       - Added client-side support for DNS configuration to iked(8).
       - Increased iked(8) default data bytes limit for Child SAs to 4
         GB, preventing excessive rekeying and lost data in high
         performance setups.
       - Fixed an iked(8) bug where no flows are added if a single
         address is configured in the config address instead of a
       - Fixed a problem in iked(8) where no flows are loaded when a
         single config address without pool is configured.
       - Added an experimental post-quantum hybrid key exchange method
         based on Streamlined NTRU Prime (coupled with X25519) to
         iked(8) as sntrup761x25519.
       - Fixed races which were slowing ipsec(4) throughput.
       - Fixed ipsec(4) NAT-T to work with pipex(4).
    o rpki-client(8) received the following new features and bugfixes:
       - Added keep-alive support to the HTTP client code for RRDP.
       - Reference-count and delete unused files synced via RRDP, as
         far as possible.
       - In the JSON output, changed the AS Number from a string
         ("AS123") to an integer ("123") to make processing of the
         output easier,
       - Added an 'expires' column to CSV & JSON output, based on
         certificate and CRL validity times. The 'expires' value can
         be used to avoid route selection based on stale data when
         generating VRP sets, when faced with loss of communication
         between consumer and validator, or validator and CA
       - Made the runtime timeout (-s option) also trigger in child
       - Improved RRDP support and make RRDP the default protocol for
         synchronizing the RPKI repository data, with openrsync(1)
         used as secondary.
       - At startup, warn if the filesystem containing the cache
         directory is probably too small.
       - Handle running out of disk space more gracefully, including
         cleanup of temporary and old files before exiting.
       - Improved the HTTP/1.1 request headers being sent.
       - Improved validation checks for ROA and MFT objects.
       - Improved the HTTP client code (status code handling, http
         proxy support, keep-alive).
       - In RRDP, do not access URI with userinfo (@-sign)
       - Improved RRDP syncing by considering a notification file
         serial jumping backwards as synced repository.
       - Made -R (rsync only) also apply to the fetching of TA files.
       - Only sync *.{cer,crl,gbr,mft,roa} files via rsync and exclude
         all others.
       - When producing output for bgpd(8), make use of the 'roa-set
         expires' attribute to prevent machines from loading outdated
       - In RRDP, limited the number of deltas to 300 per repo. If
         more deltas exist, downloading a full snapshot is faster.
       - Limited the validation depth of X.509 certificate chains to
         12, double the current depth seen in RPKI.
    o traceroute(8) was improved:
       - Probe packets are now sent in quick succession and responses
         handled asynchronously.
       - DNS lookups are performed asynchronously. This speeds up the
         time required to display results considerably.
    o dhcpleased(8) was made the default program for configuring IPv4
      addresses via DHCP. resolvd(8) was activated to handle concurrent
      changes to resolv.conf(5) by both dhcpleased(8) and slaacd(8).
      Additionally these programs saw the following improvements and
       - Changed dhcpleased(8) client identifier transmission to match
         other DHCP client implementations.
       - Simplified dhcpleasectl(8) and added syntax to match
         dhclient(8) (interface), allowing one to be aliased to the
       - Retried broadcast with dhcpleased(8) when the DHCP server is
         unreachable via unicast UDP.
       - Made resolvd(8) accept DNS proposals for the loopback
       - Added to dhcpleased.conf(5) the ability to ignore routes or
         nameservers from a lease and to ignore servers entirely.
       - Made dhclient(8) defer to dhcpleased(8) when the inet
         autoconf flag is set. When run, dhclient will signal
         dhcpleased to request a new lease rather than requesting one
       - Fixed potential races in slaacd(8) and dhcpleased(8) when two
         processes are configuring the same IP.
       - Added the possibility to send vendor class identifier and
         client identifier using dhcpleased.conf(5).
       - Made dhcpleased(8) always configure provided routes,
         regardless of whether the address received in the lease is
         already configured.
       - Used exclusive locks under /dev/ to ensure single instances
         of resolvd(8), slaacd(8) and dhcpleased(8).
       - Implemented classless static routes DHCP option in
       - Added a new "nameserver" command to route(8), sending
         nameserver proposals to resolvd(8) using the DNS proposal
         protocol over the route socket. This command is intended be
         used to integrate userland triggered nameserver changes, for
         example by VPN software.
    o Changes to snmp related tools:
       - Disable SNMPv1 and SNMPv2c by default in snmpd(8).
       - Remove default communities from snmpd(8).
       - Switched default seclevel to enc for snmpd(8).
       - Changed the default snmp(1) version to -v3 and removed the
         default community.
       - Switched default snmp(1) auth to hmac-sha1.
       - Switched default snmp(1) and snmpd(8) privacy protocol to
       - Added the ability for snmpd(8) to send SNMPv3 traps.
       - Allowed "any" to be used as a listen on address in
       - Allowed setting of the engineid in snmpd(8).
    o Other userland network changes:
       - Fixed acme-client(1) SAN generation for CSRs.
       - Added pledge(2) for ftpd(8) user processes.
       - Allowed router solicitations from the unspecified address
         (::) in rad(8).
       - Altered slowcgi(8) so it no longer sends debug logging to
         syslog unless debug logging is requested via the new -v flag.
       - Prevented httpd(8) from trying to chunk encode an empty http
         body coming from an fcgi upstream.
       - Used relative reference URIs in Location header on directory
         redirects in httpd(8), adding support for front-ending httpd
         with a TLS-terminating gateway that forwards unencrypted http
       - Prevented a crash on strict alignment architectures of
         tcpdump(8) WireGuard printer.
       - Made tcpdump(8) split the 802.11 sequence number field into
         its sequence number and fragment number components rather
         than printing the whole field in decimal.
       - Added simple BGP enhanced route refresh message decoding to

 - tmux(1) improvements and bug fixes:
    o Added a -B flag to tmux(1) to remove borders from popups and added
      a menu to popups as well as options to convert a popup into a
    o Added pipe variants of the tmux(1) line copy commands.
    o Added basic support for zero width joiners to tmux(1).
    o Added client focus hooks to tmux(1).
    o Made window-linked and window-unlinked window options in tmux(1).
    o Added -F for tmux(1) command-prompt and used it to fix "Rename" on
      the window menu.
    o Added different tmux(1) command histories for different types of
    o Fixed tmux(1) problems with xterm in VT340 mode.
    o Added an "always" value to the extended-keys option to always
      forward those keys to applications inside tmux(1).

 - OpenSMTPD 7.0.0
    o Fixed incorrect status code for expired mails resulting in a
      misleading bounce report in smtpd(8).
    o Added TLS options cafile=(path), nosni, noverify and
      servername=(name) to smtp(1).
    o Allowed specification of TLS ciphers and protocols in smtp(1).

 - LibreSSL 3.4.1
    o New Features
       - Added support for OpenSSL 1.1.1 TLSv1.3 APIs.
       - Enabled the new X.509 validator to allow verification of
         modern certificate chains.
    o Portable Improvements
       - Ported continuous integration and test infrastructure to
         Github actions.
       - Added Universal Windows Platform (UWP) build support.
       - Fixed mingw-w64 builds on newer versions with missing SSP
       - Added non-executable stack annotations for CMake builds.
    o API and Documentation Enhancements
       - Added the following APIs from OpenSSL
          BN_bn2binpad BN_bn2lebinpad BN_lebin2bn EC_GROUP_get_curve
        EC_GROUP_order_bits EC_GROUP_set_curve
        EC_POINT_set_compressed_coordinates EVP_DigestSign
        EVP_DigestVerify SSL_CIPHER_find SSL_CTX_get0_privatekey
        SSL_CTX_get_max_early_data SSL_CTX_get_ssl_method
        SSL_CTX_set_ciphersuites SSL_CTX_set_max_early_data
        SSL_CTX_set_post_handshake_auth SSL_SESSION_get0_cipher
        SSL_SESSION_get_max_early_data SSL_SESSION_is_resumable
        SSL_SESSION_set_max_early_data SSL_get_early_data_status
        SSL_get_max_early_data SSL_read_early_data SSL_set0_rbio
        SSL_set_ciphersuites SSL_set_max_early_data
        SSL_verify_client_post_handshake SSL_write_early_data
       - Added AES-GCM constants from RFC 7714 for SRTP.
    o Compatibility Changes
       - Implement flushing for TLSv1.3 handshakes behavior, needed
         for Apache.
       - Call the info callback on connect/accept exit in TLSv1.3,
         needed for p5-Net-SSLeay.
       - Default to using named curve parameter encoding from
         pre-OpenSSL 1.1.0, adding OPENSSL_EC_EXPLICIT_CURVE.
       - Do not ignore SSL_TLSEXT_ERR_FATAL from the ALPN callback.
    o Testing and Proactive Security
       - Added additional state machine test coverage.
       - Improved integration test support with ruby/openssl tests.
       - Error codes and callback support in new X.509 validator made
         compatible with p5-Net_SSLeay tests.
    o Internal Improvements
       - Numerous fixes and improvements to the new X.509 validator to
         ensure compatible error codes and callback support compatible
         with the legacy OpenSSL validator.

 - OpenSSH 8.8
    o Security
       - sshd(8): OpenSSH 8.5 introduced the LogVerbose keyword. When
         this option was enabled with a set of patterns that activated
         logging in code that runs in the low-privilege sandboxed sshd
         process, the log messages were constructed in such a way that
         printf(3) format strings could effectively be specified the
         low-privilege code.
       - sshd(8) from OpenSSH 6.2 through 8.7 failed to correctly
         initialise supplemental groups when executing an
         AuthorizedKeysCommand or AuthorizedPrincipalsCommand, where a
         AuthorizedKeysCommandUser or AuthorizedPrincipalsCommandUser
         directive has been set to run the command as a different
    o Potentially incompatible changes
       - A near-future release of OpenSSH will switch scp(1) from
         using the legacy scp/rcp protocol to using SFTP by default.
       - This release disables RSA signatures using the SHA-1 hash
         algorithm by default.
       - scp(1): this release changes the behaviour of remote to
         remote copies (e.g. "scp host-a:/path host-b:") to transfer
         through the local host by default. This was previously
         available via the -3 flag. This mode avoids the need to
         expose credentials on the origin hop, avoids triplicate
         interpretation of filenames by the shell (by the local
         system, the copy origin and the destination) and, in
         conjunction with the SFTP support for scp(1) mentioned below,
         allows use of all authentication methods to the remote hosts
         (previously, only non-interactive methods could be used). A
         -R flag has been added to select the old behaviour.
       - ssh(1)/sshd(8): both the client and server are now using a
         stricter configuration file parser. The new parser uses more
         shell-like rules for quotes, space and escape characters. It
         is also more strict in rejecting configurations that include
         options lacking arguments. Previously some options (e.g.
         DenyUsers) could appear on a line with no subsequent
         arguments. This release will reject such configurations. The
         new parser will also reject configurations with unterminated
         quotes and multiple '=' characters after the option name.
       - ssh(1): when using SSHFP DNS records for host key
         verification, ssh(1) will verify all matching records instead
         of just those with the specific signature type requested.
         This may cause host key verification problems if stale SSHFP
         records of a different or legacy signature type exist
         alongside other records for a particular host.
       - ssh-keygen(1): when generating a FIDO key and specifying an
         explicit attestation challenge (using -Ochallenge), the
         challenge will now be hashed by the builtin security key
         middleware. This removes the (undocumented) requirement that
         challenges be exactly 32 bytes in length and matches the
         expectations of libfido2.
       - sshd(8): environment="..." directives in authorized_keys
         files are now first-match-wins and limited to 1024 discrete
         environment variable names.
    o New features
       - scp(1): experimental support for transfers using the SFTP
         protocol as a replacement for the venerable SCP/RCP protocol
         that it has traditionally used. SFTP offers more predictable
         filename handling and does not require expansion of glob(3)
         patterns via the shell on the remote side.
       - sftp-server(8): add a protocol extension to support expansion
         of ~/ and ~user/ prefixed paths. This was added to support
         these paths when used by scp(1) while in SFTP mode.
       - ssh(1): add a ForkAfterAuthentication ssh_config(5)
         counterpart to the ssh(1) -f flag.
       - ssh(1): add a StdinNull directive to ssh_config(5) that
         allows the config file to do the same thing as -n does on the
         ssh(1) command- line.
       - ssh(1): add a SessionType directive to ssh_config, allowing
         the configuration file to offer equivalent control to the -N
         (no session) and -s (subsystem) command-line flags.
       - ssh-keygen(1): allowed signers files used by ssh-keygen(1)
         signatures now support listing key validity intervals
         alongside they key, and ssh-keygen(1) can optionally check
         during signature verification whether a specified time falls
         inside this interval. This feature is intended for use by git
         to support signing and verifying objects using ssh keys.
       - ssh-keygen(8): support printing of the full public key in a
         sshsig signature via a -Oprint-pubkey flag.
       - ssh(1): allow the ssh_config(5) CanonicalizePermittedCNAMEs
         directive to accept a "none" argument to specify the default
    o Bugfixes
       - ssh(1)/ sshd(8): start time-based re-keying exactly on
         schedule in the client and server mainloops. Previously the
         re-key timeout could expire but re-keying would not start
         until a packet was sent or received, causing a spin in
         select() if the connection was quiescent.
       - ssh-keygen(1): avoid Y2038 problem in printing certificate
         validity lifetimes. Dates past 2^31-1 seconds since epoch
         were displayed incorrectly on some platforms.
       - scp(1): allow spaces to appear in usernames for local to
         remote and scp -3 remote to remote copies.
       - ssh(1)/ sshd(8): remove references to
         ChallengeResponseAuthentication in favour of
         KbdInteractiveAuthentication. The former is what was in
         SSHv1, the latter is what is in SSHv2 (RFC4256) and they were
         treated as somewhat but not entirely equivalent. We retain
         the old name as a deprecated alias so configuration files
         continue to work as well as a reference in the man page for
         people looking for it.
       - ssh(1)/ ssh-add(1)/ ssh-keygen(1): fix decoding of X.509
         subject name when extracting a key from a PKCS#11
       - ssh(1): restore blocking status on stdio fds before close.
         ssh(1) needs file descriptors in non-blocking mode to operate
         but it was not restoring the original state on exit. This
         could cause problems with fds shared with other programs via
         the shell.
       - ssh(1)/ sshd(8): switch both client and server mainloops from
         select(3) to pselect(3). Avoids race conditions where a
         signal may arrive immediately before select(3) and not be
         processed until an event fires.
       - ssh(1): sessions started with ControlPersist were incorrectly
         executing a shell when the -N (no shell) option was
       - ssh(1): check if IPQoS or TunnelDevice are already set before
         overriding. Prevents values in config files from overriding
         values supplied on the command line.
       - ssh(1): fix debug message when finding a private key to match
         a certificate being attempted for user authentication.
         Previously it would print the certificate's path, whereas it
         was supposed to be showing the private key's path.
       - sshd(8): match host certificates against host public keys,
         not private keys. Allows use of certificates with private
         keys held in a ssh-agent.
       - ssh(1): add a workaround for a bug in OpenSSH 7.4 sshd(8),
         which allows RSA/SHA2 signatures for public key
         authentication but fails to advertise this correctly via
         SSH2_MSG_EXT_INFO. This causes clients of these server to
         incorrectly match PubkeyAcceptedAlgorithms and potentially
         refuse to offer valid keys.
       - sftp(1)/ scp(1): degrade gracefully if a sftp-server offers
         the extension but fails when the client
         tries to invoke it.
       - ssh(1): allow ssh_config SetEnv to override $TERM, which is
         otherwise handled specially by the protocol. Useful in
         ~/.ssh/config to set TERM to something generic (e.g. "xterm"
         instead of "xterm-256color") for destinations that lack
         terminfo entries.
       - sftp-server(8): the extension was
         incorrectly marked as an operation that writes to the
         filesystem, which made it unavailable in sftp-server
         read-only mode.
       - ssh(1): fix SEGV in UpdateHostkeys debug() message, triggered
         when the update removed more host keys than remain present.
       - scp(1): when using the SFTP protocol, continue transferring
         files after a transfer error occurs, better matching original
         scp/rcp behaviour.
       - ssh(1): fixed a number of memory leaks in multiplexing,
       - ssh-keygen(1): avoid crash when using the -Y find-principals
       - A number of documentation and manual improvements.

 - mandoc 1.14.6
    o Added a style message about overlong text input lines.
    o Made "-W style" check .Xr links along the full manpath to help
      validation of non-base manual pages.
    o Supported auto-tagging for ".It Va" in mdoc(7) documents.
    o Stopped printing two extra blank lines at the top and bottom of
      man(7) documents.
    o Supported the CB and CI fonts in roff(7) \f font escapes and .ft
      font requests.
    o Added support for two-character font names (BI, CW, CR, CB, CI) to
      the tbl(7) layout font modifier.
    o Implemented the tbl(7) layout modifiers "b" (bold) and "i"
      (italic) in HTML output mode.
    o Completed support for the "nospaces" option in the tbl(7) parser.
    o Fixed an infinite loop in the tbl(7) parser for some cases of
      horizontally overlapping horizontal spans.
    o Added a meta viewport element to "-T html" output.
    o Fixed a crash with "-T man" when an input file contains tbl(7) or
      eqn(7) input.
    o Fixed a crash in makewhatis(8) when a manpath directory contains a
      symbolic link that points to a directory.

 - Ports and packages:
    o Pre-built packages are available for the following architectures on
      the day of release:
       - aarch64 (arm64): 11034
       - amd64: 11325
       - i386: 10248
       - mips64: 9311
       - powerpc64: 9273
       - sparc64: 9636
    o Packages for the following architectures will be made available as
      their builds complete:
       - arm
       - mips64el
       - powerpc

 - Some highlights:

    o Asterisk 18.6.0                 o Mutt 2.1.3 and NeoMutt 20210205
    o Audacity 2.4.2                  o Node.js 12.22.6
    o CMake 3.20.3                    o OCaml 4.10.0
    o Chromium 93.0.4577.82           o OpenLDAP 2.4.59
    o Emacs 27.2                      o PHP 7.3.30, 7.4.23 and 8.0.10
    o FFmpeg 4.4                      o Postfix 3.5.12
    o GCC 8.4.0 and 11.2.0            o PostgreSQL 13.4
    o GHC 8.10.6                      o Python 2.7.18, 3.8.12 and 3.9.7
    o GNOME 40.4                      o Qt 5.15.2 and 6.0.4
    o Go 1.17                         o R 4.1.1
    o JDK 8u302, 11.0.12 and 16.0.2   o Ruby 2.6.8, 2.7.4 and 3.0.2
    o KDE Applications 21.08.1        o Rust 1.55.0
    o KDE Frameworks 5.85.0           o SQLite 3.35.5
    o Krita 4.4.8                     o Shotcut 21.01.29
    o LLVM/Clang 11.1.0               o Sudo 1.9.7p2
    o LibreOffice             o Suricata 6.0.2
    o Lua 5.1.5, 5.2.4 and 5.3.6      o Tcl/Tk 8.5.19 and 8.6.8
    o MariaDB 10.6.4                  o TeX Live 2020
    o Mono                 o Vim 8.2.3394 and Neovim 0.5.0
    o Mozilla Firefox 92.0 and        o Xfce 4.16
      ESR 91.1.0
    o Mozilla Thunderbird 91.1.1

 - As usual, steady improvements in manual pages and other documentation.

 - The system includes the following major components from outside suppliers:
    o Xenocara (based on X.Org 7.7 with xserver 1.20.13 + patches,
      freetype 2.10.4, fontconfig 2.12.4, Mesa 21.1.8, xterm 367,
      xkeyboard-config 2.20, fonttosfnt 1.2.2, and more)
    o LLVM/Clang 11.1.0 (+ patches)
    o GCC 4.2.1 (+ patches) and 3.3.6 (+ patches)
    o Perl 5.32.1 (+ patches)
    o NSD 4.3.7
    o Unbound 1.13.2
    o Ncurses 5.7
    o Binutils 2.17 (+ patches)
    o Gdb 6.3 (+ patches)
    o Awk December 18, 2020 version
    o Expat 2.4.1

- SECURITY AND ERRATA --------------------------------------------------

We provide patches for known security threats and other important
issues discovered after each release.  Our continued research into
security means we will find new security problems -- and we always
provide patches as soon as possible.  Therefore, we advise regular
visits to

- MAILING LISTS AND FAQ ------------------------------------------------

Mailing lists are an important means of communication among users and
developers of OpenBSD.  For information on OpenBSD mailing lists, please

You are also encouraged to read the Frequently Asked Questions (FAQ) at:

- DONATIONS ------------------------------------------------------------

The OpenBSD Project is a volunteer-driven software group funded by
donations.  Besides OpenBSD itself, we also develop important software
like OpenSSH, LibreSSL, OpenNTPD, OpenSMTPD, the ubiquitous pf packet
filter, the quality work of our ports development process, and many
others.  This ecosystem is all handled under the same funding umbrella.

We hope our quality software will result in contributions that maintain
our build/development infrastructure, pay our electrical/internet costs,
and allow us to continue operating very productive developer hackathon

All of our developers strongly urge you to donate and support our future
efforts.  Donations to the project are highly appreciated, and are
described in more detail at:

- OPENBSD FOUNDATION ---------------------------------------------------

For those unable to make their contributions as straightforward gifts,
the OpenBSD Foundation ( is a Canadian
not-for-profit corporation that can accept larger contributions and
issue receipts.  In some situations, their receipt may qualify as a
business expense write-off, so this is certainly a consideration for
some organizations or businesses.

There may also be exposure benefits since the Foundation may be
interested in participating in press releases.  In turn, the Foundation
then uses these contributions to assist OpenBSD's infrastructure needs.
Contact the foundation directors at for
more information.

- RELEASE SONG ---------------------------------------------------------

OpenBSD 7.0 comes with the song "The Style Hymn".  Lyrics (and an
explanation) of the song may be found at:

- HTTPS INSTALLS -------------------------------------------------------

OpenBSD can be easily installed via HTTPS downloads.  Typically you need
a single small piece of boot media (e.g., a USB flash drive) and then
the rest of the files can be installed from a number of locations,
including directly off the Internet.  Follow this simple set of
instructions to ensure that you find all of the documentation you will
need while performing an install via HTTPS.

1) Read either of the following two files for a list of HTTPS mirrors
   which provide OpenBSD, then choose one near you:

   As of October 14, 2021, the following HTTPS mirror sites have the
   7.0 release:            Global         Stockholm, Sweden          Frankfurt, Germany           Oldenburg, Germany         Paris, France       Brisbane, Australia        CO, USA       CA, USA            TX, USA     Toronto, Canada Global     Global

        The release is also available at the master site:            Alberta, Canada

        However it is strongly suggested you use a mirror.

   Other mirror sites may take a day or two to update.

2) Connect to that HTTPS mirror site and go into the directory
   pub/OpenBSD/7.0/ which contains these files and directories.
   This is a list of what you will see:

        ANNOUNCEMENT     armv7/        octeon/             root.mail
        README           hppa/ sparc64/
        SHA256           i386/         packages/           src.tar.gz
        SHA256.sig       landisk/      packages-stable/    sys.tar.gz
        alpha/           loongson/     ports.tar.gz        xenocara.tar.gz
        amd64/           luna88k/      powerpc64/
        arm64/           macppc/       riscv64/

   It is quite likely that you will want at LEAST the following
   files which apply to all the architectures OpenBSD supports.

        README          - generic README
        root.mail       - a copy of root's mail at initial login.
                          (This is really worthwhile reading).

3) Read the README file.  It is short, and a quick read will make
   sure you understand what else you need to fetch.

4) Next, go into the directory that applies to your architecture,
   for example, amd64.  This is a list of what you will see:

        BOOTIA32.EFI*   bsd*            floppy70.img    pxeboot*
        BOOTX64.EFI**         game70.tgz      xbase70.tgz
        BUILDINFO       bsd.rd*         index.txt       xfont70.tgz
        INSTALL.amd64   cd70.iso        install70.img   xserv70.tgz
        SHA256          cdboot*         install70.iso   xshare70.tgz
        SHA256.sig      cdbr*           man70.tgz
        base70.tgz      comp70.tgz      miniroot70.img

   If you are new to OpenBSD, fetch _at least_ the file INSTALL.amd64
   and install70.iso.  The install70.iso file (roughly 697MB in size)
   is a one-step ISO-format install CD image which contains the various
   *.tgz files so you do not need to fetch them separately.

   If you prefer to use a USB flash drive, fetch install70.img and
   follow the instructions in INSTALL.amd64.

5) If you are an expert, follow the instructions in the file called
   README; otherwise, use the more complete instructions in the
   file called INSTALL.amd64.  INSTALL.amd64 may tell you that you
   need to fetch other files.

6) Just in case, take a peek at:

   This is the page where we talk about the mistakes we made while
   creating the 7.0 release, or the significant bugs we fixed
   post-release which we think our users should have fixes for.
   Patches and workarounds are clearly described there.

- X.ORG FOR MOST ARCHITECTURES -----------------------------------------

X.Org has been integrated more closely into the system.  This release
contains X.Org 7.7.  Most of our architectures ship with X.Org, including
amd64, sparc64 and macppc.  During installation, you can install X.Org
quite easily using xenodm(1), our simplified X11 display manager forked
from xdm(1).

- PACKAGES AND PORTS ---------------------------------------------------

Many third party software applications have been ported to OpenBSD and
can be installed as pre-compiled binary packages on the various OpenBSD
architectures.  Please see for
more information on working with packages and ports.

Note: a few popular ports, e.g., NSD, Unbound, and several X
applications, come standard with OpenBSD and do not need to be installed

- SYSTEM SOURCE CODE ---------------------------------------------------

The source code for all four subsystems can be found in the
pub/OpenBSD/7.0/ directory:

        xenocara.tar.gz     ports.tar.gz   src.tar.gz     sys.tar.gz

The README ( file
explains how to deal with these source files.

- THANKS ---------------------------------------------------------------

Ports tree and package building by Jasper Lievisse Adriaanse,
Pierre-Emmanuel Andre, Jeremie Courreges-Anglas, Visa Hankala,
Stuart Henderson, Peter Hessler, Kurt Mosiejczuk, Christian Weisgerber,
and Charlene Wendling.  Base and X system builds by Kenji Aoyama and
Theo de Raadt.  Release art contributed by Natasha Allegri.

We would like to thank all of the people who sent in bug reports, bug
fixes, donation cheques, and hardware that we use.  We would also like
to thank those who bought our previous CD sets.  Those who did not
support us financially have still helped us with our goal of improving
the quality of the software.

Our developers are:

    Aaron Bieber, Adam Wolk, Alexander Bluhm, Alexander Hall,
    Alexandr Nedvedicky, Alexandr Shadchin, Alexandre Ratchov,
    Andrew Fresh, Anil Madhavapeddy, Anthony J. Bentley,
    Antoine Jacoutot, Anton Lindqvist, Asou Masato, Ayaka Koshibe,
    Benoit Lecocq, Bjorn Ketelaars, Bob Beck, Brandon Mercer,
    Brent Cook, Brian Callahan, Bryan Steele, Can Erkin Acar,
    Carlos Cardenas, Charlene Wendling, Charles Longeau,
    Chris Cappuccio, Christian Weisgerber, Christopher Zimmermann,
    Claudio Jeker, Dale Rahn, Damien Miller, Daniel Dickman,
    Daniel Jakots, Darren Tucker, Dave Voutila, David Coppa,
    David Gwynne, David Hill, Denis Fondras, Doug Hogan, Edd Barrett,
    Elias M. Mariani, Eric Faurot, Florian Obser, Florian Riehm,
    Frederic Cambus, George Koehler, Gerhard Roth, Giannis Tsaraias,
    Gilles Chehade, Giovanni Bechis, Gleydson Soares,
    Gonzalo L. Rodriguez, Greg Steuck, Helg Bredow, Henning Brauer,
    Ian Darwin, Ian Sutton, Igor Sobrado, Ingo Feinerer, Ingo Schwarze,
    Inoguchi Kinichiro, James Turner, Jan Klemkow, Jason McIntyre,
    Jasper Lievisse Adriaanse, Jeremie Courreges-Anglas, Jeremy Evans,
    Job Snijders, Joel Sing, Joerg Jung, Jonathan Armani, Jonathan Gray,
    Jonathan Matthew, Jordan Hargrave, Joris Vink, Joshua Stein,
    Juan Francisco Cantero Hurtado, Kazuya Goda, Kenji Aoyama,
    Kenneth R Westerback, Kent R. Spillner, Kevin Lo, Kirill Bychkov,
    Klemens Nanni, Kurt Miller, Kurt Mosiejczuk, Landry Breuil,
    Lawrence Teo, Marc Espie, Marcus Glocker, Mark Kettenis,
    Mark Lumsden, Markus Friedl, Martijn van Duren, Martin Natano,
    Martin Pieuchot, Martin Reindl, Martynas Venckus, Mats O Jansson,
    Matthew Dempsky, Matthias Kilian, Matthieu Herrb, Michael Mikonos,
    Mike Belopuhov, Mike Larkin, Moritz Buhl, Nam Nguyen,
    Nayden Markatchev, Nicholas Marriott, Nigel Taylor, Okan Demirmen,
    Ori Bernstein, Otto Moerbeek, Paco Esteban, Pamela Mosiejczuk,
    Pascal Stumpf, Patrick Wildt, Paul Irofti, Pavel Korovin,
    Peter Hessler, Philip Guenther, Pierre-Emmanuel Andre, Pratik Vyas,
    Rafael Sadowski, Rafael Zalamena, Raphael Graf, Remi Locherer,
    Remi Pointel, Renato Westphal, Ricardo Mestre, Richard Procter,
    Rob Pierce, Robert Nagy, Sasano Takayoshi, Scott Soule Cheloha,
    Sebastian Benoit, Sebastian Reitenbach, Sebastien Marie,
    Solene Rapenne, Stefan Fritsch, Stefan Kempf, Stefan Sperling,
    Steven Mestdagh, Stuart Cassoff, Stuart Henderson, Sunil Nimmagadda,
    T.J. Townsend, Ted Unangst, Theo Buehler, Theo de Raadt,
    Thomas Frohwein, Tim van der Molen, Tobias Heider,
    Tobias Stoeckmann, Todd C. Miller, Todd Mortimer, Tom Cosgrove,
    Tracey Emery, Ulf Brosziewski, Uwe Stuehler, Vadim Zhukov,
    Vincent Gross, Visa Hankala, Vitaliy Makkoveev, Yasuoka Masahiko,
    Yojiro Uo