Language Selection

English French German Italian Portuguese Spanish

PCLinuxOS, Distros, and 10 reasons to try PCLinuxOS.

Filed under
Linux

When I first started experimenting with Linux, it was quite primitive. I waited a couple of years, and tried it again. I purchased a bunch of distros from cheapbytes.com, and tried them all in various computers.

Only one of those distros worked on the majority of machines (where all the devices functioned properly). That distro was Mandrake 7.0. I think it was KDE 2.0 or 2.1 at the time. I stayed with Mandrake for several years (who bought out Connectiva Linux and changed its name to Mandriva Linux).

Through the years, I found some version releases were wonderful (Mandriva 8.2 was remarkably stable on a server for me, as well being a fine desktop).

For Mandriva in a desktop role, I discovered this guy who went by the handle of Texstar was taking the latest KDE releases and producing RPM packages to work with Mandriva. Mandriva even mentioned on their web pages that a person could find updated KDE RPMs created by a guy named Textar [sic]. Yes, here was a guy who was single-handedly keeping the Mandriva distro's primary GUI up to date, and they incorrectly spell his name.

More Mandriva versions were released, and Texstar relentlessly kept issuing updated KDE RPMs for each version. He did an incredible amount of very high quality work, and made the Mandriva experience much better than it would otherwise have been.

On Tex's web site (pclinuxonline.com) I read messages in the forums where folks were encouraging Tex to fork Mandriva and do his own distribution. Sal was one of the guys urging Tex to do his own distro. I was skeptical--although Tex had proved to be an incredibly talented and hard-working maker of KDE RPM's specific to the Mandrake/Mandriva distro, I thought that doing your own complete distro (even with forking Mandriva's source code) was too arduous and difficult a task.

So Tex stopped doing Mandriva KDE packages, and was reputed to be working (with a few others) on a new distro to be called PCLinuxOS. Frankly, I didn't pay much attention--I kept using Mandriva in both server and desktop roles.

Mandriva 10.0 came and went, then 10.1, and Mandriva 10.2/2005, 2006, and now 2007. Mandriva fired Gael Duval. Although I thought he was treated badly, I stuck with Mandriva. But I was becoming increasingly frustrated with Mandriva not officially releasing KDE updates. And while other 3rd parties jumped in to provide KDE updates, they didn't (particularly at first) have the quality and reliability of Tex's RPMs.

And Mandriva's software updater was often unreliable. They changed the organization and structure of their repositories (more than once). It was becoming increasingly difficult to keep a release updated.

Finally, when PCLinuxOS .92 came out, I made the switch from Mandriva. In a way, it was a sad time for me. I had been a silver edition Mandriva club member for several years. I thought Mandriva, as a company, was faithful to Open Source ideals. I had, for many years, paid my club membership *and* purchased boxed sets of each new release.

When PCLinuxOS .93a came out, I upgraded to it. This distro version has been wonderful--a real sweet spot. And on the rare occasion that Tex and the gang didn't have an RPM package for what I wanted, I'd compile my own.

However, there were a few things that just wouldn't compile. They needed the newer C/C++ development libraries, (and libraries that depended on those libraries). And, of course, other distros were starting to introduce new 3D accelerated effects with Compiz and Beryl.

The forums at pclinuxos.com mentioned that Tex and the gang were working on a new release. So, a version of PCLinuxOS 2007 was released internally. About a month later, PCLinuxOS 2007 Test Release 1 was released for wide-spread testing. For me, this version worked fine, with no issues--it is equivalent to, say, a Release Candidate version 2. After further testing and debugging, PCLinuxOS final is due out at the end of January.

What do I think of PCLinuxOS 2007 Test Release 1? I find it stunning. When the final 2007 release version comes out, I think it will skyrocket in popularity. Already, PCLinux OS has taken over 5th place (from Mandriva) on the distrowatch.com hit parade.

So, a couple of caveats--while PCLinuxOS contains quite a bit of server stuff in its repositories, it is primarily a desktop oriented distro.

Secondly, there are some non-free packages in the distro. You will get all the audio and video codecs and drivers you need. This distro is not for FOSS purists.

Top Ten reasons to install and use PCLinuxOS:

1. It's drop dead gorgeous, and very professional looking.
2. The Beryl/Compiz 3D acceleration effects are terrific--much better than any other distro I've tried.
3. The repository has over 5000 packages, and updates are incredibly prompt, smooth, and easy to do. Synaptic, the GUI package manager works easily and reliably with the repository's RPM packages. Dependency issues are usually well handled. All the development programs and libraries are up to date.
4. An up to date KDE version (3.5.6).
5. Bugs, problems, and issues are promptly fixed.
6. The PCLinuxOS community is positive and helpful. Documentation is excellent. Support is excellent.
7. It's quick and snappy.
8. Everything works.
9. Its very easy to install ... and ...
10. It doesn't require the largess and financial backing of a millionaire to keep it going.

So, yes, the former child (PCLinusOS) has grown up to supersede its parent (Mandriva). Put simply, for a desktop Linux distro, it's the best.

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

A finely tuned engine

I think the review covers it. I would still drop it now if it did not keep Xfce. As for the eye candy, you can get rid of it if, like I, you find it more of an eyesore.

I too moved from Mandriva. For me, its so-called "2007" version was the last straw.

PCLinuxOS has given me no trouble, unlike the 7 or so others I've tried to some degree.

-----
I try to take one day at a time -- but sometimes several days attack me at once - Ashleigh Brilliant

I agree with some of your

I agree with some of your points but hat I really find annoying in every PCLinuxOS I read is the lack of concern about the internationalisation of the distro. Indeed I didn't find any non-english word in the whole live-cd. Even the bootloader at the beginning isn't translated, nor the installer who's pretty much Mandriva's.

So yes they took Mandrake, put a better package manager and a good new theme on it. But they also dropped everything that makes Mandriva 2007 worthy: the several CDs with different languages, the several formats (live cd, dvd installer...)

Localization of PCLOS

Tomaskroh wrote:
I agree with some of your points but hat I really find annoying in every PCLinuxOS I read is the lack of concern about the internationalisation of the distro. Indeed I didn't find any non-english word in the whole live-cd. Even the bootloader at the beginning isn't translated, nor the installer who's pretty much Mandriva's.

I find the fact that the PCLOS team concentrates on make a darn good distro in English not at all disturbing. A whole community has sprung up around the developers and that community is certainly up to the task of internationalizing.

Over on MyPCLinuxOS.com you can find localization efforts and howto's in many languages, pclinuxos.nl has Dutch remasters available, pclinuxos.de has a German remaster etc. etc.

Basically all of the packages already come with their localized .po files because their projects deliver them ready-to-eat.

So there is only a little bit of tweaking required plus the download of a few files that are quite conveniently located in the standard PCLOS repos, put there by.....the developers.

Installers and other distro-specific scripts are the prime focus of the localization effort based on MyPCLinuxos.com

So I resent the suggestion that PCLOS has no international aspirations or doesn't care for its overseas customers. Tex is treating us Europeans just fine, thank you.

Old Chinese saying goes: "Tex helps those who help themselves"

Internationalisation

I suppose you have to focus your efforts at the beginning. If other languages are not added at some point, I would wonder why.

The process may have begun. There is a German website and a Netherlands website.

re: Internationalisation

They're Texan's - so English is about as close as you can get to their native language.

Don't get your dander up, it's just a little joke there, ya varmints.

re: Internationalisation

"PCLinuxOS is an English only live CD initially based on Mandrake Linux that runs entirely from a bootable CD." - Distrowatch.com

PCLinuxOS is upfront with the fact that it is English only. If this is a problem, perhaps instead of complaining, you could join the community and help with translating.

Look at it this way:

Look at it this way: PCLinuxOS is the work of a handful of people. As already said, if people want to help add more localisations, I'm sure they'll be welcome.

That said, what is remarkable about PCLinuxOS is that it is clearly the favourite distro of many who do not have English as a first language, and, judging by the forums, people who struggle in English. You have to ask why that is, my answer would be that the general feel, and Ease of Use makes up for it.

Look at it this way

I've tried about 8 distros. PCLinuxOS is one of only two which have given me no trouble worth mentioning and it is several points better than the other.

It has not wasted any of my time. It is a cut above its parent (Mandriva) which itself is a darn sight less time-wasting than the others. I'd like to see localisations added and I hope that happens in time.

Works for me

I have a few computers here. Trying different distros like Ubuntu, openSUSE, fedora, mepis and the rest, It was a toss between pclinuxos and mepis. I think mepis is sweet enough but when it came down to getting standard desktop work done, I decided pclinuxos test release1 rocks! It has new versions of programs like digikam 0.9.0.
Have you all tried songbird !!? http://www.songbirdnest.com/
Load up synaptic and install this new music player. Tell me your not impressed!!!

More in Tux Machines

today's leftovers

  • mintCast 355.5 – McKnight in Shining Armor

    1:49 Linux Innards 27:06 Vibrations from the Ether 51:29 Check This Out 58:45 Announcements & Outro In our Innards section, we talk to community member Mike! And finally, the feedback and a couple suggestions

  • The small web is beautiful

    About fifteen years ago, I read E. F. Schumacher’s Small is Beautiful and, despite not being interested in economics, I was moved by its message. Perhaps even more, I loved the terse poetry of the book’s title – it resonated with my frugal upbringing and my own aesthetic.

    I think it’s time for a version of that book about technology, with a chapter on web development: The Small Web is Beautiful: A Study of Web Development as if People Mattered. Until someone writes that, this essay will have to do.

    There are two aspects of this: first, small teams and companies. I’m not going to talk much about that here, but Basecamp and many others have. What I’m going to focus on in this essay is small websites and architectures.

  • PS2 Emulation Gets Even Nicer With Custom Textures

    PCSX2 has long been a fantastic PS2 emulator, but a recent advance has made it all the more appealing for anyone playing on a PC: the ability to swap textures in games. While the famous Dolphin emulator for the GameCube has long supported this feature, PCSX2 has only just brought it in, and it’ll allow modders to improve any kind of texture they want in an old PS2 game. In the example video below by someother1ne, we can see everything from the road in Gran Turismo to the helmets and jerseys in NFL2K5 get swapped out.

  • Epic Games is buying Fall Guys creator Mediatonic

    According to the blog posts and FAQs detailing the announcement, Fall Guys will remain available on Steam for the time being, and the developer is still bringing the game to both the Xbox and Nintendo Switch platforms. Epic and Mediatonic say there are no plans right now to make the game (which currently costs $19.99) free-to-play, as Epic did with Rocket League. Epic later confirmed it plans to make the PC version of Fall Guys available on the Epic Game Store.

today's howtos

  • Kushal Das: Get a TLS certificate for your onion service

    For a long time, I wanted to have a certificate for the onion address of my blog. Digicert was the only CA who was providing those certificates with an Extended Validation. Those are costly and suitable for an organization to get, but not for me personally, especially due to the cost.

  • How To Install Nano Text Editor on CentOS 8 - idroot

    In this tutorial, we will show you how to install Nano Text Editor on CentOS 8. For those of you who didn’t know, Nano comes with many powerful features and allows you to edit and create various files on your computer or server. It includes all the basic functionality same as other text editors such as UTF-8 encoding, syntax highlighting, search and replace with regular expression support, multiple buffers, spellchecking, and more. This article assumes you have at least basic knowledge of Linux, know how to use the shell, and most importantly, you host your site on your own VPS. The installation is quite simple and assumes you are running in the root account, if not you may need to add ‘sudo‘ to the commands to get root privileges. I will show you through the step-by-step installation of the Nano Text Editor on CentOS 8.

  • How to Install Terraform in Linux Distributions

    Terraform is a popular cloud orchestration tool in the world of automation, which is used to deploy your infrastructure through the IAC (Infrastructure as code) approach. Terraform is built by Hashicorp and released under Mozilla Public License. It supports public, private as well as hybrid cloud, as of now Terraform supports 145 providers, which includes popular providers like AWS, Azure cloud, GCP, Oracle cloud, and many others. Terraform architecture is very simple. All you need is to download the terraform binary to your local/server machine which is going to act as your base machine. We have to mention the provider to work within our syntax file. Terraform will download the plugin for that particular provider automatically and will authenticate with provider API to execute the plan.

Programming Leftovers

  • How to Deploy a Node.js App – From Server Setup to Production

    In this tutorial, we are going to learn everything we need to know before deploying a Node app to a production server. We will start by renting a server on Digital Ocean. Then we'll configure this server, connect to it, install Nginx and configure it, pull or create our Node app, and run it as a process. As you can see, there is a lot to do and it will be an action-packed tutorial. So let's get started without wasting any time.

  • React Tutorial – Learn React and JavaScript Programming Basics with Example Code

    React is an open-source JavaScript library that helps you build user interfaces. It's a component-based, declarative, "learn once and write anywhere" tool.

  • How to Build a Solid To-Do App with React

    In this tutorial you will learn how to create a basic Solid to-do app. But what is Solid – not to be confused with SOLID? Well, it's a set of conventions and tools used to build decentralized apps. So what do I mean by decentralized? Currently, all our data is centralized in a few web platforms: Facebook, Google, and others. This has various consequences for privacy that we're all aware of, but it also endangers the principle of universality of the web: the web must be accessible to everyone.

  • Working with RESTful Web Services in JavaScript - Creating your First Web Service

    Some developers consider themselves to be server-side specialists, while others focus most of their efforts on client-side coding. The departments of IT shops often reflect those tendencies. However, that need not be the case. Thanks to the emergence of technologies like Node.js, you can write both the server and client components using essentially the same language. In this series on RESTful Web services we'll cover how to to do it all using JavaScript. Today's installment will focus on setting up a basic Web service using Node.js and the Express framework.

  • How to Install R Programming Language Tools on Linux Mint 20

    By following today’s tutorial, you will be able to install the “R” programming language on your Linux Mint 20 system instantly. However, as soon as you feel like you do not want to work with this language anymore, you can conveniently uninstall it from your system to free up your resources.

  • Using Delve to debug Go programs on Red Hat Enterprise Linux - Red Hat Developer

    Delve is now available on Red Hat Enterprise Linux (RHEL). Starting in the RHEL 8.2 and devtools-2020.2 releases, the Go language debugger Delve will be installed with the Go toolchain itself via the go-toolset package. Being tailored specifically for Go, Delve has intricate knowledge of the Go runtime and provides features and an environment not available in other debuggers. The tool aims for simplicity of use, staying out of your way as you figure out what’s going wrong with your program. Delve also offers powerful features that let you debug your Go programs as quickly as possible.

  • Python's datetime Module – How to Handle Dates in Python

    In this quick guide to Python's datetime module, you'll learn how to parse dates, extract meaningful information from dates, handle timedelta objects and much more. So without further ado let's start counting time with Python! Most programming languages provide libraries for easy handling of dates. Python offers the powerful datetime module with its many functions and lucid documentation which makes parsing dates easy.

  • Elegant bash conditionals

    The if-statement is a very basic thing, not just in bash, but in all of programming. I see them used quite a lot in shell scripts, even though in many cases they can be replaced with something much more elegant.

    In this rather short article, I'll show how control operators can be used instead. Many probably know about this, but don't realize how to use them nicely. This will help you write cleaner shell scripts in the future.

  • How to write a function in bash

    When you are writing a complex bash script (or any complex program for that matter), subdividing the functional logic of the script in smaller modules and writing/testing each module is often an effective coding strategy. A modularized bash script not only makes the script easier to understand, but also makes individual modules re-usable. In bash, such modular programming is achieved with bash functions. Even if you have little coding experience, you are probably familiar with the notion of a function in programming. A function is basically a self-contained block of code that performs a specific task via well-defined input/output interfaces. Let's find out how a bash function is written and how to use a function in bash. This bash tutorial will specifically cover how to create a bash function, how to pass arguments to a bash function, how to call a bash function, how to return a bash function, etc.

  • 5 signs you might be a Rust programmer

    I'm a fairly recent convert to Rust, which I started to learn around the end of April 2020. But, like many converts, I'm an enthusiastic evangelist. I'm also not a very good Rustacean, truth be told, in that my coding style isn't great, and I don't write particularly idiomatic Rust. I suspect this is partly because I never really finished learning Rust before diving in and writing quite a lot of code (some of which is coming back to haunt me) and partly because I'm just not that good a programmer. But I love Rust, and so should you. It's friendly—well, more friendly than C or C++; it's ready for low-level systems tasks—more so than Python, it's well-structured—more than Perl; and, best of all, it's completely open source from the design level up—much more than Java, for instance. Despite my lack of expertise, I noticed a few things that I suspect are common to many Rust enthusiasts and programmers. If you say "yes" to the following five signs (the first of which was sparked by some exciting recent news), you, too, might be a Rust programmer.

  • What Every Developer Must Know About Encoding and Unicode

    If you are coding an international app that uses multiple languages, you'll need to know about encoding. Or even if you're just curious how words end up on your screen – yep, that's encoding, too. I'll explain a brief history of encoding in this article (and I'll discuss how little standardisation there was) and then I'll talk about what we use now. I'll also cover some Computer Science theory you need to understand.

OpenSSH 8.5

OpenSSH 8.5 was released on 2021-03-03. It is available from the
mirrors listed at https://www.openssh.com/.

OpenSSH is a 100% complete SSH protocol 2.0 implementation and
includes sftp client and server support.

Once again, we would like to thank the OpenSSH community for their
continued support of the project, especially those who contributed
code or patches, reported bugs, tested snapshots or donated to the
project. More information on donations may be found at:
https://www.openssh.com/donations.html

Future deprecation notice
=========================

It is now possible[1] to perform chosen-prefix attacks against the
SHA-1 algorithm for less than USD$50K.

In the SSH protocol, the "ssh-rsa" signature scheme uses the SHA-1
hash algorithm in conjunction with the RSA public key algorithm.
OpenSSH will disable this signature scheme by default in the near
future.

Note that the deactivation of "ssh-rsa" signatures does not necessarily
require cessation of use for RSA keys. In the SSH protocol, keys may be
capable of signing using multiple algorithms. In particular, "ssh-rsa"
keys are capable of signing using "rsa-sha2-256" (RSA/SHA256),
"rsa-sha2-512" (RSA/SHA512) and "ssh-rsa" (RSA/SHA1). Only the last of
these is being turned off by default.

This algorithm is unfortunately still used widely despite the
existence of better alternatives, being the only remaining public key
signature algorithm specified by the original SSH RFCs that is still
enabled by default.

The better alternatives include:

 * The RFC8332 RSA SHA-2 signature algorithms rsa-sha2-256/512. These
   algorithms have the advantage of using the same key type as
   "ssh-rsa" but use the safe SHA-2 hash algorithms. These have been
   supported since OpenSSH 7.2 and are already used by default if the
   client and server support them.

 * The RFC8709 ssh-ed25519 signature algorithm. It has been supported
   in OpenSSH since release 6.5.

 * The RFC5656 ECDSA algorithms: ecdsa-sha2-nistp256/384/521. These
   have been supported by OpenSSH since release 5.7.

To check whether a server is using the weak ssh-rsa public key
algorithm, for host authentication, try to connect to it after
removing the ssh-rsa algorithm from ssh(1)'s allowed list:

    ssh -oHostKeyAlgorithms=-ssh-rsa user@host

If the host key verification fails and no other supported host key
types are available, the server software on that host should be
upgraded.

This release enables the UpdateHostKeys option by default to assist
the client by automatically migrating to better algorithms.

[1] "SHA-1 is a Shambles: First Chosen-Prefix Collision on SHA-1 and
    Application to the PGP Web of Trust" Leurent, G and Peyrin, T
    (2020) https://eprint.iacr.org/2020/014.pdf

Security
========

 * ssh-agent(1): fixed a double-free memory corruption that was
   introduced in OpenSSH 8.2 . We treat all such memory faults as
   potentially exploitable. This bug could be reached by an attacker
   with access to the agent socket.

   On modern operating systems where the OS can provide information
   about the user identity connected to a socket, OpenSSH ssh-agent
   and sshd limit agent socket access only to the originating user
   and root. Additional mitigation may be afforded by the system's
   malloc(3)/free(3) implementation, if it detects double-free
   conditions.

   The most likely scenario for exploitation is a user forwarding an
   agent either to an account shared with a malicious user or to a
   host with an attacker holding root access.

 * Portable sshd(8): Prevent excessively long username going to PAM.
   This is a mitigation for a buffer overflow in Solaris' PAM username
   handling (CVE-2020-14871), and is only enabled for Sun-derived PAM
   implementations.  This is not a problem in sshd itself, it only
   prevents sshd from being used as a vector to attack Solaris' PAM.
   It does not prevent the bug in PAM from being exploited via some
   other PAM application. GHPR#212


Potentially-incompatible changes
================================

This release includes a number of changes that may affect existing
configurations:

 * ssh(1), sshd(8): this release changes the first-preference signature
   algorithm from ECDSA to ED25519.

 * ssh(1), sshd(8): set the TOS/DSCP specified in the configuration
   for interactive use prior to TCP connect. The connection phase of
   the SSH session is time-sensitive and often explicitly interactive.
   The ultimate interactive/bulk TOS/DSCP will be set after
   authentication completes.

 * ssh(1), sshd(8): remove the pre-standardization cipher
   rijndael-cbc@lysator.liu.se. It is an alias for aes256-cbc before
   it was standardized in RFC4253 (2006), has been deprecated and
   disabled by default since OpenSSH 7.2 (2016) and was only briefly
   documented in ssh.1 in 2001.

 * ssh(1), sshd(8): update/replace the experimental post-quantum
   hybrid key exchange method based on Streamlined NTRU Prime coupled
   with X25519.

   The previous sntrup4591761x25519-sha512@tinyssh.org method is
   replaced with sntrup761x25519-sha512@openssh.com. Per its
   designers, the sntrup4591761 algorithm was superseded almost two
   years ago by sntrup761.

   (note this both the updated method and the one that it replaced are
   disabled by default)

 * ssh(1): disable CheckHostIP by default. It provides insignificant
   benefits while making key rotation significantly more difficult,
   especially for hosts behind IP-based load-balancers.

Changes since OpenSSH 8.4
=========================

New features
------------

 * ssh(1): this release enables UpdateHostkeys by default subject to
   some conservative preconditions:
    - The key was matched in the UserKnownHostsFile (and not in the
      GlobalKnownHostsFile).
    - The same key does not exist under another name.
    - A certificate host key is not in use.
    - known_hosts contains no matching wildcard hostname pattern.
    - VerifyHostKeyDNS is not enabled.
    - The default UserKnownHostsFile is in use.

   We expect some of these conditions will be modified or relaxed in
   future.

 * ssh(1), sshd(8): add a new LogVerbose configuration directive for
   that allows forcing maximum debug logging by file/function/line
   pattern-lists.

 * ssh(1): when prompting the user to accept a new hostkey, display
   any other host names/addresses already associated with the key.

 * ssh(1): allow UserKnownHostsFile=none to indicate that no
   known_hosts file should be used to identify host keys.

 * ssh(1): add a ssh_config KnownHostsCommand option that allows the
   client to obtain known_hosts data from a command in addition to
   the usual files.

 * ssh(1): add a ssh_config PermitRemoteOpen option that allows the
   client to restrict the destination when RemoteForward is used
   with SOCKS.

 * ssh(1): for FIDO keys, if a signature operation fails with a
   "incorrect PIN" reason and no PIN was initially requested from the
   user, then request a PIN and retry the operation. This supports
   some biometric devices that fall back to requiring PIN when reading
   of the biometric failed, and devices that require PINs for all
   hosted credentials.

 * sshd(8): implement client address-based rate-limiting via new
   sshd_config(5) PerSourceMaxStartups and PerSourceNetBlockSize
   directives that provide more fine-grained control on a per-origin
   address basis than the global MaxStartups limit.

Bugfixes
--------

 * ssh(1): Prefix keyboard interactive prompts with "(user@host)" to
   make it easier to determine which connection they are associated
   with in cases like scp -3, ProxyJump, etc. bz#3224

 * sshd(8): fix sshd_config SetEnv directives located inside Match
   blocks. GHPR#201

 * ssh(1): when requesting a FIDO token touch on stderr, inform the
   user once the touch has been recorded.

 * ssh(1): prevent integer overflow when ridiculously large
   ConnectTimeout values are specified, capping the effective value
   (for most platforms) at 24 days. bz#3229

 * ssh(1): consider the ECDSA key subtype when ordering host key
   algorithms in the client.

 * ssh(1), sshd(8): rename the PubkeyAcceptedKeyTypes keyword to
   PubkeyAcceptedAlgorithms. The previous name incorrectly suggested
   that it control allowed key algorithms, when this option actually
   specifies the signature algorithms that are accepted. The previous
   name remains available as an alias. bz#3253

 * ssh(1), sshd(8): similarly, rename HostbasedKeyTypes (ssh) and
   HostbasedAcceptedKeyTypes (sshd) to HostbasedAcceptedAlgorithms.

 * sftp-server(8): add missing lsetstat@openssh.com documentation
   and advertisement in the server's SSH2_FXP_VERSION hello packet.

 * ssh(1), sshd(8): more strictly enforce KEX state-machine by
   banning packet types once they are received. Fixes memleak caused
   by duplicate SSH2_MSG_KEX_DH_GEX_REQUEST (oss-fuzz #30078).

 * sftp(1): allow the full range of UIDs/GIDs for chown/chgrp on 32bit
   platforms instead of being limited by LONG_MAX. bz#3206

 * Minor man page fixes (capitalization, commas, etc.) bz#3223

 * sftp(1): when doing an sftp recursive upload or download of a
   read-only directory, ensure that the directory is created with
   write and execute permissions in the interim so that the transfer
   can actually complete, then set the directory permission as the
   final step. bz#3222

 * ssh-keygen(1): document the -Z, check the validity of its argument
   earlier and provide a better error message if it's not correct.
   bz#2879

 * ssh(1): ignore comments at the end of config lines in ssh_config,
   similar to what we already do for sshd_config. bz#2320

 * sshd_config(5): mention that DisableForwarding is valid in a
   sshd_config Match block. bz3239

 * sftp(1): fix incorrect sorting of "ls -ltr" under some
   circumstances. bz3248.

 * ssh(1), sshd(8): fix potential integer truncation of (unlikely)
   timeout values. bz#3250

 * ssh(1): make hostbased authentication send the signature algorithm
   in its SSH2_MSG_USERAUTH_REQUEST packets instead of the key type.
   This make HostbasedAcceptedAlgorithms do what it is supposed to -
   filter on signature algorithm and not key type.

Portability
-----------

 * sshd(8): add a number of platform-specific syscalls to the Linux
   seccomp-bpf sandbox. bz#3232 bz#3260

 * sshd(8): remove debug message from sigchld handler that could cause
   deadlock on some platforms. bz#3259

 * Sync contrib/ssh-copy-id with upstream.

 * unittests: add a hostname function for systems that don't have it.
   Some systems don't have a hostname command (it's not required by
   POSIX). The do have uname -n (which is), but not all of those have
   it report the FQDN.

Checksums:
==========

 - SHA1 (openssh-8.5.tar.gz) = 04cae43c389fb411227c01219e4eb46e3113f34e
 - SHA256 (openssh-8.5.tar.gz) = 5qB2CgzNG4io4DmChTjHgCWqRWvEOvCKJskLdJCz+SU=

 - SHA1 (openssh-8.5p1.tar.gz) = 72eadcbe313b07b1dd3b693e41d3cd56d354e24e
 - SHA256 (openssh-8.5p1.tar.gz) = 9S8/QdQpqpkY44zyAK8iXM3Y5m8FLaVyhwyJc3ZG7CU=

Please note that the SHA256 signatures are base64 encoded and not
hexadecimal (which is the default for most checksum tools). The PGP
key used to sign the releases is available from the mirror sites:
https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/RELEASE_KEY.asc

Please note that the OpenPGP key used to sign releases has been
rotated for this release. The new key has been signed by the previous
key to provide continuity.

Reporting Bugs:
===============

- Please read https://www.openssh.com/report.html
  Security bugs should be reported directly to openssh@openssh.com
Read more