Bob Beck

- OpenBSD 5.1 RELEASED -------------------------------------------------

May 1, 2012.

We are pleased to announce the official release of OpenBSD 5.1.
This is our 31st release on CD-ROM (and 31th via FTP).  We remain
proud of OpenBSD's record of more than ten years with only two remote
holes in the default install.

As in our previous releases, 5.1 provides significant improvements,
including new features, in nearly all areas of the system:

- Improved hardware support, including:
   o umsm(4) supports additional mobile broadband devices.
   o Non-GigE ale(4) devices can now establish link to a GigE link partner.
   o Support for Intel 82580 has been added to em(4).
   o Support for MegaRAID 9240 has been added to mfi(4).
   o Support for Nuvoton NCT6776F has been added to lm(4).
   o Support for Centrino Advanced-N 6205 has been added to iwn(4).
   o Support for SiS 1182/1183 SATA has been added to pciide(4).
   o Support for Synaptics touch pads through the synaptics(4) X.Org
     input driver is now enabled by default.
   o Support for Intel Sandy Bridge integrated graphics cards has been
     added to the intel(4) X.Org driver.
   o Assembler implementation of the AES-GCM mode for new Intel and
     future AMD CPUs has been added.
   o usb(4) probes bus after resume, improves functionality for some laptops.

- Generic network stack improvements:
   o RFC4638 MTU negotiation for pppoe(4).
   o npppdctl(8) replaced with npppctl(8), written from scratch.
     Includes support for IPv6 as tunnel source address.
   o Improve performance (throughput and loss rate) for PPTP, pppd(8)
     or L2TP(/IPsec) on unstable latency networks (eg mobile).
   o Improved IPv6 fragment handling.
   o Many robustness improvements for IEEE 802.11 (particularly hostap).
   o Improved vlan priority support, including mapping to interface queues.
   o Initial rdomains support for IPv6.
   o Robustness improvements for carp(4).
   o Various IPv6 and rdomain related improvements for carp(4).

- Routing daemons and other userland network improvements:
   o fstat(8) now displays routing table ID and socket-splicing information
     and ps can display routing table ID.
   o traceroute(8) and traceroute6(8) can look up ASNs for each hop.
   o snmpd(8) adds a MIB to show statistics for carp(4) interfaces.
   o bgpctl(8) parses and display MRT routing table dumps.
   o ntpd(8) supports multiple rdomains.
   o When ospfd(8) detects route socket overflow, it now delays before
     it reloads the fib.
   o Improved and more consistent ToS support in various network
     tools (tcpbench(8), nc(8), ping(8), traceroute(8)).
   o Initial inport of login_yubikey(8) for logging in using yubikeys.

- pf(4) improvements:
   o One-shot rule support for pf(4), for use with proxies via anchors.
   o NAT64 support in PF using the af-to keyword.
   o Much improved IPv6 fragment handling.
   o Various enhancements with ICMP and especially ICMPv6 states
   o Improved IPv6 Neighbor Discovery and Multicast Listener Discovery handling.
   o pfctl(8) now prints port numbers instead of service names by default.
   o Netflow v9 and ipfix support for pflow(4).
   o Many pfsync(4) fixes and improvements including jumbo frames and
     automatically requesting a bulk update after a physical interface
     comes online.

- Assorted improvements:
   o Improved locale support.
   o Support for MSG_NOSIGNAL.
   o KERN_PROC_CWD sysctl(3) for fetching the path to a process's
     working directory.
   o Improved fnmatch(3), glob(3), and regcomp(3) implementations
     to resist DoS attacks.
   o Lots of HISTORY and AUTHORS information added to manpages.
   o Improved checking of file-offset wraparound.
   o pwrite(2)/pwritev(2) now correctly by ignored O_APPEND.
   o Improved conformance of header files with standards.
   o Improved cancelation support in both user-threads (libpthread)
     and rthreads.
   o Improved correctness of execing, coredumping, signal delivery,
     alternate signal stacks, blocking socket accepts(), mutexes
     and condition variables, per-thread errno, symbol binding,
     and ktracing when rthreads are in use.
   o Architecture-independent kernel support for thread-control-block
     handling for rthreads.
   o Small improvements to Linux compat (only available on i386).
   o Multiple bugs have been fixed in the Intel 10Gb driver ix(4).
   o softraid(4) now supports a concatenating discipline.
   o On amd64, i386, and sparc64, the root filesystem can reside in
     a softraid(4) volume. The kernel needs to be booted from a
     non-softraid partition.
   o On amd64, the system can be booted from a softraid(4) RAID1 volume.
   o aucat(1) adds a "device number" component in sndio(7) device
     names, allowing a single aucat instance to handle all audio
     and MIDI services.
   o Built-in sndiod(1) sound daemon now uses default rate 48kHz and
     the default block size 10ms. These settings ensure video players
     and programs using MTC are smooth by default.
   o Many updates to smtpd(8): a new scheduler_backend API introduced,
     more MIME 1.0 support added, new filter callbacks for network events,
     improved DNS error reporting and envelope handling, and the
     purge/ directory is now cleared via a privilege-separated child.
   o tmux(1) is extended to support a larger history, minimizes redundant
     log messages and does some code reordering for more local and less
     global variables. Support is added for the ESC[s and ESC[u
     save/restore cursor-position key sequences. $HOME (or ~) may now
     be used as default-path in tmux.conf.
   o Enhanced cwm(1) event support, added {r,}cycleingroup to cycle
     through clients belonging to the same group as the active client,
     simplified color initialization.
   o The mg(1) emacs-like editor: now uses absolute filenames while
     pushing and popping off the stack. In dired mode: corrected
     cursor movements and added missing keybindings.

- OpenSSH 6.0:
    o New features:
      - ssh-keygen(1): add optional checkpoints for moduli screening.
      - ssh-add(1): new -k option to load plain keys (skipping
        certificates).
      - sshd(8): add wildcard support to PermitOpen, allowing things
        like "PermitOpen localhost:*". (bz#1857)
      - ssh(1): support for cancelling local and remote port forwards
        via the multiplex socket. Use "ssh -O cancel -L xx:xx:xx -R
        yy:yy:yy user@host" to request the cancellation of the
        specified forwardings.
      - support cancellation of local/dynamic forwardings from ~C commandline.
    o The following significant bugs have been fixed in this release:
      - ssh(1): ensure that $DISPLAY contains only valid characters
        before using it to extract xauth data so that it can't be
        used to play local shell metacharacter games.
      - ssh(1): unbreak remote port forwarding with dynamic allocated
        listen ports.
      - scp(1): uppress adding '--' to remote commandlines when the
        first argument does not start with '-'. Saves breakage on
        some difficult-to-upgrade embedded/router platforms.
      - ssh(1) and sshd(8): fix typo in IPQoS parsing: there is
        no "AF14" class, but there is an "AF21" class.
      - ssh(1) and sshd(8): do not permit SSH2_MSG_SERVICE_REQUEST/ACCEPT
        during rekeying.
      - ssh(1): skip attempting to create ~/.ssh when -F is passed.
      - sshd(8): unbreak stdio forwarding when ControlPersist is
        in use. (bz#1943)
      - sshd(8): send tty break to pty master instead of (probably
        already closed) slave side. (bz#1859)
      - sftp(1): silence error spam for "ls */foo" in directory
        with files. (bz#1683)
      - Fixed a number of memory and file descriptor leaks.

- Over 7,000 ports, major performance and stability improvements in
   the package build process
   o Downloading of distfiles is simpler, can resume interrupted
     download, discover file moves, and expire old files. Distfiles
     mirror sites now use the new and improved method.
   o Dependency handling during ports build and package creation is
     at least twice as fast, twenty times as fast in pathological
     cases. This also affects user scripts such as out-of-date
   o More checks are done during package builds, for increased
     user friendliness
   o The long term process of documenting the infrastructure
     is now 100% done.
   o The distributed ports builder (dpb) can now clean up old
     dependencies, thus helping package builds be more reproducible.
     This found tens of hidden build dependencies in the ports tree already.
   o The semantics of pkg_add -a have been nailed down and a few minor
     bugs have been fixed.
   o The arch-dependent issues are better classified, leading to
     better builds on old architectures in some complicated cases.
     In particular, dpb explicitly purges from memory info about
     packages it cannot build and stuff that depends on it,
     leading to better life on sparc and vax which have very small
     data-size limits.
   o dpb recognizes full builds and trims some duplicate package builds

- Many pre-built packages for each architecture:
    o i386: 7229                      o sparc64: 6599
    o alpha: 5943                     o sh: 2459
    o amd64: 7181                     o powerpc: 6852
    o sparc: 4152                     o arm: 5536
    o hppa: 6159                      o vax: 2199
    o mips64: 5785                    o mips64el: 5807

- Some highlights:
    o Gnome 3.2.1                     o KDE 3.5.10
    o Xfce 4.8.3                      o MySQL 5.1.60
    o PostgreSQL 9.1.2                o Postfix 2.8.8
    o OpenLDAP 2.3.43 and 2.4.26      o GHC 7.0.4
    o Mozilla Firefox 3.5.19, 3.6.25 and 9.0.1
    o Mozilla Thunderbird 9.0.1       o LibreOffice 3.4.5.2
    o Emacs 21.4, 22.3 and 23.4       o Vim 7.3.154
    o PHP 5.2.17 and 5.3.10           o Python 2.5.4, 2.7.1 and 3.2.2
    o Ruby 1.8.7.357 and 1.9.3.0      o Tcl 8.5.11
    o Jdk 1.7                         o Mono 2.10.6
    o Chromium 16.0.912.77            o Groff 1.21

- As usual, steady improvements in manual pages and other documentation.
    o Base system and Xenocara manuals are now installed as source code,
      making grep(1) more useful in /usr/share/man/ and /usr/X11R6/man/.
    o If both formatted and source versions of manuals are installed,
      man(1) automatically displays the newer version of each page.

- The system includes the following major components from outside suppliers:
    o Xenocara (based on X.Org 7.6 with xserver 1.11.4 + patches,
      freetype 2.4.8, fontconfig 2.8.0, Mesa 7.10.3, xterm 276,
      xkeyboard-config 2.5 and more)
    o Gcc 4.2.1 (+patches), 3.3.5 (+ patches) and 2.95.3 (+ patches)
    o Perl 5.12.2 (+ patches)
    o Our improved and secured version of Apache 1.3, with SSL/TLS
      and DSO support
    o OpenSSL 1.0.0f (+ patches)
    o Sendmail 8.14.5, with libmilter
    o Bind 9.4.2-P2 (+ patches)
    o Lynx 2.8.7rel.2 with HTTPS and IPv6 support (+ patches)
    o Sudo 1.7.2p8
    o Ncurses 5.7
    o Heimdal 0.7.2 (+ patches)
    o Arla 0.35.7
    o Binutils 2.15 (+ patches)
    o Gdb 6.3 (+ patches)
    o Less 444 (+ patches)
    o Awk Aug 10, 2011 version

If you'd like to see a list of what has changed between OpenBSD 5.0
and 5.1, look at

         http://www.OpenBSD.org/plus51.html

Even though the list is a summary of the most important changes
made to OpenBSD, it still is a very very long list.
We provide patches for known security threats and other important
issues discovered after each CD release.  As usual, between the
creation of the OpenBSD 5.1 FTP/CD-ROM binaries and the actual 5.1
release date, our team found and fixed some new reliability problems
(note: most are minor and in subsystems that are not enabled by
default).  Our continued research into security means we will find
new security problems -- and we always provide patches as soon as
possible.  Therefore, we advise regular visits to

         http://www.OpenBSD.org/security.html
and
         http://www.OpenBSD.org/errata.html

Security patch announcements are sent to the security-announce*******
mailing list.  For information on OpenBSD mailing lists, please see:

         http://www.OpenBSD.org/mail.html
OpenBSD 5.1 is also available on CD-ROM.  The 3-CD set costs $50 CDN and
is available via mail order and from a number of contacts around the
world.  The set includes a colourful booklet which carefully explains the
installation of OpenBSD.  A new set of cute little stickers is also
included (sorry, but our FTP mirror sites do not support STP, the Sticker
Transfer Protocol).  As an added bonus, the second CD contains an audio
track, a song entitled "Bug Busters".  MP3 and OGG versions of
the audio track can be found on the first CD.

Lyrics (and an explanation) for the songs may be found at:

     http://www.OpenBSD.org/lyrics.html#51

Profits from CD sales are the primary income source for the OpenBSD
project -- in essence selling these CD-ROM units ensures that OpenBSD
will continue to make another release six months from now.

The OpenBSD 5.1 CD-ROMs are bootable on the following four platforms:

  o i386
  o amd64
  o macppc
  o sparc64

(Other platforms must boot from floppy, network, or other method).

For more information on ordering CD-ROMs, see:

         http://www.OpenBSD.org/orders.html

The above web page lists a number of places where OpenBSD CD-ROMs
can be purchased from.  For our default mail order, go directly to:

         https://https.OpenBSD.org/cgi-bin/order

All of our developers strongly urge you to buy a CD-ROM and support
our future efforts.  Additionally, donations to the project are
highly appreciated, as described in more detail at:

         http://www.OpenBSD.org/goals.html#funding
For those unable to make their contributions as straightforward gifts,
the OpenBSD Foundation ( http://www.openbsdfoundation.org ) is a Canadian
not-for-profit corporation that can accept larger contributions and
issue receipts.  In some situations, their receipt may qualify as a
business expense write-off, so this is certainly a consideration for
some organizations or businesses.  There may also be exposure benefits
since the Foundation may be interested in participating in press releases.
In turn, the Foundation then uses these contributions to assist OpenBSD's
infrastructure needs.  Contact the foundation directors at
directors*******for more information.
The OpenBSD distribution companies also sell tshirts and polo shirts.
And our users like them, too.  We have a variety of shirts available,
with the new and old designs, from our web ordering system at, as
described above.
If you choose not to buy an OpenBSD CD-ROM, OpenBSD can be easily
installed via FTP or HTTP downloads.  Typically you need a single
small piece of boot media (e.g., a boot floppy) and then the rest
of the files can be installed from a number of locations, including
directly off the Internet.  Follow this simple set of instructions
to ensure that you find all of the documentation you will need
while performing an install via FTP or HTTP.  With the CD-ROMs,
the necessary documentation is easier to find.

1) Read either of the following two files for a list of ftp/http
   mirrors which provide OpenBSD, then choose one near you:

         http://www.OpenBSD.org/ftp.html
         ftp://ftp.OpenBSD.org/pub/OpenBSD/5.1/ftplist

   As of Nov 1, 2011, the following ftp mirror sites have the 5.1 release:

         ftp://ftp.eu.openbsd.org/pub/OpenBSD/5.1/        Stockholm, Sweden
         ftp://ftp.bytemine.net/pub/OpenBSD/5.1/          Oldenburg, Germany
         ftp://ftp.ch.openbsd.org/pub/OpenBSD/5.1/        Zurich, Switzerland
         ftp://ftp.fr.openbsd.org/pub/OpenBSD/5.1/        Paris, France
         ftp://ftp5.eu.openbsd.org/pub/OpenBSD/5.1/       Vienna, Austria
         ftp://mirror.aarnet.edu.au/pub/OpenBSD/5.1/      Brisbane, Australia
         ftp://ftp.usa.openbsd.org/pub/OpenBSD/5.1/       CO, USA
         ftp://ftp5.usa.openbsd.org/pub/OpenBSD/5.1/      CA, USA
         ftp://obsd.cec.mtu.edu/pub/OpenBSD/5.1/          Michigan, USA

        The release is also available at the master site:

         ftp://ftp.openbsd.org/pub/OpenBSD/5.1/           Alberta, Canada

        However it is strongly suggested you use a mirror.

   Other mirror sites may take a day or two to update.

2) Connect to that ftp mirror site and go into the directory
   pub/OpenBSD/5.1/ which contains these files and directories.
   This is a list of what you will see:

        ANNOUNCEMENT     armish/          mvme68k/         sparc64/
        Changelogs/      ftplist          mvme88k/         src.tar.gz
        HARDWARE         hp300/           packages/        sys.tar.gz
        PACKAGES         hppa/            ports.tar.gz     tools/
        PORTS            i386/            root.mail        vax/
        README           landisk/         sgi/             xenocara.tar.gz
        alpha/           mac68k/          socppc/          zaurus/
        amd64/           macppc/          sparc/

   It is quite likely that you will want at LEAST the following
   files which apply to all the architectures OpenBSD supports.

        README          - generic README
        HARDWARE        - list of hardware we support
        PORTS           - description of our "ports" tree
        PACKAGES        - description of pre-compiled packages
        root.mail       - a copy of root's mail at initial login.
                          (This is really worthwhile reading).

3) Read the README file.  It is short, and a quick read will make
   sure you understand what else you need to fetch.

4) Next, go into the directory that applies to your architecture,
   for example, i386.  This is a list of what you will see:

        INSTALL.i386    cd51.iso        floppyB51.fs    pxeboot*
        INSTALL.linux   cdboot*         floppyC51.fs    xbase51.tgz
        MD5             cdbr*           game51.tgz      xetc51.tgz
        base51.tgz      cdemu51.iso     index.txt       xfont51.tgz
        bsd*            comp51.tgz      install51.iso   xserv51.tgz
        bsd.mp*         etc51.tgz       man51.tgz       xshare51.tgz
        bsd.rd*         floppy51.fs     misc51.tgz

   If you are new to OpenBSD, fetch _at least_ the file INSTALL.i386
   and the appropriate floppy*.fs or install51.iso files.  Consult the
   INSTALL.i386 file if you don't know which of the floppy images
   you need (or simply fetch all of them).

   If you use the install51.iso file (roughly 250MB in size), then you
   do not need the various *.tgz files since they are contained on that
   one-step ISO-format install CD.

5) If you are an expert, follow the instructions in the file called
   README; otherwise, use the more complete instructions in the
   file called INSTALL.i386.  INSTALL.i386 may tell you that you
   need to fetch other files.

6) Just in case, take a peek at:

         http://www.OpenBSD.org/errata.html

   This is the page where we talk about the mistakes we made while
   creating the 5.1 release, or the significant bugs we fixed
   post-release which we think our users should have fixes for.
   Patches and workarounds are clearly described there.

Note: If you end up needing to write a raw floppy using Windows,
      you can use "fdimage.exe" located in the pub/OpenBSD/5.1/tools
      directory to do so.
X.Org has been integrated more closely into the system.  This release
contains X.Org 7.6.  Most of our architectures ship with X.Org, including
amd64, sparc, sparc64 and macppc.  During installation, you can install
X.Org quite easily.  Be sure to try out xdm(1) and see how we have
customized it for OpenBSD.
The OpenBSD ports tree contains automated instructions for building
third party software.  The software has been verified to build and
run on the various OpenBSD architectures.  The 5.1 ports collection,
including many of the distribution files, is included on the 3-CD
set.  Please see the PORTS file for more information.

Note: some of the most popular ports, e.g., the Apache web server
and several X applications, come standard with OpenBSD.  Also, many
popular ports have been pre-compiled for those who do not desire
to build their own binaries (see BINARY PACKAGES, below).
A large number of binary packages are provided.  Please see the PACKAGES
file ( ftp://ftp.OpenBSD.org/pub/OpenBSD/5.1/PACKAGES ) for more details.
The CD-ROMs contain source code for all the subsystems explained
above, and the README ( ftp://ftp.OpenBSD.org/pub/OpenBSD/5.1/README )
file explains how to deal with these source files.  For those who
are doing an FTP install, the source code for all four subsystems
can be found in the pub/OpenBSD/5.1/ directory:

        xenocara.tar.gz     ports.tar.gz   src.tar.gz     sys.tar.gz
Ports tree and package building by Jasper Lievisse Adriaanse,
Landry Breuil, Michael Erdely, Stuart Henderson, Peter Hessler,
Paul Irofti, Antoine Jacoutot, Robert Nagy, and Christian Weisgerber.
System builds by Theo de Raadt, Mark Kettenis, and Miod Vallat.
X11 builds by Todd Fries and Miod Vallat.  ISO-9660 filesystem
layout by Theo de Raadt.

We would like to thank all of the people who sent in bug reports, bug
fixes, donation cheques, and hardware that we use.  We would also like
to thank those who pre-ordered the 5.1 CD-ROM or bought our previous
CD-ROMs.  Those who did not support us financially have still helped
us with our goal of improving the quality of the software.

Our developers are:

    Alexander Bluhm, Alexander Hall, Alexander Schrijver,
    Alexander Yurchenko, Alexandr Shadchin, Alexandre Ratchov,
    Anil Madhavapeddy, Anthony J. Bentley, Antoine Jacoutot,
    Ariane van der Steldt, Austin Hook, Benoit Lecocq, Bernd Ahlers,
    Bob Beck, Bret Lambert, Bryan Steele, Camiel Dobbelaar,
    Can Erkin Acar, Charles Longeau, Chris Kuethe, Christian Weisgerber,
    Christiano F. Haesbaert, Claudio Jeker, Dale Rahn, Damien Bergamini,
    Damien Miller, Darren Tucker, David Coppa, David Gwynne, David Hill,
    David Krause, Edd Barrett, Eric Faurot, Federico G. Schwindt,
    Felix Kronlage, Gilles Chehade, Giovanni Bechis, Gleydson Soares,
    Henning Brauer, Ian Darwin, Igor Sobrado, Ingo Schwarze,
    Jacek Masiulaniec, Jakob Schlyter, Janne Johansson, Jason George,
    Jason McIntyre, Jason Meltzer, Jasper Lievisse Adriaanse,
    Jeremy Evans, Jim Razmus II, Joel Knight, Joel Sing, Joerg Zinke,
    Jolan Luff, Jonathan Armani, Jonathan Gray, Jonathan Matthew,
    Jordan Hargrave, Joshua Elsasser, Joshua Stein, Kenji Aoyama,
    Kenneth R Westerback, Kevin Lo, Kevin Steves, Kurt Miller,
    Landry Breuil, Laurent Fanis, Luke Tymowski, Marc Espie,
    Marco Pfatschbacher, Marcus Glocker, Mark Kettenis, Mark Lumsden,
    Mark Uemura, Markus Friedl, Martin Pieuchot, Martynas Venckus,
    Mats O Jansson, Matthew Dempsky, Matthias Kilian, Matthieu Herrb,
    Michael Erdely, Mike Belopuhov, Mike Larkin, Miod Vallat,
    Nayden Markatchev, Nicholas Marriott, Nick Holland, Nigel Taylor,
    Nikolay Sturm, Okan Demirmen, Otto Moerbeek, Owain Ainsworth,
    Pascal Stumpf, Paul de Weerd, Paul Irofti, Peter Hessler,
    Peter Valchev, Philip Guenther, Pierre-Emmanuel Andre,
    Pierre-Yves Ritschard, Remi Pointel, Reyk Floeter, Robert Nagy,
    Ryan Freeman, Ryan Thomas McBride, Sasano, Sebastian Benoit,
    Sebastian Reitenbach, Simon Bertrang, Simon Perreault,
    Stefan Sperling, Stephan A. Rickauer, Steven Mestdagh,
    Stuart Cassoff, Stuart Henderson, Takuya Asada, Ted Unangst,
    Theo de Raadt, Thordur I Bjornsson, Tobias Stoeckmann,
    Tobias Weingartner, Todd C. Miller, Todd Fries, Uwe Stuehler,
    Will Maier, William Yodlowsky, Yasuoka Masahiko, Yojiro Uo

------------------------------------------------------------------------
May 1, 2011.

We are pleased to announce the official release of OpenBSD 4.9.
This is our 29th release on CD-ROM (and 30th via FTP).  We remain
proud of OpenBSD's record of more than ten years with only two remote
holes in the default install.

As in our previous releases, 4.9 provides significant improvements,
including new features, in nearly all areas of the system:

- New/extended platforms:
    o OpenBSD/amd64 and OpenBSD/i386:
      - Enabled NTFS by default (read-only) on GENERIC kernels.
      - Enabled the vmt(4) driver by default for VMWare tools support
        as a guest.
      - SMP kernels can now boot on machines with up to 64 cores.
      - Maximum allocation size for i386 bumped to 2G.
      - Handle >16 disks when searching for kernel boot device.
      - Added support for AES-NI instructions found in recent Intel processors.
      - Further improvements in suspend and resume.
      - Processes are now switched to TSS per cpu on the amd64 platform,
        resulting in removal of the old limit of ~4000 processes.
    o OpenBSD/hppa:
      - Multiprocessor support.
    o OpenBSD/loongson and OpenBSD/sgi:
      - All MIPS64 based platforms now use MI softfloat code, which implements
        all MIPS IV specified floating point operations.
    o OpenBSD/sparc64:
      - The vdsp(4) driver now supports the vDisk 1.1 protocol, allowing
        Solaris to run on top of an OpenBSD control domain.

- Improved hardware support, including:
    o New vte(4) driver for RDC R6040 10/100 Ethernet devices.
    o New rdcphy(4) driver for RDC Semiconductor R6040 10/100 Ethernet PHY.
    o New rsu(4) driver for Realtek RTL8188SU/RTL8191SU/RTL8192SU USB
      IEEE 802.11b/g/n wireless devices.
    o New urtwn(4) driver for Realtek RTL8188CU/RTL8192CU USB IEEE
      802.11b/g/n wireless devices.
    o New utwitch(4) driver for YUREX USB twitch/jiggle of knee sensor.
    o Support for AR9271, AR9280+AR7010 and AR9287+AR7010 USB IEEE
      802.11a/g/n wireless adapters has been added to athn(4).
    o Support for 82583V has been added to em(4).
    o Support for Yukon 88E8059 has been added to msk(4).
    o Support for SiS191 has been added to se(4).
    o Support for SAS2004 has been added to mpii(4).
    o Support for NVIDIA MCP89 SATA has been added to pciide(4).
    o Support for Mobility Radeon HD 4200 has been added to radeondrm(4).
    o pms(4) support has been significantly reworked and expanded.
    o MCLGETI support has been added to xl(4).
    o Support for low latency interrupt modulation has been added to ix(4).
    o Port multiplier support has been added to ahci(4) and sili(4).
    o Support for Sun XVR-300 graphics has been added to radeonfb(4).
    o Added workaround for BCM5906 A0/1/2 controller silicon bug in bge(4).
    o ugen(4) can now be attached along with other drivers to
      multifunction devices.
    o umodem(4) now supports more devices.
    o umsm(4) now supports more mobile broadband devices.
    o Support for more image processing controls was added to uvideo(4).

- Generic network stack improvements:
    o Reworking of the MCLGETI livelock algorithm to improve forwarding
      and host performance under high network load.
    o Added support for socket splicing; sockets can be temporarily
      connected so that the kernel moves data without userland intervention.
      This will be used by relayd(8) in the next release.
    o Added AES-GCM support for IPsec.
    o Added automatic send and receive buffer scaling for TCP.
    o Added wpakey option to ifconfig(8) replacing wpa-psk(8).
    o TCP acknowledgments are no longer delayed on the loopback interface.
    o Network livelock counters are now exported via sysctl(3).
    o A radix tree sorting bug was fixed, which results in significant
      improvements to IPsec performance under certain conditions.
    o tcpdump(8) now decodes Multicast DNS (mDNS) traffic.
    o Wake on Lan support has been added to arp(8).
    o Enabled MPLS and mpe(4) by default on GENERIC kernels.
    o Added a mpls option to ifconfig(8) to enable MPLS on a per
      interface basis replacing the global sysctl knob.

- OpenBGPD, OpenOSPFD and other routing daemon improvements:
    o bgpd(8) handles various message encoding errors more gracefully now.
    o Notification messages are now logged in bgpd(8).
    o ospfd(8) will now correctly redistribute overlapping routes.
    o ospfctl(8) now prints the LSDB checksum in the show summary output
      for quick verification that two LSDBs are in sync.
    o Fixed ldpd(8)'s message parser to work on all architectures and
      more LDP messages are now implemented.
    o Various improvements in ospf6d(8).

- pf(4) improvements:
    o The logging subsystem has been largely rewritten, now logging the
      translated addresses again instead of the original ones.
    o match log rules cause a log on the fly, showing the packet exactly
      as pf(4) sees it at the moment of evaluating that rule. A packet
      can also be logged more than once now.
    o match log(matches) rules allow the further rule matching to be traced.
    o pflog(4) now includes the original addresses and ports for packets
      that have been rewritten. This is also displayed by tcpdump(8).

- IPsec stack audit was performed, resulting in:
    o Several potential security problems have been identified and fixed.
    o ARC4 based PRNG code was audited and revamped.
    o New explicit_bzero kernel function was introduced to prevent a
      compiler from optimizing bzero calls away.

- SCSI improvements:
    o Improved safety when detaching SCSI devices by waiting for the
      completion of pending commands.
    o Improved hotplug support on mpi(4) and mpii(4).
    o Continued iopoolification of SCSI drivers, notably on umass(4)
      which improves the reliability and performance of multi-LUN devices.
    o Added vscsi(4), a driver for userland handling of SCSI device commands.
    o Added iscsid(8), an iSCSI initiator.
    o Forcibly restrict devices incapable of tagged I/O to executing one
      command at a time.
    o Discover and honour read-only status of sd(4) devices.
    o Improve st(4) handling of I/O residual information.
    o sd(4) devices that can only execute one command at a time (e.g. USB)
      will now be allowed to spin up if necessary.
    o cd(4) will now attach CDROM devices identified as non-removable.

- Assorted improvements:
    o Enabled wide character support in ncurses(3).
    o Added nsd(8), an authoritative name server implementation.
    o Disklabel UID support improved and added to more utilities.
    o rarpd(8) now accepts a list of interfaces to listen on.
    o dhclient(8) now accepts 'egress' as an interface name, meaning
      whichever interface is marked as being in the 'egress' group.
    o dhcpd(8) no longer listens on interfaces without a broadcast
      address (e.g. pflog(4)).
    o who(1) now displays as much of the hostname as fits on the line.
    o tcpdump(8) now correctly handles 'net' primitives when processing
      pflog(4) traffic.
    o fdisk(8) now respects failure to read the MBR.
    o fdisk(8) will no longer infinitely loop when encountering an
      improperly constructed EBR.
    o disklabel(8) no longer reuses information from a failed partition
      addition on the next addition of the same partition.
    o Many unused and obsolete disktab(5) entries removed.
    o Enabled X11 autoconfiguration on sparc and sparc64.
    o Implement attribute syntax from RFC4517 and support bsdauth in ldapd(8).
    o New video(1) utility which can record or display images from video(4).
    o httpd(8) mod_headers now handles apache2 style RequestHeader directives.
    o UNIX-domain datagram socket support has been added to nc(1) (-uU option).
    o Added support for terabyte units in disklabel(8).
    o loongson and sgi platforms have been switched over to gcc4.
    o ddb cpu support was added to the sgi platform.
    o Fast path TLB miss handling was added to the landisk platform,
      resulting in a 44-50% gain in performance.
    o PCIe extended configuration space can now be viewed using
      pcidump(8) (-xxx option).
    o The number of spurious IPIs has been decreased on the amd64 platform,
      resulting in improved performance.
    o Numerous improvements and bug fixes to tmux(1).
    o Considerable robustness and interoperability improvements in the
      IKEv2 daemon iked(8).
    o Skipjack and libdes were retired from the system. CAST-128
      implementation was also removed from libc.
    o Removed some races in the USB subsystem, substantially increasing
      reliability.
    o Added a few more compat_linux(8) system calls to make it possible
      for newer versions of applications, such as Skype, to execute.
    o OpenBSD-specific package documentation is now centralised
      in /usr/local/share/doc/pkg-readmes.

- Install/Upgrade process changes:
    o Fixed the hppa CD installation process.
    o Added some more free firmwares to the CD media that could fit them.
    o Make the macppc upgrade script update the boot blocks (oddly, this
      had been broken a very long time and no one noticed).
    o Teach the install script about the configuration of 802.11 interfaces.
      Visible networks can be listed, and even configured for WPA.
    o The install script now passes collected entropy better to the
      system which is booted next.
    o Upgrade now defaults to checking only the root filesystem.
    o Upgrade no longer checks filesystems with a fs_passno of 0.
    o Upgrade now asks if it should proceed even if one or more
      filesystem mounts fail.
    o Installer now configures ntpd(8) to use all provided time source IPs.

- New rc.d(8) for starting, stopping and reconfiguring package daemons:
    o The rc.subr(8) framework allows for easy creation of rc scripts.
    o Only a handful of packages have migrated for now.
    o rc.local can still be used instead of or in addition to rc.d(8).

- OpenSSH 5.5:
    o New features:
      - Implement Elliptic Curve Cryptography modes for key exchange (ECDH)
        and host/user keys (ECDSA) as specified by RFC5656. ECDH and ECDSA
        offer better performance than plain DH and DSA at the same equivalent
        symmetric key length, as well as much shorter keys.
      - sftp(1) and sftp-server(8): add a protocol extension to support a
        hard link operation. It is available through the "ln" command in the
        client. The old "ln" behaviour of creating a symlink is available
        using its "-s" option or through the preexisting "symlink" command.
      - scp(1): Add a new -3 option to scp: Copies between two remote hosts
        are transferred through the local host. Without this option the data
        is copied directly between the two remote hosts.
      - ssh(1): automatically order the hostkeys requested by the client based
        on which hostkeys are already recorded in known_hosts. This avoids
        hostkey warnings when connecting to servers with new ECDSA keys, since
        these are now preferred when learning hostkeys for the first time.
      - ssh(1) and sshd(8): add a new IPQoS option to specify arbitrary
        TOS/DSCP/QoS values instead of hardcoding lowdelay/throughput. (bz#1733)
      - sftp(1): the sftp client is now significantly faster at performing
        directory listings, using OpenBSD glob(3) extensions to preserve
        the results of stat(3) operations performed in the course of its
        execution rather than performing expensive round trips to fetch them
        again afterwards.
      - ssh(1): "atomically" create the listening mux socket by binding it
        on a temporary name and then linking it into position after listen()
        has succeeded. This allows the mux clients to determine that the
        server socket is either ready or stale without races. Stale server
        sockets are now automatically removed. (also fixes bz#1711)
      - ssh(1) and sshd(8): add a KexAlgorithms knob to the client and server
        configuration to allow selection of which key exchange methods are
        used by ssh(1) and sshd(8) and their order of preference.
      - sftp(1) and scp(1): factor out bandwidth limiting code from scp(1)
        into a generic bandwidth limiter that can be attached using the
        atomicio callback mechanism and use it to add a bandwidth limit
        option to sftp(1). (bz#1147)
    o The following significant bugs have been fixed in this release:
      - ssh(1) and ssh-agent(1): honour $TMPDIR for client xauth and
        ssh-agent temporary directories. (bz#1809)
      - ssh(1): avoid NULL deref on receiving a channel request on an
        unknown or invalid channel. (bz#1842)
      - sshd(8): remove a debug() that pollutes stderr on client connecting
        to a server in debug mode. (bz#1719)
      - scp(1): pass through ssh command-line flags and options when doing
        remote-remote transfers, e.g. to enable agent forwarding which is
        particularly useful in this case. (bz#1837)
      - sftp-server(8): umask should be parsed as octal.
      - sftp(1): escape '[' in filename tab-completion.
      - ssh(1): Typo in confirmation message. (bz#1827)
      - sshd(8): prevent free() of string in .rodata when overriding
        AuthorizedKeys in a Match block.
      - sshd(8): Use default shell /bin/sh if $SHELL is "".
      - ssh(1): kill proxy command on fatal() (we already killed it on
        clean exit).
      - ssh(1): install a SIGCHLD handler to reap expired child
        process. (bz#1812)
      - Support building against openssl-1.0.0a
      - Fix vulnerability in legacy certificate signing introduced in
        OpenSSH-5.6 and found by Mateusz Kocielski.

- Mandoc 1.10.10:
    o New integrated tbl(7) parser and renderer.
    o Support the roff(7) .de, .rm, and .so requests.
    o Support all roff code used in the standard pod2man(1) preamble.
    o Fully support roff quoting in man(7) documents.
    o Mandoc now copes with most formatting errors that used to be fatal.
    o Much simplified and improved reporting of errors and warnings.
    o Significantly improved -Thtml output quality.
    o The ports tree now allows ports to use either mandoc or groff to
      render manuals.

- Over 6,800 ports, major robustness and speed improvements in package tools.
- Many pre-built packages for each architecture:
    o i386: 6620                      o sparc64: 6225
    o alpha: 6000                     o sh: 3656
    o amd64: 6570                     o powerpc: 6272
    o sparc: 4184                     o arm: 5679
    o hppa: 5838                      o vax: 1068
    o mips64: 5492                    o mips64el: 5499

- Some highlights:
    o Gnome 2.32.1                    o KDE 3.5.10
    o Xfce 4.8.0                      o MySQL 5.1.54
    o PostgreSQL 9.0.3                o Postfix 2.7.2
    o OpenLDAP 2.3.43 and 2.4.23      o Mozilla Firefox 3.5.16 and 3.6.13
    o Mozilla Thunderbird 3.1.7       o OpenOffice.org 3.3.0rc9
    o LibreOffice 3.3.0.4             o Emacs 21.4 and 22.3
    o Vim 7.3.3                       o PHP 5.2.16
    o Python 2.4.6, 2.5.4 and 2.6.    o Ruby 1.8.7.330 and 1.9.2.136
    o Mono 2.8.2

- As usual, steady improvements in manual pages and other documentation.

- The system includes the following major components from outside suppliers:
    o Xenocara (based on X.Org 7.6 with xserver 1.9 + patches,
      freetype 2.4.4, fontconfig 2.8.0, Mesa 7.8.2, xterm 257 and more)
    o Gcc 2.95.3 (+ patches), 3.3.5 (+ patches) and 4.2.1 (+patches)
    o Perl 5.12.2 (+ patches)
    o Our improved and secured version of Apache 1.3, with SSL/TLS and DSO support
    o OpenSSL 1.0.0a (+ patches)
    o Sendmail 8.14.3, with libmilter
    o Bind 9.4.2-P2 (+ patches)
    o Lynx 2.8.6rel.5 with HTTPS and IPv6 support (+ patches)
    o Sudo 1.7.2p8
    o Ncurses 5.7
    o Heimdal 0.7.2 (+ patches)
    o Arla 0.35.7
    o Binutils 2.15 (+ patches)
    o Gdb 6.3 (+ patches)

If you'd like to see a list of what has changed between OpenBSD 4.8
and 4.9, look at

         http://www.OpenBSD.org/plus49.html

Even though the list is a summary of the most important changes
made to OpenBSD, it still is a very very long list.
We provide patches for known security threats and other important
issues discovered after each CD release.  As usual, between the
creation of the OpenBSD 4.9 FTP/CD-ROM binaries and the actual 4.9
release date, our team found and fixed some new reliability problems
(note: most are minor and in subsystems that are not enabled by
default).  Our continued research into security means we will find
new security problems -- and we always provide patches as soon as
possible.  Therefore, we advise regular visits to

         http://www.OpenBSD.org/security.html
and
http://www.OpenBSD.org/errata.html

Security patch announcements are sent to the security-announce*******
mailing list.  For information on OpenBSD mailing lists, please see:

http://www.OpenBSD.org/mail.html
OpenBSD 4.9 is also available on CD-ROM.  The 3-CD set costs $50 CDN and
is available via mail order and from a number of contacts around the
world.  The set includes a colourful booklet which carefully explains the
installation of OpenBSD.  A new set of cute little stickers is also
included (sorry, but our FTP mirror sites do not support STP, the Sticker
Transfer Protocol).  As an added bonus, the second CD contains an audio
track, a song entitled "The Answer".  MP3 and OGG versions of
the audio track can be found on the first CD.

Lyrics (and an explanation) for the songs may be found at:

     http://www.OpenBSD.org/lyrics.html#49

The OpenBSD project was formed Oct 18, 1995.  As of Apr 26, 2011 the
developers have done 235,957 commits over 5661 days, which is an
average rate of almost 42/day.  (That number was only discovered when
writing this ANNOUNCEMENT; the release artwork is intended to honour
the CSRG BSD 4.2 release.  It is nice to see the number show up again).

Profits from CD sales are the primary income source for the OpenBSD
project -- in essence selling these CD-ROM units ensures that OpenBSD
will continue to make another release six months from now.

The OpenBSD 4.9 CD-ROMs are bootable on the following four platforms:

  o i386
  o amd64
  o macppc
  o sparc64

(Other platforms must boot from floppy, network, or other method).

For more information on ordering CD-ROMs, see:

         http://www.OpenBSD.org/orders.html

The above web page lists a number of places where OpenBSD CD-ROMs
can be purchased from.  For our default mail order, go directly to:

         https://https.OpenBSD.org/cgi-bin/order

All of our developers strongly urge you to buy a CD-ROM and support
our future efforts.  Additionally, donations to the project are
highly appreciated, as described in more detail at:

         http://www.OpenBSD.org/goals.html#funding
For those unable to make their contributions as straightforward gifts,
the OpenBSD Foundation ( http://www.openbsdfoundation.org ) is a Canadian
not-for-profit corporation that can accept larger contributions and
issue receipts.  In some situations, their receipt may qualify as a
business expense writeoff, so this is certainly a consideration for
some organizations or businesses.  There may also be exposure benefits
since the Foundation may be interested in participating in press releases.
In turn, the Foundation then uses these contributions to assist OpenBSD's
infrastructure needs.  Contact the foundation directors at
directors*******for more information.
The OpenBSD distribution companies also sell tshirts and polo shirts.
And our users like them too.  We have a variety of shirts available,
with the new and old designs, from our web ordering system at, as
described above.

There is no specific new OpenBSD shirt for this release -- we decided
to skip a release.  Hoever, we also sell our older shirts, as well as
a selection of OpenSSH t-shirts.
If you choose not to buy an OpenBSD CD-ROM, OpenBSD can be easily
installed via FTP.  Typically you need a single small piece of boot
media (e.g., a boot floppy) and then the rest of the files can be
installed from a number of locations, including directly off the
Internet.  Follow this simple set of instructions to ensure that
you find all of the documentation you will need while performing
an install via FTP.  With the CD-ROMs, the necessary documentation
is easier to find.

1) Read either of the following two files for a list of ftp
   mirrors which provide OpenBSD, then choose one near you:

         http://www.OpenBSD.org/ftp.html
         ftp://ftp.OpenBSD.org/pub/OpenBSD/4.9/ftplist

   As of May 1, 2011, the following ftp mirror sites have the 4.9 release:

ftp://ftp.eu.openbsd.org/pub/OpenBSD/4.9/     Stockholm, Sweden
ftp://ftp.bytemine.net/pub/OpenBSD/4.9/         Oldenburg, Germany
ftp://ftp.ch.openbsd.org/pub/OpenBSD/4.9/     Zurich, Switzerland
ftp://ftp.fr.openbsd.org/pub/OpenBSD/4.9/     Paris, France
ftp://ftp5.eu.openbsd.org/pub/OpenBSD/4.9/     Vienna, Austria
ftp://mirror.aarnet.edu.au/pub/OpenBSD/4.9/     Brisbane, Australia
ftp://ftp.usa.openbsd.org/pub/OpenBSD/4.9/     CO, USA
ftp://ftp5.usa.openbsd.org/pub/OpenBSD/4.9/     CA, USA
ftp://obsd.cec.mtu.edu/pub/OpenBSD/4.9/         Michigan, USA

    The release is also available at the master site:

ftp://ftp.openbsd.org/pub/OpenBSD/4.9/             Alberta, Canada

    However it is strongly suggested you use a mirror.

   Other mirror sites may take a day or two to update.

2) Connect to that ftp mirror site and go into the directory
   pub/OpenBSD/4.9/ which contains these files and directories.
   This is a list of what you will see:

        ANNOUNCEMENT     armish/          mvme68k/         sparc64/
        Changelogs/      ftplist          mvme88k/         src.tar.gz
        HARDWARE         hp300/           packages/        sys.tar.gz
        PACKAGES         hppa/            ports.tar.gz     tools/
        PORTS            i386/            root.mail        vax/
        README           landisk/         sgi/             xenocara.tar.gz
        alpha/           mac68k/          socppc/          zaurus/
        amd64/           macppc/          sparc/

   It is quite likely that you will want at LEAST the following
   files which apply to all the architectures OpenBSD supports.

        README          - generic README
        HARDWARE        - list of hardware we support
        PORTS           - description of our "ports" tree
        PACKAGES        - description of pre-compiled packages
        root.mail       - a copy of root's mail at initial login.
              (This is really worthwhile reading).

3) Read the README file.  It is short, and a quick read will make
   sure you understand what else you need to fetch.

4) Next, go into the directory that applies to your architecture,
   for example, i386.  This is a list of what you will see:

    INSTALL.i386    cd49.iso        floppyB49.fs    pxeboot*
    INSTALL.linux   cdboot*         floppyC49.fs    xbase49.tgz
    MD5             cdbr*           game49.tgz      xetc49.tgz
    base49.tgz      cdemu49.iso     index.txt       xfont49.tgz
    bsd*            comp49.tgz      install49.iso   xserv49.tgz
    bsd.mp*         etc49.tgz       man49.tgz       xshare49.tgz
    bsd.rd*         floppy49.fs     misc49.tgz

   If you are new to OpenBSD, fetch _at least_ the file INSTALL.i386
   and the appropriate floppy*.fs or install49.iso files.  Consult the
   INSTALL.i386 file if you don't know which of the floppy images
   you need (or simply fetch all of them).

   If you use the install49.iso file (roughly 200MB in size), then you
   do not need the various *.tgz files since they are contained on that
   one-step ISO-format install CD.

5) If you are an expert, follow the instructions in the file called
   README; otherwise, use the more complete instructions in the
   file called INSTALL.i386.  INSTALL.i386 may tell you that you
   need to fetch other files.

6) Just in case, take a peek at:

         http://www.OpenBSD.org/errata.html

   This is the page where we talk about the mistakes we made while
   creating the 4.9 release, or the significant bugs we fixed
   post-release which we think our users should have fixes for.
   Patches and workarounds are clearly described there.

Note: If you end up needing to write a raw floppy using Windows,
      you can use "fdimage.exe" located in the pub/OpenBSD/4.9/tools
      directory to do so.
X.Org has been integrated more closely into the system.  This release
contains X.Org 7.4.  Most of our architectures ship with X.Org, including
amd64, sparc, sparc64 and macppc.  During installation, you can install
X.Org quite easily.  Be sure to try out xdm(1) and see how we have
customized it for OpenBSD.
The OpenBSD ports tree contains automated instructions for building
third party software.  The software has been verified to build and
run on the various OpenBSD architectures.  The 4.9 ports collection,
including many of the distribution files, is included on the 3-CD
set.  Please see the PORTS file for more information.

Note: some of the most popular ports, e.g., the Apache web server
and several X applications, come standard with OpenBSD.  Also, many
popular ports have been pre-compiled for those who do not desire
to build their own binaries (see BINARY PACKAGES, below).
A large number of binary packages are provided.  Please see the PACKAGES
file ( ftp://ftp.OpenBSD.org/pub/OpenBSD/4.9/PACKAGES ) for more details.
The CD-ROMs contain source code for all the subsystems explained
above, and the README ( ftp://ftp.OpenBSD.org/pub/OpenBSD/4.9/README )
file explains how to deal with these source files.  For those who
are doing an FTP install, the source code for all four subsystems
can be found in the pub/OpenBSD/4.9/ directory:

        xenocara.tar.gz     ports.tar.gz   src.tar.gz     sys.tar.gz
Ports tree and package building by Jasper Lievisse Adriaanse,
Landry Breuil, Michael Erdely, Stuart Henderson, Peter Hessler,
Paul Irofti, Antoine Jacoutot, Robert Nagy, and Christian Weisgerber.
System builds by Theo de Raadt, Mark Kettenis, and Miod Vallat.
X11 builds by Todd Fries and Miod Vallat.  ISO-9660 filesystem
layout by Theo de Raadt.

We would like to thank all of the people who sent in bug reports, bug
fixes, donation cheques, and hardware that we use.  We would also like
to thank those who pre-ordered the 4.9 CD-ROM or bought our previous
CD-ROMs.  Those who did not support us financially have still helped
us with our goal of improving the quality of the software.

Our developers are:

    Aleksander Piotrowski, Alexander Bluhm, Alexander Hall,
    Alexander Yurchenko, Alexandr Shadchin, Alexandre Ratchov,
    Antoine Jacoutot, Ariane van der Steldt, Artur Grabowski,
    Austin Hook, Benoit Lecocq, Bernd Ahlers, Bob Beck, Bret Lambert,
    Camiel Dobbelaar, Can Erkin Acar, Charles Longeau, Chris Kuethe,
    Christian Weisgerber, Claudio Jeker, Dale Rahn, Damien Bergamini,
    Damien Miller, Darren Tucker, David Coppa, David Gwynne, David Hill,
    David Krause, Edd Barrett, Eric Faurot, Federico G. Schwindt,
    Felix Kronlage, Gilles Chehade, Giovanni Bechis, Henning Brauer,
    Hikaru Abe, Ian Darwin, Igor Sobrado, Ingo Schwarze,
    Jacek Masiulaniec, Jacob Meuser, Jakob Schlyter, James Wright,
    Janne Johansson, Jason George, Jason McIntyre, Jason Meltzer,
    Jasper Lievisse Adriaanse, Jeremy Evans, Jim Razmus II, Joel Sing,
    Johan Mson Suorra, Jolan Luff, Jonathan Armani, Jonathan Gray,
    Jordan Hargrave, Joshua Elsasser, Joshua Stein,
    Kenneth R Westerback, Kevin Lo, Kevin Steves, Kjell Wooding,
    Kurt Miller, Landry Breuil, Laurent Fanis, Marc Espie,
    Marco Peereboom, Marco Pfatschbacher, Marcus Glocker, Mark Kettenis,
    Mark Lumsden, Mark Uemura, Markus Friedl, Martin Hedenfalk,
    Martynas Venckus, Mathieu Sauve-Frankel, Mats O Jansson,
    Matthew Dempsky, Matthias Kilian, Matthieu Herrb, Michael Erdely,
    Michael Knudsen, Michele Marchetto, Mike Belopuhov, Mike Larkin,
    Miod Vallat, Nicholas Marriott, Nick Holland, Nikolay Sturm,
    Okan Demirmen, Oleg Safiullin, Otto Moerbeek, Owain Ainsworth,
    Ozawa Tsuyoshi, Paul de Weerd, Paul Irofti, Peter Hessler,
    Peter Valchev, Philip Guenther, Pierre-Emmanuel Andre,
    Pierre-Yves Ritschard, Ray Lai, Remi Pointel, Reyk Floeter,
    Robert Nagy, Ryan Thomas McBride, Ryo Shimizu, Sasano,
    Sebastian Reitenbach, Stefan Sperling, Stephan A. Rickauer,
    Steven Mestdagh, Stuart Cassoff, Stuart Henderson, Suenaga Hiroki,
    Takuya Asada, Ted Unangst, Theo de Raadt, Thordur I Bjornsson,
    Tobias Stoeckmann, Tobias Weingartner, Todd C. Miller, Todd Fries,
    Will Maier, William Yodlowsky, Xavier Santolaria, Yasuoka Masahiko,
    Yojiro Uo

------------------------------------------------------------------------
May 19, 2010.

We are pleased to announce the official release of OpenBSD 4.7.
This is our 27th release on CD-ROM (and 28th via FTP).  We remain
proud of OpenBSD's record of more than ten years with only two remote
holes in the default install.

As in our previous releases, 4.7 provides significant improvements,
including new features, in nearly all areas of the system:

- New/extended platforms:
    o OpenBSD/alpha
      o Added support for the DS15/DS25/ES45.
    o OpenBSD/loongson
      New platform for systems based on the Loongson 2E and 2F MIPS-compatible
      processors. Supported machines include:
      o Lemote Fuloong 2F mini-PC
      o Lemote Lynloong all-in-one-PC
      o Lemote Yeeloong netbook (8.9" and 10.1" models)
      o EMTEC Gdium Liberty 1000 netbook
    o OpenBSD/sgi
      o Added support for multi-node SGI Origin systems, in M mode.
      o Added support for the SGI Origin 350, Onyx 350, Onyx 4 and
        Tezro systems.
      o Added SMP support on the SGI Octane.
      o Support for many more onboard devices on Octane and Origin systems.
    o OpenBSD/socppc
      o Added support for the RouterBOARD RB600A.
    o OpenBSD/sparc64
      o Preliminary support for running OpenBSD in a guest domain on top of
        an OpenBSD control domain on sun4v machines.

- Improved hardware support, including:
    o Revamped SCSI midlayer and improved driver support.
    o UDF 2.5 and 2.6 (HDDVD and Blu-ray) disks support.
    o Added mpath(4), a driver that steals paths to scsi devices if they could
      be available via multiple paths and then made available via mpath(4).
    o New aibs(4) driver for ASUSTeK AI Booster hardware monitoring.
    o New uthum(4) driver for the TEMPerHUM USB temperature and humidity
      sensors.
    o New utrh(4) driver for USBRH temperature and humidity sensors.
    o New uyurex(4) driver for the Maywa-denki & KAYAC YUREX twitch/jiggle of
      knee sensor.
    o New urndis(4) driver for remote NDIS Ethernet over USB devices (phones).
    o New xf86-video-wsudl(4) Xorg driver for USB DisplayLink devices
      supported by udl(4).
    o New mpii(4) driver for LSI Logic Fusion MPT Message Passing Interface II
      based SAS 2 controllers.
    o New athn(4) driver for Atheros IEEE 802.11a/g/n wireless network devices.
    o New alc(4) driver for Atheros AR8131/AR8132 10/100/Gigabit Ethernet
      devices.
    o New lisa(4) driver for STMicroelectronics LIS331DL MEMS motion sensors.
    o New gcu(4) driver for Intel EP80579 Global Configuration Unit.
    o New lom(4) driver for LOMLite and LOMLite2 as found on many of Sun's
      UltraSPARC-IIi servers.
    o New vsw(4) driver for virtual switches on sun4v machines.
    o New vds(4) driver for virtual disk servers on sun4v machines.
    o Support for EP80579 integrated Ethernet and ICH9 M V has been added
      to em(4).
    o Support for 82599 and SFP+ 82598 devices has been added to ix(4).
    o Support for the Sun GigabitEthernet SBus Adapter 1.0/1.1 has been
      added to ti(4).
    o Support for SBus variants of the QLogic Fibre Channel host adapters
      has been added to isp(4).
    o Support for SBus variants of the Sun Gigabit Ethernet has been added
      to gem(4).
    o Support for Intel WiFi Link 1000 and Intel Centrino
      Advanced-N 6200/Ultimate-N 6300 has been added to iwn(4).
    o Support for Ralink RT3572 based 802.11n devices has been added to run(4).
    o VIA Tremor 5.1, M-Audio Revolution 5.1 cards has been added to envy(4).
    o New uhts(4) driver for USB HID touchscreens.
    o Improved touchscreen support in the xf86-input-ws(4) Xorg driver and
      improved calibration using the new device properties from Xinput.
    o Support for ON CAT6095 and ON CAT34TS02 temperature sensors added
      to sdtemp(4).
    o Several improvements and bug fixes to existing Ethernet drivers,
      including em(4), re(4), ti(4) and vge(4).
    o Support for the PIC PCI-X controller added to the SGI xbridge(4) driver.
    o Support for the onboard Fast Ethernet interface found on SGI Octane
      and many SGI Origin family systems, iec(4).
    o Support for more SGI input and video devices on Octane and Origin
      systems, with iockbc(4), impact(4), and odyssey(4).
    o Improved PCI resource allocation; more hardware left unconfigured by
      the machine's firmware (including hotplugged hardware) should work now.
    o Support for recording/full-duplex added to mavb(4).
    o Improved support for USB audio devices in uaudio(4).
    o Improved support for bwi(4) devices on strict-alignment architectures
      like armish.
    o Eliminate usage of SCSI tagged queueing mechanisms other than simple
      queuing, thus avoiding incorrect implementations on various disk devices.
    o Eliminate spurious dhclient(8) error messages when the specified
      interface does not exist.
    o Eliminate spurious softraid(4) error messages for removable devices
      without media.

- New tools:
    o newfs_ext2fs(8) for creating ext2 filesystems.
    o mkuboot(8) for creating U-Boot boot loader images.
    o midicat(1) MIDI server allowing MIDI programs to communicate
    o POSIX-compliant fuser(1) to identify process IDs holding a file open

- Filesystem midlayer improvements:
    o Dynamic Buffer Cache now supported to a max size set with sysctl
      kern.bufcachepercent
    o Dynamic VFS name cache rewrite, now uses Red/Black trees instead of
      linked lists.
    o Numerous NFS client stability fixes.
    o Fix FAT32 mounting.
    o Fix cd9660 directory handling to eliminate looping and random
      truncation of directory entries.
    o Fix various internal locking problems with cd9660, udf, msdosfs
      and ffs file systems.

- pf(4) improvements:
    o nat-to, rdr-to, binat-to options replace the nat, rdr and binat
      translation rules.
      changes for more info.
    o The route-to, reply-to, dup-to and fastroute options in pf.conf
      move to filteropts.
    o pf(4) can now translate packets between different routing domains.
    o Added -S and -L options to pfctl(8) to store and load pf state table
      from a file.
    o Added support for IPV4 and IPv6 divert sockets.

- OpenBGPD, OpenOSPFD and other routing daemon improvements:
    o Update capability code in bgpd(8) to follow RFC 5492.
    o BGP MPLS VPN (RFC 4364) support added to the bgpd RIB.
    o In bgpd(8), implement the RFC4486 BGP Cease Notification
      Message subcodes.
    o It is now possible to enable/disable specific BGP capabilities.
    o Update bgpctl(8) irrfilter to support IPv6 and 4-byte AS numbers.
    o Minimal router-dead-time of 1 second and sub-second hello intervals
      added to ospfd(8). Additionally it is now possible to specify
      sub-second SPF timers for faster route fail-over.
    o ospf6d(8) is now installed by default. The RIB can be synced with
      the kernel routing table now. Support for AS-ext LSA has been added.
      This is still work-in-progress but testing is highly appreciated.
    o ldpd -- the MPLS label distribution protocol daemon -- is now
      installed by default. A custom kernel with option MPLS is needed
      to use it.

- Generic network stack improvements:
    o brconfig is now integrated into ifconfig(8)
    o Added vether(4), a virtual Ethernet device.
    o Two bugs in IPsec/HMAC-SHA2 were fixed, resulting in an incompatibility
      with the HMAC-SHA-256/384/512 hash algorithms with previous versions
      of OpenBSD and other IPsec implementations sharing the bugs.
    o In dhcpd(8), echo back the Relay Agent Information option if present,
      and add support for the ipsec-tunnel hardware type.
    o Make dhcrelay(8) pick up the routing domain from the specified interface
      and use that rdomain for relaying the packets to the server.
    o Added support in dhcrelay(8) for RFC3046 "DHCP-over-ipsec".
    o Make the tcpdump(8) BGP OPEN capability parser RFC 5492 compliant.
    o Added an exec command to route(8) to run a process and its children
      in a specified routing domain.
    o ifconfig(8) now deals with more than 64 alias addresses.
    o Various fixes to mbuf defragmenting and mbuf chain copying
      improve reliability.

- Assorted improvements:
    o malloc(3) now has an S flag to turn on the options that help debugging
      and improve security.
    o Updated terminfo(3) database and ncurses(3) library.
    o Added support for lazy binding in ld.so(1) on hppa.
    o Added POSIX silent check option (-C) to sort(1).
    o Added POSIX extended regular expression support to sed(1) (-E option).
    o Added GNU-compatible macro prefix option (-P) to m4(1).
    o Make it possible to specify a port in resolv.conf(5).
    o Improved FILE locking support in stdio(3).
    o Added SO_SNDTIMEO and SO_RCVTIMEO support in pthreads(3).
    o cdio(1) no longer prints bogus information if no TOC is found on
      the disk.
    o New -v flag causes cdio(1) to print profile and feature information.
    o whois(1) no longer attempts to keep the memory of 6Bone alive.
    o Added per-application MIDI-controlled volume knob to aucat(1)
    o Added MMC and MTC support to aucat(1) making possible MIDI-to-audio
      synchronization.
    o Added mio_open(3) interface to access hardware and software MIDI ports
    o Many memory leaks found by parfait and eliminated.
    o Make handling of floppy disk disklabels more reliable by properly
      initializing starting label.

- Install/Upgrade process changes:
    o Take more care to ensure all filesystems are umount'ed when restarting
      an install or upgrade.
    o If no possible root disk is found, keep checking until one appears.
    o The default ftp directory for -stable is now the release directory
      instead of the snapshot directory.
    o Selection of TZ during installs is no longer confused by
      trailing slashes.
    o If /etc/X11 is found during upgrades, add the X sets to the list
      of default sets to install.

- OpenSSH 5.5:
    o New features:
      o SSH protocol 1 is disabled by default.
      o Remove the libsectok/OpenSC-based smartcard code and add support
        for PKCS#11 tokens.
      o Add support for certificate authentication of users and hosts
        using a new, minimal OpenSSH certificate format (not X.509).
      o Added a 'netcat mode' to ssh(1).
      o Add the ability to revoke keys in sshd(8) and ssh(1).
      o Rewrite the ssh(1) multiplexing support to support non-blocking
        operation of the mux master.
      o Add a 'read-only' mode to sftp-server(8) that disables open in
        write mode and all other fs-modifying protocol methods. (bz#430)
      o Allow setting an explicit umask on the sftp-server(8) commandline
        to override whatever default the user has. (bz#1229)
      o Many improvements to the sftp(1) client.
      o New RSA keys will be generated with a public exponent of 65537
        instead of the previous value 35.
      o Passphrase-protected SSH protocol 2 private keys are now protected
        with AES-128 instead of 3DES.
    o The following significant bugs have been fixed in this release:
      o Fixed a minor information leak of environment variables specified in
        authorized_keys if an attacker happens to know the public key in use.
      o When using ChrootDirectory, make sure we test for the existence of
        the user's shell inside the chroot and not outside. (bz#1679)
      o Cache user and group name lookups in sftp-server using
        user_from_[ug]id(3) to improve performance on hosts where these
        operations are slow. (bz#1495)
      o Fix problem that prevented passphrase reading from being interrupted
        in some circumstances. (bz#1590)
      o Ignore and log any Protocol 1 keys where the claimed size is not
        equal to the actual size.
      o Make HostBased authentication work with a ProxyCommand. (bz#1569)
      o Avoid run-time failures when specifying hostkeys via a relative path
        by prepending the current working directory in these cases. (bz#1290)
      o Do not prompt for a passphrase if we fail to open a keyfile, and log
        the reason why the open failed to debug. (bz#1693)
      o Document that the PubkeyAuthentication directive is allowed in a
        sshd_config(5) Match block. (bz#1577)
      o When converting keys, truncate key comments at 72 chars as per
        RFC4716. (bz#1630)
      o Do not allow logins if /etc/nologin exists but is not readable by
        the user logging in.
      o Output a debug log if sshd(8) can't open an existing
        authorized_keys. (bz#1694)
      o Quell tc[gs]etattr(3) warnings when forcing a tty (ssh -tt), since
        we usually don't actually have a tty to read/set. (bz#1686)
      o Prevent sftp(1) from crashing when given a "-" without a command;
        also, allow whitespace to follow a "-". (bz#1691)
      o After sshd(8) receives a SIGHUP, ignore subsequent HUPs while
        sshd(8) re-execs itself; prevents two HUPs in quick succession
        from resulting in sshd(8) dying. (bz#1692)
      o Clarify in sshd_config(5) that StrictModes does not apply to
        ChrootDirectory; permissions and ownership are always checked
        when chrooting. (bz#1532)
      o Set close-on-exec on various descriptors so they don't get leaked
        to child processes. (bz#1643)
      o Fix very rare race condition in x11/agent channel allocation
      o Fix incorrect exit status when multiplexing and channel ID 0 is
        recycled. (bz#1570)
      o Fail with an error when an attempt is made to connect to a server
        with ForceCommand=internal-sftp with a shell session. (bz#1606)
      o Warn but do not fail if stat(2)ing the subsystem binary
        fails. (bz#1599)
      o Change "Connecting to host..." message to "Connected to host." and
        delay it until after the sftp protocol connection has been
        established. (bz#1588)
      o Use the HostKeyAlias rather than the hostname specified on the
        commandline when prompting for passwords. (bz#1039)
      o Correct off-by-one in percent_expand(). (bz#1607)
      o Fix passing of empty options from scp(1) and sftp(1) to the
        underlying ssh(1); also add support for the stop option "--".
      o Fix an incorrect magic number and typo in PROTOCOL. (bz#1688)
      o Don't escape backslashes when displaying the SSH2 banner. (bz#1533)
      o Don't unnecessarily dup() the in and out fds for
        sftp-server(8). (bz#1566)
      o Force use of the correct hash function for random-art signature
        display. (bz#1611)
      o Do not fall back to adding keys without constraints when the agent
        refuses the constrained add request. (bz#1612)
      o Fix a race condition in ssh-agent(1) that could result in a wedged
        or spinning agent. (bz#1633)
      o Flush stdio before exec() to ensure that everything has made it out
        before the streams go away. (bz#1596)
      o Set FD_CLOEXEC on in/out sockets in sshd(8). (bz#1706)

- Over 5,800 ports, major robustness and speed improvements in package tools.
- Many pre-built packages for each architecture:
    o i386: 5951
    o sparc64: 5745
    o alpha: 5641
    o sh: 768
    o amd64: 5879
    o powerpc: 5785
    o sparc: 4053
    o arm: 3711
    o hppa: 5500
    o vax: 1785
    o mips64: 3690
    o mips64el: 4316

- Some highlights:
    o Gnome 2.28.2.
    o KDE 3.5.10.
    o Xfce 4.6.1.
    o MySQL 5.1.42.
    o PostgreSQL 8.4.2.
    o Postfix 2.6.5.
    o OpenLDAP 2.3.43.
    o Mozilla Firefox 3.0.18 and 3.5.8.
    o Mozilla Thunderbird 2.0.0.23.
    o OpenOffice.org 3.1.1.
    o Emacs 21.4 and 22.3
    o Vim 7.2.267.
    o PHP 5.2.12.
    o Python 2.4.6, 2.5.4 and 2.6.3.
    o Ruby 1.8.6.369.

- As usual, steady improvements in manual pages and other documentation.

- The system includes the following major components from outside suppliers:
    o Xenocara (based on X.Org 7.4 with xserver 1.6.5 + patches,
      freetype 2.3.9, fontconfig 2.6.0, Mesa 7.4.2, xterm 250 and more)
    o Gcc 2.95.3 (+ patches) and 3.3.5 (+ patches)
    o Perl 5.10.1 (+ patches)
    o Our improved and secured version of Apache 1.3, with SSL/TLS
      and DSO support
    o OpenSSL 0.9.8k (+ patches)
    o Groff 1.15
    o Sendmail 8.14.3, with libmilter
    o Bind 9.4.2-P2 (+ patches)
    o Lynx 2.8.6rel.5 with HTTPS and IPv6 support (+ patches)
    o Sudo 1.7.2
    o Ncurses 5.7
    o Latest KAME IPv6
    o Heimdal 0.7.2 (+ patches)
    o Arla 0.35.7
    o Binutils 2.15 (+ patches)
    o Gdb 6.3 (+ patches)

If you'd like to see a list of what has changed between OpenBSD 4.6
and 4.7, look at

         http://www.OpenBSD.org/plus47.html

Even though the list is a summary of the most important changes
made to OpenBSD, it still is a very very long list.
We provide patches for known security threats and other important
issues discovered after each CD release.  As usual, between the
creation of the OpenBSD 4.7 FTP/CD-ROM binaries and the actual 4.7
release date, our team found and fixed some new reliability problems
(note: most are minor and in subsystems that are not enabled by
default).  Our continued research into security means we will find
new security problems -- and we always provide patches as soon as
possible.  Therefore, we advise regular visits to

         http://www.OpenBSD.org/security.html
and
http://www.OpenBSD.org/errata.html

Security patch announcements are sent to the security-announce*******
mailing list.  For information on OpenBSD mailing lists, please see:

http://www.OpenBSD.org/mail.html
OpenBSD 4.7 is also available on CD-ROM.  The 3-CD set costs $50 CDN and
is available via mail order and from a number of contacts around the
world.  The set includes a colourful booklet which carefully explains the
installation of OpenBSD.  A new set of cute little stickers is also
included (sorry, but our FTP mirror sites do not support STP, the Sticker
Transfer Protocol).  As an added bonus, the second CD contains an audio
track, a song entitled "I'm still here".  MP3 and OGG versions of
the audio track can be found on the first CD.

Lyrics (and an explanation) for the songs may be found at:

     http://www.OpenBSD.org/lyrics.html#47

Profits from CD sales are the primary income source for the OpenBSD
project -- in essence selling these CD-ROM units ensures that OpenBSD
will continue to make another release six months from now.

The OpenBSD 4.7 CD-ROMs are bootable on the following four platforms:

  o i386
  o amd64
  o macppc
  o sparc64

(Other platforms must boot from floppy, network, or other method).

For more information on ordering CD-ROMs, see:

         http://www.OpenBSD.org/orders.html

The above web page lists a number of places where OpenBSD CD-ROMs
can be purchased from.  For our default mail order, go directly to:

         https://https.OpenBSD.org/cgi-bin/order

All of our developers strongly urge you to buy a CD-ROM and support
our future efforts.  Additionally, donations to the project are
highly appreciated, as described in more detail at:

         http://www.OpenBSD.org/goals.html#funding
For those unable to make their contributions as straightforward gifts,
the OpenBSD Foundation ( http://www.openbsdfoundation.org ) is a Canadian
not-for-profit corporation that can accept larger contributions and
issue receipts.  In some situations, their receipt may qualify as a
business expense writeoff, so this is certainly a consideration for
some organizations or businesses.  There may also be exposure benefits
since the Foundation may be interested in participating in press releases.
In turn, the Foundation then uses these contributions to assist OpenBSD's
infrastructure needs.  Contact the foundation directors at
directors*******for more information.
The OpenBSD distribution companies also sell tshirts and polo shirts.
And our users like them too.  We have a variety of shirts available,
with the new and old designs, from our web ordering system at, as
described above.

The OpenBSD 4.7 t-shirts are available now.  We also sell our older
shirts, as well as a selection of OpenSSH t-shirts.
If you choose not to buy an OpenBSD CD-ROM, OpenBSD can be easily
installed via FTP.  Typically you need a single small piece of boot
media (e.g., a boot floppy) and then the rest of the files can be
installed from a number of locations, including directly off the
Internet.  Follow this simple set of instructions to ensure that
you find all of the documentation you will need while performing
an install via FTP.  With the CD-ROMs, the necessary documentation
is easier to find.

1) Read either of the following two files for a list of ftp
   mirrors which provide OpenBSD, then choose one near you:

         http://www.OpenBSD.org/ftp.html
         ftp://ftp.OpenBSD.org/pub/OpenBSD/4.7/ftplist

   As of May 19, 2010, the following ftp mirror sites have the 4.7 release:

ftp://ftp.eu.openbsd.org/pub/OpenBSD/4.7/     Stockholm, Sweden
ftp://ftp.bytemine.net/pub/OpenBSD/4.7/          Oldenburg, Germany
ftp://mirror.aarnet.edu.au/pub/OpenBSD/4.7/      Brisbane, Australia
ftp://ftp.wu-wien.ac.at/pub/OpenBSD/4.7/         Vienna, Austria
ftp://ftp.usa.openbsd.org/pub/OpenBSD/4.7/     CO, USA
ftp://ftp5.usa.openbsd.org/pub/OpenBSD/4.7/     CA, USA
ftp://obsd.cec.mtu.edu/pub/OpenBSD/4.7/          Michigan, USA

    The release is also available at the master site:

ftp://ftp.openbsd.org/pub/OpenBSD/4.7/             Alberta, Canada
    
    However it is strongly suggested you use a mirror.

   Other mirror sites may take a day or two to update.

2) Connect to that ftp mirror site and go into the directory
   pub/OpenBSD/4.7/ which contains these files and directories.
   This is a list of what you will see:

        ANNOUNCEMENT     armish/          mvme68k/         sparc64/
        Changelogs/      ftplist          mvme88k/         src.tar.gz
        HARDWARE         hp300/           packages/        sys.tar.gz
        PACKAGES         hppa/            ports.tar.gz     tools/
        PORTS            i386/            root.mail        vax/
        README           landisk/         sgi/             xenocara.tar.gz
        alpha/           mac68k/          socppc/          zaurus/
        amd64/           macppc/          sparc/

   It is quite likely that you will want at LEAST the following
   files which apply to all the architectures OpenBSD supports.

        README          - generic README
        HARDWARE        - list of hardware we support
        PORTS           - description of our "ports" tree
        PACKAGES        - description of pre-compiled packages
        root.mail       - a copy of root's mail at initial login.
              (This is really worthwhile reading).

3) Read the README file.  It is short, and a quick read will make
   sure you understand what else you need to fetch.

4) Next, go into the directory that applies to your architecture,
   for example, i386.  This is a list of what you will see:

    INSTALL.i386    cd47.iso        floppyB47.fs    pxeboot*
    INSTALL.linux   cdboot*         floppyC47.fs    xbase47.tgz
    MD5             cdbr*           game47.tgz      xetc47.tgz
    base47.tgz      cdemu47.iso     index.txt       xfont47.tgz
    bsd*            comp47.tgz      install47.iso   xserv47.tgz
    bsd.mp*         etc47.tgz       man47.tgz       xshare47.tgz
    bsd.rd*         floppy47.fs     misc47.tgz

   If you are new to OpenBSD, fetch _at least_ the file INSTALL.i386
   and the appropriate floppy*.fs or install47.iso files.  Consult the
   INSTALL.i386 file if you don't know which of the floppy images
   you need (or simply fetch all of them).

   If you use the install47.iso file (roughly 200MB in size), then you
   do not need the various *.tgz files since they are contained on that
   one-step ISO-format install CD.

5) If you are an expert, follow the instructions in the file called
   README; otherwise, use the more complete instructions in the
   file called INSTALL.i386.  INSTALL.i386 may tell you that you
   need to fetch other files.

6) Just in case, take a peek at:

         http://www.OpenBSD.org/errata.html

   This is the page where we talk about the mistakes we made while
   creating the 4.7 release, or the significant bugs we fixed
   post-release which we think our users should have fixes for.
   Patches and workarounds are clearly described there.

Note: If you end up needing to write a raw floppy using Windows,
      you can use "fdimage.exe" located in the pub/OpenBSD/4.7/tools
      directory to do so.
X.Org has been integrated more closely into the system.  This release
contains X.Org 7.4.  Most of our architectures ship with X.Org, including
amd64, sparc, sparc64 and macppc.  During installation, you can install
X.Org quite easily.  Be sure to try out xdm(1) and see how we have
customized it for OpenBSD.
The OpenBSD ports tree contains automated instructions for building
third party software.  The software has been verified to build and
run on the various OpenBSD architectures.  The 4.7 ports collection,
including many of the distribution files, is included on the 3-CD
set.  Please see the PORTS file for more information.

Note: some of the most popular ports, e.g., the Apache web server
and several X applications, come standard with OpenBSD.  Also, many
popular ports have been pre-compiled for those who do not desire
to build their own binaries (see BINARY PACKAGES, below).
A large number of binary packages are provided.  Please see the PACKAGES
file ( ftp://ftp.OpenBSD.org/pub/OpenBSD/4.7/PACKAGES ) for more details.
The CD-ROMs contain source code for all the subsystems explained
above, and the README ( ftp://ftp.OpenBSD.org/pub/OpenBSD/4.7/README )
file explains how to deal with these source files.  For those who
are doing an FTP install, the source code for all four subsystems
can be found in the pub/OpenBSD/4.7/ directory:

        xenocara.tar.gz     ports.tar.gz   src.tar.gz     sys.tar.gz
Ports tree and package building by Jasper Lievisse Adriaanse, Michael Erdely,
Simon Bertrang, Stuart Henderson, Antoine Jacoutot, Robert Nagy,
Nikolay Sturm, and Christian Weisgerber.  System builds by Theo de Raadt,
Mark Kettenis, and Miod Vallat.  X11 builds by Todd Fries and Miod Vallat.
ISO-9660 filesystem layout by Theo de Raadt.

We would like to thank all of the people who sent in bug reports, bug
fixes, donation cheques, and hardware that we use.  We would also like
to thank those who pre-ordered the 4.7 CD-ROM or bought our previous
CD-ROMs.  Those who did not support us financially have still helped
us with our goal of improving the quality of the software.

Our developers are:

    Alexander Bluhm, Alexander Hall, Alexander von Gernler,
    Alexander Yurchenko, Alexandre Ratchov, Alexey Vatchenko,
    Anders Magnusson, Andreas Gunnarsson, Anil Madhavapeddy,
    Antoine Jacoutot, Ariane van der Steldt, Artur Grabowski,
    Austin Hook, Benoit Lecocq, Bernd Ahlers, Bob Beck, Bret Lambert,
    Can Erkin Acar, Chad Loder, Charles Longeau, Chris Kuethe,
    Christian Weisgerber, Claudio Jeker, Dale Rahn, Damien Bergamini,
    Damien Miller, Dariusz Swiderski, Darren Tucker,
    David Gwynne,  David Hill, David Krause, Edd Barrett, Eric Faurot,
    Esben Norby,  Fabien Romano, Federico G. Schwindt, Felix Kronlage,
    Gilles Chehade, Giovanni Bechis, Gordon Willem Klok,
    Henning Brauer, Ian Darwin, Igor Sobrado, Ingo Schwarze,
    Jacek Masiulaniec, Jacob Meuser, Jakob Schlyter, Janne Johansson,
    Jared Yanovich, Jason Dixon, Jason George, Jason McIntyre,
    Jason Meltzer, Jasper Lievisse Adriaanse, Jim Razmus II, Joel Sing,
    Joerg Goltermann, Johan Mson Lindman, Jolan Luff, Jonathan Armani,
    Jonathan Gray, Jordan Hargrave, Joshua Stein, Kenneth R Westerback,
    Kevin Lo, Kevin Steves, Kjell Wooding, Kurt Miller, Landry Breuil,
    Laurent Fanis, Marc Espie, Marco Peereboom, Marco Pfatschbacher,
    Marco S Hyman, Marcus Glocker, Marek Vasut, Mark Kettenis,
    Mark Uemura, Markus Friedl, Martin Reindl, Martynas Venckus,
    Mathieu Sauve-Frankel, Mats O Jansson, Matthias Kilian,
    Matthieu Herrb, Michael Erdely, Michael Knudsen, Michele Marchetto,
    Mike Larkin, Miod Vallat, Moritz Grimm, Moritz Jodeit,
    Nicholas Marriott, Nick Holland, Nikolay Sturm, Okan Demirmen,
    Oleg Safiullin, Otto Moerbeek, Owain Ainsworth, Paul de Weerd,
    Paul Irofti, Peter Hessler, Peter Stromberg, Peter Valchev,
    Philip Guenther, Pierre-Emmanuel Andre, Pierre-Yves Ritschard,
    Rainer Giedat, Reyk Floeter, Robert Nagy, Rui Reis,
    Ryan Thomas McBride, Simon Bertrang, Simon Perreault, Stefan Kempf,
    Stefan Sperling, Stephan A. Rickauer, Steven Mestdagh,
    Stuart Henderson, Takuya Asada, Ted Unangst, Theo de Raadt,
    Thordur I Bjornsson, Tobias Stoeckmann, Tobias Weingartner,
    Todd C. Miller, Todd Fries, Will Maier, William Yodlowsky,
    Xavier Santolaria, Yasuoka Masahiko, Yojiro Uo