Comment 8 for bug 1668093

On
git://anongit.mindrot.org/openssh.git

With bisect helper:
$cat ../test-ssh.sh
#!/bin/bash
set -ux

make clean
autoreconf && ./configure && make -j4
if [[ $? -ne 0 ]]; then
        # skip build issue
        exit 125
fi

rm ~/.ssh/known_hosts /root/.ssh/known_hosts.old /root/.ssh/known_hosts
./ssh-keyscan 10.245.71.133 > ~/.ssh/known_hosts
./ssh-keygen -H
./ssh-keygen -H
# here .old and current should have no diff
# no diff = still ok, diff = broken - diff RC matches that
diff -q /root/.ssh/known_hosts.old /root/.ssh/known_hosts

$ git bisect start V_7_2_P2 V_6_6_P1

Gives me:

$ git bisect log
# bad: [5c35450a0c901d9375fb23343a8dc82397da5f75] update versions for release
# good: [19158b2447e35838d69b2b735fb640d1e86061ea] - (djm) Release OpenSSH 6.6
git bisect start 'V_7_2_P2' 'V_6_6_P1'
# bad: [39e2f1229562e1195169905607bc12290d21f021] upstream commit
git bisect bad 39e2f1229562e1195169905607bc12290d21f021
# skip: [08c0eebf55d70a9ae1964399e609288ae3186a0c] upstream commit
git bisect skip 08c0eebf55d70a9ae1964399e609288ae3186a0c
# good: [f067cca2bc20c86b110174c3fef04086a7f57b13] upstream commit
git bisect good f067cca2bc20c86b110174c3fef04086a7f57b13
# bad: [fe8a3a51699afbc6407a8fae59b73349d01e49f8] upstream commit
git bisect bad fe8a3a51699afbc6407a8fae59b73349d01e49f8
# good: [9010902954a40b59d0bf3df3ccbc3140a653e2bc] upstream commit
git bisect good 9010902954a40b59d0bf3df3ccbc3140a653e2bc
# bad: [3fdc88a0def4f86aa88a5846ac079dc964c0546a] upstream commit
git bisect bad 3fdc88a0def4f86aa88a5846ac079dc964c0546a
# bad: [9e06a0fb23ec55d9223b26a45bb63c7649e2f2f2] upstream commit
git bisect bad 9e06a0fb23ec55d9223b26a45bb63c7649e2f2f2
# good: [f101d8291da01bbbfd6fb8c569cfd0cc61c0d346] upstream commit
git bisect good f101d8291da01bbbfd6fb8c569cfd0cc61c0d346
# bad: [cecb30bc2ba6d594366e657d664d5c494b6c8a7f] upstream commit
git bisect bad cecb30bc2ba6d594366e657d664d5c494b6c8a7f
# good: [c29811cc480a260e42fd88849fc86a80c1e91038] upstream commit
git bisect good c29811cc480a260e42fd88849fc86a80c1e91038
# good: [ec3d065df3a9557ea96b02d061fd821a18c1a0b9] upstream commit
git bisect good ec3d065df3a9557ea96b02d061fd821a18c1a0b9
# first bad commit: [cecb30bc2ba6d594366e657d664d5c494b6c8a7f] upstream commit

The offending commit you want to report in your upstream bug is:
cecb30bc2ba6d594366e657d664d5c494b6c8a7f is the first bad commit
commit cecb30bc2ba6d594366e657d664d5c494b6c8a7f
Author: <email address hidden> <email address hidden>
Date: Sun Jan 18 21:49:42 2015 +0000

    upstream commit

    make ssh-keygen use hostkeys_foreach(). Removes some
     horrendous code; ok markus@

Upstream accidentally dropped the "non-overwrite" feature of ssh-keygen -H, but it is part of a much bigger rework, therefore this is nothing we just can/want to revert.