Merging upstream version 1:2.14.0.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

35 files changed, 300 insertions, 84 deletions

diff --git a/completions/.gitignore b/completions/.gitignore
index 0837060..c3bf546 100644
--- a/completions/.gitignore
+++ b/completions/.gitignore
@@ -28,6 +28,7 @@
 /autoupdate
 /avahi-browse-domains
 /b2sum
+/_bao
 /_black
 /_blackd
 /bmake
@@ -68,6 +69,7 @@
 /dfutool
 /_diesel
 /display
+/_dlv
 /_docker
 /dpkg-deb
 /dpkg-query
@@ -115,6 +117,7 @@
 /gpgv2
 /gssdp-device-sniffer
 /gtar
+/_gup
 /hciattach
 /hciconfig
 /hd
@@ -131,6 +134,7 @@
 /ifstatus
 /_ignite
 /import
+/_incus
 /_infracost
 /inotifywatch
 /insmod.static
@@ -313,6 +317,7 @@
 /_tkn
 /_tkn-pac
 /tightvncviewer
+/_tofu
 /tracepath6
 /_trivy
 /typeset
@@ -348,4 +353,5 @@
 /xpovray
 /xvnc4viewer
 /ypcat
+/_zarf
 /_zitadel
diff --git a/completions/Makefile.am b/completions/Makefile.am
index ed1f215..219ea10 100644
--- a/completions/Makefile.am
+++ b/completions/Makefile.am
@@ -100,6 +100,7 @@ bashcomp_DATA = 2to3 \
 		ebtables \
 		ecryptfs-migrate-home \
 		_eject \
+		env \
 		eog \
 		ether-wake \
 		evince \
@@ -545,6 +546,7 @@ CLEANFILES = \
 	autossh \
 	autoupdate \
 	avahi-browse-domains \
+	_bao \
 	_black \
 	_blackd \
 	bmake \
@@ -585,6 +587,7 @@ CLEANFILES = \
 	dfutool \
 	_diesel \
 	display \
+	_dlv \
 	_docker \
 	dpkg-deb \
 	dpkg-query \
@@ -644,6 +647,7 @@ CLEANFILES = \
 	gpgv2 \
 	gssdp-device-sniffer \
 	gtar \
+	_gup \
 	hciattach \
 	hciconfig \
 	hd \
@@ -660,6 +664,7 @@ CLEANFILES = \
 	ifstatus \
 	_ignite \
 	import \
+	_incus \
 	_infracost \
 	inotifywatch \
 	insmod.static \
@@ -876,6 +881,7 @@ CLEANFILES = \
 	_tkn \
 	_tkn-pac \
 	tightvncviewer \
+	_tofu \
 	tracepath6 \
 	_trivy \
 	typeset \
@@ -911,6 +917,7 @@ CLEANFILES = \
 	xpovray \
 	xvnc4viewer \
 	ypcat \
+	_zarf \
 	_zitadel
 
 symlinks: $(DATA)
@@ -998,6 +1005,7 @@ symlinks: $(DATA)
 		_constellation \
 		_crc \
 		_datree \
+		_dlv \
 		_docker \
 		_gardenctl \
 		_gh-label \
@@ -1005,8 +1013,10 @@ symlinks: $(DATA)
 		_go-licenses \
 		_gopherjs \
 		_goreleaser \
+		_gup \
 		_helm \
 		_hugo \
+		_incus \
 		_ignite \
 		_istioctl \
 		_k3s \
@@ -1047,6 +1057,7 @@ symlinks: $(DATA)
 		_upctl \
 		_vacuum \
 		_virtctl \
+		_zarf \
 		_zitadel
 	$(ss) gpgv \
 		gpgv2
@@ -1198,7 +1209,7 @@ symlinks: $(DATA)
 	$(ss) update-alternatives \
 		alternatives
 	$(ss) _vault \
-		_consul _nomad _packer _terraform
+		_bao _consul _nomad _packer _terraform _tofu
 	$(ss) vipw \
 		vigr
 	$(ss) vncviewer \
diff --git a/completions/_nox b/completions/_nox
index 40b8bb1..6293109 100644
--- a/completions/_nox
+++ b/completions/_nox
@@ -4,8 +4,8 @@
 # This serves as a fallback in case the completion is not installed otherwise.
 
 eval -- "$(
-    bin_path=$(type -P "$1" 2>/dev/null | command sed 's,/[^/]*$,,')
-    [[ $bin_path ]] && PATH=$bin_path${PATH:+:$PATH}
+    pathcmd=$(type -P -- "$1" 2>/dev/null | command sed 's,/[^/]*$,,')
+    [[ $pathcmd ]] && PATH=$pathcmd${PATH:+:$PATH}
     register-python-argcomplete --shell bash "$1" 2>/dev/null ||
         register-python-argcomplete3 --shell bash "$1" 2>/dev/null
 )"
diff --git a/completions/add_members b/completions/add_members
index d691884..d83957a 100644
--- a/completions/add_members
+++ b/completions/add_members
@@ -24,7 +24,7 @@ _comp_cmd_add_members()
     else
         # Prefer `list_lists` in the same dir as command
         local pathcmd
-        pathcmd=$(type -P "$1") && local PATH=${pathcmd%/*}:$PATH
+        pathcmd=$(type -P -- "$1") && local PATH=${pathcmd%/*}:$PATH
         _comp_xfunc list_lists mailman_lists
     fi
 
diff --git a/completions/apt-get b/completions/apt-get
index f59c62b..4c62b25 100644
--- a/completions/apt-get
+++ b/completions/apt-get
@@ -33,7 +33,7 @@ _comp_cmd_apt_get()
             source)
                 # Prefer `apt-cache` in the same dir as command
                 local pathcmd
-                pathcmd=$(type -P "$1") && local PATH=${pathcmd%/*}:$PATH
+                pathcmd=$(type -P -- "$1") && local PATH=${pathcmd%/*}:$PATH
                 _comp_compgen -x apt-cache packages
                 _comp_compgen -a split -- "$(apt-cache dumpavail |
                     _comp_awk '$1 == "Source:" { print $2 }' | sort -u)"
@@ -79,7 +79,7 @@ _comp_cmd_apt_get()
         --target-release | --default-release | -${noargopts}t)
             # Prefer `apt-cache` in the same dir as command
             local pathcmd
-            pathcmd=$(type -P "$1") && local PATH=${pathcmd%/*}:$PATH
+            pathcmd=$(type -P -- "$1") && local PATH=${pathcmd%/*}:$PATH
             _comp_compgen_split -- "$(apt-cache policy | command sed -ne \
                 's/^ *release.*[ ,]o=\(Debian\|Ubuntu\),a=\(\w*\).*/\2/p')"
             return
diff --git a/completions/arch b/completions/arch
index 7ca9738..e03056f 100644
--- a/completions/arch
+++ b/completions/arch
@@ -34,7 +34,7 @@ _comp_have_command mailmanctl &&
                 1)
                     # Prefer `list_lists` in the same dir as command
                     local pathcmd
-                    pathcmd=$(type -P "$1") && local PATH=${pathcmd%/*}:$PATH
+                    pathcmd=$(type -P -- "$1") && local PATH=${pathcmd%/*}:$PATH
                     _comp_compgen -x list_lists mailman_lists
                     ;;
                 2)
diff --git a/completions/change_pw b/completions/change_pw
index 819c082..dd5dd52 100644
--- a/completions/change_pw
+++ b/completions/change_pw
@@ -9,7 +9,7 @@ _comp_cmd_change_pw()
         -l | --listname)
             # Prefer `list_lists` in the same dir as command
             local pathcmd
-            pathcmd=$(type -P "$1") && local PATH=${pathcmd%/*}:$PATH
+            pathcmd=$(type -P -- "$1") && local PATH=${pathcmd%/*}:$PATH
             _comp_compgen -x list_lists mailman_lists
             return
             ;;
diff --git a/completions/check_db b/completions/check_db
index 6480a11..851829e 100644
--- a/completions/check_db
+++ b/completions/check_db
@@ -10,7 +10,7 @@ _comp_cmd_check_db()
     else
         # Prefer `list_lists` in the same dir as command
         local pathcmd
-        pathcmd=$(type -P "$1") && local PATH=${pathcmd%/*}:$PATH
+        pathcmd=$(type -P -- "$1") && local PATH=${pathcmd%/*}:$PATH
         _comp_compgen -x list_lists mailman_lists
     fi
 
diff --git a/completions/clone_member b/completions/clone_member
index 01f87e6..46514be 100644
--- a/completions/clone_member
+++ b/completions/clone_member
@@ -9,7 +9,7 @@ _comp_cmd_clone_member()
         -l | --listname)
             # Prefer `list_lists` in the same dir as command
             local pathcmd
-            pathcmd=$(type -P "$1") && local PATH=${pathcmd%/*}:$PATH
+            pathcmd=$(type -P -- "$1") && local PATH=${pathcmd%/*}:$PATH
             _comp_compgen -x list_lists mailman_lists
             return
             ;;
diff --git a/completions/config_list b/completions/config_list
index d75ef2e..96a7ab8 100644
--- a/completions/config_list
+++ b/completions/config_list
@@ -20,7 +20,7 @@ _comp_cmd_config_list()
     else
         # Prefer `list_lists` in the same dir as command
         local pathcmd
-        pathcmd=$(type -P "$1") && local PATH=${pathcmd%/*}:$PATH
+        pathcmd=$(type -P -- "$1") && local PATH=${pathcmd%/*}:$PATH
         _comp_xfunc list_lists mailman_lists
     fi
 
diff --git a/completions/cryptsetup b/completions/cryptsetup
index 9d23bfa..dbe2a2c 100644
--- a/completions/cryptsetup
+++ b/completions/cryptsetup
@@ -22,7 +22,7 @@ _comp_cmd_cryptsetup()
             --skip | --iter-time | --timeout | --tries | -${noargopts}[chslSbopitT])
             return
             ;;
-        --key-file | --master-key-file | --header-backup-file | -${noargopts}d)
+        --key-file | --master-key-file | --header | --header-backup-file | -${noargopts}d)
             _comp_compgen_filedir
             return
             ;;
diff --git a/completions/env b/completions/env
new file mode 100644
index 0000000..9576510
--- /dev/null
+++ b/completions/env
@@ -0,0 +1,56 @@
+# bash completion for env(1)                              -*- shell-script -*-
+
+_comp_cmd_env()
+{
+    local cur prev words cword was_split comp_args
+    _comp_initialize -s -- "$@" || return
+
+    local i noargopts='!(-*|*[uCS]*)'
+    for ((i = 1; i <= cword; i++)); do
+        if [[ ${words[i]} != -* || ${words[i]} == -?(-) && i -lt cword ]]; then
+            [[ ${words[i]} == -?(-) ]] && ((i++))
+            for (( ; i <= cword; i++)); do
+                if [[ ${words[i]} != *=* ]]; then
+                    _comp_command_offset "$i"
+                    return
+                fi
+            done
+            break
+        fi
+
+        # shellcheck disable=SC2254
+        [[ ${words[i]} == @(--@(unset|chdir|split-string)|-${noargopts}[uCS]) ]] &&
+            ((i++))
+    done
+
+    # shellcheck disable=SC2254
+    case "$prev" in
+        --unset | -${noargopts}u)
+            _comp_compgen -- -A variable
+            return
+            ;;
+        --chdir | -${noargopts}C)
+            _comp_compgen_filedir -d
+            return
+            ;;
+        --split-string | -${noargopts}S)
+            return
+            ;;
+        --block-signal | --default-signal | --ignore-signal)
+            # TODO signals, but only if completing with a =SIG
+            ;;
+    esac
+
+    [[ $was_split ]] && return
+
+    _comp_variable_assignments "$cur" && return
+
+    if [[ $cur == -* ]]; then
+        _comp_compgen_help || _comp_compgen_usage
+        [[ ${COMPREPLY-} == *= ]] && compopt -o nospace
+        return
+    fi
+} &&
+    complete -F _comp_cmd_env env
+
+# ex: filetype=sh
diff --git a/completions/find_member b/completions/find_member
index d2620e8..35214aa 100644
--- a/completions/find_member
+++ b/completions/find_member
@@ -9,7 +9,7 @@ _comp_cmd_find_member()
         -l | -x | --listname | --exclude)
             # Prefer `list_lists` in the same dir as command
             local pathcmd
-            pathcmd=$(type -P "$1") && local PATH=${pathcmd%/*}:$PATH
+            pathcmd=$(type -P -- "$1") && local PATH=${pathcmd%/*}:$PATH
             _comp_compgen -x list_lists mailman_lists
             return
             ;;
diff --git a/completions/fio b/completions/fio
index 7fbcdd4..51eb74e 100644
--- a/completions/fio
+++ b/completions/fio
@@ -2,7 +2,7 @@
 
 _comp_cmd_fio__compgen_engines()
 {
-    _comp_compgen_split -l -- "$("$1" --enghelp 2>/dev/null | command sed -ne '/^[[:space:]]/p'))"
+    _comp_compgen_split -F $'\t\n' -- "$("$1" --enghelp 2>/dev/null | command sed -ne '/^[[:space:]]/p')"
 }
 
 _comp_cmd_fio()
diff --git a/completions/inject b/completions/inject
index 4b46921..4dc3bc4 100644
--- a/completions/inject
+++ b/completions/inject
@@ -9,7 +9,7 @@ _comp_cmd_inject()
         -l | --listname)
             # Prefer `list_lists` in the same dir as command
             local pathcmd
-            pathcmd=$(type -P "$1") && local PATH=${pathcmd%/*}:$PATH
+            pathcmd=$(type -P -- "$1") && local PATH=${pathcmd%/*}:$PATH
             _comp_compgen -x list_lists mailman_lists
             return
             ;;
diff --git a/completions/ip b/completions/ip
index 09bec5b..3b495b6 100644
--- a/completions/ip
+++ b/completions/ip
@@ -121,6 +121,13 @@ _comp_cmd_ip()
                 add)
                     # TODO
                     ;;
+                afstats)
+                    if [[ $prev == dev ]]; then
+                        _comp_compgen_available_interfaces
+                    else
+                        _comp_compgen -- -W 'dev'
+                    fi
+                    ;;
                 delete)
                     if [[ $prev == type ]]; then
                         _comp_cmd_ip__link_types "$1"
@@ -129,7 +136,7 @@ _comp_cmd_ip()
                         _comp_compgen -a -- -W 'type'
                     fi
                     ;;
-                set)
+                set | change)
                     if ((cword - subcword == 1)); then
                         _comp_compgen_available_interfaces
                     else
@@ -173,7 +180,7 @@ _comp_cmd_ip()
                     ;;
                 *)
                     ((cword == subcword)) &&
-                        _comp_compgen -- -W 'help add delete set show property'
+                        _comp_compgen -- -W 'help add change delete set show property afstats'
                     ;;
             esac
             ;;
@@ -181,13 +188,24 @@ _comp_cmd_ip()
         a | addr | address)
             case $subcmd in
                 add | change | replace)
-                    if [[ $prev == dev ]]; then
-                        _comp_compgen_available_interfaces
-                    elif [[ $prev == scope ]]; then
-                        _comp_cmd_ip__iproute2_etc rt_scopes
-                    else
-                        : # TODO
-                    fi
+                    case $prev in
+                        dev | label)
+                            _comp_compgen_available_interfaces
+                            ;;
+                        scope)
+                            _comp_cmd_ip__iproute2_etc rt_scopes
+                            ;;
+                        broadcast | anycast | peer | metric)
+                            :
+                            ;;
+                        valid_lft | preferred_lft)
+                            _comp_compgen -- -W 'forever'
+                            ;;
+                        *)
+                            _comp_compgen -- -W 'anycast autojoin broadcast dev home label scope nodad metric mngtmpaddr
+			        noprefixroute valid_lft peer preferred_lft'
+                            ;;
+                    esac
                     ;;
                 del)
                     if [[ $prev == dev ]]; then
@@ -241,15 +259,45 @@ _comp_cmd_ip()
 
         r | route)
             case $subcmd in
-                list | flush)
-                    if [[ $prev == proto ]]; then
-                        _comp_cmd_ip__iproute2_etc rt_protos
-                    else
-                        : # TODO
-                    fi
+                list | flush | save)
+                    case "$prev" in
+                        proto)
+                            _comp_cmd_ip__iproute2_etc rt_protos
+                            ;;
+                        table)
+                            _comp_compgen -- -W 'local main default all'
+                            ;;
+                        scope)
+                            _comp_cmd_ip__iproute2_etc rt_scopes
+                            ;;
+                        root | match | exact | vrf)
+                            : # TODO: Can we complete vrf?
+                            ;;
+                        type)
+                            _comp_compgen -- -W 'unicast local broadcast multicast throw unreachable prohibit blackhole nat'
+                            ;;
+                        *)
+                            _comp_compgen -- -W 'root match exact table vrf proto type scope'
+                            ;;
+                    esac
                     ;;
                 get)
-                    # TODO
+                    case $prev in
+                        as | dport | from | sport | ipproto | vrf | to | tos | mark)
+                            : # TODO: Can we complete ipproto, tos, or vrf?
+                            ;;
+                        uid)
+                            _comp_compgen_uids
+                            ;;
+                        oif | iif | dev)
+                            _comp_compgen_available_interfaces -a
+                            ;;
+                        *)
+                            # TODO: 'iif' only works if also 'from' is specified
+                            _comp_compgen -- -W 'as connected dport from fibmatch
+			        iif ipproto mark notify oif sport to tos uid vrf'
+                            ;;
+                    esac
                     ;;
                 a | add | d | del | change | append | r | replace)
                     if [[ $prev == via ]]; then
@@ -276,7 +324,7 @@ _comp_cmd_ip()
                 *)
                     ((cword == subcword)) &&
                         _comp_compgen -- -W 'help list flush get add del change
-                            append replace'
+                            append replace save showdump'
                     ;;
             esac
             ;;
@@ -357,7 +405,26 @@ _comp_cmd_ip()
         n | neigh | neighbor | neighbour)
             case $subcmd in
                 add | del | change | replace)
-                    # TODO
+                    case $prev in
+                        lladdr)
+                            _comp_compgen_mac_addresses
+                            ;;
+                        nud)
+                            _comp_cmd_ip__neigh_states "$1"
+                            ;;
+                        dev)
+                            _comp_compgen_available_interfaces
+                            ;;
+                        protocol)
+                            _comp_cmd_ip__iproute2_etc rt_protos
+                            ;;
+                        proxy)
+                            :
+                            ;;
+                        *)
+                            _comp_compgen -- -W 'lladdr nud proxy dev router use managed extern_learn protocol'
+                            ;;
+                    esac
                     ;;
                 show | flush)
                     case "$prev" in
@@ -367,7 +434,7 @@ _comp_cmd_ip()
                         dev)
                             _comp_compgen_available_interfaces
                             ;;
-                        nomaster | proxy | to | vrf) # TODO - Maybe we can complete vrf here?
+                        to | vrf) # TODO - Maybe we can complete vrf here?
                             :
                             ;;
                         *)
diff --git a/completions/iperf b/completions/iperf
index 0168814..ef2860a 100644
--- a/completions/iperf
+++ b/completions/iperf
@@ -5,16 +5,16 @@ _comp_cmd_iperf()
     local cur prev words cword was_split comp_args
     _comp_initialize -s -n : -- "$@" || return
 
-    local noargopts='!(-*|*[ilpwMXbntLPTZCkOSAfIoFBcxy]*)'
+    local noargopts='!(-*|*[ilpwMXbntLPTZCkOAfIoFBcxy]*)'
     # shellcheck disable=SC2254
     case $prev in
         --help | --version | --interval | --len | --port | --window | --mss | --bandwidth | \
             --num | --time | --listenport | --parallel | --ttl | --linux-congestion | --omit | \
             --congestion | --bytes | --blockcount | --cport | --set-mss | --flowlabel | \
-            --title | --tos | --affinity | --rcv-timeout | --server-bitrate-limit | \
+            --title | --affinity | --rcv-timeout | --server-bitrate-limit | \
             --idle-timeout | --time-skew-threshold | --xbind | --nstreams | --connect-timeout | \
             --bitrate | --pacing-timer | --fq-rate | --length | --dscp | --extra-data | \
-            --username | -${noargopts}[hvilpwMXbntLPTZCkOSA])
+            --username | -${noargopts}[hvilpwMXbntLPTZCkOA])
             return
             ;;
         --format | -${noargopts}f)
@@ -59,6 +59,10 @@ _comp_cmd_iperf()
             _comp_compgen_filedir log
             return
             ;;
+        --tos | -${noargopts}S)
+            _comp_compgen -- -W '{0..255}'
+            return
+            ;;
         --rsa-private-key-path | --rsa-public-key-path)
             _comp_compgen_filedir pem
             return
diff --git a/completions/list_admins b/completions/list_admins
index 98452eb..e9de58e 100644
--- a/completions/list_admins
+++ b/completions/list_admins
@@ -10,7 +10,7 @@ _comp_cmd_list_admins()
     else
         # Prefer `list_lists` in the same dir as command
         local pathcmd
-        pathcmd=$(type -P "$1") && local PATH=${pathcmd%/*}:$PATH
+        pathcmd=$(type -P -- "$1") && local PATH=${pathcmd%/*}:$PATH
         _comp_compgen -x list_lists mailman_lists
     fi
 
diff --git a/completions/list_members b/completions/list_members
index a15a2cc..52d9398 100644
--- a/completions/list_members
+++ b/completions/list_members
@@ -28,7 +28,7 @@ _comp_cmd_list_members()
     else
         # Prefer `list_lists` in the same dir as command
         local pathcmd
-        pathcmd=$(type -P "$1") && local PATH=${pathcmd%/*}:$PATH
+        pathcmd=$(type -P -- "$1") && local PATH=${pathcmd%/*}:$PATH
         _comp_compgen -x list_lists mailman_lists
     fi
 
diff --git a/completions/list_owners b/completions/list_owners
index 6179176..f9e4225 100644
--- a/completions/list_owners
+++ b/completions/list_owners
@@ -10,7 +10,7 @@ _comp_cmd_list_owners()
     else
         # Prefer `list_lists` in the same dir as command
         local pathcmd
-        pathcmd=$(type -P "$1") && local PATH=${pathcmd%/*}:$PATH
+        pathcmd=$(type -P -- "$1") && local PATH=${pathcmd%/*}:$PATH
         _comp_compgen -x list_lists mailman_lists
     fi
 
diff --git a/completions/mysql b/completions/mysql
index 4ba049f..f1b9a9b 100644
--- a/completions/mysql
+++ b/completions/mysql
@@ -24,7 +24,7 @@ _comp_cmd_mysql()
 
     # Prefer `mysqlshow` in the same dir as the command
     local pathcmd
-    pathcmd=$(type -P "$1") && local PATH=${pathcmd%/*}:$PATH
+    pathcmd=$(type -P -- "$1") && local PATH=${pathcmd%/*}:$PATH
 
     local noargopts='!(-*|*[uDhSPeI]*)'
     # shellcheck disable=SC2254
diff --git a/completions/newlist b/completions/newlist
index b4e6060..1e4d26e 100644
--- a/completions/newlist
+++ b/completions/newlist
@@ -19,7 +19,7 @@ _comp_cmd_newlist()
     else
         # Prefer `list_lists` in the same dir as command
         local pathcmd
-        pathcmd=$(type -P "$1") && local PATH=${pathcmd%/*}:$PATH
+        pathcmd=$(type -P -- "$1") && local PATH=${pathcmd%/*}:$PATH
         _comp_compgen -x list_lists mailman_lists
     fi
 } &&
diff --git a/completions/perl b/completions/perl
index 9b82777..ee852f1 100644
--- a/completions/perl
+++ b/completions/perl
@@ -107,7 +107,7 @@ _comp_cmd_perldoc()
 
     # Prefer `perl` in the same dir in utility functions
     local pathcmd
-    pathcmd=$(type -P "$1") && local PATH=${pathcmd%/*}:$PATH
+    pathcmd=$(type -P -- "$1") && local PATH=${pathcmd%/*}:$PATH
 
     case $prev in
         -*[hVnoMwL])
diff --git a/completions/pkgutil b/completions/pkgutil
index 63dc400..0b2e4ec 100644
--- a/completions/pkgutil
+++ b/completions/pkgutil
@@ -1,6 +1,9 @@
 # pkgutil completion                                       -*- shell-script -*-
 # Copyright 2006 Yann Rouillard <yann@opencsw.org>
 
+# At least macOS pkgutil is different
+[[ $OSTYPE == *solaris* ]] || return 1
+
 _comp_cmd_pkgutil__url2catalog()
 {
     local filename="$1"
diff --git a/completions/pydoc b/completions/pydoc
index 2cf2987..12e83e4 100644
--- a/completions/pydoc
+++ b/completions/pydoc
@@ -25,7 +25,7 @@ _comp_cmd_pydoc()
     if ! _comp_looks_like_path "$cur"; then
         # Prefer python in the same dir for resolving modules
         local pathcmd
-        pathcmd=$(type -P "$1") && local PATH=${pathcmd%/*}:$PATH
+        pathcmd=$(type -P -- "$1") && local PATH=${pathcmd%/*}:$PATH
         _comp_compgen -ax python modules
     fi
 
diff --git a/completions/remove_members b/completions/remove_members
index 4689b03..6f1290d 100644
--- a/completions/remove_members
+++ b/completions/remove_members
@@ -20,7 +20,7 @@ _comp_cmd_remove_members()
     else
         # Prefer `list_lists` in the same dir as command
         local pathcmd
-        pathcmd=$(type -P "$1") && local PATH=${pathcmd%/*}:$PATH
+        pathcmd=$(type -P -- "$1") && local PATH=${pathcmd%/*}:$PATH
         _comp_compgen -x list_lists mailman_lists
     fi
 
diff --git a/completions/rmlist b/completions/rmlist
index f3aca06..b5c140e 100644
--- a/completions/rmlist
+++ b/completions/rmlist
@@ -10,7 +10,7 @@ _comp_cmd_rmlist()
     else
         # Prefer `list_lists` in the same dir as command
         local pathcmd
-        pathcmd=$(type -P "$1") && local PATH=${pathcmd%/*}:$PATH
+        pathcmd=$(type -P -- "$1") && local PATH=${pathcmd%/*}:$PATH
         _comp_compgen -x list_lists mailman_lists
     fi
 
diff --git a/completions/rpm b/completions/rpm
index b6cafa5..1ffbeae 100644
--- a/completions/rpm
+++ b/completions/rpm
@@ -262,7 +262,7 @@ _comp_cmd_rpmbuild()
         --target | --eval | -${noargopts}E | --buildpolicy)
             # Prefer `rpm` in the same dir in utility functions
             local pathcmd
-            pathcmd=$(type -P "$1") && local PATH=${pathcmd%/*}:$PATH
+            pathcmd=$(type -P -- "$1") && local PATH=${pathcmd%/*}:$PATH
             ;;&
         --target)
             _comp_cmd_rpm__buildarchs
diff --git a/completions/ssh b/completions/ssh
index 386fd25..561dd07 100644
--- a/completions/ssh
+++ b/completions/ssh
@@ -404,7 +404,7 @@ _comp_cmd_sftp()
 
     # Prefer `ssh` from same dir for resolving options, etc
     local pathcmd
-    pathcmd=$(type -P "$1") && local PATH=${pathcmd%/*}:$PATH
+    pathcmd=$(type -P -- "$1") && local PATH=${pathcmd%/*}:$PATH
 
     _comp_xfunc_ssh_compgen_suboption_check && return
 
@@ -469,7 +469,7 @@ _comp_cmd_scp__path_esc='[][(){}<>"'"'"',:;^&!$=?`\\|[:space:]]'
 _comp_xfunc_scp_compgen_remote_files()
 {
     # remove backslash escape from the first colon
-    cur=${cur/\\:/:}
+    local cur=${cur/\\:/:}
 
     local _userhost=${cur%%?(\\):*}
     local _path=${cur#*:}
@@ -499,7 +499,7 @@ _comp_xfunc_scp_compgen_remote_files()
             command sed -e 's/'"$_comp_cmd_scp__path_esc"'/\\\\\\&/g' -e 's/[*@|=]$//g' \
                 -e 's/[^\/]$/& /g')
     fi
-    _comp_compgen_split -l -- "$_files"
+    _comp_compgen -R split -l -- "$_files"
 }
 
 # @deprecated 2.12 use `_comp_compgen -ax ssh remote_files` instead
@@ -556,7 +556,7 @@ _comp_cmd_scp()
 
     # Prefer `ssh` from same dir for resolving options, remote files, etc
     local pathcmd
-    pathcmd=$(type -P "$1") && local PATH=${pathcmd%/*}:$PATH
+    pathcmd=$(type -P -- "$1") && local PATH=${pathcmd%/*}:$PATH
 
     _comp_xfunc_ssh_compgen_suboption_check && {
         ((${#COMPREPLY[@]})) && COMPREPLY=("${COMPREPLY[@]/%/ }")
diff --git a/completions/ssh-add b/completions/ssh-add
index 23c73e0..0589972 100644
--- a/completions/ssh-add
+++ b/completions/ssh-add
@@ -10,6 +10,19 @@ _comp_cmd_ssh_add()
             _comp_compgen -- -W 'md5 sha256'
             return
             ;;
+        -*H)
+            _comp_compgen_filedir
+            return
+            ;;
+        -*h)
+            # TODO should we try supporting more types of constraints?
+            if [[ $cur == *@* ]]; then
+                _comp_complete_user_at_host "$@"
+            else
+                _comp_compgen_known_hosts -- "$cur"
+            fi
+            return
+            ;;
         -*t)
             return
             ;;
@@ -17,14 +30,14 @@ _comp_cmd_ssh_add()
             _comp_compgen_filedir
             return
             ;;
-        -*[se])
+        -*S | -*[se])
             _comp_compgen_filedir so
             return
             ;;
     esac
 
     if [[ $cur == -* ]]; then
-        _comp_compgen_help -- '-?'
+        _comp_compgen_usage -- '-?' || _comp_compgen_help -- '-?'
         return
     fi
 
diff --git a/completions/ssh-copy-id b/completions/ssh-copy-id
index 52aa9d7..5ead5a6 100644
--- a/completions/ssh-copy-id
+++ b/completions/ssh-copy-id
@@ -7,7 +7,7 @@ _comp_cmd_ssh_copy_id()
 
     # Prefer `ssh` from same dir for resolving options, etc
     local pathcmd
-    pathcmd=$(type -P "$1") && local PATH=${pathcmd%/*}:$PATH
+    pathcmd=$(type -P -- "$1") && local PATH=${pathcmd%/*}:$PATH
 
     _comp_compgen -x ssh suboption_check && return
 
@@ -16,7 +16,11 @@ _comp_cmd_ssh_copy_id()
             _comp_compgen -x ssh identityfile pub
             return
             ;;
-        -p)
+        -p | -t)
+            return
+            ;;
+        -F)
+            _comp_compgen_filedir
             return
             ;;
         -o)
diff --git a/completions/ssh-keygen b/completions/ssh-keygen
index 3f9d175..095f36b 100644
--- a/completions/ssh-keygen
+++ b/completions/ssh-keygen
@@ -5,11 +5,14 @@ _comp_cmd_ssh_keygen()
     local cur prev words cword comp_args
     _comp_initialize -n := -- "$@" || return
 
+    local IFS=$' \t\n' # for ${words[*]}
+    local noargopts='!(-*|*[ aCIJjMNPSVWzbEFRDwfGKsTmnOrtY]*)'
+    # shellcheck disable=SC2254
     case $prev in
-        -*[aCIJjMNPSVWz])
+        -${noargopts}[aCIJjMNPSVWz])
             return
             ;;
-        -*b)
+        -${noargopts}b)
             local -a sizes=()
             case "${words[*]}" in
                 *" -t dsa"?( *))
@@ -26,28 +29,28 @@ _comp_cmd_ssh_keygen()
                 _comp_compgen -- -W '"${sizes[@]}"'
             return
             ;;
-        -*E)
+        -${noargopts}E)
             _comp_compgen -- -W 'md5 sha256'
             return
             ;;
-        -*[FR])
+        -${noargopts}[FR])
             # TODO: trim this down to actual entries in known hosts files
             _comp_compgen_known_hosts -- "$cur"
             return
             ;;
-        -*[Dw])
+        -${noargopts}[Dw])
             _comp_compgen_filedir so
             return
             ;;
-        -*[fGKsT])
+        -${noargopts}[fGKsT])
             _comp_compgen_filedir
             return
             ;;
-        -*m)
+        -${noargopts}m)
             _comp_compgen -- -W 'PEM PKCS8 RFC4716'
             return
             ;;
-        -*n)
+        -${noargopts}n)
             [[ ${words[*]} != *\ -*Y\ * ]] || return
             if [[ ${words[*]} == *\ -*h\ * ]]; then
                 _comp_compgen_known_hosts -- "${cur##*,}"
@@ -58,19 +61,41 @@ _comp_cmd_ssh_keygen()
             fi
             return
             ;;
-        -*O)
+        -${noargopts}O)
             if [[ $cur != *=* ]]; then
-                _comp_compgen -- -W 'clear critical: extension: force-command=
-                    no-agent-forwarding no-port-forwarding no-pty no-user-rc
-                    no-x11-forwarding permit-agent-forwarding
-                    permit-port-forwarding permit-pty permit-user-rc
-                    permit-X11-forwarding no-touch-required source-address=
-                    verify-required
-
-                    lines= start-line= checkpoint= memory= start= generator=
-
-                    application= challenge= device= no-touch-required resident
-                    user= write-attestation='
+                local -a opts=()
+                case ${words[*]} in
+                    *\ -${noargopts}M\ *)
+                        opts=(
+                            lines= start-line= checkpoint= memory= start=
+                            generator=
+                        )
+                        ;;
+                    *\ -${noargopts}r\ *)
+                        opts=(hashalg=)
+                        ;;
+                    *\ -${noargopts}s\ *)
+                        opts=(
+                            clear critical: extension: force-command=
+                            no-agent-forwarding no-port-forwarding no-pty
+                            no-user-rc no-x11-forwarding permit-agent-forwarding
+                            permit-port-forwarding permit-pty permit-user-rc
+                            permit-X11-forwarding no-touch-required
+                            source-address= verify-required
+                        )
+                        ;;
+                    *\ -${noargopts}t\ +([a-z0-9])-sk\ *)
+                        opts=(
+                            application= challenge= device= no-touch-required
+                            resident user= verify-required write-attestation=
+                        )
+                        ;;
+                    *\ -${noargopts}Y\ *)
+                        opts=(hashalg= print-pubkey verify-time)
+                        ;;
+                esac
+                ((${#opts[@]})) &&
+                    _comp_compgen -- -W '"${opts[@]}"'
 
                 [[ ${COMPREPLY-} == *[:=] ]] && compopt -o nospace
                 _comp_ltrim_colon_completions "$cur"
@@ -90,18 +115,31 @@ _comp_cmd_ssh_keygen()
                     user=*)
                         _comp_compgen -c "${cur#*=}" -- -u
                         ;;
+                    hashalg=*)
+                        local -a args=()
+                        case ${words[*]} in
+                            *\ -*Y\ *)
+                                args=(sha256 sha512)
+                                ;;
+                            *\ -*r\ *)
+                                args=(sha1 sha256)
+                                ;;
+                        esac
+                        ((${#args[@]})) &&
+                            _comp_compgen -c "${cur#*=}" -- -W '"${args[@]}"'
+                        ;;
                 esac
             fi
             return
             ;;
-        -*r)
-            [[ ${words[*]} != *\ -*Y\ * ]] || _comp_compgen_filedir
+        -${noargopts}r)
+            [[ ${words[*]} != *\ -${noargopts}Y\ * ]] || _comp_compgen_filedir
             return
             ;;
-        -*t)
+        -${noargopts}t)
             # Prefer `ssh` from same dir for resolving options, etc
             local pathcmd protocols
-            pathcmd=$(type -P "$1") && local PATH=${pathcmd%/*}:$PATH
+            pathcmd=$(type -P -- "$1") && local PATH=${pathcmd%/*}:$PATH
             _comp_compgen -v protocols -x ssh query protocol-version
             local types='dsa ecdsa ecdsa-sk ed25519 ed25519-sk rsa'
             if [[ ${protocols[*]} == *1* ]]; then
@@ -110,7 +148,7 @@ _comp_cmd_ssh_keygen()
             _comp_compgen -- -W "$types"
             return
             ;;
-        -*Y)
+        -${noargopts}Y)
             _comp_compgen -- -W 'find-principals check-novalidate sign verify'
             return
             ;;
@@ -122,7 +160,7 @@ _comp_cmd_ssh_keygen()
             _comp_compgen_help -- "-?" # OpenSSH < 7
     fi
 
-    if [[ ${words[*]} == *\ -*s\ * ]]; then
+    if [[ ${words[*]} == *\ -${noargopts}s\ * ]]; then
         _comp_compgen -a filedir pub
     fi
 } &&
diff --git a/completions/ssh-keyscan b/completions/ssh-keyscan
index f5e4364..e9d92cc 100644
--- a/completions/ssh-keyscan
+++ b/completions/ssh-keyscan
@@ -3,7 +3,7 @@
 _comp_cmd_ssh_keyscan()
 {
     local cur prev words cword comp_args
-    _comp_initialize -- "$@" || return
+    _comp_initialize -n = -- "$@" || return
 
     local ipvx
 
@@ -18,6 +18,20 @@ _comp_cmd_ssh_keyscan()
             _comp_compgen_filedir
             return
             ;;
+        -*O)
+            case $cur in
+                hashalg=*)
+                    cur=${cur#*=}
+                    _comp_compgen -- -W 'sha1 sha256'
+                    ;;
+                *=*) ;;
+                *)
+                    _comp_compgen -- -W 'hashalg='
+                    compopt -o nospace
+                    ;;
+            esac
+            return
+            ;;
         -*p | -*T)
             return
             ;;
diff --git a/completions/sync_members b/completions/sync_members
index e8c07a7..450651f 100644
--- a/completions/sync_members
+++ b/completions/sync_members
@@ -24,7 +24,7 @@ _comp_cmd_sync_members()
     else
         # Prefer `list_lists` in the same dir as command
         local pathcmd
-        pathcmd=$(type -P "$1") && local PATH=${pathcmd%/*}:$PATH
+        pathcmd=$(type -P -- "$1") && local PATH=${pathcmd%/*}:$PATH
         _comp_compgen -x list_lists mailman_lists
     fi
 
diff --git a/completions/withlist b/completions/withlist
index f687511..b91346a 100644
--- a/completions/withlist
+++ b/completions/withlist
@@ -10,7 +10,7 @@ _comp_cmd_withlist()
     else
         # Prefer `list_lists` in the same dir as command
         local pathcmd
-        pathcmd=$(type -P "$1") && local PATH=${pathcmd%/*}:$PATH
+        pathcmd=$(type -P -- "$1") && local PATH=${pathcmd%/*}:$PATH
         _comp_compgen -x list_lists mailman_lists
     fi