Fix shebang lines for NixOS compatibility

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/tools/pull/171)

Move OpenSSL-Query from omc-tools

Fixes #134

Co-authored-by: Matthias St. Pierre <matthias.st.pierre@ncp-e.com>
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/tools/pull/170)

Add 3.2 branch to pick-to-branch and opensslpull

Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/tools/pull/169)

release-tools/do-copyright-year: Always update copyright year in README.md

The copyright in README.md is supposed to have global scope.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/tools/pull/159)

Reorganize the release HOWTO

This splits up HOWTO-make-a-release.md into two new documents that reflect
the fact that *staging* and *publishing* a release are really two separate
things.

This also reflects that we're working towards full automation for staging
releases.

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/tools/pull/145)

Add how to handle security issues document

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/tools/pull/165)

Add a performance test for PEM_read_bio_PrivateKey()

We repeatedly attempt to load an RSA Private Key and measure performance.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/tools/pull/161)

Enable a different announcement for premium releases

The basic data of what is considered premium and what is considered
public releases, a new bash function is added, std_release_type(), found in
release-tools/release-aux/release-data-fn.sh.

Along with this, the non-descript variable 'tag' is renamed to 'release_tag',
and a spelling error is corrected.

Fixes #157

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/tools/pull/160)

release-tools/stage-release.sh: Update copyright year

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/tools/pull/155)

release-tools/do-copyright-year: Do not commit the changes!

Leave it to the caller to do what they want with the changes.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/tools/pull/156)

Add a performance test for OSSL_PROVIDER_do_all()

This tests calls the OSSL_PROVIDER_do_all() function repeatedly in a loop.
This function can be called directly by user code, but is also used during
the initialisation of an SSL_CTX to discover TLS capabilities from
providers (e.g. pluggable groups etc).

The underlying internal function ossl_provider_doall_activated() will
also be tested by this. That function is called during algorithm fetching
(if the algorithms have not yet been cached).

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/tools/pull/154)

Add a performance test for X509_CTX_CTX_get1_issuer()

This test just call X509_STORE_CTX_get1_issuer() in a loop with an empty
store. This function is usually called as part of chain building during a
certificate verify operation.

Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/tools/pull/150)

A few fixes for release-tools/stage-release.sh

Correcting these issues:

- The update branch and release branch were created each on different sides
  of a 'next_release_state' call, which made them differ even though there
  shouldn't be any difference (i.e. --branch was given or implied).
- Running 'do-copyright-year' was done after configuration, and may change
  Configure, which means that the following 'make' call may reconfigure and
  intentionally fail, causing release staging failure.
- In the metadata, the 'staging_update_branch' entry was set to the original
  update branch.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/tools/pull/153)

Add an RSA signing performance test

Unlike "speed" this performs RSA operations in parallel using threads
(as opposed to the -multi speed option which uses "fork").

Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/tools/pull/152)

Add a performance test for EVP_PKEY_new_raw_public_key_ex()

We add a performance test for repeatedly calling
EVP_PKEY_new_raw_public_key_ex(). Note this test does not support 1.1.1.

Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/tools/pull/149)

Add a performance test for constructing an SSL and associated BIO objects

We repeatedly call SSL_new() and BIO_new() (followed by appropriate free
calls), for a specified number of threads.

Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/tools/pull/148)

Add details about the handshake script to the README

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/tools/pull/146)

Add a --terse option

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/tools/pull/146)

Add a handshake performance test

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/tools/pull/146)

Move some common code out of randbytes

We move some code out of the randbytes test into perflib so we can later
reuse it.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/tools/pull/146)

Add a README for the performance testing tools

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/tools/pull/146)

Add a clean target for the Makefile

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/tools/pull/146)

Create a RAND_bytes() performance testing script

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/tools/pull/146)

Add some performance testing tools

Initial commit to add some performance testing tools. We start by adapting
some code from the main line for standalone use.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/tools/pull/146)

release-tools/do-copyright-year: Modify files with more care

Files were modified by running a simple in-place sed (i.e. 'sed -i').
This turns out to update the modification time on every file, even those
that remain unmodified.

The effect is that time stamps in a source directory become unreliable,
causing configdata.pm to be "mysteriously" older than (unmodified) files it
depends on, which causes a spurious reconfiguration when running 'make'
again.

To mediate, the loop is modified to take copies of the original files, run
an in-place sed on those, and only move them back to the original files if
there were any actual modifications.  That should leave time stamps alone on
unmodified files.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/tools/pull/151)

release-tools/stage-release.sh: Add a run of 'do-copyright-year'

We did this as a manual step when the release staging script was in another
repository.

Now that they are in the same repository (in the same directory, even!),
there's no reason not to run 'do-copyright-year' automatically.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/tools/pull/144)

Include the original HEAD in the porcelain output

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/tools/pull/140)

release-tools/stage-release.sh: Use 'type -p' and realpath to find $0

This allows the release-aux directory to be found, even when a symbolic
link to this script is used.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/tools/pull/140)

release-tools/stage-release.sh: Add --unsigned

This allows staging to produce unsigned files, and to add an annotated
but unsigned tag.  The signing can be done later, when promoting a staged
release to an actual release.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/tools/pull/140)

release-tools/stage-release.sh: Add a metadata file among the release files

This file contains shell variable assignments with diverse data that may
serve other release scripts.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/tools/pull/140)

Clarify that the release script only stages the release files

This renames release-tools/release.sh to release-tools/stage-release.sh,
and modifies the option --upload-address to --staging-address.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/tools/pull/140)

release.sh: Add --clean-worktree, --branch_fmt and --tag-fmt

This needed quite a bit of rearrangement to make sense.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/tools/pull/140)

release.sh: Also present the uploaded/to be uploaded files with --porcelain

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/tools/pull/140)

release.sh: Add --quiet and --porcelain

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/tools/pull/140)

When checking for make update changes, only check tracked files

Sometimes, 'make update' leaves behind files that aren't tracked, and this
shouldn't cause trying to add an extra commit.  However, we only checked
with 'git status --porcelain', which does list untracked files.  This can
cause release failure, so we add a few more options so git status doesn't
report on these files that should be ignored.

This also includes a documenting comment for a piece of the scripts that's
potentially confusing without the explanation.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/tools/pull/140)

Adapt release-tools/release.sh for pre-3.0 versions

There are small differences, such as some make targets not existing,
the method for creating tarballs being different in 1.0.2, ...

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/tools/pull/140)

Add an option to specify the upload address

Both local directory and several forms of SCP/SFTP addresses are supported.
For the SCP/SFTP form, it is always translated to be usable with SFTP.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/tools/pull/140)

Adapt documentation for the new release script, and clean up

release-tools/release.sh and associated files should now be a good enough
replacement of release-tools/mkrelease.pl and associated files.
Therefore, HOWTO-make-a-release.md is adapted to only refer to the new
script, and release-tools/mkrelease.pl and associated files are removed.

Someone might want to ask, why shell scripts rather than perl?
The reasoning is that the OpenSSL team does most if not all its development
on Unix-like systems, and the release script is essentially a wrapper around
diverse shell commands anyway, it therefore seems sensible to use the shell
language.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/tools/pull/140)

release-tools/release.sh et al: introduce RELEASE_FILES and use it

This is a variable that holds a list of files other than the version file,
that need to be touched up with release information.  This variable is set
by the version functions, as the files are varied, depending on the versio
scheme and series.

We also add the fixup files for all possible release files.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/tools/pull/140)

release-tools/release.sh et al: introduce FULL_VERSION and use it

This is a convenience variable, combined from $VERSION, $_PRE_RELEASE_TAG
and $_BUILD_METADATA.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/tools/pull/140)

Adapt release-tools/release.sh for a life outside of the OpenSSL work tree

This makes use of the VERSION_FILE variable that is delivered by
release-tools/release-aux/release-version-fn.sh

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/tools/pull/140)

Adapt release-tools/release-aux/release-version-fn.sh for pre-3.0 versions

This also adds a test script release-tools/release-aux/test_suite.sh, to
check that all these functions behave as expected.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/tools/pull/140)

release-tools/release-aux/ documentation updates and small fixes

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/tools/pull/140)

Import openssl/openssl's dev/release.sh and accompanying files

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/tools/pull/140)

Don't cross-post security advisories to oss-security

We should send any security advisory to oss-security separately and not
cross-post it with our own lists.

We also change the text to say that security advisories should be sent to
support-announce regardless of whether a premium release has been affected.

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/tools/pull/139)

Add fuzz-corpora to review-tools

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/tools/pull/143)

pick-to-branch: warn if target remote is not in github.openssl.org

Fixes #141

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/tools/pull/142)

Update the release HOWTO following the 3.1 release

We now need to upload the release files to the "Releases" section of
github - so we update the HOWTO instructions accordingly.
This also fixes a minor error that was spotted during the release.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/tools/pull/128)

Update README

CLA: trivial
fix typo

Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/tools/pull/137)

Add oss-security to the lists that receive advisory details

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/tools/pull/135)

pick-to-branch: fix exit message by making variable name consistent

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/tools/pull/133)

ghmerge: support handling conflicts on interactive rebase

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/tools/pull/132)

Cover the premium release as well

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/tools/pull/130)

Updates of things that have aged

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/tools/pull/130)

review-tools/opensslpull: add 3.1

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/tools/pull/131)

ghmerge: support handling conflicts on --cherry-pick

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/tools/pull/129)

The command to freeze the repository isn't quite right, fix it

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/tools/pull/128)

ghmerge and pick-to-branch: improve hints on how to handle conflicts

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/tools/pull/126)

3.0.0 is out so don't special case things as being deferred

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/tools/pull/127)

gmerge and pick-to-branch: further tweak output

Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/tools/pull/111)

Modify mkrelease.pl to have a different announce text for premium releases

^CT-142 Closed

HOWTO-make-a-release.md:take into account the moved secadv files

This includes vulnerabilities.xml and all of secadv/*

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/tools/pull/120)

HOWTO-make-a-release.md: take into account the moved newsflash.txt

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/tools/pull/120)

Update HOWTO-make-a-release.md to refer to OpenSSL's Github instance

openssl-git@git.openssl.org:openssl.git is no more.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/tools/pull/119)

Drop release-tools/README.md

We have HOWTO-make-a-release.md, which is a more up to date version of
the same information.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/tools/pull/118)

Update addrev to allow self-review on release

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/tools/pull/117)

The web repo is governed by the OMC...

... and should therefore require a minimum of one OMC member reviewing.

In a similar vein, we also specify that the tools repo is governed by
the OTC.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/tools/pull/114)

Depending on the repo, authors may still count as a reviewer

For the main repo, the author is never counted as a reviewer.
For the web and tools repos, the author is counted.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/tools/pull/114)

Allow Release line to be added to all commits touched by addrev

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/web/pull/115)

Support release review requirement bypass for 1.1.1/1.0.2

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/web/pull/115)

pick-to-branch: Allow fixing trivial conflicts when cherry-picking

Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/tools/pull/110)

Add the tool for GH openssl-machine to ping and close stale PRs

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/tools/pull/108)

Don't add the author to the unknown reviewers list

If the author is a known reviewer, don't add them to the unknown reviewers
list.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/tools/pull/107)

ghmerge: The default remote is on github.openssl.org

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/tools/pull/103)

Don't let addrev count the author as a reviewer

As per the latest policy change the author is no longer counted as a
reviewer, so we ensure addrev disallows this.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/tools/pull/105)

pick-to-branch: restrict 'git pull --ff-only' to target branch

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/tools/pull/101)

pick-to-branch: allow 'h' or 'HEAD' as first argument, which leads to using the master HEAD

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/tools/pull/101)

pick-to-branch: restore to original commit HEAD of target on error/abort

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/tools/pull/101)

pick-to-branch: rename 'branch' to 'target' for clarity

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/tools/pull/101)

pick-to-branch: improve user guidance and streamline interaction

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/tools/pull/101)

ghmerge: support stopping rebase for adaptations

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/tools/pull/102)

pick-to-branch: Allow cherry-picking multiple commits at once

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/tools/pull/100)

pick-to-branch: Improve fix of behavior on failed cherry-pick

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/tools/pull/99)

pick-to-branch: make sure that local branch is up-to-date

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/tools/pull/98)

pick-to-branch: revert cherry-pick if aborted by user

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/tools/pull/98)

ghmerge: restore to original commit HEAD of target on error/abort

Also add an empty line before the git log output for readability.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/tools/pull/97)

ghmerge: correct assignment to WORK_USED

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/tools/pull/97)

ghmerge: Rename --ref to --target for clarity

We are keeping --ref for backward compat.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/tools/pull/97)

ghmerge: extend --cherry-pick with the number of commits to pick

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/tools/pull/97)

ghmerge: Fix behavior on failed cherry-pick, rebase, and pull

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/tools/pull/97)

pick-to-branch: fix inferring the id from master branch

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/tools/pull/96)

Make it more explicit how to push tags

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/tools/pull/90)

pick-to-branch: Further improve user guidance on commit id

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/tools/pull/95)

pick-to-branch: Fix behavior on failed cherry-pick

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/tools/pull/95)

pick-to-branch: Improve diagnostics on bad target branch

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/tools/pull/95)

pick-to-branch: Fix the case that commit id is derived from HEAD of master

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/tools/pull/95)

pick-to-branch: Preserve current branch and its state if it is not the target

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/tools/pull/95)

pick-to-branch: Improve user guidance

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/tools/pull/95)

ghmerge: Avoid checking out ref branch if not needed

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/tools/pull/94)

ghmerge: Improve robustness and clarity regarding which ref branch is used

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/tools/pull/94)