wild fits inside 32 elements, like UsmUserEntry objects.
OK rob@, claudio@

check that the resulting db works instead of some more specific test
okay schwarze@

ok deraadt@

okay millert@, tb@

From j@bitminer.ca with input from Andras Farkas, deraadt, joerg@netbsd
"fix however you feel best!" jmc

While FIDO/U2F keys were already supported by the generic uhid(4)
driver, this driver adds the first step to tighten the security of
FIDO/U2F access.  Specifically, users don't need read/write access to
all USB/HID devices anymore and the driver also improves integration
with pledge(2) and unveil(2): It is pledge-friendly because it doesn't
require any ioctls to discover the device and unveil-friendly because
it uses a single /dev/fido/* directory for its device nodes.
It also allows to support FIDO/U2F in firefox without further
weakening the "sandbox" of the browser.  Firefox does not have a
proper privsep design and many operations, such as U2F access, are
handled directly by the main process.  This means that the browser's
"fat" main process needs direct read/write access to all USB HID
devices, at least on other operating systems.  With fido(4) we can
support security keys in Firefox under OpenBSD without such a
compromise.
With this change, libfido2 stops using the ioctl to query the device
vendor/product and just assumes "OpenBSD" "fido(4)" instead.  The
ioctl is still supported but there was no benefit in obtaining the
vendor product or name; it also allows to use libfido2 under pledge.
With feedback from deraadt@ and many others
OK kettenis@ djm@ and jmc@ for the manpage bits

repair that.

behavior.
noticed by hshoexer@; OK beck@

- minor tweaks while here

Repair from Martin @ academicsolutions.ch

OK claudio@

OK claudio@ benno@

compute, based upon flags.  OpenBGPD compatible format by default if
no options, to integrate with bgpd.conf and bgpctl reload.  Adapt
mtree and stuff.  This will receive further refactoring...
ok benno job

bpgd configuration, which enables Enterprise-Ready Industry-Leading-by-Example
RPKI ROA filtering on your OpenBGP edge.
Arguments remain about how often to run this operation, for now we propose
9AM when people who can fix their shit are in the office.
ok claudio benno

discussed at length with claudio and benno

rpki-client(8) can deal with it (some upcoming changes...)

OK otto

any implicit behavior
ok eric@, kn@

ok eric@

when -F is used. Because of this allow rc.d script to reload sndiod.
OK kn ratchov aja

ok deraadt

for these. ok deraadt@

unwind can be started (silently) before pf is configured (for those
few weirdos who use hostnames in pf.conf...).  Other unidentified concerns
may be improved by this startup re-ordering, so let's give it a try.
discussed with florian.

more clearly
ok ingo schwarze

any MITM protection checks.  We've had constraint checks for MITM protection
for some time. Recent work changed the default mode to rapidly check NTP packets against constraint validation, as the default mode.
In environments where https traffic doesn't work, ethernet-near servers can
be labelled as "trusted".  trusted sensor support is also coming.
We have reasons to immediately move people away from the -s mode.
ok otto

server is wired up such that non MITM attacks are possible, and NTP
packets can be trusted.  Therefore constraint validity is not required,
and during boot ntpd can spin-up correct time faster.
with otto, ok jmc schwarze

used in situations where https constraints cannot be used and we still want
auto settime. Result of discussion with and ok deraadt@