available wide open.  there should be some access model either via a
group or fbtab.  This will cause a decision to be made.
ok millert

ensure that we load the CA certificates and use tls_connect_servername()
so that we can verify the server we are connecting to (even though we've
already resolved the hostname). Also add additional warnings for TLS
connect and TLS write failures so that we know what is happening and why.
Lack of server name verification also reported by Luis M. Merino
<luismiguelmerino at gmail dot com> - thanks!
ok deraadt@ reyk@

and force long filenames on the first mount of fat 16 filesystems so
this works.
U-boot scripts have not yet been changed to load these files.
ok kettenis@

about pkg.conf isn't really that helpful and if a big syntax change comes along
well we have current.html.
it was disabled during p2k16 and no one complained so far
discussed with and ok deraadt@

sthen does not object

hppa reverse-stack gives us a valuable test case, but most developers don't
have a 2nd one to proceed further with this.
ok kettenis

From Michal Mazurek <akfaew at jasminek dot net>.
OK tedu@

ok beck@

the University of Alberta moves away from running a spamd fronted MX,
so there is no more source for this traplist anymore.

This stores errno, the cancelation flags, and related bits for each thread
and is allocated by ld.so or libc.a.  This is an ABI break from 5.9-stable!
Make libpthread dlopen'able by moving the cancelation wrappers into libc
and doing locking and fork/errno handling via callbacks that libpthread
registers when it first initializes.  'errno' *must* be declared via
<errno.h> now!
Clean up libpthread's symbol exports like libc.
On powerpc, offset the TIB/TCB/TLS data from the register per the ELF spec.
Testing by various, particularly sthen@ and patrick@
ok kettenis@

ok deraadt@ reyk@

above it is "starting network", which can make you think something is
broken when your machine is as slow as some of mine.
"Yeah, that's a pretty crappy machine" deraadt@

table has to be defined BEFORE
consequently move all tables in the examples to the beginning and before the
listen directive to avoid tables not being found
no functional change
ran into this myself earlier, also reported by cjones via irc
ok gilles

for ntpd(8), removing the pledge call is a first step: futher redesign will occurs later.
ok reyk@ benno@

On a real mailserver, it's too noisy and may be a privacy concern.
On a machine that's not a mailserver, it's pointless.
Besides, Theo points out that running subsystems that potentially
parse untrusted user data daily, at a predictable time, as root
is not a very good idea in the first place.
Suggested by millert@; gilles@ matthieu@ deraadt@ sthen@ agree

unused for now, but I plan to convert all programs in base to use it in
a future diff. /dev/bpf0 is for compatibility with existing binaries
and is to be removed after a transition period.
ok rpe krw, for the installer part
"Let's see it hit the tree." deraadt

additions and functionality changes.

portmap isn't happy with it as reported by naddy@

We'll see if something else breaks but it's the right thing to do.
discussed with robert@

chance to update the *default* configuration of the important daemons.
Factorize rc.firsttime into a run_upgrade_script() function which takes the
script suffix name as an argument.
i.e. run_upgrade_script sysmerge / run_upgrade_script firsttime
discussed with deraadt@
ok deraadt@ rpe@

does start as root but does not have a root master process and instead
changed its uid.
reported by deraadt@

Noted by zhuk@
OK deraadt@

It works by adding daemon_rtable=$id in /etc/rc.conf.local.
rcctl(8) support coming in a few and so are the man pages bits.
If you want multiple instances of the same daemon running in different
routing tables, just symlink the original rc.d script.
e.g.
# cd /etc/rc.d && ln -s dhcpd dhcpd42
Then enable your daemons as such in rc.conf.local:
dhcpd_flags=
dhcpd42_flags=
dhcpd42_rtable=42
most work done by Jiri B <jirib@devio.us>; with a few tweaks and simplifications
by yours truly
ok robert@
... should make henning happy ;-)

daemon_class, daemon_flags, daemon_timeout, daemon_user, pexp
Add "pexp" as a valid variable to _rc_parse_conf() and sort the list while here.
Besides having an easy way to see how a daemon was started exactly, it opens the
door to rdomain/rtable support in rc.d(8). We need to have as much information
on a daemon as possible if we want to target a specific rtable (using -T) and it
also makes it easier to start multiple instances of the same daemon with similar
flags as a different user...
Of course that only works with rc.d scripts *not* overwritting the default rc_*
functions.
Man page tweaks coming later.
discussed with and ok robert@

order.
with shell script assistance from rpe

The getenv(3) and unsetenv(3) functions already support this.
This will make it easier to emulate the glibc clearenv() function in ports.
Based on a diff from and OK jca@

CUPS wants it to be a symlink, and that is probably the most common
printing system.  Bad idea to constantly spam everybody about that!
Antoine already adjusted the file permissions in pkg/cupsd.rc rev. 1.24.
OK ajacoutot@  (print/cups MAINTAINER).

ok martijn@ semarie@ matthieu@ danj@ benno@

ok sthen@