so that libssl no longer need to access the non-external headers of libcrypto
to build.
No library bump, riding upon the recent update.

and libssl major (ssl_check_clienthello_tlsext split into two functions)

as configuration files; split manpages and .pc files between libcrypto and
libssl.
No functional change, only there to make engineering easier, and libcrypto
sources are still found in libssl/src/crypto at the moment.
ok reyk@, also discussed with deraadt@ beck@ and the usual crypto suspects.

of the stride. don't overwrite past the end of the buffer, and also save
that amount for later so the array is completely filled. ok deraadt djm
reported by Dmitry Chestnykh (dchest)

For inet(3), go the other way, remove some bogus symlinks.
Found while testing the new makewhatis(8).
ok jmc@

in the install media. Reported by Donovan Watteau

This is merely a by-product of figuring out the amount of phk@ code
contained herein; i'm not planning to hack on this file.

this license change. We will remember that we all still like beer.

ok millert

executable and will not serve any purpose with smtpd by default
ok jmc@ tedu@

ok deraadt millert

Include tweaks suggested by mpi@
ok deraadt@

removing gets means removing it from libstdc++ and guenther tells me
that will require changing version numbers.

ok florian@ jung@ sthen@

opens the log before chrooting, but this handles the case where syslogd is
restarted during Unbound's runtime.

"A collision attack published in 2007 can find collisions for full
MD4 in less than two hash operations."
ok deraadt@, man pages ok jmc@

use better constant for salt size.
always copy ":" to gerror, in case somebody is dumb enough to overwrite it
timingsafe_bcmp before somebody whines about strcmp

add some friendlier functions.
move the classic static data api into wrapper functions.
a few more changes to come...

iterator" by default.  Pointed out by Patrik Lundin.

ok jung@ stephan@
tweaks and ok sthen@

and use it as the default location for the DNSSEC root key. Update default
config for this location.
With this, the only step required to enable DNSSEC validation is to
uncomment these default config entries and restart:
#module-config: "validator iterator"
#auto-trust-anchor-file: "/var/unbound/db/root.key"
There is no longer a requirement to run unbound-anchor manually to
update the root key. The rc.d script will take care of updates at boot,
and Unbound will manage the file itself at runtime.
Test with "dig test.dnssec-or-not.net txt @127.0.0.1" or similar.

such a manpage does not currently exist. Requested by jmc@

increase root to 9(+1).
ok deraadt (and a thank you to miod for helping to reduce the set of
architectures harmed by this)

this hardware alive is becoming increasingly difficult, and I should heed the
message sent by the three disks which have died on me over the last few days.
Noone sane will mourn these ports anyway. So long, and thanks for the fish.

disallow them itself. ok deraadt@ millert@, gsoares@ and aja@ like it too.
("nobody" still needs to be listed).