Repair from Martin @ academicsolutions.ch

OK claudio@

OK claudio@ benno@

compute, based upon flags.  OpenBGPD compatible format by default if
no options, to integrate with bgpd.conf and bgpctl reload.  Adapt
mtree and stuff.  This will receive further refactoring...
ok benno job

bpgd configuration, which enables Enterprise-Ready Industry-Leading-by-Example
RPKI ROA filtering on your OpenBGP edge.
Arguments remain about how often to run this operation, for now we propose
9AM when people who can fix their shit are in the office.
ok claudio benno

discussed at length with claudio and benno

rpki-client(8) can deal with it (some upcoming changes...)

OK otto

any implicit behavior
ok eric@, kn@

ok eric@

when -F is used. Because of this allow rc.d script to reload sndiod.
OK kn ratchov aja

ok deraadt

for these. ok deraadt@

unwind can be started (silently) before pf is configured (for those
few weirdos who use hostnames in pf.conf...).  Other unidentified concerns
may be improved by this startup re-ordering, so let's give it a try.
discussed with florian.

more clearly
ok ingo schwarze

any MITM protection checks.  We've had constraint checks for MITM protection
for some time. Recent work changed the default mode to rapidly check NTP packets against constraint validation, as the default mode.
In environments where https traffic doesn't work, ethernet-near servers can
be labelled as "trusted".  trusted sensor support is also coming.
We have reasons to immediately move people away from the -s mode.
ok otto

server is wired up such that non MITM attacks are possible, and NTP
packets can be trusted.  Therefore constraint validity is not required,
and during boot ntpd can spin-up correct time faster.
with otto, ok jmc schwarze

used in situations where https constraints cannot be used and we still want
auto settime. Result of discussion with and ok deraadt@

more similar
ok jmc schwarze

- do not restart settime timeout interval if something happens in the main
event loop
- apply a tight loop protection; it can be painfull on a single
core machine since the process runs at maximum priority. Should only
happen when a bug is introduced while developing, but prevents having to
machine taken over by ntpd.

dnssec the sysadmin has some idea what's going on in logs, and
"aggressive-nsec: yes", if we're using dnssec anyway we might as well
get the benefits. These were both enabled last time dnssec was enabled
in this sample unbound.conf.
ok florian@

OK deraadt@ otto@

avoids DNS lookups entirely, but yes this https is correctly validated)
long discussions with otto, florian, and the quad9 crew.

other methods failed to inject/churn the rng enough.  Move it up far earlier.
ok naddy sthen kettenis

ok deraadt@

responsive during packages compilation, especially on slower machines.
feedback welcome from people building ports
discussed with deraadt@

from brad@
ok bluhm@ claudio@ deraadt@

ober_add_string.3 and as it was before the ber -> ober rename.

so move our BER API to the unused ober_* prefix to avoid some
breakage in ports.
Problem diagnosed by jmatthew with ber_free() in samba, but
there are many others as pointed out by sthen.
tests & ok rob
ok sthen (who had an almost identical diff for libutil)
"go head hit it" deraadt

Diff from eric@ and florian@, commiting on their behalf since they are absent
and we want to ride the minor shlib bump.