An empty file /var/account/acct in etc.tgz simplifies accounting.
OK deraadt@

Impose constraints on RPKI Trust Anchors

See https://datatracker.ietf.org/doc/html/draft-snijders-constraining-rpki-trust-anchors
for more information.

Tested for a few months.

OK tb@ claudio@

Hook up bgplgd. Uses _bgplgd user with id 71:71 add a rc.d script and
all the other rc plumbing.
OK deraadt@

switch(4) and switchd(8) are retiering. Unhook them from various
configuration files.
OK sthen@ kn@ patrick@

Retire OpenBSD/sgi.

OK deraadt@

descend into riscv64 dirs

ok deraadt@

install rc.d/resolvd

rc(8) bits for dhcpleased(8).
OK deraadt

Install /etc/examples/login_ldap.conf with proper mode and ownership.

tweak from deraadt@
ok martijn@ tb@

Install login_ldap.conf and register it into changelist and mtree/special.

ok tb@ (who had the same diff) & deraadt@

enter etc.powerpc64

retire rebound etc bits to the attic

a few depend:-related thingies that were still in.

okay millert@, tb@

sync names

Tweak rpki-client to create all 4 output file formats from a single
compute, based upon flags. OpenBGPD compatible format by default if
no options, to integrate with bgpd.conf and bgpctl reload. Adapt
mtree and stuff. This will receive further refactoring...
ok benno job

create a var/db/rpki-client/roa file with correct ownership so that
rpki-client(8) can deal with it (some upcoming changes...)

Nuke http captive portal detection; something better is coming.
OK otto

There is no reason why the TAL files are installed only readable by root
these are public files.
Agreed by deraadt@ (and florian@)

move tals to /etc, where they can be upgraded by a "sysupgrade" if
such a circumstance ever occurs.
ok job

socppc makes an extended visit to the bigbucket.
ok kettenis

Add an example unwind.conf.

Note that unwind(8) works without a config file in many (most?) cases.

This provides an example on how to use the captive portal detection
feature.
Input benno
Input & OK sthen

rc(8) bits for unwind(8); OK deraadt

Move acme-client.conf to examples. Since we no longer store the
agreement url in here we no longer need to updated it all the time.
OK deraadt

add rad.conf example

ok florian@

It's time to switch to rad(8); tested by many.
Unhook rtadvd from build.
OK deraadt, phessler

rc(8) infrastructure for rad

stop installing /etc/networks, it is now unused; OK deraadt@ tb@

Consolidate lib.so.*.a, ld.so.a and the kernel relink kit into
one location under /usr/share/relink.

Be more specific in src/etc/rc reorder_libs() what filesystems
need r/w remount and ensure that their mount state is restored.

Idea and positive feedback from deraadt@
OK aja@ tb@

compile.tgz no longer needs to contain machine/ subdir, instead it needs
makegap.sh
ok tb

When building a snapshot, install the compile.tgz file to builder's
/usr/share/ so that next boot will find it and perhaps use it.
ok tb rpe

For KARL, include a linkkit into the base set, as usr/share/compile.tgz.
This contains the relevant pieces from all the GENERIC* compile directories
(*.o ld.script Makefile gap.S). It also includes the machine/ subdir for
now, to support re-randomizing of gap.S, though other methods are being
investigated. (Any binutils ld.script hackers out there?)
collaboration with rpe

destroy lint remnants.
okay millert@ deraadt@

kernels in compile dirs are og-rwx, so need to make them readable in
$RELEASEDIR
ok tb rpe

rc.d(8) for slaacd
OK phessler, deraadt

mark newish phony targets as phony.
okay tb@

Enable dhcrelay6(8).

ok deraadt@

Remove support for pkg.conf in light of the consolidation towards
a single configuration file for the OpenBSD repository location.

The pkg_* tools now use installurl(5) to find the package repository.

NOTE:
/etc/installurl only contains a single URL pointing to a mirror.
Use the PKG_PATH environment variable to specify more than one
package repository.

prodded by and OK deraadt@ aja@

Switch to xenodm(1).

Do it now deraadt@

As it's done in /etc/skel for new regular users, create an empty
/root/.ssh/authorized_keys file with correct permissions (0600 for the
file, 0700 for /root/.ssh dir). Since we encourage administrators to use
public keys only if they want to access root account via ssh, might
aswell make it easier, this will be particularly useful in
managed/provisioned environments (think ansible & others).

Note that administrators might get an e-mail from security(8) if the
file suddenly appears after an update - this is of course expected :)

ok tb@ sthen@ rpe@ ajacoutot@

Use a single chown user:group instead of separate chown and chgrp.

OK tb@

+arm64

Interpolate a 'make cleandir' if KEEPKERNELS is set to a non-empty string,
right before building kernels. This should unbreak 'make release' for
people having this setting.

ok deraadt

Fix up some permissions in RELEASEDIR and /var/sysmerge.

help, testing & ok rpe

Enable builds with a dedicated user that cannot elevate privileges or write
to /usr/src or /usr/xenocara.

Change /usr/{,x}obj to owner build:wobj with mode 770 and install the
systemwide makefiles before starting a build. The root of the noperm fs
containing DESTDIR should also be owned by build:wobj.

Developers will need to add their users to group wobj to be able to write
to /usr/{,x}obj/.

"push forward" deraadt; testing, input & ok rpe

Remove the obj, xobj and src directories from the base set.
The installer will create these directories during install.
So local setups will not get overwritten during upgrades.

idea from and OK deraadt@
with help from and OK tb@
feedback from and no objections halex@

Build the bundle of GENERIC* kernels in using the new compile metods,
and de-escalate to $BUILDUSER.
Much help from natano and tb.

Remove check for RELEASEDIR permissions, there are usecases where other
filesystem permissions are required.

requested by deraadt

Check that DESTDIR is on a noperm filesystem that's properly locked
down and enforce reasonable permissions for RELEASEDIR.

prodded by and ok deraadt
ok tb

Add switchd

OK deraadt@

Print the root check error message to stderr. While there add the name
of the target to the message to be more descriptive.

ok deraadt tb

Build kernels as root for now. Otherwise we run into permission issues
when the source tree is not owned by ${BUILDUSER}.

ok deraadt

conditionally create obj & xobj same way that src is handled
ok natano

De-escalate to an unprivileged users during 'make build' and 'make release'.

- If you start make build as root, everything will be run as root.
Nothing new here. New is, that you can set BUILDUSER=somebody and the
unprived parts will be run as somebody.
- If you start make build with sudo, the unprived parts will be run as
the real user (meaning YOU). You can still set BUILDUSER=somebody and
the uprived parts will run as somebody.
- If you start make build as a normal user it will error out. "I'm sorry
Dave."

Note that DESTDIR must be on partition with the noperm flag set for make
release to work correctly as an unprivileged user.

idea and ok deraadt
input and ok tb ratchov millert
rpe, halex and probably others where part of the conversation to make
this happen, thanks!

stop supporting SUDO builds. Something better is coming, so let's
align everyone who is using SUDO builds towards the new strategy.
ok natano

fix build

add a config file parser to acme-client (unused at the moment, so that
it can be worked on in the tree).
ok florian@ deraadt@

Set owner for /etc/{passwd,pwd.db,spwd.db} and /var/sysmerge/etcsum.
from rpe

The /etc/{localtime,rmt}, /var/tmp and /sys symlinks and the etc tarball
should be owned by root.

ok deraadt

Retire zaurus, as it hasn't made the EABI jump and will be permanently broken
shortly when we use the hardware thread register in userland

Add doas.conf example configuration file.

Discussed with and loved by many.

OK tedu@, tom@, deraadt@.

remove sparc pieces

armish handled some early-gen arm machines, which required tons of
workarounds. Some of them will soon stand in the way of armv7.
Off to the attic you go.

remove pointless csh placeholder files from /etc

ok jung@ (some time ago) phessler@

whitespace found during review

Remove handling of /etc/examples/ files by sysmerge(8). Getting regular messages
about pkg.conf isn't really that helpful and if a big syntax change comes along
well we have current.html.

it was disabled during p2k16 and no one complained so far
discussed with and ok deraadt@

remove hppa64 port, which we never got going beyond broken single users.
hppa reverse-stack gives us a valuable test case, but most developers don't
have a 2nd one to proceed further with this.
ok kettenis

burn down the systrace

We are done providing support for the vax.
lots of agreement.

When the default mode on /var/log/maillog was changed to 640 the
creation of maillog as part of the distribution-etc-root-var target
was missed. From Nathanael Rensen

Add /etc/examples/pkg.conf, generated from mirrors.dat over in www/.
Positive feedback and/or OKs from benno millert jcs aja jasper

Add initial vm.conf(5) example. But please note that the grammar is
not fixed yet.

add rcscript for vmd

ok mlarkin@
prompted by deraadt@

Send Aviion to same place as Nova II
discussed with jsg

Add rebound rc.d script.

ok benno@ requested by tedu@

yppasswd went away

With ikectl now requiring ca specific sections not present in the
general openssl cnf files install the ikeca.cnf file.

ok sthen@ requested by reyk@

add BUILDINFO file. currently contains a timestamp. ok deraadt

Delete the empty example file "ftpchroot"; no example is needed.
Move the one useful bit of information contained in the file ("one
user name per line") to the ftpd(8) manual page where it belongs.
OK deraadt@ sthen@

The hosts.lpd examples file does not contain a single example.
The file format is so simple that no example is needed.
All relevant documentation is already available
from the proper place, which is the lpd(8) manual.
Consequently, delete the empty file.
OK millert@ dcoppa@ beck@ deraadt@

Enable eigrpd(8) and eigrpctl(8) in the builds

ok deraadt@

Provide an ftpproxy6 rc script. ftp-proxy can only open one listening socket
at a time, so a second instance of the daemon is required.

OK mikeb stsp ajacoutot

/usr/share/sysmerge -> /var/sysmerge

requested by several
discussed with deraadt@

install the radiusd rc.d file
ok deraadt@

Place etc/defaults/radiusd.conf and etc/rc.d/radiusd. Modify etc/rc
to hook the rc script and modify etc/rc.conf to make it disable by
default. Also add an entry for /etc/radiusd.conf to etc/changelist
and etc/mtree/special.

ok deraadt

Remove sudoers

Put ntpd.conf in MUTABLE so it's installed with 0644 mode.

discussed by deraadt@

enable ntpd by default at install time. We use pools and a reliable
constraint to keep them in check. in the worst case of being on a
dark net, nothing changes.

this is being enabled by default to allow gathering of more operational
information from users. and if the operational heuristics in ntpd can be
suitable refined, this may stay the default into the future. if not, ntpd
will become even more awesome along the way.

with reyk rpe

Move man.conf from /etc to /etc/examples, deleting what's no longer supported.
Discussed with many and OK ajacoutot@.

Unhook rtsol(8) and rtsold(8) from the build.
OK deraadt@

Make /var/tmp a symbolic link to /tmp. The creation of /var/tmp in the
often space-constrained /var filesystem was a historical mistake. There
are big implications for the daemons which assume they won't run out of
space, and this is a first step towards trying to improve the situation.

Move /tmp to the same 7-day expiration rules that /var/tmp had.
vi.recover works just as well as before, except on memory filesystems;
indicating that vi should be repaired to write files into homedirs or
something.

done with rpe
ok many

sort RCDAEMONS

sliphome et sliplogin(8) are gone.

Get rid of intermediate file handling during sumfile creation
by first changing to $DESTDIR and then simply piping to xargs.

OK deraadt@

Remove sendmail tentacles. ok krw@ ajacoutot@

Ensure proper group ID for chio.conf example.

Noted by and OK ajacoutot@
Positive feedback halex@

Remove /etc/{hosts,myname} from etc.tgz.
Make the installer create the /etc/hosts template. While here, re-add a
missing 'echo' from install.sh.

ok miod@ krw@ halex@

Move dhclient.conf(5) to examples.

no objections from todd@ millert@ rpe@

Create etc set during 'make build' and embed it in base set to make
it available during a regular install or upgrade so that it doesn't
need to be independently fetched.

Idea, directions and OK deraadt@
Feedback and Ok halex@ and aja@

usr.sbin

disable use of bind in base; in the base use nsd/unbound instead.
a proper & complete bind port will show up.
discussed with many for years

httpd.conf can be installed 0644 instead of 0600 like relayd.conf.

ok ajacoutot@ benno@

Trailing whitespace.

Enable httpd(8) in the builds to get more testing, feedback and
improvements. It is not "finished" but serves static files.

ok deraadt@

Repair two deep targets mistakenly called as afterinstall, rather
than distribution. These would modify files in /etc, part of the base
set, but still... that makes it harder to discern their sets placement.

remove ancient unused NOGZIP support

prefer ln -f over rm + ln

OK deraadt

use /bin/sh instead of /bin/ksh and add cvs id.

OK deraadt

mixerctl.conf wsconsctl.conf can properly become examples.
As discussed a few days ago with aja

the files listed under BIN1 are not binaries in any way. Let's call
them what they are: MUTABLE, as in these are the specific files that
admins do edit in /etc

create examples/pf.conf which is a clone of the existing file. Now
the existing file can start losing... examples...

BIN2 is now just motd; install it direct without the abstractions. While
there, let's make it operator writeable. Or let's do a commit changing it
to operator writeable and see the pro and con camps rise up.

more lynx bits

BSD.local.dist went away

/var/db/sysmerge -> /usr/share/sysmerge

ok deraadt@

correct dir

sysctl.conf moves to etc/examples

/etc/rc already takes care of creating /var/run/utmp.

ok deraadt@ giovanni@

rc.{local,securelevel,shutdown} become examples. If versions of them
are created in /etc, they are executed (they used to be sourced) to
avoid polluting the rc variable space. The powerdown= and securelevel=
features are removed; they are likely only used by 2 people. the
secureleve is now always raised; this is the only sensible default.
ok ajacoutot

- move the ntpd.conf file to examples directory
- move it from BIN1 to EXAMPLES in src/etc/Makefile
- change the installer to create the file instead of editing it
- add a '+' to the corresponding changelist entry

suggested by and OK deraadt@
OK for the installer change krw@

Mismatch between the sets list and what's in DESTDIR should not be fatal
to sysmerge sum files generation.

discussed by deraadt@

Install some config files with mode 0600 as they were before the move to
/etc/examples.

ok deraadt@

Add iscsid to the rc.d files to install

egsum -> examplessum to make it more obvious.

req. by deraadt@

Simplify checksum generation for sysmerge.

no objection from deraadt@

cksum -> sha256
That means sysmerge(8) may be a little more interactive the next time you
run it.

Create the examples checksum for sysmerge at release time.

"move ahead" deraadt@

move exports, ftpchroot, hosts.lpd, printcap, and remote to the examples
directory.
ok robert

oops, nsd.conf cannot be an example... yet

Move more files into the examples directory...

my pleasure to move bgpd.conf to examples. ok theo

handle the movement of the first few files to /etc/examples. They are
still managed by changelist, as long as the marker is + and they are in
the correct distrib/sets/* files
Bit of help from ajacoutot

tedu ~/.klogin

ok henning@ deraadt@

rm rwhod tentacles

Remove krb5 bits from rc(8).

ok reyk@

Remove kerberosV from etc/

ok deraadt@ guenther@

hosts.equiv is a ghost from bsd past

Move build machinery for libcrypto from libssl/crypto to libcrypto, as well
as configuration files; split manpages and .pc files between libcrypto and
libssl.
No functional change, only there to make engineering easier, and libcrypto
sources are still found in libssl/src/crypto at the moment.

ok reyk@, also discussed with deraadt@ beck@ and the usual crypto suspects.

end experimental login.conf template support. one file per machine.
ok deraadt millert

sum -> cksum, ok deraadt

Retire hp300, mvme68k and mvme88k ports. These ports have no users, keeping
this hardware alive is becoming increasingly difficult, and I should heed the
message sent by the three disks which have died on me over the last few days.

Noone sane will mourn these ports anyway. So long, and thanks for the fish.

the userland ppp(9) code goes awa. Having too much ppp choice in the
tree results in one-true-ppp not coming into existance. This code is
essentially un-audited and quite dangerous.
ok claudio sthen

Enable Unbound in base, ok deraadt@

Unhook httpd(8) from build; etc bits
OK krw@, gilles@, lteo@, tedu@, todd@, benno@, sthen@
"The time is right." and much help getting the show on
the road deraadt@

delete junk file

sort the SHA256 file

be a bit more careful

be forceful with removing the SHA256 file

remove the SHA256 file as soon as we start creating sets

install signify keys

remove popa3d etc tendrils

install sample nsd config file to /var/nsd/etc not /etc, spotted by/ok deraadt

ugly spaces

Move moduli generation to usr.bin/ssh/moduli-gen and keep track of
the fragments separately. "No substantive objection" djm@

Beagle has been replaced by armv7.

ok rapha@

Add rc.d(8) scripts for ipropd-master and ipropd-slave.

ok deraadt@

Ship a simpler krb5.conf which logs to syslog(3) by default.
Remove useless README -- the info(1) and man(1) pages contains all the
required information.

ok dcoppa@ robert@ beck@

hook up slowcgi to the tree, including /etc glue and a sample configuration
snippet; ok florian@

a default .cvsrc for skel.
okay deraadt@
some other people like that too.

hookup octeon

ok deraadt@

the unused palm code goes away.

rev 1.318 made this MI parallel-make clean, however it inadvertantly
changed the build order.

Have release-sets depend on the kernels target, which restores the
order.

OK espie@

typo

Script for ldomd(8).

ok dcoppa@, deraadt@

Add targets for the 6k and 8k bit moduli components

Enable npppd and npppctl in default build. Add npppd to rc and
install sample configs to /etc/.

ok claudio deraadt henning mcbride

Make the update-moduli rule append the 6kbit and 8kbit params so that we
can trivially regen the <=4k bit ones. ok djm@

enter etc.beagle so MAKEDEV.8 can be generated properly during builds
prompted by deraadt@

stop installing the etc/afs

wire up the bits for tftp-proxy, which is called tftpproxy from rc.d's
point of view.

mostly ok sthen@ ajacoutot@, who were discussing the feng shui of the
start_daemons chunk

Delete some more SUBDIR += mac68k.

clean-up release dependency tree, so that release is "MI parallel-make clean"
(yeah, the md parts are NOT, not yet).

okay miod@, deraadt@

NOOBJ -> zap unneeded ${.CURDIR} for clarity.
ok miod@

btd went away

install the rc.d script for tftpd, ok dlg@

enable nginx

install popa3d script; ok robert@ deraadt@

Handle aucat -> sndiod name change, and enable sndiod by default. Mostly
from ajacoutot@.

ok deraadt ajacoutot

Add a sample mixerctl.conf(5).
Pretty terse for now but will eventually come with some more complex
examples when ratchov@ finishes some ongoing work on aucat(1).

ok ratchov@ jmc@ deraadt@

ccd goes to the attic
discussed with jsing and millert

unify kernel building on various platforms.
feedback from miod@ and deraadt@

add ospfd ospf6d to RCDAEMONS so they get installed; ok deraadt@

Sort RC_DAEMONS.

ok robert@

Switch amd and spamlogd to rc scripts and make sure that the
rc_pre() functions are returning correctly. This change
also simplyfies the changes because false || return 1 can be replaced
with false if that's the last call. thanks halex@!

Add the nfs startup scripts.

ok robert@

switch pflogd to rc.d

add scripts for aucat and spamd and switch rc to use them

add a script for btd and replace the rc parts

add wsmoused script and switch xdm and wsmoused in rc

timed's time is up. use ntpd(8). Even our own fossil developers
switched a while back.
ok miod, kettenis

Install a default ypldap.conf(5) based on the one from the man page
(which we remove now) with a couple of tweaks; use the same base DN and
admin user as our default ldap.conf(5).

add scripts for portmap and the yp daemons

Add rc.d(8) script for the system daemons that are restartable.
From now on rc(8) is going to call these scripts to start them up on boot
in the same order than before.
In addition the inetd and rwhod variables in rc.conf are deprecated so that
inetd_flags and rwhod_flags should be used. The old flags are still going
to be used for some time to allow users to switch.
There are more rc modifications to come later so let's put this in so
we can base more work on this.
It is important to mention that you can still keep using rc.local just
like the way you did before, and we have no intention to remove that either.

I'd also like to thank ajacoutot@, halex@, sthen@ and schwarze@ for working
on this with me.

Remove support for non-microVAX, non-VAXstation, non-VXT hardware in the
VAX port. This means, 11/7xx, VAX6000 and VAX8x00 systems, as well as SBI,
CMI, BI, XMI and MASSBUS drivers.
Most of these files were not being compiled or kept in compilable state over
the years anyway.

Switch from the old shell script /etc/security
to the new Perl script /usr/libexec/security.
The new script was tested by sthen@ and ajacoutot@.
Committing now due to repeated prodding from deraadt@.
In case problems show up, they will be fixed in tree.

Add a simple 'rc' system to base in order to start/stop/restart/reload
services installed by the ports system (for now).
It only uses pgrep/pkill to handle these processes. A manual page will
come later.

'put it in' deraadt@

no more misc set

install nsd.conf; ok jakob@

Kill msgs. Noone uses it, and it has a longjmp in it.
Lots of agreement.

No more phones(5), /etc/phones, or dial up bits in remote.

add iked.conf default configuration file example.

ok jsg@

Install a default ldapd.conf, and standard schema files in /etc/ldap.

ok deraadt@

install mtree always
okay deraadt@

Install a sample ldpd.conf file. OK dlg, deraadt

Add etc.loongson. ok miod@

Create an empty etcsum file so that cksum can run without error (as
var/db/sysmerge/etcsum is created after the cksum calls and etcsum is
part of the etc set).

"sure" deraadt@

Create sysmerge etcsum file at release time for etc set inclusion.
This way, the first time sysmerge is run on a new box, it will already
have reference sums needed for automatic processing.

Original idea from and discussed with deraadt@
"commit it" deraadt@, tweaks and ok millert

fix syntax error in 'make update-moduli'; ok deraadt

Bring BSD.x11.dist back here. It's needed by the ports subsystem.
Update the BSD.x11.dist version to the one in xenocara.

Reach palm MAKEDEV bits.

remove unused and outdated BSD.x11.dist file. ok miod@, krw@.

Install root's crontab with gid "crontab" to be consistent with what
crontab(1) does.

ok miod@

install wsconsctl.conf on more machines

revert previous, requested by kettenis@ and deraadt@

remove the empty script /etc/monthly
in preparation for improvements in /etc/daily and /etc/weekly
using feedback and suggestions from jmc@ and sthen@
ok jmc@, and sthen@ agreed with the general direction

Provide users by default with XTerm*loginShell:true. This situation just is
ridiculous; xdm is totally broken since it never starts anything which resembles
a "login shell". As a result, no configuration is brought into a process
context to give to future xterms or *sh shells and thus cause them to run their
.profile or .kshrc or such a thing, to get futher configuration. Therefore
people are left with a totally bland unconfigured Unix environment in their
xterms, and don't know how to change this since .profile is ignored. This
problem shows hundreds of thousands of google hits. xdm is fundamentally
broken, but we must solve this also for the startx methods, too, and for people
running csh. It is clear that .xsession is not a solution to this problem at
all (that is, assuming the people who suggest such a thing really mean a
.xsession file with the execute bit set). This now becomes the recommended
way for new users to get out of this stupid situation; if someone does not
like it they can change it or delete it. Few will. Just watch.
ok kettenis guenther millert

move bsd and bsd.rd and all such other MD "sets" into the MD files,
since we perhaps cannot assume that is what kernels will be in the
pathetically stupid world that SGI created

For SHA256 hashes to be ready to go onto the install media, we must
build the sets before we build the media. While there we can get rid
of DESTDIR/snapshot too, and simply install straight into RELEASEDIR.
(This also ends up saving an astounding amount of traffic/latency in a nfs
environment)

build release sets before kernels (so that bsd.rd can know about at least
some of the sets)

unbreak make release, spotted by todd and kurt

enable smtpd in the build

"please enable it" deraadt@

clean

shorten SUBDIR list

redo the way MAKEDEV files are generated
get it in, deraadt@

Deprecate /etc/dhcpd.interfaces. This is made unnecessary by dhcpd_flags.

ok deraadt@ beck@ reyk@ phessler@

improve indentation.

ok jsing@

Disable more wscons bits on socppc.

Plumb socppc in MAKEDEV machinery.

remove superfluous backslashes and semicolons

ok deraadt@

Add .ssh and authorized keys to /etc/skel, makes setting up new
pubkey authentication users with the correct file permissions a bit easier.

ok djm krw henning miod and many others

enable snmpd in the build

approved by deraadt@, ok thib@

revert back to using local zones for localhost. and IPv4/IPv6 reverse until
we've found a better solution for chrooted applications.

remove localhost. zone (localhost. queries are handled by /etc/hosts)
replace IPv4 and IPv6 loopback zones with BIND's autogenerated empty zones.
move root.hint to /var/named/etc
remove empty directory /var/named/standard

hoststated gets renamed to relayd. easier to type, and actually says
what the daemon does - it is a relayer that pays attention to the status
of pools of hosts; not a status checkers that happens to do some relaying

Change chio.conf's group ownership to operator and mode to 644.
At this time, there is no sensitive information in that file.

ok beck@, millert@, jdixon@, deraadt@

Add a sample configuration file for the newly imported ospf6d(8) daemon.

ok dlg@

Retire OpenBSD/cats. Hardware is nice but prone to catch fire, and the firmware
is anything but useful. Nevertheless this was a very good platform to use as
an OpenBSD/*arm* starting point, but nowadays this platform is not necessary
anymore.

Somehow these CATS motherboard are just like AUI hubs, with the difference that,
when my AUI hub caught fire, 10base5 support was not removed from the networking
code.

incompletely killed the cksum bits

stop shipping CKSUM files; people can use the MD5 files
(this decreases build time a bit too)
ok todd (and i assume legacy-architecture-miod would not object either)

avoid messing with the cvs tag expansion

/etc/spamd.conf moves to /etc/mail/spamd.conf

sample sasyncd.conf, PR5387 sthen at symphytum.spacehopper.org, ok theo

s/GZIP/GZIPCMD/g in `make release` structure to avoid conflict with gzip's
use of a GZIP environment variable for extra command flags.

ok deraadt@, millert@

link hoststated to the builds.
ok miod@, henning@

Uncomment MAKEDEVARCH+=landisk.
ok drahn@

enable bgplg, the bgp looking glass

ok henning@ deraadt@

landisk has no wsconsctl.conf

Add the _ripd user and startup stuff.

ok claudio@

etc.landisk does not exist yet, dont try to build MAKEDEV for it yet either

enable landisk MAKEDEV building later

remove unused WCS stuff

remove "snapshot" code, now that our snapshots are always actually
releases...

Build wscons stuff on vax (but no for bsd.rd yet)

System build pieces for armish arch.

do chio.conf install from right place

add all the goo to hook dvmrp into the system

ok derradt@

Administrative changes for aviion, ok deraadt@

Import NetBSD's direct adb code on mac68k, switching to real keyboard and mouse
drivers, and to wscons as the console; a few parts borrowed from OpenBSD/macppc
as well.

Currently only working with displays configured in 1bpp or 8bpp modes; this
limitation will be worked on ASAP.

Tested by claudio@ kettenis@ martin@ nick@ and I on various models. X11 changes
coming soon.

nuke extra whitespace

install sample ipsec.conf; ok hshoexer@

Make the rc files in / be copies of the ones given by default to root in
/root instead of hard links to them. This way multiuser only changes
a user makes to the to the ones in /root do not screw them over for
getting into single user easily when the have to.

ok millert@

remove stale NAMEDB; ok theo

Generate login.conf from a template with optional per-architecture overrides

Enable ifstated in the builds. This still does not mean that ifstated is
necessary for regular carp setups. There are situations where you need this,
but if you're going to use it, think hard about redesigning your network so
you don't have to.

ok deraadt@ mpf@ henning@

no need to install and checksum *.ipk since *bsd* will already catch it
ok deraadt@

include zbsdmod, Packages, and ipk in the checksums; ok deraadt@

move the few needlessly special-cased root:wheel 0644 files to BIN1

sample hostapd.conf from reyk, to be tweaked

hppa64 chunkies

during make release install *bsd* not just bsd*, so we pick up zaurus zbsdmod.o too

Packages for zaurus - yuck yuck; for uwe

also copy *.ipk files to RELEASEDIR

ospfd.conf mode 0600, requested by norby

ospfd.conf

cleaning distrib twice is useless
committed from the ship while drinking a trad, from a zaurus on beck's birthday

Switch OpenBSD/hp300 to wscons, still using on-board ROM fonts for now.

Main features:
- MI hil drivers, allowing live plug/unplug of devices, and the keyboard
does not need to be at id 1 anymore.
- SGC bus support on 4xx models. SGC frame buffers are supported too, but
not as console, though you can use them as a regular glass terminal if
you run a getty on ttyC0. Currently not compiled-in, awaiting for an sti(4)
fix to be commited.
- HP-UX compatibility interfaces are removed. grfinfo and hilinfo are removed.

X11 support is currently broken by these changes; X.org X11R6 support will
be available very soon.

Tested on hyperion and 4 different flavours of catseye/topcat/kathmandu; other,
older frame buffers (davinci, gatorbox and renaissance) could not been tested
but should work; please report any regression.

wsconsctl.conf on zaurus too.

Add zaurus to MAKEDEV machinery.

install cdbr and cdboot for those that have it, too

fix the tree after jakob broke it

add sgi to MAKEDEV build.

sample ntpd config file

generate entries for all of the ptys after more were added, ok deraadt millert

bye bye bootpd. You will not be missed.

nuke default .rhosts file; from S@mSmith.net, ok millert

Remove OpenBSD/pegaos, this has been announced before but delayed until
the tree was stable. No point in code supporting a company which screws
its employees being in the OpenBSD tree.

Install /etc/wsconsctl.conf on luna88k.

Populate /etc for luna88k

oops

change amd64's MACHINE_ARCH from x86_64 to amd64. There are many many
reasons for this, quite a few of them technical, and not all of them
in response to Intel's broken ia32e crud. The gcc toolchain stays at
x86_64 for now.

Introduce MAKEDEV.man*, an equivalent of MAKEDEV.mi and MAKEDEV.sub
designed to output mdoc rather than shell script, and use them to produce
much better MAKEDEV.8 manual pages.

Note that MAKEDEV.man relies upon BSD m4 behaviour, which all m4 binaries
might not follow.

mdoc help and comments jmc@, disabused ok deraadt@

Add cats to MAKEDEVARCHS

install bgpd.conf mode 600, theo ok

add cats and amd64

Fix tab damage in Makefile introduced in previous commit, pointed out by
STeve Andre

Add update-moduli target for regenerating ssh moduli file; from markus@
ok deraadt@

amd64 hook ups

vax joins the club; ok miod@

catch pegasos up with the rest; ok deraadt

+ alph2d() (thanks dr!), allow ttyU's a-zA-Z to be created

support new MAKEDEV for pegasos; from todd

+bgpd.conf

Pegasos port and dirs.

Sample sensorsd.conf file.
ok henning@ millert@

Sample files for /etc/mail, installed at 'make distribution' time.

Add derivative of Michal Zalewski's p0f v2 passive OS fingerprint database

remove kerberosIV configuration files
ok hin@ deraadt@ pb@

default timezone: Canada/Mountain

Add *.iso to list of files in CKSUM/MD5 spotted by A.Farber.
ok millert@ miod@ deraadt@

Move /var/log/sendmail.st creation to etc/Makefile where it belongs;
noticed by grange@

default spamd.conf file, with entries for spews 1, spews 2, china and korea

copy cd*.iso also, for snapshots

Move contents of /var/at into /var/cron since at is now intergrated into
cron. When ISC cron 5.0 is out the integration will be even tighter.

Also rename /var/cron/{allow,deny} -> /var/cron/cron.{allow,deny}
for consistency with POSIX and at.{allow,deny} and install an empty
cron.deny file (as we do at.deny) since crontab will require this
in the near future for POSIX compliance.

After a "make build" you can update your system as follows:
# mv /var/at/* /var/cron
# mv /var/cron/jobs /var/cron/atjobs
# mv /var/cron.allow /var/cron/cron.allow
# mv /var/cron.deny /var/cron/cron.deny
# rm -rf /var/at
# kill `cat /var/run/cron.pid` ; cron

make pf.conf 0600 by default

discussed and agreed theo and daniel

enable bind now; some diffs from jakob, some from me

Prepare for the removal of amiga and sun3 platforms from the tree.
There has not been enough activity and interest towards these platform
to keep them lying in the tree.

record failed login attemps by default, aka enable /var/log/failedlogin.
pval@ millert@ ok.

Install /var/log/message 644 since the beginning and change back
newsyslog.conf to reflect that. More people seem to prefer that,
and it can be easily changed if you like it another way.
millert, fgs and others verbally agree

more photuris bits by bye bye

Install /etc/wsconsctl.conf on sparc.

policy for lpd

named policy for systrace

we no longer do this. why was it edited incorrectly?

fix mkr for libssl changes

more dm parts going away; pjanzen

oops, missed another file

remove MAKEDEV.local finally

No more /etc/skeykeys; brad@

Major changes:

Job names are now "runtime.queue" where runtime is when the job will run
in Unix time format. This is what SysV at does and allows us to nuke
the .SEQ file.

Historic BSD options for atq and atrm are now implemented;
atq and atrm get their own man pages.

At no longer does anything with the -v flag. We print the execution
time when jobs are submitted so there is no need.

Most *scanf() usage is gone (one remains in atrun).

Better sanity checks in atrun.

Random style/cleanup.

With these changes we have the best of both worlds; POSIX compliance with
the traditional BSD features.

move common distrib rules to main Makefile,
make -> ${MAKE}
add phony targets
remove unnecessary subshells
install kernel in a separate target from building.
some SUDO.

okay deraadt@

(checked bootstrap on i386, should be safe elsewhere, and trivial to fix
anyways)

Remove unnecessary subshells
make -> ${MAKE}
add exec at end of lines
sprinkle with SUDO where needed (not enough for a full release yet)
PHONY targets.

ok millert@, deraadt@

at(1) is no longer setuid root, it is setgid crontab.
This means that /var/at/at.{allow,deny} must be readable by group
crontab, /var/at/jobs is mode 01770, and /var/at/.SEQ is mode 0660.

Move mvme88k to the joys of the m4-generated MAKEDEV world.

Regen mvme68k MAKEDEV, and add it to the list of m4 MAKEDEV enabled arches.

oops

wsconsctl.conf for sparc64 too; mickey ok

vax is not m4 yet

Do not ignore mtree's exit value when updating via 4.4BSD.dist.
Use the -U flag instead of -u so mtree doesn't exit with non-zero
when fixing up existing permissions/owners.

if ${DESTDIR} exists, do not modify the mode

hidden magic is stupid

install PCS on vax from here

vax joins the fun.

hp300 joins the party; ok millert@

hppa is in.

enable amiga

indent

No automatic in-tree modification. my bad!

add vme, commented out at this point

add files under etc/namedb. noted by openbsd@davidkrause.com

sync

sync

enable sun3; ok miod@

generate i386 (regress diff = more devices than before, ugen, etc..)

rules to build the MAKEDEV files:

all -> builds 'this' arch (etc.$(uname -m)/MAKEDEV)
allarchs -> builds all archs (etc.*/MAKEDEV)
clean -> cleans 'this' arch (etc.$(uname -m)/MAKEDEV)
cleandirs -> cleans all archs (etc.*/MAKEDEV)

also, build the MAKEDEV files during the release process

convert mkr/ckr to shell scripts, use mktemp(1)

close ppp.conf.sample file as requested

csh maketars -> csh -f maketars
ok millert@

do not run MAKEDEV

Install etc/kerberosV/krb5.conf.example

powerpc -> macppc port rename changes

wsconsctl.conf support, wsconsctl accepts saner var names now; raadtified

bye bye MIPS related bits and pieces.
--
Ok'd by deraadt@

change default pf configuration files to pf.conf and nat.conf. ok theo

add pf.filter and pf.nat; ok @deraadt

Install /etc/kerberosV/README

install new moduli

o move passwd.conf variables into login.conf
o no longer install passwd.conf (but it is used if it exists and the
needed info is not in login.conf)
o added passwordtime and minpasswordlen login.conf variables

Remove ipf. Darren Reed has interpreted his (old, new, whichever)
licence in a way that makes ipf not free according to the rules we
established over 5 years ago, at www.openbsd.org/goals.html (and those
same basic rules govern the other *BSD projects too). Specifically,
Darren says that modified versions are not permitted. But software
which OpenBSD uses and redistributes must be free to all (be they
people or companies), for any purpose they wish to use it, including
modification, use, peeing on, or even integration into baby mulching
machines or atomic bombs to be dropped on Australia. Furthermore, we
know of a number of companies using ipf with modification like us, who
are now in the same situation, and we hope that some of them will work
with us to fill this gap that now exists in OpenBSD (temporarily, we
hope).

Install /etc/kerberosIV/krb.extra and /etc/kerberosIV/krb.equiv

Install empty sudoers file in /etc

no longer install those now

install wscons.conf and rc.wscons on alpha/hppa/i386/powerpc and call it from rc

do not intsall rtadvd.conf into /etc, it is not required to use it
(rtadvd will derive the configuration from kernel settings).

make it clearer that rtadvd.conf is not necessary, in manpage.

sync with kame.

add primes that can be used for diffie-hellman key exchange

Add calls to setusercontext() and login_get*(). We basically call
setusercontext() in most places where previously we did a setlogin().
Add default login.conf file and put root in the "daemon" login class.

chmod proper file; chouanard@parc.xerox.com

increase flexibility of distribution-etc-root-var:
- NOMAKEDEV to optionally skip making devices
- allow building aliases.db under /var/tmp
will come in handy with mergemaster; ok millert@

cvs strikes again!; thanks to Oleg Safiullin <form@openbsd.ru>
for pointing out this evaded the last commit

handle .tgz files too

fix install mode for skel/dot.rhosts

skeletal login directory into /etc/skel

install correct cf distribution

Enable sendmail 8.10.0. Things like sendmail.* and aliases now live
in /etc/mail.

sendmail is really /usr/libexec/sendmail/sendmail now - not /usr/sbin

rtadvd.conf

/var/db/locate.database should be owned by root, not nobody. While
/usr/libexec/locate.updatedb does run as nobody the redirection is
done as root so the resulting file is owned by root.

sync log file owner/mode with what is is newsyslog.conf

Oops... CKSUM should hold cksum results, and be sorted on 3rd field

Final framework for amiga tools.

httpd has a Makefile.bsd-wrapper now

make distribution in ssh

Integration of mailwrapper (from NetBSD)

"The mailwrapper program is designed to replace /usr/sbin/sendmail and to
invoke an appropriate MTA instead of sendmail(8) based on configuration
information placed in /etc/mailer.conf. This permits the administrator to
configure which MTA is to be invoked on the system at run time."

OK deraadt, millert

your basic rc.shutdown file

install afs/SuidCells

run libssl distribution target

namedb files go in /var/named/named

chdir to ${DESTDIR}/ to create sys -> usr/src/sys link.
This avoids creating of incorrect symlink ${HOME}/sys -> usr/src/sys when
DESTDIR="".

Run mtree with -q in distrib-dirs target

use OSrev

install afs configuration

dhcp client stuff. "Angelos D. Keromytis" <angelos@dsl.cis.upenn.edu>

add dhcpd.* to makefile

install krb.realms with 644 perms

add named user and use /var/named, not /etc/namedb as the named dir

split sysctl.conf into MD and MI parts

Don't duplicate bsd*.gz in MD5 and CKSUM files. Preserve CKSUM order.

solve a bsd*gz problem noted by ryker

give root mail after install

install sysctl.conf

distribution build in httpd

add lynx. -moj

oops

Hook the sample ppp configuration files.

copy *BOOT* too for destdir building

wrong, Jason, wrong

Copy all of snapshot/ into ${RELEASEDIR}, and produce correct checksum
files.

Sync mode of authlog to what mtree/special says.

Bring some file owner/group/mode's into sync with mtree/special.

cksum *BOOT*, too.

oops

sure would be nice to install those new mtree files that ports requires...

Make the sendmail aliases build actually work.

operator can fiddle with dumpdates

fork netstart; new child is rc.conf

no more need for the fstab.* files

build a aliases.db file into the distribution

install mail.rc at distribution time; bug found by explorer@flame.org

Remove refs to hcx9 and add usr/lkm to misc.tar.gz.

Don't install virc.

start the photuris daemon per default. hilfe.

oops

Back out arc fiddling, wrong place...

ARC ramdisk install stuff

split release target off from snapshot targ

copy *boot* from snapshot too, if they exist

gene asked

for release; copy bsd.* too -- ecoff/elf issue

install ld.so.conf on all mips machines too

more careful release build

arg

cleanup sets gen for release

release target. This is one monster target

build notes automatically

md5 too (yeah, i know this is not perfect)

Added ${MAKE} distribution for ypinit in distribution-etc-root-var. -moj

create empty /var/log/ipflog, sort the /var/log file creations
alphabetical :-) and remove the entry for tahoe (is the vax entry
still used ?)

split rc.local, creating rc.securelevel. Read the comments. If you believe
in securelevels, follow them religiously. Problem found by millert...

fix syntax errors

NAT example rules file

Install zero-length /var/at/at.deny to allow users to use at(1).

do not put a space after a backslash

install passwd.conf

Don't mess with /usr/src if it already exists.

Redo the GZIP somewhat. Use NOGZIP= to get no compression at all.
if NOGZIP is not set, these three vars are overidable: GZIP, GZIPFLAGS &
GZIPEXT. Also do some s/install/\${INSTALL}/ edits

changing SNAP_GZIP_CMD to GZIP + GZIPEXT etc.

add a variable SNAP_GZIP_CMD to the snap_tar target - here my comment
in the Makefile:

# check if SNAP_GZIP_CMD is set - else set it to "gzip -9"
# you may set it to "cat" alternatively for architectures
# where the gzip'ing would take too much time (pmax or slower :-)
# this way you get only tar'ed snap files and you can gzip
# them on a faster machine

Install etc/amd/master.sample NOT master.

More /var/log 'placeholder' log files.

better perms for ppp stuff

make mode/group on /usr/src/ consistent with mtree/special

uhm...zap that column shit

Install more files when making distribution

install locate.rc, noted by millert.

virc is sourced by vim when invoked as vi.

split off distribution-etc-root-var target, which is useful; from graichen

sample amd/master file; idea from graichen

provide sample /etc/ccd.conf; idea from graichen@axp5.physik.fu-berlin.de

install locate.rc.

Add /etc/ksh.kshrc.

ftpd -US; create /var/log/ftpd for wu-style log files

chgrp ${BINGRP} not ${BINOWN}

generate fbtab for each architecture