pkgsrc-Changes archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

CVS commit: pkgsrc/doc



Module Name:    pkgsrc
Committed By:   leot
Date:           Fri Oct  1 17:59:06 UTC 2021

Modified Files:
        pkgsrc/doc: pkgsrc.html pkgsrc.txt

Log Message:
doc/pkgsrc.*: regen


To generate a diff of this commit:
cvs rdiff -u -r1.321 -r1.322 pkgsrc/doc/pkgsrc.html
cvs rdiff -u -r1.319 -r1.320 pkgsrc/doc/pkgsrc.txt

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/doc/pkgsrc.html
diff -u pkgsrc/doc/pkgsrc.html:1.321 pkgsrc/doc/pkgsrc.html:1.322
--- pkgsrc/doc/pkgsrc.html:1.321        Mon Aug 23 18:40:27 2021
+++ pkgsrc/doc/pkgsrc.html      Fri Oct  1 17:59:05 2021
@@ -31,7 +31,7 @@
       </h3>
 </div></div>
 <div><p class="copyright">Copyright � 1994-2021 The NetBSD Foundation, Inc</p></div>
-<div><p class="pubdate">$NetBSD: pkgsrc.xml,v 1.39 2021/01/02 08:32:15 jnemeth Exp $</p></div>
+<div><p class="pubdate">$NetBSD: pkgsrc.xml,v 1.40 2021/10/01 17:20:27 nia Exp $</p></div>
 <div><div class="abstract">
 <p class="title"><b>Abstract</b></p>
 <p>pkgsrc is a centralized package management system for
@@ -441,27 +441,49 @@ builds)</a></span></dt>
 </dl></dd>
 <dt><span class="sect1"><a href="#steps-for-b-i-p">A.2. Steps for building, installing, packaging</a></span></dt>
 </dl></dd>
-<dt><span class="appendix"><a href="#logs">B. Build logs</a></span></dt>
+<dt><span class="appendix"><a href="#hardening">B. Security hardening</a></span></dt>
 <dd><dl>
-<dt><span class="sect1"><a href="#logs.building">B.1. Building figlet</a></span></dt>
-<dt><span class="sect1"><a href="#logs.package">B.2. Packaging figlet</a></span></dt>
+<dt><span class="sect1"><a href="#hardening.mechanisms">B.1. Mechanisms</a></span></dt>
+<dd><dl>
+<dt><span class="sect2"><a href="#hardening.mechanisms.enabled">B.1.1. Enabled by default</a></span></dt>
+<dt><span class="sect2"><a href="#hardening.mechanisms.disabled">B.1.2. Not enabled by default</a></span></dt>
+</dl></dd>
+<dt><span class="sect1"><a href="#hardening.caveats">B.2. Caveats</a></span></dt>
+<dd><dl>
+<dt><span class="sect2"><a href="#hardening.caveats.pie">B.2.1. Problems with PKGSRC_MKPIE</a></span></dt>
+<dt><span class="sect2"><a href="#hardening.caveats.fortify">B.2.2. Problems with PKGSRC_USE_FORTIFY</a></span></dt>
+<dt><span class="sect2"><a href="#hardening.caveats.relro">B.2.3. Problems with PKGSRC_USE_RELRO</a></span></dt>
+<dt><span class="sect2"><a href="#hardening.caveats.ssp">B.2.4. Problems with PKGSRC_USE_SSP</a></span></dt>
+</dl></dd>
+<dt><span class="sect1"><a href="#hardening.audit">B.3. Auditing the system</a></span></dt>
+<dd><dl>
+<dt><span class="sect2"><a href="#hardening.audit.pie">B.3.1. Checking for PIE</a></span></dt>
+<dt><span class="sect2"><a href="#hardening.audit.relropartial">B.3.2. Checking for partial RELRO</a></span></dt>
+<dt><span class="sect2"><a href="#hardening.audit.relrofull">B.3.3. Checking for full RELRO</a></span></dt>
+<dt><span class="sect2"><a href="#hardening.audit.ssp">B.3.4. Checking for SSP</a></span></dt>
+</dl></dd>
+</dl></dd>
+<dt><span class="appendix"><a href="#logs">C. Build logs</a></span></dt>
+<dd><dl>
+<dt><span class="sect1"><a href="#logs.building">C.1. Building figlet</a></span></dt>
+<dt><span class="sect1"><a href="#logs.package">C.2. Packaging figlet</a></span></dt>
 </dl></dd>
-<dt><span class="appendix"><a href="#ftp-layout">C. Directory layout of the pkgsrc FTP server</a></span></dt>
+<dt><span class="appendix"><a href="#ftp-layout">D. Directory layout of the pkgsrc FTP server</a></span></dt>
 <dd><dl>
-<dt><span class="sect1"><a href="#ftp-distfiles">C.1. <code class="filename">distfiles</code>: The distributed source files</a></span></dt>
-<dt><span class="sect1"><a href="#ftp-misc">C.2. <code class="filename">misc</code>: Miscellaneous things</a></span></dt>
-<dt><span class="sect1"><a href="#ftp-packages">C.3. <code class="filename">packages</code>: Binary packages</a></span></dt>
-<dt><span class="sect1"><a href="#ftp-reports">C.4. <code class="filename">reports</code>: Bulk build reports</a></span></dt>
-<dt><span class="sect1"><a href="#ftp-source">C.5. <code class="filename">current</code>,
+<dt><span class="sect1"><a href="#ftp-distfiles">D.1. <code class="filename">distfiles</code>: The distributed source files</a></span></dt>
+<dt><span class="sect1"><a href="#ftp-misc">D.2. <code class="filename">misc</code>: Miscellaneous things</a></span></dt>
+<dt><span class="sect1"><a href="#ftp-packages">D.3. <code class="filename">packages</code>: Binary packages</a></span></dt>
+<dt><span class="sect1"><a href="#ftp-reports">D.4. <code class="filename">reports</code>: Bulk build reports</a></span></dt>
+<dt><span class="sect1"><a href="#ftp-source">D.5. <code class="filename">current</code>,
 <code class="filename">stable</code>,
 <code class="filename">pkgsrc-20<em class="replaceable"><code>xx</code></em>Q<em class="replaceable"><code>y</code></em></code>:
 source packages</a></span></dt>
 </dl></dd>
-<dt><span class="appendix"><a href="#help-topics">D. Help topics</a></span></dt>
-<dt><span class="appendix"><a href="#editing">E. Editing guidelines for the pkgsrc guide</a></span></dt>
+<dt><span class="appendix"><a href="#help-topics">E. Help topics</a></span></dt>
+<dt><span class="appendix"><a href="#editing">F. Editing guidelines for the pkgsrc guide</a></span></dt>
 <dd><dl>
-<dt><span class="sect1"><a href="#targets">E.1. Make targets</a></span></dt>
-<dt><span class="sect1"><a href="#procedure">E.2. Procedure</a></span></dt>
+<dt><span class="sect1"><a href="#targets">F.1. Make targets</a></span></dt>
+<dt><span class="sect1"><a href="#procedure">F.2. Procedure</a></span></dt>
 </dl></dd>
 </dl>
 </div>
@@ -506,13 +528,13 @@ packages for himself, which is a time-co
 <p>pkgsrc currently contains several thousand packages,
       including:</p>
 <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
-<li class="listitem"><p><a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/www/apache24/README.html"; target="_top"><code class="filename">www/apache24</code></a> - The Apache
+<li class="listitem"><p><a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/www/apache24/index.html"; target="_top"><code class="filename">www/apache24</code></a> - The Apache
          web server</p></li>
-<li class="listitem"><p><a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/www/firefox/README.html"; target="_top"><code class="filename">www/firefox</code></a> - The Firefox
+<li class="listitem"><p><a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/www/firefox/index.html"; target="_top"><code class="filename">www/firefox</code></a> - The Firefox
          web browser</p></li>
-<li class="listitem"><p><a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/meta-pkgs/gnome/README.html"; target="_top"><code class="filename">meta-pkgs/gnome</code></a> - The GNOME
+<li class="listitem"><p><a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/meta-pkgs/gnome/index.html"; target="_top"><code class="filename">meta-pkgs/gnome</code></a> - The GNOME
          Desktop Environment</p></li>
-<li class="listitem"><p><a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/meta-pkgs/kde4/README.html"; target="_top"><code class="filename">meta-pkgs/kde4</code></a> - The K
+<li class="listitem"><p><a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/meta-pkgs/kde4/index.html"; target="_top"><code class="filename">meta-pkgs/kde4</code></a> - The K
          Desktop Environment</p></li>
 </ul></div>
 <p>&#8230; just to name a few.</p>
@@ -560,7 +582,7 @@ pkgsrc provides the following key featur
 &mdash; That means, if a package contains bugs, it's better to find
 them and to complain about them rather than to just install the package
 and hope that it works. There are numerous checks in pkgsrc that try to
-find such bugs: static analysis tools (<a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/pkglint/README.html"; target="_top"><code class="filename">pkgtools/pkglint</code></a>), 
build-time checks (portability
+find such bugs: static analysis tools (<a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/pkglint/index.html"; target="_top"><code class="filename">pkgtools/pkglint</code></a>), 
build-time checks (portability
 of shell scripts), and post-installation checks (installed files,
 references to shared libraries, script interpreters).</p></li>
 <li class="listitem"><p><span class="quote">&#8220;<span class="quote">If it works, it should work everywhere</span>&#8221;</span>
@@ -942,7 +964,7 @@ builds)</a></span></dt>
        <code class="varname">BUILD_DEFS</code>, a make target like
        <span class="command"><strong>do-build</strong></span>, a missing C or C++ function like
        <span class="command"><strong>strcasecmp</strong></span> or any other topic.</p>
-<p>The available help topics are listed in <a class="xref" href="#help-topics" title="Appendix�D.�Help topics">Appendix�D, <i>Help topics</i></a>.</p>
+<p>The available help topics are listed in <a class="xref" href="#help-topics" title="Appendix�E.�Help topics">Appendix�E, <i>Help topics</i></a>.</p>
 </li>
 <li class="listitem"><p>
        To see the value of a single variable, run <span class="command"><strong>bmake
@@ -1003,7 +1025,7 @@ and dashes.</p>
        quarterly basis from the current branch and only gets modified
        for security updates. The names of the stable branches are built
        from the year and the quarter, for example
-       <code class="literal">2021Q1</code>.</p>
+       <code class="literal">2021Q3</code>.</p>
 <p>The second step is to decide <span class="emphasis"><em>how</em></span> you
        want to download pkgsrc. You can get it as a tar file or via CVS.
        Both ways are described here.</p>
@@ -1017,7 +1039,7 @@ and dashes.</p>
        <a class="ulink" href="ftp://ftp.NetBSD.org/pub/pkgsrc/"; target="_top">ftp://ftp.NetBSD.org/pub/pkgsrc/</a>
        (it points to the same location).
        There are a number of subdirectories for different purposes,
-       which are described in detail in <a class="xref" href="#ftp-layout" title="Appendix�C.�Directory layout of the pkgsrc FTP server">Appendix�C, <i>Directory layout of the pkgsrc FTP 
server</i></a>.</p>
+       which are described in detail in <a class="xref" href="#ftp-layout" title="Appendix�D.�Directory layout of the pkgsrc FTP server">Appendix�D, <i>Directory layout of the pkgsrc FTP 
server</i></a>.</p>
 <p>The tar archive for the current branch is in the directory
        <code class="filename">current</code> and is called <a class="ulink" href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc.tar.gz"; target="_top"><code 
class="filename">pkgsrc.tar.gz</code></a>.
        It is autogenerated weekly.</p>
@@ -1029,11 +1051,11 @@ and dashes.</p>
        respectively.
        </p>
 <p>You can fetch the same files using FTP.</p>
-<p>The tar file for the stable branch 2021Q1 is in the
-       directory <code class="filename">pkgsrc-2021Q1</code> and is also called <a class="ulink" href="https://cdn.NetBSD.org/pub/pkgsrc/pkgsrc-2021Q1/pkgsrc.tar.gz"; target="_top"><code 
class="filename">pkgsrc.tar.gz</code></a>.</p>
+<p>The tar file for the stable branch 2021Q3 is in the
+       directory <code class="filename">pkgsrc-2021Q3</code> and is also called <a class="ulink" href="https://cdn.NetBSD.org/pub/pkgsrc/pkgsrc-2021Q3/pkgsrc.tar.gz"; target="_top"><code 
class="filename">pkgsrc.tar.gz</code></a>.</p>
 <p>To download the latest pkgsrc stable tarball, run:</p>
 <pre class="screen">
-<code class="prompt">$</code> <strong class="userinput"><code>ftp ftp://ftp.NetBSD.org/pub/pkgsrc/pkgsrc-2021Q1/pkgsrc.tar.gz</code></strong></pre>
+<code class="prompt">$</code> <strong class="userinput"><code>ftp ftp://ftp.NetBSD.org/pub/pkgsrc/pkgsrc-2021Q3/pkgsrc.tar.gz</code></strong></pre>
 <p>If you prefer, you can also fetch it using "wget", "curl",
        or your web browser.</p>
 <p>Then, extract it with:</p>
@@ -1048,7 +1070,7 @@ and dashes.</p>
 <div class="titlepage"><div><div><h3 class="title">
 <a name="getting-via-cvs"></a>3.1.2.�Via anonymous CVS</h3></div></div></div>
 <p>To fetch a specific pkgsrc stable branch, run:</p>
-<pre class="screen"><code class="prompt">$</code> <strong class="userinput"><code>cd /usr &amp;&amp; cvs -q -z2 -d anoncvs%anoncvs.NetBSD.org@localhost:/cvsroot checkout -r pkgsrc-2021Q1 -P 
pkgsrc</code></strong>
+<pre class="screen"><code class="prompt">$</code> <strong class="userinput"><code>cd /usr &amp;&amp; cvs -q -z2 -d anoncvs%anoncvs.NetBSD.org@localhost:/cvsroot checkout -r pkgsrc-2021Q3 -P 
pkgsrc</code></strong>
 </pre>
 <p>This will create the directory <code class="filename">pkgsrc/</code> 
        in your <code class="filename">/usr/</code> directory and all the package source 
@@ -1133,7 +1155,7 @@ release -d
        by adding the option <span class="quote">&#8220;<span class="quote">-A</span>&#8221;</span> after the
        <span class="quote">&#8220;<span class="quote">update</span>&#8221;</span> keyword. To switch from the current branch
        back to the stable branch, add the
-       <span class="quote">&#8220;<span class="quote">-rpkgsrc-2021Q1</span>&#8221;</span> option.</p>
+       <span class="quote">&#8220;<span class="quote">-rpkgsrc-2021Q3</span>&#8221;</span> option.</p>
 </div>
 <div class="sect3">
 <div class="titlepage"><div><div><h4 class="title">
@@ -1387,7 +1409,7 @@ nginx-1.18.0nb8      Lightweight HTTP se
       <a class="ulink" href="https://cdn.NetBSD.org/pub/pkgsrc/distfiles/vulnerabilities"; target="_top">vulnerabilities</a>
       file downloaded daily so that
       it remains current.  This may be done by adding an appropriate entry
-      to the root users <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/crontab.5";><span class="citerefentry"><span class="refentrytitle">crontab</span>(5)</span></a> entry.  
For example the entry
+      to the root users <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/crontab.5";><span class="citerefentry"><span class="refentrytitle">crontab</span>(5)</span></a> entry.  
For example the entry
       </p>
 <pre class="screen">
 # Download vulnerabilities file
@@ -1416,14 +1438,14 @@ fetch_pkg_vulnerabilities=YES
 check_pkg_vulnerabilities=YES
       </pre>
 <p>
-      see <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/daily.conf.5";><span class="citerefentry"><span class="refentrytitle">daily.conf</span>(5)</span></a> and <a 
class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/security.conf.5";><span class="citerefentry"><span class="refentrytitle">security.conf</span>(5)</span></a> for more details.
+      see <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/daily.conf.5";><span class="citerefentry"><span class="refentrytitle">daily.conf</span>(5)</span></a> and <a 
class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/security.conf.5";><span class="citerefentry"><span class="refentrytitle">security.conf</span>(5)</span></a> for more details.
     </p>
 </div>
 <div class="sect2">
 <div class="titlepage"><div><div><h3 class="title">
 <a name="pkg_versions"></a>5.1.7.�Finding if newer versions of your installed packages are in pkgsrc</h3></div></div></div>
 <p>
-      Install <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/lintpkgsrc/README.html"; target="_top"><code class="filename">pkgtools/lintpkgsrc</code></a> and run
+      Install <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/lintpkgsrc/index.html"; target="_top"><code class="filename">pkgtools/lintpkgsrc</code></a> and run
       <span class="command"><strong>lintpkgsrc</strong></span> with the <span class="quote">&#8220;<span class="quote">-i</span>&#8221;</span>
       argument to check if any packages are stale, e.g.
     </p>
@@ -1448,7 +1470,7 @@ Version mismatch: 'tcsh' 6.09.00 vs 6.10
   categories. You can browse the online index of packages, or run
   <span class="command"><strong>make readme</strong></span> from the <code class="filename">pkgsrc</code>
   directory to build local <code class="filename">README.html</code> files for
-  all packages, viewable with any web browser such as <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/www/lynx/README.html"; target="_top"><code class="filename">www/lynx</code></a> or <a 
href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/www/firefox/README.html"; target="_top"><code class="filename">www/firefox</code></a>.</p>
+  all packages, viewable with any web browser such as <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/www/lynx/index.html"; target="_top"><code class="filename">www/lynx</code></a> or <a 
href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/www/firefox/index.html"; target="_top"><code class="filename">www/firefox</code></a>.</p>
 <p>The default <span class="emphasis"><em>prefix</em></span> for installed packages
   is <code class="filename">/usr/pkg</code>. If you wish to change this, you
   should do so by setting <code class="varname">LOCALBASE</code> in
@@ -1506,7 +1528,7 @@ Version mismatch: 'tcsh' 6.09.00 vs 6.10
     and adding the definitions there.</p>
 <p>
       If a package depends on many other packages (such as
-      <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/meta-pkgs/kde4/README.html"; target="_top"><code class="filename">meta-pkgs/kde4</code></a>), the build process may
+      <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/meta-pkgs/kde4/index.html"; target="_top"><code class="filename">meta-pkgs/kde4</code></a>), the build process may
       alternate between periods of
       downloading source, and compiling. To ensure you have all the source
       downloaded initially you can run the command:
@@ -1572,7 +1594,7 @@ Version mismatch: 'tcsh' 6.09.00 vs 6.10
 <code class="prompt">%</code> <strong class="userinput"><code>make clean-depends</code></strong>
     </pre>
 <p>Taking the figlet utility as an example, we can install it on our
-    system by building as shown in <a class="xref" href="#logs" title="Appendix�B.�Build logs">Appendix�B, <i>Build logs</i></a>.</p>
+    system by building as shown in <a class="xref" href="#logs" title="Appendix�C.�Build logs">Appendix�C, <i>Build logs</i></a>.</p>
 <p>The program is installed under the default root of the
     packages tree - <code class="filename">/usr/pkg</code>. Should this not
     conform to your tastes, set the <code class="varname">LOCALBASE</code>
@@ -1604,7 +1626,7 @@ Version mismatch: 'tcsh' 6.09.00 vs 6.10
     help with this.</p>
 <div class="orderedlist"><ol class="orderedlist" type="1">
 <li class="listitem">
-<p>If you invoke the <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/make.1";><span class="citerefentry"><span class="refentrytitle">make</span>(1)</span></a> command with
+<p>If you invoke the <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/make.1";><span class="citerefentry"><span class="refentrytitle">make</span>(1)</span></a> command with
        <code class="varname">PKG_DEBUG_LEVEL=2</code>, then a huge amount of
        information will be displayed. For example,</p>
 <pre class="screen"><strong class="userinput"><code>make patch PKG_DEBUG_LEVEL=2</code></strong></pre>
@@ -1612,10 +1634,10 @@ Version mismatch: 'tcsh' 6.09.00 vs 6.10
        including the <span class="quote">&#8220;<span class="quote">patch</span>&#8221;</span> stage.</p>
 </li>
 <li class="listitem">
-<p>If you want to know the value of a certain <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/make.1";><span class="citerefentry"><span 
class="refentrytitle">make</span>(1)</span></a>
+<p>If you want to know the value of a certain <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/make.1";><span class="citerefentry"><span 
class="refentrytitle">make</span>(1)</span></a>
        definition, then the <code class="varname">VARNAME</code> definition
        should be used, in conjunction with the show-var
-       target. e.g. to show the expansion of the <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/make.1";><span class="citerefentry"><span 
class="refentrytitle">make</span>(1)</span></a>
+       target. e.g. to show the expansion of the <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/make.1";><span class="citerefentry"><span 
class="refentrytitle">make</span>(1)</span></a>
        variable <code class="varname">LOCALBASE</code>:</p>
 <pre class="screen">
 <code class="prompt">%</code> <strong class="userinput"><code>make show-var VARNAME=LOCALBASE</code></strong>
@@ -1628,11 +1650,11 @@ Version mismatch: 'tcsh' 6.09.00 vs 6.10
     created yourself (see next section), that you put into
     pkgsrc/packages manually or that is located on a remote FTP
     server, you can use the "bin-install" target. This target will
-    install a binary package - if available - via <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/pkg_add.1";><span class="citerefentry"><span 
class="refentrytitle">pkg_add</span>(1)</span></a>,
+    install a binary package - if available - via <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/pkg_add.1";><span class="citerefentry"><span 
class="refentrytitle">pkg_add</span>(1)</span></a>,
     else do a <span class="command"><strong>make package</strong></span>.  The list of remote FTP
     sites searched is kept in the variable
     <code class="varname">BINPKG_SITES</code>, which defaults to
-    ftp.NetBSD.org. Any flags that should be added to <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/pkg_add.1";><span class="citerefentry"><span 
class="refentrytitle">pkg_add</span>(1)</span></a>
+    ftp.NetBSD.org. Any flags that should be added to <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/pkg_add.1";><span class="citerefentry"><span 
class="refentrytitle">pkg_add</span>(1)</span></a>
     can be put into <code class="varname">BIN_INSTALL_FLAGS</code>.  See
     <code class="filename">pkgsrc/mk/defaults/mk.conf</code> for more
     details.</p>
@@ -1671,7 +1693,7 @@ Version mismatch: 'tcsh' 6.09.00 vs 6.10
 <a name="mk.conf"></a><p>The whole pkgsrc system is configured in a single file, usually
 called <code class="filename">mk.conf</code>. In which directory pkgsrc looks for
 that file depends on the installation. On NetBSD, when you use
-<a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/make.1";><span class="citerefentry"><span class="refentrytitle">make</span>(1)</span></a> from the base system, it is in the 
directory
+<a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/make.1";><span class="citerefentry"><span class="refentrytitle">make</span>(1)</span></a> from the base system, it is in the 
directory
 <code class="filename">/etc/</code>. In all other cases the default location is
 <code class="literal">${PREFIX}/etc/</code>, depending on where you told the
 bootstrap program to install the binary packages.</p>
@@ -1813,7 +1835,7 @@ uid=1000(myusername) gid=100(users) grou
 <p>
 
     For the following command, you must be able to gain root
-    privileges using <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/su.1";><span class="citerefentry"><span class="refentrytitle">su</span>(1)</span></a>
+    privileges using <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/su.1";><span class="citerefentry"><span class="refentrytitle">su</span>(1)</span></a>
 
 </p>
 <pre class="programlisting">
@@ -1913,7 +1935,7 @@ CFLAGS+=        -your -flags
 <p>Using <code class="varname">CFLAGS=</code> (i.e. without the
        <span class="quote">&#8220;<span class="quote">+</span>&#8221;</span>) may lead to problems with packages that
        need to add their own flags.  You may want to take a look
-       at the <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/devel/cpuflags/README.html"; target="_top"><code class="filename">devel/cpuflags</code></a>
+       at the <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/devel/cpuflags/index.html"; target="_top"><code class="filename">devel/cpuflags</code></a>
        package if you're interested in optimization specifically
        for the current CPU. </p>
 </div>
@@ -2053,7 +2075,7 @@ PKG_OPTIONS.apache=     suexec </pre>
 <a name="building-a-single-binary-package"></a>7.1.�Building a single binary package</h2></div></div></div>
 <p>Once you have built and installed a package, you can create
     a <span class="emphasis"><em>binary package</em></span> which can be installed on
-    another system with <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/pkg_add.1";><span class="citerefentry"><span class="refentrytitle">pkg_add</span>(1)</span></a>. This 
saves having to build
+    another system with <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/pkg_add.1";><span class="citerefentry"><span class="refentrytitle">pkg_add</span>(1)</span></a>. This 
saves having to build
     the same package on a group of hosts and wasting CPU time. It also
     provides a simple means for others to install your package, should
     you distribute it.</p>
@@ -2069,8 +2091,8 @@ PKG_OPTIONS.apache=     suexec </pre>
     then use the <span class="command"><strong>pkg_*</strong></span> tools to manipulate
     it. Binary packages are created by default in
     <code class="filename">/usr/pkgsrc/packages</code>, in the form of a
-    gzipped tar file. See <a class="xref" href="#logs.package" title="B.2.�Packaging figlet">Section�B.2, &#8220;Packaging figlet&#8221;</a> for a
-    continuation of the above <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/misc/figlet/README.html"; target="_top"><code class="filename">misc/figlet</code></a> example.</p>
+    gzipped tar file. See <a class="xref" href="#logs.package" title="C.2.�Packaging figlet">Section�C.2, &#8220;Packaging figlet&#8221;</a> for a
+    continuation of the above <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/misc/figlet/index.html"; target="_top"><code class="filename">misc/figlet</code></a> example.</p>
 <p>See <a class="xref" href="#submit" title="Chapter�23.�Submitting and Committing">Chapter�23, <i>Submitting and Committing</i></a> for information on how to submit
     such a binary package.</p>
 </div>
@@ -2485,7 +2507,7 @@ different.</p>
 <p>After your pkgsrc bulk-build has completed, you may wish to
     create a CD-ROM set of the resulting binary packages to assist
     in installing packages on other machines.  The
-    <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/cdpack/README.html"; target="_top"><code class="filename">pkgtools/cdpack</code></a> package provides
+    <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/cdpack/index.html"; target="_top"><code class="filename">pkgtools/cdpack</code></a> package provides
     a simple tool for creating the ISO 9660 images.
     <span class="command"><strong>cdpack</strong></span> arranges the packages on the CD-ROMs in a
     way that keeps all the dependencies for a given package on the same
@@ -2735,70 +2757,70 @@ section attempts only to make the reader
 they might be useful, and not to duplicate the documentation that comes
 with each package.</p>
 <p>Utilities used by pkgsrc (automatically installed when needed):</p>
-<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem"><p><a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/x11-links/README.html"; 
target="_top"><code class="filename">pkgtools/x11-links</code></a>:
+<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem"><p><a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/x11-links/index.html"; 
target="_top"><code class="filename">pkgtools/x11-links</code></a>:
       Symlinks for use by buildlink.</p></li></ul></div>
 <p>OS tool augmentation (automatically installed when needed):</p>
 <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
-<li class="listitem"><p><a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/digest/README.html"; target="_top"><code class="filename">pkgtools/digest</code></a>:
+<li class="listitem"><p><a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/digest/index.html"; target="_top"><code class="filename">pkgtools/digest</code></a>:
       Calculates various kinds of checksums (including SHA3).</p></li>
-<li class="listitem"><p><a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/libnbcompat/README.html"; target="_top"><code class="filename">pkgtools/libnbcompat</code></a>:
+<li class="listitem"><p><a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/libnbcompat/index.html"; target="_top"><code class="filename">pkgtools/libnbcompat</code></a>:
       Compatibility library for pkgsrc tools.</p></li>
-<li class="listitem"><p><a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/mtree/README.html"; target="_top"><code class="filename">pkgtools/mtree</code></a>: Installed on
+<li class="listitem"><p><a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/mtree/index.html"; target="_top"><code class="filename">pkgtools/mtree</code></a>: Installed on
       non-BSD systems due to lack of native mtree.</p></li>
-<li class="listitem"><p><a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/pkg_install/README.html"; target="_top"><code class="filename">pkgtools/pkg_install</code></a>:
+<li class="listitem"><p><a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/pkg_install/index.html"; target="_top"><code class="filename">pkgtools/pkg_install</code></a>:
       Up-to-date replacement for
       <code class="filename">/usr/sbin/pkg_install</code>, or for use on operating
       systems where pkg_install is not present.</p></li>
 </ul></div>
 <p>Utilities used by pkgsrc (not automatically installed):</p>
 <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
-<li class="listitem"><p><a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/pkg_tarup/README.html"; target="_top"><code class="filename">pkgtools/pkg_tarup</code></a>:
+<li class="listitem"><p><a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/pkg_tarup/index.html"; target="_top"><code class="filename">pkgtools/pkg_tarup</code></a>:
       Create a binary package from an
       already-installed package.  Used by <span class="command"><strong>make replace</strong></span> to
       save the old package.</p></li>
-<li class="listitem"><p><a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/dfdisk/README.html"; target="_top"><code class="filename">pkgtools/dfdisk</code></a>:
+<li class="listitem"><p><a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/dfdisk/index.html"; target="_top"><code class="filename">pkgtools/dfdisk</code></a>:
       Adds extra functionality to pkgsrc, allowing it to fetch distfiles
       from multiple locations. It currently supports the following
       methods: multiple CD-ROMs and network FTP/HTTP connections.</p></li>
-<li class="listitem"><p><a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/devel/cpuflags/README.html"; target="_top"><code class="filename">devel/cpuflags</code></a>: Determine
+<li class="listitem"><p><a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/devel/cpuflags/index.html"; target="_top"><code class="filename">devel/cpuflags</code></a>: Determine
       the best compiler flags to optimise code for your current
       CPU and compiler. </p></li>
 </ul></div>
 <p>Utilities for keeping track of installed packages, being up to date,
 etc:</p>
 <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
-<li class="listitem"><p><a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/pkgin/README.html"; target="_top"><code class="filename">pkgtools/pkgin</code></a>: A package
+<li class="listitem"><p><a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/pkgin/index.html"; target="_top"><code class="filename">pkgtools/pkgin</code></a>: A package
     update tool similar to apt(1). Download, install, and upgrade
     binary packages easily.</p></li>
-<li class="listitem"><p><a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/pkg_chk/README.html"; target="_top"><code class="filename">pkgtools/pkg_chk</code></a>: Reports on
+<li class="listitem"><p><a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/pkg_chk/index.html"; target="_top"><code class="filename">pkgtools/pkg_chk</code></a>: Reports on
       packages whose installed versions do not match the latest pkgsrc
       entries.</p></li>
-<li class="listitem"><p><a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/pkgdep/README.html"; target="_top"><code class="filename">pkgtools/pkgdep</code></a>: Makes
+<li class="listitem"><p><a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/pkgdep/index.html"; target="_top"><code class="filename">pkgtools/pkgdep</code></a>: Makes
       dependency graphs of packages, to aid in choosing a strategy for
       updating.</p></li>
-<li class="listitem"><p><a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/pkgdepgraph/README.html"; target="_top"><code class="filename">pkgtools/pkgdepgraph</code></a>: Makes
-      graphs from the output of <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/pkgdep/README.html"; target="_top"><code class="filename">pkgtools/pkgdep</code></a> (uses 
graphviz).</p></li>
-<li class="listitem"><p><a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/pkglint/README.html"; target="_top"><code class="filename">pkgtools/pkglint</code></a>: The
+<li class="listitem"><p><a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/pkgdepgraph/index.html"; target="_top"><code class="filename">pkgtools/pkgdepgraph</code></a>: Makes
+      graphs from the output of <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/pkgdep/index.html"; target="_top"><code class="filename">pkgtools/pkgdep</code></a> (uses 
graphviz).</p></li>
+<li class="listitem"><p><a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/pkglint/index.html"; target="_top"><code class="filename">pkgtools/pkglint</code></a>: The
       pkglint(1) program checks a pkgsrc entry for errors.</p></li>
-<li class="listitem"><p><a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/lintpkgsrc/README.html"; target="_top"><code class="filename">pkgtools/lintpkgsrc</code></a>: The 
lintpkgsrc(1) program
+<li class="listitem"><p><a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/lintpkgsrc/index.html"; target="_top"><code class="filename">pkgtools/lintpkgsrc</code></a>: The 
lintpkgsrc(1) program
       does various checks on the complete pkgsrc system.</p></li>
-<li class="listitem"><p><a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/pkgsurvey/README.html"; target="_top"><code class="filename">pkgtools/pkgsurvey</code></a>: Report what
+<li class="listitem"><p><a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/pkgsurvey/index.html"; target="_top"><code class="filename">pkgtools/pkgsurvey</code></a>: Report what
       packages you have installed.</p></li>
 </ul></div>
 <p>Utilities for people maintaining or creating individual packages:</p>
 <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
-<li class="listitem"><p><a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/pkgdiff/README.html"; target="_top"><code class="filename">pkgtools/pkgdiff</code></a>: Automate
+<li class="listitem"><p><a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/pkgdiff/index.html"; target="_top"><code class="filename">pkgtools/pkgdiff</code></a>: Automate
       making and maintaining patches for a package (includes pkgdiff,
       pkgvi, mkpatches, etc.).</p></li>
-<li class="listitem"><p><a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/url2pkg/README.html"; target="_top"><code class="filename">pkgtools/url2pkg</code></a>: Aids in
+<li class="listitem"><p><a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/url2pkg/index.html"; target="_top"><code class="filename">pkgtools/url2pkg</code></a>: Aids in
       converting to pkgsrc.</p></li>
 </ul></div>
 <p>Utilities for people maintaining pkgsrc (or: more obscure pkg
 utilities)</p>
 <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
-<li class="listitem"><p><a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/pkg_comp/README.html"; target="_top"><code class="filename">pkgtools/pkg_comp</code></a>: Build
+<li class="listitem"><p><a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/pkg_comp/index.html"; target="_top"><code class="filename">pkgtools/pkg_comp</code></a>: Build
       packages in a chrooted area.</p></li>
-<li class="listitem"><p><a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/libkver/README.html"; target="_top"><code class="filename">pkgtools/libkver</code></a>: Spoof
+<li class="listitem"><p><a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/libkver/index.html"; target="_top"><code class="filename">pkgtools/libkver</code></a>: Spoof
       kernel version for chrooted cross builds.</p></li>
 </ul></div>
 </div>
@@ -2909,7 +2931,7 @@ but downloading the entire directory may
 <p>The answer here is to do a <span class="command"><strong>make fetch-list</strong></span> in
 <code class="filename">/usr/pkgsrc</code> or one of its subdirectories, carry the
 resulting list to your machine at work/school and use it there.  If you
-don't have a NetBSD-compatible <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/ftp.1";><span class="citerefentry"><span class="refentrytitle">ftp</span>(1)</span></a> (like 
tnftp) at work, don't
+don't have a NetBSD-compatible <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/ftp.1";><span class="citerefentry"><span class="refentrytitle">ftp</span>(1)</span></a> (like 
tnftp) at work, don't
 forget to set <code class="varname">FETCH_CMD</code> to something that fetches a
 URL:</p>
 <p>At home:</p>
@@ -2935,13 +2957,13 @@ by running:</p>
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
 <a name="tmac.andoc-missing"></a>10.10.�What does <span class="quote">&#8220;<span class="quote">Don't know how to make
 /usr/share/tmac/tmac.andoc</span>&#8221;</span> mean?</h2></div></div></div>
-<p>When compiling the <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/pkg_install/README.html"; target="_top"><code class="filename">pkgtools/pkg_install</code></a>
+<p>When compiling the <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/pkg_install/index.html"; target="_top"><code class="filename">pkgtools/pkg_install</code></a>
 package, you get the error from make that it doesn't know how to make
 <code class="filename">/usr/share/tmac/tmac.andoc</code>? This indicates that
 you don't have installed the <span class="quote">&#8220;<span class="quote">text</span>&#8221;</span> set (nroff, ...) from
 the NetBSD base distribution on your machine.  It is recommended to do
 that to format man pages.</p>
-<p>In the case of the <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/pkg_install/README.html"; target="_top"><code class="filename">pkgtools/pkg_install</code></a> package, you
+<p>In the case of the <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/pkg_install/index.html"; target="_top"><code class="filename">pkgtools/pkg_install</code></a> package, you
 can get away with setting <code class="varname">NOMAN=YES</code> either in the
 environment or in <a class="link" href="#mk.conf"><code class="filename">mk.conf</code></a>.</p>
 </div>
@@ -2961,11 +2983,11 @@ the one that corresponds to your release
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
 <a name="using-sudo-with-pkgsrc"></a>10.12.�Using 'sudo' with pkgsrc</h2></div></div></div>
 <p>When installing packages as non-root user and using the just-in-time
-<a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/su.1";><span class="citerefentry"><span class="refentrytitle">su</span>(1)</span></a> feature of pkgsrc, it can become annoying to 
type in the root
+<a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/su.1";><span class="citerefentry"><span class="refentrytitle">su</span>(1)</span></a> feature of pkgsrc, it can become annoying to 
type in the root
 password for each required package installed.  To avoid this, the sudo
 package can be used, which does password caching over a limited time.  To
 use it, install sudo (either as binary package or from
-<a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/security/sudo/README.html"; target="_top"><code class="filename">security/sudo</code></a>) and then put the
+<a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/security/sudo/index.html"; target="_top"><code class="filename">security/sudo</code></a>) and then put the
 following into your <a class="link" href="#mk.conf"><code class="filename">mk.conf</code></a>, somewhere
 <span class="emphasis"><em>after</em></span> the definition of the
 <code class="varname">LOCALBASE</code> variable:</p>
@@ -3007,7 +3029,7 @@ maintains a database of known-exploits t
 been included in pkgsrc.  The database can be downloaded automatically, and
 a security audit of all packages installed on a system can take place.  To
 do this, refer to the following two tools (installed as part of the
-<a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/pkg_install/README.html"; target="_top"><code class="filename">pkgtools/pkg_install</code></a> package):</p>
+<a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/pkg_install/index.html"; target="_top"><code class="filename">pkgtools/pkg_install</code></a> package):</p>
 <div class="orderedlist"><ol class="orderedlist" type="1">
 <li class="listitem">
 <p><span class="command"><strong>pkg_admin fetch-pkg-vulnerabilities</strong></span>, an easy way to
@@ -3035,7 +3057,7 @@ perform a security check before building
        <code class="varname">CFLAGS</code> variable in your
        <a class="link" href="#mk.conf"><code class="filename">mk.conf</code></a>, these flags are passed in
        environment variables to the <code class="filename">./configure</code>
-       scripts and to <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/make.1";><span class="citerefentry"><span class="refentrytitle">make</span>(1)</span></a>. Some package 
authors ignore the
+       scripts and to <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/make.1";><span class="citerefentry"><span class="refentrytitle">make</span>(1)</span></a>. Some package 
authors ignore the
        <code class="varname">CFLAGS</code> from the environment variable by
        overriding them in the <code class="filename">Makefile</code>s of their
        package.</p>
@@ -3360,7 +3382,7 @@ anymore, you can remove that file and ru
        <code class="varname">BUILD_DEFS</code>, a make target like
        <span class="command"><strong>do-build</strong></span>, a missing C or C++ function like
        <span class="command"><strong>strcasecmp</strong></span> or any other topic.</p>
-<p>The available help topics are listed in <a class="xref" href="#help-topics" title="Appendix�D.�Help topics">Appendix�D, <i>Help topics</i></a>.</p>
+<p>The available help topics are listed in <a class="xref" href="#help-topics" title="Appendix�E.�Help topics">Appendix�E, <i>Help topics</i></a>.</p>
 </li>
 <li class="listitem"><p>
        To see the value of a single variable, run <span class="command"><strong>bmake
@@ -3489,7 +3511,7 @@ converters    games         mbone       
     Primary location(s) for distribution patch files (see
     <code class="varname">PATCHFILES</code> above) if not found locally.</p></li>
 <li class="listitem"><p><code class="varname">PATCH_DIST_STRIP</code>:
-    an argument to <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/patch.1";><span class="citerefentry"><span class="refentrytitle">patch</span>(1)</span></a> that sets the 
pathname strip count to
+    an argument to <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/patch.1";><span class="citerefentry"><span class="refentrytitle">patch</span>(1)</span></a> that sets the 
pathname strip count to
     help find the correct files to patch. It defaults to
     <span class="command"><strong>-p0</strong></span>.</p></li>
 </ul></div>
@@ -3499,7 +3521,7 @@ converters    games         mbone       
 <li class="listitem"><p><code class="varname">MAINTAINER</code> is the email
     address of the person who feels responsible for this package,
     and who is most likely to look at problems or questions regarding
-    this package which have been reported with <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/send-pr.1";><span class="citerefentry"><span 
class="refentrytitle">send-pr</span>(1)</span></a>.
+    this package which have been reported with <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/send-pr.1";><span class="citerefentry"><span 
class="refentrytitle">send-pr</span>(1)</span></a>.
     Other developers may contact the <code class="varname">MAINTAINER</code>
     before making changes to the package, but are not required to
     do so. When packaging a new program, set <code class="varname">MAINTAINER</code>
@@ -3536,7 +3558,7 @@ converters    games         mbone       
       set <code class="varname">WRKSRC</code> to point to the proper name in
       <code class="filename">${WRKDIR}</code>, for example
       <code class="varname">WRKSRC=${WRKDIR}/${DISTNAME}/unix</code>. See
-      <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/lang/tcl/README.html"; target="_top"><code class="filename">lang/tcl</code></a> and <a 
href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/x11/tk/README.html"; target="_top"><code class="filename">x11/tk</code></a> for other examples.</p>
+      <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/lang/tcl/index.html"; target="_top"><code class="filename">lang/tcl</code></a> and <a 
href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/x11/tk/index.html"; target="_top"><code class="filename">x11/tk</code></a> for other examples.</p>
 <p>The name of the working directory created by pkgsrc is
       taken from the <code class="varname">WRKDIR_BASENAME</code>
       variable. By default, its value is
@@ -3587,7 +3609,7 @@ converters    games         mbone       
 <p>To regenerate the <code class="filename">distinfo</code> file, use the
   <span class="command"><strong>make distinfo</strong></span> command.</p>
 <p>Some packages have different sets of distfiles depending on
-  the platform, for example <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/lang/openjdk8/README.html"; target="_top"><code class="filename">lang/openjdk8</code></a>. These are kept in the 
same
+  the platform, for example <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/lang/openjdk8/index.html"; target="_top"><code class="filename">lang/openjdk8</code></a>. These are kept in the 
same
   <code class="filename">distinfo</code> file and care should be taken when
   upgrading such a package to ensure distfile information is not
   lost.</p>
@@ -3637,7 +3659,7 @@ converters    games         mbone       
 <p>One important thing to mention is to pay attention that no RCS
   IDs get stored in the patch files, as these will cause problems when
   later checked into the NetBSD CVS tree. Use the
-  <span class="command"><strong>pkgdiff</strong></span> command from the <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/pkgdiff/README.html"; target="_top"><code 
class="filename">pkgtools/pkgdiff</code></a> package to avoid these
+  <span class="command"><strong>pkgdiff</strong></span> command from the <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/pkgdiff/index.html"; target="_top"><code 
class="filename">pkgtools/pkgdiff</code></a> package to avoid these
   problems.</p>
 <p>For even more automation, we recommend using
   <span class="command"><strong>mkpatches</strong></span> from the same package to make a
@@ -3664,7 +3686,7 @@ converters    games         mbone       
   Many packages still use the previous convention
   <code class="filename">patch-<em class="replaceable"><code>[a-z][a-z]</code></em></code>,
   but new patches should be of the form containing the filename.
-  <span class="command"><strong>mkpatches</strong></span> included in <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/pkgdiff/README.html"; target="_top"><code 
class="filename">pkgtools/pkgdiff</code></a> takes care of the name
+  <span class="command"><strong>mkpatches</strong></span> included in <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/pkgdiff/index.html"; target="_top"><code 
class="filename">pkgtools/pkgdiff</code></a> takes care of the name
   automatically.</p>
 </div>
 <div class="sect2">
@@ -3852,13 +3874,13 @@ monitor_file(...)
 <div class="variablelist"><dl class="variablelist">
 <dt><span class="term"><code class="filename">INSTALL</code></span></dt>
 <dd>
-<p>This shell script is invoked twice by <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/pkg_add.1";><span class="citerefentry"><span 
class="refentrytitle">pkg_add</span>(1)</span></a>.
+<p>This shell script is invoked twice by <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/pkg_add.1";><span class="citerefentry"><span 
class="refentrytitle">pkg_add</span>(1)</span></a>.
            First time after package extraction and before files are
            moved in place, the second time after the files to install
            are moved in place. This can be used to do any custom
            procedures not possible with @exec commands in
-           <code class="filename">PLIST</code>. See <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/pkg_add.1";><span class="citerefentry"><span 
class="refentrytitle">pkg_add</span>(1)</span></a> and
-           <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/pkg_create.1";><span class="citerefentry"><span class="refentrytitle">pkg_create</span>(1)</span></a> for more 
information.  See also <a class="xref" href="#files-and-dirs-outside-prefix" title="20.1.�Files and directories outside the installation prefix">Section�20.1, &#8220;Files and directories outside the 
installation prefix&#8221;</a>.
+           <code class="filename">PLIST</code>. See <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/pkg_add.1";><span class="citerefentry"><span 
class="refentrytitle">pkg_add</span>(1)</span></a> and
+           <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/pkg_create.1";><span class="citerefentry"><span class="refentrytitle">pkg_create</span>(1)</span></a> for more 
information.  See also <a class="xref" href="#files-and-dirs-outside-prefix" title="20.1.�Files and directories outside the installation prefix">Section�20.1, &#8220;Files and directories outside the 
installation prefix&#8221;</a>.
            Please note that you can modify variables in it easily by using
            <code class="varname">FILES_SUBST</code> in the package's
            <code class="filename">Makefile</code>:</p>
@@ -3878,8 +3900,8 @@ FILES_SUBST+=  SOMEVAR="somevalue"
            this script's responsibility to clean up any additional messy details
            around the package's installation, since all pkg_delete knows is how to
            delete the files created in the original distribution.
-           See <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/pkg_delete.1";><span class="citerefentry"><span class="refentrytitle">pkg_delete</span>(1)</span></a>
-           and <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/pkg_create.1";><span class="citerefentry"><span class="refentrytitle">pkg_create</span>(1)</span></a> for more 
information.
+           See <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/pkg_delete.1";><span class="citerefentry"><span class="refentrytitle">pkg_delete</span>(1)</span></a>
+           and <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/pkg_create.1";><span class="citerefentry"><span class="refentrytitle">pkg_create</span>(1)</span></a> for more 
information.
            The same methods to replace variables can be used as for
            the <code class="filename">INSTALL</code> file.</p></dd>
 <dt><span class="term"><code class="filename">MESSAGE</code></span></dt>
@@ -4108,7 +4130,7 @@ FILESDIR=       ../../editors/xemacs/fil
        <code class="varname">USE_IMAKE</code> to be installed correctly under
        <code class="varname">LOCALBASE</code>.</p></li>
 <li class="listitem"><p>Within <code class="filename">${PREFIX}</code>, packages should
-       install files according to <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/hier.7";><span class="citerefentry"><span class="refentrytitle">hier</span>(7)</span></a>, with 
the exception that
+       install files according to <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/hier.7";><span class="citerefentry"><span class="refentrytitle">hier</span>(7)</span></a>, with 
the exception that
        manual pages go into <code class="filename">${PREFIX}/man</code>, not
        <code class="filename">${PREFIX}/share/man</code>.</p></li>
 </ul></div>
@@ -4426,9 +4448,9 @@ ${FETCH_CMD} ${FETCH_BEFORE_ARGS} ${site
     <code class="filename">.gz</code> are uncompressed before they are
     applied, files ending in <code class="filename">.orig</code> or
     <code class="filename">.rej</code> are ignored. Any special options to
-    <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/patch.1";><span class="citerefentry"><span class="refentrytitle">patch</span>(1)</span></a> can be handed in
+    <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/patch.1";><span class="citerefentry"><span class="refentrytitle">patch</span>(1)</span></a> can be handed in
     <code class="varname">PATCH_DIST_ARGS</code>.  See <a class="xref" href="#components.patches" title="12.3.�patches/*">Section�12.3, &#8220;<code class="filename">patches/*</code>&#8221;</a> for 
more details.</p>
-<p>By default <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/patch.1";><span class="citerefentry"><span class="refentrytitle">patch</span>(1)</span></a> is given special 
arguments to make it
+<p>By default <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/patch.1";><span class="citerefentry"><span class="refentrytitle">patch</span>(1)</span></a> is given special 
arguments to make it
     fail if the expected text from the patch context is not found in the
     patched file. If that happens, fix the patch file by comparing it
     with the actual text in the file to be patched.</p>
@@ -4607,7 +4629,7 @@ ${FETCH_CMD} ${FETCH_BEFORE_ARGS} ${site
     defined.</p>
 <p>In the <span class="emphasis"><em>install</em></span> phase, the following
     variables are useful. They are all variations of the
-    <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/install.1";><span class="citerefentry"><span class="refentrytitle">install</span>(1)</span></a> command that have the owner, 
group and
+    <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/install.1";><span class="citerefentry"><span class="refentrytitle">install</span>(1)</span></a> command that have the owner, 
group and
     permissions preset. <code class="varname">INSTALL</code> is the plain
     install command. The specialized variants, together with their
     intended use, are:</p>
@@ -4653,7 +4675,7 @@ ${FETCH_CMD} ${FETCH_BEFORE_ARGS} ${site
 <p>Some other variables are:</p>
 <div class="variablelist"><dl class="variablelist">
 <dt><span class="term"><code class="varname">INSTALL_UNSTRIPPED</code></span></dt>
-<dd><p>If set to <code class="literal">yes</code>, do not run <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/strip.1";><span class="citerefentry"><span 
class="refentrytitle">strip</span>(1)</span></a>
+<dd><p>If set to <code class="literal">yes</code>, do not run <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/strip.1";><span class="citerefentry"><span 
class="refentrytitle">strip</span>(1)</span></a>
       when installing binaries. Any debugging sections and symbols present in
       binaries will be preserved.
       </p></dd>
@@ -4741,13 +4763,13 @@ ${FETCH_CMD} ${FETCH_BEFORE_ARGS} ${site
 </dd>
 <dt><span class="term">deinstall</span></dt>
 <dd>
-<p>This target does a <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/pkg_delete.1";><span class="citerefentry"><span class="refentrytitle">pkg_delete</span>(1)</span></a> in the
+<p>This target does a <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/pkg_delete.1";><span class="citerefentry"><span class="refentrytitle">pkg_delete</span>(1)</span></a> in the
          current directory, effectively de-installing the
          package. The following variables can be used to tune the
          behaviour:</p>
 <div class="variablelist"><dl class="variablelist">
 <dt><span class="term"><code class="varname">PKG_VERBOSE</code></span></dt>
-<dd><p>Add a "-v" to the <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/pkg_delete.1";><span class="citerefentry"><span class="refentrytitle">pkg_delete</span>(1)</span></a> 
command.</p></dd>
+<dd><p>Add a "-v" to the <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/pkg_delete.1";><span class="citerefentry"><span class="refentrytitle">pkg_delete</span>(1)</span></a> 
command.</p></dd>
 <dt><span class="term"><code class="varname">DEINSTALLDEPENDS</code></span></dt>
 <dd><p>Remove all packages that require (depend on)
                the given package.  This can be used to remove any
@@ -4756,7 +4778,7 @@ ${FETCH_CMD} ${FETCH_BEFORE_ARGS} ${site
                DEINSTALLDEPENDS=1</strong></span> is done in
                <code class="filename">pkgsrc/x11/kde</code>, this is
                likely to remove whole KDE. Works by adding
-               <span class="quote">&#8220;<span class="quote">-R</span>&#8221;</span> to the <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/pkg_delete.1";><span 
class="citerefentry"><span class="refentrytitle">pkg_delete</span>(1)</span></a>
+               <span class="quote">&#8220;<span class="quote">-R</span>&#8221;</span> to the <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/pkg_delete.1";><span 
class="citerefentry"><span class="refentrytitle">pkg_delete</span>(1)</span></a>
                command line.</p></dd>
 </dl></div>
 </dd>
@@ -4896,7 +4918,7 @@ ${FETCH_CMD} ${FETCH_BEFORE_ARGS} ${site
 <dd>
 <p>Update the installation of the current package.  This
          differs from update in that it does not replace dependent
-         packages.  You will need to install <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/pkg_tarup/README.html"; target="_top"><code 
class="filename">pkgtools/pkg_tarup</code></a> for this
+         packages.  You will need to install <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/pkg_tarup/index.html"; target="_top"><code 
class="filename">pkgtools/pkg_tarup</code></a> for this
          target to work.</p>
 <p><span class="emphasis"><em>Be careful when using this
          target!</em></span> There are no guarantees that dependent
@@ -4908,7 +4930,7 @@ ${FETCH_CMD} ${FETCH_BEFORE_ARGS} ${site
          recommended for advanced users.</p>
 </dd>
 <dt><span class="term">info</span></dt>
-<dd><p>This target invokes <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/pkg_info.1";><span class="citerefentry"><span class="refentrytitle">pkg_info</span>(1)</span></a> for 
the current
+<dd><p>This target invokes <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/pkg_info.1";><span class="citerefentry"><span class="refentrytitle">pkg_info</span>(1)</span></a> for 
the current
          package. You can use this to check which version of a
          package is installed.</p></dd>
 <dt><span class="term">index</span></dt>
@@ -4935,7 +4957,7 @@ ${FETCH_CMD} ${FETCH_BEFORE_ARGS} ${site
 <dd>
 <p>This target generates a
          <code class="filename">index.html</code> file, which can be
-         viewed using a browser such as <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/www/firefox/README.html"; target="_top"><code class="filename">www/firefox</code></a> or <a 
href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/www/links/README.html"; target="_top"><code class="filename">www/links</code></a>.  The generated files
+         viewed using a browser such as <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/www/firefox/index.html"; target="_top"><code class="filename">www/firefox</code></a> or <a 
href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/www/links/index.html"; target="_top"><code class="filename">www/links</code></a>.  The generated files
          contain references to any packages which are in the
          <code class="varname">PACKAGES</code> directory on the local
          host. The generated files can be made to refer to URLs
@@ -5024,7 +5046,7 @@ ${FETCH_CMD} ${FETCH_BEFORE_ARGS} ${site
          <code class="filename">PLIST</code>. On upgrades, it's useful to
          diff the output of this command against an already
          existing <code class="filename">PLIST</code> file.</p>
-<p>If the package installs files via <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/tar.1";><span class="citerefentry"><span class="refentrytitle">tar</span>(1)</span></a> or
+<p>If the package installs files via <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/tar.1";><span class="citerefentry"><span class="refentrytitle">tar</span>(1)</span></a> or
          other methods that don't update file access times, be
          sure to add these files manually to your
          <code class="filename">PLIST</code>, as the <span class="quote">&#8220;<span class="quote">find
@@ -5061,7 +5083,7 @@ few steps.</p>
 <li class="step"><p>In your <a class="link" href="#mk.conf"><code class="filename">mk.conf</code></a>, set <code class="code">PKG_DEVELOPER=yes</code> to
 enable the basic quality checks.</p></li>
 <li class="step">
-<p>Install the package <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/meta-pkgs/pkg_developer/README.html"; target="_top"><code class="filename">meta-pkgs/pkg_developer</code></a>, which 
among others will
+<p>Install the package <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/meta-pkgs/pkg_developer/index.html"; target="_top"><code class="filename">meta-pkgs/pkg_developer</code></a>, which 
among others will
 install the utilities <span class="command"><strong>url2pkg</strong></span>,
 <span class="command"><strong>pkglint</strong></span>, <span class="command"><strong>pkgvi</strong></span> and
 <span class="command"><strong>mkpatches</strong></span>:</p>
@@ -5255,7 +5277,7 @@ of supported packages.</p>
 <a name="creating.R-package"></a>14.1.3.�R packages</h3></div></div></div>
 <p>Simple R packages from <a class="ulink" href="https://cran.r-project.org/web/packages/available_packages_by_name.html"; target="_top">CRAN</a>
 are handled automatically by <span class="command"><strong>R2pkg</strong></span>, which is
-available in <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/R2pkg/README.html"; target="_top"><code class="filename">pkgtools/R2pkg</code></a>.
+available in <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/R2pkg/index.html"; target="_top"><code class="filename">pkgtools/R2pkg</code></a>.
 Individual packages (and optionally their dependencies) may be created
 and updated.  R packages generally follow the same form, and most of
 the relevant information needed is contained in a
@@ -5269,7 +5291,7 @@ package should be reviewed for correctne
 <div class="titlepage"><div><div><h3 class="title">
 <a name="creating.TeX-package"></a>14.1.4.�TeXlive packages</h3></div></div></div>
 <p>TeXlive packages from <a class="ulink" href="https://www.ctan.org/"; target="_top">CTAN</a> are handled automatically by
-<span class="command"><strong>texlive2pkg</strong></span>, which is available in <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/texlive2pkg/README.html"; target="_top"><code 
class="filename">pkgtools/texlive2pkg</code></a>.</p>
+<span class="command"><strong>texlive2pkg</strong></span>, which is available in <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/texlive2pkg/index.html"; target="_top"><code 
class="filename">pkgtools/texlive2pkg</code></a>.</p>
 <p>If the TeXlive package name is not known, it may be useful to
 search <a class="ulink" href="https://www.ctan.org/"; target="_top">CTAN</a>.  A
 <span class="quote">&#8220;<span class="quote">Contained in</span>&#8221;</span> field on the package page typically
@@ -5504,7 +5526,7 @@ BUILDLINK_TRANSFORM+=   l:IDL:IDL-2
 <code class="filename">libIDL-2.so</code> is available. So I told the compiler
 wrapper to rewrite that on the fly.</p>
 <p>The next problem was related to a recent change of the FreeType
-interface. I looked up in <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/www/seamonkey/README.html"; target="_top"><code class="filename">www/seamonkey</code></a>
+interface. I looked up in <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/www/seamonkey/index.html"; target="_top"><code class="filename">www/seamonkey</code></a>
 which patch files were relevant for this issue and copied them to the
 <code class="filename">patches</code> directory. Then I retried, fixed the
 patches so that they applied cleanly and retried again. This time,
@@ -5544,13 +5566,13 @@ everything worked.</p>
 </div>
 <p>Pkgsrc consists of many <code class="filename">Makefile</code> fragments,
   each of which forms a well-defined part of the pkgsrc system. Using
-  the <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/make.1";><span class="citerefentry"><span class="refentrytitle">make</span>(1)</span></a> system as a programming language 
for a big system
+  the <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/make.1";><span class="citerefentry"><span class="refentrytitle">make</span>(1)</span></a> system as a programming language 
for a big system
   like pkgsrc requires some discipline to keep the code correct and
   understandable.</p>
 <p>The basic ingredients for <code class="filename">Makefile</code>
   programming are variables and shell
   commands. Among these shell commands may even be more complex ones
-  like <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/awk.1";><span class="citerefentry"><span class="refentrytitle">awk</span>(1)</span></a> programs. To make sure that every 
shell command runs
+  like <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/awk.1";><span class="citerefentry"><span class="refentrytitle">awk</span>(1)</span></a> programs. To make sure that every 
shell command runs
   as intended it is necessary to quote all variables correctly when they
   are used.</p>
 <p>This chapter describes some patterns that appear quite often in
@@ -5564,7 +5586,7 @@ everything worked.</p>
     target of a rule, always write the data to a temporary file first
     and finally rename that file. Otherwise there might occur an error
     in the middle of generating the file, and when the user runs
-    <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/make.1";><span class="citerefentry"><span class="refentrytitle">make</span>(1)</span></a> for the second time, the file exists 
and will not be
+    <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/make.1";><span class="citerefentry"><span class="refentrytitle">make</span>(1)</span></a> for the second time, the file exists 
and will not be
     regenerated properly. Example:</p>
 <pre class="programlisting">
 wrong:
@@ -5582,11 +5604,11 @@ correct:
     <code class="filename">wrong</code> will exist, although there was an error
     message in the first run. On the other hand, running <span class="command"><strong>make
     correct</strong></span> gives an error message twice, as expected.</p>
-<p>You might remember that <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/make.1";><span class="citerefentry"><span class="refentrytitle">make</span>(1)</span></a> sometimes 
removes
+<p>You might remember that <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/make.1";><span class="citerefentry"><span class="refentrytitle">make</span>(1)</span></a> sometimes 
removes
     <code class="literal">${.TARGET}</code> in case of error, but this only
     happens when it is interrupted, for example by pressing
     <code class="literal">Ctrl+C</code>. This does <span class="emphasis"><em>not</em></span> happen
-    when one of the commands fails (like <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/false.1";><span class="citerefentry"><span 
class="refentrytitle">false</span>(1)</span></a> above).</p>
+    when one of the commands fails (like <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/false.1";><span class="citerefentry"><span 
class="refentrytitle">false</span>(1)</span></a> above).</p>
 </li></ul></div>
 </div>
 <div class="sect1">
@@ -5595,7 +5617,7 @@ correct:
 <p><code class="filename">Makefile</code> variables contain strings that
     can be processed using the five operators <code class="code">=</code>,
     <code class="code">+=</code>, <code class="code">?=</code>, <code class="code">:=</code> and
-    <code class="code">!=</code>, which are described in the <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/make.1";><span class="citerefentry"><span 
class="refentrytitle">make</span>(1)</span></a> man
+    <code class="code">!=</code>, which are described in the <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/make.1";><span class="citerefentry"><span 
class="refentrytitle">make</span>(1)</span></a> man
     page.</p>
 <p>When a variable's value is parsed from a
     <code class="filename">Makefile</code>, the hash character <code class="code">#</code> and
@@ -5613,7 +5635,7 @@ correct:
 <p>Some of the modifiers split the string into words and then
     operate on the words, others operate on the string as a whole. When a
     string is split into words, double quotes and single quotes are
-    interpreted as delimiters, just like in <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/sh.1";><span class="citerefentry"><span 
class="refentrytitle">sh</span>(1)</span></a>.</p>
+    interpreted as delimiters, just like in <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/sh.1";><span class="citerefentry"><span 
class="refentrytitle">sh</span>(1)</span></a>.</p>
 <div class="sect2">
 <div class="titlepage"><div><div><h3 class="title">
 <a name="makefile.variables.names"></a>15.2.1.�Naming conventions</h3></div></div></div>
@@ -5670,11 +5692,11 @@ are just copied.</p>
 <p>Example 2 quotes the string so that the shell interprets it
 correctly. But the echo command may additionally interpret strings with a
 leading dash or those containing backslashes.</p>
-<p>Example 3 can handle arbitrary strings, since <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/printf.1";><span class="citerefentry"><span 
class="refentrytitle">printf</span>(1)</span></a> only
+<p>Example 3 can handle arbitrary strings, since <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/printf.1";><span class="citerefentry"><span 
class="refentrytitle">printf</span>(1)</span></a> only
 interprets the format string, but not the next argument. The trailing
 single quotes handle the case when the string is empty. In that case, the
 :Q modifier would result in an empty string too, which would then be
-skipped by the shell. For <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/printf.1";><span class="citerefentry"><span class="refentrytitle">printf</span>(1)</span></a> this 
doesn't make a difference,
+skipped by the shell. For <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/printf.1";><span class="citerefentry"><span class="refentrytitle">printf</span>(1)</span></a> this 
doesn't make a difference,
 but other programs may care.</p>
 <p>In example 4, the <code class="varname">EXAMPLE_ENV</code> does not
 need to be quoted because the quoting has already been done
@@ -5718,7 +5740,7 @@ install-examples:   # produces a syntax 
         done
 </pre>
 <p>The shell only sees the text <code class="code">for egfile in ; do</code>, since
-<code class="code">${EGFILES}</code> is replaced with an empty string by <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/make.1";><span class="citerefentry"><span 
class="refentrytitle">make</span>(1)</span></a>.
+<code class="code">${EGFILES}</code> is replaced with an empty string by <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/make.1";><span class="citerefentry"><span 
class="refentrytitle">make</span>(1)</span></a>.
 To fix this syntax error, use one of the snippets below.</p>
 <pre class="programlisting">
 EMPTY=          # empty
@@ -5862,7 +5884,7 @@ options are supported by the package, an
 if needed.</p>
 <div class="orderedlist"><ol class="orderedlist" type="1">
 <li class="listitem"><p><code class="varname">PKG_OPTIONS_VAR</code> is the name of the
-<a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/make.1";><span class="citerefentry"><span class="refentrytitle">make</span>(1)</span></a> variable that the user can set to 
override the default
+<a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/make.1";><span class="citerefentry"><span class="refentrytitle">make</span>(1)</span></a> variable that the user can set to 
override the default
 options.  It should be set to
 PKG_OPTIONS.<em class="replaceable"><code>pkgbase</code></em>. Do not set it to
 PKG_OPTIONS.${PKGBASE}, since <code class="varname">PKGBASE</code> is not defined
@@ -6162,21 +6184,21 @@ BUILDLINK_API_DEPENDS.foo+=   foo&gt;=1.
        <code class="varname">BDB_DEFAULT</code>.</p></li>
 <li class="listitem"><p><code class="filename">curses.buildlink3.mk</code>: If the system
        comes with neither Curses nor NCurses, this will take care
-       to install the <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/devel/ncurses/README.html"; target="_top"><code class="filename">devel/ncurses</code></a> package.</p></li>
+       to install the <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/devel/ncurses/index.html"; target="_top"><code class="filename">devel/ncurses</code></a> package.</p></li>
 <li class="listitem"><p><code class="filename">krb5.buildlink3.mk</code> uses the value
        of <code class="varname">KRB5_ACCEPTED</code> to choose between
        adding a dependency on Heimdal or MIT-krb5 for packages that
        require a Kerberos 5 implementation.</p></li>
 <li class="listitem"><p><code class="filename">motif.buildlink3.mk</code> checks for a
        system-provided Motif installation or adds a dependency on
-       <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/x11/lesstif/README.html"; target="_top"><code class="filename">x11/lesstif</code></a> or <a 
href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/x11/motif/README.html"; target="_top"><code class="filename">x11/motif</code></a>. The user can set
+       <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/x11/lesstif/index.html"; target="_top"><code class="filename">x11/lesstif</code></a> or <a 
href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/x11/motif/index.html"; target="_top"><code class="filename">x11/motif</code></a>. The user can set
        <code class="varname">MOTIF_TYPE</code> to <span class="quote">&#8220;<span class="quote">dt</span>&#8221;</span>,
        <span class="quote">&#8220;<span class="quote">lesstif</span>&#8221;</span> or <span class="quote">&#8220;<span class="quote">motif</span>&#8221;</span>
        to choose which Motif version will be used.</p></li>
 <li class="listitem"><p><code class="filename">readline.buildlink3.mk</code> checks for a
        system-provided GNU readline or editline (libedit) installation,
-       or adds a dependency on <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/devel/readline/README.html"; target="_top"><code class="filename">devel/readline</code></a>,
-       <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/devel/editline/README.html"; target="_top"><code class="filename">devel/editline</code></a>. The user can set
+       or adds a dependency on <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/devel/readline/index.html"; target="_top"><code class="filename">devel/readline</code></a>,
+       <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/devel/editline/index.html"; target="_top"><code class="filename">devel/editline</code></a>. The user can set
        <code class="varname">READLINE_DEFAULT</code> to choose readline implementation.
        If your package really needs GNU readline library, its Makefile
        should include <code class="filename">devel/readline/buildlink3.mk</code>
@@ -6191,7 +6213,7 @@ BUILDLINK_API_DEPENDS.foo+=   foo&gt;=1.
        the file for more information.</p></li>
 <li class="listitem"><p><code class="filename">pthread.buildlink3.mk</code> uses the value of
        <code class="varname">PTHREAD_OPTS</code> and checks for native pthreads or adds
-       a dependency on <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/devel/pth/README.html"; target="_top"><code class="filename">devel/pth</code></a> as needed.</p></li>
+       a dependency on <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/devel/pth/index.html"; target="_top"><code class="filename">devel/pth</code></a> as needed.</p></li>
 <li class="listitem"><p><code class="filename">xaw.buildlink3.mk</code> uses the value of
        <code class="varname">XAW_TYPE</code> to choose a particular Athena widgets
        library.</p></li>
@@ -6212,7 +6234,7 @@ BUILDLINK_API_DEPENDS.foo+=   foo&gt;=1.
     <code class="filename">buildlink3.mk</code> files that it needs to find
     headers and libraries that it needs in turn.</p>
 <p>To generate an initial <code class="filename">buildlink3.mk</code>
-    file for further editing, Rene Hexel's <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/createbuildlink/README.html"; target="_top"><code 
class="filename">pkgtools/createbuildlink</code></a>
+    file for further editing, Rene Hexel's <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/createbuildlink/index.html"; target="_top"><code 
class="filename">pkgtools/createbuildlink</code></a>
     package is highly recommended.  For most packages, the following
     command will generate a good starting point for
     <code class="filename">buildlink3.mk</code> files:</p>
@@ -6405,7 +6427,7 @@ BUILDLINK_TREE+=        -tiff
       package will pull in the versions of the packages that use the
       new ABI and that the packages' <code class="varname">PKGREVISION</code>s
       uniquely identify the packages built against the new ABI. The
-      <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/revbump/README.html"; target="_top"><code class="filename">pkgtools/revbump</code></a> package can
+      <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/revbump/index.html"; target="_top"><code class="filename">pkgtools/revbump</code></a> package can
       help with these updates.</p>
 <p>See <a class="xref" href="#dependencies" title="21.1.5.�Handling dependencies">Section�21.1.5, &#8220;Handling dependencies&#8221;</a> for more information
       about dependencies on other packages, including the
@@ -6624,7 +6646,7 @@ PREFER_NATIVE=  getopt skey tcp_wrappers
   <span class="quote">&#8220;<span class="quote">packing list</span>&#8221;</span>, i.e. a list of files that belong to
   the package (relative to the <code class="filename">${PREFIX}</code>
   directory it's been installed in) plus some additional statements
-  - see the <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/pkg_create.1";><span class="citerefentry"><span class="refentrytitle">pkg_create</span>(1)</span></a> man page for a 
full list.
+  - see the <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/pkg_create.1";><span class="citerefentry"><span class="refentrytitle">pkg_create</span>(1)</span></a> man page for a 
full list.
   This chapter addresses some issues that need attention when
   dealing with the <code class="filename">PLIST</code> file (or files, see
   below!).</p>
@@ -6773,7 +6795,7 @@ adding the RCS ID the space should be om
 <p>To use one or more files as source for the <code class="filename">PLIST</code> used
     in generating the binary package, set the variable
     <code class="varname">PLIST_SRC</code> to the names of that file(s).
-    The files are later concatenated using <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/cat.1";><span class="citerefentry"><span 
class="refentrytitle">cat</span>(1)</span></a>, and the order of things is
+    The files are later concatenated using <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/cat.1";><span class="citerefentry"><span 
class="refentrytitle">cat</span>(1)</span></a>, and the order of things is
     important. The default for <code class="varname">PLIST_SRC</code> is
     <code class="filename">${PKGDIR}/PLIST</code>.</p>
 </div>
@@ -7022,7 +7044,7 @@ set based upon the following variables:<
     variable only makes sense in the package's
     <code class="filename">Makefile</code> (i.e., it is not user-customizable).</p>
 <p>As an example, consider the Apache package,
-    <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/www/apache24/README.html"; target="_top"><code class="filename">www/apache24</code></a>, which places its
+    <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/www/apache24/index.html"; target="_top"><code class="filename">www/apache24</code></a>, which places its
     configuration files under the
     <code class="filename">httpd/</code> subdirectory of
     <code class="varname">PKG_SYSCONFBASE</code>.  This should be set in the package
@@ -7095,7 +7117,7 @@ during the package installation to updat
 <code class="varname">CONF_FILES</code> and <code class="varname">CONF_FILES_PERMS</code> are
 used.  Check out <a class="xref" href="#files-outside-prefix" title="20.1.2.�File manipulation">Section�20.1.2, &#8220;File manipulation&#8221;</a> for information
 about their syntax and their purpose.  Here is an example, taken from the
-<a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/mail/mutt/README.html"; target="_top"><code class="filename">mail/mutt</code></a> package:</p>
+<a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/mail/mutt/index.html"; target="_top"><code class="filename">mail/mutt</code></a> package:</p>
 <pre class="programlisting">
 EGDIR=        ${PREFIX}/share/doc/mutt/samples
 CONF_FILES=   ${EGDIR}/Muttrc ${PKG_SYSCONFDIR}/Muttrc
@@ -7124,7 +7146,7 @@ to:</p>
 <div class="orderedlist"><ol class="orderedlist" type="1">
 <li class="listitem"><p>Store the script inside <code class="filename">${FILESDIR}</code>, with
     the <code class="literal">.sh</code> suffix appended.  Considering the
-    <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/print/cups/README.html"; target="_top"><code class="filename">print/cups</code></a> package as an example, it has a
+    <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/print/cups/index.html"; target="_top"><code class="filename">print/cups</code></a> package as an example, it has a
     <code class="filename">cupsd.sh</code> in its files directory.</p></li>
 <li class="listitem">
 <p>Tell pkginstall to handle it, appending the name of the script,
@@ -7208,7 +7230,7 @@ accomplish this task.</p>
 <p>When a package provides a shell interpreter, it has to set the
 <code class="varname">PKG_SHELL</code> variable to its absolute file name.  This will
 add some hooks to the installation scripts to handle it.  Consider the
-following example, taken from <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/shells/zsh/README.html"; target="_top"><code class="filename">shells/zsh</code></a>:</p>
+following example, taken from <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/shells/zsh/index.html"; target="_top"><code class="filename">shells/zsh</code></a>:</p>
 <pre class="programlisting">
 PKG_SHELL=      ${PREFIX}/bin/zsh
 </pre>
@@ -7234,7 +7256,7 @@ where <em class="replaceable"><code>type
 installation scripts to run the appropriate commands to update the fonts
 database files within each of those directories.  For convenience, if the
 directory path is relative, it is taken to be relative to the package's
-installation prefix.  Consider the following example, taken from <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/fonts/dbz-ttf/README.html"; target="_top"><code 
class="filename">fonts/dbz-ttf</code></a>:</p>
+installation prefix.  Consider the following example, taken from <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/fonts/dbz-ttf/index.html"; target="_top"><code 
class="filename">fonts/dbz-ttf</code></a>:</p>
 <pre class="programlisting">
 FONTS_DIRS.ttf= ${PREFIX}/share/fonts/X11/TTF
 </pre>
@@ -7336,7 +7358,7 @@ environment variable to <code class="lit
     variables in the file pointed to by <code class="varname">MAKECONF</code>,
     which is <a class="link" href="#mk.conf"><code class="filename">mk.conf</code></a> by default. When you
     want to use those variables in the preprocessor directives of
-    <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/make.1";><span class="citerefentry"><span class="refentrytitle">make</span>(1)</span></a> (for example <code 
class="literal">.if</code> or
+    <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/make.1";><span class="citerefentry"><span class="refentrytitle">make</span>(1)</span></a> (for example <code 
class="literal">.if</code> or
     <code class="literal">.for</code>), you need to include the file
     <code class="filename">../../mk/bsd.prefs.mk</code> before, which in turn
     loads the user preferences.</p>
@@ -7414,7 +7436,7 @@ INTERACTIVE_STAGE=      configure instal
     particular license is done by placing the license in
     <code class="filename">pkgsrc/licenses</code> and setting the
     <code class="varname">LICENSE</code> variable to a string identifying the
-    license, e.g. in <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/graphics/xv/README.html"; target="_top"><code class="filename">graphics/xv</code></a>:</p>
+    license, e.g. in <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/graphics/xv/index.html"; target="_top"><code class="filename">graphics/xv</code></a>:</p>
 <pre class="programlisting">
 LICENSE=        xv-license
 </pre>
@@ -7592,7 +7614,7 @@ ACCEPTABLE_LICENSES+=xv-license
 </pre>
 <p>Please note that the <span class="quote">&#8220;<span class="quote">pre-req-package-name</span>&#8221;</span>
     may include any of the wildcard version numbers recognized by
-    <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/pkg_info.1";><span class="citerefentry"><span class="refentrytitle">pkg_info</span>(1)</span></a>.</p>
+    <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/pkg_info.1";><span class="citerefentry"><span class="refentrytitle">pkg_info</span>(1)</span></a>.</p>
 <div class="orderedlist"><ol class="orderedlist" type="1">
 <li class="listitem">
 <p>If your package needs another package's binaries or
@@ -7634,7 +7656,7 @@ TOOL_DEPENDS+= itstool-[0-9]*:../../text
        correctly and if there's no
        <code class="filename">buildlink3.mk</code> file, this is specified
        using the <code class="varname">DEPENDS</code> variable. The
-       <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/print/lyx/README.html"; target="_top"><code class="filename">print/lyx</code></a> package needs to
+       <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/print/lyx/index.html"; target="_top"><code class="filename">print/lyx</code></a> package needs to
        be able to execute the latex binary from the tex-latex-bin package
        when it runs, and that is specified:</p>
 <pre class="programlisting">
@@ -7682,7 +7704,7 @@ BUILDLINK_API_DEPENDS.jpeg+=    jpeg&gt;
 <p>If your package needs files from another package to build,
     add the relevant distribution files to
     <code class="varname">DISTFILES</code>, so they will be extracted
-    automatically. See the <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/print/ghostscript/README.html"; target="_top"><code class="filename">print/ghostscript</code></a> package for an 
example.
+    automatically. See the <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/print/ghostscript/index.html"; target="_top"><code class="filename">print/ghostscript</code></a> package for an 
example.
     (It relies on the jpeg sources being present in source form
     during the build.)</p>
 </div>
@@ -7693,8 +7715,8 @@ BUILDLINK_API_DEPENDS.jpeg+=    jpeg&gt;
     already have installed on his system, e.g. if your package
     installs the same set of files as another package in the pkgsrc
     tree or has the same <code class="varname">PKGNAME</code>.</p>
-<p>For example, <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/x11/libXaw3d/README.html"; target="_top"><code class="filename">x11/libXaw3d</code></a>
-    and <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/x11/Xaw-Xpm/README.html"; target="_top"><code class="filename">x11/Xaw-Xpm</code></a>
+<p>For example, <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/x11/libXaw3d/index.html"; target="_top"><code class="filename">x11/libXaw3d</code></a>
+    and <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/x11/Xaw-Xpm/index.html"; target="_top"><code class="filename">x11/Xaw-Xpm</code></a>
     install the same shared library, thus you set in
     <code class="filename">pkgsrc/x11/libXaw3d/Makefile</code>:</p>
 <pre class="programlisting">
@@ -7704,7 +7726,7 @@ CONFLICTS=      Xaw-Xpm-[0-9]*
 <pre class="programlisting">
 CONFLICTS=      libXaw3d-[0-9]*
     </pre>
-<p><a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/pkg_add.1";><span class="citerefentry"><span class="refentrytitle">pkg_add</span>(1)</span></a> is able to detect attempts to 
install packages
+<p><a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/pkg_add.1";><span class="citerefentry"><span class="refentrytitle">pkg_add</span>(1)</span></a> is able to detect attempts to 
install packages
     that conflict with existing packages and abort. However, in many
     situations this is too late in the process. Binary package managers
     will not know about the conflict until they attempt to install the
@@ -7715,7 +7737,7 @@ CONFLICTS=      libXaw3d-[0-9]*
 <p>To avoid these issues <code class="varname">CONFLICTS</code> entries
     should be added in all cases where it is known that packages conflict
     with each other.  These <code class="varname">CONFLICTS</code> entries are
-    exported in <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/pkg_summary.5";><span class="citerefentry"><span class="refentrytitle">pkg_summary</span>(5)</span></a> files and 
consumed by binary package
+    exported in <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/pkg_summary.5";><span class="citerefentry"><span class="refentrytitle">pkg_summary</span>(5)</span></a> files and 
consumed by binary package
     managers to inform users that packages cannot be installed onto
     the target system.</p>
 </div>
@@ -7744,7 +7766,7 @@ CONFLICTS=      libXaw3d-[0-9]*
     (OS-version-platform) that can use glob-style
     wildcards.</p>
 <p>Some packages are tightly bound to a specific version of an
-    operating system, e.g. LKMs or <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/sysutils/lsof/README.html"; target="_top"><code class="filename">sysutils/lsof</code></a>.  Such binary 
packages are not
+    operating system, e.g. LKMs or <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/sysutils/lsof/index.html"; target="_top"><code class="filename">sysutils/lsof</code></a>.  Such binary 
packages are not
     backwards compatible with other versions of the OS, and should be
     uploaded to a version specific directory on the FTP server.  Mark
     these packages by setting <code class="varname">OSVERSION_SPECIFIC</code> to
@@ -7766,7 +7788,7 @@ CONFLICTS=      libXaw3d-[0-9]*
     be set in the package Makefile. This will be carried into any
     binary package that is made from this pkgsrc entry. A
     <span class="quote">&#8220;<span class="quote">preserved</span>&#8221;</span> package will
-    not be deleted using <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/pkg_delete.1";><span class="citerefentry"><span class="refentrytitle">pkg_delete</span>(1)</span></a> 
unless the
+    not be deleted using <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/pkg_delete.1";><span class="citerefentry"><span class="refentrytitle">pkg_delete</span>(1)</span></a> 
unless the
     <span class="quote">&#8220;<span class="quote">-f</span>&#8221;</span> option is used.</p>
 </div>
 <div class="sect2">
@@ -7955,7 +7977,7 @@ often a better choice.</p>
 <p>The substitutions are applied after the patches from the
 <code class="filename">patches/</code> directory. This makes it possible to run
 <span class="command"><strong>bmake patch</strong></span> on the package, after which the patches
-can be edited using the tools pkgvi and mkpatches from the <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/pkgdiff/README.html"; target="_top"><code 
class="filename">pkgtools/pkgdiff</code></a> package.</p>
+can be edited using the tools pkgvi and mkpatches from the <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/pkgdiff/index.html"; target="_top"><code 
class="filename">pkgtools/pkgdiff</code></a> package.</p>
 <p>When updating the patches, it is helpful to explicitly separate the
 <span class="command"><strong>bmake patch</strong></span> from the <span class="command"><strong>bmake
 configure</strong></span>, and to only edit the patches between these commands.
@@ -8049,7 +8071,7 @@ command to generate the list of filename
 <div class="titlepage"><div><div><h4 class="title">
 <a name="fixes.subst.what"></a>21.1.11.3.�Choosing what to substitute</h4></div></div></div>
 <p>In most cases, the substitutions are given using one or more
-<a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/sed.1";><span class="citerefentry"><span class="refentrytitle">sed</span>(1)</span></a> commands, like this:</p>
+<a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/sed.1";><span class="citerefentry"><span class="refentrytitle">sed</span>(1)</span></a> commands, like this:</p>
 <pre class="programlisting">
 SUBST_SED.path=         -e 's|/usr/local|${PREFIX}|g'
 </pre>
@@ -8106,7 +8128,7 @@ message.</p>
     fetch</strong></span> will call <code class="filename">files/getsite.sh</code>
     with the name of each file to download as an argument, expecting
     it to output the URL of the directory from which to download
-    it. <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/graphics/ns-cult3d/README.html"; target="_top"><code class="filename">graphics/ns-cult3d</code></a> is an
+    it. <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/graphics/ns-cult3d/index.html"; target="_top"><code class="filename">graphics/ns-cult3d</code></a> is an
     example of this usage.</p>
 <p>If the download can't be automated, because the user must
     submit personal information to apply for a password, or must pay
@@ -8249,7 +8271,7 @@ EXTRACT_SUFX=   .zip
     compiler, linker, etc. to get the Right Thing, which can be
     pretty annoying especially if you don't have all the machines
     at your hand to test things.  The
-    <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/devel/libtool/README.html"; target="_top"><code class="filename">devel/libtool</code></a> pkg
+    <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/devel/libtool/index.html"; target="_top"><code class="filename">devel/libtool</code></a> pkg
     can help here, as it just <span class="quote">&#8220;<span class="quote">knows</span>&#8221;</span> how to build
     both static and dynamic libraries from a set of source files,
     thus being platform-independent.</p>
@@ -8321,7 +8343,7 @@ dynamic linker chooses the library with 
 </li>
 <li class="listitem">
 <p>When linking shared object (<code class="filename">.so</code>)
-       files, i.e. files that are loaded via <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/dlopen.3";><span class="citerefentry"><span 
class="refentrytitle">dlopen</span>(3)</span></a>, NOT
+       files, i.e. files that are loaded via <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/dlopen.3";><span class="citerefentry"><span 
class="refentrytitle">dlopen</span>(3)</span></a>, NOT
        shared libraries, use <span class="quote">&#8220;<span class="quote">-module
        -avoid-version</span>&#8221;</span> to prevent them getting version
        tacked on.</p>
@@ -8331,7 +8353,7 @@ dynamic linker chooses the library with 
 <li class="listitem">
 <p>When linking programs that depend on these libraries
        <span class="emphasis"><em>before</em></span> they are installed, preface
-       the <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/cc.1";><span class="citerefentry"><span class="refentrytitle">cc</span>(1)</span></a> or <a class="citerefentry" 
href="https://man.NetBSD.org/NetBSD-9.1/i386/ld.1";><span class="citerefentry"><span class="refentrytitle">ld</span>(1)</span></a> line with <span class="quote">&#8220;<span class="quote">${LIBTOOL}
+       the <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/cc.1";><span class="citerefentry"><span class="refentrytitle">cc</span>(1)</span></a> or <a class="citerefentry" 
href="https://man.NetBSD.org/NetBSD-9.2/i386/ld.1";><span class="citerefentry"><span class="refentrytitle">ld</span>(1)</span></a> line with <span class="quote">&#8220;<span class="quote">${LIBTOOL}
        --mode=link</span>&#8221;</span>, and it will find the correct
        libraries (static or shared), but please be aware that
        libtool will not allow you to specify a relative path in
@@ -8348,8 +8370,8 @@ ${LIBTOOL} --mode=link ${CC} -o <em clas
 <p>and it will do the right thing with the libraries.</p>
 </li>
 <li class="listitem">
-<p>When installing libraries, preface the <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/install.1";><span class="citerefentry"><span 
class="refentrytitle">install</span>(1)</span></a>
-       or <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/cp.1";><span class="citerefentry"><span class="refentrytitle">cp</span>(1)</span></a> command with <span 
class="quote">&#8220;<span class="quote">${LIBTOOL}
+<p>When installing libraries, preface the <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/install.1";><span class="citerefentry"><span 
class="refentrytitle">install</span>(1)</span></a>
+       or <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/cp.1";><span class="citerefentry"><span class="refentrytitle">cp</span>(1)</span></a> command with <span 
class="quote">&#8220;<span class="quote">${LIBTOOL}
        --mode=install</span>&#8221;</span>, and change the library name to
        <code class="filename">.la</code>. e.g.</p>
 <pre class="programlisting">
@@ -8357,7 +8379,7 @@ ${LIBTOOL} --mode=install ${BSD_INSTALL_
 </pre>
 <p>This will install the static <code class="filename">.a</code>,
        shared library, any needed symlinks, and run
-       <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/ldconfig.8";><span class="citerefentry"><span class="refentrytitle">ldconfig</span>(8)</span></a>.</p>
+       <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/ldconfig.8";><span class="citerefentry"><span class="refentrytitle">ldconfig</span>(8)</span></a>.</p>
 </li>
 <li class="listitem"><p>In your <code class="filename">PLIST</code>, include only
        the <code class="filename">.la</code>
@@ -8925,7 +8947,7 @@ ${INSTALL_DATA_DIR} ${PREFIX}/dir2
     <code class="filename">${PREFIX}/share/doc/html</code> or other
     places.</p>
 <p>An exception to the above is that library API documentation
-    generated with the <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/textproc/gtk-doc/README.html"; target="_top"><code class="filename">textproc/gtk-doc</code></a> tools, for use by 
special
+    generated with the <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/textproc/gtk-doc/index.html"; target="_top"><code class="filename">textproc/gtk-doc</code></a> tools, for use by 
special
     browsers (devhelp) should be left at their default location, which
     is <code class="filename">${PREFIX}/share/gtk-doc</code>.  Such
     documentation can be recognized from files ending in
@@ -9104,7 +9126,7 @@ PERL5_PACKLIST= auto/Pg/.packlist
     default, a minimum version of 3.12 is required. If the system
     does not provide a <span class="command"><strong>makeinfo</strong></span> command or if it
     does not match the required minimum, a build dependency on the
-    <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/devel/gtexinfo/README.html"; target="_top"><code class="filename">devel/gtexinfo</code></a> package will
+    <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/devel/gtexinfo/index.html"; target="_top"><code class="filename">devel/gtexinfo</code></a> package will
     be added automatically.</p>
 <p>The build and installation process of the software provided
     by the package should not use the
@@ -9303,7 +9325,7 @@ PERL5_PACKLIST= auto/Pg/.packlist
     executables for running binaries from a one operating system
     on a different one (if the latter supports it).  One example
     is running Linux binaries on NetBSD.</p>
-<p>The <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/rpm2pkg/README.html"; target="_top"><code class="filename">pkgtools/rpm2pkg</code></a>
+<p>The <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/rpm2pkg/index.html"; target="_top"><code class="filename">pkgtools/rpm2pkg</code></a>
     helps in extracting and packaging Linux rpm packages.</p>
 <p>The <code class="varname">CHECK_SHLIBS</code> can be set to no to
     avoid the <span class="command"><strong>check-shlibs</strong></span> target, which tests
@@ -9414,14 +9436,14 @@ important information regarding their in
 <a name="meta-packages"></a>22.1.�Meta packages</h2></div></div></div>
 <p>pkgsrc includes three GNOME-related meta packages:</p>
 <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
-<li class="listitem"><p><a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/meta-pkgs/gnome-base/README.html"; target="_top"><code class="filename">meta-pkgs/gnome-base</code></a>: Provides
+<li class="listitem"><p><a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/meta-pkgs/gnome-base/index.html"; target="_top"><code class="filename">meta-pkgs/gnome-base</code></a>: Provides
     the core GNOME desktop environment.  It only includes the necessary
     bits to get it to boot correctly, although it may lack important
     functionality for daily operation.  The idea behind this package is
     to let end users build their own configurations on top of this one,
     first installing this meta package to achieve a functional setup and
     then adding individual applications.</p></li>
-<li class="listitem"><p><a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/meta-pkgs/gnome/README.html"; target="_top"><code class="filename">meta-pkgs/gnome</code></a>: Provides a
+<li class="listitem"><p><a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/meta-pkgs/gnome/index.html"; target="_top"><code class="filename">meta-pkgs/gnome</code></a>: Provides a
     complete installation of the GNOME platform and desktop as defined
     by the GNOME project; this is based on the components distributed in
     the <code class="filename">platform/x.y/x.y.z/sources</code> and
@@ -9431,8 +9453,8 @@ important information regarding their in
     component to work properly.  Similarly, packages from the bindings
     set (<code class="filename">bindings/x.y/x.y.z/sources</code>) are not pulled
     in unless required as a dependency for an end-user component.  This
-    package "extends" <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/meta-pkgs/gnome-base/README.html"; target="_top"><code class="filename">meta-pkgs/gnome-base</code></a>.</p></li>
-<li class="listitem"><p><a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/meta-pkgs/gnome-devel/README.html"; target="_top"><code class="filename">meta-pkgs/gnome-devel</code></a>:
+    package "extends" <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/meta-pkgs/gnome-base/index.html"; target="_top"><code class="filename">meta-pkgs/gnome-base</code></a>.</p></li>
+<li class="listitem"><p><a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/meta-pkgs/gnome-devel/index.html"; target="_top"><code class="filename">meta-pkgs/gnome-devel</code></a>:
     Installs all the tools required to build a GNOME component when
     fetched from the CVS repository.  These are required to let the
     <span class="command"><strong>autogen.sh</strong></span> scripts work appropriately.</p></li>
@@ -9467,7 +9489,7 @@ USE_TOOLS+=gmake
 <pre class="programlisting">
 USE_TOOLS+=pkg-config
 </pre>
-<p>Also use <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/verifypc/README.html"; target="_top"><code class="filename">pkgtools/verifypc</code></a> at
+<p>Also use <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/verifypc/index.html"; target="_top"><code class="filename">pkgtools/verifypc</code></a> at
     the end of the build process to ensure that you did not miss to
     specify any dependency in your package and that the version
     requirements are all correct.</p>
@@ -9612,7 +9634,7 @@ followed:</p>
 <p>Packages not listed in the <code class="filename">list.txt</code> file
     should be updated to the latest version available (if found in
     pkgsrc).  This is the case, for example, of the dependencies on the
-    GNU Autotools in the <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/meta-pkgs/gnome-devel/README.html"; target="_top"><code class="filename">meta-pkgs/gnome-devel</code></a> meta 
package.</p>
+    GNU Autotools in the <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/meta-pkgs/gnome-devel/index.html"; target="_top"><code class="filename">meta-pkgs/gnome-devel</code></a> meta 
package.</p>
 </li>
 <li class="listitem">
 <p>Generate a patch from the modified meta packages and extract the
@@ -9694,15 +9716,15 @@ builds)</i></a>.</p>
 <a name="submitting-your-package"></a>23.2.�Submitting source packages (for non-NetBSD-developers)</h2></div></div></div>
 <p>First, check that your package is complete, compiles and
        runs well; see <a class="xref" href="#creating" title="Chapter�14.�Creating a new pkgsrc package from scratch">Chapter�14, <i>Creating a new pkgsrc package from scratch</i></a> and the rest 
of this
-       document. Next, generate an uuencoded gzipped <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/tar.1";><span class="citerefentry"><span 
class="refentrytitle">tar</span>(1)</span></a>
+       document. Next, generate an uuencoded gzipped <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/tar.1";><span class="citerefentry"><span 
class="refentrytitle">tar</span>(1)</span></a>
        archive that contains all files that make up the package.
        Finally, send this package to the pkgsrc bug tracking system,
-       either with the <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/send-pr.1";><span class="citerefentry"><span class="refentrytitle">send-pr</span>(1)</span></a> command, or 
if you don't have
+       either with the <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/send-pr.1";><span class="citerefentry"><span class="refentrytitle">send-pr</span>(1)</span></a> command, or 
if you don't have
        that, go to the web page
        <a class="ulink" href="https://www.NetBSD.org/support/send-pr.html"; target="_top">https://www.NetBSD.org/support/send-pr.html</a>,
        which contains some instructions and a link to a form where you
        can submit packages.  The
-       <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/sysutils/gtk-send-pr/README.html"; target="_top"><code class="filename">sysutils/gtk-send-pr</code></a> package is
+       <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/sysutils/gtk-send-pr/index.html"; target="_top"><code class="filename">sysutils/gtk-send-pr</code></a> package is
        also available as a substitute for either of the above two tools.
        </p>
 <p>In the form of the problem report, the category should be
@@ -9900,7 +9922,7 @@ instead of <span class="quote">&#8220;<s
 <code class="varname">PREV_PKGPATH</code> to the previous category/package
 pathname.  The <code class="varname">PREV_PKGPATH</code> can be used by tools
 for doing an update using pkgsrc building; for example, it can
-search the <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/pkg_summary.5";><span class="citerefentry"><span class="refentrytitle">pkg_summary</span>(5)</span></a> database for 
<code class="varname">PREV_PKGPATH</code>
+search the <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/pkg_summary.5";><span class="citerefentry"><span class="refentrytitle">pkg_summary</span>(5)</span></a> database for 
<code class="varname">PREV_PKGPATH</code>
 (if no <code class="varname">SUPERSEDES</code>) and then use the corresponding
 new <code class="varname">PKGPATH</code> for that moved package.  Note that
 it may have multiple matches, so the tool should also check on the
@@ -9990,7 +10012,7 @@ What shall I do?</a>
 <tr class="answer">
 <td align="left" valign="top"></td>
 <td align="left" valign="top"><p><code class="varname">MAKEFLAGS</code> are the flags passed
-       to the pkgsrc-internal invocations of <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/make.1";><span class="citerefentry"><span 
class="refentrytitle">make</span>(1)</span></a>, while
+       to the pkgsrc-internal invocations of <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/make.1";><span class="citerefentry"><span 
class="refentrytitle">make</span>(1)</span></a>, while
        <code class="varname">MAKE_FLAGS</code> are the flags that are passed to
        the <code class="varname">MAKE_PROGRAM</code> when building the
        package. [FIXME: What is .MAKEFLAGS for?]</p></td>
@@ -10006,7 +10028,7 @@ What shall I do?</a>
 <tr class="answer">
 <td align="left" valign="top"></td>
 <td align="left" valign="top"><p><code class="varname">MAKE</code> is the path to the
-       <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/make.1";><span class="citerefentry"><span class="refentrytitle">make</span>(1)</span></a> program that is used in the pkgsrc
+       <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/make.1";><span class="citerefentry"><span class="refentrytitle">make</span>(1)</span></a> program that is used in the pkgsrc
        infrastructure. <code class="varname">GMAKE</code> is the path to GNU
        Make, but you need to say <code class="varname">USE_TOOLS+=gmake</code> to
        use that. <code class="varname">MAKE_PROGRAM</code> is the path to the
@@ -10075,7 +10097,7 @@ What shall I do?</a>
        assignment operator, although it looks like it.
        Instead, it is a degenerate form of
        <code class="code">${LIST:<em class="replaceable"><code>old_string</code></em>=<em class="replaceable"><code>new_string</code></em>}</code>,
-       which is documented in the <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/make.1";><span class="citerefentry"><span class="refentrytitle">make</span>(1)</span></a> man 
page and which is
+       which is documented in the <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/make.1";><span class="citerefentry"><span class="refentrytitle">make</span>(1)</span></a> man 
page and which is
        commonly used in the form <code class="code">${SRCS:.c=.o}</code>. In the
        case of <code class="varname">MASTER_SITE_*</code>,
        <em class="replaceable"><code>old_string</code></em> is the empty string and
@@ -10104,7 +10126,7 @@ What shall I do?</a>
        etc.</p></dd>
 <dt><span class="term"><a class="ulink" href="https://www.NetBSD.org/mailinglists/index.html#pkgsrc-bugs"; target="_top">pkgsrc-bugs</a></span></dt>
 <dd><p>All bug reports in category "pkg" sent with
-       <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/send-pr.1";><span class="citerefentry"><span class="refentrytitle">send-pr</span>(1)</span></a> appear here. Please do not 
report your bugs here
+       <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/send-pr.1";><span class="citerefentry"><span class="refentrytitle">send-pr</span>(1)</span></a> appear here. Please do not 
report your bugs here
        directly; use one of the other mailing
        lists.</p></dd>
 </dl></div></td>
@@ -10171,7 +10193,7 @@ What shall I do?</p></td>
 anyway.</p>
 <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
 <li class="listitem"><p>Run <span class="command"><strong>pkg_chk -N</strong></span> (from the
-    <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/pkg_chk/README.html"; target="_top"><code class="filename">pkgtools/pkg_chk</code></a> package).  It
+    <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/pkg_chk/index.html"; target="_top"><code class="filename">pkgtools/pkg_chk</code></a> package).  It
     will tell you about newer versions of installed packages that are
     available, but not yet updated in pkgsrc.</p></li>
 <li class="listitem"><p>Browse <code class="filename">pkgsrc/doc/TODO</code>
@@ -10534,7 +10556,7 @@ CFLAGS+=                -Wall
 <div class="sect1">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
 <a name="regression.run"></a>26.1.�Running the regression tests</h2></div></div></div>
-<p>You first need to install the <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/pkg_regress/README.html"; target="_top"><code class="filename">pkgtools/pkg_regress</code></a> 
package, which
+<p>You first need to install the <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/pkg_regress/index.html"; target="_top"><code class="filename">pkgtools/pkg_regress</code></a> 
package, which
        provides the <span class="command"><strong>pkg_regress</strong></span> command. Then you
        can simply run that command, which will run all tests in the
        <code class="filename">regress/</code> directory.</p>
@@ -10669,7 +10691,7 @@ output_require "^[[:alpha:]+[[:space:]][
        platform and add them.</p></dd>
 </dl></div>
 <p>Now, you should be able to build some basic packages, like
-       <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/lang/perl5/README.html"; target="_top"><code class="filename">lang/perl5</code></a>, <a 
href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/shells/bash/README.html"; target="_top"><code class="filename">shells/bash</code></a>.</p>
+       <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/lang/perl5/index.html"; target="_top"><code class="filename">lang/perl5</code></a>, <a 
href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/shells/bash/index.html"; target="_top"><code class="filename">shells/bash</code></a>.</p>
 </div>
 </div>
 </div>
@@ -10723,7 +10745,7 @@ INFO_FILES=     yes
 <a name="example-descr"></a>A.1.2.�DESCR</h3></div></div></div>
 <pre class="programlisting">
 GNU version of yacc.  Can make re-entrant parsers, and numerous other
-improvements.  Why you would want this when Berkeley <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.1/i386/yacc.1";><span class="citerefentry"><span 
class="refentrytitle">yacc</span>(1)</span></a> is part
+improvements.  Why you would want this when Berkeley <a class="citerefentry" href="https://man.NetBSD.org/NetBSD-9.2/i386/yacc.1";><span class="citerefentry"><span 
class="refentrytitle">yacc</span>(1)</span></a> is part
 of the NetBSD source tree is beyond me.
 </pre>
 </div>
@@ -10742,7 +10764,7 @@ share/bison.hairy
 <div class="titlepage"><div><div><h3 class="title">
 <a name="checking-package-with-pkglint"></a>A.1.4.�Checking a package with pkglint</h3></div></div></div>
 <p>The NetBSD package system comes with
-        <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/pkglint/README.html"; target="_top"><code class="filename">pkgtools/pkglint</code></a>
+        <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/pkglint/index.html"; target="_top"><code class="filename">pkgtools/pkglint</code></a>
        which helps to check the contents of these
        files. After installation it is quite easy to use, just change to the
        directory of the package you wish to examine and run
@@ -10872,213 +10894,755 @@ Creating gzip'd tar ball in '/u/pkgsrc/l
 </div>
 <div class="appendix">
 <div class="titlepage"><div><div><h1 class="title">
-<a name="logs"></a>Appendix�B.�Build logs</h1></div></div></div>
+<a name="hardening"></a>Appendix�B.�Security hardening</h1></div></div></div>
 <div class="toc">
 <p><b>Table of Contents</b></p>
 <dl class="toc">
-<dt><span class="sect1"><a href="#logs.building">B.1. Building figlet</a></span></dt>
-<dt><span class="sect1"><a href="#logs.package">B.2. Packaging figlet</a></span></dt>
+<dt><span class="sect1"><a href="#hardening.mechanisms">B.1. Mechanisms</a></span></dt>
+<dd><dl>
+<dt><span class="sect2"><a href="#hardening.mechanisms.enabled">B.1.1. Enabled by default</a></span></dt>
+<dt><span class="sect2"><a href="#hardening.mechanisms.disabled">B.1.2. Not enabled by default</a></span></dt>
+</dl></dd>
+<dt><span class="sect1"><a href="#hardening.caveats">B.2. Caveats</a></span></dt>
+<dd><dl>
+<dt><span class="sect2"><a href="#hardening.caveats.pie">B.2.1. Problems with PKGSRC_MKPIE</a></span></dt>
+<dt><span class="sect2"><a href="#hardening.caveats.fortify">B.2.2. Problems with PKGSRC_USE_FORTIFY</a></span></dt>
+<dt><span class="sect2"><a href="#hardening.caveats.relro">B.2.3. Problems with PKGSRC_USE_RELRO</a></span></dt>
+<dt><span class="sect2"><a href="#hardening.caveats.ssp">B.2.4. Problems with PKGSRC_USE_SSP</a></span></dt>
+</dl></dd>
+<dt><span class="sect1"><a href="#hardening.audit">B.3. Auditing the system</a></span></dt>
+<dd><dl>
+<dt><span class="sect2"><a href="#hardening.audit.pie">B.3.1. Checking for PIE</a></span></dt>
+<dt><span class="sect2"><a href="#hardening.audit.relropartial">B.3.2. Checking for partial RELRO</a></span></dt>
+<dt><span class="sect2"><a href="#hardening.audit.relrofull">B.3.3. Checking for full RELRO</a></span></dt>
+<dt><span class="sect2"><a href="#hardening.audit.ssp">B.3.4. Checking for SSP</a></span></dt>
+</dl></dd>
 </dl>
 </div>
+<p>
+A number of mechanisms are available in pkgsrc to improve the security of the
+resulting system. This page describes the mechanisms, and gives hints
+about detecting and fixing problems.
+</p>
+<p>
+Mechanisms can be enabled individually in
+<code class="filename">mk.conf</code>, and are
+individually described below.
+</p>
+<p>
+Typically, a feature will cause some programs to fail to build or work
+when first enabled. This can be due to latent problems in the
+program, and can be due to other reasons. After enough testing to
+have confidence that user problems will be quite rare, individual
+mechanisms will be enabled by default.
+</p>
+<p>
+For each mechanism, see the Caveats section below for an explanation
+of what might go wrong at compile time and at run time, and how to
+notice and address these problems.
+</p>
 <div class="sect1">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="logs.building"></a>B.1.�Building figlet</h2></div></div></div>
-<pre class="screen"><code class="prompt">#</code> <strong class="userinput"><code>make</code></strong>
-===&gt; Checking for vulnerabilities in figlet-2.2.1nb2
-=&gt; figlet221.tar.gz doesn't seem to exist on this system.
-=&gt; Attempting to fetch figlet221.tar.gz from ftp://ftp.figlet.org/pub/figlet/program/unix/.
-=&gt; [172219 bytes]
-Connected to ftp.plig.net.
-220 ftp.plig.org NcFTPd Server (licensed copy) ready.
-331 Guest login ok, send your complete e-mail address as password.
-230-You are user #5 of 500 simultaneous users allowed.
-230-
-230-  ___ _             _ _
-230- |  _| |_ ___   ___| |_|___   ___ ___ ___
-230- |  _|  _| . |_| . | | | . |_| . |  _| . |
-230- |_| |_| |  _|_|  _|_|_|_  |_|___|_| |_  |
-230-         |_|   |_|     |___|         |___|
-230-
-230-** Welcome to ftp.plig.org **
-230-
-230-Please note that all transfers from this FTP site are logged. If you
-230-do not like this, please disconnect now.
-230-
-230-This archive is available via
-230-
-230-HTTP:  http://ftp.plig.org/
-230-FTP:   ftp://ftp.plig.org/     (max 500 connections)
-230-RSYNC: rsync://ftp.plig.org/   (max  30 connections)
-230-
-230-Please email comments, bug reports and requests for packages to be
-230-mirrored to ftp-admin%plig.org@localhost.
-230-
-230-
-230 Logged in anonymously.
-Remote system type is UNIX.
-Using binary mode to transfer files.
-200 Type okay.
-250 "/pub" is new cwd.
-250-"/pub/figlet" is new cwd.
-250-
-250-Welcome to the figlet archive at ftp.figlet.org
-250-
-250-   ftp://ftp.figlet.org/pub/figlet/
-250-
-250-The official FIGlet web page is:
-250-   http://www.figlet.org/
-250-
-250-If you have questions, please mailto:info%figlet.org@localhost. If you want to
-250-contribute a font or something else, you can email us.
-250
-250 "/pub/figlet/program" is new cwd.
-250 "/pub/figlet/program/unix" is new cwd.
-local: figlet221.tar.gz remote: figlet221.tar.gz
-502 Unimplemented command.
-227 Entering Passive Mode (195,40,6,41,246,104)
-150 Data connection accepted from 84.128.86.72:65131; transfer starting for figlet221.tar.gz (172219 bytes).
-38% |**************                       | 65800      64.16 KB/s    00:01 ETA
-226 Transfer completed.
-172219 bytes received in 00:02 (75.99 KB/s)
-221 Goodbye.
-=&gt; Checksum OK for figlet221.tar.gz.
-===&gt; Extracting for figlet-2.2.1nb2
-===&gt; Required installed package ccache-[0-9]*: ccache-2.3nb1 found
-===&gt; Patching for figlet-2.2.1nb2
-===&gt; Applying pkgsrc patches for figlet-2.2.1nb2
-===&gt; Overriding tools for figlet-2.2.1nb2
-===&gt; Creating toolchain wrappers for figlet-2.2.1nb2
-===&gt; Configuring for figlet-2.2.1nb2
-===&gt; Building for figlet-2.2.1nb2
-gcc -O2 -DDEFAULTFONTDIR=\"/usr/pkg/share/figlet\"  -DDEFAULTFONTFILE=\"standard.flf\"  figlet.c zipio.c crc.c inflate.c -o figlet
-chmod a+x figlet
-gcc -O2 -o chkfont chkfont.c
-=&gt; Unwrapping files-to-be-installed.
-<code class="prompt">#</code>
-<code class="prompt">#</code> <strong class="userinput"><code>make install</code></strong>
-===&gt; Checking for vulnerabilities in figlet-2.2.1nb2
-===&gt; Installing for figlet-2.2.1nb2
-install -d -o root -g wheel -m 755 /usr/pkg/bin
-install -d -o root -g wheel -m 755 /usr/pkg/man/man6
-mkdir -p /usr/pkg/share/figlet
-cp figlet /usr/pkg/bin
-cp chkfont /usr/pkg/bin
-chmod 555 figlist showfigfonts
-cp figlist /usr/pkg/bin
-cp showfigfonts /usr/pkg/bin
-cp fonts/*.flf /usr/pkg/share/figlet
-cp fonts/*.flc /usr/pkg/share/figlet
-cp figlet.6 /usr/pkg/man/man6
-===&gt; Registering installation for figlet-2.2.1nb2
-<code class="prompt">#</code></pre>
+<a name="hardening.mechanisms"></a>B.1.�Mechanisms</h2></div></div></div>
+<div class="sect2">
+<div class="titlepage"><div><div><h3 class="title">
+<a name="hardening.mechanisms.enabled"></a>B.1.1.�Enabled by default</h3></div></div></div>
+<div class="sect3">
+<div class="titlepage"><div><div><h4 class="title">
+<a name="hardening.mechanisms.enabled.fortify"></a>B.1.1.1.�PKGSRC_USE_FORTIFY</h4></div></div></div>
+<p>
+This allows substitute wrappers to be used for some commonly used
+library functions that do not have built-in bounds checking - but
+could in some cases.
+</p>
+<p>
+Two mitigation levels are available:
+</p>
+<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
+<li class="listitem"><p>"weak" only enables checks at compile-time.</p></li>
+<li class="listitem"><p>"strong" enables checks at compile-time and runtime.</p></li>
+</ul></div>
+<p>
+"strong" has been enabled by default since pkgsrc-2017Q3.
+</p>
 </div>
-<div class="sect1">
-<div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="logs.package"></a>B.2.�Packaging figlet</h2></div></div></div>
-<pre class="screen"><code class="prompt">#</code> <strong class="userinput"><code>make package</code></strong>
-===&gt; Checking for vulnerabilities in figlet-2.2.1nb2
-===&gt; Packaging figlet-2.2.1nb2
-===&gt; Building binary package for figlet-2.2.1nb2
-Creating package /home/cvs/pkgsrc/packages/i386/All/figlet-2.2.1nb2.tgz
-Using SrcDir value of /usr/pkg
-Registering depends:.
-<code class="prompt">#</code></pre>
+<div class="sect3">
+<div class="titlepage"><div><div><h4 class="title">
+<a name="hardening.mechanisms.enabled.ssp"></a>B.1.1.2.�PKGSRC_USE_SSP</h4></div></div></div>
+<p>
+This enables a stack-smashing protection mitigation. It is done by adding a
+guard variable to functions with vulnerable objects. The guards are initialized
+when a function is entered and then checked when the function exits. The guard
+check will fail and the program forcibly exited if the variable was modified in
+the meantime. This can happen in case of buffer overflows or memory corruption,
+and therefore exposing these bugs.
+</p>
+<p>
+Different mitigation levels are available:
+</p>
+<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
+<li class="listitem"><p>"yes", which will only protect functions considered vulnerable
+by the compiler;</p></li>
+<li class="listitem"><p>"all", which will protect every function;</p></li>
+<li class="listitem"><p>"strong", the default, which will apply a better balance between the
+two settings above.</p></li>
+</ul></div>
+<p>
+This mitigation is supported by both GCC and clang. It may be supported in
+additional compilers, possibly under a different name. It is particularly useful
+for unsafe programming languages, such as C/C++.
+</p>
+<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
+<li class="listitem"><p>"yes" is enabled by default where known supported since pkgsrc-2017Q3.</p></li>
+<li class="listitem"><p>"strong" is enabled by default where known supported since pkgsrc-2021Q4.</p></li>
+</ul></div>
+<p>More details can be found here:</p>
+<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem"><p>
+<a class="ulink" href="https://en.wikipedia.org/wiki/Buffer_overflow_protection"; target="_top">Buffer overflow protection on Wikipedia</a>
+</p></li></ul></div>
 </div>
+<div class="sect3">
+<div class="titlepage"><div><div><h4 class="title">
+<a name="hardening.mechanisms.enabled.pie"></a>B.1.1.3.�PKGSRC_MKPIE</h4></div></div></div>
+<p>
+This requests the creation of PIE (Position Independent Executables) for all
+executables. The PIE mechanism is normally used for shared libraries, so that
+they can be loaded at differing addresses at runtime. PIE itself does not have
+useful security properties; however, it is necessary to fully leverage some,
+such as ASLR.  Some operating systems support Address Space Layout Randomization
+(ASLR), which causes different addresses to be used each time a program is run.
+This makes it more difficult for an attacker to guess addresses and thus makes
+exploits harder to construct. With PIE, ASLR can really be applied to the entire
+program, instead of the stack and heap only.
+</p>
+<p>
+PIE executables will only be built for toolchains that are known to support PIE.
+Currently, this means NetBSD on x86, ARM, SPARC64, m68k, and MIPS.
+</p>
+<p>
+<code class="varname">PKGSRC_MKPIE</code> was enabled by default after the pkgsrc-2021Q3 branch.
+</p>
 </div>
-<div class="appendix">
-<div class="titlepage"><div><div><h1 class="title">
-<a name="ftp-layout"></a>Appendix�C.�Directory layout of the pkgsrc FTP server</h1></div></div></div>
-<div class="toc">
-<p><b>Table of Contents</b></p>
-<dl class="toc">
-<dt><span class="sect1"><a href="#ftp-distfiles">C.1. <code class="filename">distfiles</code>: The distributed source files</a></span></dt>
-<dt><span class="sect1"><a href="#ftp-misc">C.2. <code class="filename">misc</code>: Miscellaneous things</a></span></dt>
-<dt><span class="sect1"><a href="#ftp-packages">C.3. <code class="filename">packages</code>: Binary packages</a></span></dt>
-<dt><span class="sect1"><a href="#ftp-reports">C.4. <code class="filename">reports</code>: Bulk build reports</a></span></dt>
-<dt><span class="sect1"><a href="#ftp-source">C.5. <code class="filename">current</code>,
-<code class="filename">stable</code>,
-<code class="filename">pkgsrc-20<em class="replaceable"><code>xx</code></em>Q<em class="replaceable"><code>y</code></em></code>:
-source packages</a></span></dt>
-</dl>
+<div class="sect3">
+<div class="titlepage"><div><div><h4 class="title">
+<a name="hardening.mechanisms.enabled.relro"></a>B.1.1.4.�PKGSRC_USE_RELRO</h4></div></div></div>
+<p>
+This also makes the exploitation of some security vulnerabilities more
+difficult in some cases.
+</p>
+<p>Two different mitigation levels are available:</p>
+<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
+<li class="listitem"><p>
+partial: the ELF sections are reordered so that internal data sections
+precede the program's own data sections, and non-PLT GOT is read-only;
+</p></li>
+<li class="listitem"><p>
+full: in addition to partial RELRO, every relocation is performed immediately
+when starting the program (with a slight performance impact), allowing the
+entire GOT to be read-only.
+</p></li>
+</ul></div>
+<p>
+This is currently supported by GCC. Many software distributions now enable this
+feature by default, at the "partial" level.
+</p>
+<p>
+More details can be found here:
+</p>
+<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem"><p>
+<a class="ulink" href="https://www.redhat.com/en/blog/hardening-elf-binaries-using-relocation-read-only-relro"; target="_top">Hardening ELF binaries using Relocation Read-Only (RELRO)</a>
+</p></li></ul></div>
 </div>
-<p>As in other big projects, the directory layout of pkgsrc
-       is quite complex for newbies. This chapter explains where you
-       find things on the FTP server. The base directory on
-       <code class="filename">ftp.NetBSD.org</code> is <a class="ulink" href="ftp://ftp.NetBSD.org/pub/pkgsrc/"; target="_top"><code class="filename">/pub/pkgsrc/</code></a>.
-       On other servers it may be different, but inside this directory,
-       everything should look the same, no matter on which server you
-       are. This directory contains some subdirectories, which are
-       explained below.</p>
-<div class="sect1">
-<div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="ftp-distfiles"></a>C.1.�<code class="filename">distfiles</code>: The distributed source files</h2></div></div></div>
-<p>The directory <code class="filename">distfiles</code> contains lots
-       of archive files from all pkgsrc packages, which are mirrored
-       here. The subdirectories are called after their package names
-       and are used when the distributed files have names that don't
-       explicitly contain a version number or are otherwise too generic
-       (for example <code class="filename">release.tar.gz</code>).</p>
 </div>
-<div class="sect1">
-<div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="ftp-misc"></a>C.2.�<code class="filename">misc</code>: Miscellaneous things</h2></div></div></div>
-<p>This directory contains things that individual pkgsrc
-       developers find worth publishing.</p>
+<div class="sect2">
+<div class="titlepage"><div><div><h3 class="title">
+<a name="hardening.mechanisms.disabled"></a>B.1.2.�Not enabled by default</h3></div></div></div>
+<div class="sect3">
+<div class="titlepage"><div><div><h4 class="title">
+<a name="hardening.mechanisms.disabled.repro"></a>B.1.2.1.�PKGSRC_MKREPRO</h4></div></div></div>
+<p>
+With this option, pkgsrc will try to build packages reproducibly. This allows
+packages built from the same tree and with the same options, to produce
+identical results bit by bit. This option should be combined with ASLR and
+<code class="varname">PKGSRC_MKPIE</code> to avoid predictable address offsets for
+attackers attempting to exploit security vulnerabilities.
+</p>
+<p>
+More details can be found here:
+</p>
+<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem"><p>
+<a class="ulink" href="https://reproducible-builds.org/"; target="_top">Reproducible Builds - a set of software development practices that create an independently-verifiable path from source to 
binary code</a>
+</p></li></ul></div>
+<p>
+More work likely needs to be done before pkgsrc is fully reproducible.
+</p>
+</div>
+<div class="sect3">
+<div class="titlepage"><div><div><h4 class="title">
+<a name="hardening.mechanisms.disabled.stackcheck"></a>B.1.2.2.�PKGSRC_USE_STACK_CHECK</h4></div></div></div>
+<p>
+This uses <code class="literal">-fstack-check</code> with GCC for
+another stack protection mitigation.
+</p>
+<p>
+It asks the compiler to generate code verifying that it does not corrupt the
+stack. According to GCC's manual page, this is really only useful for
+multi-threaded programs.
+</p>
+</div>
 </div>
-<div class="sect1">
-<div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="ftp-packages"></a>C.3.�<code class="filename">packages</code>: Binary packages</h2></div></div></div>
-<p>This directory contains binary packages for the various
-       platforms that are supported by pkgsrc.
-       Each subdirectory is of the form <em class="replaceable"><code>OPSYS</code></em>/<em class="replaceable"><code>ARCH</code></em>/<em class="replaceable"><code>OSVERSION_TAG</code></em>. The 
meaning of these variables is:</p>
-<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
-<li class="listitem"><p><code class="varname">OPSYS</code> is the name of the
-       operating system for which the packages have been built. The
-       name is taken from the output of the <span class="command"><strong>uname</strong></span>
-       command, so it may differ from the one you are used to
-       hear.</p></li>
-<li class="listitem"><p><code class="varname">ARCH</code> is the hardware
-       architecture of the platform for which the packages have been
-       built. It also includes the <code class="varname">ABI</code> (Application
-       Binary Interface) for platforms that have several of
-       them.</p></li>
-<li class="listitem"><p><code class="varname">OSVERSION</code> is the version of
-       the operating system. For version numbers that change often (for
-       example NetBSD-current), the often-changing part should be
-       replaced with an <code class="literal">x</code>, for example
-       <code class="literal">4.99.x</code>.</p></li>
-<li class="listitem"><p><code class="varname">TAG</code> is either
-       <code class="literal">20<em class="replaceable"><code>xx</code></em>Q<em class="replaceable"><code>y</code></em></code>
-       for a stable branch, or <code class="literal">head</code> for packages
-       built from the HEAD branch. The latter should only be used when
-       the packages are updated on a regular basis. Otherwise the date
-       from checking out pkgsrc should be appended, for example
-       <code class="literal">head_20071015</code>.</p></li>
-</ul></div>
-<p>The rationale for exactly this scheme is that the pkgsrc users looking for binary packages
-       can quickly click through the directories on the
-       server and find the best binary packages for their machines. Since they
-       usually know the operating system and the hardware architecture, OPSYS
-       and ARCH are placed first. After these choices, they can select the
-       best combination of OSVERSION and TAG together, since it is usually the
-       case that packages stay compatible between different version of the
-       operating system.</p>
-<p>In each of these directories, there is a
-       whole binary packages collection for a specific platform. It has a directory called
-       <code class="filename">All</code> which contains all binary packages.
-       Besides that, there are various category directories that
-       contain symbolic links to the real binary packages.</p>
 </div>
 <div class="sect1">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="ftp-reports"></a>C.4.�<code class="filename">reports</code>: Bulk build reports</h2></div></div></div>
-<p>Here are the reports from bulk builds, for those who want
+<a name="hardening.caveats"></a>B.2.�Caveats</h2></div></div></div>
+<div class="sect2">
+<div class="titlepage"><div><div><h3 class="title">
+<a name="hardening.caveats.pie"></a>B.2.1.�Problems with PKGSRC_MKPIE</h3></div></div></div>
+<div class="sect3">
+<div class="titlepage"><div><div><h4 class="title">
+<a name="hardening.caveats.pie.build"></a>B.2.1.1.�Packages failing to build</h4></div></div></div>
+<p>
+A number of packages may fail to build with this option enabled. The
+failures are often related to the absence of the <code class="literal">-fPIC</code>
+compilation flag when building libraries or executables (or ideally
+<code class="literal">-fPIE</code> in the latter case). This flag is added to the
+<code class="varname">CFLAGS</code> already, but requires the package to
+actually support it.
+</p>
+<div class="sect4">
+<div class="titlepage"><div><div><h5 class="title">
+<a name="hardening.caveats.pie.build.fix"></a>B.2.1.1.1.�How to fix</h5></div></div></div>
+<p>
+These instructions are meant as a reference only; they likely need to be adapted
+for many packages individually.
+</p>
+<p>
+For packages using <code class="filename">Makefiles</code>:
+</p>
+<pre class="programlisting">
+MAKE_FLAGS+=   CFLAGS=${CFLAGS:Q}
+MAKE_FLAGS+=   LDFLAGS=${LDFLAGS:Q}
+</pre>
+<p>
+For packages using <code class="filename">Imakefiles</code>:
+</p>
+<pre class="programlisting">
+MAKE_FLAGS+=   CCOPTIONS=${CFLAGS:Q}
+MAKE_FLAGS+=   LOCAL_LDFLAGS=${LDFLAGS:Q}
+</pre>
+</div>
+</div>
+<div class="sect3">
+<div class="titlepage"><div><div><h4 class="title">
+<a name="hardening.caveats.pie.crash"></a>B.2.1.2.�Run-time crashes</h4></div></div></div>
+<p>
+Some programs may fail to run, or crash at random times once built as PIE. Two
+scenarios are essentially possible. This is nearly always due to a bug in
+the program being exposed due to ASLR.
+</p>
+</div>
+<div class="sect3">
+<div class="titlepage"><div><div><h4 class="title">
+<a name="hardening.caveats.pie.disable"></a>B.2.1.3.�Disabling PKGSRC_MKPIE on a per-package basis</h4></div></div></div>
+<p>
+Ideally, packages should be fixed for compatibility with MKPIE.
+However, in some cases this is very difficult, due to complex build systems,
+packages using non-standard toolchains, or programming languages with odd
+bootstrapping mechanisms.
+</p>
+<p>
+To disable <code class="varname">PKGSRC_MKPIE</code> on a per-package basis, set
+<code class="varname">MKPIE_SUPPORTED= no</code> in the package's Makefile before
+<code class="filename">bsd.prefs.mk</code> is included.
+</p>
+</div>
+</div>
+<div class="sect2">
+<div class="titlepage"><div><div><h3 class="title">
+<a name="hardening.caveats.fortify"></a>B.2.2.�Problems with PKGSRC_USE_FORTIFY</h3></div></div></div>
+<div class="sect3">
+<div class="titlepage"><div><div><h4 class="title">
+<a name="hardening.caveats.fortify.build"></a>B.2.2.1.�Packages failing to build</h4></div></div></div>
+<p>
+This feature makes use of pre-processing directives to look for hardened,
+alternative implementations of essential library calls. Some programs may fail
+to build as a result; this usually happens for those trying too hard to be
+portable, or otherwise abusing definitions in the standard library.
+</p>
+</div>
+<div class="sect3">
+<div class="titlepage"><div><div><h4 class="title">
+<a name="hardening.caveats.fortify.crash"></a>B.2.2.2.�Run-time crashes</h4></div></div></div>
+<p>
+This feature may cause some programs to crash, usually indicating an
+actual bug in the program. The fix will typically involve patching the
+original program's source code.
+</p>
+</div>
+<div class="sect3">
+<div class="titlepage"><div><div><h4 class="title">
+<a name="hardening.caveats.fortify.opt"></a>B.2.2.3.�Optimization is required</h4></div></div></div>
+<p>
+At least in the case of GCC, FORTIFY will only be applied if optimization is
+applied while compiling. This means that the <code class="varname">CFLAGS</code> should
+also contain <code class="literal">-O</code>, <code class="literal">-O2</code> or another
+optimization level. This cannot easily be applied globally, as some packages
+may require specific optimization levels.
+</p>
+</div>
+<div class="sect3">
+<div class="titlepage"><div><div><h4 class="title">
+<a name="hardening.caveats.fortify.disable"></a>B.2.2.4.�Disabling FORTIFY on a per-package basis</h4></div></div></div>
+<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
+<h3 class="title">Note</h3>
+<p>FORTIFY should not be disabled to work around runtime crashes in
+the program!  This is a very bad idea and will expose you to security
+vulnerabilities.
+</p>
+</div>
+<p>
+To disable FORTIFY on a per-package basis, set the following
+in the package's <code class="filename">Makefile</code>
+before <code class="filename">bsd.prefs.mk</code> is included:
+</p>
+<pre class="programlisting">
+FORTIFY_SUPPORTED=     no
+</pre>
+</div>
+</div>
+<div class="sect2">
+<div class="titlepage"><div><div><h3 class="title">
+<a name="hardening.caveats.relro"></a>B.2.3.�Problems with PKGSRC_USE_RELRO</h3></div></div></div>
+<div class="sect3">
+<div class="titlepage"><div><div><h4 class="title">
+<a name="hardening.caveats.relro.performance"></a>B.2.3.1.�Performance impact</h4></div></div></div>
+<p>
+For better protection, full RELRO requires every symbol to be resolved when the
+program starts, rather than simply when required at run-time. This will have
+more impact on programs using a lot of symbols, or linked to libraries exposing
+a lot of symbols. Therefore, daemons or programs otherwise running in
+background are affected only when started. Programs loading plug-ins at
+run-time are affected when loading the plug-ins.
+</p>
+<p>
+The impact is not expected to be noticeable on modern hardware, except in some
+cases for big programs.
+</p>
+</div>
+<div class="sect3">
+<div class="titlepage"><div><div><h4 class="title">
+<a name="hardening.caveats.relro.crash"></a>B.2.3.2.�Run-time crashes</h4></div></div></div>
+<p>
+Some programs handle plug-ins and dependencies in a way that conflicts with
+RELRO: for instance, with an initialization routine listing any other plug-in
+required. With full RELRO, the missing symbols are resolved before the
+initialization routine can run, and the dynamic loader will not be able to find
+them directly and abort as a result. Unfortunately, this is how Xorg loads its
+drivers. Partial RELRO can be applied instead in this case.
+</p>
+</div>
+<div class="sect3">
+<div class="titlepage"><div><div><h4 class="title">
+<a name="hardening.caveats.relro.disable"></a>B.2.3.3.�Disabling RELRO on a per-package basis</h4></div></div></div>
+<p>
+To disable RELRO on a per-package basis, set the following
+in the package's <code class="filename">Makefile</code>
+before <code class="filename">bsd.prefs.mk</code> is included:
+</p>
+<pre class="programlisting">
+RELRO_SUPPORTED=       no
+</pre>
+</div>
+</div>
+<div class="sect2">
+<div class="titlepage"><div><div><h3 class="title">
+<a name="hardening.caveats.ssp"></a>B.2.4.�Problems with PKGSRC_USE_SSP</h3></div></div></div>
+<div class="sect3">
+<div class="titlepage"><div><div><h4 class="title">
+<a name="hardening.caveats.ssp.build"></a>B.2.4.1.�Packages failing to build</h4></div></div></div>
+<p>
+The stack-smashing protection provided by this option does not work for some
+programs. The most common situation in which this happens is when the program
+allocates variables on the stack, with the size determined at run-time.
+</p>
+</div>
+<div class="sect3">
+<div class="titlepage"><div><div><h4 class="title">
+<a name="hardening.caveats.ssp.crash"></a>B.2.4.2.�Run-time crashes</h4></div></div></div>
+<p>
+Again, this feature may cause some programs to crash via a
+<code class="varname">SIGABRT</code>, usually indicating an actual bug in the program.
+</p>
+<p>
+On NetBSD <code class="varname">LOG_CRIT</code> level syslog
+messages are sent and - by default -
+appended to <code class="filename">/var/log/messages</code>, e.g.:
+</p>
+<pre class="programlisting">
+Jan  6 15:42:51 hostname -: hostname program - - - buffer overflow detected; terminated
+</pre>
+<p>
+(where <code class="literal">hostname</code> is the hostname(1) and
+<code class="literal">program</code> is the basename(1) of the program crashed).
+</p>
+<p>
+Patching the original program is then required.
+</p>
+<p>
+Rebuilding the package via:
+</p>
+<pre class="programlisting">
+<strong class="userinput"><code>% env CFLAGS=-g INSTALL_UNSTRIPPED=yes make replace</code></strong>
+</pre>
+<p>
+and inspecting the backtrace of the coredump via the debugger
+should point out the problematic call by inspecting the frame
+calling the _chk() (SSP) function.
+</p>
+</div>
+<div class="sect3">
+<div class="titlepage"><div><div><h4 class="title">
+<a name="hardening.caveats.ssp.performance"></a>B.2.4.3.�Performance impact</h4></div></div></div>
+<p>
+The compiler emits extra code when using this feature: a check for buffer
+overflows is performed when entering and exiting functions, requiring an extra
+variable on the stack. The level of protection can otherwise be adjusted to
+affect only those functions considered more sensitive by the compiler (with
+-fstack-protector instead of -fstack-protector-all).
+</p>
+<p>
+The impact is not expected to be noticeable on modern hardware. However,
+programs with a hard requirement to run at the fastest possible speed should
+avoid using this feature, or using libraries built with this feature.
+</p>
+</div>
+<div class="sect3">
+<div class="titlepage"><div><div><h4 class="title">
+<a name="hardening.caveats.ssp.disable"></a>B.2.4.4.�Disabling SSP on a per-package basis</h4></div></div></div>
+<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
+<h3 class="title">Note</h3>
+<p>SSP should not be disabled to work around runtime crashes in
+the program!  This is a very bad idea and will expose you to security
+vulnerabilities.</p>
+</div>
+<p>
+To disable SSP on a per-package basis, set the following
+in the package's <code class="filename">Makefile</code>
+before <code class="filename">bsd.prefs.mk</code> is included:
+</p>
+<pre class="programlisting">
+SSP_SUPPORTED= no
+</pre>
+</div>
+</div>
+</div>
+<div class="sect1">
+<div class="titlepage"><div><div><h2 class="title" style="clear: both">
+<a name="hardening.audit"></a>B.3.�Auditing the system</h2></div></div></div>
+<p>
+The illusion of security is worse than having no security at all. This section
+lists a number of ways to ensure the security features requested are actually
+effective.
+</p>
+<p>
+These instructions were obtained and tested on a system derived from NetBSD 7
+(amd64). YMMV.
+</p>
+<div class="sect2">
+<div class="titlepage"><div><div><h3 class="title">
+<a name="hardening.audit.pie"></a>B.3.1.�Checking for PIE</h3></div></div></div>
+<p>
+The ELF executable type in use changes for binaries built as PIE; without:
+</p>
+<pre class="programlisting">
+<strong class="userinput"><code>$ file /path/to/bin/ary</code></strong>
+/path/to/bin/ary: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked (uses shared libs), for NetBSD 7.0, not stripped
+</pre>
+<p>as opposed to the following binary, built as PIE:</p>
+<pre class="programlisting">
+<strong class="userinput"><code>$ file /path/to/pie/bin/ary</code></strong>
+/path/to/pie/bin/ary: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked (uses shared libs), for NetBSD 7.0, not stripped
+</pre>
+<p>
+The latter result is then what is expected.
+</p>
+</div>
+<div class="sect2">
+<div class="titlepage"><div><div><h3 class="title">
+<a name="hardening.audit.relropartial"></a>B.3.2.�Checking for partial RELRO</h3></div></div></div>
+<p>
+The following command should list a section called RELRO:
+</p>
+<pre class="programlisting">
+<strong class="userinput"><code>$ objdump -p /path/to/bin/ary</code></strong>
+
+/path/to/bin/ary:     file format elf64-x86-64
+
+Program Header:
+[...]
+   RELRO off    0x0000000000000d78 vaddr 0x0000000000600d78 paddr 0x0000000000600d78 align 2**0
+</pre>
+<p>
+This check is now performed automatically if
+<code class="varname">PKG_DEVELOPER</code> is set and RELRO is enabled.
+</p>
+</div>
+<div class="sect2">
+<div class="titlepage"><div><div><h3 class="title">
+<a name="hardening.audit.relrofull"></a>B.3.3.�Checking for full RELRO</h3></div></div></div>
+<p>
+The dynamic loader will apply RELRO immediately when detecting the presence of
+the <code class="varname">BIND_NOW</code> flag:
+</p>
+<pre class="programlisting">
+<strong class="userinput"><code>$ objdump -x /path/to/bin/ary</code></strong>
+
+/path/to/bin/ary:     file format elf64-x86-64
+
+Dynamic Section:
+[...]
+  BIND_NOW             0x0000000000000000
+</pre>
+<p>
+This has to be combined with partial RELRO (see above) to be fully efficient.
+</p>
+<p>
+This check is now performed automatically (where supported) if
+<code class="varname">PKG_DEVELOPER</code> is set.
+</p>
+</div>
+<div class="sect2">
+<div class="titlepage"><div><div><h3 class="title">
+<a name="hardening.audit.ssp"></a>B.3.4.�Checking for SSP</h3></div></div></div>
+<p>
+Building objects, binaries and libraries with SSP will affect the presence of
+additional symbols in the resulting file:
+</p>
+<pre class="programlisting">
+<strong class="userinput"><code>$ nm /path/to/bin/ary</code></strong>
+[...]
+                 U __stack_chk_fail
+0000000000600ea0 B __stack_chk_guard
+</pre>
+<p>
+This is an indicator that the program was indeed built with support for SSP.
+</p>
+<p>
+This check is now performed automatically (where supported) if
+<code class="varname">PKG_DEVELOPER</code> is set and SSP is enabled.
+</p>
+</div>
+</div>
+</div>
+<div class="appendix">
+<div class="titlepage"><div><div><h1 class="title">
+<a name="logs"></a>Appendix�C.�Build logs</h1></div></div></div>
+<div class="toc">
+<p><b>Table of Contents</b></p>
+<dl class="toc">
+<dt><span class="sect1"><a href="#logs.building">C.1. Building figlet</a></span></dt>
+<dt><span class="sect1"><a href="#logs.package">C.2. Packaging figlet</a></span></dt>
+</dl>
+</div>
+<div class="sect1">
+<div class="titlepage"><div><div><h2 class="title" style="clear: both">
+<a name="logs.building"></a>C.1.�Building figlet</h2></div></div></div>
+<pre class="screen"><code class="prompt">#</code> <strong class="userinput"><code>make</code></strong>
+===&gt; Checking for vulnerabilities in figlet-2.2.1nb2
+=&gt; figlet221.tar.gz doesn't seem to exist on this system.
+=&gt; Attempting to fetch figlet221.tar.gz from ftp://ftp.figlet.org/pub/figlet/program/unix/.
+=&gt; [172219 bytes]
+Connected to ftp.plig.net.
+220 ftp.plig.org NcFTPd Server (licensed copy) ready.
+331 Guest login ok, send your complete e-mail address as password.
+230-You are user #5 of 500 simultaneous users allowed.
+230-
+230-  ___ _             _ _
+230- |  _| |_ ___   ___| |_|___   ___ ___ ___
+230- |  _|  _| . |_| . | | | . |_| . |  _| . |
+230- |_| |_| |  _|_|  _|_|_|_  |_|___|_| |_  |
+230-         |_|   |_|     |___|         |___|
+230-
+230-** Welcome to ftp.plig.org **
+230-
+230-Please note that all transfers from this FTP site are logged. If you
+230-do not like this, please disconnect now.
+230-
+230-This archive is available via
+230-
+230-HTTP:  http://ftp.plig.org/
+230-FTP:   ftp://ftp.plig.org/     (max 500 connections)
+230-RSYNC: rsync://ftp.plig.org/   (max  30 connections)
+230-
+230-Please email comments, bug reports and requests for packages to be
+230-mirrored to ftp-admin%plig.org@localhost.
+230-
+230-
+230 Logged in anonymously.
+Remote system type is UNIX.
+Using binary mode to transfer files.
+200 Type okay.
+250 "/pub" is new cwd.
+250-"/pub/figlet" is new cwd.
+250-
+250-Welcome to the figlet archive at ftp.figlet.org
+250-
+250-   ftp://ftp.figlet.org/pub/figlet/
+250-
+250-The official FIGlet web page is:
+250-   http://www.figlet.org/
+250-
+250-If you have questions, please mailto:info%figlet.org@localhost. If you want to
+250-contribute a font or something else, you can email us.
+250
+250 "/pub/figlet/program" is new cwd.
+250 "/pub/figlet/program/unix" is new cwd.
+local: figlet221.tar.gz remote: figlet221.tar.gz
+502 Unimplemented command.
+227 Entering Passive Mode (195,40,6,41,246,104)
+150 Data connection accepted from 84.128.86.72:65131; transfer starting for figlet221.tar.gz (172219 bytes).
+38% |**************                       | 65800      64.16 KB/s    00:01 ETA
+226 Transfer completed.
+172219 bytes received in 00:02 (75.99 KB/s)
+221 Goodbye.
+=&gt; Checksum OK for figlet221.tar.gz.
+===&gt; Extracting for figlet-2.2.1nb2
+===&gt; Required installed package ccache-[0-9]*: ccache-2.3nb1 found
+===&gt; Patching for figlet-2.2.1nb2
+===&gt; Applying pkgsrc patches for figlet-2.2.1nb2
+===&gt; Overriding tools for figlet-2.2.1nb2
+===&gt; Creating toolchain wrappers for figlet-2.2.1nb2
+===&gt; Configuring for figlet-2.2.1nb2
+===&gt; Building for figlet-2.2.1nb2
+gcc -O2 -DDEFAULTFONTDIR=\"/usr/pkg/share/figlet\"  -DDEFAULTFONTFILE=\"standard.flf\"  figlet.c zipio.c crc.c inflate.c -o figlet
+chmod a+x figlet
+gcc -O2 -o chkfont chkfont.c
+=&gt; Unwrapping files-to-be-installed.
+<code class="prompt">#</code>
+<code class="prompt">#</code> <strong class="userinput"><code>make install</code></strong>
+===&gt; Checking for vulnerabilities in figlet-2.2.1nb2
+===&gt; Installing for figlet-2.2.1nb2
+install -d -o root -g wheel -m 755 /usr/pkg/bin
+install -d -o root -g wheel -m 755 /usr/pkg/man/man6
+mkdir -p /usr/pkg/share/figlet
+cp figlet /usr/pkg/bin
+cp chkfont /usr/pkg/bin
+chmod 555 figlist showfigfonts
+cp figlist /usr/pkg/bin
+cp showfigfonts /usr/pkg/bin
+cp fonts/*.flf /usr/pkg/share/figlet
+cp fonts/*.flc /usr/pkg/share/figlet
+cp figlet.6 /usr/pkg/man/man6
+===&gt; Registering installation for figlet-2.2.1nb2
+<code class="prompt">#</code></pre>
+</div>
+<div class="sect1">
+<div class="titlepage"><div><div><h2 class="title" style="clear: both">
+<a name="logs.package"></a>C.2.�Packaging figlet</h2></div></div></div>
+<pre class="screen"><code class="prompt">#</code> <strong class="userinput"><code>make package</code></strong>
+===&gt; Checking for vulnerabilities in figlet-2.2.1nb2
+===&gt; Packaging figlet-2.2.1nb2
+===&gt; Building binary package for figlet-2.2.1nb2
+Creating package /home/cvs/pkgsrc/packages/i386/All/figlet-2.2.1nb2.tgz
+Using SrcDir value of /usr/pkg
+Registering depends:.
+<code class="prompt">#</code></pre>
+</div>
+</div>
+<div class="appendix">
+<div class="titlepage"><div><div><h1 class="title">
+<a name="ftp-layout"></a>Appendix�D.�Directory layout of the pkgsrc FTP server</h1></div></div></div>
+<div class="toc">
+<p><b>Table of Contents</b></p>
+<dl class="toc">
+<dt><span class="sect1"><a href="#ftp-distfiles">D.1. <code class="filename">distfiles</code>: The distributed source files</a></span></dt>
+<dt><span class="sect1"><a href="#ftp-misc">D.2. <code class="filename">misc</code>: Miscellaneous things</a></span></dt>
+<dt><span class="sect1"><a href="#ftp-packages">D.3. <code class="filename">packages</code>: Binary packages</a></span></dt>
+<dt><span class="sect1"><a href="#ftp-reports">D.4. <code class="filename">reports</code>: Bulk build reports</a></span></dt>
+<dt><span class="sect1"><a href="#ftp-source">D.5. <code class="filename">current</code>,
+<code class="filename">stable</code>,
+<code class="filename">pkgsrc-20<em class="replaceable"><code>xx</code></em>Q<em class="replaceable"><code>y</code></em></code>:
+source packages</a></span></dt>
+</dl>
+</div>
+<p>As in other big projects, the directory layout of pkgsrc
+       is quite complex for newbies. This chapter explains where you
+       find things on the FTP server. The base directory on
+       <code class="filename">ftp.NetBSD.org</code> is <a class="ulink" href="ftp://ftp.NetBSD.org/pub/pkgsrc/"; target="_top"><code class="filename">/pub/pkgsrc/</code></a>.
+       On other servers it may be different, but inside this directory,
+       everything should look the same, no matter on which server you
+       are. This directory contains some subdirectories, which are
+       explained below.</p>
+<div class="sect1">
+<div class="titlepage"><div><div><h2 class="title" style="clear: both">
+<a name="ftp-distfiles"></a>D.1.�<code class="filename">distfiles</code>: The distributed source files</h2></div></div></div>
+<p>The directory <code class="filename">distfiles</code> contains lots
+       of archive files from all pkgsrc packages, which are mirrored
+       here. The subdirectories are called after their package names
+       and are used when the distributed files have names that don't
+       explicitly contain a version number or are otherwise too generic
+       (for example <code class="filename">release.tar.gz</code>).</p>
+</div>
+<div class="sect1">
+<div class="titlepage"><div><div><h2 class="title" style="clear: both">
+<a name="ftp-misc"></a>D.2.�<code class="filename">misc</code>: Miscellaneous things</h2></div></div></div>
+<p>This directory contains things that individual pkgsrc
+       developers find worth publishing.</p>
+</div>
+<div class="sect1">
+<div class="titlepage"><div><div><h2 class="title" style="clear: both">
+<a name="ftp-packages"></a>D.3.�<code class="filename">packages</code>: Binary packages</h2></div></div></div>
+<p>This directory contains binary packages for the various
+       platforms that are supported by pkgsrc.
+       Each subdirectory is of the form <em class="replaceable"><code>OPSYS</code></em>/<em class="replaceable"><code>ARCH</code></em>/<em class="replaceable"><code>OSVERSION_TAG</code></em>. The 
meaning of these variables is:</p>
+<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
+<li class="listitem"><p><code class="varname">OPSYS</code> is the name of the
+       operating system for which the packages have been built. The
+       name is taken from the output of the <span class="command"><strong>uname</strong></span>
+       command, so it may differ from the one you are used to
+       hear.</p></li>
+<li class="listitem"><p><code class="varname">ARCH</code> is the hardware
+       architecture of the platform for which the packages have been
+       built. It also includes the <code class="varname">ABI</code> (Application
+       Binary Interface) for platforms that have several of
+       them.</p></li>
+<li class="listitem"><p><code class="varname">OSVERSION</code> is the version of
+       the operating system. For version numbers that change often (for
+       example NetBSD-current), the often-changing part should be
+       replaced with an <code class="literal">x</code>, for example
+       <code class="literal">4.99.x</code>.</p></li>
+<li class="listitem"><p><code class="varname">TAG</code> is either
+       <code class="literal">20<em class="replaceable"><code>xx</code></em>Q<em class="replaceable"><code>y</code></em></code>
+       for a stable branch, or <code class="literal">head</code> for packages
+       built from the HEAD branch. The latter should only be used when
+       the packages are updated on a regular basis. Otherwise the date
+       from checking out pkgsrc should be appended, for example
+       <code class="literal">head_20071015</code>.</p></li>
+</ul></div>
+<p>The rationale for exactly this scheme is that the pkgsrc users looking for binary packages
+       can quickly click through the directories on the
+       server and find the best binary packages for their machines. Since they
+       usually know the operating system and the hardware architecture, OPSYS
+       and ARCH are placed first. After these choices, they can select the
+       best combination of OSVERSION and TAG together, since it is usually the
+       case that packages stay compatible between different version of the
+       operating system.</p>
+<p>In each of these directories, there is a
+       whole binary packages collection for a specific platform. It has a directory called
+       <code class="filename">All</code> which contains all binary packages.
+       Besides that, there are various category directories that
+       contain symbolic links to the real binary packages.</p>
+</div>
+<div class="sect1">
+<div class="titlepage"><div><div><h2 class="title" style="clear: both">
+<a name="ftp-reports"></a>D.4.�<code class="filename">reports</code>: Bulk build reports</h2></div></div></div>
+<p>Here are the reports from bulk builds, for those who want
        to fix packages that didn't build on some of the platforms. The
-       structure of subdirectories should look like the one in <a class="xref" href="#ftp-packages" title="C.3.�packages: Binary packages">Section�C.3, &#8220;<code class="filename">packages</code>: 
Binary packages&#8221;</a>.</p>
+       structure of subdirectories should look like the one in <a class="xref" href="#ftp-packages" title="D.3.�packages: Binary packages">Section�D.3, &#8220;<code class="filename">packages</code>: 
Binary packages&#8221;</a>.</p>
 </div>
 <div class="sect1">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="ftp-source"></a>C.5.�<code class="filename">current</code>,
+<a name="ftp-source"></a>D.5.�<code class="filename">current</code>,
 <code class="filename">stable</code>,
 <code class="filename">pkgsrc-20<em class="replaceable"><code>xx</code></em>Q<em class="replaceable"><code>y</code></em></code>:
 source packages</h2></div></div></div>
@@ -11118,7 +11682,7 @@ source packages</h2></div></div></div>
 </div>
 <div class="appendix">
 <div class="titlepage"><div><div><h1 class="title">
-<a name="help-topics"></a>Appendix�D.�Help topics</h1></div></div></div>
+<a name="help-topics"></a>Appendix�E.�Help topics</h1></div></div></div>
 <p>
        The following list contains all help topics that are available
        when running <span class="command"><strong>bmake help topic=:index</strong></span>.
@@ -12189,664 +12753,668 @@ source packages</h2></div></div></div>
 <td>MKDIR</td>
 </tr>
 <tr>
+<td>MKPIE_SUPPORTED</td>
 <td>MLDONKEY_GROUP</td>
-<td>MLDONKEY_HOME</td>
 </tr>
 <tr>
+<td>MLDONKEY_HOME</td>
 <td>MLDONKEY_USER</td>
-<td>MONOTONE_GROUP</td>
 </tr>
 <tr>
+<td>MONOTONE_GROUP</td>
 <td>MONOTONE_USER</td>
-<td>MOTIFBASE</td>
 </tr>
 <tr>
+<td>MOTIFBASE</td>
 <td>MOTIF_TYPE</td>
-<td>MOTIF_TYPE_DEFAULT</td>
 </tr>
 <tr>
+<td>MOTIF_TYPE_DEFAULT</td>
 <td>MPI_TYPE</td>
-<td>MSGFMT_STRIP_MSGCTXT</td>
 </tr>
 <tr>
+<td>MSGFMT_STRIP_MSGCTXT</td>
 <td>MSGFMT_STRIP_MSGID_PLURAL</td>
-<td>MTOOLS_ENABLE_FLOPPYD</td>
 </tr>
 <tr>
+<td>MTOOLS_ENABLE_FLOPPYD</td>
 <td>MUST</td>
-<td>MV</td>
 </tr>
 <tr>
+<td>MV</td>
 <td>MYSQL_CHARSET</td>
-<td>MYSQL_DATADIR</td>
 </tr>
 <tr>
+<td>MYSQL_DATADIR</td>
 <td>MYSQL_EXTRA_CHARSET</td>
-<td>MYSQL_GROUP</td>
 </tr>
 <tr>
+<td>MYSQL_GROUP</td>
 <td>MYSQL_USER</td>
-<td>MYSQL_VERSION</td>
 </tr>
 <tr>
+<td>MYSQL_VERSION</td>
 <td>MYSQL_VERSIONS_ACCEPTED</td>
-<td>MYSQL_VERSIONS_ALL</td>
 </tr>
 <tr>
+<td>MYSQL_VERSIONS_ALL</td>
 <td>MYSQL_VERSION_DEFAULT</td>
-<td>NAGIOSCMD_GROUP</td>
 </tr>
 <tr>
+<td>NAGIOSCMD_GROUP</td>
 <td>NAGIOSDIR</td>
-<td>NAGIOS_GROUP</td>
 </tr>
 <tr>
+<td>NAGIOS_GROUP</td>
 <td>NAGIOS_USER</td>
-<td>NATIVE_APPEND_ABI</td>
 </tr>
 <tr>
+<td>NATIVE_APPEND_ABI</td>
 <td>NATIVE_APPEND_ELF</td>
-<td>NATIVE_EXEC_FMT</td>
 </tr>
 <tr>
+<td>NATIVE_EXEC_FMT</td>
 <td>NATIVE_MACHINE_PLATFORM</td>
-<td>NATIVE_OBJECT_FMT</td>
 </tr>
 <tr>
+<td>NATIVE_OBJECT_FMT</td>
 <td>NBPAX_PROGRAM_PREFIX</td>
-<td>NETBSD_LOGIN_NAME</td>
 </tr>
 <tr>
+<td>NETBSD_LOGIN_NAME</td>
 <td>NMH_EDITOR</td>
-<td>NMH_MTA</td>
 </tr>
 <tr>
+<td>NMH_MTA</td>
 <td>NMH_PAGER</td>
-<td>NOLOGIN</td>
 </tr>
 <tr>
+<td>NOLOGIN</td>
 <td>NOTE</td>
-<td>NOT_FOR_PLATFORM</td>
 </tr>
 <tr>
+<td>NOT_FOR_PLATFORM</td>
 <td>NOT_PAX_ASLR_SAFE</td>
-<td>NOT_PAX_MPROTECT_SAFE</td>
 </tr>
 <tr>
+<td>NOT_PAX_MPROTECT_SAFE</td>
 <td>NO_BUILD</td>
-<td>NO_CHECKSUM</td>
 </tr>
 <tr>
+<td>NO_CHECKSUM</td>
 <td>NO_CONFIGURE</td>
-<td>NO_SKIP</td>
 </tr>
 <tr>
+<td>NO_SKIP</td>
 <td>NS_PREFERRED</td>
-<td>NULLMAILER_GROUP</td>
 </tr>
 <tr>
+<td>NULLMAILER_GROUP</td>
 <td>NULLMAILER_USER</td>
-<td>OASIS</td>
 </tr>
 <tr>
+<td>OASIS</td>
 <td>OASIS_BUILD_ARGS</td>
-<td>OBJHOSTNAME</td>
 </tr>
 <tr>
+<td>OBJHOSTNAME</td>
 <td>OBJMACHINE</td>
-<td>OCAML_FINDLIB_DIRS</td>
 </tr>
 <tr>
+<td>OCAML_FINDLIB_DIRS</td>
 <td>OCAML_FINDLIB_REGISTER</td>
-<td>OCAML_FINDLIB_REGISTER_VERBOSE</td>
 </tr>
 <tr>
+<td>OCAML_FINDLIB_REGISTER_VERBOSE</td>
 <td>OCAML_SITELIBDIR</td>
-<td>OCAML_TOPKG_DOCDIR</td>
 </tr>
 <tr>
+<td>OCAML_TOPKG_DOCDIR</td>
 <td>OCAML_USE_DUNE</td>
-<td>OCAML_USE_FINDLIB</td>
 </tr>
 <tr>
+<td>OCAML_USE_FINDLIB</td>
 <td>OCAML_USE_JBUILDER</td>
-<td>OCAML_USE_OASIS</td>
 </tr>
 <tr>
+<td>OCAML_USE_OASIS</td>
 <td>OCAML_USE_OASIS_DYNRUN</td>
-<td>OCAML_USE_OPAM</td>
 </tr>
 <tr>
+<td>OCAML_USE_OPAM</td>
 <td>OCAML_USE_OPT_COMPILER</td>
-<td>OCAML_USE_TOPKG</td>
 </tr>
 <tr>
+<td>OCAML_USE_TOPKG</td>
 <td>OMF</td>
-<td>ONLY_FOR_COMPILER</td>
 </tr>
 <tr>
+<td>ONLY_FOR_COMPILER</td>
 <td>ONLY_FOR_PLATFORM</td>
-<td>OPENSSH_CHROOT</td>
 </tr>
 <tr>
+<td>OPENSSH_CHROOT</td>
 <td>OPENSSH_GROUP</td>
-<td>OPENSSH_USER</td>
 </tr>
 <tr>
+<td>OPENSSH_USER</td>
 <td>OPSYS</td>
+</tr>
+<tr>
 <td>OPSYS_EMULDIR</td>
+<td>OS</td>
 </tr>
 <tr>
-<td>OS</td>
 <td>OSS_TYPE</td>
+<td>OSX</td>
 </tr>
 <tr>
-<td>OSX</td>
 <td>OSX_TOLERATE_SDK_SKEW</td>
+<td>OS_HAVE_ALSA</td>
 </tr>
 <tr>
-<td>OS_HAVE_ALSA</td>
 <td>OS_HAVE_RCD</td>
+<td>OS_VARIANT</td>
 </tr>
 <tr>
-<td>OS_VARIANT</td>
 <td>OS_VERSION</td>
+<td>OTF_FONTS_DIR</td>
 </tr>
 <tr>
-<td>OTF_FONTS_DIR</td>
 <td>OVERRIDE_DIRDEPTH</td>
+<td>OVERRIDE_GEMSPEC</td>
 </tr>
 <tr>
-<td>OVERRIDE_GEMSPEC</td>
 <td>OVERRIDE_GNU_CONFIG_SCRIPTS</td>
+<td>OVERRIDE_ROCKSPEC</td>
 </tr>
 <tr>
-<td>OVERRIDE_ROCKSPEC</td>
 <td>OWN_DIRS</td>
+<td>OWN_DIRS_PERMS</td>
 </tr>
 <tr>
-<td>OWN_DIRS_PERMS</td>
 <td>P4GROUP</td>
+<td>P4PORT</td>
 </tr>
 <tr>
-<td>P4PORT</td>
 <td>P4ROOT</td>
+<td>P4USER</td>
 </tr>
 <tr>
-<td>P4USER</td>
 <td>PACKAGES</td>
+<td>PALMOS_DEFAULT_SDK</td>
 </tr>
 <tr>
-<td>PALMOS_DEFAULT_SDK</td>
 <td>PAMBASE</td>
+<td>PAM_DEFAULT</td>
 </tr>
 <tr>
-<td>PAM_DEFAULT</td>
 <td>PAPERSIZE</td>
+<td>PASSIVE_FETCH</td>
 </tr>
 <tr>
-<td>PASSIVE_FETCH</td>
 <td>PATCHDIR</td>
+<td>PATCHFILES</td>
 </tr>
 <tr>
-<td>PATCHFILES</td>
 <td>PATCH_ARGS</td>
+<td>PATCH_DEBUG</td>
 </tr>
 <tr>
-<td>PATCH_DEBUG</td>
 <td>PATCH_DIST_ARGS</td>
+<td>PATCH_DIST_CAT</td>
 </tr>
 <tr>
-<td>PATCH_DIST_CAT</td>
 <td>PATCH_DIST_STRIP</td>
+<td>PATCH_FUZZ_FACTOR</td>
 </tr>
 <tr>
-<td>PATCH_FUZZ_FACTOR</td>
 <td>PATCH_STRIP</td>
+<td>PATH</td>
 </tr>
 <tr>
-<td>PATH</td>
 <td>PCCBASE</td>
+<td>PEAR</td>
 </tr>
 <tr>
-<td>PEAR</td>
 <td>PEAR_CHANNEL</td>
+<td>PEAR_CHANNEL_ALIAS</td>
 </tr>
 <tr>
-<td>PEAR_CHANNEL_ALIAS</td>
 <td>PEAR_CHANNEL_VERSION</td>
+<td>PEAR_CMD</td>
 </tr>
 <tr>
-<td>PEAR_CMD</td>
 <td>PEAR_LIB</td>
+<td>PEAR_PACKAGE_XML</td>
 </tr>
 <tr>
-<td>PEAR_PACKAGE_XML</td>
 <td>PERL5</td>
+<td>PERL5_CONFIGURE</td>
 </tr>
 <tr>
-<td>PERL5_CONFIGURE</td>
 <td>PERL5_CONFIGURE_DIRS</td>
+<td>PERL5_LDFLAGS</td>
 </tr>
 <tr>
-<td>PERL5_LDFLAGS</td>
 <td>PERL5_LICENSE</td>
+<td>PERL5_MODULE_TYPE</td>
 </tr>
 <tr>
-<td>PERL5_MODULE_TYPE</td>
 <td>PERL5_PACKLIST</td>
+<td>PERL5_PACKLIST_DIR</td>
 </tr>
 <tr>
-<td>PERL5_PACKLIST_DIR</td>
 <td>PERL5_PERLBASE</td>
+<td>PERL5_SITEBASE</td>
 </tr>
 <tr>
-<td>PERL5_SITEBASE</td>
 <td>PERL5_USE_PACKLIST</td>
+<td>PERL5_VENDORBASE</td>
 </tr>
 <tr>
-<td>PERL5_VENDORBASE</td>
 <td>PFCTL</td>
+<td>PFVAR_H</td>
 </tr>
 <tr>
-<td>PFVAR_H</td>
 <td>PF_VERSION</td>
+<td>PGGROUP</td>
 </tr>
 <tr>
-<td>PGGROUP</td>
 <td>PGHOME</td>
+<td>PGPKGSRCDIR</td>
 </tr>
 <tr>
-<td>PGPKGSRCDIR</td>
 <td>PGSQL_TYPE</td>
+<td>PGSQL_VERSION</td>
 </tr>
 <tr>
-<td>PGSQL_VERSION</td>
 <td>PGSQL_VERSIONS_ACCEPTED</td>
+<td>PGSQL_VERSION_DEFAULT</td>
 </tr>
 <tr>
-<td>PGSQL_VERSION_DEFAULT</td>
 <td>PGUSER</td>
+<td>PG_LIB_EXT</td>
 </tr>
 <tr>
-<td>PG_LIB_EXT</td>
 <td>PHP</td>
+<td>PHPCOMMON_MK</td>
 </tr>
 <tr>
-<td>PHPCOMMON_MK</td>
 <td>PHPPKGSRCDIR</td>
+<td>PHP_BASE_VERS</td>
 </tr>
 <tr>
-<td>PHP_BASE_VERS</td>
 <td>PHP_CHECK_INSTALLED</td>
+<td>PHP_EXTENSION_DIR</td>
 </tr>
 <tr>
-<td>PHP_EXTENSION_DIR</td>
 <td>PHP_INITIAL_TEENY</td>
+<td>PHP_PKG_PREFIX</td>
 </tr>
 <tr>
-<td>PHP_PKG_PREFIX</td>
 <td>PHP_VERSION</td>
+<td>PHP_VERSIONS_ACCEPTED</td>
 </tr>
 <tr>
-<td>PHP_VERSIONS_ACCEPTED</td>
 <td>PHP_VERSIONS_INCOMPATIBLE</td>
+<td>PHP_VERSION_DEFAULT</td>
 </tr>
 <tr>
-<td>PHP_VERSION_DEFAULT</td>
 <td>PHP_VERSION_REQD</td>
+<td>PILRC_USE_GTK</td>
 </tr>
 <tr>
-<td>PILRC_USE_GTK</td>
 <td>PKGCONFIG_BASE</td>
+<td>PKGCONFIG_FILE</td>
 </tr>
 <tr>
-<td>PKGCONFIG_FILE</td>
 <td>PKGCONFIG_OVERRIDE</td>
+<td>PKGCONFIG_OVERRIDE_STAGE</td>
 </tr>
 <tr>
-<td>PKGCONFIG_OVERRIDE_STAGE</td>
 <td>PKGDIR</td>
+<td>PKGGNUDIR</td>
 </tr>
 <tr>
-<td>PKGGNUDIR</td>
 <td>PKGINFODIR</td>
+<td>PKGLOCALEDIR</td>
 </tr>
 <tr>
-<td>PKGLOCALEDIR</td>
 <td>PKGMANDIR</td>
+<td>PKGNAME</td>
 </tr>
 <tr>
-<td>PKGNAME</td>
 <td>PKGNAME_REQD</td>
+<td>PKGPATH</td>
 </tr>
 <tr>
-<td>PKGPATH</td>
 <td>PKGREVISION</td>
+<td>PKGSRC_BLAS_TYPES</td>
 </tr>
 <tr>
-<td>PKGSRC_BLAS_TYPES</td>
 <td>PKGSRC_CHANGES</td>
+<td>PKGSRC_COMPILER</td>
 </tr>
 <tr>
-<td>PKGSRC_COMPILER</td>
 <td>PKGSRC_KEEP_BIN_PKGS</td>
+<td>PKGSRC_LOCKTYPE</td>
 </tr>
 <tr>
-<td>PKGSRC_LOCKTYPE</td>
 <td>PKGSRC_MAKE_ENV</td>
+<td>PKGSRC_MESSAGE_RECIPIENTS</td>
 </tr>
 <tr>
-<td>PKGSRC_MESSAGE_RECIPIENTS</td>
 <td>PKGSRC_MKPIE</td>
+<td>PKGSRC_MKREPRO</td>
 </tr>
 <tr>
-<td>PKGSRC_MKREPRO</td>
 <td>PKGSRC_RUN_TEST</td>
+<td>PKGSRC_SETENV</td>
 </tr>
 <tr>
-<td>PKGSRC_SETENV</td>
 <td>PKGSRC_SLEEPSECS</td>
+<td>PKGSRC_TODO</td>
 </tr>
 <tr>
-<td>PKGSRC_TODO</td>
 <td>PKGSRC_USE_CTF</td>
+<td>PKGSRC_USE_FORTIFY</td>
 </tr>
 <tr>
-<td>PKGSRC_USE_FORTIFY</td>
 <td>PKGSRC_USE_RELRO</td>
+<td>PKGSRC_USE_SSP</td>
 </tr>
 <tr>
-<td>PKGSRC_USE_SSP</td>
 <td>PKGSRC_USE_STACK_CHECK</td>
+<td>PKGTASKS_DATAFILE</td>
 </tr>
 <tr>
-<td>PKGTASKS_DATAFILE</td>
 <td>PKGTOOLS_ARGS</td>
+<td>PKGTOOLS_ENV</td>
 </tr>
 <tr>
-<td>PKGTOOLS_ENV</td>
 <td>PKG_ALTERNATIVES</td>
+<td>PKG_APACHE</td>
 </tr>
 <tr>
-<td>PKG_APACHE</td>
 <td>PKG_APACHE_ACCEPTED</td>
+<td>PKG_APACHE_DEFAULT</td>
 </tr>
 <tr>
-<td>PKG_APACHE_DEFAULT</td>
 <td>PKG_BEST_EXISTS</td>
+<td>PKG_BUILD_OPTIONS</td>
 </tr>
 <tr>
-<td>PKG_BUILD_OPTIONS</td>
 <td>PKG_COMPRESSION</td>
+<td>PKG_CONFIG</td>
 </tr>
 <tr>
-<td>PKG_CONFIG</td>
 <td>PKG_CONFIG_PERMS</td>
+<td>PKG_CREATE_USERGROUP</td>
 </tr>
 <tr>
-<td>PKG_CREATE_USERGROUP</td>
 <td>PKG_DB_TMPDIR</td>
+<td>PKG_DEBUG_LEVEL</td>
 </tr>
 <tr>
-<td>PKG_DEBUG_LEVEL</td>
 <td>PKG_DEFAULT_OPTIONS</td>
+<td>PKG_DESTDIR_SUPPORT</td>
 </tr>
 <tr>
-<td>PKG_DESTDIR_SUPPORT</td>
 <td>PKG_DEVELOPER</td>
+<td>PKG_DISABLED_OPTIONS</td>
 </tr>
 <tr>
-<td>PKG_DISABLED_OPTIONS</td>
 <td>PKG_FATAL_ERRORS</td>
+<td>PKG_FC</td>
 </tr>
 <tr>
-<td>PKG_FC</td>
 <td>PKG_FILELIST_CMD</td>
+<td>PKG_GECOS</td>
 </tr>
 <tr>
-<td>PKG_GECOS</td>
 <td>PKG_GID</td>
+<td>PKG_GROUPS</td>
 </tr>
 <tr>
-<td>PKG_GROUPS</td>
 <td>PKG_GROUPS_VARS</td>
+<td>PKG_HOME</td>
 </tr>
 <tr>
-<td>PKG_HOME</td>
 <td>PKG_INIT_SCRIPTS</td>
+<td>PKG_JAVA_HOME</td>
 </tr>
 <tr>
-<td>PKG_JAVA_HOME</td>
 <td>PKG_JVM</td>
+<td>PKG_JVMS_ACCEPTED</td>
 </tr>
 <tr>
-<td>PKG_JVMS_ACCEPTED</td>
 <td>PKG_JVM_DEFAULT</td>
+<td>PKG_LEGACY_OPTIONS</td>
 </tr>
 <tr>
-<td>PKG_LEGACY_OPTIONS</td>
 <td>PKG_LIBTOOL</td>
+<td>PKG_OPTIONS</td>
 </tr>
 <tr>
-<td>PKG_OPTIONS</td>
 <td>PKG_OPTIONS_DEPRECATED_WARNINGS</td>
+<td>PKG_OPTIONS_LEGACY_OPTS</td>
 </tr>
 <tr>
-<td>PKG_OPTIONS_LEGACY_OPTS</td>
 <td>PKG_OPTIONS_LEGACY_VARS</td>
+<td>PKG_OPTIONS_NONEMPTY_SETS</td>
 </tr>
 <tr>
-<td>PKG_OPTIONS_NONEMPTY_SETS</td>
 <td>PKG_OPTIONS_OPTIONAL_GROUPS</td>
+<td>PKG_OPTIONS_REQUIRED_GROUPS</td>
 </tr>
 <tr>
-<td>PKG_OPTIONS_REQUIRED_GROUPS</td>
 <td>PKG_OPTIONS_VAR</td>
+<td>PKG_PHP</td>
 </tr>
 <tr>
-<td>PKG_PHP</td>
 <td>PKG_PHP_MAJOR_VERS</td>
+<td>PKG_PHP_VERSION</td>
 </tr>
 <tr>
-<td>PKG_PHP_VERSION</td>
 <td>PKG_RCD_SCRIPTS</td>
+<td>PKG_REFCOUNT_DBDIR</td>
 </tr>
 <tr>
-<td>PKG_REFCOUNT_DBDIR</td>
 <td>PKG_REGISTER_SHELLS</td>
+<td>PKG_RESUME_TRANSFERS</td>
 </tr>
 <tr>
-<td>PKG_RESUME_TRANSFERS</td>
 <td>PKG_SHELL</td>
+<td>PKG_SUGGESTED_OPTIONS</td>
 </tr>
 <tr>
-<td>PKG_SUGGESTED_OPTIONS</td>
 <td>PKG_SUPPORTED_OPTIONS</td>
+<td>PKG_SYSCONFBASE</td>
 </tr>
 <tr>
-<td>PKG_SYSCONFBASE</td>
 <td>PKG_SYSCONFBASEDIR</td>
+<td>PKG_SYSCONFDIR</td>
 </tr>
 <tr>
-<td>PKG_SYSCONFDIR</td>
 <td>PKG_SYSCONFDIR_PERMS</td>
+<td>PKG_SYSCONFSUBDIR</td>
 </tr>
 <tr>
-<td>PKG_SYSCONFSUBDIR</td>
 <td>PKG_SYSCONFVAR</td>
+<td>PKG_TOOLS_BIN</td>
 </tr>
 <tr>
-<td>PKG_TOOLS_BIN</td>
 <td>PKG_UID</td>
+<td>PKG_UPDATE_FONTS_DB</td>
 </tr>
 <tr>
-<td>PKG_UPDATE_FONTS_DB</td>
 <td>PKG_USERS</td>
+<td>PKG_USERS_VARS</td>
 </tr>
 <tr>
-<td>PKG_USERS_VARS</td>
 <td>PKG_VERBOSE</td>
+<td>PLEASE</td>
 </tr>
 <tr>
-<td>PLEASE</td>
 <td>PLIST</td>
+<td>PLIST_AWK</td>
 </tr>
 <tr>
-<td>PLIST_AWK</td>
 <td>PLIST_AWK_ENV</td>
+<td>PLIST_SRC</td>
 </tr>
 <tr>
-<td>PLIST_SRC</td>
 <td>PLIST_SUBST</td>
+<td>PLIST_TYPE</td>
 </tr>
 <tr>
-<td>PLIST_TYPE</td>
 <td>PLIST_VARS</td>
+<td>POPTOP_USE_MPPE</td>
 </tr>
 <tr>
-<td>POPTOP_USE_MPPE</td>
 <td>POSSIBLE_GFORTRAN_VERSION</td>
+<td>POST_FETCH_HOOK</td>
 </tr>
 <tr>
-<td>POST_FETCH_HOOK</td>
 <td>PREFER</td>
+<td>PREFER_NATIVE</td>
 </tr>
 <tr>
-<td>PREFER_NATIVE</td>
 <td>PREFER_NATIVE_PTHREADS</td>
+<td>PREFER_PKGSRC</td>
 </tr>
 <tr>
-<td>PREFER_PKGSRC</td>
 <td>PREFIX</td>
+<td>PREPEND_PATH</td>
 </tr>
 <tr>
-<td>PREPEND_PATH</td>
 <td>PRE_ROOT_CMD</td>
+<td>PRIVILEGED_STAGES</td>
 </tr>
 <tr>
-<td>PRIVILEGED_STAGES</td>
 <td>PS</td>
+<td>PTHREAD_AUTO_VARS</td>
 </tr>
 <tr>
-<td>PTHREAD_AUTO_VARS</td>
 <td>PTHREAD_CFLAGS</td>
+<td>PTHREAD_LDFLAGS</td>
 </tr>
 <tr>
-<td>PTHREAD_LDFLAGS</td>
 <td>PTHREAD_LIBS</td>
+<td>PTHREAD_OPTS</td>
 </tr>
 <tr>
-<td>PTHREAD_OPTS</td>
 <td>PTHREAD_TYPE</td>
+<td>PVM_SSH</td>
 </tr>
 <tr>
-<td>PVM_SSH</td>
 <td>PYPKGPREFIX</td>
+<td>PYTHON_FOR_BUILD_ONLY</td>
 </tr>
 <tr>
-<td>PYTHON_FOR_BUILD_ONLY</td>
 <td>PYTHON_SELF_CONFLICT</td>
+<td>PYTHON_VERSIONED_DEPENDENCIES</td>
 </tr>
 <tr>
-<td>PYTHON_VERSIONED_DEPENDENCIES</td>
 <td>PYTHON_VERSIONS_ACCEPTED</td>
+<td>PYTHON_VERSIONS_INCOMPATIBLE</td>
 </tr>
 <tr>
-<td>PYTHON_VERSIONS_INCOMPATIBLE</td>
 <td>PYTHON_VERSION_DEFAULT</td>
+<td>PYTHON_VERSION_REQD</td>
 </tr>
 <tr>
-<td>PYTHON_VERSION_REQD</td>
 <td>PYVERSSUFFIX</td>
+<td>PY_NO_EGG</td>
 </tr>
 <tr>
-<td>PY_NO_EGG</td>
 <td>QMAILDIR</td>
+<td>QMAIL_ALIAS_USER</td>
 </tr>
 <tr>
-<td>QMAIL_ALIAS_USER</td>
 <td>QMAIL_DAEMON_USER</td>
+<td>QMAIL_LOG_USER</td>
 </tr>
 <tr>
-<td>QMAIL_LOG_USER</td>
 <td>QMAIL_NOFILES_GROUP</td>
+<td>QMAIL_PASSWD_USER</td>
 </tr>
 <tr>
-<td>QMAIL_PASSWD_USER</td>
 <td>QMAIL_QMAIL_GROUP</td>
+<td>QMAIL_QUEUE_DIR</td>
 </tr>
 <tr>
-<td>QMAIL_QUEUE_DIR</td>
 <td>QMAIL_QUEUE_EXTRA</td>
+<td>QMAIL_QUEUE_USER</td>
 </tr>
 <tr>
-<td>QMAIL_QUEUE_USER</td>
 <td>QMAIL_REMOTE_USER</td>
+<td>QMAIL_ROOT_USER</td>
 </tr>
 <tr>
-<td>QMAIL_ROOT_USER</td>
 <td>QMAIL_SEND_USER</td>
+<td>QPOPPER_FAC</td>
 </tr>
 <tr>
-<td>QPOPPER_FAC</td>
 <td>QPOPPER_SPOOL_DIR</td>
+<td>QPOPPER_USER</td>
 </tr>
 <tr>
-<td>QPOPPER_USER</td>
 <td>RAKE_NAME</td>
+<td>RASMOL_DEPTH</td>
 </tr>
 <tr>
-<td>RASMOL_DEPTH</td>
 <td>RCD_DIR</td>
+<td>RCD_ORDER</td>
 </tr>
 <tr>
-<td>RCD_ORDER</td>
 <td>RCD_SCRIPTS</td>
+<td>RCD_SCRIPTS_DIR</td>
 </tr>
 <tr>
-<td>RCD_SCRIPTS_DIR</td>
 <td>RCD_SCRIPTS_EXAMPLEDIR</td>
+<td>RCD_SCRIPTS_MODE</td>
 </tr>
 <tr>
-<td>RCD_SCRIPTS_MODE</td>
 <td>RCD_SCRIPTS_SHELL</td>
+<td>RCD_SCRIPT_SRC</td>
 </tr>
 <tr>
-<td>RCD_SCRIPT_SRC</td>
 <td>RCD_SUBR</td>
+<td>RDOC</td>
 </tr>
 <tr>
-<td>RDOC</td>
 <td>READLINE_DEFAULT</td>
+<td>READLINE_TYPE</td>
 </tr>
 <tr>
-<td>READLINE_TYPE</td>
 <td>REAL_ROOT_GROUP</td>
+<td>REAL_ROOT_USER</td>
 </tr>
 <tr>
-<td>REAL_ROOT_USER</td>
 <td>RECURSIVE_MAKE</td>
+<td>RELAY_CTRL_DIR</td>
 </tr>
 <tr>
-<td>RELAY_CTRL_DIR</td>
 <td>RELRO_SUPPORTED</td>
+<td>REPLACE_AWK</td>
 </tr>
 <tr>
-<td>REPLACE_AWK</td>
 <td>REPLACE_BASH</td>
+<td>REPLACE_CSH</td>
 </tr>
 <tr>
-<td>REPLACE_CSH</td>
 <td>REPLACE_KSH</td>
+<td>REPLACE_PERL</td>
 </tr>
 <tr>
-<td>REPLACE_PERL</td>
 <td>REPLACE_PERL6</td>
+<td>REPLACE_PHP</td>
 </tr>
 <tr>
-<td>REPLACE_PHP</td>
 <td>REPLACE_PYTHON</td>
+<td>REPLACE_R</td>
 </tr>
 <tr>
 <td>REPLACE_RUBY</td>
@@ -14060,19 +14628,19 @@ source packages</h2></div></div></div>
 </div>
 <div class="appendix">
 <div class="titlepage"><div><div><h1 class="title">
-<a name="editing"></a>Appendix�E.�Editing guidelines for the pkgsrc guide</h1></div></div></div>
+<a name="editing"></a>Appendix�F.�Editing guidelines for the pkgsrc guide</h1></div></div></div>
 <div class="toc">
 <p><b>Table of Contents</b></p>
 <dl class="toc">
-<dt><span class="sect1"><a href="#targets">E.1. Make targets</a></span></dt>
-<dt><span class="sect1"><a href="#procedure">E.2. Procedure</a></span></dt>
+<dt><span class="sect1"><a href="#targets">F.1. Make targets</a></span></dt>
+<dt><span class="sect1"><a href="#procedure">F.2. Procedure</a></span></dt>
 </dl>
 </div>
 <p>This section contains information on editing the pkgsrc
        guide itself.</p>
 <div class="sect1">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="targets"></a>E.1.�Make targets</h2></div></div></div>
+<a name="targets"></a>F.1.�Make targets</h2></div></div></div>
 <p>The pkgsrc guide's source code is stored in
        <code class="filename">pkgsrc/doc/guide/files</code>, and several files
        are created from it:</p>
@@ -14088,7 +14656,7 @@ source packages</h2></div></div></div>
 </div>
 <div class="sect1">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="procedure"></a>E.2.�Procedure</h2></div></div></div>
+<a name="procedure"></a>F.2.�Procedure</h2></div></div></div>
 <p>The procedure to edit the pkgsrc guide is:</p>
 <div class="procedure"><ol class="procedure" type="1">
 <li class="step"><p>Make sure you have checked out the htdocs repository
@@ -14097,7 +14665,7 @@ source packages</h2></div></div></div>
 <li class="step"><p>Make sure you have the packages needed to
        regenerate the pkgsrc guide (and other XML-based NetBSD
        documentation) installed. These are automatically installed when
-       you install the <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/meta-pkgs/pkgsrc-guide-tools/README.html"; target="_top"><code 
class="filename">meta-pkgs/pkgsrc-guide-tools</code></a> package.</p></li>
+       you install the <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/meta-pkgs/pkgsrc-guide-tools/index.html"; target="_top"><code class="filename">meta-pkgs/pkgsrc-guide-tools</code></a> 
package.</p></li>
 <li class="step"><p>Run <span class="command"><strong>cd doc/guide</strong></span> to get to the
        right directory. All further steps will take place
        here.</p></li>

Index: pkgsrc/doc/pkgsrc.txt
diff -u pkgsrc/doc/pkgsrc.txt:1.319 pkgsrc/doc/pkgsrc.txt:1.320
--- pkgsrc/doc/pkgsrc.txt:1.319 Mon Aug 23 18:40:27 2021
+++ pkgsrc/doc/pkgsrc.txt       Fri Oct  1 17:59:05 2021
@@ -14,7 +14,7 @@ The pkgsrc Developers
 
 Copyright   1994-2021 The NetBSD Foundation, Inc
 
-$NetBSD: pkgsrc.xml,v 1.39 2021/01/02 08:32:15 jnemeth Exp $
+$NetBSD: pkgsrc.xml,v 1.40 2021/10/01 17:20:27 nia Exp $
 
 Abstract
 
@@ -429,24 +429,45 @@ A. A simple example package: bison
 
     A.2. Steps for building, installing, packaging
 
-B. Build logs
+B. Security hardening
 
-    B.1. Building figlet
-    B.2. Packaging figlet
+    B.1. Mechanisms
 
-C. Directory layout of the pkgsrc FTP server
+        B.1.1. Enabled by default
+        B.1.2. Not enabled by default
 
-    C.1. distfiles: The distributed source files
-    C.2. misc: Miscellaneous things
-    C.3. packages: Binary packages
-    C.4. reports: Bulk build reports
-    C.5. current, stable, pkgsrc-20xxQy: source packages
+    B.2. Caveats
 
-D. Help topics
-E. Editing guidelines for the pkgsrc guide
+        B.2.1. Problems with PKGSRC_MKPIE
+        B.2.2. Problems with PKGSRC_USE_FORTIFY
+        B.2.3. Problems with PKGSRC_USE_RELRO
+        B.2.4. Problems with PKGSRC_USE_SSP
 
-    E.1. Make targets
-    E.2. Procedure
+    B.3. Auditing the system
+
+        B.3.1. Checking for PIE
+        B.3.2. Checking for partial RELRO
+        B.3.3. Checking for full RELRO
+        B.3.4. Checking for SSP
+
+C. Build logs
+
+    C.1. Building figlet
+    C.2. Packaging figlet
+
+D. Directory layout of the pkgsrc FTP server
+
+    D.1. distfiles: The distributed source files
+    D.2. misc: Miscellaneous things
+    D.3. packages: Binary packages
+    D.4. reports: Bulk build reports
+    D.5. current, stable, pkgsrc-20xxQy: source packages
+
+E. Help topics
+F. Editing guidelines for the pkgsrc guide
+
+    F.1. Make targets
+    F.2. Procedure
 
 List of Tables
 
@@ -814,7 +835,7 @@ pkgsrc guide. If you don't find anything
     like BUILD_DEFS, a make target like do-build, a missing C or C++ function
     like strcasecmp or any other topic.
 
-    The available help topics are listed in Appendix D, Help topics.
+    The available help topics are listed in Appendix E, Help topics.
 
   * To see the value of a single variable, run bmake show-var VARNAME=X.
 
@@ -857,7 +878,7 @@ Before you download any pkgsrc files, yo
 current branch or the stable branch. The latter is forked on a quarterly basis
 from the current branch and only gets modified for security updates. The names
 of the stable branches are built from the year and the quarter, for example
-2021Q1.
+2021Q3.
 
 The second step is to decide how you want to download pkgsrc. You can get it as
 a tar file or via CVS. Both ways are described here.
@@ -870,7 +891,7 @@ CVS at any later time.
 The primary download location for all pkgsrc files is https://cdn.NetBSD.org/
 pub/pkgsrc/ or ftp://ftp.NetBSD.org/pub/pkgsrc/ (it points to the same
 location). There are a number of subdirectories for different purposes, which
-are described in detail in Appendix C, Directory layout of the pkgsrc FTP
+are described in detail in Appendix D, Directory layout of the pkgsrc FTP
 server.
 
 The tar archive for the current branch is in the directory current and is
@@ -881,12 +902,12 @@ published at pkgsrc.tar.bz2 and pkgsrc.t
 
 You can fetch the same files using FTP.
 
-The tar file for the stable branch 2021Q1 is in the directory pkgsrc-2021Q1 and
+The tar file for the stable branch 2021Q3 is in the directory pkgsrc-2021Q3 and
 is also called pkgsrc.tar.gz.
 
 To download the latest pkgsrc stable tarball, run:
 
-$ ftp ftp://ftp.NetBSD.org/pub/pkgsrc/pkgsrc-2021Q1/pkgsrc.tar.gz
+$ ftp ftp://ftp.NetBSD.org/pub/pkgsrc/pkgsrc-2021Q3/pkgsrc.tar.gz
 
 If you prefer, you can also fetch it using "wget", "curl", or your web browser.
 
@@ -905,7 +926,7 @@ $ ftp ftp://ftp.NetBSD.org/pub/pkgsrc/cu
 
 To fetch a specific pkgsrc stable branch, run:
 
-$ cd /usr && cvs -q -z2 -d anoncvs%anoncvs.NetBSD.org@localhost:/cvsroot checkout -r pkgsrc-2021Q1 -P pkgsrc
+$ cd /usr && cvs -q -z2 -d anoncvs%anoncvs.NetBSD.org@localhost:/cvsroot checkout -r pkgsrc-2021Q3 -P pkgsrc
 
 This will create the directory pkgsrc/ in your /usr/ directory and all the
 package source will be stored under /usr/pkgsrc/.
@@ -987,7 +1008,7 @@ When updating pkgsrc, the CVS program ke
 But if you, for whatever reason, want to switch from the stable branch to the
 current one, you can do it by adding the option "-A" after the "update"
 keyword. To switch from the current branch back to the stable branch, add the "
--rpkgsrc-2021Q1" option.
+-rpkgsrc-2021Q3" option.
 
 3.2.2.2. What happens to my changes when updating?
 
@@ -1344,7 +1365,7 @@ allow your program to compile, you can t
 
 
 Taking the figlet utility as an example, we can install it on our system by
-building as shown in Appendix B, Build logs.
+building as shown in Appendix C, Build logs.
 
 The program is installed under the default root of the packages tree - /usr/
 pkg. Should this not conform to your tastes, set the LOCALBASE variable in your
@@ -1716,7 +1737,7 @@ $ make package
 This will build and install your package (if not already done), and then build
 a binary package from what was installed. You can then use the pkg_* tools to
 manipulate it. Binary packages are created by default in /usr/pkgsrc/packages,
-in the form of a gzipped tar file. See Section B.2, "Packaging figlet" for a
+in the form of a gzipped tar file. See Section C.2, "Packaging figlet" for a
 continuation of the above misc/figlet example.
 
 See Chapter 23, Submitting and Committing for information on how to submit such
@@ -2898,7 +2919,7 @@ pkgsrc guide. If you don't find anything
     like BUILD_DEFS, a make target like do-build, a missing C or C++ function
     like strcasecmp or any other topic.
 
-    The available help topics are listed in Appendix D, Help topics.
+    The available help topics are listed in Appendix E, Help topics.
 
   * To see the value of a single variable, run bmake show-var VARNAME=X.
 
@@ -8894,14 +8915,395 @@ Now that you don't need the source and o
 # make clean
 ===>  Cleaning for bison-1.25
 
-Appendix B. Build logs
+Appendix B. Security hardening
+
+Table of Contents
+
+B.1. Mechanisms
+
+    B.1.1. Enabled by default
+    B.1.2. Not enabled by default
+
+B.2. Caveats
+
+    B.2.1. Problems with PKGSRC_MKPIE
+    B.2.2. Problems with PKGSRC_USE_FORTIFY
+    B.2.3. Problems with PKGSRC_USE_RELRO
+    B.2.4. Problems with PKGSRC_USE_SSP
+
+B.3. Auditing the system
+
+    B.3.1. Checking for PIE
+    B.3.2. Checking for partial RELRO
+    B.3.3. Checking for full RELRO
+    B.3.4. Checking for SSP
+
+A number of mechanisms are available in pkgsrc to improve the security of the
+resulting system. This page describes the mechanisms, and gives hints about
+detecting and fixing problems.
+
+Mechanisms can be enabled individually in mk.conf, and are individually
+described below.
+
+Typically, a feature will cause some programs to fail to build or work when
+first enabled. This can be due to latent problems in the program, and can be
+due to other reasons. After enough testing to have confidence that user
+problems will be quite rare, individual mechanisms will be enabled by default.
+
+For each mechanism, see the Caveats section below for an explanation of what
+might go wrong at compile time and at run time, and how to notice and address
+these problems.
+
+B.1. Mechanisms
+
+B.1.1. Enabled by default
+
+B.1.1.1. PKGSRC_USE_FORTIFY
+
+This allows substitute wrappers to be used for some commonly used library
+functions that do not have built-in bounds checking - but could in some cases.
+
+Two mitigation levels are available:
+
+  * "weak" only enables checks at compile-time.
+
+  * "strong" enables checks at compile-time and runtime.
+
+"strong" has been enabled by default since pkgsrc-2017Q3.
+
+B.1.1.2. PKGSRC_USE_SSP
+
+This enables a stack-smashing protection mitigation. It is done by adding a
+guard variable to functions with vulnerable objects. The guards are initialized
+when a function is entered and then checked when the function exits. The guard
+check will fail and the program forcibly exited if the variable was modified in
+the meantime. This can happen in case of buffer overflows or memory corruption,
+and therefore exposing these bugs.
+
+Different mitigation levels are available:
+
+  * "yes", which will only protect functions considered vulnerable by the
+    compiler;
+
+  * "all", which will protect every function;
+
+  * "strong", the default, which will apply a better balance between the two
+    settings above.
+
+This mitigation is supported by both GCC and clang. It may be supported in
+additional compilers, possibly under a different name. It is particularly
+useful for unsafe programming languages, such as C/C++.
+
+  * "yes" is enabled by default where known supported since pkgsrc-2017Q3.
+
+  * "strong" is enabled by default where known supported since pkgsrc-2021Q4.
+
+More details can be found here:
+
+  * Buffer overflow protection on Wikipedia
+
+B.1.1.3. PKGSRC_MKPIE
+
+This requests the creation of PIE (Position Independent Executables) for all
+executables. The PIE mechanism is normally used for shared libraries, so that
+they can be loaded at differing addresses at runtime. PIE itself does not have
+useful security properties; however, it is necessary to fully leverage some,
+such as ASLR. Some operating systems support Address Space Layout Randomization
+(ASLR), which causes different addresses to be used each time a program is run.
+This makes it more difficult for an attacker to guess addresses and thus makes
+exploits harder to construct. With PIE, ASLR can really be applied to the
+entire program, instead of the stack and heap only.
+
+PIE executables will only be built for toolchains that are known to support
+PIE. Currently, this means NetBSD on x86, ARM, SPARC64, m68k, and MIPS.
+
+PKGSRC_MKPIE was enabled by default after the pkgsrc-2021Q3 branch.
+
+B.1.1.4. PKGSRC_USE_RELRO
+
+This also makes the exploitation of some security vulnerabilities more
+difficult in some cases.
+
+Two different mitigation levels are available:
+
+  * partial: the ELF sections are reordered so that internal data sections
+    precede the program's own data sections, and non-PLT GOT is read-only;
+
+  * full: in addition to partial RELRO, every relocation is performed
+    immediately when starting the program (with a slight performance impact),
+    allowing the entire GOT to be read-only.
+
+This is currently supported by GCC. Many software distributions now enable this
+feature by default, at the "partial" level.
+
+More details can be found here:
+
+  * Hardening ELF binaries using Relocation Read-Only (RELRO)
+
+B.1.2. Not enabled by default
+
+B.1.2.1. PKGSRC_MKREPRO
+
+With this option, pkgsrc will try to build packages reproducibly. This allows
+packages built from the same tree and with the same options, to produce
+identical results bit by bit. This option should be combined with ASLR and
+PKGSRC_MKPIE to avoid predictable address offsets for attackers attempting to
+exploit security vulnerabilities.
+
+More details can be found here:
+
+  * Reproducible Builds - a set of software development practices that create
+    an independently-verifiable path from source to binary code
+
+More work likely needs to be done before pkgsrc is fully reproducible.
+
+B.1.2.2. PKGSRC_USE_STACK_CHECK
+
+This uses -fstack-check with GCC for another stack protection mitigation.
+
+It asks the compiler to generate code verifying that it does not corrupt the
+stack. According to GCC's manual page, this is really only useful for
+multi-threaded programs.
+
+B.2. Caveats
+
+B.2.1. Problems with PKGSRC_MKPIE
+
+B.2.1.1. Packages failing to build
+
+A number of packages may fail to build with this option enabled. The failures
+are often related to the absence of the -fPIC compilation flag when building
+libraries or executables (or ideally -fPIE in the latter case). This flag is
+added to the CFLAGS already, but requires the package to actually support it.
+
+B.2.1.1.1. How to fix
+
+These instructions are meant as a reference only; they likely need to be
+adapted for many packages individually.
+
+For packages using Makefiles:
+
+MAKE_FLAGS+=    CFLAGS=${CFLAGS:Q}
+MAKE_FLAGS+=    LDFLAGS=${LDFLAGS:Q}
+
+For packages using Imakefiles:
+
+MAKE_FLAGS+=    CCOPTIONS=${CFLAGS:Q}
+MAKE_FLAGS+=    LOCAL_LDFLAGS=${LDFLAGS:Q}
+
+B.2.1.2. Run-time crashes
+
+Some programs may fail to run, or crash at random times once built as PIE. Two
+scenarios are essentially possible. This is nearly always due to a bug in the
+program being exposed due to ASLR.
+
+B.2.1.3. Disabling PKGSRC_MKPIE on a per-package basis
+
+Ideally, packages should be fixed for compatibility with MKPIE. However, in
+some cases this is very difficult, due to complex build systems, packages using
+non-standard toolchains, or programming languages with odd bootstrapping
+mechanisms.
+
+To disable PKGSRC_MKPIE on a per-package basis, set MKPIE_SUPPORTED= no in the
+package's Makefile before bsd.prefs.mk is included.
+
+B.2.2. Problems with PKGSRC_USE_FORTIFY
+
+B.2.2.1. Packages failing to build
+
+This feature makes use of pre-processing directives to look for hardened,
+alternative implementations of essential library calls. Some programs may fail
+to build as a result; this usually happens for those trying too hard to be
+portable, or otherwise abusing definitions in the standard library.
+
+B.2.2.2. Run-time crashes
+
+This feature may cause some programs to crash, usually indicating an actual bug
+in the program. The fix will typically involve patching the original program's
+source code.
+
+B.2.2.3. Optimization is required
+
+At least in the case of GCC, FORTIFY will only be applied if optimization is
+applied while compiling. This means that the CFLAGS should also contain -O, -O2
+or another optimization level. This cannot easily be applied globally, as some
+packages may require specific optimization levels.
+
+B.2.2.4. Disabling FORTIFY on a per-package basis
+
+Note
+
+FORTIFY should not be disabled to work around runtime crashes in the program!
+This is a very bad idea and will expose you to security vulnerabilities.
+
+To disable FORTIFY on a per-package basis, set the following in the package's
+Makefile before bsd.prefs.mk is included:
+
+FORTIFY_SUPPORTED=      no
+
+B.2.3. Problems with PKGSRC_USE_RELRO
+
+B.2.3.1. Performance impact
+
+For better protection, full RELRO requires every symbol to be resolved when the
+program starts, rather than simply when required at run-time. This will have
+more impact on programs using a lot of symbols, or linked to libraries exposing
+a lot of symbols. Therefore, daemons or programs otherwise running in
+background are affected only when started. Programs loading plug-ins at
+run-time are affected when loading the plug-ins.
+
+The impact is not expected to be noticeable on modern hardware, except in some
+cases for big programs.
+
+B.2.3.2. Run-time crashes
+
+Some programs handle plug-ins and dependencies in a way that conflicts with
+RELRO: for instance, with an initialization routine listing any other plug-in
+required. With full RELRO, the missing symbols are resolved before the
+initialization routine can run, and the dynamic loader will not be able to find
+them directly and abort as a result. Unfortunately, this is how Xorg loads its
+drivers. Partial RELRO can be applied instead in this case.
+
+B.2.3.3. Disabling RELRO on a per-package basis
+
+To disable RELRO on a per-package basis, set the following in the package's
+Makefile before bsd.prefs.mk is included:
+
+RELRO_SUPPORTED=        no
+
+B.2.4. Problems with PKGSRC_USE_SSP
+
+B.2.4.1. Packages failing to build
+
+The stack-smashing protection provided by this option does not work for some
+programs. The most common situation in which this happens is when the program
+allocates variables on the stack, with the size determined at run-time.
+
+B.2.4.2. Run-time crashes
+
+Again, this feature may cause some programs to crash via a SIGABRT, usually
+indicating an actual bug in the program.
+
+On NetBSD LOG_CRIT level syslog messages are sent and - by default - appended
+to /var/log/messages, e.g.:
+
+Jan  6 15:42:51 hostname -: hostname program - - - buffer overflow detected; terminated
+
+(where hostname is the hostname(1) and program is the basename(1) of the
+program crashed).
+
+Patching the original program is then required.
+
+Rebuilding the package via:
+
+% env CFLAGS=-g INSTALL_UNSTRIPPED=yes make replace
+
+and inspecting the backtrace of the coredump via the debugger should point out
+the problematic call by inspecting the frame calling the _chk() (SSP) function.
+
+B.2.4.3. Performance impact
+
+The compiler emits extra code when using this feature: a check for buffer
+overflows is performed when entering and exiting functions, requiring an extra
+variable on the stack. The level of protection can otherwise be adjusted to
+affect only those functions considered more sensitive by the compiler (with
+-fstack-protector instead of -fstack-protector-all).
+
+The impact is not expected to be noticeable on modern hardware. However,
+programs with a hard requirement to run at the fastest possible speed should
+avoid using this feature, or using libraries built with this feature.
+
+B.2.4.4. Disabling SSP on a per-package basis
+
+Note
+
+SSP should not be disabled to work around runtime crashes in the program! This
+is a very bad idea and will expose you to security vulnerabilities.
+
+To disable SSP on a per-package basis, set the following in the package's
+Makefile before bsd.prefs.mk is included:
+
+SSP_SUPPORTED=  no
+
+B.3. Auditing the system
+
+The illusion of security is worse than having no security at all. This section
+lists a number of ways to ensure the security features requested are actually
+effective.
+
+These instructions were obtained and tested on a system derived from NetBSD 7
+(amd64). YMMV.
+
+B.3.1. Checking for PIE
+
+The ELF executable type in use changes for binaries built as PIE; without:
+
+$ file /path/to/bin/ary
+/path/to/bin/ary: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked (uses shared libs), for NetBSD 7.0, not stripped
+
+as opposed to the following binary, built as PIE:
+
+$ file /path/to/pie/bin/ary
+/path/to/pie/bin/ary: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked (uses shared libs), for NetBSD 7.0, not stripped
+
+The latter result is then what is expected.
+
+B.3.2. Checking for partial RELRO
+
+The following command should list a section called RELRO:
+
+$ objdump -p /path/to/bin/ary
+
+/path/to/bin/ary:     file format elf64-x86-64
+
+Program Header:
+[...]
+   RELRO off    0x0000000000000d78 vaddr 0x0000000000600d78 paddr 0x0000000000600d78 align 2**0
+
+This check is now performed automatically if PKG_DEVELOPER is set and RELRO is
+enabled.
+
+B.3.3. Checking for full RELRO
+
+The dynamic loader will apply RELRO immediately when detecting the presence of
+the BIND_NOW flag:
+
+$ objdump -x /path/to/bin/ary
+
+/path/to/bin/ary:     file format elf64-x86-64
+
+Dynamic Section:
+[...]
+  BIND_NOW             0x0000000000000000
+
+This has to be combined with partial RELRO (see above) to be fully efficient.
+
+This check is now performed automatically (where supported) if PKG_DEVELOPER is
+set.
+
+B.3.4. Checking for SSP
+
+Building objects, binaries and libraries with SSP will affect the presence of
+additional symbols in the resulting file:
+
+$ nm /path/to/bin/ary
+[...]
+                 U __stack_chk_fail
+0000000000600ea0 B __stack_chk_guard
+
+This is an indicator that the program was indeed built with support for SSP.
+
+This check is now performed automatically (where supported) if PKG_DEVELOPER is
+set and SSP is enabled.
+
+Appendix C. Build logs
 
 Table of Contents
 
-B.1. Building figlet
-B.2. Packaging figlet
+C.1. Building figlet
+C.2. Packaging figlet
 
-B.1. Building figlet
+C.1. Building figlet
 
 # make
 ===> Checking for vulnerabilities in figlet-2.2.1nb2
@@ -8992,7 +9394,7 @@ cp figlet.6 /usr/pkg/man/man6
 ===> Registering installation for figlet-2.2.1nb2
 #
 
-B.2. Packaging figlet
+C.2. Packaging figlet
 
 # make package
 ===> Checking for vulnerabilities in figlet-2.2.1nb2
@@ -9003,15 +9405,15 @@ Using SrcDir value of /usr/pkg
 Registering depends:.
 #
 
-Appendix C. Directory layout of the pkgsrc FTP server
+Appendix D. Directory layout of the pkgsrc FTP server
 
 Table of Contents
 
-C.1. distfiles: The distributed source files
-C.2. misc: Miscellaneous things
-C.3. packages: Binary packages
-C.4. reports: Bulk build reports
-C.5. current, stable, pkgsrc-20xxQy: source packages
+D.1. distfiles: The distributed source files
+D.2. misc: Miscellaneous things
+D.3. packages: Binary packages
+D.4. reports: Bulk build reports
+D.5. current, stable, pkgsrc-20xxQy: source packages
 
 As in other big projects, the directory layout of pkgsrc is quite complex for
 newbies. This chapter explains where you find things on the FTP server. The
@@ -9020,7 +9422,7 @@ different, but inside this directory, ev
 matter on which server you are. This directory contains some subdirectories,
 which are explained below.
 
-C.1. distfiles: The distributed source files
+D.1. distfiles: The distributed source files
 
 The directory distfiles contains lots of archive files from all pkgsrc
 packages, which are mirrored here. The subdirectories are called after their
@@ -9028,12 +9430,12 @@ package names and are used when the dist
 explicitly contain a version number or are otherwise too generic (for example
 release.tar.gz).
 
-C.2. misc: Miscellaneous things
+D.2. misc: Miscellaneous things
 
 This directory contains things that individual pkgsrc developers find worth
 publishing.
 
-C.3. packages: Binary packages
+D.3. packages: Binary packages
 
 This directory contains binary packages for the various platforms that are
 supported by pkgsrc. Each subdirectory is of the form OPSYS/ARCH/OSVERSION_TAG.
@@ -9069,13 +9471,13 @@ specific platform. It has a directory ca
 packages. Besides that, there are various category directories that contain
 symbolic links to the real binary packages.
 
-C.4. reports: Bulk build reports
+D.4. reports: Bulk build reports
 
 Here are the reports from bulk builds, for those who want to fix packages that
 didn't build on some of the platforms. The structure of subdirectories should
-look like the one in Section C.3, "packages: Binary packages".
+look like the one in Section D.3, "packages: Binary packages".
 
-C.5. current, stable, pkgsrc-20xxQy: source packages
+D.5. current, stable, pkgsrc-20xxQy: source packages
 
 These directories contain the "real" pkgsrc, that is the files that define how
 to create binary packages from source archives.
@@ -9099,7 +9501,7 @@ branch of the CVS repository. In these d
 called pkgsrc-20xxQy.tar.{bz,gz,xz}, which contains the state of pkgsrc when it
 was branched.
 
-Appendix D. Help topics
+Appendix E. Help topics
 
 The following list contains all help topics that are available when running 
 bmake help topic=:index.
@@ -9370,171 +9772,172 @@ MECAB_CHARSET                    MEDIATO
 MEDIATOMB_USER                   MIPSPROBASE
 MIREDO_GROUP                     MIREDO_USER
 MISSING_FEATURES                 MKDIR
-MLDONKEY_GROUP                   MLDONKEY_HOME
-MLDONKEY_USER                    MONOTONE_GROUP
-MONOTONE_USER                    MOTIFBASE
-MOTIF_TYPE                       MOTIF_TYPE_DEFAULT
-MPI_TYPE                         MSGFMT_STRIP_MSGCTXT
-MSGFMT_STRIP_MSGID_PLURAL        MTOOLS_ENABLE_FLOPPYD
-MUST                             MV
-MYSQL_CHARSET                    MYSQL_DATADIR
-MYSQL_EXTRA_CHARSET              MYSQL_GROUP
-MYSQL_USER                       MYSQL_VERSION
-MYSQL_VERSIONS_ACCEPTED          MYSQL_VERSIONS_ALL
-MYSQL_VERSION_DEFAULT            NAGIOSCMD_GROUP
-NAGIOSDIR                        NAGIOS_GROUP
-NAGIOS_USER                      NATIVE_APPEND_ABI
-NATIVE_APPEND_ELF                NATIVE_EXEC_FMT
-NATIVE_MACHINE_PLATFORM          NATIVE_OBJECT_FMT
-NBPAX_PROGRAM_PREFIX             NETBSD_LOGIN_NAME
-NMH_EDITOR                       NMH_MTA
-NMH_PAGER                        NOLOGIN
-NOTE                             NOT_FOR_PLATFORM
-NOT_PAX_ASLR_SAFE                NOT_PAX_MPROTECT_SAFE
-NO_BUILD                         NO_CHECKSUM
-NO_CONFIGURE                     NO_SKIP
-NS_PREFERRED                     NULLMAILER_GROUP
-NULLMAILER_USER                  OASIS
-OASIS_BUILD_ARGS                 OBJHOSTNAME
-OBJMACHINE                       OCAML_FINDLIB_DIRS
-OCAML_FINDLIB_REGISTER           OCAML_FINDLIB_REGISTER_VERBOSE
-OCAML_SITELIBDIR                 OCAML_TOPKG_DOCDIR
-OCAML_USE_DUNE                   OCAML_USE_FINDLIB
-OCAML_USE_JBUILDER               OCAML_USE_OASIS
-OCAML_USE_OASIS_DYNRUN           OCAML_USE_OPAM
-OCAML_USE_OPT_COMPILER           OCAML_USE_TOPKG
-OMF                              ONLY_FOR_COMPILER
-ONLY_FOR_PLATFORM                OPENSSH_CHROOT
-OPENSSH_GROUP                    OPENSSH_USER
-OPSYS                            OPSYS_EMULDIR
-OS                               OSS_TYPE
-OSX                              OSX_TOLERATE_SDK_SKEW
-OS_HAVE_ALSA                     OS_HAVE_RCD
-OS_VARIANT                       OS_VERSION
-OTF_FONTS_DIR                    OVERRIDE_DIRDEPTH
-OVERRIDE_GEMSPEC                 OVERRIDE_GNU_CONFIG_SCRIPTS
-OVERRIDE_ROCKSPEC                OWN_DIRS
-OWN_DIRS_PERMS                   P4GROUP
-P4PORT                           P4ROOT
-P4USER                           PACKAGES
-PALMOS_DEFAULT_SDK               PAMBASE
-PAM_DEFAULT                      PAPERSIZE
-PASSIVE_FETCH                    PATCHDIR
-PATCHFILES                       PATCH_ARGS
-PATCH_DEBUG                      PATCH_DIST_ARGS
-PATCH_DIST_CAT                   PATCH_DIST_STRIP
-PATCH_FUZZ_FACTOR                PATCH_STRIP
-PATH                             PCCBASE
-PEAR                             PEAR_CHANNEL
-PEAR_CHANNEL_ALIAS               PEAR_CHANNEL_VERSION
-PEAR_CMD                         PEAR_LIB
-PEAR_PACKAGE_XML                 PERL5
-PERL5_CONFIGURE                  PERL5_CONFIGURE_DIRS
-PERL5_LDFLAGS                    PERL5_LICENSE
-PERL5_MODULE_TYPE                PERL5_PACKLIST
-PERL5_PACKLIST_DIR               PERL5_PERLBASE
-PERL5_SITEBASE                   PERL5_USE_PACKLIST
-PERL5_VENDORBASE                 PFCTL
-PFVAR_H                          PF_VERSION
-PGGROUP                          PGHOME
-PGPKGSRCDIR                      PGSQL_TYPE
-PGSQL_VERSION                    PGSQL_VERSIONS_ACCEPTED
-PGSQL_VERSION_DEFAULT            PGUSER
-PG_LIB_EXT                       PHP
-PHPCOMMON_MK                     PHPPKGSRCDIR
-PHP_BASE_VERS                    PHP_CHECK_INSTALLED
-PHP_EXTENSION_DIR                PHP_INITIAL_TEENY
-PHP_PKG_PREFIX                   PHP_VERSION
-PHP_VERSIONS_ACCEPTED            PHP_VERSIONS_INCOMPATIBLE
-PHP_VERSION_DEFAULT              PHP_VERSION_REQD
-PILRC_USE_GTK                    PKGCONFIG_BASE
-PKGCONFIG_FILE                   PKGCONFIG_OVERRIDE
-PKGCONFIG_OVERRIDE_STAGE         PKGDIR
-PKGGNUDIR                        PKGINFODIR
-PKGLOCALEDIR                     PKGMANDIR
-PKGNAME                          PKGNAME_REQD
-PKGPATH                          PKGREVISION
-PKGSRC_BLAS_TYPES                PKGSRC_CHANGES
-PKGSRC_COMPILER                  PKGSRC_KEEP_BIN_PKGS
-PKGSRC_LOCKTYPE                  PKGSRC_MAKE_ENV
-PKGSRC_MESSAGE_RECIPIENTS        PKGSRC_MKPIE
-PKGSRC_MKREPRO                   PKGSRC_RUN_TEST
-PKGSRC_SETENV                    PKGSRC_SLEEPSECS
-PKGSRC_TODO                      PKGSRC_USE_CTF
-PKGSRC_USE_FORTIFY               PKGSRC_USE_RELRO
-PKGSRC_USE_SSP                   PKGSRC_USE_STACK_CHECK
-PKGTASKS_DATAFILE                PKGTOOLS_ARGS
-PKGTOOLS_ENV                     PKG_ALTERNATIVES
-PKG_APACHE                       PKG_APACHE_ACCEPTED
-PKG_APACHE_DEFAULT               PKG_BEST_EXISTS
-PKG_BUILD_OPTIONS                PKG_COMPRESSION
-PKG_CONFIG                       PKG_CONFIG_PERMS
-PKG_CREATE_USERGROUP             PKG_DB_TMPDIR
-PKG_DEBUG_LEVEL                  PKG_DEFAULT_OPTIONS
-PKG_DESTDIR_SUPPORT              PKG_DEVELOPER
-PKG_DISABLED_OPTIONS             PKG_FATAL_ERRORS
-PKG_FC                           PKG_FILELIST_CMD
-PKG_GECOS                        PKG_GID
-PKG_GROUPS                       PKG_GROUPS_VARS
-PKG_HOME                         PKG_INIT_SCRIPTS
-PKG_JAVA_HOME                    PKG_JVM
-PKG_JVMS_ACCEPTED                PKG_JVM_DEFAULT
-PKG_LEGACY_OPTIONS               PKG_LIBTOOL
-PKG_OPTIONS                      PKG_OPTIONS_DEPRECATED_WARNINGS
-PKG_OPTIONS_LEGACY_OPTS          PKG_OPTIONS_LEGACY_VARS
-PKG_OPTIONS_NONEMPTY_SETS        PKG_OPTIONS_OPTIONAL_GROUPS
-PKG_OPTIONS_REQUIRED_GROUPS      PKG_OPTIONS_VAR
-PKG_PHP                          PKG_PHP_MAJOR_VERS
-PKG_PHP_VERSION                  PKG_RCD_SCRIPTS
-PKG_REFCOUNT_DBDIR               PKG_REGISTER_SHELLS
-PKG_RESUME_TRANSFERS             PKG_SHELL
-PKG_SUGGESTED_OPTIONS            PKG_SUPPORTED_OPTIONS
-PKG_SYSCONFBASE                  PKG_SYSCONFBASEDIR
-PKG_SYSCONFDIR                   PKG_SYSCONFDIR_PERMS
-PKG_SYSCONFSUBDIR                PKG_SYSCONFVAR
-PKG_TOOLS_BIN                    PKG_UID
-PKG_UPDATE_FONTS_DB              PKG_USERS
-PKG_USERS_VARS                   PKG_VERBOSE
-PLEASE                           PLIST
-PLIST_AWK                        PLIST_AWK_ENV
-PLIST_SRC                        PLIST_SUBST
-PLIST_TYPE                       PLIST_VARS
-POPTOP_USE_MPPE                  POSSIBLE_GFORTRAN_VERSION
-POST_FETCH_HOOK                  PREFER
-PREFER_NATIVE                    PREFER_NATIVE_PTHREADS
-PREFER_PKGSRC                    PREFIX
-PREPEND_PATH                     PRE_ROOT_CMD
-PRIVILEGED_STAGES                PS
-PTHREAD_AUTO_VARS                PTHREAD_CFLAGS
-PTHREAD_LDFLAGS                  PTHREAD_LIBS
-PTHREAD_OPTS                     PTHREAD_TYPE
-PVM_SSH                          PYPKGPREFIX
-PYTHON_FOR_BUILD_ONLY            PYTHON_SELF_CONFLICT
-PYTHON_VERSIONED_DEPENDENCIES    PYTHON_VERSIONS_ACCEPTED
-PYTHON_VERSIONS_INCOMPATIBLE     PYTHON_VERSION_DEFAULT
-PYTHON_VERSION_REQD              PYVERSSUFFIX
-PY_NO_EGG                        QMAILDIR
-QMAIL_ALIAS_USER                 QMAIL_DAEMON_USER
-QMAIL_LOG_USER                   QMAIL_NOFILES_GROUP
-QMAIL_PASSWD_USER                QMAIL_QMAIL_GROUP
-QMAIL_QUEUE_DIR                  QMAIL_QUEUE_EXTRA
-QMAIL_QUEUE_USER                 QMAIL_REMOTE_USER
-QMAIL_ROOT_USER                  QMAIL_SEND_USER
-QPOPPER_FAC                      QPOPPER_SPOOL_DIR
-QPOPPER_USER                     RAKE_NAME
-RASMOL_DEPTH                     RCD_DIR
-RCD_ORDER                        RCD_SCRIPTS
-RCD_SCRIPTS_DIR                  RCD_SCRIPTS_EXAMPLEDIR
-RCD_SCRIPTS_MODE                 RCD_SCRIPTS_SHELL
-RCD_SCRIPT_SRC                   RCD_SUBR
-RDOC                             READLINE_DEFAULT
-READLINE_TYPE                    REAL_ROOT_GROUP
-REAL_ROOT_USER                   RECURSIVE_MAKE
-RELAY_CTRL_DIR                   RELRO_SUPPORTED
-REPLACE_AWK                      REPLACE_BASH
-REPLACE_CSH                      REPLACE_KSH
-REPLACE_PERL                     REPLACE_PERL6
-REPLACE_PHP                      REPLACE_PYTHON
+MKPIE_SUPPORTED                  MLDONKEY_GROUP
+MLDONKEY_HOME                    MLDONKEY_USER
+MONOTONE_GROUP                   MONOTONE_USER
+MOTIFBASE                        MOTIF_TYPE
+MOTIF_TYPE_DEFAULT               MPI_TYPE
+MSGFMT_STRIP_MSGCTXT             MSGFMT_STRIP_MSGID_PLURAL
+MTOOLS_ENABLE_FLOPPYD            MUST
+MV                               MYSQL_CHARSET
+MYSQL_DATADIR                    MYSQL_EXTRA_CHARSET
+MYSQL_GROUP                      MYSQL_USER
+MYSQL_VERSION                    MYSQL_VERSIONS_ACCEPTED
+MYSQL_VERSIONS_ALL               MYSQL_VERSION_DEFAULT
+NAGIOSCMD_GROUP                  NAGIOSDIR
+NAGIOS_GROUP                     NAGIOS_USER
+NATIVE_APPEND_ABI                NATIVE_APPEND_ELF
+NATIVE_EXEC_FMT                  NATIVE_MACHINE_PLATFORM
+NATIVE_OBJECT_FMT                NBPAX_PROGRAM_PREFIX
+NETBSD_LOGIN_NAME                NMH_EDITOR
+NMH_MTA                          NMH_PAGER
+NOLOGIN                          NOTE
+NOT_FOR_PLATFORM                 NOT_PAX_ASLR_SAFE
+NOT_PAX_MPROTECT_SAFE            NO_BUILD
+NO_CHECKSUM                      NO_CONFIGURE
+NO_SKIP                          NS_PREFERRED
+NULLMAILER_GROUP                 NULLMAILER_USER
+OASIS                            OASIS_BUILD_ARGS
+OBJHOSTNAME                      OBJMACHINE
+OCAML_FINDLIB_DIRS               OCAML_FINDLIB_REGISTER
+OCAML_FINDLIB_REGISTER_VERBOSE   OCAML_SITELIBDIR
+OCAML_TOPKG_DOCDIR               OCAML_USE_DUNE
+OCAML_USE_FINDLIB                OCAML_USE_JBUILDER
+OCAML_USE_OASIS                  OCAML_USE_OASIS_DYNRUN
+OCAML_USE_OPAM                   OCAML_USE_OPT_COMPILER
+OCAML_USE_TOPKG                  OMF
+ONLY_FOR_COMPILER                ONLY_FOR_PLATFORM
+OPENSSH_CHROOT                   OPENSSH_GROUP
+OPENSSH_USER                     OPSYS
+OPSYS_EMULDIR                    OS
+OSS_TYPE                         OSX
+OSX_TOLERATE_SDK_SKEW            OS_HAVE_ALSA
+OS_HAVE_RCD                      OS_VARIANT
+OS_VERSION                       OTF_FONTS_DIR
+OVERRIDE_DIRDEPTH                OVERRIDE_GEMSPEC
+OVERRIDE_GNU_CONFIG_SCRIPTS      OVERRIDE_ROCKSPEC
+OWN_DIRS                         OWN_DIRS_PERMS
+P4GROUP                          P4PORT
+P4ROOT                           P4USER
+PACKAGES                         PALMOS_DEFAULT_SDK
+PAMBASE                          PAM_DEFAULT
+PAPERSIZE                        PASSIVE_FETCH
+PATCHDIR                         PATCHFILES
+PATCH_ARGS                       PATCH_DEBUG
+PATCH_DIST_ARGS                  PATCH_DIST_CAT
+PATCH_DIST_STRIP                 PATCH_FUZZ_FACTOR
+PATCH_STRIP                      PATH
+PCCBASE                          PEAR
+PEAR_CHANNEL                     PEAR_CHANNEL_ALIAS
+PEAR_CHANNEL_VERSION             PEAR_CMD
+PEAR_LIB                         PEAR_PACKAGE_XML
+PERL5                            PERL5_CONFIGURE
+PERL5_CONFIGURE_DIRS             PERL5_LDFLAGS
+PERL5_LICENSE                    PERL5_MODULE_TYPE
+PERL5_PACKLIST                   PERL5_PACKLIST_DIR
+PERL5_PERLBASE                   PERL5_SITEBASE
+PERL5_USE_PACKLIST               PERL5_VENDORBASE
+PFCTL                            PFVAR_H
+PF_VERSION                       PGGROUP
+PGHOME                           PGPKGSRCDIR
+PGSQL_TYPE                       PGSQL_VERSION
+PGSQL_VERSIONS_ACCEPTED          PGSQL_VERSION_DEFAULT
+PGUSER                           PG_LIB_EXT
+PHP                              PHPCOMMON_MK
+PHPPKGSRCDIR                     PHP_BASE_VERS
+PHP_CHECK_INSTALLED              PHP_EXTENSION_DIR
+PHP_INITIAL_TEENY                PHP_PKG_PREFIX
+PHP_VERSION                      PHP_VERSIONS_ACCEPTED
+PHP_VERSIONS_INCOMPATIBLE        PHP_VERSION_DEFAULT
+PHP_VERSION_REQD                 PILRC_USE_GTK
+PKGCONFIG_BASE                   PKGCONFIG_FILE
+PKGCONFIG_OVERRIDE               PKGCONFIG_OVERRIDE_STAGE
+PKGDIR                           PKGGNUDIR
+PKGINFODIR                       PKGLOCALEDIR
+PKGMANDIR                        PKGNAME
+PKGNAME_REQD                     PKGPATH
+PKGREVISION                      PKGSRC_BLAS_TYPES
+PKGSRC_CHANGES                   PKGSRC_COMPILER
+PKGSRC_KEEP_BIN_PKGS             PKGSRC_LOCKTYPE
+PKGSRC_MAKE_ENV                  PKGSRC_MESSAGE_RECIPIENTS
+PKGSRC_MKPIE                     PKGSRC_MKREPRO
+PKGSRC_RUN_TEST                  PKGSRC_SETENV
+PKGSRC_SLEEPSECS                 PKGSRC_TODO
+PKGSRC_USE_CTF                   PKGSRC_USE_FORTIFY
+PKGSRC_USE_RELRO                 PKGSRC_USE_SSP
+PKGSRC_USE_STACK_CHECK           PKGTASKS_DATAFILE
+PKGTOOLS_ARGS                    PKGTOOLS_ENV
+PKG_ALTERNATIVES                 PKG_APACHE
+PKG_APACHE_ACCEPTED              PKG_APACHE_DEFAULT
+PKG_BEST_EXISTS                  PKG_BUILD_OPTIONS
+PKG_COMPRESSION                  PKG_CONFIG
+PKG_CONFIG_PERMS                 PKG_CREATE_USERGROUP
+PKG_DB_TMPDIR                    PKG_DEBUG_LEVEL
+PKG_DEFAULT_OPTIONS              PKG_DESTDIR_SUPPORT
+PKG_DEVELOPER                    PKG_DISABLED_OPTIONS
+PKG_FATAL_ERRORS                 PKG_FC
+PKG_FILELIST_CMD                 PKG_GECOS
+PKG_GID                          PKG_GROUPS
+PKG_GROUPS_VARS                  PKG_HOME
+PKG_INIT_SCRIPTS                 PKG_JAVA_HOME
+PKG_JVM                          PKG_JVMS_ACCEPTED
+PKG_JVM_DEFAULT                  PKG_LEGACY_OPTIONS
+PKG_LIBTOOL                      PKG_OPTIONS
+PKG_OPTIONS_DEPRECATED_WARNINGS  PKG_OPTIONS_LEGACY_OPTS
+PKG_OPTIONS_LEGACY_VARS          PKG_OPTIONS_NONEMPTY_SETS
+PKG_OPTIONS_OPTIONAL_GROUPS      PKG_OPTIONS_REQUIRED_GROUPS
+PKG_OPTIONS_VAR                  PKG_PHP
+PKG_PHP_MAJOR_VERS               PKG_PHP_VERSION
+PKG_RCD_SCRIPTS                  PKG_REFCOUNT_DBDIR
+PKG_REGISTER_SHELLS              PKG_RESUME_TRANSFERS
+PKG_SHELL                        PKG_SUGGESTED_OPTIONS
+PKG_SUPPORTED_OPTIONS            PKG_SYSCONFBASE
+PKG_SYSCONFBASEDIR               PKG_SYSCONFDIR
+PKG_SYSCONFDIR_PERMS             PKG_SYSCONFSUBDIR
+PKG_SYSCONFVAR                   PKG_TOOLS_BIN
+PKG_UID                          PKG_UPDATE_FONTS_DB
+PKG_USERS                        PKG_USERS_VARS
+PKG_VERBOSE                      PLEASE
+PLIST                            PLIST_AWK
+PLIST_AWK_ENV                    PLIST_SRC
+PLIST_SUBST                      PLIST_TYPE
+PLIST_VARS                       POPTOP_USE_MPPE
+POSSIBLE_GFORTRAN_VERSION        POST_FETCH_HOOK
+PREFER                           PREFER_NATIVE
+PREFER_NATIVE_PTHREADS           PREFER_PKGSRC
+PREFIX                           PREPEND_PATH
+PRE_ROOT_CMD                     PRIVILEGED_STAGES
+PS                               PTHREAD_AUTO_VARS
+PTHREAD_CFLAGS                   PTHREAD_LDFLAGS
+PTHREAD_LIBS                     PTHREAD_OPTS
+PTHREAD_TYPE                     PVM_SSH
+PYPKGPREFIX                      PYTHON_FOR_BUILD_ONLY
+PYTHON_SELF_CONFLICT             PYTHON_VERSIONED_DEPENDENCIES
+PYTHON_VERSIONS_ACCEPTED         PYTHON_VERSIONS_INCOMPATIBLE
+PYTHON_VERSION_DEFAULT           PYTHON_VERSION_REQD
+PYVERSSUFFIX                     PY_NO_EGG
+QMAILDIR                         QMAIL_ALIAS_USER
+QMAIL_DAEMON_USER                QMAIL_LOG_USER
+QMAIL_NOFILES_GROUP              QMAIL_PASSWD_USER
+QMAIL_QMAIL_GROUP                QMAIL_QUEUE_DIR
+QMAIL_QUEUE_EXTRA                QMAIL_QUEUE_USER
+QMAIL_REMOTE_USER                QMAIL_ROOT_USER
+QMAIL_SEND_USER                  QPOPPER_FAC
+QPOPPER_SPOOL_DIR                QPOPPER_USER
+RAKE_NAME                        RASMOL_DEPTH
+RCD_DIR                          RCD_ORDER
+RCD_SCRIPTS                      RCD_SCRIPTS_DIR
+RCD_SCRIPTS_EXAMPLEDIR           RCD_SCRIPTS_MODE
+RCD_SCRIPTS_SHELL                RCD_SCRIPT_SRC
+RCD_SUBR                         RDOC
+READLINE_DEFAULT                 READLINE_TYPE
+REAL_ROOT_GROUP                  REAL_ROOT_USER
+RECURSIVE_MAKE                   RELAY_CTRL_DIR
+RELRO_SUPPORTED                  REPLACE_AWK
+REPLACE_BASH                     REPLACE_CSH
+REPLACE_KSH                      REPLACE_PERL
+REPLACE_PERL6                    REPLACE_PHP
+REPLACE_PYTHON                   REPLACE_R
 REPLACE_RUBY                     REPLACE_RUBY_DIRS
 REPLACE_RUBY_PAT                 REPLACE_SH
 REPLACE_TEXLUA                   REQD_DIRS
@@ -9838,16 +10241,16 @@ warnx                            wattr_o
 wattr_on                         work
 wrapper                          wrkdir
 
-Appendix E. Editing guidelines for the pkgsrc guide
+Appendix F. Editing guidelines for the pkgsrc guide
 
 Table of Contents
 
-E.1. Make targets
-E.2. Procedure
+F.1. Make targets
+F.2. Procedure
 
 This section contains information on editing the pkgsrc guide itself.
 
-E.1. Make targets
+F.1. Make targets
 
 The pkgsrc guide's source code is stored in pkgsrc/doc/guide/files, and several
 files are created from it:
@@ -9864,7 +10267,7 @@ files are created from it:
   * https://www.NetBSD.org/docs/pkgsrc/pkgsrc.ps: PostScript version of the
     pkgsrc guide.
 
-E.2. Procedure
+F.2. Procedure
 
 The procedure to edit the pkgsrc guide is:
 



Home | Main Index | Thread Index | Old Index