same about the commit message

the commit message, should clarify the consistency purpose imho.

agreed with @emaste on the why I personnally find rule_is_valid easier to understand then rule_applies, but still find rule_applies clear enough so I am ok with the change itself

This approach is very intrusive and I don't think the is the right approach, the right one is do mark the binary which are not protmax or wx=0 friendly.
Log ago I have written this: https://reviews.freebsd.org/D43168 for aslr, I think the same approach should be taken for the other security features and it should not be done as wildly as this propose.

Fixes make check-plist

now it works for real!

Fix: BRANCH_EXT was not define when PKG_VERSION is specified from command line
which is always the case during make update-package

note after some testing this is still wrong :(

new attempt

oh thank you for opening my eyes, the error is obvious now I should be able to fix tomorrow

I don't understand why BRANCH_EXT is empty in your case, are you just invoking make update-packages or do you have more in your command line and env?

fix BRANCH_EXT_FROM on current

committed as rG88a198af3c20730f638a60aa699f4d5aa1650512

there are good chances they do apply ;)

fix issue reported by @0mp

about the rc script, powerd even before this patches can be started before devd, it has a retry mechanism to be able to connect to it once devd is up.