Please skip the change for security/ipsec-tools as was already applied and then reverted: the change breaks upgrade path from previous version like 9.x or 10.x or 11.0 because they do no have ipsec.ko as a module.

I agree that snprintf() should be avoided here, as well as stack abuse. Please consider using asprintf() that allocated memory on heap all by itself dealing with space requirements automatically, just free the pointer just after posix_spawnp().

In D26447#664154, @gnn wrote:

Now that this review has devolved to the point of discussing democracy, rather than the deprecation of a piece of long surviving, but, inherently insecure code in our base system, it's time for people to step back from their keyboards and realize that removing this from base does not make it impossible to install or use, it simply reduces the default attack surface of our system. So, let's let emaste put this deprecation in for 14, and move on.

Please keep ftp and telnet clients and servers in base system. Removing violates POLA and does not buy anything. Servers already disables by default.

Sorry for the mess, my latest actions on this differential were unintentional, some problems with old Firefox.

CCing Roman Kurakin (ce(4)) and Serge Vakulenko (cp(4)), see later.

I'm going to commit this soon unless an objection is raised.

My goal is to improve performance by default not requiring any user actions while not breaking things same time. Both GNU binutils version of strip(1) and our version from contrib/elftoolchain/elfcopy support -o, so there would be no slowdown but improvement for all supported branches. However, install(1) could be used in some strange environment for cases other than "installworld" and I don't want it to break there making regression.

Thanks, I've fixed this.

Use: strip -o to_name -- from_name

Thanks!

Correct wording in the manual page.

I'm going to commit this soon unless an objection is raised.

In D25029#552845, @lutz_donnerhacke.de wrote:

If I understand correctly

ifconfig -a -g lagg -G lagg*1

will match all lagg interfaces besides those ending in 1.

But

ifconfig -a -g lagg -g vlan

will match vlan interfaces only.

Correct?

Add explicit note to the manual page that additional options -g override previous ones, same for -G.

Fix case when none of -g nor -G is specified that was broken with addition of second option.

Do not use prefix to negate condition. Instead, use new flag -G and allow user to specify both -g and -G same time.

In D25029#552131, @lutz_donnerhacke.de wrote:

"^" does look like an regex starting point and will cause confusion: "Why is '-g la.*2[345]' not working?"

In D25029#551705, @ae wrote:

You can just use another option name to specify excludes.

Compactify code a bit.

Fix misprint that somehow passed testing.

Kernel side asprintf() uses M_NOWAIT internally and may return -1 on memory allocation failure. It would need a check.