@des: what's the correct path for pam modules installed from ports? ${PREFIX}/lib or ${PREFIX}/lib/security ?

There is also D50108 implementing RFC 8981, I think these 2 patches can be reviewed together, at least the part of getting an interface identifier, as suggested in RFC 8981 3.3.2.

In D50239#1146150, @aokblast wrote:

There is no change. See pam.conf(5).

The module-path field specifies the name or full path of the module to
     call.  If only the name is specified, the PAM library will search for it
     in the following locations:

     1.   /usr/lib

     2.   /usr/local/lib

Then use git blame

git blame contrib/openpam/doc/man/pam.conf.5

It shows these line is added from import of 2013 pam module

I found that currently all the pam_* ports install pam_*.so under lib/security/, perhaps we also need to check if the behavior of openpam has been changed.

FreeBSD uses a list derived from ISO 3166 [1], which is at src/share/misc/iso3166. It would be nice if we can have this enum generated from that list so we have a single source of truth.

Speaking of using /tmp, is it possible to have a variable serves as a prefix? In the building machines, we don't have infinite /tmp space for many jobs running in parallel.

I think the current idea is avoiding directly import firmware file into repo. Perhaps we can separate the firmware out. The current approach is using firmware ports/pkg, before having that, we can just put it somewhere and ask people to grab it and put to the required place, for testing.

Is there a target to extract the test reports from meta disk of the VM to the host?

I don't know the exact policy, but my personal feeling is that for format/typo changes, I don't bump the date.
If this is for bumping a previous content editing without bumping the date, that it's fine.

Tested by: lwhsu

I'm good for letting these tests get skipped in CI for now, in the long term I still hope we can depend on local service instead of external dependency, as mentioned in D49594#1131294

In D49594#1131311, @igoro wrote:

In D49594#1131294, @lwhsu wrote:

I am happy to see allow_network_access feature has been added to the test framework. I believe it would be useful in some cases that network access is mandatory. However, in the case of DNS resolving, I suggest we just using the built-in local unbound for a simple local resolver to serve the test needs.

Fortunately, it does not need any specific implementation, we just name it and use it. This patch simply makes it officially documented. I guess the goal was to remove those CI test fails as soon as possible. Yes, there is an opportunity to revise the tests.

Sorry for being late to this (well, the window is quite short and I have been busy with other things recently...)

D49528 for removing date -v

I think that part uses ${START_DATE} and ${EXPIRY_DATE} can be removed and switch to newer publishing method. Let me modify Makefile.azure

I believe that we also want to add him to contrib-develalumni.adoc

In D49061#1121430, @yklaxds_gmail.com wrote:

I have already talked with Li-Wen. If there are no issues, please help merge it.