diff --git a/share/mk/local.dirdeps-options.mk b/share/mk/local.dirdeps-options.mk
index 9ad08a78cb19..87af1604c4e4 100644
--- a/share/mk/local.dirdeps-options.mk
+++ b/share/mk/local.dirdeps-options.mk
@@ -1,28 +1,28 @@
 # $FreeBSD$
 
 # avoid duplication
 DIRDEPS.AUDIT.yes= lib/libbsm
 DIRDEPS.BLACKLIST_SUPPORT.yes+= lib/libblacklist
 DIRDEPS.CASPER.yes+= lib/libcasper/libcasper
 DIRDEPS.GSSAPI.yes+= lib/libgssapi
 DIRDEPS.JAIL.yes+= lib/libjail
 DIRDEPS.KERBEROS_SUPPORT.yes+= \
 	kerberos5/lib/libasn1 \
 	kerberos5/lib/libheimbase \
 	kerberos5/lib/libheimipcc \
 	kerberos5/lib/libhx509 \
 	kerberos5/lib/libkrb5 \
 	kerberos5/lib/libroken \
 	kerberos5/lib/libwind
 
 DIRDEPS.NIS.yes+= \
 	include/rpc \
 	include/rpcsvc \
 	lib/librpcsvc
 
 DIRDEPS.OPENSSL.yes+= secure/lib/libcrypto
 DIRDEPS.OPENSSL.no+= lib/libmd
 DIRDEPS.PAM_SUPPORT.yes+= lib/libpam/libpam
 DIRDEPS.TCP_WRAPPERS.yes+= lib/libwrap
 
-
+.-include <site.dirdeps-options.mk>
diff --git a/share/mk/local.dirdeps.mk b/share/mk/local.dirdeps.mk
index 16c9ee5a55ec..d7e5396c81ed 100644
--- a/share/mk/local.dirdeps.mk
+++ b/share/mk/local.dirdeps.mk
@@ -1,219 +1,221 @@
 # $FreeBSD$
 .if !target(_DIRDEP_USE)
 # we are the 1st makefile
 
 .if !defined(MK_CLANG)
 .include "${SRCTOP}/share/mk/src.opts.mk"
 .endif
 
 # making universe is special
 .if defined(UNIVERSE_GUARD)
 # these should be done by now
 DIRDEPS_FILTER+= N*.host
 .endif
 
 # pseudo machines get no qualification
 .for m in host common
 M_dep_qual_fixes += C;($m),[^/.,]*$$;\1;
 .endfor
 #.info M_dep_qual_fixes=${M_dep_qual_fixes}
 
 # Cheat for including src.libnames.mk
 __<bsd.init.mk>__:
 # Pull in _INTERNALLIBS
 .include <src.libnames.mk>
 
 # Host libraries should mostly be excluded from the build so the
 # host version in /usr/lib is used.  Internal libraries need to be
 # allowed to be built though since they are never installed.
 _need_host_libs=
 .for lib in ${_INTERNALLIBS}
 _need_host_libs+= ${LIB${lib:tu}DIR:S,^${OBJTOP}/,,}
 .endfor
 
 N_host_libs:= ${cd ${SRCTOP} && echo lib/lib*:L:sh:${_need_host_libs:${M_ListToSkip}}:${M_ListToSkip}}
 DIRDEPS_FILTER.host = \
 	${N_host_libs} \
 	Ninclude* \
 	Nlib/csu* \
 	Nlib/libc \
 	Nlib/[mn]* \
 	Ngnu/lib/lib[a-r]* \
 	Nsecure/lib* \
 	Nusr.bin/xinstall* \
 
 
 DIRDEPS_FILTER+= \
 	Nbin/cat.host \
 	${DIRDEPS_FILTER.xtras:U}
 
 # Cleanup a buildworld's WORLDTMP so that any files generated from it
 # or using it will rebuild with the DIRDEPS SYSROOT.  Otherwise existing
 # object .meta files may still reference those directories and not be
 # rebuilt and lead to incorrect Makefile.depend files due to lack of
 # .dirdep files.
 .if !defined(NO_CLEANUP_WORLDTMP) && exists(${OBJTOP}/tmp/_worldtmp)
 cleanup_worldtmp: .PHONY .NOMETA
 	@echo "Cleaning leftover WORLDTMP from buildworld."
 	-rm -rf ${OBJTOP}/tmp/*
 	-chflags -R 0 ${OBJTOP}/tmp/*
 	rm -rf ${OBJTOP}/tmp
 beforedirdeps: cleanup_worldtmp
 .endif
 .endif
 
 # reset this each time
 DIRDEPS_FILTER.xtras=
 .if ${DEP_MACHINE:Npkgs*} != ""
 DIRDEPS_FILTER.xtras+= Nusr.bin/clang/clang.host
 .endif
 
 .if ${DEP_MACHINE} != "host"
 
 # this is how we can handle optional dependencies
 .if ${DEP_RELDIR} == "lib/libc"
 DIRDEPS += lib/libc_nonshared
 .if ${MK_SSP:Uno} != "no" 
 DIRDEPS += lib/libssp_nonshared
 .endif
 .else
 DIRDEPS_FILTER.xtras+= Nlib/libc_nonshared
 .endif
 
 # some optional things
 .if ${MK_CTF} == "yes" && ${DEP_RELDIR:Mcddl/usr.bin/ctf*} == ""
 DIRDEPS += \
 	cddl/usr.bin/ctfconvert.host \
 	cddl/usr.bin/ctfmerge.host
 .endif
 
 # Add in proper libgcc (gnu or LLVM) if not building libcc and libc is needed.
 # Add both gcc_s and gcc_eh as dependencies as the decision to build
 # -static or not is not known here.
 .if ${DEP_RELDIR:M*libgcc*} == "" && ${DIRDEPS:U:Mlib/libc} != ""
 DIRDEPS+= \
 	lib/libgcc_eh \
 	lib/libgcc_s
 .endif
 
 # Bootstrap support.  Give hints to DIRDEPS if there is no Makefile.depend*
 # generated yet.  This can be based on things such as SRC files and LIBADD.
 # These hints will not factor into the final Makefile.depend as only what is
 # used will be added in and handled via [local.]gendirdeps.mk.  This is not
 # done for MACHINE=host builds.
 # XXX: Include this in local.autodep.mk as well for gendirdeps without filemon.
 # Only do this for main build target
 .if ${RELDIR} == ${DEP_RELDIR} && !defined(_RECURSING_PROGS)
 .for _depfile in ${.MAKE.DEPENDFILE_PREFERENCE:T}
 .if !defined(_have_depfile) && exists(${.CURDIR}/${_depfile})
 _have_depfile=
 .endif
 .endfor
 .if !defined(_have_depfile)
 # KMOD does not use any stdlibs.
 .if !defined(KMOD)
 # Gather PROGS dependencies first
 .if !empty(PROGS)
 _PROGS_LIBADD=
 _PROGS_DPADD=
 _PROGS_SRCS=
 .for _prog in ${PROGS}
 .for s in . _
 .if !empty(LIBADD${s}${_prog})
 _PROGS_LIBADD+=	${LIBADD${s}${_prog}}
 .endif
 .if !empty(DPADD${s}${_prog})
 _PROGS_DPADD+=	${DPADD${s}${_prog}}
 .endif
 .if !empty(SRCS${s}${_prog})
 _PROGS_SRCS+=	${SRCS${s}${_prog}}
 .endif
 .endfor	# .for s in . _
 # Add in assumed source (bsd.prog.mk)
 .if !target(${_prog})
 .if defined(PROG_CXX)
 _PROGS_SRCS+=	${_prog}.cc
 .else
 _PROGS_SRCS+=	${_prog}.c
 .endif
 .endif	# !target(${_prog})
 .endfor	# .for _prog in ${PROGS}
 .endif	# !empty(PROGS)
 _SRCS= ${SRCS} ${_PROGS_SRCS}
 
 # Has C files. The C_DIRDEPS are shared with C++ files as well.
 C_DIRDEPS= \
 	include \
 	include/arpa \
 	include/protocols \
 	include/rpc  \
 	include/rpcsvc \
 	include/xlocale \
 	lib/${CSU_DIR} \
 	lib/libc \
 	lib/libcompiler_rt \
 
 # libgcc is needed as well but is added later.
 
 .if ${MK_GSSAPI} != "no"
 C_DIRDEPS+=  include/gssapi
 .endif
 
 .if !empty(_SRCS:M*.c)
 DIRDEPS+= ${C_DIRDEPS}
 .endif
 # Has C++ files
 .if !empty(_SRCS:M*.cc) || !empty(_SRCS:M*.C) || !empty(_SRCS:M*.cpp) || \
     !empty(_SRCS:M*.cxx)
 DIRDEPS+= ${C_DIRDEPS}
 .if ${MK_CLANG} == "yes"
 DIRDEPS+= lib/libc++ lib/libcxxrt
 .endif
 # XXX: Clang and GCC always adds -lm currently, even when not needed.
 DIRDEPS+= lib/msun
 .endif	# CXX
 .endif	# !defined(KMOD)
 # Has yacc files.
 .if !empty(_SRCS:M*.y)
 DIRDEPS+=	usr.bin/yacc.host
 .endif
 _DPADD= ${DPADD} ${_PROGS_DPADD}
 .if !empty(_DPADD)
 # This only works for DPADD with full OBJ/SRC paths, which is mostly just
 # _INTERNALLIBS.
 _DP_DIRDEPS= \
 	${_DPADD:O:u:M${OBJTOP}*:H:N.:tA:C,${OBJTOP}[^/]*/,,:N.:O:u} \
 	${_DPADD:O:u:M${OBJROOT}*:N${OBJTOP}*:N${STAGE_ROOT}/*:H:S,${OBJROOT},,:C,^([^/]+)/(.*),\2.\1,:S,${HOST_TARGET}$,host,:N.*:O:u}
 # Resolve the paths to RELDIRs
 .if !empty(_DP_DIRDEPS)
 DIRDEPS+= ${_DP_DIRDEPS:C,^,${SRCTOP}/,:tA:C,^${SRCTOP}/,,}
 .endif
 .endif	# !empty(DPADD)
 _ALL_LIBADD= ${LIBADD} ${_PROGS_LIBADD}
 .if !empty(_ALL_LIBADD)
 # Also handle LIBADD for non-internal libraries.
 .for _lib in ${_ALL_LIBADD:O:u}
 _lib${_lib}reldir= ${LIB${_lib:tu}DIR:C,${OBJTOP}/,,}
 .if defined(LIB${_lib:tu}DIR) && ${DIRDEPS:M${_lib${_lib}reldir}} == "" && \
     exists(${SRCTOP}/${_lib${_lib}reldir})
 DIRDEPS+= ${_lib${_lib}reldir}
 .endif
 .endfor
 .endif	# !empty(LIBADD)
 .endif	# no Makefile.depend*
 .endif	# ${RELDIR} == ${DEP_RELDIR}
 
 .endif	# ${DEP_MACHINE} != "host"
 
 .if ${MK_STAGING} == "yes"
 # we need targets/pseudo/stage to prep the stage tree
 .if ${DEP_RELDIR} != "targets/pseudo/stage"
 DIRDEPS += targets/pseudo/stage
 .endif
 .endif
 
 DEP_MACHINE_ARCH = ${MACHINE_ARCH.${DEP_MACHINE}}
 CSU_DIR.${DEP_MACHINE_ARCH} ?= csu/${DEP_MACHINE_ARCH}
 CSU_DIR := ${CSU_DIR.${DEP_MACHINE_ARCH}}
 BOOT_MACHINE_DIR:= ${BOOT_MACHINE_DIR.${DEP_MACHINE}}
 KERNEL_NAME:= ${KERNEL_NAME.${DEP_MACHINE}}
+
+.-include <site.dirdeps.mk>
diff --git a/share/mk/local.init.mk b/share/mk/local.init.mk
index 29a951a6aac0..c8072004697f 100644
--- a/share/mk/local.init.mk
+++ b/share/mk/local.init.mk
@@ -1,40 +1,41 @@
 # $FreeBSD$
 
 .if !target(__${_this}__)
 __${_this}__:
 
 .if ${.MAKE.MODE:Mmeta*} != ""
 .if !empty(SUBDIR) && !defined(LIB) && !defined(PROG) && ${.MAKE.MAKEFILES:M*bsd.prog.mk} == ""
 .if ${.MAKE.MODE:Mleaf*} != ""
 # we only want leaf dirs to build in meta mode... and we are not one
 .MAKE.MODE = normal
 .endif
 .endif
 .endif
 
 # XXX: This should be combined with external compiler support in Makefile.inc1
 # and local.meta.sys.mk (CROSS_TARGET_FLAGS)
 .if ${MK_SYSROOT} == "yes" && !empty(SYSROOT) && ${MACHINE} != "host"
 CFLAGS_LAST+= --sysroot=${SYSROOT}
 CXXFLAGS_LAST+= --sysroot=${SYSROOT}
 LDADD+= --sysroot=${SYSROOT}
 .elif ${MK_STAGING} == "yes"
 CFLAGS+= -isystem ${STAGE_INCLUDEDIR}
 # XXX: May be needed for GCC to build with libc++ rather than libstdc++. See Makefile.inc1
 #CXXFLAGS+= -std=gnu++11
 #LDADD+= -L${STAGE_LIBDIR}/libc++
 #CXXFLAGS+= -I${STAGE_INCLUDEDIR}/usr/include/c++/v1
 LDADD+= -L${STAGE_LIBDIR}
 .endif
 
 .if ${MACHINE} == "host"
 .if ${.MAKE.DEPENDFILE:E} != "host"
 UPDATE_DEPENDFILE?= no
 .endif
 HOST_CFLAGS+= -DHOSTPROG
 CFLAGS+= ${HOST_CFLAGS}
 .endif
 
 .-include "src.init.mk"
+.-include <site.init.mk>
 .-include "${.CURDIR}/local.init.mk"
 .endif
diff --git a/share/mk/local.meta.sys.mk b/share/mk/local.meta.sys.mk
index 075a84fb67de..fc28b83d82cc 100644
--- a/share/mk/local.meta.sys.mk
+++ b/share/mk/local.meta.sys.mk
@@ -1,260 +1,263 @@
 # $FreeBSD$
 
 # local configuration specific to meta mode
 # XXX some of this should be in meta.sys.mk
 # we assume that MK_DIRDEPS_BUILD=yes
 
 # we need this until there is an alternative
 MK_INSTALL_AS_USER= yes
 
 .if !defined(HOST_TARGET) || !defined(HOST_MACHINE)
 # we need HOST_TARGET etc below.
 .include <host-target.mk>
 .export HOST_TARGET
 .endif
 
 # from src/Makefile (for universe)
 TARGET_ARCHES_arm?=     arm armv6 armv7
 TARGET_ARCHES_arm64?=   aarch64
 TARGET_ARCHES_powerpc?= powerpc powerpc64 powerpc64le powerpcspe
 TARGET_ARCHES_riscv?=   riscv64 riscv64sf
 
 # some corner cases
 BOOT_MACHINE_DIR.amd64 = boot/i386
 MACHINE_ARCH.host = ${_HOST_ARCH}
 
 # the list of machines we support
 ALL_MACHINE_LIST?= amd64 arm arm64 i386 powerpc riscv
+
+.-include <site.meta.sys.mk>
+
 .for m in ${ALL_MACHINE_LIST:O:u}
 MACHINE_ARCH_LIST.$m?= ${TARGET_ARCHES_${m}:U$m}
 MACHINE_ARCH.$m?= ${MACHINE_ARCH_LIST.$m:[1]}
 BOOT_MACHINE_DIR.$m ?= boot/$m
 .endfor
 
 .ifndef _TARGET_SPEC
 .if empty(MACHINE_ARCH)
 .if !empty(TARGET_ARCH)
 MACHINE_ARCH= ${TARGET_ARCH}
 .else
 MACHINE_ARCH= ${MACHINE_ARCH.${MACHINE}}
 .endif
 .endif
 MACHINE_ARCH?= ${MACHINE_ARCH.${MACHINE}}
 MACHINE_ARCH:= ${MACHINE_ARCH}
 .else
 # we got here via dirdeps
 MACHINE_ARCH:= ${MACHINE_ARCH.${MACHINE}}
 .endif
 
 # now because for universe we want to potentially
 # build for multiple MACHINE_ARCH per MACHINE
 # we need more than MACHINE in TARGET_SPEC
 TARGET_SPEC_VARS= MACHINE MACHINE_ARCH
 # see dirdeps.mk
 .if ${TARGET_SPEC:Uno:M*,*} != ""
 _tspec := ${TARGET_SPEC:S/,/ /g}
 MACHINE := ${_tspec:[1]}
 MACHINE_ARCH := ${_tspec:[2]}
 # etc.
 # We need to stop that TARGET_SPEC affecting any submakes
 # and deal with MACHINE=${TARGET_SPEC} in the environment.
 TARGET_SPEC=
 # export but do not track
 .export-env TARGET_SPEC 
 .export ${TARGET_SPEC_VARS}
 .for v in ${TARGET_SPEC_VARS:O:u}
 .if empty($v)
 .undef $v
 .endif
 .endfor
 .endif
 # make sure we know what TARGET_SPEC is
 # as we may need it to find Makefile.depend*
 TARGET_SPEC = ${TARGET_SPEC_VARS:@v@${$v:U}@:ts,}
 
 # to be consistent with src/Makefile just concatenate with '.'s
 TARGET_OBJ_SPEC:= ${TARGET_SPEC:S;,;.;g}
 OBJTOP:= ${OBJROOT}${TARGET_OBJ_SPEC}
 
 .if defined(MAKEOBJDIR)
 .if ${MAKEOBJDIR:M/*} == ""
 .error Cannot use MAKEOBJDIR=${MAKEOBJDIR}${.newline}Unset MAKEOBJDIR to get default:  MAKEOBJDIR='${_default_makeobjdir}'
 .endif
 .endif
 
 HOST_OBJTOP ?= ${OBJROOT}${HOST_TARGET}
 
 .if ${OBJTOP} == ${HOST_OBJTOP} || ${REQUESTED_MACHINE:U${MACHINE}} == "host"
 MACHINE= host
 .if ${TARGET_MACHINE:Uno} == ${HOST_TARGET}
 # not what we want
 TARGET_MACHINE= host
 .endif
 .endif
 .if ${MACHINE} == "host"
 OBJTOP := ${HOST_OBJTOP}
 .endif
 
 .if ${.MAKE.LEVEL} == 0 || empty(PYTHON)
 PYTHON ?= /usr/local/bin/python
 .export PYTHON
 # _SKIP_BUILD is not 100% as it requires wrapping all 'all:' targets to avoid
 # building in MAKELEVEL0.  Just prohibit 'all' entirely in this case to avoid
 # problems.
 .if ${MK_DIRDEPS_BUILD} == "yes" && ${.MAKE.LEVEL} == 0
 .MAIN: dirdeps
 .if make(all)
 .error DIRDEPS_BUILD: Please run '${MAKE}' instead of '${MAKE} all'.
 .endif
 .endif
 .endif
 
 # we want to end up with a singe stage tree for all machines
 .if ${MK_STAGING} == "yes"
 .if empty(STAGE_ROOT)
 STAGE_ROOT?= ${OBJROOT}stage
 .export STAGE_ROOT
 .endif
 .endif
 
 .if ${MK_STAGING} == "yes"
 .if ${MACHINE} == "host"
 STAGE_MACHINE= ${HOST_TARGET}
 .else
 STAGE_MACHINE:= ${TARGET_OBJ_SPEC}
 .endif
 STAGE_OBJTOP:= ${STAGE_ROOT}/${STAGE_MACHINE}
 STAGE_COMMON_OBJTOP:= ${STAGE_ROOT}/common
 STAGE_TARGET_OBJTOP:= ${STAGE_ROOT}/${TARGET_OBJ_SPEC}
 STAGE_HOST_OBJTOP:= ${STAGE_ROOT}/${HOST_TARGET}
 # These are exported for hooking in out-of-tree builds.  They will always
 # be overridden in sub-makes above when building in-tree.
 .if ${.MAKE.LEVEL} > 0
 .export STAGE_OBJTOP STAGE_TARGET_OBJTOP STAGE_HOST_OBJTOP
 .endif
 
 # Use tools/install.sh which can avoid the need for xinstall for simple cases.
 INSTALL?=	sh ${SRCTOP}/tools/install.sh
 # This is for stage-install to pickup from the environment.
 REAL_INSTALL:=	${INSTALL}
 .export REAL_INSTALL
 STAGE_INSTALL=	sh ${.PARSEDIR:tA}/stage-install.sh OBJDIR=${.OBJDIR:tA}
 
 STAGE_LIBDIR= ${STAGE_OBJTOP}${_LIBDIR:U${LIBDIR:U/lib}}
 STAGE_INCLUDEDIR= ${STAGE_OBJTOP}${INCLUDEDIR:U/usr/include}
 # this is not the same as INCLUDEDIR
 STAGE_INCSDIR= ${STAGE_OBJTOP}${INCSDIR:U/include}
 # the target is usually an absolute path
 STAGE_SYMLINKS_DIR= ${STAGE_OBJTOP}
 
 #LDFLAGS_LAST+= -Wl,-rpath-link,${STAGE_LIBDIR}
 .if ${MK_SYSROOT} == "yes"
 SYSROOT?= ${STAGE_OBJTOP}
 .else
 LDFLAGS_LAST+= -L${STAGE_LIBDIR}
 .endif
 
 .endif				# MK_STAGING
 
 .-include "local.toolchain.mk"
 
 # this is sufficient for most of the tree.
 .MAKE.DEPENDFILE_DEFAULT = ${.MAKE.DEPENDFILE_PREFIX}
 
 # but if we have a machine qualified file it should be used in preference
 .MAKE.DEPENDFILE_PREFERENCE = \
 	${.MAKE.DEPENDFILE_PREFIX}.${MACHINE} \
 	${.MAKE.DEPENDFILE_PREFIX}
 
 .undef .MAKE.DEPENDFILE
 
 .include "sys.dependfile.mk"
 
 .if ${.MAKE.LEVEL} > 0 && ${MACHINE} == "host" && ${.MAKE.DEPENDFILE:E} != "host"
 # we can use this but should not update it.
 UPDATE_DEPENDFILE= NO
 .endif
 # Don't require filemon for makeman.
 .if make(showconfig)
 UPDATE_DEPENDFILE= NO
 .endif
 
 # define the list of places that contain files we are responsible for
 .MAKE.META.BAILIWICK = ${SB} ${OBJROOT} ${STAGE_ROOT}
 
 CSU_DIR.${MACHINE_ARCH} ?= csu/${MACHINE_ARCH}
 CSU_DIR := ${CSU_DIR.${MACHINE_ARCH}}
 
 .if !empty(TIME_STAMP)
 TRACER= ${TIME_STAMP} ${:U}
 .endif
 .if !defined(_RECURSING_PROGS) && !defined(_RECURSING_CRUNCH) && \
     !make(print-dir)
 WITH_META_STATS= t
 .endif
 
 # toolchains can be a pain - especially bootstrappping them
 .if ${MACHINE} == "host"
 MK_SHARED_TOOLCHAIN= no
 .endif
 TOOLCHAIN_VARS=	AS AR CC CLANG_TBLGEN CXX CPP LD NM OBJCOPY RANLIB \
 		STRINGS SIZE LLVM_TBLGEN
 _toolchain_bin_CLANG_TBLGEN=	/usr/bin/clang-tblgen
 _toolchain_bin_LLVM_TBLGEN=	/usr/bin/llvm-tblgen
 _toolchain_bin_CXX=		/usr/bin/c++
 .ifdef WITH_TOOLSDIR
 TOOLSDIR?= ${HOST_OBJTOP}/tools
 .elif defined(STAGE_HOST_OBJTOP)
 TOOLSDIR?= ${STAGE_HOST_OBJTOP}
 .endif
 # Only define if it exists in case user didn't run bootstrap-tools.  Otherwise
 # the tool will be built during the build.  Building it assumes it is
 # TARGET==MACHINE.
 .if exists(${HOST_OBJTOP}/tools${.CURDIR})
 BTOOLSPATH= ${HOST_OBJTOP}/tools${.CURDIR}
 .endif
 
 # Don't use the bootstrap tools logic on itself.
 .if ${.TARGETS:Mbootstrap-tools} == "" && \
     !make(test-system-*) && !make(showconfig) && !make(print-dir) && \
     !defined(BOOTSTRAPPING_TOOLS) && !empty(TOOLSDIR) && ${.MAKE.LEVEL} == 0
 .for dir in /sbin /bin /usr/sbin /usr/bin
 PATH:= ${TOOLSDIR}${dir}:${PATH}
 .endfor
 .export PATH
 # Prefer the TOOLSDIR version of the toolchain if present vs the host version.
 .for var in ${TOOLCHAIN_VARS}
 _toolchain_bin.${var}=	${TOOLSDIR}${_toolchain_bin_${var}:U/usr/bin/${var:tl}}
 .if exists(${_toolchain_bin.${var}})
 HOST_${var}?=	${_toolchain_bin.${var}}
 .export		HOST_${var}
 .endif
 .endfor
 .endif
 
 .for var in ${TOOLCHAIN_VARS}
 HOST_${var}?=	${_toolchain_bin_${var}:U/usr/bin/${var:tl}}
 .endfor
 
 .if ${MACHINE} == "host"
 .for var in ${TOOLCHAIN_VARS}
 ${var}=		${HOST_${var}}
 .endfor
 .endif
 
 .if ${MACHINE:Nhost:Ncommon} != "" && ${MACHINE} != ${HOST_MACHINE}
 # cross-building
 .if !defined(FREEBSD_REVISION)
 FREEBSD_REVISION!= sed -n '/^REVISION=/{s,.*=,,;s,",,g;p; }' ${SRCTOP}/sys/conf/newvers.sh
 .export FREEBSD_REVISION
 .endif
 CROSS_TARGET_FLAGS= -target ${MACHINE_ARCH}-unknown-freebsd${FREEBSD_REVISION}
 CFLAGS+= ${CROSS_TARGET_FLAGS}
 ACFLAGS+= ${CROSS_TARGET_FLAGS}
 LDFLAGS+= -Wl,-m -Wl,elf_${MACHINE_ARCH}_fbsd
 .endif
 
 META_MODE+=	missing-meta=yes
 .if empty(META_MODE:Mnofilemon)
 META_MODE+=	missing-filemon=yes
 .endif
diff --git a/share/mk/local.sys.env.mk b/share/mk/local.sys.env.mk
index 2187104e83fa..e3348537db41 100644
--- a/share/mk/local.sys.env.mk
+++ b/share/mk/local.sys.env.mk
@@ -1,51 +1,52 @@
 # $FreeBSD$
 
 # This makefile is for customizations that should be done early
 
 .if !defined(_TARGETS)
 # some things we do only once
 _TARGETS:= ${.TARGETS}
 .export _TARGETS
 .endif
 
 # some handy macros
 _this = ${.PARSEDIR:tA}/${.PARSEFILE}
 # some useful modifiers
 
 # A useful trick for testing multiple :M's against something
 # :L says to use the variable's name as its value - ie. literal
 # got = ${clean* destroy:${M_ListToMatch:S,V,.TARGETS,}}
 M_ListToMatch = L:@m@$${V:M$$m}@
 # match against our initial targets (see above)
 M_L_TARGETS = ${M_ListToMatch:S,V,_TARGETS,}
 
 # turn a list into a set of :N modifiers
 # NskipFoo = ${Foo:${M_ListToSkip}}
 M_ListToSkip= O:u:ts::S,:,:N,g:S,^,N,
 
 # type should be a builtin in any sh since about 1980,
 # AUTOCONF := ${autoconf:L:${M_whence}}
 M_type = @x@(type $$x 2> /dev/null); echo;@:sh:[0]:N* found*:[@]:C,[()],,g
 M_whence = ${M_type}:M/*:[1]
 
 # convert a path to a valid shell variable
 M_P2V = tu:C,[./-],_,g
 
 # these are handy
 # we can use this for a cheap timestamp at the start of a target's script,
 # but not at the end - since make will expand both at the same time.
 TIME_STAMP_FMT = @ %s [%Y-%m-%d %T]
 TIME_STAMP = ${TIME_STAMP_FMT:localtime}
 # this will produce the same output but as of when date(1) is run.
 TIME_STAMP_DATE = `date '+${TIME_STAMP_FMT}'`
 TIME_STAMP_END?= ${TIME_STAMP_DATE}
 
 # Simplify auto.obj.mk mkdir -p handling and avoid unneeded/redundant
 # error spam and show a proper error.
 Mkdirs= Mkdirs() { mkdir -p $$* || :; }
 
 .if !empty(.MAKEFLAGS:M-s)
 ECHO_TRACE?=	true
 .endif
 
 .include "src.sys.env.mk"
+.-include <site.sys.env.mk>
diff --git a/share/mk/local.sys.mk b/share/mk/local.sys.mk
index a4b7b0561f15..519c72df2383 100644
--- a/share/mk/local.sys.mk
+++ b/share/mk/local.sys.mk
@@ -1,88 +1,89 @@
 # $FreeBSD$
 
 .if ${MK_DIRDEPS_BUILD} == "yes" || ${MK_META_MODE} == "yes"
 
 # Not in the below list as it may make sense for non-meta mode
 # eventually.  meta.sys.mk (DIRDEPS_BUILD) also already adds these in.
 .if ${MK_DIRDEPS_BUILD} == "no" && ${MK_META_MODE} == "yes"
 MAKE_PRINT_VAR_ON_ERROR += \
 	.ERROR_TARGET \
 	.ERROR_META_FILE \
 	.MAKE.LEVEL \
 	MAKEFILE \
 	.MAKE.MODE
 .endif
 
 _ERROR_CMD_EXEC=	${sed -n '/^CMD/s,^CMD \(.*\),\1;,p' ${.ERROR_META_FILE}:L:sh}
 _ERROR_CMD=		${!empty(.ERROR_META_FILE):?${_ERROR_CMD_EXEC}:.PHONY}
 MAKE_PRINT_VAR_ON_ERROR+= \
 	_ERROR_CMD \
 	.CURDIR \
 	.MAKE \
 	.OBJDIR \
 	.TARGETS \
 	DESTDIR \
 	LD_LIBRARY_PATH \
 	MACHINE \
 	MACHINE_ARCH \
 	MAKEOBJDIRPREFIX \
 	MAKESYSPATH \
 	MAKE_VERSION \
 	PATH \
 	SRCTOP \
 	OBJTOP \
 	${MAKE_PRINT_VAR_ON_ERROR_XTRAS}
 
 # Meta mode may rebuild targets that then fail. The next build won't detect
 # the meta mode change. Not all targets have a 'rm ${.TARGET}' in them
 # so force it.
 .DELETE_ON_ERROR:
 
 .if ${.MAKE.LEVEL} > 0
 MAKE_PRINT_VAR_ON_ERROR += .MAKE.MAKEFILES .PATH
 .endif
 .endif
 
 .if !empty(.OBJDIR)
 OBJTOP?= ${.OBJDIR:S,${.CURDIR},,}${SRCTOP}
 .endif
 
 .if !empty(LIBDIR)
 _PREMK_LIBDIR:=	${LIBDIR}
 .endif
 
 .include "src.sys.mk"
+.-include <site.sys.mk>
 
 .if ${.MAKE.MODE:Mmeta*} != ""
 # we can afford to use cookies to prevent some targets
 # re-running needlessly but only when using filemon.
 # Targets that should support the meta mode cookie handling should just be
 # added to META_TARGETS.  If bsd.sys.mk cannot be included then ${META_DEPS}
 # should be added as a target dependency as well.  Otherwise the target
 # is added to in bsd.sys.mk since it comes last.
 .if ${.MAKE.MODE:Mnofilemon} == ""
 # Prepend .OBJDIR if not already there.
 _META_COOKIE_COND=	"${.TARGET:M${.OBJDIR}/*}" == ""
 _META_COOKIE_DEFAULT=	${${_META_COOKIE_COND}:?${.OBJDIR}/${.TARGET}:${.TARGET}}
 # Use the default if COOKIE.${.TARGET} is not defined.
 META_COOKIE=		${COOKIE.${.TARGET}:U${_META_COOKIE_DEFAULT}}
 META_COOKIE_RM=		@rm -f ${META_COOKIE}
 META_COOKIE_TOUCH=	@touch ${META_COOKIE}
 CLEANFILES+=		${META_TARGETS}
 _meta_dep_before:	.USEBEFORE .NOTMAIN
 	${META_COOKIE_RM}
 _meta_dep_after:	.USE .NOTMAIN
 	${META_COOKIE_TOUCH}
 # Attach this to a target to allow it to benefit from meta mode's
 # not rerunning a command if it doesn't need to be considering its
 # metafile/filemon-tracked dependencies.
 META_DEPS=	_meta_dep_before _meta_dep_after .META
 .endif
 .else
 # some targets need to be .PHONY - but not in meta mode
 META_NOPHONY=	.PHONY
 .endif
 META_NOPHONY?=
 META_COOKIE_RM?=
 META_COOKIE_TOUCH?=
 META_DEPS+=	${META_NOPHONY}
diff --git a/share/mk/src.libnames.mk b/share/mk/src.libnames.mk
index 59b7630bcf55..db7c86651f96 100644
--- a/share/mk/src.libnames.mk
+++ b/share/mk/src.libnames.mk
@@ -1,790 +1,792 @@
 # $FreeBSD$
 #
 # The include file <src.libnames.mk> define library names suitable
 # for INTERNALLIB and PRIVATELIB definition
 
 .if !target(__<bsd.init.mk>__)
 .error src.libnames.mk cannot be included directly.
 .endif
 
 .if !target(__<src.libnames.mk>__)
 __<src.libnames.mk>__:
 
 .include <src.opts.mk>
 
 _PRIVATELIBS=	\
 		atf_c \
 		atf_cxx \
 		auditd \
 		bsddialog \
 		bsdstat \
 		cbor \
 		devdctl \
 		event1 \
 		fido2 \
 		gmock \
 		gtest \
 		gmock_main \
 		gtest_main \
 		heimipcc \
 		heimipcs \
 		ldns \
 		sqlite3 \
 		ssh \
 		ucl \
 		unbound \
 		zstd
 
 # Let projects based on FreeBSD append to _PRIVATELIBS
 # by maintaining their own LOCAL_PRIVATELIBS list.
 _PRIVATELIBS+=	${LOCAL_PRIVATELIBS}
 
 _INTERNALLIBS=	\
 		amu \
 		bsnmptools \
 		c_nossp_pic \
 		cron \
 		elftc \
 		fifolog \
 		ifconfig \
 		ipf \
 		iscsiutil \
 		lpr \
 		lua \
 		lutok \
 		netbsd \
 		ntp \
 		ntpevent \
 		openbsd \
 		opts \
 		parse \
 		pe \
 		pfctl \
 		pmcstat \
 		sl \
 		sm \
 		smdb \
 		smutil \
 		telnet \
 		vers \
 		wpaap \
 		wpacommon \
 		wpacrypto \
 		wpadrivers \
 		wpaeap_common \
 		wpaeap_peer \
 		wpaeap_server \
 		wpaeapol_auth \
 		wpaeapol_supp \
 		wpal2_packet \
 		wparadius \
 		wparsn_supp \
 		wpatls \
 		wpautils \
 		wpawps
 
 # Let projects based on FreeBSD append to _INTERNALLIBS
 # by maintaining their own LOCAL_INTERNALLIBS list.
 _INTERNALLIBS+=	${LOCAL_INTERNALLIBS}
 
 _LIBRARIES=	\
 		${_PRIVATELIBS} \
 		${_INTERNALLIBS} \
 		${LOCAL_LIBRARIES} \
 		80211 \
 		9p \
 		alias \
 		archive \
 		asn1 \
 		avl \
 		BlocksRuntime \
 		be \
 		begemot \
 		bluetooth \
 		bsdxml \
 		bsm \
 		bsnmp \
 		bz2 \
 		c \
 		c_pic \
 		calendar \
 		cam \
 		casper \
 		cap_dns \
 		cap_fileargs \
 		cap_grp \
 		cap_net \
 		cap_netdb \
 		cap_pwd \
 		cap_sysctl \
 		cap_syslog \
 		com_err \
 		compiler_rt \
 		crypt \
 		crypto \
 		ctf \
 		cuse \
 		cxxrt \
 		devctl \
 		devdctl \
 		devinfo \
 		devstat \
 		dialog \
 		dl \
 		dpv \
 		dtrace \
 		dwarf \
 		edit \
 		efivar \
 		elf \
 		execinfo \
 		fetch \
 		figpar \
 		formw \
 		geom \
 		gpio \
 		gssapi \
 		gssapi_krb5 \
 		hdb \
 		heimbase \
 		heimntlm \
 		heimsqlite \
 		hx509 \
 		icp \
 		ipsec \
 		ipt \
 		jail \
 		kadm5clnt \
 		kadm5srv \
 		kafs5 \
 		kdc \
 		kiconv \
 		krb5 \
 		kvm \
 		l \
 		lzma \
 		m \
 		magic \
 		md \
 		memstat \
 		mp \
 		mt \
 		ncursesw \
 		netgraph \
 		netmap \
 		ngatm \
 		nv \
 		nvpair \
 		opencsd \
 		pam \
 		panel \
 		panelw \
 		pcap \
 		pcsclite \
 		pjdlog \
 		pmc \
 		proc \
 		procstat \
 		pthread \
 		radius \
 		regex \
 		roken \
 		rpcsec_gss \
 		rpcsvc \
 		rt \
 		rtld_db \
 		sbuf \
 		sdp \
 		sm \
 		smb \
 		spl \
 		ssl \
 		ssp_nonshared \
 		stats \
 		stdthreads \
 		supcplusplus \
 		sysdecode \
 		tacplus \
 		termcapw \
 		tinfow \
 		tpool \
 		ufs \
 		ugidfw \
 		ulog \
 		umem \
 		usb \
 		usbhid \
 		util \
 		uutil \
 		vmmapi \
 		wind \
 		wrap \
 		xo \
 		y \
 		ypclnt \
 		z \
 		zfs_core \
 		zfs \
 		zfsbootenv \
 		zpool \
 		zutil
 
 .if ${MK_BLACKLIST} != "no"
 _LIBRARIES+= \
 		blacklist \
 
 .endif
 
 .if ${MK_OFED} != "no"
 _LIBRARIES+= \
 		cxgb4 \
 		ibcm \
 		ibmad \
 		ibnetdisc \
 		ibumad \
 		ibverbs \
 		irdma \
 		mlx4 \
 		mlx5 \
 		rdmacm \
 		osmcomp \
 		opensm \
 		osmvendor
 .endif
 
 .if ${MK_BEARSSL} == "yes"
 _LIBRARIES+= \
 		bearssl \
 		secureboot \
 
 LIBBEARSSL?=	${LIBBEARSSLDIR}/libbearssl.a
 LIBSECUREBOOT?=	${LIBSECUREBOOTDIR}/libsecureboot.a
 .endif
 
 .if ${MK_VERIEXEC} == "yes"
 _LIBRARIES+= veriexec
 
 LIBVERIEXEC?=	${LIBVERIEXECDIR}/libveriexec.a
 .endif
 
 # Each library's LIBADD needs to be duplicated here for static linkage of
 # 2nd+ order consumers.  Auto-generating this would be better.
 _DP_80211=	sbuf bsdxml
 _DP_9p=		sbuf
 # XXX: Not bootstrapped so uses host version on non-FreeBSD, so don't use a
 # FreeBSD-specific dependency list
 .if ${.MAKE.OS} == "FreeBSD" || !defined(BOOTSTRAPPING)
 _DP_archive=	z bz2 lzma bsdxml zstd
 .endif
 _DP_avl=	spl
 _DP_bsddialog=	formw ncursesw tinfow
 _DP_zstd=	pthread
 .if ${MK_BLACKLIST} != "no"
 _DP_blacklist+=	pthread
 .endif
 _DP_crypto=	pthread
 # See comment by _DP_archive above
 .if ${.MAKE.OS} == "FreeBSD" || !defined(BOOTSTRAPPING)
 .if ${MK_OPENSSL} != "no"
 _DP_archive+=	crypto
 .else
 _DP_archive+=	md
 .endif
 .endif
 _DP_sqlite3=	pthread
 _DP_ssl=	crypto
 _DP_ssh=	crypto crypt z
 .if ${MK_LDNS} != "no"
 _DP_ssh+=	ldns
 .endif
 _DP_edit=	tinfow
 .if ${MK_OPENSSL} != "no"
 _DP_bsnmp=	crypto
 .endif
 _DP_geom=	bsdxml sbuf
 _DP_cam=	sbuf
 _DP_kvm=	elf
 _DP_casper=	nv
 _DP_cap_dns=	nv
 _DP_cap_fileargs=	nv
 _DP_cap_grp=	nv
 _DP_cap_pwd=	nv
 _DP_cap_sysctl=	nv
 _DP_cap_syslog=	nv
 .if ${MK_OFED} != "no"
 _DP_pcap=	ibverbs mlx5
 .endif
 _DP_pjdlog=	util
 _DP_usb=	pthread
 _DP_unbound=	ssl crypto pthread
 _DP_rt=	pthread
 .if ${MK_OPENSSL} == "no"
 _DP_radius=	md
 .else
 _DP_radius=	crypto
 .endif
 _DP_rtld_db=	elf procstat
 _DP_procstat=	kvm util elf
 .if ${MK_CXX} == "yes"
 _DP_proc=	cxxrt
 .endif
 .if ${MK_CDDL} != "no"
 _DP_proc+=	ctf
 .endif
 _DP_proc+=	elf procstat rtld_db util z
 _DP_mp=	crypto
 _DP_memstat=	kvm
 _DP_magic=	z
 _DP_mt=		sbuf bsdxml
 _DP_ldns=	ssl crypto
 _DP_lua=	m
 _DP_lutok=	lua
 .if ${MK_OPENSSL} != "no"
 _DP_fetch=	ssl crypto
 .else
 _DP_fetch=	md
 .endif
 _DP_execinfo=	elf
 _DP_dwarf=	elf z
 _DP_dpv=	dialog figpar util tinfow ncursesw
 _DP_dialog=	tinfow ncursesw m
 _DP_cuse=	pthread
 _DP_atf_cxx=	atf_c
 _DP_gtest=	pthread regex
 _DP_gmock=	gtest
 _DP_gmock_main=	gmock
 _DP_gtest_main=	gtest
 _DP_devstat=	kvm
 _DP_pam=	radius tacplus md util
 .if ${MK_KERBEROS} != "no"
 _DP_pam+=	krb5
 .endif
 .if ${MK_OPENSSH} != "no"
 _DP_fido2+=	crypto z
 _DP_pam+=	ssh
 .endif
 .if ${MK_NIS} != "no"
 _DP_pam+=	ypclnt
 .endif
 _DP_roken=	crypt
 _DP_kadm5clnt=	com_err krb5 roken
 _DP_kadm5srv=	com_err hdb krb5 roken
 _DP_heimntlm=	crypto com_err krb5 roken
 _DP_hx509=	asn1 com_err crypto roken wind
 _DP_hdb=	asn1 com_err krb5 roken sqlite3
 _DP_asn1=	com_err roken
 _DP_kdc=	roken hdb hx509 krb5 heimntlm asn1 crypto
 _DP_wind=	com_err roken
 _DP_heimbase=	pthread
 _DP_heimipcc=	heimbase roken pthread
 _DP_heimipcs=	heimbase roken pthread
 _DP_kafs5=	asn1 krb5 roken
 _DP_krb5=	asn1 com_err crypt crypto hx509 roken wind heimbase heimipcc
 _DP_gssapi_krb5=	gssapi krb5 crypto roken asn1 com_err
 _DP_lzma=	md pthread
 _DP_ucl=	m
 _DP_vmmapi=	util
 _DP_opencsd=	cxxrt
 _DP_ctf=	spl z
 _DP_dtrace=	ctf elf proc pthread rtld_db
 _DP_xo=		util
 _DP_ztest=	geom m nvpair umem zpool pthread avl zfs_core spl zutil zfs uutil icp
 # The libc dependencies are not strictly needed but are defined to make the
 # assert happy.
 _DP_c=		compiler_rt
 # Use libssp_nonshared only on i386 and power*.  Other archs emit direct calls
 # to __stack_chk_fail, not __stack_chk_fail_local provided by libssp_nonshared.
 .if ${MK_SSP} != "no" && \
     (${MACHINE_ARCH} == "i386" || ${MACHINE_ARCH:Mpower*} != "")
 _DP_c+=		ssp_nonshared
 .endif
 _DP_stats=	sbuf pthread
 _DP_stdthreads=	pthread
 _DP_tacplus=	md
 _DP_ncursesw=	tinfow
 _DP_formw=	ncursesw
 _DP_nvpair=	spl
 _DP_panelw=	ncursesw
 _DP_rpcsec_gss=	gssapi
 _DP_smb=	kiconv
 _DP_ulog=	md
 _DP_fifolog=	z
 _DP_ipf=	kvm
 _DP_tpool=	spl
 _DP_uutil=	avl spl
 _DP_zfs=	md pthread umem util uutil m avl bsdxml crypto geom nvpair \
 	z zfs_core zutil
 _DP_zfsbootenv= zfs nvpair
 _DP_zfs_core=	nvpair spl zutil
 _DP_zpool=	md pthread z icp spl nvpair avl umem
 _DP_zutil=	avl geom m tpool
 _DP_be=		zfs spl nvpair zfsbootenv
 _DP_netmap=
 _DP_ifconfig=	m
 _DP_pfctl=	nv
 
 # OFED support
 .if ${MK_OFED} != "no"
 _DP_cxgb4=	ibverbs pthread
 _DP_ibcm=	ibverbs
 _DP_ibmad=	ibumad
 _DP_ibnetdisc=	osmcomp ibmad ibumad
 _DP_ibumad=	
 _DP_ibverbs=
 _DP_irdma=	ibverbs pthread
 _DP_mlx4=	ibverbs pthread
 _DP_mlx5=	ibverbs pthread
 _DP_rdmacm=	ibverbs
 _DP_osmcomp=	pthread
 _DP_opensm=	pthread
 _DP_osmvendor=	ibumad pthread
 .endif
 
 # Define special cases
 LDADD_supcplusplus=	-lsupc++
 LIBATF_C=	${LIBDESTDIR}${LIBDIR_BASE}/libprivateatf-c.a
 LIBATF_CXX=	${LIBDESTDIR}${LIBDIR_BASE}/libprivateatf-c++.a
 LDADD_atf_c=	-lprivateatf-c
 LDADD_atf_cxx=	-lprivateatf-c++
 
 LIBGMOCK=	${LIBDESTDIR}${LIBDIR_BASE}/libprivategmock.a
 LIBGMOCK_MAIN=	${LIBDESTDIR}${LIBDIR_BASE}/libprivategmock_main.a
 LIBGTEST=	${LIBDESTDIR}${LIBDIR_BASE}/libprivategtest.a
 LIBGTEST_MAIN=	${LIBDESTDIR}${LIBDIR_BASE}/libprivategtest_main.a
 LDADD_gmock=	-lprivategmock
 LDADD_gtest=	-lprivategtest
 LDADD_gmock_main= -lprivategmock_main
 LDADD_gtest_main= -lprivategtest_main
 
 .for _l in ${_PRIVATELIBS}
 LIB${_l:tu}?=	${LIBDESTDIR}${LIBDIR_BASE}/libprivate${_l}.a
 .endfor
 
 .if ${MK_PIE} != "no"
 PIE_SUFFIX=	_pie
 .endif
 
 .for _l in ${_LIBRARIES}
 .if ${_INTERNALLIBS:M${_l}} || !defined(SYSROOT)
 LDADD_${_l}_L+=		-L${LIB${_l:tu}DIR}
 .endif
 DPADD_${_l}?=	${LIB${_l:tu}}
 .if ${_PRIVATELIBS:M${_l}}
 LDADD_${_l}?=	-lprivate${_l}
 .elif ${_INTERNALLIBS:M${_l}}
 LDADD_${_l}?=	${LDADD_${_l}_L} -l${_l:S/${PIE_SUFFIX}//}${PIE_SUFFIX}
 .else
 LDADD_${_l}?=	${LDADD_${_l}_L} -l${_l}
 .endif
 # Add in all dependencies for static linkage.
 # Bootstrapping from non-FreeBSD needs special handling, since it overrides
 # NO_SHARED back to yes despite only building static versions of bootstrap
 # libraries (see tools/build/mk/Makefile.boot.pre).
 .if defined(_DP_${_l}) && (${_INTERNALLIBS:M${_l}} || \
     (defined(NO_SHARED) && ${NO_SHARED:tl} != "no") || \
     (defined(BOOTSTRAPPING) && ${.MAKE.OS} != "FreeBSD"))
 .for _d in ${_DP_${_l}}
 DPADD_${_l}+=	${DPADD_${_d}}
 LDADD_${_l}+=	${LDADD_${_d}}
 .endfor
 .endif
 .endfor
 
 # These are special cases where the library is broken and anything that uses
 # it needs to add more dependencies.  Broken usually means that it has a
 # cyclic dependency and cannot link its own dependencies.  This is bad, please
 # fix the library instead.
 # Unless the library itself is broken then the proper place to define
 # dependencies is _DP_* above.
 
 # libatf-c++ exposes libatf-c abi hence we need to explicit link to atf_c for
 # atf_cxx
 DPADD_atf_cxx+=	${DPADD_atf_c}
 LDADD_atf_cxx+=	${LDADD_atf_c}
 
 DPADD_gmock+=	${DPADD_gtest}
 LDADD_gmock+=	${LDADD_gtest}
 
 DPADD_gmock_main+=	${DPADD_gmock}
 LDADD_gmock_main+=	${LDADD_gmock}
 
 DPADD_gtest_main+=	${DPADD_gtest}
 LDADD_gtest_main+=	${LDADD_gtest}
 
 # Detect LDADD/DPADD that should be LIBADD, before modifying LDADD here.
 _BADLDADD=
 .for _l in ${LDADD:M-l*:N-l*/*:C,^-l,,}
 .if ${_LIBRARIES:M${_l}} && !${_PRIVATELIBS:M${_l}}
 _BADLDADD+=	${_l}
 .endif
 .endfor
 .if !empty(_BADLDADD)
 .error ${.CURDIR}: These libraries should be LIBADD+=foo rather than DPADD/LDADD+=-lfoo: ${_BADLDADD}
 .endif
 
 .for _l in ${LIBADD}
 DPADD+=		${DPADD_${_l}}
 LDADD+=		${LDADD_${_l}}
 .endfor
 
 _LIB_OBJTOP?=	${OBJTOP}
 # INTERNALLIB definitions.
 LIBELFTCDIR=	${_LIB_OBJTOP}/lib/libelftc
 LIBELFTC?=	${LIBELFTCDIR}/libelftc${PIE_SUFFIX}.a
 
 LIBLUADIR=	${_LIB_OBJTOP}/lib/liblua
 LIBLUA?=	${LIBLUADIR}/liblua${PIE_SUFFIX}.a
 
 LIBLUTOKDIR=	${_LIB_OBJTOP}/lib/liblutok
 LIBLUTOK?=	${LIBLUTOKDIR}/liblutok${PIE_SUFFIX}.a
 
 LIBPEDIR=	${_LIB_OBJTOP}/lib/libpe
 LIBPE?=		${LIBPEDIR}/libpe${PIE_SUFFIX}.a
 
 LIBOPENBSDDIR=	${_LIB_OBJTOP}/lib/libopenbsd
 LIBOPENBSD?=	${LIBOPENBSDDIR}/libopenbsd${PIE_SUFFIX}.a
 
 LIBSMDIR=	${_LIB_OBJTOP}/lib/libsm
 LIBSM?=		${LIBSMDIR}/libsm${PIE_SUFFIX}.a
 
 LIBSMDBDIR=	${_LIB_OBJTOP}/lib/libsmdb
 LIBSMDB?=	${LIBSMDBDIR}/libsmdb${PIE_SUFFIX}.a
 
 LIBSMUTILDIR=	${_LIB_OBJTOP}/lib/libsmutil
 LIBSMUTIL?=	${LIBSMUTILDIR}/libsmutil${PIE_SUFFIX}.a
 
 LIBNETBSDDIR?=	${_LIB_OBJTOP}/lib/libnetbsd
 LIBNETBSD?=	${LIBNETBSDDIR}/libnetbsd${PIE_SUFFIX}.a
 
 LIBVERSDIR?=	${_LIB_OBJTOP}/kerberos5/lib/libvers
 LIBVERS?=	${LIBVERSDIR}/libvers${PIE_SUFFIX}.a
 
 LIBSLDIR=	${_LIB_OBJTOP}/kerberos5/lib/libsl
 LIBSL?=		${LIBSLDIR}/libsl${PIE_SUFFIX}.a
 
 LIBIFCONFIGDIR=	${_LIB_OBJTOP}/lib/libifconfig
 LIBIFCONFIG?=	${LIBIFCONFIGDIR}/libifconfig${PIE_SUFFIX}.a
 
 LIBIPFDIR=	${_LIB_OBJTOP}/sbin/ipf/libipf
 LIBIPF?=	${LIBIPFDIR}/libipf${PIE_SUFFIX}.a
 
 LIBNVDIR=	${_LIB_OBJTOP}/lib/libnv
 LIBNV?=		${LIBNVDIR}/libnv${PIE_SUFFIX}.a
 
 LIBISCSIUTILDIR=	${_LIB_OBJTOP}/lib/libiscsiutil
 LIBISCSIUTIL?=	${LIBISCSIUTILDIR}/libiscsiutil${PIE_SUFFIX}.a
 
 LIBTELNETDIR=	${_LIB_OBJTOP}/lib/libtelnet
 LIBTELNET?=	${LIBTELNETDIR}/libtelnet${PIE_SUFFIX}.a
 
 LIBCRONDIR=	${_LIB_OBJTOP}/usr.sbin/cron/lib
 LIBCRON?=	${LIBCRONDIR}/libcron${PIE_SUFFIX}.a
 
 LIBNTPDIR=	${_LIB_OBJTOP}/usr.sbin/ntp/libntp
 LIBNTP?=	${LIBNTPDIR}/libntp${PIE_SUFFIX}.a
 
 LIBNTPEVENTDIR=	${_LIB_OBJTOP}/usr.sbin/ntp/libntpevent
 LIBNTPEVENT?=	${LIBNTPEVENTDIR}/libntpevent${PIE_SUFFIX}.a
 
 LIBOPTSDIR=	${_LIB_OBJTOP}/usr.sbin/ntp/libopts
 LIBOPTS?=	${LIBOPTSDIR}/libopts${PIE_SUFFIX}.a
 
 LIBPARSEDIR=	${_LIB_OBJTOP}/usr.sbin/ntp/libparse
 LIBPARSE?=	${LIBPARSEDIR}/libparse${PIE_SUFFIX}.a
 
 LIBPFCTL=	${_LIB_OBJTOP}/lib/libpfctl
 LIBPFCTL?=	${LIBPFCTLDIR}/libpfctl${PIE_SUFFIX}.a
 
 LIBLPRDIR=	${_LIB_OBJTOP}/usr.sbin/lpr/common_source
 LIBLPR?=	${LIBLPRDIR}/liblpr${PIE_SUFFIX}.a
 
 LIBFIFOLOGDIR=	${_LIB_OBJTOP}/usr.sbin/fifolog/lib
 LIBFIFOLOG?=	${LIBFIFOLOGDIR}/libfifolog${PIE_SUFFIX}.a
 
 LIBBSNMPTOOLSDIR=	${_LIB_OBJTOP}/usr.sbin/bsnmpd/tools/libbsnmptools
 LIBBSNMPTOOLS?=	${LIBBSNMPTOOLSDIR}/libbsnmptools${PIE_SUFFIX}.a
 
 LIBBE?=		${LIBBEDIR}/libbe${PIE_SUFFIX}.a
 
 LIBPMCSTATDIR=	${_LIB_OBJTOP}/lib/libpmcstat
 LIBPMCSTAT?=	${LIBPMCSTATDIR}/libpmcstat${PIE_SUFFIX}.a
 
 LIBWPAAPDIR=	${_LIB_OBJTOP}/usr.sbin/wpa/src/ap
 LIBWPAAP?=	${LIBWPAAPDIR}/libwpaap${PIE_SUFFIX}.a
 
 LIBWPACOMMONDIR=	${_LIB_OBJTOP}/usr.sbin/wpa/src/common
 LIBWPACOMMON?=	${LIBWPACOMMONDIR}/libwpacommon${PIE_SUFFIX}.a
 
 LIBWPACRYPTODIR=	${_LIB_OBJTOP}/usr.sbin/wpa/src/crypto
 LIBWPACRYPTO?=	${LIBWPACRYPTODIR}/libwpacrypto${PIE_SUFFIX}.a
 
 LIBWPADRIVERSDIR=	${_LIB_OBJTOP}/usr.sbin/wpa/src/drivers
 LIBWPADRIVERS?=	${LIBWPADRIVERSDIR}/libwpadrivers${PIE_SUFFIX}.a
 
 LIBWPAEAP_COMMONDIR=	${_LIB_OBJTOP}/usr.sbin/wpa/src/eap_common
 LIBWPAEAP_COMMON?=	${LIBWPAEAP_COMMONDIR}/libwpaeap_common${PIE_SUFFIX}.a
 
 LIBWPAEAP_PEERDIR=	${_LIB_OBJTOP}/usr.sbin/wpa/src/eap_peer
 LIBWPAEAP_PEER?=	${LIBWPAEAP_PEERDIR}/libwpaeap_peer${PIE_SUFFIX}.a
 
 LIBWPAEAP_SERVERDIR=	${_LIB_OBJTOP}/usr.sbin/wpa/src/eap_server
 LIBWPAEAP_SERVER?=	${LIBWPAEAP_SERVERDIR}/libwpaeap_server${PIE_SUFFIX}.a
 
 LIBWPAEAPOL_AUTHDIR=	${_LIB_OBJTOP}/usr.sbin/wpa/src/eapol_auth
 LIBWPAEAPOL_AUTH?=	${LIBWPAEAPOL_AUTHDIR}/libwpaeapol_auth${PIE_SUFFIX}.a
 
 LIBWPAEAPOL_SUPPDIR=	${_LIB_OBJTOP}/usr.sbin/wpa/src/eapol_supp
 LIBWPAEAPOL_SUPP?=	${LIBWPAEAPOL_SUPPDIR}/libwpaeapol_supp${PIE_SUFFIX}.a
 
 LIBWPAL2_PACKETDIR=	${_LIB_OBJTOP}/usr.sbin/wpa/src/l2_packet
 LIBWPAL2_PACKET?=	${LIBWPAL2_PACKETDIR}/libwpal2_packet${PIE_SUFFIX}.a
 
 LIBWPARADIUSDIR=	${_LIB_OBJTOP}/usr.sbin/wpa/src/radius
 LIBWPARADIUS?=	${LIBWPARADIUSDIR}/libwparadius${PIE_SUFFIX}.a
 
 LIBWPARSN_SUPPDIR=	${_LIB_OBJTOP}/usr.sbin/wpa/src/rsn_supp
 LIBWPARSN_SUPP?=	${LIBWPARSN_SUPPDIR}/libwparsn_supp${PIE_SUFFIX}.a
 
 LIBWPATLSDIR=	${_LIB_OBJTOP}/usr.sbin/wpa/src/tls
 LIBWPATLS?=	${LIBWPATLSDIR}/libwpatls${PIE_SUFFIX}.a
 
 LIBWPAUTILSDIR=	${_LIB_OBJTOP}/usr.sbin/wpa/src/utils
 LIBWPAUTILS?=	${LIBWPAUTILSDIR}/libwpautils${PIE_SUFFIX}.a
 
 LIBWPAWPSDIR=	${_LIB_OBJTOP}/usr.sbin/wpa/src/wps
 LIBWPAWPS?=	${LIBWPAWPSDIR}/libwpawps${PIE_SUFFIX}.a
 
 LIBC_NOSSP_PICDIR=	${_LIB_OBJTOP}/lib/libc
 LIBC_NOSSP_PIC?=	${LIBC_NOSSP_PICDIR}/libc_nossp_pic.a
 
 # Define a directory for each library.  This is useful for adding -L in when
 # not using a --sysroot or for meta mode bootstrapping when there is no
 # Makefile.depend.  These are sorted by directory.
 LIBAVLDIR=	${_LIB_OBJTOP}/cddl/lib/libavl
 LIBCTFDIR=	${_LIB_OBJTOP}/cddl/lib/libctf
 LIBDTRACEDIR=	${_LIB_OBJTOP}/cddl/lib/libdtrace
 LIBICPDIR=	${_LIB_OBJTOP}/cddl/lib/libicp
 LIBICP?=	${LIBICPDIR}/libicp${PIE_SUFFIX}.a
 LIBICP_RESCUEDIR=	${_LIB_OBJTOP}/cddl/lib/libicp_rescue
 LIBICP_RESCUE?=	${LIBICP_RESCUEDIR}/libicp_rescue${PIE_SUFFIX}.a
 LIBNVPAIRDIR=	${_LIB_OBJTOP}/cddl/lib/libnvpair
 LIBNVPAIR?=	${LIBNVPAIRDIR}/libnvpair${PIE_SUFFIX}.a
 LIBUMEMDIR=	${_LIB_OBJTOP}/cddl/lib/libumem
 LIBUUTILDIR=	${_LIB_OBJTOP}/cddl/lib/libuutil
 LIBZFSDIR=	${_LIB_OBJTOP}/cddl/lib/libzfs
 LIBZFS?=	${LIBZFSDIR}/libzfs${PIE_SUFFIX}.a
 LIBZFS_COREDIR=	${_LIB_OBJTOP}/cddl/lib/libzfs_core
 LIBZFS_CORE?=	${LIBZFS_COREDIR}/libzfs_core${PIE_SUFFIX}.a
 LIBZFSBOOTENVDIR=	${_LIB_OBJTOP}/cddl/lib/libzfsbootenv
 LIBZFSBOOTENV?=	${LIBZFSBOOTENVDIR}/libzfsbootenv${PIE_SUFFIX}.a
 LIBZPOOLDIR=	${_LIB_OBJTOP}/cddl/lib/libzpool
 LIBZPOOL?=	${LIBZPOOLDIR}/libzpool${PIE_SUFFIX}.a
 LIBZUTILDIR=	${_LIB_OBJTOP}/cddl/lib/libzutil
 LIBZUTIL?=	${LIBZUTILDIR}/libzutil${PIE_SUFFIX}.a
 LIBTPOOLDIR=	${_LIB_OBJTOP}/cddl/lib/libtpool
 
 # OFED support
 LIBCXGB4DIR=	${_LIB_OBJTOP}/lib/ofed/libcxgb4
 LIBIBCMDIR=	${_LIB_OBJTOP}/lib/ofed/libibcm
 LIBIBMADDIR=	${_LIB_OBJTOP}/lib/ofed/libibmad
 LIBIBNETDISCDIR=${_LIB_OBJTOP}/lib/ofed/libibnetdisc
 LIBIBUMADDIR=	${_LIB_OBJTOP}/lib/ofed/libibumad
 LIBIBVERBSDIR=	${_LIB_OBJTOP}/lib/ofed/libibverbs
 LIBIRDMADIR=	${_LIB_OBJTOP}/lib/ofed/libirdma
 LIBMLX4DIR=	${_LIB_OBJTOP}/lib/ofed/libmlx4
 LIBMLX5DIR=	${_LIB_OBJTOP}/lib/ofed/libmlx5
 LIBRDMACMDIR=	${_LIB_OBJTOP}/lib/ofed/librdmacm
 LIBOSMCOMPDIR=	${_LIB_OBJTOP}/lib/ofed/complib
 LIBOPENSMDIR=	${_LIB_OBJTOP}/lib/ofed/libopensm
 LIBOSMVENDORDIR=${_LIB_OBJTOP}/lib/ofed/libvendor
 
 LIBDIALOGDIR=	${_LIB_OBJTOP}/gnu/lib/libdialog
 LIBSSPDIR=	${_LIB_OBJTOP}/lib/libssp
 LIBSSP_NONSHAREDDIR=	${_LIB_OBJTOP}/lib/libssp_nonshared
 LIBASN1DIR=	${_LIB_OBJTOP}/kerberos5/lib/libasn1
 LIBGSSAPI_KRB5DIR=	${_LIB_OBJTOP}/kerberos5/lib/libgssapi_krb5
 LIBGSSAPI_NTLMDIR=	${_LIB_OBJTOP}/kerberos5/lib/libgssapi_ntlm
 LIBGSSAPI_SPNEGODIR=	${_LIB_OBJTOP}/kerberos5/lib/libgssapi_spnego
 LIBHDBDIR=	${_LIB_OBJTOP}/kerberos5/lib/libhdb
 LIBHEIMBASEDIR=	${_LIB_OBJTOP}/kerberos5/lib/libheimbase
 LIBHEIMIPCCDIR=	${_LIB_OBJTOP}/kerberos5/lib/libheimipcc
 LIBHEIMIPCSDIR=	${_LIB_OBJTOP}/kerberos5/lib/libheimipcs
 LIBHEIMNTLMDIR=	${_LIB_OBJTOP}/kerberos5/lib/libheimntlm
 LIBHX509DIR=	${_LIB_OBJTOP}/kerberos5/lib/libhx509
 LIBKADM5CLNTDIR=	${_LIB_OBJTOP}/kerberos5/lib/libkadm5clnt
 LIBKADM5SRVDIR=	${_LIB_OBJTOP}/kerberos5/lib/libkadm5srv
 LIBKAFS5DIR=	${_LIB_OBJTOP}/kerberos5/lib/libkafs5
 LIBKDCDIR=	${_LIB_OBJTOP}/kerberos5/lib/libkdc
 LIBKRB5DIR=	${_LIB_OBJTOP}/kerberos5/lib/libkrb5
 LIBROKENDIR=	${_LIB_OBJTOP}/kerberos5/lib/libroken
 LIBWINDDIR=	${_LIB_OBJTOP}/kerberos5/lib/libwind
 LIBATF_CDIR=	${_LIB_OBJTOP}/lib/atf/libatf-c
 LIBATF_CXXDIR=	${_LIB_OBJTOP}/lib/atf/libatf-c++
 LIBGMOCKDIR=	${_LIB_OBJTOP}/lib/googletest/gmock
 LIBGMOCK_MAINDIR=	${_LIB_OBJTOP}/lib/googletest/gmock_main
 LIBGTESTDIR=	${_LIB_OBJTOP}/lib/googletest/gtest
 LIBGTEST_MAINDIR=	${_LIB_OBJTOP}/lib/googletest/gtest_main
 LIBALIASDIR=	${_LIB_OBJTOP}/lib/libalias/libalias
 LIBBLACKLISTDIR=	${_LIB_OBJTOP}/lib/libblacklist
 LIBBLOCKSRUNTIMEDIR=	${_LIB_OBJTOP}/lib/libblocksruntime
 LIBBSNMPDIR=	${_LIB_OBJTOP}/lib/libbsnmp/libbsnmp
 LIBCASPERDIR=	${_LIB_OBJTOP}/lib/libcasper/libcasper
 LIBCAP_DNSDIR=	${_LIB_OBJTOP}/lib/libcasper/services/cap_dns
 LIBCAP_GRPDIR=	${_LIB_OBJTOP}/lib/libcasper/services/cap_grp
 LIBCAP_NETDIR=	${_LIB_OBJTOP}/lib/libcasper/services/cap_net
 LIBCAP_PWDDIR=	${_LIB_OBJTOP}/lib/libcasper/services/cap_pwd
 LIBCAP_SYSCTLDIR=	${_LIB_OBJTOP}/lib/libcasper/services/cap_sysctl
 LIBCAP_SYSLOGDIR=	${_LIB_OBJTOP}/lib/libcasper/services/cap_syslog
 LIBCBORDIR=	${_LIB_OBJTOP}/lib/libcbor
 LIBBSDXMLDIR=	${_LIB_OBJTOP}/lib/libexpat
 LIBFIDO2DIR=	${_LIB_OBJTOP}/lib/libfido2
 LIBKVMDIR=	${_LIB_OBJTOP}/lib/libkvm
 LIBPTHREADDIR=	${_LIB_OBJTOP}/lib/libthr
 LIBMDIR=	${_LIB_OBJTOP}/lib/msun
 LIBFORMWDIR=	${_LIB_OBJTOP}/lib/ncurses/form
 LIBMENUWDIR=	${_LIB_OBJTOP}/lib/ncurses/menu
 LIBNCURSESWDIR=	${_LIB_OBJTOP}/lib/ncurses/ncurses
 LIBTINFOWDIR=	${_LIB_OBJTOP}/lib/ncurses/tinfo
 LIBPANELWDIR=	${_LIB_OBJTOP}/lib/ncurses/panel
 LIBCRYPTODIR=	${_LIB_OBJTOP}/secure/lib/libcrypto
 LIBSPLDIR=	${_LIB_OBJTOP}/cddl/lib/libspl
 LIBSSHDIR=	${_LIB_OBJTOP}/secure/lib/libssh
 LIBSSLDIR=	${_LIB_OBJTOP}/secure/lib/libssl
 LIBTEKENDIR=	${_LIB_OBJTOP}/sys/teken/libteken
 LIBEGACYDIR=	${_LIB_OBJTOP}/tools/build
 LIBLNDIR=	${_LIB_OBJTOP}/usr.bin/lex/lib
 
 LIBTERMCAPWDIR=	${LIBTINFOWDIR}
 
+.-include <site.src.libnames.mk>
+
 # Default other library directories to lib/libNAME.
 .for lib in ${_LIBRARIES}
 LIB${lib:tu}DIR?=	${OBJTOP}/lib/lib${lib}
 .endfor
 
 # Validate that listed LIBADD are valid.
 .for _l in ${LIBADD}
 .if empty(_LIBRARIES:M${_l})
 _BADLIBADD+= ${_l}
 .endif
 .endfor
 .if !empty(_BADLIBADD)
 .error ${.CURDIR}: Invalid LIBADD used which may need to be added to ${_this:T}: ${_BADLIBADD}
 .endif
 
 # Sanity check that libraries are defined here properly when building them.
 .if defined(LIB) && ${_LIBRARIES:M${LIB}} != ""
 .if !empty(LIBADD) && \
     (!defined(_DP_${LIB}) || ${LIBADD:O:u} != ${_DP_${LIB}:O:u})
 .error ${.CURDIR}: Missing or incorrect _DP_${LIB} entry in ${_this:T}.  Should match LIBADD for ${LIB} ('${LIBADD}' vs '${_DP_${LIB}}')
 .endif
 # Note that OBJTOP is not yet defined here but for the purpose of the check
 # it is fine as it resolves to the SRC directory.
 .if !defined(LIB${LIB:tu}DIR) || !exists(${SRCTOP}/${LIB${LIB:tu}DIR:S,^${OBJTOP}/,,})
 .error ${.CURDIR}: Missing or incorrect value for LIB${LIB:tu}DIR in ${_this:T}: ${LIB${LIB:tu}DIR:S,^${OBJTOP}/,,}
 .endif
 .if ${_INTERNALLIBS:M${LIB}} != "" && !defined(LIB${LIB:tu})
 .error ${.CURDIR}: Missing value for LIB${LIB:tu} in ${_this:T}.  Likely should be: LIB${LIB:tu}?= $${LIB${LIB:tu}DIR}/lib${LIB}.a
 .endif
 .endif
 
 .endif	# !target(__<src.libnames.mk>__)
diff --git a/share/mk/src.opts.mk b/share/mk/src.opts.mk
index adb6912daa7d..de36d672d20e 100644
--- a/share/mk/src.opts.mk
+++ b/share/mk/src.opts.mk
@@ -1,511 +1,513 @@
 # $FreeBSD$
 #
 # Option file for FreeBSD /usr/src builds, at least the userland and boot loader
 # portions of the tree. These options generally chose what parts of the tree to
 # include or omit and are FreeBSD source tree specific.
 #
 # Users define WITH_FOO and WITHOUT_FOO on the command line or in /etc/src.conf
 # and /etc/make.conf files. These translate in the build system to MK_FOO={yes,no}
 # with sensible (usually) defaults.
 #
 # Makefiles must include bsd.opts.mk after defining specific MK_FOO options that
 # are applicable for that Makefile (typically there are none, but sometimes there
 # are exceptions). Recursive makes usually add MK_FOO=no for options that they wish
 # to omit from that make.
 #
 # Makefiles must include bsd.mkopt.mk before they test the value of any MK_FOO
 # variable.
 #
 # Makefiles may also assume that this file is included by src.opts.mk should it
 # need variables defined there prior to the end of the Makefile where
 # bsd.{subdir,lib.bin}.mk is traditionally included.
 #
 # The old-style YES_FOO and NO_FOO are being phased out. No new instances of them
 # should be added. Old instances should be removed since they were just to
 # bridge the gap between FreeBSD 4 and FreeBSD 5.
 #
 # Makefiles should never test WITH_FOO or WITHOUT_FOO directly (although an
 # exception is made for _WITHOUT_SRCONF which turns off this mechanism
 # completely inside bsd.*.mk files).
 #
 
 .if !target(__<src.opts.mk>__)
 __<src.opts.mk>__:
 
 .include <bsd.own.mk>
 
 #
 # Define MK_* variables (which are either "yes" or "no") for users
 # to set via WITH_*/WITHOUT_* in /etc/src.conf and override in the
 # make(1) environment.
 # These should be tested with `== "no"' or `!= "no"' in makefiles.
 # The NO_* variables should only be set by makefiles for variables
 # that haven't been converted over.
 #
 
 # These options are used by the src builds. Those listed in
 # __DEFAULT_YES_OPTIONS default to 'yes' and will build unless turned
 # off.  __DEFAULT_NO_OPTIONS will default to 'no' and won't build
 # unless turned on. Any options listed in 'BROKEN_OPTIONS' will be
 # hard-wired to 'no'.  "Broken" here means not working or
 # not-appropriate and/or not supported. It doesn't imply something is
 # wrong with the code. There's not a single good word for this, so
 # BROKEN was selected as the least imperfect one considered at the
 # time. Options are added to BROKEN_OPTIONS list on a per-arch basis.
 # At this time, there's no provision for mutually incompatible options.
 
 __DEFAULT_YES_OPTIONS = \
     ACCT \
     ACPI \
     APM \
     AT \
     ATM \
     AUDIT \
     AUTHPF \
     AUTOFS \
     BHYVE \
     BLACKLIST \
     BLUETOOTH \
     BOOT \
     BOOTPARAMD \
     BOOTPD \
     BSD_CPIO \
     BSDINSTALL \
     BSNMP \
     BZIP2 \
     CALENDAR \
     CAPSICUM \
     CAROOT \
     CASPER \
     CCD \
     CDDL \
     CLANG \
     CLANG_BOOTSTRAP \
     CLEAN \
     CPP \
     CROSS_COMPILER \
     CRYPT \
     CUSE \
     CXX \
     CXGBETOOL \
     DIALOG \
     DICT \
     DMAGENT \
     DTRACE \
     DYNAMICROOT \
     EE \
     EFI \
     ELFTOOLCHAIN_BOOTSTRAP \
     EXAMPLES \
     FDT \
     FILE \
     FINGER \
     FLOPPY \
     FORTH \
     FP_LIBC \
     FREEBSD_UPDATE \
     FTP \
     GAMES \
     GH_BC \
     GNU_DIFF \
     GOOGLETEST \
     GPIO \
     HAST \
     HTML \
     HYPERV \
     ICONV \
     INET \
     INET6 \
     INETD \
     IPFILTER \
     IPFW \
     ISCSI \
     JAIL \
     KDUMP \
     KVM \
     LDNS \
     LDNS_UTILS \
     LEGACY_CONSOLE \
     LLD \
     LLD_BOOTSTRAP \
     LLD_IS_LD \
     LLVM_ASSERTIONS \
     LLVM_COV \
     LLVM_CXXFILT \
     LOADER_GELI \
     LOADER_KBOOT \
     LOADER_LUA \
     LOADER_OFW \
     LOADER_UBOOT \
     LOCALES \
     LOCATE \
     LPR \
     LS_COLORS \
     MACHDEP_OPTIMIZATIONS \
     MAIL \
     MAILWRAPPER \
     MAKE \
     MLX5TOOL \
     NDIS \
     NETCAT \
     NETGRAPH \
     NLS_CATALOGS \
     NS_CACHING \
     NTP \
     NVME \
     OFED \
     OPENSSL \
     PAM \
     PF \
     PKGBOOTSTRAP \
     PMC \
     PORTSNAP \
     PPP \
     QUOTAS \
     RADIUS_SUPPORT \
     RBOOTD \
     RESCUE \
     ROUTED \
     SENDMAIL \
     SERVICESDB \
     SETUID_LOGIN \
     SHARED_TOOLCHAIN \
     SHAREDOCS \
     SOURCELESS \
     SOURCELESS_HOST \
     SOURCELESS_UCODE \
     STATS \
     SYSCONS \
     SYSTEM_COMPILER \
     SYSTEM_LINKER \
     TALK \
     TCP_WRAPPERS \
     TCSH \
     TELNET \
     TEXTPROC \
     TFTP \
     UNBOUND \
     USB \
     UTMPX \
     VI \
     VT \
     WIRELESS \
     WPA_SUPPLICANT_EAPOL \
     ZFS \
     LOADER_ZFS \
     ZONEINFO
 
 __DEFAULT_NO_OPTIONS = \
     BEARSSL \
     BHYVE_SNAPSHOT \
     CLANG_EXTRAS \
     CLANG_FORMAT \
     DETECT_TZ_CHANGES \
     DTRACE_TESTS \
     EXPERIMENTAL \
     HESIOD \
     LOADER_VERBOSE \
     LOADER_VERIEXEC_PASS_MANIFEST \
     LLVM_BINUTILS \
     MALLOC_PRODUCTION \
     OFED_EXTRA \
     OPENLDAP \
     REPRODUCIBLE_BUILD \
     RPCBIND_WARMSTART_SUPPORT \
     SORT_THREADS \
     ZONEINFO_LEAPSECONDS_SUPPORT \
 
 # LEFT/RIGHT. Left options which default to "yes" unless their corresponding
 # RIGHT option is disabled.
 __DEFAULT_DEPENDENT_OPTIONS= \
 	CLANG_FULL/CLANG \
 	LLVM_TARGET_ALL/CLANG \
 	LOADER_VERIEXEC/BEARSSL \
 	LOADER_EFI_SECUREBOOT/LOADER_VERIEXEC \
 	LOADER_VERIEXEC_VECTX/LOADER_VERIEXEC \
 	VERIEXEC/BEARSSL \
 
 # MK_*_SUPPORT options which default to "yes" unless their corresponding
 # MK_* variable is set to "no".
 #
 .for var in \
     BLACKLIST \
     BZIP2 \
     INET \
     INET6 \
     KERBEROS \
     KVM \
     NETGRAPH \
     PAM \
     TESTS \
     WIRELESS
 __DEFAULT_DEPENDENT_OPTIONS+= ${var}_SUPPORT/${var}
 .endfor
 
+.-include <site.src.opts.mk>
+
 #
 # Default behaviour of some options depends on the architecture.  Unfortunately
 # this means that we have to test TARGET_ARCH (the buildworld case) as well
 # as MACHINE_ARCH (the non-buildworld case).  Normally TARGET_ARCH is not
 # used at all in bsd.*.mk, but we have to make an exception here if we want
 # to allow defaults for some things like clang to vary by target architecture.
 # Additional, per-target behavior should be rarely added only after much
 # gnashing of teeth and grinding of gears.
 #
 .if defined(TARGET_ARCH)
 __T=${TARGET_ARCH}
 .else
 __T=${MACHINE_ARCH}
 .endif
 
 # All supported backends for LLVM_TARGET_XXX
 __LLVM_TARGETS= \
 		aarch64 \
 		arm \
 		powerpc \
 		riscv \
 		x86
 __LLVM_TARGET_FILT=	C/(amd64|i386)/x86/:C/powerpc.*/powerpc/:C/armv[67]/arm/:C/riscv.*/riscv/:C/mips.*/mips/
 .for __llt in ${__LLVM_TARGETS}
 # Default enable the given TARGET's LLVM_TARGET support
 .if ${__T:${__LLVM_TARGET_FILT}} == ${__llt}
 __DEFAULT_YES_OPTIONS+=	LLVM_TARGET_${__llt:${__LLVM_TARGET_FILT}:tu}
 # aarch64 needs arm for -m32 support.
 .elif ${__T} == "aarch64" && ${__llt:Marm*} != ""
 __DEFAULT_DEPENDENT_OPTIONS+=	LLVM_TARGET_ARM/LLVM_TARGET_AARCH64
 # Default the rest of the LLVM_TARGETs to the value of MK_LLVM_TARGET_ALL.
 .else
 __DEFAULT_DEPENDENT_OPTIONS+=	LLVM_TARGET_${__llt:${__LLVM_TARGET_FILT}:tu}/LLVM_TARGET_ALL
 .endif
 .endfor
 
 __DEFAULT_NO_OPTIONS+=LLVM_TARGET_BPF LLVM_TARGET_MIPS
 
 .include <bsd.compiler.mk>
 
 .if ${__T:Marm*} == "" && ${__T:Mriscv64*} == ""
 __DEFAULT_YES_OPTIONS+=LLDB
 .else
 __DEFAULT_NO_OPTIONS+=LLDB
 .endif
 # LIB32 is supported on amd64 and powerpc64
 .if (${__T} == "amd64" || ${__T} == "powerpc64")
 __DEFAULT_YES_OPTIONS+=LIB32
 .else
 BROKEN_OPTIONS+=LIB32
 .endif
 # EFI doesn't exist on powerpc (well, officially)
 .if ${__T:Mpowerpc*}
 BROKEN_OPTIONS+=EFI
 .endif
 # OFW is only for powerpc, exclude others
 .if ${__T:Mpowerpc*} == ""
 BROKEN_OPTIONS+=LOADER_OFW
 .endif
 # KBOOT is only for powerpc64 (powerpc64le broken) and kinda for amd64
 .if ${__T} != "powerpc64" && ${__T} != "amd64"
 BROKEN_OPTIONS+=LOADER_KBOOT
 .endif
 # UBOOT is only for arm, and big-endian powerpc
 .if (${__T:Marm*} == "" && ${__T:Mpowerpc*} == "") || ${__T} == "powerpc64le"
 BROKEN_OPTIONS+=LOADER_UBOOT
 .endif
 # GELI and Lua in loader currently cause boot failures on powerpc.
 # Further debugging is required -- probably they are just broken on big
 # endian systems generically (they jump to null pointers or try to read
 # crazy high addresses, which is typical of endianness problems).
 .if ${__T:Mpowerpc*}
 BROKEN_OPTIONS+=LOADER_GELI LOADER_LUA
 .endif
 
 # Kernel TLS is enabled by default on amd64 and aarch64
 .if ${__T} == "aarch64" || ${__T} == "amd64"
 __DEFAULT_YES_OPTIONS+=OPENSSL_KTLS
 .else
 __DEFAULT_NO_OPTIONS+=OPENSSL_KTLS
 .endif
 
 .if ${__T} != "aarch64" && ${__T} != "amd64" && ${__T} != "i386" && \
     ${__T:Mpowerpc64*} == ""
 BROKEN_OPTIONS+=CXGBETOOL
 BROKEN_OPTIONS+=MLX5TOOL
 .endif
 
 .if ${__T} != "amd64" && ${__T} != "i386" && ${__T} != "aarch64"
 BROKEN_OPTIONS+=HYPERV
 .endif
 
 # NVME is only aarch64, x86 and powerpc64*
 .if ${__T} != "aarch64" && ${__T} != "amd64" && ${__T} != "i386" && \
     ${__T:Mpowerpc64*} == ""
 BROKEN_OPTIONS+=NVME
 .endif
 
 .if ${__T} == "aarch64" || ${__T} == "amd64" || ${__T} == "i386" || \
     ${__T:Mpowerpc64*} != "" || ${__T:Mriscv64*} != ""
 __DEFAULT_YES_OPTIONS+=OPENMP
 .else
 __DEFAULT_NO_OPTIONS+=OPENMP
 .endif
 
 # libc++ requires C++20
 .if !${COMPILER_FEATURES:Mc++20}
 BROKEN_OPTIONS+=CXX
 .endif
 
 .include <bsd.mkopt.mk>
 
 #
 # Force some options off if their dependencies are off.
 # Order is somewhat important.
 #
 .if ${MK_CAPSICUM} == "no"
 MK_CASPER:=	no
 .endif
 
 .if ${MK_SOURCELESS} == "no"
 MK_SOURCELESS_HOST:=	no
 MK_SOURCELESS_UCODE:= no
 .endif
 
 .if ${MK_CDDL} == "no"
 MK_CTF:=	no
 MK_DTRACE:=	no
 MK_LOADER_ZFS:=	no
 MK_ZFS:=	no
 .endif
 
 .if ${MK_CRYPT} == "no"
 MK_OPENSSL:=	no
 MK_OPENSSH:=	no
 MK_KERBEROS:=	no
 MK_KERBEROS_SUPPORT:=	no
 .endif
 
 .if ${MK_CXX} == "no"
 MK_CLANG:=	no
 MK_LLD:=	no
 MK_LLDB:=	no
 MK_LLVM_BINUTILS:= no
 MK_GOOGLETEST:=	no
 MK_OFED:=	no
 MK_OPENMP:=	no
 MK_PMC:=	no
 MK_TESTS:=	no
 .endif
 
 .if ${MK_DIALOG} == "no"
 MK_BSDINSTALL:=	no
 .endif
 
 .if ${MK_DTRACE} == "no"
 MK_CTF:=	no
 .endif
 
 .if ${MK_MAIL} == "no"
 MK_MAILWRAPPER:= no
 MK_SENDMAIL:=	no
 MK_DMAGENT:=	no
 .endif
 
 .if ${MK_NETGRAPH} == "no"
 MK_ATM:=	no
 MK_BLUETOOTH:=	no
 .endif
 
 .if ${MK_NLS} == "no"
 MK_NLS_CATALOGS:= no
 .endif
 
 .if ${MK_OPENSSL} == "no"
 MK_DMAGENT:=	no
 MK_OPENSSH:=	no
 MK_OPENSSL_KTLS:=	no
 MK_KERBEROS:=	no
 MK_KERBEROS_SUPPORT:=	no
 MK_LDNS:=	no
 MK_PKGBOOTSTRAP:=	no
 MK_ZFS:=	no
 .endif
 
 .if ${MK_LDNS} == "no"
 MK_LDNS_UTILS:=	no
 MK_UNBOUND:= no
 .endif
 
 .if ${MK_PF} == "no"
 MK_AUTHPF:=	no
 .endif
 
 .if ${MK_OFED} == "no"
 MK_OFED_EXTRA:=	no
 .endif
 
 .if ${MK_TESTS} == "no"
 MK_DTRACE_TESTS:= no
 .endif
 
 .if ${MK_TESTS_SUPPORT} == "no"
 MK_GOOGLETEST:=	no
 .endif
 
 .if ${MK_ZONEINFO} == "no"
 MK_ZONEINFO_LEAPSECONDS_SUPPORT:= no
 .endif
 
 .if ${MK_CROSS_COMPILER} == "no"
 MK_CLANG_BOOTSTRAP:= no
 MK_ELFTOOLCHAIN_BOOTSTRAP:= no
 MK_LLD_BOOTSTRAP:= no
 .endif
 
 .if ${MK_TOOLCHAIN} == "no"
 MK_CLANG:=	no
 MK_INCLUDES:=	no
 MK_LLD:=	no
 MK_LLDB:=	no
 MK_LLVM_BINUTILS:=	no
 .endif
 
 .if ${MK_CLANG} == "no"
 MK_CLANG_EXTRAS:= no
 MK_CLANG_FORMAT:= no
 MK_CLANG_FULL:= no
 MK_LLVM_COV:= no
 .endif
 
 .if ${MK_ASAN} == "yes"
 # In order to get sensible backtraces from ASAN we have to install
 # llvm-symbolizer as /usr/bin/addr2line instead of the elftoolchain version.
 MK_LLVM_BINUTILS:=	yes
 .endif
 
 .if ${MK_LLVM_BINUTILS} == "yes"
 # MK_LLVM_CXXFILT is a subset of MK_LLVM_BINUTILS and should therefore be
 # enabled if MK_LLVM_BINUTILS is set.
 MK_LLVM_CXXFILT:=	yes
 .endif
 
 .if ${MK_LOADER_VERIEXEC} == "no"
 MK_LOADER_VERIEXEC_PASS_MANIFEST := no
 .endif
 
 #
 # MK_* options whose default value depends on another option.
 #
 .for vv in \
     GSSAPI/KERBEROS \
     MAN_UTILS/MAN
 .if defined(WITH_${vv:H})
 MK_${vv:H}:=	yes
 .elif defined(WITHOUT_${vv:H})
 MK_${vv:H}:=	no
 .else
 MK_${vv:H}:=	${MK_${vv:T}}
 .endif
 .endfor
 
 #
 # Set defaults for the MK_*_SUPPORT variables.
 #
 
 .endif #  !target(__<src.opts.mk>__)
diff --git a/share/mk/src.sys.env.mk b/share/mk/src.sys.env.mk
index 86f739414230..e20bc52d2065 100644
--- a/share/mk/src.sys.env.mk
+++ b/share/mk/src.sys.env.mk
@@ -1,94 +1,96 @@
 # $FreeBSD$
 
 # early setup only see also src.sys.mk
 
 # bmake-20170301 started taking '-C' "as is" for some cases, notably absolute
 # paths.  Some later comparisons will assume .CURDIR is resolved and matches
 # what we would get with 'cd'.  So just force resolve it now if it is an
 # absolute path.
 .if ${MAKE_VERSION} >= 20170301 && !empty(.CURDIR:M/*)
 .CURDIR:= ${.CURDIR:tA}
 .endif
 
 # make sure this is defined in a consistent manner
 SRCTOP:= ${.PARSEDIR:tA:H:H}
 
 .if ${.CURDIR} == ${SRCTOP}
 RELDIR= .
 RELTOP= .
 .elif ${.CURDIR:M${SRCTOP}/*}
 RELDIR:= ${.CURDIR:S,${SRCTOP}/,,}
 .endif
 RELTOP?= 	${RELDIR:C,[^/]+,..,g}
 RELOBJTOP?=	${RELTOP}
 RELSRCTOP?=	${RELTOP}
 
 .if !defined(OS_REVISION)
 OS_REVISION!=eval `sh ${SRCTOP}/sys/conf/newvers.sh -V REVISION` && echo $$REVISION || echo
 .export OS_REVISION
 .endif
 
 # site customizations that do not depend on anything!
 
 # Save MAKEOBJDIRPREFIX and don't let src-env.conf modify it.
 # MAKEOBJDIRPREFIX is only needed in MAKELEVEL=0.  In sub-makes it will
 # either be read from environment or OBJDIR/MAKEOBJDIR according to
 # src.sys.obj.mk.
 .if !(${.MAKE.LEVEL} == 0 || empty(OBJROOT))
 .if defined(MAKEOBJDIRPREFIX)
 _saveMAKEOBJDIRPREFIX:=	${MAKEOBJDIRPREFIX}
 .else
 _undefMAKEOBJDIRPREFIX=	t
 .endif
 .endif
 
+.-include <site.src.sys.env.mk>
+
 SRC_ENV_CONF?= /etc/src-env.conf
 .if !empty(SRC_ENV_CONF) && !target(_src_env_conf_included_)
 .-include "${SRC_ENV_CONF}"
 _src_env_conf_included_:	.NOTMAIN
 .endif
 
 .if defined(_saveMAKEOBJDIRPREFIX) || defined(_undefMAKEOBJDIRPREFIX)
 .if defined(MAKEOBJDIRPREFIX) && ((defined(_saveMAKEOBJDIRPREFIX) && \
     ${_saveMAKEOBJDIRPREFIX} != ${MAKEOBJDIRPREFIX}) || \
     defined(_undefMAKEOBJDIRPREFIX))
 .warning ${SRC_ENV_CONF}: Ignoring MAKEOBJDIRPREFIX entry in sub-make.  Use '?=' to avoid this warning.
 .endif
 .if defined(_saveMAKEOBJDIRPREFIX)
 MAKEOBJDIRPREFIX:=	${_saveMAKEOBJDIRPREFIX}
 .undef _saveMAKEOBJDIRPREFIX
 .elif defined(_undefMAKEOBJDIRPREFIX)
 .undef MAKEOBJDIRPREFIX
 .undef _undefMAKEOBJDIRPREFIX
 .endif
 .endif
 
 .include <bsd.mkopt.mk>
 
 # Top-level installs should not use meta mode as it may prevent installing
 # based on cookies. It's fine with filemon though.
 .if !empty(META_MODE:Mnofilemon) && \
   make(*install*) && ${.MAKE.LEVEL} == 0
 META_MODE=	normal
 MK_META_MODE=	no
 .export MK_META_MODE
 .endif
 
 # If we were found via .../share/mk we need to replace that
 # with ${.PARSEDIR:tA} so that we can be found by
 # sub-makes launched from objdir.
 .if ${.MAKEFLAGS:M.../share/mk} != ""
 .MAKEFLAGS:= ${.MAKEFLAGS:S,.../share/mk,${.PARSEDIR:tA},}
 .endif
 .if ${MAKESYSPATH:Uno:M*.../*} != ""
 MAKESYSPATH:= ${MAKESYSPATH:S,.../share/mk,${.PARSEDIR:tA},}
 .export MAKESYSPATH
 .elif empty(MAKESYSPATH)
 MAKESYSPATH:=	${.PARSEDIR:tA}
 .export MAKESYSPATH
 .endif
 
 .if ${RELDIR:U} == "." && ${.MAKE.LEVEL} == 0
-.sinclude "${.CURDIR}/Makefile.sys.inc"
+.-include "${.CURDIR}/Makefile.sys.inc"
 .endif
 .include <src.sys.obj.mk>