Be quiet in case /var/syspatch/ is empty and that there's no remote sig
file yet (i.e. when we are in release mode but not released yet).

ok deraadt@

Reverse output when installing a patch; it's more logical (first get, then
install). While here, match the installer output a bit more:
Get/Verify ...
Installing ...

prodded by a mail exchange with

Reverse output when installing a patch; it's more logical (first get, then
install). While here, match the installer output a bit more:
Get/Verify ...
Installing ...

prodded by a mail exchange with "bytevolcano"
discussed with robert@ sthen@
ok robert@

show more ...

Drop empty line.

Remove unused _REL variable

OK aja@

Move setting _OSrev to immediately after verifying _KERNV and exit
early if _OSrev is empty.

OK aja@

No need to escape '.' in shell patterns - it has no special meaning.

OK aja@

Spacing and use arithmetic test

OK aja@

Simplify: bundle stripcom().

/etc/mirror.conf -> /etc/installurl
discussed with deraadt@ beck@ rpe@

ls_missing(): as a precaution, don't output anything on stdout when running
ftp(1) to prevent corrupting the patch list; we are already running in silent
mode but better safe than sorry.

Read the sy

ls_missing(): as a precaution, don't output anything on stdout when running
ftp(1) to prevent corrupting the patch list; we are already running in silent
mode but better safe than sorry.

Read the syspatch mirror base URL using stripcom() /etc/mirror.conf for the time
being; discussed with deraadt@ and rpe@ -- naming is not set in stone yet.

show more ...

Use the _syspatch user.

Drop the _FETCH variable. It's useless, we are using ftp(1) specific options
that are different on the two invocations; it's not like we'll support using
wget|curl to fetch syspatches anyway.

Match what the installer does:
- verify SHA256.sig and create SHA256 out of it
- get the list of syspatches from the verified SHA256
- use sha256 against the verified SHA256 to checksum the syspatches

Drop FTP_KEEPALIVE, it's unused.

The syspatch test repo can now be accessed over https.

Make it possible to install patches even if we don't have all sets installed
(e.g. no x sets); in this case, syspatch will skip the patch *but* it will still
be listed as available. This will allow a

Make it possible to install patches even if we don't have all sets installed
(e.g. no x sets); in this case, syspatch will skip the patch *but* it will still
be listed as available. This will allow applying the patch in case sets are
installed later on.

show more ...

Cleanup syspatch directories that do not contain a tarball; it means it
was not applied properly.

Missed in previous.

Better matching and remove a useless use of sort(1).

Catch mtree(8) error; it's only run when applying patches and we already
check for read-only... in this case.

Tweak comment.

Explicit error when running on unsupported release.

If we end up creating a rollback tarball from an empty list of files, it means
we are missing a base set. In this case, error out right away or we may end up
having the patch supposedly installed but

If we end up creating a rollback tarball from an empty list of files, it means
we are missing a base set. In this case, error out right away or we may end up
having the patch supposedly installed but without its corresponding rollback
tarball.
For now we only support *full* installations.

installed patches mismatch reported by Marc Benslahdine

show more ...

Remove the ugly temporary quirks.

Simplify.