make build

# Set independent corner and background-opacity defaults.
make build DEFAULT_ROUNDING=rounded DEFAULT_BACKGROUND_OPACITY=20

# Per-article pages with system light/dark selection and no theme menu.
make build SITE_MODE=multi-page DEFAULT_THEME_MODE=auto \
    DEFAULT_THEME_SELECTOR=false

# Per-article files for file:// navigation, using a fixed theme.
make build SITE_MODE=multi-page SITE_URL_STYLE=html \
    DEFAULT_THEME=solarized-dark DEFAULT_THEME_MODE=off \
    DEFAULT_THEME_SELECTOR=false

# Published articles only, without theme controls or an article backdrop.
make build SITE_MODE_UNLISTED=false SITE_BACKGROUND=false \
    DEFAULT_THEME_MODE=off DEFAULT_THEME_SELECTOR=false

# Set this site's Atom feed identity.
make build SITE_FEED=true SITE_URL=https://example.com \
    SITE_AUTHOR='Example Author'

<article class="article" id="getting-started" data-title="Getting Started" data-created="2026-07-09" data-modified="2026-07-09" data-feed-sections="h1">
  <header class="article-header">
    <p class="kicker">Guide</p>
    <h1>Getting Started</h1>
    <p class="summary">
      A short article built from one editable HTML fragment.
    </p>
  </header>

  <section>
    <h2>Example</h2>
    <p>Article text is normal HTML.</p>
    <h3>Subsection</h3>
    <p>Plain one-line h3 headings appear under their preceding section.</p>
  </section>
</article>

<h2 data-created="2026-07-09">BUILD</h2>
<h3>Requirements</h3>
<h3 id="custom-subsection" data-modified="2026-07-10">Explicit Subsection Anchor</h3>
<h2 id="custom-anchor" data-created="2026-07-09" data-modified="2026-07-10">Explicit Anchor</h2>

<pre class="code-block" data-src="src/example.c" data-title="example.c" data-note="A short C example" data-lang="c"></pre>
<pre class="code-block" data-src="build.sh" data-lang="sh" data-open="false" data-footer="false"></pre>
<pre class="code-block" data-src="output.txt" data-lang="text" data-header="false"></pre>
<pre class="code-block" data-src="output.txt" data-title="output.txt" data-lang="text" data-header="false" data-footer="true"></pre>

make build HIGHLIGHTER=none
make build HIGHLIGHTER=pygments
make build HIGHLIGHTER=source-highlight

<div class="article-downloads" data-src="release.tar.gz" data-title="release.tar.gz" data-note="Source archive"></div>

<figure class="image-block" data-src="images/diagram.png" data-title="Diagram" data-note="Article-local image path" data-alt="Build flow diagram" data-caption="Article-local image"></figure>
<figure class="image-block" data-src="images/screenshots" data-title="Screenshots" data-alt="Installation screenshot" data-scale="large" data-border="fit"></figure>
<figure class="image-block" data-src="images/icon.png" data-title="Icon" data-alt="Small icon" data-scale="small" data-border="fit" data-align="start" data-header="false" data-footer="true"></figure>
<figure class="image-block" data-src="images/plain.png" data-alt="Borderless image" data-scale="small" data-border="none" data-align="end"></figure>

<input type="radio" name="theme" id="theme-solarized-dark" data-auto-dark="theme-solarized-dark" data-auto-light="theme-solarized-light" checked>
<label for="theme-solarized-dark">Dark</label>
<input type="radio" name="theme" id="theme-solarized-light" data-auto-dark="theme-solarized-dark" data-auto-light="theme-solarized-light">
<label for="theme-solarized-light">Light</label>

# Custom SVG after adding the required classes.
make build SITE_ICON_PATH=articles/article-slug/site-icon.svg \
    SITE_ICON_PATH_THEME=true

# Restore the Unicode icon.
make build SITE_ICON_PATH= SITE_ICON_PATH_THEME=false

types {
	include "/usr/share/misc/mime.types"
	application/atom+xml atom
}

server "arachnogoat.com" {
	listen on * port 80

	location "/.well-known/acme-challenge/*" {
		root "/acme"
		request strip 2
	}

	location * {
		block return 301 "https://$HTTP_HOST$REQUEST_URI"
	}
}

server "arachnogoat.com" {
	listen on * tls port 443

	tls {
		certificate "/etc/ssl/arachnogoat.com.fullchain.pem"
		key "/etc/ssl/private/arachnogoat.com.key"
	}

	root "/htdocs/arachnogoat.com"

	# Required when arachnopress uses SITE_URL_STYLE=extensionless.
	location not found match "/[^./]+$" {
		request rewrite "$DOCUMENT_URI.html"
	}
}

Browser URL with SITE_TITLE="Example Site":
https://host.example/?example_site_contact=1&reply=operator%40example.com&message=Short+message#contact-confirmation

HTTP request target logged by a server that retains query strings:
GET /?example_site_contact=1&reply=operator%40example.com&message=Short+message

# Run from the project root when no build is running.
rm -rf site

.
|-- Makefile
|-- README.arachnopress
|-- THIRD_PARTY_NOTICES.txt
|-- articles
|   `-- arachnopress
|       |-- article.html
|       `-- ...
|-- custom-styles.css (optional)
|-- licenses
|   |-- mit.txt
|   `-- oksolar-cc0.txt
|-- site
|   |-- THIRD_PARTY_NOTICES.txt
|   |-- articles
|   |   `-- arachnopress
|   |       |-- article.html
|   |       `-- ...
|   |-- custom-styles.css (optional)
|   |-- favicon.svg
|   |-- feed.atom (when enabled)
|   |-- index.html
|   |-- licenses
|   |   |-- mit.txt
|   |   `-- oksolar-cc0.txt
|   |-- styles.css
|   `-- theme-auto.css (when mapped modes are enabled)
|-- styles.css
`-- tools
    |-- build-profile.sh
    |-- build.sh
    |-- html-fragment.outlang
    |-- license.txt
    `-- theme-menu.html

--- /dev/null
+++ b/distrib/amd64/ramdisk_cd/bsddd/Makefile.bsddd
@@ -0,0 +1,233 @@
+#	$OpenBSD$
+
+.include <bsd.own.mk>
+
+# Stock ramdisk_cd outer-image size, retained as an override point.
+BSDDD_FSSIZE?=	11392
+BSDDD_DD_IF?=	/dev/zero
+BSDDD_WIPE_TIMEOUT?=	0
+
+BSDDD_BASEDIR=	${.CURDIR}/..
+BSDDD_TOP=	${.CURDIR}/../../../..
+BSDDD_UTILS=	${BSDDD_BASEDIR}/../../miniroot
+BSDDD_MTREE=	${BSDDD_UTILS}/mtree.conf
+BSDDD_EFIBOOT=	${DESTDIR}/usr/mdec/BOOTX64.EFI \
+		${DESTDIR}/usr/mdec/BOOTIA32.EFI
+BSDDD_MOUNT_ARGS_MSDOS=	-o-s
+
+BSDDD_RAMDISK=	RAMDISK_CD_DD
+BSDDD_KERNEL=	${.OBJDIR}/bsd
+BSDDD_FS=	miniroot${OSrev}_dd.img
+BSDDD_BUILDOBJDIR=	${.OBJDIR}/build
+BSDDD_KERNELOBJDIR=	${BSDDD_BUILDOBJDIR}/kernel/${BSDDD_RAMDISK}
+BSDDD_INSTBIN=	${BSDDD_BUILDOBJDIR}/instbin
+BSDDD_RDOBJDIR=	${.OBJDIR}/rdobj
+BSDDD_MOUNT_POINT=	${.OBJDIR}/mnt
+BSDDD_VND=	${.OBJDIR}/vnd
+BSDDD_BOOT=	${.OBJDIR}/boot
+BSDDD_OBJCHECK=	${.OBJDIR}/.bsddd-obj-ok
+BSDDD_MAKEFILE=	${.CURDIR}/Makefile.bsddd
+BSDDD_KERNELCONF=	${.CURDIR}/${BSDDD_RAMDISK}
+BSDDD_BASECONF=	${BSDDD_TOP}/sys/arch/${MACHINE}/conf/RAMDISK_CD
+BSDDD_KERNELCONFDEPS=	${BSDDD_BASECONF}
+BSDDD_LISTS=	${BSDDD_BASEDIR}/list ${.CURDIR}/list.dd
+BSDDD_SCRIPTSRC=	${.CURDIR}/bsddd
+BSDDD_SCRIPT=	${BSDDD_RDOBJDIR}/bsddd
+BSDDD_PROFILE=	${.CURDIR}/dot.profile
+# Stock 7360-block rdroot; keep paired with RAMDISK_CD_DD MINIROOTSIZE.
+BSDDD_RDROOT_SIZE?=	3680k
+BSDDD_MRMAKEFSARGS?=	-s ${BSDDD_RDROOT_SIZE} \
+		-o rdroot,minfree=0,bsize=4096,fsize=512,density=4096
+
+.PHONY: bsddd
+bsddd: bsddd.rd ${BSDDD_FS}
+
+${BSDDD_OBJCHECK}:
+	@if [ "${.OBJDIR}" = "${.CURDIR}" ]; then \
+		echo "private object directory is not active;" >&2; \
+		echo "run 'make -f Makefile.bsddd obj' separately first" >&2; \
+		exit 1; \
+	fi
+	touch $@
+
+${BSDDD_KERNEL}: ${BSDDD_OBJCHECK} ${BSDDD_MAKEFILE} \
+	    ${BSDDD_KERNELCONF} ${BSDDD_KERNELCONFDEPS}
+	install -d -o ${BUILDUSER} -g ${WOBJGROUP} ${BSDDD_KERNELOBJDIR}
+	su ${BUILDUSER} -c \
+	    'config -b ${BSDDD_KERNELOBJDIR} -s ${BSDDD_TOP}/sys \
+	    ${BSDDD_KERNELCONF} && cd ${BSDDD_KERNELOBJDIR} && \
+	    MAKEOBJDIR=${BSDDD_KERNELOBJDIR} ${MAKE} clean && \
+	    exec env MAKEOBJDIR=${BSDDD_KERNELOBJDIR} ${MAKE} ${MFLAGS}'
+	cp -p ${BSDDD_KERNELOBJDIR}/bsd $@
+
+bsddd.gz: bsddd.rd
+	objcopy -g -x -R .comment -R .SUNW_ctf \
+	    -K rd_root_size -K rd_root_image \
+	    bsddd.rd bsddd.strip
+	gzip -9cn bsddd.strip > bsddd.gz
+
+.PHONY: bsddd-stock-deps bsddd-instbin
+bsddd-stock-deps: ${BSDDD_OBJCHECK} ${BSDDD_MAKEFILE}
+	@_objroot=`cd ${BSDDD_BASEDIR} && ${MAKE} -V BSDOBJDIR`; \
+	if [ ! -d "$$_objroot" ]; then \
+		echo "normal OpenBSD object root does not exist: $$_objroot" >&2; \
+		echo "create it before building bsddd" >&2; \
+		exit 1; \
+	fi
+	cd ${BSDDD_TOP}/lib && ${MAKE} obj
+	cd ${BSDDD_TOP}/distrib/special && ${MAKE} obj
+	cd ${BSDDD_BASEDIR} && ${MAKE} obj
+	@_srcdir=`cd ${BSDDD_BASEDIR} && pwd`; \
+	_objdir=`cd ${BSDDD_BASEDIR} && ${MAKE} -V .OBJDIR`; \
+	if [ "$$_objdir" = "$$_srcdir" ] || [ ! -d "$$_objdir" ]; then \
+		echo "normal ramdisk_cd object directory is not active" >&2; \
+		exit 1; \
+	fi
+	cd ${BSDDD_TOP}/distrib/special/libstubs && ${MAKE} ${MFLAGS}
+
+bsddd-instbin: bsddd-stock-deps
+	cd ${BSDDD_BASEDIR} && ${MAKE} ${MFLAGS} instbin
+	install -d ${BSDDD_BUILDOBJDIR}
+	@_objdir=`cd ${BSDDD_BASEDIR} && ${MAKE} -V .OBJDIR`; \
+	if [ ! -f "$$_objdir/instbin" ]; then \
+		echo "stock ramdisk_cd instbin was not built" >&2; \
+		exit 1; \
+	fi; \
+	cp -p "$$_objdir/instbin" ${BSDDD_INSTBIN}
+
+bsddd.rd: bsddd-files bsddd-instbin ${BSDDD_KERNEL}
+	install -d ${BSDDD_RDOBJDIR}
+	rm -f ${BSDDD_RDOBJDIR}/instbin \
+	    ${BSDDD_RDOBJDIR}/mr.fs \
+	    ${BSDDD_RDOBJDIR}/bsd.rd
+	cp -p ${BSDDD_INSTBIN} ${BSDDD_RDOBJDIR}/instbin
+	rm -rf ${BSDDD_RDOBJDIR}/mr.fs.d
+	install -d -o root -g wheel ${BSDDD_RDOBJDIR}/mr.fs.d
+	mtree -def ${BSDDD_MTREE} -p ${BSDDD_RDOBJDIR}/mr.fs.d -u
+	CURDIR=${BSDDD_BASEDIR} OBJDIR=${BSDDD_RDOBJDIR} OSrev=${OSrev} \
+	    TARGDIR=${BSDDD_RDOBJDIR}/mr.fs.d UTILS=${BSDDD_UTILS} \
+	    RELEASEDIR=${RELEASEDIR} sh ${BSDDD_UTILS}/runlist.sh \
+	    ${BSDDD_LISTS}
+	rm ${BSDDD_RDOBJDIR}/mr.fs.d/instbin
+	makefs ${BSDDD_MRMAKEFSARGS} ${BSDDD_RDOBJDIR}/mr.fs \
+	    ${BSDDD_RDOBJDIR}/mr.fs.d
+	cp -p ${BSDDD_KERNEL} ${BSDDD_RDOBJDIR}/bsd.rd
+	rdsetroot ${BSDDD_RDOBJDIR}/bsd.rd ${BSDDD_RDOBJDIR}/mr.fs
+	cp ${BSDDD_RDOBJDIR}/bsd.rd $@
+
+${BSDDD_FS}: bsddd.gz
+	-umount -f ${BSDDD_MOUNT_POINT} >/dev/null 2>&1
+	@if [ -e ${BSDDD_VND} ] && [ ! -s ${BSDDD_VND} ]; then \
+		rm -f ${BSDDD_VND}; \
+	fi
+	@if [ -e ${BSDDD_VND} ]; then \
+		echo "stale private vnd state; run" \
+		    "'make -f Makefile.bsddd unconfig-bsddd' first" >&2; \
+		exit 1; \
+	fi
+	install -d ${BSDDD_MOUNT_POINT}
+	dd if=/dev/zero of=${BSDDD_FS} bs=512 count=${BSDDD_FSSIZE}
+	vnconfig -v ${.OBJDIR}/${BSDDD_FS} > ${BSDDD_VND}
+	fdisk -yi -l ${BSDDD_FSSIZE} -b 960 -f ${DESTDIR}/usr/mdec/mbr \
+	    `cat ${BSDDD_VND}`
+	echo '/ *' | disklabel -wAT- `cat ${BSDDD_VND}`
+	newfs -t msdos /dev/r`cat ${BSDDD_VND}`i
+	mount ${BSDDD_MOUNT_ARGS_MSDOS} /dev/`cat ${BSDDD_VND}`i \
+	    ${BSDDD_MOUNT_POINT}
+	mkdir -p ${BSDDD_MOUNT_POINT}/efi/boot
+	cp ${BSDDD_EFIBOOT} ${BSDDD_MOUNT_POINT}/efi/boot
+	umount ${BSDDD_MOUNT_POINT}
+	newfs -O 1 -m 0 -o space -i 524288 -c ${BSDDD_FSSIZE} \
+	    /dev/r`cat ${BSDDD_VND}`a
+	mount /dev/`cat ${BSDDD_VND}`a ${BSDDD_MOUNT_POINT}
+	objcopy -S -R .comment ${DESTDIR}/usr/mdec/boot ${BSDDD_BOOT}
+	installboot -v -r ${BSDDD_MOUNT_POINT} `cat ${BSDDD_VND}` \
+	    ${DESTDIR}/usr/mdec/biosboot ${BSDDD_BOOT}
+	install -c -m 555 -o root -g wheel bsddd.gz \
+	    ${BSDDD_MOUNT_POINT}/bsd
+	df -i ${BSDDD_MOUNT_POINT}
+	umount ${BSDDD_MOUNT_POINT}
+	vnconfig -u `cat ${BSDDD_VND}`
+	rm -f ${BSDDD_VND}
+
+.PHONY: bsddd-check bsddd-files
+bsddd-check:
+	@case "${BSDDD_DD_IF}" in \
+	/dev/zero|/dev/urandom) ;; \
+	*) echo "BSDDD_DD_IF must be /dev/zero or /dev/urandom" >&2; exit 1;; \
+	esac
+	@case "${BSDDD_WIPE_TIMEOUT}" in \
+	''|*[!0-9]*|0[0-9]*) \
+		echo "BSDDD_WIPE_TIMEOUT must be 0 or a positive decimal integer" >&2; \
+		exit 1;; \
+	esac
+	@if ! [ "${BSDDD_WIPE_TIMEOUT}" -le 2147483647 ]; then \
+		echo "BSDDD_WIPE_TIMEOUT exceeds 2147483647" >&2; \
+		exit 1; \
+	fi
+	test -s ${BSDDD_SCRIPTSRC}
+	test -s ${BSDDD_PROFILE}
+	test -s ${.CURDIR}/list.dd
+
+bsddd-files: ${BSDDD_OBJCHECK} bsddd-check ${BSDDD_SCRIPTSRC} \
+	    ${BSDDD_PROFILE} ${.CURDIR}/list.dd
+	install -d ${BSDDD_RDOBJDIR}
+	rm -f ${BSDDD_SCRIPT}.tmp
+	sed -e 's|^DD_IF=.*|DD_IF=${BSDDD_DD_IF}|' \
+	    -e 's|^WIPE_TIMEOUT=.*|WIPE_TIMEOUT=${BSDDD_WIPE_TIMEOUT}|' \
+	    ${BSDDD_SCRIPTSRC} > \
+	    ${BSDDD_SCRIPT}.tmp
+	grep -Fqx 'DD_IF=${BSDDD_DD_IF}' ${BSDDD_SCRIPT}.tmp
+	grep -Fqx 'WIPE_TIMEOUT=${BSDDD_WIPE_TIMEOUT}' ${BSDDD_SCRIPT}.tmp
+	mv ${BSDDD_SCRIPT}.tmp ${BSDDD_SCRIPT}
+
+.PHONY: unconfig-bsddd
+unconfig-bsddd:
+	-umount -f ${BSDDD_MOUNT_POINT} >/dev/null 2>&1
+	@if [ -e ${BSDDD_VND} ] && [ ! -s ${BSDDD_VND} ]; then \
+		rm -f ${BSDDD_VND}; \
+	elif [ -f ${BSDDD_VND} ]; then \
+		_vnd=`cat ${BSDDD_VND}`; \
+		_unit=$${_vnd#vnd}; \
+		if [ "vnd$$_unit" != "$$_vnd" ] || [ -z "$$_unit" ]; then \
+			echo "invalid private vnd state: $$_vnd" >&2; exit 1; \
+		fi; \
+		case "$$_unit" in \
+		*[!0-9]*) echo "invalid private vnd state: $$_vnd" >&2; exit 1;; \
+		esac; \
+		_info=`vnconfig -l "$$_vnd"` || exit 1; \
+		case "$$_info" in \
+		"$$_vnd: not in use") rm -f ${BSDDD_VND} ;; \
+		"$$_vnd: covering ${.OBJDIR}/${BSDDD_FS} on "*) \
+			vnconfig -u "$$_vnd" && rm -f ${BSDDD_VND} ;; \
+		*) echo "refusing to detach vnd not owned by bsddd: $$_info" >&2; \
+			exit 1 ;; \
+		esac; \
+	fi
+
+.ifdef RELEASEDIR
+.PHONY: install-bsddd
+install-bsddd: bsddd.gz ${BSDDD_FS}
+	cp bsddd.gz ${RELEASEDIR}/bsddd.rd
+	cp ${BSDDD_FS} ${RELEASEDIR}
+	chmod a+r ${RELEASEDIR}/bsddd.rd ${RELEASEDIR}/${BSDDD_FS}
+.endif
+
+.PHONY: clean-bsddd clean cleandir
+clean-bsddd: unconfig-bsddd
+	rm -f bsddd.rd bsddd.gz bsddd.strip ${BSDDD_FS} \
+	    ${BSDDD_KERNEL} ${BSDDD_BOOT} ${BSDDD_OBJCHECK}
+	rm -rf ${BSDDD_BUILDOBJDIR} ${BSDDD_RDOBJDIR}
+	-rmdir ${BSDDD_MOUNT_POINT}
+
+clean cleandir: clean-bsddd
+
+.PHONY: prepare-unpatch-bsddd
+prepare-unpatch-bsddd: clean-bsddd
+	@if [ -L ${.CURDIR}/obj ]; then \
+		_obj=`readlink ${.CURDIR}/obj`; \
+		echo "empty private object directory may be removed: $$_obj"; \
+		rm -f ${.CURDIR}/obj; \
+	fi
+
+.include <bsd.obj.mk>
--- /dev/null
+++ b/distrib/amd64/ramdisk_cd/bsddd/RAMDISK_CD_DD
@@ -0,0 +1,12 @@
+#	$OpenBSD$
+
+include "arch/amd64/conf/RAMDISK_CD"
+
+# Retain an explicit, stock-sized rdroot override for later adjustment.
+option		BSDDD_RDROOT
+rmoption	MINIROOTSIZE
+option		MINIROOTSIZE=7360
+rmoption	BSDDD_RDROOT
+
+pcppi0	at isa?
+spkr0	at pcppi?
--- /dev/null
+++ b/distrib/amd64/ramdisk_cd/bsddd/README.bsddd
@@ -0,0 +1,238 @@
+BSDDD.RD                    bsddd.rd build notes                    BSDDD.RD
+
+NAME
+     bsddd.rd - OpenBSD/amd64 parallel disk-overwrite ramdisk
+
+DESCRIPTION
+     The patch adds separate bsddd.rd and minirootXX_dd.img targets.  The
+     ramdisk waits for one eligible sd(4) or wd(4) disk to disappear, then
+     overwrites the remaining disks concurrently.  Two console confirmations
+     or an optional timeout instead select every eligible attached disk.
+
+     /dev/zero is the default input.  /dev/urandom is selectable at build
+     time.  Console messages and interval-based bells report status.
+
+     The patch adds files only.  Stock source files, Makefiles, bsd.rd,
+     minirootXX.img, and cdXX.iso targets are unchanged.  The enhanced targets
+     are available only through Makefile.bsddd.
+
+INTENDED USE
+     bsddd.rd supports batch whole-disk overwriting when preparing
+     decommissioned systems for disposal or reuse, particularly where
+     device-native sanitize or secure-erase facilities are unavailable or
+     impractical.  It runs from RAM, allowing boot media and optional console
+     equipment to be moved between machines while wipes continue.
+
+SYNOPSIS
+     Build on the matching OpenBSD/amd64 release after completing the normal
+     source and release prerequisites.  BSDOBJDIR and the amd64 boot files
+     below ${DESTDIR}/usr/mdec must exist.  The documented commands require
+     root privileges.
+
+     Apply the patch below /usr/src, create the private object link, then build:
+
+           cd /usr/src
+           patch -p1 < /root/bsddd.rd.patch
+           cd distrib/amd64/ramdisk_cd/bsddd
+           make -f Makefile.bsddd obj
+           make -f Makefile.bsddd
+
+     Select pseudorandom input instead:
+
+           make -f Makefile.bsddd BSDDD_DD_IF=/dev/urandom
+
+     Enable a 300-second all-disk timeout:
+
+           make -f Makefile.bsddd BSDDD_WIPE_TIMEOUT=300
+
+     Install release artifacts when RELEASEDIR is set:
+
+           make -f Makefile.bsddd install-bsddd \
+               RELEASEDIR=/path/to/release
+
+TARGETS
+     bsddd
+             Builds bsddd.rd and minirootXX_dd.img.
+
+     install-bsddd
+             Defined when RELEASEDIR is set.  Installs compressed bsddd.rd and
+             minirootXX_dd.img.
+
+     unconfig-bsddd
+             Recovers private mount and vnd(4) state after an interrupted
+             media build.  An unowned vnd(4) is not detached.
+
+     clean-bsddd, clean, cleandir
+             Remove private outputs.  Stock instbin objects remain under
+             normal OpenBSD clean ownership.
+
+     prepare-unpatch-bsddd
+             Cleans private outputs, prints the private object path, and
+             removes the source obj symlink.
+
+BUILD MODEL
+     make obj creates a private object link below BSDOBJDIR.  The custom
+     kernel, rdroot, instbin copy, and media objects remain below that path.
+
+     The wrapper builds stock ramdisk_cd instbin objects in their normal object
+     directories, then copies instbin into private state.  Stock source,
+     configuration, installed use, and cleanup ownership are unchanged.  Do
+     not run bsddd concurrently with a build or clean using those objects.
+
+     The private rdroot replaces .profile, installs /bsddd, and creates
+     /dev/speaker.  It adds no userland binaries.  The private kernel retains
+     the stock rdroot size and adds pcppi(4) and speaker(4).
+
+     No parent Makefile or SUBDIR list is changed.  Normal builds and cleans do
+     not enter the bsddd source directory or its private objects.
+
+DISK SELECTION
+     /bsddd reads hw.disknames with sysctl(8) and selects names matching
+     sd[0-9]* and wd[0-9]*.  This includes softraid(4) volumes, their backing
+     disks, and disks presented through common amd64 storage controllers.
+
+     Wiping begins when the current set equals the initial set minus exactly
+     one name.  Other changes leave the ramdisk waiting.  The accepted set is
+     frozen; later arrivals are excluded.  The interlock cannot identify the
+     boot medium.  Two explicit y responses or timeout expiry select every
+     eligible attached disk.  The timer continues during both prompts.
+
+     Other device classes are excluded.  After the interlock, /bsddd detaches
+     auto-assembled softraid(4) volumes and removes their names from the set.
+     Their backing disks remain selected.  Inspection or detach failure stops
+     before writes.
+
+     MAKEDEV(8) creates device nodes.  disklabel(8) supplies sector size and
+     total sectors.  dd(1) writes each whole-disk raw character device in 1 MiB
+     transfers followed by an exact sector-sized tail.  Disks run concurrently.
+     One device failure does not stop other jobs.  A status failure waits for
+     active jobs.  sync(8) precedes the final result.
+
+FEEDBACK
+     Console-bell counts and intervals identify each state:
+
+           three short bells        waiting without a timeout
+           four rapid bells         waiting with an all-disk timeout
+           two separated bells      disk writes started
+           one bell                 wipe progress
+           five short bells         all selected disks completed
+           three separated bells    setup, status, or disk-write failure
+
+     Ready patterns repeat every 10 seconds.  Completion and failure patterns
+     repeat every 30 seconds.  Progress is reported every 60 seconds.  A
+     console bell is used if speaker output fails.  The result loop continues
+     until power-off or reset.
+
+USE
+     Write minirootXX_dd.img to removable media.  This replaces the selected
+     device's partition table and filesystems.  Verify the output device.  For
+     example, as root on OpenBSD:
+
+           dd if=./miniroot79_dd.img of=/dev/rsdXc bs=1m
+           sync
+
+     Boot the target.  At the ready pattern, remove the boot medium.  Removal
+     of any eligible disk satisfies the name-based interlock.  Two separated
+     bells mark write startup.  Wait for the repeating completion pattern
+     before power-off.  Stock amd64 BIOS and UEFI boot programs are used.
+     Secure Boot is unsupported.
+
+     A boot loader or matching OpenBSD/amd64 pxeboot(8) may load the compressed
+     bsddd.rd directly.  Without removable media, use the console confirmations.
+
+REBUILD AND CLEAN
+     Rebuild private outputs:
+
+           cd /usr/src/distrib/amd64/ramdisk_cd/bsddd
+           make -f Makefile.bsddd clean
+           make -f Makefile.bsddd
+
+     Recover an interrupted media build first:
+
+           make -f Makefile.bsddd unconfig-bsddd
+
+     Before reversing the patch:
+
+           make -f Makefile.bsddd prepare-unpatch-bsddd
+           cd /usr/src
+           patch -R -p1 < /root/bsddd.rd.patch
+           rmdir distrib/amd64/ramdisk_cd/bsddd
+
+VARIABLES
+     BSDDD_DD_IF
+             Build-time dd(1) input device.  /dev/zero is the default.
+             /dev/urandom supplies non-blocking pseudorandom data but may limit
+             throughput.  No other value is accepted.
+
+     BSDDD_WIPE_TIMEOUT
+             Build-time automatic all-disk deadline in seconds.  The default,
+             0, disables it.  Values from 1 through 2147483647 enable it.
+             Expiry selects every eligible attached disk, including boot media.
+
+     BSDDD_FSSIZE
+             Outer miniroot size in 512-byte blocks.  Default: 11392, matching
+             stock ramdisk_cd.
+
+     BSDDD_RDROOT_SIZE
+             Private rdroot size.  Default: 3680k, matching 7360 512-byte
+             blocks.  An override must match MINIROOTSIZE in RAMDISK_CD_DD.
+
+     BSDDD_MRMAKEFSARGS
+             makefs(8) arguments for the private rdroot.  The default uses
+             BSDDD_RDROOT_SIZE and stock filesystem parameters.
+
+     BSDOBJDIR
+             Normal OpenBSD object root and base for the private obj symlink.
+             Default: /usr/obj.
+
+     DESTDIR
+             Optional prefix for installed amd64 boot files under usr/mdec.
+             Default: empty.
+
+     RELEASEDIR
+             Enables install-bsddd and names its destination directory.
+
+FILES
+     distrib/amd64/ramdisk_cd/bsddd/Makefile.bsddd
+             Private build wrapper.
+
+     distrib/amd64/ramdisk_cd/bsddd/RAMDISK_CD_DD
+             Private amd64 kernel configuration.
+
+     distrib/amd64/ramdisk_cd/bsddd/list.dd
+             Ramdisk overlay list.
+
+     distrib/amd64/ramdisk_cd/bsddd/dot.profile
+             Single-user profile that replaces itself with /bsddd.
+
+     distrib/amd64/ramdisk_cd/bsddd/bsddd
+             Disk enumeration, parallel overwrite, and status script.
+
+     obj/bsddd.rd
+             Uncompressed ramdisk kernel.
+
+     obj/bsddd.gz
+             Stripped and compressed kernel installed as bsddd.rd.
+
+     obj/minirootXX_dd.img
+             Bootable BIOS/UEFI whole-device image.
+
+CAVEATS
+     This operation is irreversible.  Console confirmation and timeout expiry
+     select every eligible attached disk, including boot media.
+
+     A single logical overwrite pass is not a hardware secure erase.  Remapped
+     sectors, flash translation layers, controller caches, hidden regions, and
+     inaccessible or unsupported devices may retain data.  Use device-native
+     sanitize, secure-erase, or cryptographic-erasure procedures when the
+     required disposal policy covers those areas.
+
+     Audible feedback requires a working PC speaker or console bell.  Verify
+     feedback and storage-controller support before unattended use.
+
+SEE ALSO
+     bioctl(8), dd(1), disklabel(8), make(1), MAKEDEV(8), makefs(8), pcppi(4),
+     pxeboot(8), random(4), rdsetroot(8), speaker(4), sync(8), sysctl(8),
+     vnconfig(8)
+
+BSDDD.RD                       August 18, 2026                       BSDDD.RD
--- /dev/null
+++ b/distrib/amd64/ramdisk_cd/bsddd/bsddd
@@ -0,0 +1,365 @@
+#!/bin/ksh
+
+set +o sh
+export PATH=/sbin:/bin:/usr/bin:/usr/sbin:/
+
+POLL_INTERVAL=2
+READY_INTERVAL=10
+PROGRESS_INTERVAL=60
+RESULT_INTERVAL=30
+DD_IF=/dev/zero
+WIPE_TIMEOUT=0
+
+trap '' HUP INT QUIT TSTP
+
+beep() {
+	if [[ -c /dev/speaker ]] &&
+	    print -nr -- 'T240 O4 L8 C' >/dev/speaker 2>/dev/null; then
+		return
+	fi
+	print -n '\a'
+}
+
+beep_pattern() {
+	typeset _count=$1 _interval=$2
+
+	while ((_count > 0)); do
+		beep
+		_count=$((_count - 1))
+		((_count > 0)) && sleep "$_interval"
+	done
+}
+
+result_loop() {
+	typeset _message=$1 _count=$2 _interval=$3
+
+	while :; do
+		echo
+		echo "$_message"
+		beep_pattern "$_count" "$_interval"
+		sleep $RESULT_INTERVAL
+	done
+}
+
+get_disks() {
+	typeset _entry _disk _disks='' _oldifs=$IFS
+
+	IFS=,
+	for _entry in $(sysctl -n hw.disknames); do
+		_disk=${_entry%%:*}
+		case $_disk in
+		sd+([0-9])|wd+([0-9]))
+			_disks="${_disks}${_disks:+ }$_disk"
+			;;
+		esac
+	done
+	IFS=$_oldifs
+	print -r -- "$_disks"
+}
+
+compare_disks() {
+	typeset _disk
+
+	_removed=''
+	_removed_count=0
+	_added_count=0
+	for _disk in $_initial_disks; do
+		case " $_current_disks " in
+		*" $_disk "*) ;;
+		*)
+			_removed="${_removed}${_removed:+ }$_disk"
+			_removed_count=$((_removed_count + 1))
+			;;
+		esac
+	done
+	for _disk in $_current_disks; do
+		case " $_initial_disks " in
+		*" $_disk "*) ;;
+		*)
+			_added_count=$((_added_count + 1))
+			;;
+		esac
+	done
+}
+
+start_reader() {
+	rm -f /tmp/bsddd.answer
+	(
+		typeset _answer
+		IFS= read -r _answer </dev/console || _answer=
+		if [[ $_answer == [yY] ]]; then
+			print -n 'Wipe every attached sd/wd disk, including boot media? [y/N] ' \
+			    >/dev/console
+			IFS= read -r _answer </dev/console || _answer=
+		fi
+		print -r -- "$_answer" > /tmp/bsddd.answer
+	) &
+	_reader=$!
+}
+
+stop_reader() {
+	kill "$_reader" 2>/dev/null || :
+	wait "$_reader" 2>/dev/null || :
+	rm -f /tmp/bsddd.answer
+}
+
+wipe_disk() {
+	typeset _disk=$1 _geometry _sector_size _sectors
+	typeset _sectors_per_mib _full _tail _raw
+
+	(cd /dev && sh MAKEDEV "$_disk") || return 1
+	_raw=/dev/r${_disk}c
+	[[ -c $_raw ]] || return 1
+
+	_geometry=$(disklabel -d "$_disk" 2>/dev/null) || return 1
+	_sector_size=$(print -r -- "$_geometry" |
+	    sed -n 's/^bytes\/sector:[[:space:]]*//p')
+	_sectors=$(print -r -- "$_geometry" |
+	    sed -n 's/^total sectors:[[:space:]]*\([0-9][0-9]*\).*/\1/p')
+
+	case $_sector_size in
+	''|*[!0-9]*) return 1 ;;
+	esac
+	case $_sectors in
+	''|*[!0-9]*) return 1 ;;
+	esac
+	((_sector_size > 0 && _sectors > 0)) || return 1
+
+	echo "$_disk: overwriting $_sectors sectors at $_sector_size bytes"
+
+	if ((1048576 % _sector_size != 0)); then
+		dd if="$DD_IF" of="$_raw" bs="$_sector_size" count="$_sectors" \
+		    status=none || return 1
+	else
+		_sectors_per_mib=$((1048576 / _sector_size))
+		_full=$((_sectors / _sectors_per_mib))
+		_tail=$((_sectors % _sectors_per_mib))
+
+		if ((_full > 0)); then
+			dd if="$DD_IF" of="$_raw" bs=1m count="$_full" \
+			    status=none || return 1
+		fi
+		if ((_tail > 0)); then
+			dd if="$DD_IF" of="$_raw" bs="$_sector_size" \
+			    seek="$((_full * _sectors_per_mib))" count="$_tail" \
+			    status=none || return 1
+		fi
+	fi
+
+	echo "$_disk: complete"
+}
+
+_initial_disks=$(get_disks)
+if [[ -z $_initial_disks ]]; then
+	result_loop 'ERROR: no eligible sd(4) or wd(4) disks were found.' 3 1
+fi
+
+echo
+echo "bsddd.rd is resident in memory."
+echo "Detected disks: $_initial_disks"
+echo "Remove exactly one disk to begin automatically."
+_timeout_deadline=0
+if ((WIPE_TIMEOUT > 0)); then
+	echo "Automatic all-disk wipe in $WIPE_TIMEOUT seconds."
+	_timeout_deadline=$((SECONDS + WIPE_TIMEOUT))
+fi
+echo "Proceed without detected device removal? [y/N]"
+
+start_reader
+_ready_elapsed=$READY_INTERVAL
+_last_disks=$_initial_disks
+_override=no
+
+while :; do
+	_current_disks=$(get_disks)
+	compare_disks
+	if ((_removed_count == 1 && _added_count == 0)); then
+		stop_reader
+		_disks=$_current_disks
+		echo
+		echo "Removed disk: $_removed"
+		break
+	fi
+
+	if [[ $_current_disks != "$_last_disks" ]]; then
+		echo "Waiting; current disks: ${_current_disks:-none}"
+		_last_disks=$_current_disks
+	fi
+
+	if [[ -s /tmp/bsddd.answer ]]; then
+		_answer=$(</tmp/bsddd.answer)
+		wait "$_reader" 2>/dev/null || :
+		rm -f /tmp/bsddd.answer
+		if [[ $_answer == [yY] ]]; then
+			_override=console
+			_disks=$(get_disks)
+			break
+		fi
+		echo "Proceed without detected device removal? [y/N]"
+		start_reader
+	elif ! kill -0 "$_reader" 2>/dev/null; then
+		wait "$_reader" 2>/dev/null || :
+		start_reader
+	fi
+
+	if ((_timeout_deadline > 0 && SECONDS >= _timeout_deadline)); then
+		stop_reader
+		_override=timeout
+		_disks=$(get_disks)
+		break
+	fi
+
+	if ((_ready_elapsed >= READY_INTERVAL)); then
+		if ((_timeout_deadline > 0)); then
+			beep_pattern 4 0.15
+		else
+			beep_pattern 3 0.25
+		fi
+		_ready_elapsed=0
+	fi
+	_sleep=$POLL_INTERVAL
+	if ((_timeout_deadline > 0)); then
+		_remaining=$((_timeout_deadline - SECONDS))
+		((_remaining < _sleep)) && _sleep=$_remaining
+		((_sleep > 0)) || continue
+	fi
+	sleep "$_sleep"
+	_ready_elapsed=$((_ready_elapsed + _sleep))
+done
+
+if ! _softraid_output=$(bioctl softraid0 2>/dev/null); then
+	result_loop 'ERROR: cannot inspect softraid volumes.' 3 1
+fi
+_softraid_volumes=$(print -r -- "$_softraid_output" |
+    sed -n 's/^softraid0.*\(sd[0-9][0-9]*\).*/\1/p')
+for _volume in $_softraid_volumes; do
+	echo "$_volume: detaching softraid volume"
+	if ! bioctl -d "$_volume" >/dev/null 2>&1; then
+		result_loop "ERROR: cannot detach softraid volume: $_volume" 3 1
+	fi
+done
+
+_wipe_disks=
+for _disk in $_disks; do
+	case " $_softraid_volumes " in
+	*" $_disk "*) ;;
+	*) _wipe_disks="${_wipe_disks}${_wipe_disks:+ }$_disk" ;;
+	esac
+done
+_disks=$_wipe_disks
+if [[ -z $_disks ]]; then
+	result_loop 'ERROR: no eligible sd(4) or wd(4) disks remain.' 3 1
+fi
+
+_status_dir=/tmp/bsddd.status
+if ! rm -rf "$_status_dir" || ! mkdir "$_status_dir"; then
+	result_loop 'ERROR: cannot initialize wipe status storage.' 3 1
+fi
+for _disk in $_disks; do
+	_status_file=$_status_dir/$_disk
+	_status_ok=${_status_file}.ok
+	_status_failed=${_status_file}.failed
+	if ! print -r -- running > "$_status_file" ||
+	    ! print -r -- ok > "$_status_ok" ||
+	    ! print -r -- failed > "$_status_failed" ||
+	    [[ $(<"$_status_file") != running ]] ||
+	    [[ $(<"$_status_ok") != ok ]] ||
+	    [[ $(<"$_status_failed") != failed ]]; then
+		result_loop 'ERROR: cannot initialize wipe status storage.' 3 1
+	fi
+done
+
+echo
+if [[ $_override == console ]]; then
+	echo "Console override confirmed."
+elif [[ $_override == timeout ]]; then
+	echo "Wipe timeout expired; all attached sd/wd disks selected."
+fi
+echo "Wiping disks in parallel: $_disks"
+echo "Wipe input: $DD_IF"
+echo "DO NOT POWER OFF."
+beep_pattern 2 1
+
+_jobs=
+_total=0
+for _disk in $_disks; do
+	(
+		_status_file=$_status_dir/$_disk
+		if wipe_disk "$_disk"; then
+			mv "${_status_file}.ok" "$_status_file" || exit 2
+			exit 0
+		else
+			mv "${_status_file}.failed" "$_status_file" || exit 2
+			exit 1
+		fi
+	) &
+	_jobs="${_jobs}${_jobs:+ }$!:$_disk"
+	_total=$((_total + 1))
+done
+
+_elapsed=0
+_status_error=no
+while :; do
+	_done=0
+	for _job in $_jobs; do
+		_pid=${_job%%:*}
+		_disk=${_job#*:}
+		_status_file=$_status_dir/$_disk
+		if [[ ! -r $_status_file ]]; then
+			_status_error=yes
+			break
+		fi
+		_status=$(<"$_status_file")
+		case $_status in
+		ok|failed)
+			_done=$((_done + 1))
+			;;
+		running)
+			if ! kill -0 "$_pid" 2>/dev/null; then
+				_status_error=yes
+				break
+			fi
+			;;
+		*)
+			_status_error=yes
+			break
+			;;
+		esac
+	done
+	[[ $_status_error == yes ]] && break
+	((_done == _total)) && break
+
+	sleep $POLL_INTERVAL
+	_elapsed=$((_elapsed + POLL_INTERVAL))
+	if ((_elapsed >= PROGRESS_INTERVAL)); then
+		echo "Wipe in progress: $_done/$_total disks complete."
+		beep_pattern 1 0
+		_elapsed=0
+	fi
+done
+
+if [[ $_status_error == yes ]]; then
+	echo "ERROR: wipe status unavailable; waiting for disk jobs."
+fi
+for _job in $_jobs; do
+	_pid=${_job%%:*}
+	wait "$_pid" 2>/dev/null || :
+done
+sync
+
+if [[ $_status_error == yes ]]; then
+	result_loop 'ERROR: wipe status unavailable.' 3 1
+fi
+
+_failed=
+for _disk in $_disks; do
+	_status_file=$_status_dir/$_disk
+	[[ $(<"$_status_file") == ok ]] ||
+	    _failed="${_failed}${_failed:+ }$_disk"
+done
+
+if [[ -n $_failed ]]; then
+	result_loop "ERROR: wipe failed: $_failed" 3 1
+fi
+
+result_loop 'WIPE COMPLETE: all selected disks were overwritten.' 5 0.25
--- /dev/null
+++ b/distrib/amd64/ramdisk_cd/bsddd/dot.profile
@@ -0,0 +1,16 @@
+set +o sh
+export PATH=/sbin:/bin:/usr/bin:/usr/sbin:/
+
+if ! mount -u /dev/rd0a /; then
+	echo "Cannot remount rd0a read-write."
+	while :; do
+		sleep 3600
+	done
+fi
+
+exec /bsddd
+
+echo "Cannot start /bsddd."
+while :; do
+	sleep 3600
+done
--- /dev/null
+++ b/distrib/amd64/ramdisk_cd/bsddd/list.dd
@@ -0,0 +1,7 @@
+#	$OpenBSD$
+
+# bsddd.rd overlay.
+SCRIPT	${CURDIR}/bsddd/dot.profile		.profile
+SCRIPT	${OBJDIR}/bsddd				bsddd
+SPECIAL	chmod 555 bsddd
+SPECIAL	cd dev; sh MAKEDEV speaker

set -e

cd /usr/src
patch -p1 < /root/bsddd.rd.patch
cd distrib/amd64/ramdisk_cd/bsddd
make -f Makefile.bsddd obj
make -f Makefile.bsddd

cd /usr/src/distrib/amd64/ramdisk_cd/bsddd
make -f Makefile.bsddd BSDDD_DD_IF=/dev/urandom

set -e

cd /usr/src/distrib/amd64/ramdisk_cd/bsddd
make -f Makefile.bsddd install-bsddd \
    RELEASEDIR=/path/to/release

distrib/amd64/ramdisk_cd/bsddd/
|-- Makefile.bsddd
|-- RAMDISK_CD_DD
|-- README.bsddd
|-- bsddd
|-- dot.profile
`-- list.dd

#	$OpenBSD$

.include <bsd.own.mk>

# Stock ramdisk_cd outer-image size, retained as an override point.
BSDDD_FSSIZE?=	11392
BSDDD_DD_IF?=	/dev/zero
BSDDD_WIPE_TIMEOUT?=	0

BSDDD_BASEDIR=	${.CURDIR}/..
BSDDD_TOP=	${.CURDIR}/../../../..
BSDDD_UTILS=	${BSDDD_BASEDIR}/../../miniroot
BSDDD_MTREE=	${BSDDD_UTILS}/mtree.conf
BSDDD_EFIBOOT=	${DESTDIR}/usr/mdec/BOOTX64.EFI \
		${DESTDIR}/usr/mdec/BOOTIA32.EFI
BSDDD_MOUNT_ARGS_MSDOS=	-o-s

BSDDD_RAMDISK=	RAMDISK_CD_DD
BSDDD_KERNEL=	${.OBJDIR}/bsd
BSDDD_FS=	miniroot${OSrev}_dd.img
BSDDD_BUILDOBJDIR=	${.OBJDIR}/build
BSDDD_KERNELOBJDIR=	${BSDDD_BUILDOBJDIR}/kernel/${BSDDD_RAMDISK}
BSDDD_INSTBIN=	${BSDDD_BUILDOBJDIR}/instbin
BSDDD_RDOBJDIR=	${.OBJDIR}/rdobj
BSDDD_MOUNT_POINT=	${.OBJDIR}/mnt
BSDDD_VND=	${.OBJDIR}/vnd
BSDDD_BOOT=	${.OBJDIR}/boot
BSDDD_OBJCHECK=	${.OBJDIR}/.bsddd-obj-ok
BSDDD_MAKEFILE=	${.CURDIR}/Makefile.bsddd
BSDDD_KERNELCONF=	${.CURDIR}/${BSDDD_RAMDISK}
BSDDD_BASECONF=	${BSDDD_TOP}/sys/arch/${MACHINE}/conf/RAMDISK_CD
BSDDD_KERNELCONFDEPS=	${BSDDD_BASECONF}
BSDDD_LISTS=	${BSDDD_BASEDIR}/list ${.CURDIR}/list.dd
BSDDD_SCRIPTSRC=	${.CURDIR}/bsddd
BSDDD_SCRIPT=	${BSDDD_RDOBJDIR}/bsddd
BSDDD_PROFILE=	${.CURDIR}/dot.profile
# Stock 7360-block rdroot; keep paired with RAMDISK_CD_DD MINIROOTSIZE.
BSDDD_RDROOT_SIZE?=	3680k
BSDDD_MRMAKEFSARGS?=	-s ${BSDDD_RDROOT_SIZE} \
		-o rdroot,minfree=0,bsize=4096,fsize=512,density=4096

.PHONY: bsddd
bsddd: bsddd.rd ${BSDDD_FS}

${BSDDD_OBJCHECK}:
	@if [ "${.OBJDIR}" = "${.CURDIR}" ]; then \
		echo "private object directory is not active;" >&2; \
		echo "run 'make -f Makefile.bsddd obj' separately first" >&2; \
		exit 1; \
	fi
	touch $@

${BSDDD_KERNEL}: ${BSDDD_OBJCHECK} ${BSDDD_MAKEFILE} \
	    ${BSDDD_KERNELCONF} ${BSDDD_KERNELCONFDEPS}
	install -d -o ${BUILDUSER} -g ${WOBJGROUP} ${BSDDD_KERNELOBJDIR}
	su ${BUILDUSER} -c \
	    'config -b ${BSDDD_KERNELOBJDIR} -s ${BSDDD_TOP}/sys \
	    ${BSDDD_KERNELCONF} && cd ${BSDDD_KERNELOBJDIR} && \
	    MAKEOBJDIR=${BSDDD_KERNELOBJDIR} ${MAKE} clean && \
	    exec env MAKEOBJDIR=${BSDDD_KERNELOBJDIR} ${MAKE} ${MFLAGS}'
	cp -p ${BSDDD_KERNELOBJDIR}/bsd $@

bsddd.gz: bsddd.rd
	objcopy -g -x -R .comment -R .SUNW_ctf \
	    -K rd_root_size -K rd_root_image \
	    bsddd.rd bsddd.strip
	gzip -9cn bsddd.strip > bsddd.gz

.PHONY: bsddd-stock-deps bsddd-instbin
bsddd-stock-deps: ${BSDDD_OBJCHECK} ${BSDDD_MAKEFILE}
	@_objroot=`cd ${BSDDD_BASEDIR} && ${MAKE} -V BSDOBJDIR`; \
	if [ ! -d "$$_objroot" ]; then \
		echo "normal OpenBSD object root does not exist: $$_objroot" >&2; \
		echo "create it before building bsddd" >&2; \
		exit 1; \
	fi
	cd ${BSDDD_TOP}/lib && ${MAKE} obj
	cd ${BSDDD_TOP}/distrib/special && ${MAKE} obj
	cd ${BSDDD_BASEDIR} && ${MAKE} obj
	@_srcdir=`cd ${BSDDD_BASEDIR} && pwd`; \
	_objdir=`cd ${BSDDD_BASEDIR} && ${MAKE} -V .OBJDIR`; \
	if [ "$$_objdir" = "$$_srcdir" ] || [ ! -d "$$_objdir" ]; then \
		echo "normal ramdisk_cd object directory is not active" >&2; \
		exit 1; \
	fi
	cd ${BSDDD_TOP}/distrib/special/libstubs && ${MAKE} ${MFLAGS}

bsddd-instbin: bsddd-stock-deps
	cd ${BSDDD_BASEDIR} && ${MAKE} ${MFLAGS} instbin
	install -d ${BSDDD_BUILDOBJDIR}
	@_objdir=`cd ${BSDDD_BASEDIR} && ${MAKE} -V .OBJDIR`; \
	if [ ! -f "$$_objdir/instbin" ]; then \
		echo "stock ramdisk_cd instbin was not built" >&2; \
		exit 1; \
	fi; \
	cp -p "$$_objdir/instbin" ${BSDDD_INSTBIN}

bsddd.rd: bsddd-files bsddd-instbin ${BSDDD_KERNEL}
	install -d ${BSDDD_RDOBJDIR}
	rm -f ${BSDDD_RDOBJDIR}/instbin \
	    ${BSDDD_RDOBJDIR}/mr.fs \
	    ${BSDDD_RDOBJDIR}/bsd.rd
	cp -p ${BSDDD_INSTBIN} ${BSDDD_RDOBJDIR}/instbin
	rm -rf ${BSDDD_RDOBJDIR}/mr.fs.d
	install -d -o root -g wheel ${BSDDD_RDOBJDIR}/mr.fs.d
	mtree -def ${BSDDD_MTREE} -p ${BSDDD_RDOBJDIR}/mr.fs.d -u
	CURDIR=${BSDDD_BASEDIR} OBJDIR=${BSDDD_RDOBJDIR} OSrev=${OSrev} \
	    TARGDIR=${BSDDD_RDOBJDIR}/mr.fs.d UTILS=${BSDDD_UTILS} \
	    RELEASEDIR=${RELEASEDIR} sh ${BSDDD_UTILS}/runlist.sh \
	    ${BSDDD_LISTS}
	rm ${BSDDD_RDOBJDIR}/mr.fs.d/instbin
	makefs ${BSDDD_MRMAKEFSARGS} ${BSDDD_RDOBJDIR}/mr.fs \
	    ${BSDDD_RDOBJDIR}/mr.fs.d
	cp -p ${BSDDD_KERNEL} ${BSDDD_RDOBJDIR}/bsd.rd
	rdsetroot ${BSDDD_RDOBJDIR}/bsd.rd ${BSDDD_RDOBJDIR}/mr.fs
	cp ${BSDDD_RDOBJDIR}/bsd.rd $@

${BSDDD_FS}: bsddd.gz
	-umount -f ${BSDDD_MOUNT_POINT} >/dev/null 2>&1
	@if [ -e ${BSDDD_VND} ] && [ ! -s ${BSDDD_VND} ]; then \
		rm -f ${BSDDD_VND}; \
	fi
	@if [ -e ${BSDDD_VND} ]; then \
		echo "stale private vnd state; run" \
		    "'make -f Makefile.bsddd unconfig-bsddd' first" >&2; \
		exit 1; \
	fi
	install -d ${BSDDD_MOUNT_POINT}
	dd if=/dev/zero of=${BSDDD_FS} bs=512 count=${BSDDD_FSSIZE}
	vnconfig -v ${.OBJDIR}/${BSDDD_FS} > ${BSDDD_VND}
	fdisk -yi -l ${BSDDD_FSSIZE} -b 960 -f ${DESTDIR}/usr/mdec/mbr \
	    `cat ${BSDDD_VND}`
	echo '/ *' | disklabel -wAT- `cat ${BSDDD_VND}`
	newfs -t msdos /dev/r`cat ${BSDDD_VND}`i
	mount ${BSDDD_MOUNT_ARGS_MSDOS} /dev/`cat ${BSDDD_VND}`i \
	    ${BSDDD_MOUNT_POINT}
	mkdir -p ${BSDDD_MOUNT_POINT}/efi/boot
	cp ${BSDDD_EFIBOOT} ${BSDDD_MOUNT_POINT}/efi/boot
	umount ${BSDDD_MOUNT_POINT}
	newfs -O 1 -m 0 -o space -i 524288 -c ${BSDDD_FSSIZE} \
	    /dev/r`cat ${BSDDD_VND}`a
	mount /dev/`cat ${BSDDD_VND}`a ${BSDDD_MOUNT_POINT}
	objcopy -S -R .comment ${DESTDIR}/usr/mdec/boot ${BSDDD_BOOT}
	installboot -v -r ${BSDDD_MOUNT_POINT} `cat ${BSDDD_VND}` \
	    ${DESTDIR}/usr/mdec/biosboot ${BSDDD_BOOT}
	install -c -m 555 -o root -g wheel bsddd.gz \
	    ${BSDDD_MOUNT_POINT}/bsd
	df -i ${BSDDD_MOUNT_POINT}
	umount ${BSDDD_MOUNT_POINT}
	vnconfig -u `cat ${BSDDD_VND}`
	rm -f ${BSDDD_VND}

.PHONY: bsddd-check bsddd-files
bsddd-check:
	@case "${BSDDD_DD_IF}" in \
	/dev/zero|/dev/urandom) ;; \
	*) echo "BSDDD_DD_IF must be /dev/zero or /dev/urandom" >&2; exit 1;; \
	esac
	@case "${BSDDD_WIPE_TIMEOUT}" in \
	''|*[!0-9]*|0[0-9]*) \
		echo "BSDDD_WIPE_TIMEOUT must be 0 or a positive decimal integer" >&2; \
		exit 1;; \
	esac
	@if ! [ "${BSDDD_WIPE_TIMEOUT}" -le 2147483647 ]; then \
		echo "BSDDD_WIPE_TIMEOUT exceeds 2147483647" >&2; \
		exit 1; \
	fi
	test -s ${BSDDD_SCRIPTSRC}
	test -s ${BSDDD_PROFILE}
	test -s ${.CURDIR}/list.dd

bsddd-files: ${BSDDD_OBJCHECK} bsddd-check ${BSDDD_SCRIPTSRC} \
	    ${BSDDD_PROFILE} ${.CURDIR}/list.dd
	install -d ${BSDDD_RDOBJDIR}
	rm -f ${BSDDD_SCRIPT}.tmp
	sed -e 's|^DD_IF=.*|DD_IF=${BSDDD_DD_IF}|' \
	    -e 's|^WIPE_TIMEOUT=.*|WIPE_TIMEOUT=${BSDDD_WIPE_TIMEOUT}|' \
	    ${BSDDD_SCRIPTSRC} > \
	    ${BSDDD_SCRIPT}.tmp
	grep -Fqx 'DD_IF=${BSDDD_DD_IF}' ${BSDDD_SCRIPT}.tmp
	grep -Fqx 'WIPE_TIMEOUT=${BSDDD_WIPE_TIMEOUT}' ${BSDDD_SCRIPT}.tmp
	mv ${BSDDD_SCRIPT}.tmp ${BSDDD_SCRIPT}

.PHONY: unconfig-bsddd
unconfig-bsddd:
	-umount -f ${BSDDD_MOUNT_POINT} >/dev/null 2>&1
	@if [ -e ${BSDDD_VND} ] && [ ! -s ${BSDDD_VND} ]; then \
		rm -f ${BSDDD_VND}; \
	elif [ -f ${BSDDD_VND} ]; then \
		_vnd=`cat ${BSDDD_VND}`; \
		_unit=$${_vnd#vnd}; \
		if [ "vnd$$_unit" != "$$_vnd" ] || [ -z "$$_unit" ]; then \
			echo "invalid private vnd state: $$_vnd" >&2; exit 1; \
		fi; \
		case "$$_unit" in \
		*[!0-9]*) echo "invalid private vnd state: $$_vnd" >&2; exit 1;; \
		esac; \
		_info=`vnconfig -l "$$_vnd"` || exit 1; \
		case "$$_info" in \
		"$$_vnd: not in use") rm -f ${BSDDD_VND} ;; \
		"$$_vnd: covering ${.OBJDIR}/${BSDDD_FS} on "*) \
			vnconfig -u "$$_vnd" && rm -f ${BSDDD_VND} ;; \
		*) echo "refusing to detach vnd not owned by bsddd: $$_info" >&2; \
			exit 1 ;; \
		esac; \
	fi

.ifdef RELEASEDIR
.PHONY: install-bsddd
install-bsddd: bsddd.gz ${BSDDD_FS}
	cp bsddd.gz ${RELEASEDIR}/bsddd.rd
	cp ${BSDDD_FS} ${RELEASEDIR}
	chmod a+r ${RELEASEDIR}/bsddd.rd ${RELEASEDIR}/${BSDDD_FS}
.endif

.PHONY: clean-bsddd clean cleandir
clean-bsddd: unconfig-bsddd
	rm -f bsddd.rd bsddd.gz bsddd.strip ${BSDDD_FS} \
	    ${BSDDD_KERNEL} ${BSDDD_BOOT} ${BSDDD_OBJCHECK}
	rm -rf ${BSDDD_BUILDOBJDIR} ${BSDDD_RDOBJDIR}
	-rmdir ${BSDDD_MOUNT_POINT}

clean cleandir: clean-bsddd

.PHONY: prepare-unpatch-bsddd
prepare-unpatch-bsddd: clean-bsddd
	@if [ -L ${.CURDIR}/obj ]; then \
		_obj=`readlink ${.CURDIR}/obj`; \
		echo "empty private object directory may be removed: $$_obj"; \
		rm -f ${.CURDIR}/obj; \
	fi

.include <bsd.obj.mk>

#	$OpenBSD$

include "arch/amd64/conf/RAMDISK_CD"

# Retain an explicit, stock-sized rdroot override for later adjustment.
option		BSDDD_RDROOT
rmoption	MINIROOTSIZE
option		MINIROOTSIZE=7360
rmoption	BSDDD_RDROOT

pcppi0	at isa?
spkr0	at pcppi?

#	$OpenBSD$

# bsddd.rd overlay.
SCRIPT	${CURDIR}/bsddd/dot.profile		.profile
SCRIPT	${OBJDIR}/bsddd				bsddd
SPECIAL	chmod 555 bsddd
SPECIAL	cd dev; sh MAKEDEV speaker

set +o sh
export PATH=/sbin:/bin:/usr/bin:/usr/sbin:/

if ! mount -u /dev/rd0a /; then
	echo "Cannot remount rd0a read-write."
	while :; do
		sleep 3600
	done
fi

exec /bsddd

echo "Cannot start /bsddd."
while :; do
	sleep 3600
done

#!/bin/ksh

set +o sh
export PATH=/sbin:/bin:/usr/bin:/usr/sbin:/

POLL_INTERVAL=2
READY_INTERVAL=10
PROGRESS_INTERVAL=60
RESULT_INTERVAL=30
DD_IF=/dev/zero
WIPE_TIMEOUT=0

trap '' HUP INT QUIT TSTP

beep() {
	if [[ -c /dev/speaker ]] &&
	    print -nr -- 'T240 O4 L8 C' >/dev/speaker 2>/dev/null; then
		return
	fi
	print -n '\a'
}

beep_pattern() {
	typeset _count=$1 _interval=$2

	while ((_count > 0)); do
		beep
		_count=$((_count - 1))
		((_count > 0)) && sleep "$_interval"
	done
}

result_loop() {
	typeset _message=$1 _count=$2 _interval=$3

	while :; do
		echo
		echo "$_message"
		beep_pattern "$_count" "$_interval"
		sleep $RESULT_INTERVAL
	done
}

get_disks() {
	typeset _entry _disk _disks='' _oldifs=$IFS

	IFS=,
	for _entry in $(sysctl -n hw.disknames); do
		_disk=${_entry%%:*}
		case $_disk in
		sd+([0-9])|wd+([0-9]))
			_disks="${_disks}${_disks:+ }$_disk"
			;;
		esac
	done
	IFS=$_oldifs
	print -r -- "$_disks"
}

compare_disks() {
	typeset _disk

	_removed=''
	_removed_count=0
	_added_count=0
	for _disk in $_initial_disks; do
		case " $_current_disks " in
		*" $_disk "*) ;;
		*)
			_removed="${_removed}${_removed:+ }$_disk"
			_removed_count=$((_removed_count + 1))
			;;
		esac
	done
	for _disk in $_current_disks; do
		case " $_initial_disks " in
		*" $_disk "*) ;;
		*)
			_added_count=$((_added_count + 1))
			;;
		esac
	done
}

start_reader() {
	rm -f /tmp/bsddd.answer
	(
		typeset _answer
		IFS= read -r _answer </dev/console || _answer=
		if [[ $_answer == [yY] ]]; then
			print -n 'Wipe every attached sd/wd disk, including boot media? [y/N] ' \
			    >/dev/console
			IFS= read -r _answer </dev/console || _answer=
		fi
		print -r -- "$_answer" > /tmp/bsddd.answer
	) &
	_reader=$!
}

stop_reader() {
	kill "$_reader" 2>/dev/null || :
	wait "$_reader" 2>/dev/null || :
	rm -f /tmp/bsddd.answer
}

wipe_disk() {
	typeset _disk=$1 _geometry _sector_size _sectors
	typeset _sectors_per_mib _full _tail _raw

	(cd /dev && sh MAKEDEV "$_disk") || return 1
	_raw=/dev/r${_disk}c
	[[ -c $_raw ]] || return 1

	_geometry=$(disklabel -d "$_disk" 2>/dev/null) || return 1
	_sector_size=$(print -r -- "$_geometry" |
	    sed -n 's/^bytes\/sector:[[:space:]]*//p')
	_sectors=$(print -r -- "$_geometry" |
	    sed -n 's/^total sectors:[[:space:]]*\([0-9][0-9]*\).*/\1/p')

	case $_sector_size in
	''|*[!0-9]*) return 1 ;;
	esac
	case $_sectors in
	''|*[!0-9]*) return 1 ;;
	esac
	((_sector_size > 0 && _sectors > 0)) || return 1

	echo "$_disk: overwriting $_sectors sectors at $_sector_size bytes"

	if ((1048576 % _sector_size != 0)); then
		dd if="$DD_IF" of="$_raw" bs="$_sector_size" count="$_sectors" \
		    status=none || return 1
	else
		_sectors_per_mib=$((1048576 / _sector_size))
		_full=$((_sectors / _sectors_per_mib))
		_tail=$((_sectors % _sectors_per_mib))

		if ((_full > 0)); then
			dd if="$DD_IF" of="$_raw" bs=1m count="$_full" \
			    status=none || return 1
		fi
		if ((_tail > 0)); then
			dd if="$DD_IF" of="$_raw" bs="$_sector_size" \
			    seek="$((_full * _sectors_per_mib))" count="$_tail" \
			    status=none || return 1
		fi
	fi

	echo "$_disk: complete"
}

_initial_disks=$(get_disks)
if [[ -z $_initial_disks ]]; then
	result_loop 'ERROR: no eligible sd(4) or wd(4) disks were found.' 3 1
fi

echo
echo "bsddd.rd is resident in memory."
echo "Detected disks: $_initial_disks"
echo "Remove exactly one disk to begin automatically."
_timeout_deadline=0
if ((WIPE_TIMEOUT > 0)); then
	echo "Automatic all-disk wipe in $WIPE_TIMEOUT seconds."
	_timeout_deadline=$((SECONDS + WIPE_TIMEOUT))
fi
echo "Proceed without detected device removal? [y/N]"

start_reader
_ready_elapsed=$READY_INTERVAL
_last_disks=$_initial_disks
_override=no

while :; do
	_current_disks=$(get_disks)
	compare_disks
	if ((_removed_count == 1 && _added_count == 0)); then
		stop_reader
		_disks=$_current_disks
		echo
		echo "Removed disk: $_removed"
		break
	fi

	if [[ $_current_disks != "$_last_disks" ]]; then
		echo "Waiting; current disks: ${_current_disks:-none}"
		_last_disks=$_current_disks
	fi

	if [[ -s /tmp/bsddd.answer ]]; then
		_answer=$(</tmp/bsddd.answer)
		wait "$_reader" 2>/dev/null || :
		rm -f /tmp/bsddd.answer
		if [[ $_answer == [yY] ]]; then
			_override=console
			_disks=$(get_disks)
			break
		fi
		echo "Proceed without detected device removal? [y/N]"
		start_reader
	elif ! kill -0 "$_reader" 2>/dev/null; then
		wait "$_reader" 2>/dev/null || :
		start_reader
	fi

	if ((_timeout_deadline > 0 && SECONDS >= _timeout_deadline)); then
		stop_reader
		_override=timeout
		_disks=$(get_disks)
		break
	fi

	if ((_ready_elapsed >= READY_INTERVAL)); then
		if ((_timeout_deadline > 0)); then
			beep_pattern 4 0.15
		else
			beep_pattern 3 0.25
		fi
		_ready_elapsed=0
	fi
	_sleep=$POLL_INTERVAL
	if ((_timeout_deadline > 0)); then
		_remaining=$((_timeout_deadline - SECONDS))
		((_remaining < _sleep)) && _sleep=$_remaining
		((_sleep > 0)) || continue
	fi
	sleep "$_sleep"
	_ready_elapsed=$((_ready_elapsed + _sleep))
done

if ! _softraid_output=$(bioctl softraid0 2>/dev/null); then
	result_loop 'ERROR: cannot inspect softraid volumes.' 3 1
fi
_softraid_volumes=$(print -r -- "$_softraid_output" |
    sed -n 's/^softraid0.*\(sd[0-9][0-9]*\).*/\1/p')
for _volume in $_softraid_volumes; do
	echo "$_volume: detaching softraid volume"
	if ! bioctl -d "$_volume" >/dev/null 2>&1; then
		result_loop "ERROR: cannot detach softraid volume: $_volume" 3 1
	fi
done

_wipe_disks=
for _disk in $_disks; do
	case " $_softraid_volumes " in
	*" $_disk "*) ;;
	*) _wipe_disks="${_wipe_disks}${_wipe_disks:+ }$_disk" ;;
	esac
done
_disks=$_wipe_disks
if [[ -z $_disks ]]; then
	result_loop 'ERROR: no eligible sd(4) or wd(4) disks remain.' 3 1
fi

_status_dir=/tmp/bsddd.status
if ! rm -rf "$_status_dir" || ! mkdir "$_status_dir"; then
	result_loop 'ERROR: cannot initialize wipe status storage.' 3 1
fi
for _disk in $_disks; do
	_status_file=$_status_dir/$_disk
	_status_ok=${_status_file}.ok
	_status_failed=${_status_file}.failed
	if ! print -r -- running > "$_status_file" ||
	    ! print -r -- ok > "$_status_ok" ||
	    ! print -r -- failed > "$_status_failed" ||
	    [[ $(<"$_status_file") != running ]] ||
	    [[ $(<"$_status_ok") != ok ]] ||
	    [[ $(<"$_status_failed") != failed ]]; then
		result_loop 'ERROR: cannot initialize wipe status storage.' 3 1
	fi
done

echo
if [[ $_override == console ]]; then
	echo "Console override confirmed."
elif [[ $_override == timeout ]]; then
	echo "Wipe timeout expired; all attached sd/wd disks selected."
fi
echo "Wiping disks in parallel: $_disks"
echo "Wipe input: $DD_IF"
echo "DO NOT POWER OFF."
beep_pattern 2 1

_jobs=
_total=0
for _disk in $_disks; do
	(
		_status_file=$_status_dir/$_disk
		if wipe_disk "$_disk"; then
			mv "${_status_file}.ok" "$_status_file" || exit 2
			exit 0
		else
			mv "${_status_file}.failed" "$_status_file" || exit 2
			exit 1
		fi
	) &
	_jobs="${_jobs}${_jobs:+ }$!:$_disk"
	_total=$((_total + 1))
done

_elapsed=0
_status_error=no
while :; do
	_done=0
	for _job in $_jobs; do
		_pid=${_job%%:*}
		_disk=${_job#*:}
		_status_file=$_status_dir/$_disk
		if [[ ! -r $_status_file ]]; then
			_status_error=yes
			break
		fi
		_status=$(<"$_status_file")
		case $_status in
		ok|failed)
			_done=$((_done + 1))
			;;
		running)
			if ! kill -0 "$_pid" 2>/dev/null; then
				_status_error=yes
				break
			fi
			;;
		*)
			_status_error=yes
			break
			;;
		esac
	done
	[[ $_status_error == yes ]] && break
	((_done == _total)) && break

	sleep $POLL_INTERVAL
	_elapsed=$((_elapsed + POLL_INTERVAL))
	if ((_elapsed >= PROGRESS_INTERVAL)); then
		echo "Wipe in progress: $_done/$_total disks complete."
		beep_pattern 1 0
		_elapsed=0
	fi
done

if [[ $_status_error == yes ]]; then
	echo "ERROR: wipe status unavailable; waiting for disk jobs."
fi
for _job in $_jobs; do
	_pid=${_job%%:*}
	wait "$_pid" 2>/dev/null || :
done
sync

if [[ $_status_error == yes ]]; then
	result_loop 'ERROR: wipe status unavailable.' 3 1
fi

_failed=
for _disk in $_disks; do
	_status_file=$_status_dir/$_disk
	[[ $(<"$_status_file") == ok ]] ||
	    _failed="${_failed}${_failed:+ }$_disk"
done

if [[ -n $_failed ]]; then
	result_loop "ERROR: wipe failed: $_failed" 3 1
fi

result_loop 'WIPE COMPLETE: all selected disks were overwritten.' 5 0.25

set -e

dd if=./miniroot79_dd.img of=/dev/rsdXc bs=1m
sync

set -e

cd /usr/src/distrib/amd64/ramdisk_cd/bsddd
make -f Makefile.bsddd clean
make -f Makefile.bsddd

set -e

cd /usr/src/distrib/amd64/ramdisk_cd/bsddd
make -f Makefile.bsddd prepare-unpatch-bsddd
cd /usr/src
patch -R -p1 < /root/bsddd.rd.patch
rmdir distrib/amd64/ramdisk_cd/bsddd

--- /dev/null
+++ b/distrib/amd64/ramdisk_cd/rdsshd/Makefile.rdsshd
@@ -0,0 +1,411 @@
+#	$OpenBSD$
+
+.include <bsd.own.mk>
+
+RDSSHD_AUTHORIZED_KEYS?=
+RDSSHD_HOST_KEY?=
+RDSSHD_CONSOLE_LOCK?=	no
+RDSSHD_KERNEL_STACK_PROTECTOR?=	yes
+RDSSHD_PORT?=	22
+RDSSHD_AI_IF?=	em0
+RDSSHD_AI_HOSTNAME?=	rdinstall
+RDSSHD_AI_IPV4?=	autoconf
+RDSSHD_AI_NETMASK?=	255.255.255.0
+RDSSHD_AI_ROUTE?=	none
+RDSSHD_AI_IPV6?=	none
+RDSSHD_AI_DOMAIN?=	my.domain
+RDSSHD_AI_DNS?=	none
+RDSSHD_FSSIZE?=	32768
+
+RDSSHD_BASEDIR=	${.CURDIR}/..
+RDSSHD_TOP=	${.CURDIR}/../../../..
+RDSSHD_UTILS=	${RDSSHD_BASEDIR}/../../miniroot
+RDSSHD_MTREE=	${RDSSHD_UTILS}/mtree.conf
+RDSSHD_EFIBOOT=	${DESTDIR}/usr/mdec/BOOTX64.EFI \
+		${DESTDIR}/usr/mdec/BOOTIA32.EFI
+RDSSHD_MOUNT_ARGS_MSDOS=	-o-s
+
+RDSSHD_RAMDISK=	RAMDISK_CD_SSHD
+RDSSHD_KERNEL=	${.OBJDIR}/bsd
+.if ${RDSSHD_KERNEL_STACK_PROTECTOR:L} == "no"
+RDSSHD_RAMDISK=	RAMDISK_CD_SSHD_NO_PROPOLICE
+RDSSHD_KERNEL=	${.OBJDIR}/bsd.no-propolice
+.endif
+RDSSHD_FS=	miniroot${OSrev}_sshd.img
+RDSSHD_BUILDOBJDIR=	${.OBJDIR}/build
+RDSSHD_KERNELOBJDIR=	${RDSSHD_BUILDOBJDIR}/kernel/${RDSSHD_RAMDISK}
+RDSSHD_INSTBIN=	${RDSSHD_BUILDOBJDIR}/instbin
+RDSSHD_STAGE=	${.OBJDIR}/stage
+RDSSHD_RDOBJDIR=	${.OBJDIR}/rdobj
+RDSSHD_SSHOBJDIR=	${.OBJDIR}/sshobj
+RDSSHD_INITOBJDIR=	${.OBJDIR}/initobj
+RDSSHD_INITSRCDIR=	${.OBJDIR}/initsrc
+RDSSHD_MOUNT_POINT=	${.OBJDIR}/mnt
+RDSSHD_VND=	${.OBJDIR}/vnd
+RDSSHD_BOOT=	${.OBJDIR}/boot
+RDSSHD_OBJCHECK=	${.OBJDIR}/.rdsshd-obj-ok
+RDSSHD_MAKEFILE=	${.CURDIR}/Makefile.rdsshd
+RDSSHD_INITMAKEFILE=	${.CURDIR}/Makefile.init
+RDSSHD_KERNELCONF=	${.CURDIR}/${RDSSHD_RAMDISK}
+RDSSHD_BASECONF=	${RDSSHD_TOP}/sys/arch/${MACHINE}/conf/RAMDISK_CD
+RDSSHD_KERNELCONFDEPS=	${RDSSHD_BASECONF}
+RDSSHD_LISTS=	${RDSSHD_BASEDIR}/list ${.CURDIR}/list.sshd \
+		${RDSSHD_STAGE}/list.console
+RDSSHD_INITSRC=	${RDSSHD_INITSRCDIR}/init.c
+RDSSHD_INIT=	${RDSSHD_STAGE}/init
+RDSSHD_INSTALLERPATCH=	${.CURDIR}/installer.sshd.patch
+RDSSHD_CONSOLEPATCH=	${.CURDIR}/console-lock.sshd.patch
+RDSSHD_INITPATCH=	${.CURDIR}/init.sshd.patch
+RDSSHD_SSHDCONF=	${.CURDIR}/sshd_config
+RDSSHD_MRMAKEFSARGS?=	-s 20m \
+		-o rdroot,minfree=0,bsize=4096,fsize=512,density=4096
+RDSSHD_BINS=	${RDSSHD_STAGE}/bin/sshd \
+		${RDSSHD_STAGE}/bin/ssh-keygen \
+		${RDSSHD_STAGE}/bin/sshd-session \
+		${RDSSHD_STAGE}/bin/sshd-auth
+
+RDSSHD_INITDEP=
+.if ${RDSSHD_CONSOLE_LOCK:L} == "yes"
+RDSSHD_INITDEP=	${RDSSHD_INIT}
+.endif
+
+.PHONY: rdsshd
+rdsshd: bsdsshd.rd ${RDSSHD_FS}
+
+.PHONY: rdsshd-objcheck
+rdsshd-objcheck: ${RDSSHD_OBJCHECK}
+
+${RDSSHD_OBJCHECK}:
+	@if [ "${.OBJDIR}" = "${.CURDIR}" ]; then \
+		echo "private object directory is not active;" >&2; \
+		echo "run 'make -f Makefile.rdsshd obj' separately first" >&2; \
+		exit 1; \
+	fi
+	touch $@
+
+${RDSSHD_KERNEL}: ${RDSSHD_OBJCHECK} ${RDSSHD_MAKEFILE} \
+	    ${RDSSHD_KERNELCONF} ${RDSSHD_KERNELCONFDEPS}
+	install -d -o ${BUILDUSER} -g ${WOBJGROUP} ${RDSSHD_KERNELOBJDIR}
+	su ${BUILDUSER} -c \
+	    'config -b ${RDSSHD_KERNELOBJDIR} -s ${RDSSHD_TOP}/sys \
+	    ${RDSSHD_KERNELCONF} && cd ${RDSSHD_KERNELOBJDIR} && \
+	    MAKEOBJDIR=${RDSSHD_KERNELOBJDIR} ${MAKE} clean && \
+	    exec env MAKEOBJDIR=${RDSSHD_KERNELOBJDIR} ${MAKE} ${MFLAGS}'
+	cp -p ${RDSSHD_KERNELOBJDIR}/bsd $@
+
+bsdsshd.gz: bsdsshd.rd
+	objcopy -g -x -R .comment -R .SUNW_ctf \
+	    -K rd_root_size -K rd_root_image \
+	    bsdsshd.rd bsdsshd.strip
+	gzip -9cn bsdsshd.strip > bsdsshd.gz
+.if !empty(RDSSHD_HOST_KEY)
+	chmod 600 bsdsshd.strip $@
+.endif
+
+.PHONY: rdsshd-stock-deps rdsshd-instbin
+rdsshd-stock-deps: ${RDSSHD_OBJCHECK} ${RDSSHD_MAKEFILE}
+	@_objroot=`cd ${RDSSHD_BASEDIR} && ${MAKE} -V BSDOBJDIR`; \
+	if [ ! -d "$$_objroot" ]; then \
+		echo "normal OpenBSD object root does not exist: $$_objroot" >&2; \
+		echo "create it before building rdsshd" >&2; \
+		exit 1; \
+	fi
+	cd ${RDSSHD_TOP}/lib && ${MAKE} obj
+	cd ${RDSSHD_TOP}/distrib/special && ${MAKE} obj
+	cd ${RDSSHD_BASEDIR} && ${MAKE} obj
+	@_srcdir=`cd ${RDSSHD_BASEDIR} && pwd`; \
+	_objdir=`cd ${RDSSHD_BASEDIR} && ${MAKE} -V .OBJDIR`; \
+	if [ "$$_objdir" = "$$_srcdir" ] || [ ! -d "$$_objdir" ]; then \
+		echo "normal ramdisk_cd object directory is not active" >&2; \
+		exit 1; \
+	fi
+	cd ${RDSSHD_TOP}/distrib/special/libstubs && ${MAKE} ${MFLAGS}
+
+rdsshd-instbin: rdsshd-stock-deps
+	cd ${RDSSHD_BASEDIR} && ${MAKE} ${MFLAGS} instbin
+	install -d ${RDSSHD_BUILDOBJDIR}
+	@_objdir=`cd ${RDSSHD_BASEDIR} && ${MAKE} -V .OBJDIR`; \
+	if [ ! -f "$$_objdir/instbin" ]; then \
+		echo "stock ramdisk_cd instbin was not built" >&2; \
+		exit 1; \
+	fi; \
+	cp -p "$$_objdir/instbin" ${RDSSHD_INSTBIN}
+
+bsdsshd.rd: rdsshd-files ${RDSSHD_INITDEP} rdsshd-instbin \
+	    ${RDSSHD_KERNEL}
+	install -d ${RDSSHD_RDOBJDIR}
+	rm -f ${RDSSHD_RDOBJDIR}/instbin \
+	    ${RDSSHD_RDOBJDIR}/mr.fs \
+	    ${RDSSHD_RDOBJDIR}/bsd.rd
+	cp -p ${RDSSHD_INSTBIN} ${RDSSHD_RDOBJDIR}/instbin
+	rm -rf ${RDSSHD_RDOBJDIR}/mr.fs.d
+	install -d -o root -g wheel ${RDSSHD_RDOBJDIR}/mr.fs.d
+	mtree -def ${RDSSHD_MTREE} -p ${RDSSHD_RDOBJDIR}/mr.fs.d -u
+	CURDIR=${RDSSHD_BASEDIR} OBJDIR=${RDSSHD_RDOBJDIR} OSrev=${OSrev} \
+	    TARGDIR=${RDSSHD_RDOBJDIR}/mr.fs.d UTILS=${RDSSHD_UTILS} \
+	    RELEASEDIR=${RELEASEDIR} sh ${RDSSHD_UTILS}/runlist.sh \
+	    ${RDSSHD_LISTS}
+	rm ${RDSSHD_RDOBJDIR}/mr.fs.d/instbin
+	makefs ${RDSSHD_MRMAKEFSARGS} ${RDSSHD_RDOBJDIR}/mr.fs \
+	    ${RDSSHD_RDOBJDIR}/mr.fs.d
+	cp -p ${RDSSHD_KERNEL} ${RDSSHD_RDOBJDIR}/bsd.rd
+	rdsetroot ${RDSSHD_RDOBJDIR}/bsd.rd ${RDSSHD_RDOBJDIR}/mr.fs
+	cp ${RDSSHD_RDOBJDIR}/bsd.rd $@
+.if !empty(RDSSHD_HOST_KEY)
+	chmod 600 ${RDSSHD_RDOBJDIR}/mr.fs \
+	    ${RDSSHD_RDOBJDIR}/bsd.rd $@
+.endif
+
+${RDSSHD_FS}: bsdsshd.gz
+	-umount -f ${RDSSHD_MOUNT_POINT} >/dev/null 2>&1
+	@if [ -e ${RDSSHD_VND} ] && [ ! -s ${RDSSHD_VND} ]; then \
+		rm -f ${RDSSHD_VND}; \
+	fi
+	@if [ -e ${RDSSHD_VND} ]; then \
+		echo "stale private vnd state; run" \
+		    "'make -f Makefile.rdsshd unconfig-rdsshd' first" >&2; \
+		exit 1; \
+	fi
+	install -d ${RDSSHD_MOUNT_POINT}
+	dd if=/dev/zero of=${RDSSHD_FS} bs=512 count=${RDSSHD_FSSIZE}
+	vnconfig -v ${.OBJDIR}/${RDSSHD_FS} > ${RDSSHD_VND}
+	fdisk -yi -l ${RDSSHD_FSSIZE} -b 960 -f ${DESTDIR}/usr/mdec/mbr \
+	    `cat ${RDSSHD_VND}`
+	echo '/ *' | disklabel -wAT- `cat ${RDSSHD_VND}`
+	newfs -t msdos /dev/r`cat ${RDSSHD_VND}`i
+	mount ${RDSSHD_MOUNT_ARGS_MSDOS} /dev/`cat ${RDSSHD_VND}`i \
+	    ${RDSSHD_MOUNT_POINT}
+	mkdir -p ${RDSSHD_MOUNT_POINT}/efi/boot
+	cp ${RDSSHD_EFIBOOT} ${RDSSHD_MOUNT_POINT}/efi/boot
+	umount ${RDSSHD_MOUNT_POINT}
+	newfs -O 1 -m 0 -o space -i 524288 -c ${RDSSHD_FSSIZE} \
+	    /dev/r`cat ${RDSSHD_VND}`a
+	mount /dev/`cat ${RDSSHD_VND}`a ${RDSSHD_MOUNT_POINT}
+	objcopy -S -R .comment ${DESTDIR}/usr/mdec/boot ${RDSSHD_BOOT}
+	installboot -v -r ${RDSSHD_MOUNT_POINT} `cat ${RDSSHD_VND}` \
+	    ${DESTDIR}/usr/mdec/biosboot ${RDSSHD_BOOT}
+	install -c -m 555 -o root -g wheel bsdsshd.gz \
+	    ${RDSSHD_MOUNT_POINT}/bsd
+	df -i ${RDSSHD_MOUNT_POINT}
+	umount ${RDSSHD_MOUNT_POINT}
+	vnconfig -u `cat ${RDSSHD_VND}`
+	rm -f ${RDSSHD_VND}
+.if !empty(RDSSHD_HOST_KEY)
+	chmod 600 $@
+.endif
+
+.PHONY: rdsshd-check rdsshd-files rdsshd-scripts
+rdsshd-check:
+	@if [ -z "${RDSSHD_AUTHORIZED_KEYS}" ]; then \
+		echo "set RDSSHD_AUTHORIZED_KEYS to a public key file" >&2; \
+		exit 1; \
+	fi
+	@case "${RDSSHD_CONSOLE_LOCK:L}" in \
+	yes|no) ;; \
+	*) echo "RDSSHD_CONSOLE_LOCK must be yes or no" >&2; exit 1;; \
+	esac
+	@case "${RDSSHD_KERNEL_STACK_PROTECTOR:L}" in \
+	yes|no) ;; \
+	*) echo "RDSSHD_KERNEL_STACK_PROTECTOR must be yes or no" >&2; exit 1;; \
+	esac
+
+${RDSSHD_INITSRC}: ${RDSSHD_OBJCHECK} ${RDSSHD_TOP}/sbin/init/init.c \
+	    ${RDSSHD_INITPATCH}
+	install -d ${RDSSHD_INITSRCDIR}
+	rm -f ${RDSSHD_INITSRC}.tmp ${RDSSHD_INITSRC}.tmp.orig \
+	    ${RDSSHD_INITSRC}.tmp.rej
+	cp ${RDSSHD_TOP}/sbin/init/init.c ${RDSSHD_INITSRC}.tmp
+	cd ${RDSSHD_INITSRCDIR} && \
+	    patch -f -s -p0 -F0 < ${RDSSHD_INITPATCH}
+	mv ${RDSSHD_INITSRC}.tmp ${RDSSHD_INITSRC}
+
+${RDSSHD_INIT}: ${RDSSHD_INITSRC} \
+	    ${RDSSHD_TOP}/sbin/init/pathnames.h ${RDSSHD_INITMAKEFILE} \
+	    ${RDSSHD_BASEDIR}/../../special/init/Makefile \
+	    ${RDSSHD_BASEDIR}/../../special/Makefile.inc
+	install -d ${RDSSHD_INITOBJDIR} ${RDSSHD_STAGE}
+	cd ${RDSSHD_BASEDIR}/../../special/init && \
+	    MAKEOBJDIR=${RDSSHD_INITOBJDIR} ${MAKE} ${MFLAGS} \
+	    -f ${RDSSHD_INITMAKEFILE} \
+	    RDSSHD_INITSRCDIR=${RDSSHD_INITSRCDIR} init
+	install -c -s ${RDSSHD_INITOBJDIR}/init $@
+
+rdsshd-scripts: ${RDSSHD_OBJCHECK} ${RDSSHD_UTILS}/install.sub \
+	    ${RDSSHD_UTILS}/dot.profile \
+	    ${RDSSHD_INSTALLERPATCH} ${RDSSHD_CONSOLEPATCH}
+	install -d ${RDSSHD_STAGE}
+	rm -f ${RDSSHD_STAGE}/install.sub.tmp \
+	    ${RDSSHD_STAGE}/install.sub.tmp.orig \
+	    ${RDSSHD_STAGE}/install.sub.tmp.rej \
+	    ${RDSSHD_STAGE}/dot.profile.tmp \
+	    ${RDSSHD_STAGE}/dot.profile.tmp.orig \
+	    ${RDSSHD_STAGE}/dot.profile.tmp.rej
+	cp ${RDSSHD_UTILS}/install.sub ${RDSSHD_STAGE}/install.sub.tmp
+	cp ${RDSSHD_UTILS}/dot.profile ${RDSSHD_STAGE}/dot.profile.tmp
+	cd ${RDSSHD_STAGE} && \
+	    patch -f -s -p0 -F0 < ${RDSSHD_INSTALLERPATCH}
+.if ${RDSSHD_CONSOLE_LOCK:L} == "yes"
+	cd ${RDSSHD_STAGE} && \
+	    patch -f -s -p0 -F0 < ${RDSSHD_CONSOLEPATCH}
+.endif
+	chmod 755 ${RDSSHD_STAGE}/install.sub.tmp
+	mv ${RDSSHD_STAGE}/install.sub.tmp ${RDSSHD_STAGE}/install.sub
+	mv ${RDSSHD_STAGE}/dot.profile.tmp ${RDSSHD_STAGE}/dot.profile
+
+rdsshd-files: rdsshd-check rdsshd-scripts ${RDSSHD_BINS} \
+	    ${RDSSHD_SSHDCONF}
+	install -d ${RDSSHD_STAGE}
+	@if [ "${RDSSHD_CONSOLE_LOCK:L}" = yes ]; then \
+		echo 'COPY ${RDSSHD_INIT} sbin/init'; \
+	fi > ${RDSSHD_STAGE}/list.console
+	sed '/^root:/s|:/bin/ksh$$|:/bin/sh|' \
+	    ${RDSSHD_UTILS}/master.passwd > ${RDSSHD_STAGE}/master.passwd
+	grep '^root:.*:/bin/sh$$' ${RDSSHD_STAGE}/master.passwd >/dev/null
+	sed -e '/^[	 ]*$$/d' -e '/^[	 ]*#/d' \
+	    < "${RDSSHD_AUTHORIZED_KEYS}" > ${RDSSHD_STAGE}/authorized_keys
+	test -s ${RDSSHD_STAGE}/authorized_keys
+	@_n=0; while IFS= read -r _key; do \
+		_n=$$((_n + 1)); \
+		if ! printf '%s\n' "$$_key" | \
+		    ${RDSSHD_STAGE}/bin/ssh-keygen -l -f - >/dev/null 2>&1; then \
+			echo "invalid public key on line $$_n of RDSSHD_AUTHORIZED_KEYS" >&2; \
+			exit 1; \
+		fi; \
+	done < ${RDSSHD_STAGE}/authorized_keys
+	grep '^sshd:' ${RDSSHD_STAGE}/master.passwd >/dev/null || \
+	    grep '^sshd:' ${RDSSHD_TOP}/etc/master.passwd >> \
+	    ${RDSSHD_STAGE}/master.passwd
+	cp ${RDSSHD_UTILS}/group ${RDSSHD_STAGE}/group
+	grep '^sshd:' ${RDSSHD_STAGE}/group >/dev/null || \
+	    grep '^sshd:' ${RDSSHD_TOP}/etc/group >> ${RDSSHD_STAGE}/group
+	{ \
+	    printf 'System hostname = %s\n' '${RDSSHD_AI_HOSTNAME}'; \
+	    printf 'Network interface to configure = %s\n' '${RDSSHD_AI_IF}'; \
+	    printf 'IPv4 address for %s = %s\n' \
+		'${RDSSHD_AI_IF}' '${RDSSHD_AI_IPV4}'; \
+	    case '${RDSSHD_AI_IPV4}' in \
+	    none|autoconf|dhcp) ;; \
+	    *) printf 'Netmask for %s = %s\n' \
+		'${RDSSHD_AI_IF}' '${RDSSHD_AI_NETMASK}'; \
+	       printf 'Default IPv4 route = %s\n' '${RDSSHD_AI_ROUTE}' ;; \
+	    esac; \
+	    printf 'IPv6 address for %s = %s\n' \
+		'${RDSSHD_AI_IF}' '${RDSSHD_AI_IPV6}'; \
+	    printf 'Network interface to configure = done\n'; \
+	    printf 'DNS domain name = %s\n' '${RDSSHD_AI_DOMAIN}'; \
+	    printf 'DNS nameservers = %s\n' '${RDSSHD_AI_DNS}'; \
+	} > ${RDSSHD_STAGE}/auto_install.conf
+	sed 's|^Port .*|Port ${RDSSHD_PORT}|' ${RDSSHD_SSHDCONF} > \
+	    ${RDSSHD_STAGE}/sshd_config
+	rm -f ${RDSSHD_STAGE}/ssh_host_ed25519_key \
+	    ${RDSSHD_STAGE}/ssh_host_ed25519_key.pub \
+	    ${RDSSHD_STAGE}/ssh_host_ed25519_key.test \
+	    ${RDSSHD_STAGE}/ssh_host_ed25519_key.test.pub \
+	    ${RDSSHD_STAGE}/sshd_config.test
+	@if [ -n "${RDSSHD_HOST_KEY}" ]; then \
+		if ! ${RDSSHD_STAGE}/bin/ssh-keygen -y -P '' \
+		    -f "${RDSSHD_HOST_KEY}" 2>/dev/null | grep -q '^ssh-ed25519 '; then \
+			echo "RDSSHD_HOST_KEY is not an unencrypted Ed25519 private key" >&2; \
+			exit 1; \
+		fi; \
+		install -c -m 600 "${RDSSHD_HOST_KEY}" \
+		    ${RDSSHD_STAGE}/ssh_host_ed25519_key; \
+	fi
+	@_key=${RDSSHD_STAGE}/ssh_host_ed25519_key; \
+	_testkey=${RDSSHD_STAGE}/ssh_host_ed25519_key.test; \
+	_testconf=${RDSSHD_STAGE}/sshd_config.test; \
+	if [[ ! -s $$_key ]]; then \
+		_key=$$_testkey; \
+		${RDSSHD_STAGE}/bin/ssh-keygen -q -t ed25519 -N '' \
+		    -f $$_key || exit 1; \
+	fi; \
+	sed "s|^HostKey .*|HostKey $$_key|" \
+	    ${RDSSHD_STAGE}/sshd_config > $$_testconf; \
+	${RDSSHD_STAGE}/bin/sshd -t -f $$_testconf; \
+	_status=$$?; \
+	rm -f $$_testconf $$_testkey $$_testkey.pub; \
+	exit $$_status
+${RDSSHD_STAGE}/bin/sshd: ${RDSSHD_OBJCHECK} ${RDSSHD_MAKEFILE}
+	install -d ${RDSSHD_STAGE}/bin ${RDSSHD_SSHOBJDIR}/sshd
+	cd ${RDSSHD_TOP}/usr.bin/ssh/sshd && \
+	    MAKEOBJDIR=${RDSSHD_SSHOBJDIR}/sshd ${MAKE} ${MFLAGS} \
+	    LDSTATIC="${STATIC}" ZLIB=no
+	install -c -s ${RDSSHD_SSHOBJDIR}/sshd/sshd $@
+
+${RDSSHD_STAGE}/bin/ssh-keygen: ${RDSSHD_OBJCHECK} ${RDSSHD_MAKEFILE}
+	install -d ${RDSSHD_STAGE}/bin ${RDSSHD_SSHOBJDIR}/ssh-keygen
+	cd ${RDSSHD_TOP}/usr.bin/ssh/ssh-keygen && \
+	    MAKEOBJDIR=${RDSSHD_SSHOBJDIR}/ssh-keygen ${MAKE} ${MFLAGS} \
+	    LDSTATIC="${STATIC}" ZLIB=no
+	install -c -s ${RDSSHD_SSHOBJDIR}/ssh-keygen/ssh-keygen $@
+
+${RDSSHD_STAGE}/bin/sshd-session: ${RDSSHD_OBJCHECK} ${RDSSHD_MAKEFILE}
+	install -d ${RDSSHD_STAGE}/bin ${RDSSHD_SSHOBJDIR}/sshd-session
+	cd ${RDSSHD_TOP}/usr.bin/ssh/sshd-session && \
+	    MAKEOBJDIR=${RDSSHD_SSHOBJDIR}/sshd-session ${MAKE} ${MFLAGS} \
+	    LDSTATIC="${STATIC}" ZLIB=no
+	install -c -s ${RDSSHD_SSHOBJDIR}/sshd-session/sshd-session $@
+
+${RDSSHD_STAGE}/bin/sshd-auth: ${RDSSHD_OBJCHECK} ${RDSSHD_MAKEFILE}
+	install -d ${RDSSHD_STAGE}/bin ${RDSSHD_SSHOBJDIR}/sshd-auth
+	cd ${RDSSHD_TOP}/usr.bin/ssh/sshd-auth && \
+	    MAKEOBJDIR=${RDSSHD_SSHOBJDIR}/sshd-auth ${MAKE} ${MFLAGS} \
+	    LDSTATIC="${STATIC}" ZLIB=no
+	install -c -s ${RDSSHD_SSHOBJDIR}/sshd-auth/sshd-auth $@
+
+.PHONY: unconfig-rdsshd
+unconfig-rdsshd:
+	-umount -f ${RDSSHD_MOUNT_POINT} >/dev/null 2>&1
+	@if [ -e ${RDSSHD_VND} ] && [ ! -s ${RDSSHD_VND} ]; then \
+		rm -f ${RDSSHD_VND}; \
+	elif [ -f ${RDSSHD_VND} ]; then \
+		_vnd=`cat ${RDSSHD_VND}`; \
+		_unit=$${_vnd#vnd}; \
+		if [ "vnd$$_unit" != "$$_vnd" ] || [ -z "$$_unit" ]; then \
+			echo "invalid private vnd state: $$_vnd" >&2; exit 1; \
+		fi; \
+		case "$$_unit" in \
+		*[!0-9]*) echo "invalid private vnd state: $$_vnd" >&2; exit 1;; \
+		esac; \
+		_info=`vnconfig -l "$$_vnd"` || exit 1; \
+		case "$$_info" in \
+		"$$_vnd: not in use") rm -f ${RDSSHD_VND} ;; \
+		"$$_vnd: covering ${.OBJDIR}/${RDSSHD_FS} on "*) \
+			vnconfig -u "$$_vnd" && rm -f ${RDSSHD_VND} ;; \
+		*) echo "refusing to detach vnd not owned by rdsshd: $$_info" >&2; \
+			exit 1 ;; \
+		esac; \
+	fi
+
+.ifdef RELEASEDIR
+.PHONY: install-rdsshd
+install-rdsshd: bsdsshd.gz ${RDSSHD_FS}
+	cp bsdsshd.gz ${RELEASEDIR}/bsdsshd.rd
+	cp ${RDSSHD_FS} ${RELEASEDIR}
+.if empty(RDSSHD_HOST_KEY)
+	chmod a+r ${RELEASEDIR}/bsdsshd.rd
+.else
+	chmod 600 ${RELEASEDIR}/bsdsshd.rd ${RELEASEDIR}/${RDSSHD_FS}
+.endif
+.endif
+
+.PHONY: clean-rdsshd clean cleandir
+clean-rdsshd: unconfig-rdsshd
+	rm -f bsdsshd.rd bsdsshd.gz bsdsshd.strip ${RDSSHD_FS} \
+	    ${.OBJDIR}/bsd ${.OBJDIR}/bsd.no-propolice ${RDSSHD_BOOT} \
+	    ${RDSSHD_OBJCHECK}
+	rm -rf ${RDSSHD_BUILDOBJDIR} ${RDSSHD_STAGE} ${RDSSHD_RDOBJDIR} \
+	    ${RDSSHD_SSHOBJDIR} ${RDSSHD_INITOBJDIR} ${RDSSHD_INITSRCDIR}
+	-rmdir ${RDSSHD_MOUNT_POINT}
+
+clean cleandir: clean-rdsshd
+
+.PHONY: prepare-unpatch-rdsshd
+prepare-unpatch-rdsshd: clean-rdsshd
+	@if [ -L ${.CURDIR}/obj ]; then \
+		_obj=`readlink ${.CURDIR}/obj`; \
+		echo "empty private object directory may be removed: $$_obj"; \
+		rm -f ${.CURDIR}/obj; \
+	fi
+
+.include <bsd.obj.mk>
--- /dev/null
+++ b/distrib/amd64/ramdisk_cd/rdsshd/Makefile.init
@@ -0,0 +1,5 @@
+#	$OpenBSD$
+
+.PATH: ${RDSSHD_INITSRCDIR}
+CPPFLAGS+=	-I${.CURDIR}/../../../sbin/init
+.include "${.CURDIR}/Makefile"
--- /dev/null
+++ b/distrib/amd64/ramdisk_cd/rdsshd/README.rdsshd
@@ -0,0 +1,599 @@
+BSDSSHD.RD                 bsdsshd.rd build notes                 BSDSSHD.RD
+
+NAME
+     bsdsshd.rd - OpenBSD/amd64 installer ramdisk with sshd access
+
+DESCRIPTION
+     The patch adds separate bsdsshd.rd and minirootXX_sshd.img targets.
+     The ramdisk configures networking from /auto_install.conf, starts sshd,
+     and leaves the installer environment available to the remote root user.
+
+     The default retains the local installer menu and shell.
+     RDSSHD_CONSOLE_LOCK=yes removes the local installer userland session.
+     Boot-loader and kernel console output remain visible.
+
+     The target supports remote storage preparation and installation, including
+     softraid(4) work with bioctl(8).  Use autoinstall(8), install.site(5), and
+     siteXX.tgz when full unattended installation is appropriate.
+
+     The patch adds files only.  Stock source files, Makefiles, bsd.rd,
+     minirootXX.img, and cdXX.iso targets are unchanged.  Enhanced targets are
+     available only through Makefile.rdsshd.
+
+SYNOPSIS
+     Run the obj target separately, then build with at least one authorized
+     public key:
+
+           make -f Makefile.rdsshd obj
+           make -f Makefile.rdsshd rdsshd \
+               RDSSHD_AUTHORIZED_KEYS=/root/id_ed25519.pub
+
+SOURCE LAYOUT
+     The patch adds one source directory containing eleven files:
+
+           distrib/amd64/ramdisk_cd/rdsshd/Makefile.rdsshd
+           distrib/amd64/ramdisk_cd/rdsshd/Makefile.init
+           distrib/amd64/ramdisk_cd/rdsshd/README.rdsshd
+           distrib/amd64/ramdisk_cd/rdsshd/console-lock.sshd.patch
+           distrib/amd64/ramdisk_cd/rdsshd/init.sshd.patch
+           distrib/amd64/ramdisk_cd/rdsshd/installer.sshd.patch
+           distrib/amd64/ramdisk_cd/rdsshd/list.sshd
+           distrib/amd64/ramdisk_cd/rdsshd/root.profile
+           distrib/amd64/ramdisk_cd/rdsshd/sshd_config
+           distrib/amd64/ramdisk_cd/rdsshd/RAMDISK_CD_SSHD
+           distrib/amd64/ramdisk_cd/rdsshd/RAMDISK_CD_SSHD_NO_PROPOLICE
+
+TARGETS
+     rdsshd
+             Builds bsdsshd.rd and minirootXX_sshd.img.
+
+     install-rdsshd
+             Defined when RELEASEDIR is set.  Installs compressed bsdsshd.rd
+             and minirootXX_sshd.img:
+
+                   make -f Makefile.rdsshd install-rdsshd \
+                       RELEASEDIR=/path/to/release
+
+     unconfig-rdsshd
+             Unmounts the private mount point and detaches its recorded vnd
+             after an interrupted miniroot build.
+
+     clean-rdsshd, clean, cleandir
+             Remove private rdsshd outputs.  Stock instbin objects remain under
+             normal OpenBSD clean ownership.
+
+     prepare-unpatch-rdsshd
+             Runs private cleanup, prints the wrapper object path, and removes
+             the rdsshd source obj symlink.
+
+BUILD MODEL
+     Private paths below the rdsshd object directory:
+
+           obj/build/kernel       enhanced kernel objects
+           obj/build/instbin      copy of stock instbin
+           obj/sshobj             static OpenSSH objects
+           obj/initsrc            optional patched init source
+           obj/initobj            optional private init objects
+           obj/stage              generated and overlay files
+           obj/rdobj              ramdisk assembly
+           obj/bsd*               copied enhanced kernels
+           obj/boot               miniroot boot file
+           obj/mnt                miniroot mount point
+           obj/vnd                vnd ownership record
+
+     The kernel is configured with config(8) -b and built below
+     obj/build/kernel.  No sys/arch/amd64/compile directory is added or used.
+     OpenSSH uses explicit private MAKEOBJDIR paths.
+
+     instbin is unmodified.  Its normal objects remain under:
+
+           ${BSDOBJDIR}/distrib/amd64/ramdisk_cd
+           ${BSDOBJDIR}/distrib/special
+           ${BSDOBJDIR}/lib
+
+     The wrapper runs the normal obj targets for lib, distrib/special, and
+     ramdisk_cd.  It builds stock distrib/special/libstubs, then invokes the
+     stock ramdisk_cd instbin target.  That target builds component objects and
+     reduced source libraries.  The wrapper does not transform crunchgen
+     configuration or generated Makefiles.  It copies the completed instbin to
+     obj/build/instbin before ramdisk assembly.
+
+     BSDOBJDIR must exist and retain normal OpenBSD ownership and permissions.
+     The default is /usr/obj, owned by build:wobj with mode 770.  The build
+     rejects source-directory object fallback for both the wrapper and
+     ramdisk_cd.
+
+     Normal clean and cleandir targets own the shared instbin objects.
+     clean-rdsshd owns only the private copy and enhanced outputs.  Do not run
+     rdsshd concurrently with a normal build or clean using the same instbin
+     objects.
+
+     No parent Makefile or SUBDIR list is changed.  Normal top-level builds and
+     cleans do not enter the rdsshd source directory.
+
+     Normal and enhanced media use separate boot files, mount points, image
+     names, and vnd state.  Cleanup detaches only the recorded vnd covering the
+     absolute enhanced image path.  A missing, malformed, or reused vnd is
+     reported and left attached.
+
+KERNEL
+     RAMDISK_CD_SSHD includes stock RAMDISK_CD, then applies:
+
+           rmoption NO_PROPOLICE
+           rmoption MINIROOTSIZE
+           option MINIROOTSIZE=40960
+           pseudo-device pty 16
+
+     Removing NO_PROPOLICE enables normal kernel stack protection.
+     RDSSHD_KERNEL_STACK_PROTECTOR=no selects
+     RAMDISK_CD_SSHD_NO_PROPOLICE, which retains NO_PROPOLICE.
+
+     MINIROOTSIZE=40960 reserves a 20 MiB rdroot.  Sixteen ptys support ssh
+     sessions.  SMALL_KERNEL remains enabled.
+
+     A temporary RDSSHD_RDROOT option protects config(8)'s option-list append
+     pointer while inherited tail entries are removed.  It is absent from the
+     final configuration.
+
+RAMDISK
+     Stock bsd.rd uses the host disktab entry rdrootb:
+
+           MRMAKEFSARGS=-o disklabel=rdrootb,minfree=0,density=4096
+
+     bsdsshd.rd instead gives makefs(8) an explicit 20 MiB layout:
+
+           -s 20m \
+             -o rdroot,minfree=0,bsize=4096,fsize=512,density=4096
+
+     This does not read or modify /etc/disktab.
+
+     Stock installer programs remain in instbin.  OpenSSH is built through its
+     normal Makefiles as separate static PIE executables with zlib disabled:
+
+           /usr/sbin/sshd
+           /usr/bin/ssh-keygen
+           /usr/libexec/sshd-session
+           /usr/libexec/sshd-auth
+
+     The ssh(1) client is not included.
+
+     list.sshd adds:
+
+           /etc/ssh/sshd_config
+           /root/.ssh/authorized_keys
+           /root/.profile
+           /auto_install.conf
+           /etc/login.conf
+
+     It also adds the sshd account and pty devices.  Root retains stock
+     instbin's -sh argv link.  root.profile leaves sh mode, sets the installer
+     environment, and sets TERM=vt220.  The Port directive in sshd_config is
+     substituted only in private staging.
+
+     installer.sshd.patch modifies private copies of stock .profile and
+     install.sub.  console-lock.sshd.patch adds the locked early profile path.
+     init.sshd.patch applies only to a private init.c copy.  patch(1) runs
+     non-interactively with zero fuzz.  Context drift fails before replacement.
+
+     Image layout:
+
+           embedded rdroot                 20 MiB
+           outer miniroot                  32768 x 512 bytes (16 MiB)
+
+     The outer image follows the stock amd64 miniroot layout.  It installs BIOS
+     and EFI boot files using private boot, mount, image, and vnd paths.
+
+     minirootXX_sshd.img stores compressed bsdsshd.gz as /bsd.  It does not
+     store uncompressed bsdsshd.rd.
+
+     Example amd64 artifact sizes:
+
+           boot                    87 KiB
+           bsdsshd.gz             9.0 MiB
+           bsdsshd.rd            27.2 MiB
+           bsdsshd.strip         26.7 MiB
+           minirootXX_sshd.img   16.0 MiB
+
+     These are observations, not fixed limits.  Console locking adds a private
+     static init and may increase the compressed kernel size.
+
+SSHD
+     sshd permits public-key authentication for root only.  Relevant policy:
+
+           AllowUsers root
+           PermitRootLogin prohibit-password
+           PubkeyAuthentication yes
+           AuthenticationMethods publickey
+           PasswordAuthentication no
+           KbdInteractiveAuthentication no
+           Compression no
+           PermitUserRC no
+           PrintMotd no
+           PrintLastLog no
+           DisableForwarding yes
+
+     The static PIE executables retain normal OpenBSD OpenSSH compiler and
+     linker protections.  Compression is disabled at build and run time.
+
+     RDSSHD_AUTHORIZED_KEYS is mandatory.  It may contain one or more public
+     keys.  Blank and comment lines are removed.  Every remaining line must
+     pass ssh-keygen(1) public-key validation.  The installed file has mode
+     0600; /root and /root/.ssh have mode 0700.
+
+     No host key is embedded by default.  During the build, ssh-keygen creates
+     obj/stage/ssh_host_ed25519_key.test and its public key solely to validate
+     the generated configuration with the newly built sshd -t.  The build
+     removes the test configuration and key pair after validation.  They never
+     enter the ramdisk.  An interrupted build may leave them below obj/stage;
+     the next staging pass or cleandir removes them.
+
+     On first boot, the ramdisk generates:
+
+           /etc/ssh/ssh_host_ed25519_key
+
+     Normal installer CGI fetches call feed_random before generation.  An
+     unreachable fetch delays sshd until the normal CGI timeout.
+
+     RDSSHD_HOST_KEY may name an Ed25519 host private key without a passphrase.
+     The build validates it and copies it to private staging with mode 0600.
+     The newly built sshd validates the generated configuration against this
+     staged key.  Build-host ssh configuration and keys are not read or
+     modified.
+
+     An embedded key is recoverable from private objects, kernels, images, and
+     release copies.  Key-bearing kernel and media artifacts have mode 0600.
+
+     sshd starts after donetconfig.  A live numeric PID greater than one in
+     /var/run/sshd.pid suppresses restart.  The ramdisk lacks a process
+     inspection utility.  This checks liveness, not executable identity.
+
+     install.sub creates /var/run/rdsshd.ready only after sshd starts.
+     Bootstrap profiles use this marker because installer exit status alone
+     does not establish readiness.
+
+CONSOLE AND INSTALLER
+     The initial profile invokes:
+
+           install -af /auto_install.conf
+
+     /auto_install.conf answers only the early network questions.  Static IPv4
+     configuration includes netmask and default route.  autoconf, dhcp, and
+     none omit them.
+
+     With RDSSHD_CONSOLE_LOCK=no, automatic setup begins after the normal menu
+     timeout unless a local operator selects another action.  install.sub exits
+     after starting sshd.  The profile then returns to the local ramdisk shell.
+
+     With RDSSHD_CONSOLE_LOCK=yes, a private static init replaces /sbin/init in
+     the enhanced ramdisk.  Makefile.init invokes the stock special/init
+     Makefile, supplies stock pathnames.h, and keeps patched source and objects
+     private.  The bootstrap child retains inherited /dev/null descriptors and
+     never acquires /dev/console as a controlling terminal.
+
+     The locked profile branches before terminal setup.  It retries automatic
+     network and sshd setup until /var/run/rdsshd.ready exists, then sleeps.
+     It never presents a menu or shell.  Init restarts it after exit.
+     RDSSHD_CONSOLE_LOCK=no uses stock init from instbin.
+
+     After ssh login, run:
+
+           install
+
+     This starts the interactive installer.  At network prompts, choose done to
+     retain the active configuration.  Reconfiguration can drop the ssh
+     session.
+
+CAVEATS
+     RDSSHD_CONSOLE_LOCK removes the interactive local installer userland.
+     Boot-loader and kernel consoles remain active.  A local operator can still
+     change early boot state, reset, halt, or deny remote access.
+
+     RDSSHD_KERNEL_STACK_PROTECTOR=no deliberately retains NO_PROPOLICE.  This
+     may reduce image size and weakens mitigation of kernel stack corruption.
+
+     Protect RDSSHD_HOST_KEY, the object tree, all key-bearing images, and
+     installed copies.  Use a distinct host key for each machine identity.
+
+     RDSSHD_FSSIZE is not auto-sized.  A value too small for the compressed
+     kernel and boot files causes miniroot assembly to fail.
+
+     Network variables become installer response-file answers.  The build does
+     not probe the interface or validate network reachability.  Incorrect
+     values can prevent ssh access.  A locked image then has no local installer
+     userland with which to repair the configuration.
+
+BUILD
+     Build on OpenBSD/amd64 with src.tar.gz and sys.tar.gz matching the
+     installed OpenBSD release.  Normal source-build prerequisites apply.  The
+     media target requires root privileges for vnconfig(8), mount operations,
+     device access, and file ownership.  Kernel compilation runs as BUILDUSER.
+
+     Apply the patch:
+
+           cd /usr/src
+           patch -p1 < /root/bsdsshd.rd.patch
+
+     The configured BSDOBJDIR root, normally /usr/obj, must already exist.
+     Build from the added directory:
+
+           cd /usr/src/distrib/amd64/ramdisk_cd/rdsshd
+           make -f Makefile.rdsshd obj
+           make -f Makefile.rdsshd rdsshd \
+               RDSSHD_AUTHORIZED_KEYS=/root/id_ed25519.pub
+
+     Run obj separately.  OpenBSD make selects .OBJDIR at startup and rejects a
+     combined obj and rdsshd invocation.  No top-level /usr/src make obj is
+     required.  The wrapper creates only the normal object links required by
+     stock instbin.  Custom components retain private paths.
+
+     Remove the local installer session:
+
+           make -f Makefile.rdsshd rdsshd \
+               RDSSHD_AUTHORIZED_KEYS=/root/id_ed25519.pub \
+               RDSSHD_CONSOLE_LOCK=yes
+
+     Retain NO_PROPOLICE:
+
+           make -f Makefile.rdsshd rdsshd \
+               RDSSHD_AUTHORIZED_KEYS=/root/id_ed25519.pub \
+               RDSSHD_KERNEL_STACK_PROTECTOR=no
+
+     Embed a stable host key:
+
+           ssh-keygen -q -t ed25519 -N '' \
+               -f /root/rdsshd_host_ed25519_key
+           make -f Makefile.rdsshd rdsshd \
+               RDSSHD_AUTHORIZED_KEYS=/root/id_ed25519.pub \
+               RDSSHD_HOST_KEY=/root/rdsshd_host_ed25519_key
+
+     Outputs:
+
+           /usr/src/distrib/amd64/ramdisk_cd/rdsshd/obj/bsdsshd.rd
+           /usr/src/distrib/amd64/ramdisk_cd/rdsshd/obj/minirootXX_sshd.img
+
+REBUILD AND CLEAN
+     For variable or key changes, repeat rdsshd.  Normal dependency rules reuse
+     current stock instbin components, static OpenSSH, private init, and the
+     selected kernel.  Staging, ramdisk, and media are regenerated.
+
+           make -f Makefile.rdsshd rdsshd \
+               RDSSHD_AUTHORIZED_KEYS=/root/id_ed25519.pub
+
+     After source, compiler, flag, or Makefile changes, clean both ownership
+     domains:
+
+           cd /usr/src/distrib/amd64/ramdisk_cd
+           make cleandir
+           cd /usr/src/distrib/special
+           make cleandir
+           cd /usr/src/lib
+           make cleandir
+
+           cd /usr/src/distrib/amd64/ramdisk_cd/rdsshd
+           make -f Makefile.rdsshd cleandir
+           make -f Makefile.rdsshd obj
+           make -f Makefile.rdsshd rdsshd \
+               RDSSHD_AUTHORIZED_KEYS=/root/id_ed25519.pub
+
+     A top-level cleandir may replace the three stock cleans.  The next rdsshd
+     build recreates required normal object directories.  The wrapper clean
+     never removes stock objects.
+
+     After a failed stock instbin trace link, clean ramdisk_cd before retrying.
+     Its instbin.map and reduced archives may be incomplete:
+
+           cd /usr/src/distrib/amd64/ramdisk_cd
+           make cleandir
+
+     After an interrupted miniroot build:
+
+           cd /usr/src/distrib/amd64/ramdisk_cd/rdsshd
+           make -f Makefile.rdsshd unconfig-rdsshd
+
+VARIABLES
+     RDSSHD_AUTHORIZED_KEYS
+             Required file containing one or more root authorized public keys.
+
+     RDSSHD_HOST_KEY
+             Optional Ed25519 host private key without a passphrase.  An empty
+             value generates a new host key at each boot.  Default: empty.
+
+     RDSSHD_CONSOLE_LOCK
+             yes selects private init and removes the local installer session.
+             no retains the local menu and shell.  Default: no.
+
+     RDSSHD_KERNEL_STACK_PROTECTOR
+             yes removes inherited NO_PROPOLICE.  no retains it.  Default: yes.
+
+     RDSSHD_PORT
+             sshd listen port.  The generated sshd_config must pass sshd -t.
+             Default: 22.
+
+     RDSSHD_AI_IF
+             Network interface.  Default: em0.
+
+     RDSSHD_AI_HOSTNAME
+             Hostname.  Default: rdinstall.
+
+     RDSSHD_AI_IPV4
+             IPv4 address or installer keyword.  Default: autoconf.
+
+     RDSSHD_AI_NETMASK
+             Static IPv4 netmask.  Default: 255.255.255.0.
+
+     RDSSHD_AI_ROUTE
+             Static IPv4 default route.  Default: none.
+
+     RDSSHD_AI_IPV6
+             IPv6 address or installer keyword.  Default: none.
+
+     RDSSHD_AI_DOMAIN
+             DNS domain.  Default: my.domain.
+
+     RDSSHD_AI_DNS
+             DNS nameservers.  Default: none.
+
+     RDSSHD_FSSIZE
+             Outer miniroot size in 512-byte blocks.  Default: 32768 (16 MiB).
+
+     RDSSHD_MRMAKEFSARGS
+             makefs(8) arguments for the embedded rdroot.  The default creates
+             a 20 MiB filesystem matching MINIROOTSIZE=40960.  An override must
+             fit the kernel reservation.
+
+     BSDOBJDIR
+             Normal OpenBSD object root used by stock instbin.  Default:
+             /usr/obj.
+
+     DESTDIR
+             Optional prefix for installed amd64 boot files under usr/mdec.
+             Default: empty.
+
+     RELEASEDIR
+             Enables install-rdsshd and names its destination directory.
+
+     Boolean values are case-insensitive.  Values other than yes and no are
+     rejected.
+
+USE
+     Prepare a non-interactive next boot from the running system.
+     No boot prompt or console access is assumed.
+
+     Whole-device image
+             minirootXX_sshd.img is a complete disk image.  Writing it to a
+             block device replaces the device's partition table and filesystems.
+             Verify the output device before writing it.  For example, on Linux:
+
+                   dd if=./miniroot79_sshd.img of=/dev/sda bs=512
+                   sync
+                   reboot
+
+             The running OS or storage stack may deny raw writes to the initial
+             sectors of the device backing its active root filesystem.  Use the
+             boot-loader method if this cannot be changed remotely.
+
+             The image boots in UEFI or BIOS/CSM mode with Secure Boot disabled.
+             Firmware must already select the target device.  The rdroot runs
+             from memory, so the installer can reuse that device as its target.
+
+     GRUB one-shot boot
+             Copy the uncompressed ramdisk kernel.  Do not rely on gzio:
+
+                   cp /path/to/bsdsshd.rd /boot/bsdsshd.rd
+
+             Add to /etc/grub.d/40_custom:
+
+                   menuentry "OpenBSD bsdsshd.rd" {
+                           insmod part_gpt
+                           insmod ext2
+                           insmod bsd
+                           # Replace UUID with the /boot filesystem UUID.
+                           search --no-floppy --fs-uuid --set=root UUID
+                           kopenbsd /bsdsshd.rd
+                   }
+
+             Set in /etc/default/grub:
+
+                   GRUB_DEFAULT=saved
+
+             Select a one-shot boot:
+
+                   update-grub
+                   grub-reboot "OpenBSD bsdsshd.rd"
+                   grub-editenv list
+                   sync
+                   reboot
+
+             This example was tested in BIOS/CSM mode.  UEFI is untested and
+             may lack display console output.  Secure Boot is unsupported.
+             part_gpt and ext2 match the tested /boot filesystem; change them
+             for the target layout.  The GRUB build must provide the bsd module
+             and kopenbsd command.  Other boot loaders are untested.
+
+     Network booting
+             The matching OpenBSD/amd64 pxeboot(8) can load the compressed
+             bsdsshd.rd over the network in place of bsd.rd.
+
+     Remote session
+             After the enhanced kernel boots, connect when the configured
+             address accepts ssh:
+
+                   ssh -i /path/to/private_key root@host.example
+                   install
+
+             Perform required storage preparation before running install.  At
+             network prompts, choose done to retain the active connection.
+
+             RDSSHD_CONSOLE_LOCK=yes presents no local installer menu or shell.
+
+REMOVE PATCH
+     Remove private outputs and the wrapper obj symlink before reversal:
+
+           cd /usr/src/distrib/amd64/ramdisk_cd/rdsshd
+           make -f Makefile.rdsshd prepare-unpatch-rdsshd
+           cd /usr/src
+           patch -R -p1 < /root/bsdsshd.rd.patch
+           rmdir /usr/obj/distrib/amd64/ramdisk_cd/rdsshd
+           rmdir /usr/src/distrib/amd64/ramdisk_cd/rdsshd
+
+     prepare-unpatch-rdsshd prints the recorded object path before removing the
+     symlink.  /usr/obj is the default; use the printed path when different.
+     patch(1) removes added files but leaves their empty parent directory.
+     rmdir refuses non-empty directories.
+
+FILES
+     /usr/src/distrib/amd64/ramdisk_cd/rdsshd
+             Added source directory and Makefile.rdsshd entry point.
+
+     obj/bsdsshd.rd
+             Uncompressed enhanced ramdisk kernel.
+
+     obj/bsdsshd.gz
+             Stripped and compressed ramdisk kernel installed as bsdsshd.rd by
+             install-rdsshd and as /bsd in the enhanced miniroot.
+
+     obj/minirootXX_sshd.img
+             Enhanced BIOS- and EFI-bootable miniroot image.
+
+     obj/vnd
+             Private ownership record for an attached vnd during media
+             assembly.  Removed after successful assembly or safe cleanup.
+
+DIAGNOSTICS
+     private object directory is not active
+             Run make -f Makefile.rdsshd obj as a separate invocation before
+             building.
+
+     normal OpenBSD object root does not exist
+             Create BSDOBJDIR with normal OpenBSD ownership and permissions.
+
+     normal ramdisk_cd object directory is not active
+             The stock obj target did not select an object directory distinct
+             from its source directory.  Check BSDOBJDIR and rerun the build.
+
+     stock ramdisk_cd instbin was not built
+             The stock instbin target did not produce its expected output.
+             Inspect the preceding failure.  Clean ramdisk_cd before retrying
+             after a failed trace link.
+
+     invalid public key on line N of RDSSHD_AUTHORIZED_KEYS
+             Replace the indicated line with a public key accepted by
+             ssh-keygen(1).
+
+     RDSSHD_HOST_KEY is not an unencrypted Ed25519 private key
+             Supply an Ed25519 host private key without a passphrase.
+
+     stale private vnd state
+             Run unconfig-rdsshd before rebuilding the miniroot.
+
+     refusing to detach vnd not owned by rdsshd
+             The recorded device no longer covers the enhanced image.  The
+             target leaves it attached for manual inspection.
+
+SEE ALSO
+     make(1), patch(1), ssh(1), ssh-keygen(1), softraid(4), vnd(4), disktab(5),
+     install.site(5), sshd_config(5), autoinstall(8), bioctl(8), boot(8),
+     boot_amd64(8), config(8), installboot(8), makefs(8), rdsetroot(8),
+     release(8), sshd(8), vnconfig(8)
+
+BSDSSHD.RD                      July 18, 2026                       BSDSSHD.RD
--- /dev/null
+++ b/distrib/amd64/ramdisk_cd/rdsshd/console-lock.sshd.patch
@@ -0,0 +1,18 @@
+--- dot.profile.tmp
++++ dot.profile.tmp
+@@ -87,6 +87,15 @@
+ 	[[ -x /sbin/dhcpleased ]] && /sbin/dhcpleased 2>/dev/null
+ 	[[ -x /sbin/slaacd ]] && /sbin/slaacd 2>/dev/null
+ 
++	while [[ ! -f /var/run/rdsshd.ready ]]; do
++		/install -af /auto_install.conf
++		sleep 1
++	done
++
++	while :; do
++		sleep 3600
++	done
++
+ 	# Set up some sane tty defaults.
+ 	echo 'erase ^?, werase ^W, kill ^U, intr ^C, status ^T'
+ 	stty newcrt werase ^W intr ^C kill ^U erase ^? status ^T
--- /dev/null
+++ b/distrib/amd64/ramdisk_cd/rdsshd/init.sshd.patch
@@ -0,0 +1,20 @@
+--- init.c.tmp
++++ init.c.tmp
+@@ -517,7 +517,6 @@
+ 		/*
+ 		 * Start the single user session.
+ 		 */
+-		setctty(_PATH_CONSOLE);
+ 
+ #ifdef SECURE
+ 		/*
+@@ -651,8 +650,7 @@
+ 		}
+ 	}
+ 
+-	runcom_mode = FASTBOOT;
+-	return runcom;
++	return single_user;
+ }
+ 
+ /*
--- /dev/null
+++ b/distrib/amd64/ramdisk_cd/rdsshd/installer.sshd.patch
@@ -0,0 +1,71 @@
+--- install.sub.tmp
++++ install.sub.tmp
+@@ -1377,7 +1377,10 @@
+ 		ask_until "$_q (name, lladdr, '?', or 'done')" \
+ 		    ${_p:-$( (get_ifs netboot; get_ifs) | sed q )}
+ 
+-		[[ $resp == done ]] && break
++		if [[ $resp == done ]]; then
++			NIFS=$(ls -1 /tmp/i/hostname.* 2>/dev/null | grep -c ^)
++			break
++		fi
+ 		[[ $resp == '?'  ]] && continue
+ 
+ 		# Quote $resp to prevent user from confusing isin() by
+@@ -3170,6 +3173,21 @@
+ 	echo "\nConfiguring the root disk $ROOTDISK...\n"
+ }
+ 
++rdsshd_start() {
++	local _pid
++	if [[ -s /var/run/sshd.pid ]]; then
++		_pid=$(</var/run/sshd.pid)
++		[[ $_pid == +([0-9]) ]] && (( _pid > 1 )) && \
++		    kill -0 "$_pid" 2>/dev/null && return 0
++	fi
++	if [[ ! -s /etc/ssh/ssh_host_ed25519_key ]]; then
++		/usr/bin/ssh-keygen -q -t ed25519 -N "" \
++		    -f /etc/ssh/ssh_host_ed25519_key || return 1
++	fi
++	/usr/sbin/sshd -t -f /etc/ssh/sshd_config || return 1
++	/usr/sbin/sshd -f /etc/ssh/sshd_config || return 1
++}
++
+ do_install() {
+ 	local _rootkey _rootpass
+ 
+@@ -3190,7 +3208,20 @@
+ 
+ 	# Configure the network.
+ 	donetconfig
++	if $AI && [[ $AI_RESPFILE == /auto_install.conf ]]; then
++		start_cgiinfo
++		wait_cgiinfo
++		rdsshd_start || err_exit "Could not start ramdisk sshd."
++		>/var/run/rdsshd.ready
++		cat <<__EOT
+ 
++ramdisk sshd is running.
++Connect as root with the matching key.
++Run: install
++__EOT
++		exit 0
++	fi
++
+ 	# Fetch list of mirror servers and installer choices from previous runs.
+ 	start_cgiinfo
+ 
+--- dot.profile.tmp
++++ dot.profile.tmp
+@@ -130,6 +130,11 @@
+ 		if $timeout; then
+ 			timeout=false
+ 			echo
++			if [[ -f /auto_install.conf ]]; then
++				/install -af /auto_install.conf
++				[[ -f /var/run/rdsshd.ready ]] && break
++				continue
++			fi
+ 			REPLY=a
+ 		else
+ 			# User has made a choice; stop the read timeout.
--- /dev/null
+++ b/distrib/amd64/ramdisk_cd/rdsshd/list.sshd
@@ -0,0 +1,35 @@
+#	$OpenBSD$
+
+# bsdsshd.rd overlay.
+MKDIR	usr/libexec
+MKDIR	etc/ssh
+MKDIR	root
+MKDIR	root/.ssh
+
+COPY	${OBJDIR}/../stage/sshd_config			etc/ssh/sshd_config
+SPECIAL test ! -s ${OBJDIR}/../stage/ssh_host_ed25519_key || install -c -m 600 -o root -g wheel ${OBJDIR}/../stage/ssh_host_ed25519_key etc/ssh/ssh_host_ed25519_key
+COPY	${OBJDIR}/../stage/auto_install.conf		auto_install.conf
+SCRIPT	${OBJDIR}/../stage/dot.profile			.profile
+SCRIPT	${OBJDIR}/../stage/install.sub			install.sub
+SPECIAL	chmod 755 install.sub
+
+COPY	${OBJDIR}/../stage/master.passwd		etc/master.passwd
+COPY	${OBJDIR}/../stage/group			etc/group
+SPECIAL	pwd_mkdb -p -d etc master.passwd; rm etc/master.passwd
+
+COPY	${CURDIR}/rdsshd/root.profile			root/.profile
+COPY	${OBJDIR}/../stage/authorized_keys		root/.ssh/authorized_keys
+SPECIAL	chmod 700 root root/.ssh; chmod 600 root/.ssh/authorized_keys
+
+SPECIAL	cd dev; sh MAKEDEV pty0 ptm
+
+COPY	${OBJDIR}/../stage/bin/sshd			usr/sbin/sshd
+SPECIAL	chmod 511 usr/sbin/sshd
+COPY	${OBJDIR}/../stage/bin/ssh-keygen		usr/bin/ssh-keygen
+SPECIAL	chmod 555 usr/bin/ssh-keygen
+COPY	${OBJDIR}/../stage/bin/sshd-session		usr/libexec/sshd-session
+SPECIAL	chmod 511 usr/libexec/sshd-session
+COPY	${OBJDIR}/../stage/bin/sshd-auth		usr/libexec/sshd-auth
+SPECIAL	chmod 511 usr/libexec/sshd-auth
+
+COPY	${CURDIR}/../../../etc/etc.amd64/login.conf	etc/login.conf
--- /dev/null
+++ b/distrib/amd64/ramdisk_cd/rdsshd/root.profile
@@ -0,0 +1,16 @@
+set +o sh
+export VNAME=$(sysctl -n kern.osrelease)
+export VERSION="${VNAME%.*}${VNAME#*.}"
+export ARCH=$(sysctl -n hw.machine)
+export OBSD="OpenBSD/$ARCH $VNAME"
+PATH=/sbin:/bin:/usr/bin:/usr/sbin:/
+export PATH
+TERM=vt220
+export TERM
+umask 022
+set -o emacs
+PS1='rd# '
+export PS1
+echo
+echo "ramdisk sshd is running."
+echo "Run install to continue."
--- /dev/null
+++ b/distrib/amd64/ramdisk_cd/rdsshd/sshd_config
@@ -0,0 +1,14 @@
+Port ${RDSSHD_PORT}
+HostKey /etc/ssh/ssh_host_ed25519_key
+AllowUsers root
+PermitRootLogin prohibit-password
+AuthorizedKeysFile .ssh/authorized_keys
+PubkeyAuthentication yes
+AuthenticationMethods publickey
+PasswordAuthentication no
+KbdInteractiveAuthentication no
+Compression no
+PermitUserRC no
+PrintMotd no
+PrintLastLog no
+DisableForwarding yes
--- /dev/null
+++ b/distrib/amd64/ramdisk_cd/rdsshd/RAMDISK_CD_SSHD
@@ -0,0 +1,12 @@
+#	$OpenBSD$
+
+include "arch/amd64/conf/RAMDISK_CD"
+
+# Keep config(8)'s option append pointer valid while removing the tail.
+option		RDSSHD_RDROOT
+rmoption	NO_PROPOLICE
+rmoption	MINIROOTSIZE
+option		MINIROOTSIZE=40960
+rmoption	RDSSHD_RDROOT
+
+pseudo-device	pty	16
--- /dev/null
+++ b/distrib/amd64/ramdisk_cd/rdsshd/RAMDISK_CD_SSHD_NO_PROPOLICE
@@ -0,0 +1,11 @@
+#	$OpenBSD$
+
+include "arch/amd64/conf/RAMDISK_CD"
+
+# Keep config(8)'s option append pointer valid while removing the tail.
+option		RDSSHD_RDROOT
+rmoption	MINIROOTSIZE
+option		MINIROOTSIZE=40960
+rmoption	RDSSHD_RDROOT
+
+pseudo-device	pty	16

cd /usr/src/distrib/amd64/ramdisk_cd/rdsshd
make -f Makefile.rdsshd obj
make -f Makefile.rdsshd rdsshd \
    RDSSHD_AUTHORIZED_KEYS=/root/id_ed25519.pub

distrib/amd64/ramdisk_cd/rdsshd/Makefile.rdsshd
distrib/amd64/ramdisk_cd/rdsshd/Makefile.init
distrib/amd64/ramdisk_cd/rdsshd/README.rdsshd
distrib/amd64/ramdisk_cd/rdsshd/console-lock.sshd.patch
distrib/amd64/ramdisk_cd/rdsshd/init.sshd.patch
distrib/amd64/ramdisk_cd/rdsshd/installer.sshd.patch
distrib/amd64/ramdisk_cd/rdsshd/list.sshd
distrib/amd64/ramdisk_cd/rdsshd/root.profile
distrib/amd64/ramdisk_cd/rdsshd/sshd_config
distrib/amd64/ramdisk_cd/rdsshd/RAMDISK_CD_SSHD
distrib/amd64/ramdisk_cd/rdsshd/RAMDISK_CD_SSHD_NO_PROPOLICE

cd /usr/src/distrib/amd64/ramdisk_cd/rdsshd
make -f Makefile.rdsshd install-rdsshd \
    RELEASEDIR=/path/to/release

#	$OpenBSD$

.include <bsd.own.mk>

RDSSHD_AUTHORIZED_KEYS?=
RDSSHD_HOST_KEY?=
RDSSHD_CONSOLE_LOCK?=	no
RDSSHD_KERNEL_STACK_PROTECTOR?=	yes
RDSSHD_PORT?=	22
RDSSHD_AI_IF?=	em0
RDSSHD_AI_HOSTNAME?=	rdinstall
RDSSHD_AI_IPV4?=	autoconf
RDSSHD_AI_NETMASK?=	255.255.255.0
RDSSHD_AI_ROUTE?=	none
RDSSHD_AI_IPV6?=	none
RDSSHD_AI_DOMAIN?=	my.domain
RDSSHD_AI_DNS?=	none
RDSSHD_FSSIZE?=	32768

RDSSHD_BASEDIR=	${.CURDIR}/..
RDSSHD_TOP=	${.CURDIR}/../../../..
RDSSHD_UTILS=	${RDSSHD_BASEDIR}/../../miniroot
RDSSHD_MTREE=	${RDSSHD_UTILS}/mtree.conf
RDSSHD_EFIBOOT=	${DESTDIR}/usr/mdec/BOOTX64.EFI \
		${DESTDIR}/usr/mdec/BOOTIA32.EFI
RDSSHD_MOUNT_ARGS_MSDOS=	-o-s

RDSSHD_RAMDISK=	RAMDISK_CD_SSHD
RDSSHD_KERNEL=	${.OBJDIR}/bsd
.if ${RDSSHD_KERNEL_STACK_PROTECTOR:L} == "no"
RDSSHD_RAMDISK=	RAMDISK_CD_SSHD_NO_PROPOLICE
RDSSHD_KERNEL=	${.OBJDIR}/bsd.no-propolice
.endif
RDSSHD_FS=	miniroot${OSrev}_sshd.img
RDSSHD_BUILDOBJDIR=	${.OBJDIR}/build
RDSSHD_KERNELOBJDIR=	${RDSSHD_BUILDOBJDIR}/kernel/${RDSSHD_RAMDISK}
RDSSHD_INSTBIN=	${RDSSHD_BUILDOBJDIR}/instbin
RDSSHD_STAGE=	${.OBJDIR}/stage
RDSSHD_RDOBJDIR=	${.OBJDIR}/rdobj
RDSSHD_SSHOBJDIR=	${.OBJDIR}/sshobj
RDSSHD_INITOBJDIR=	${.OBJDIR}/initobj
RDSSHD_INITSRCDIR=	${.OBJDIR}/initsrc
RDSSHD_MOUNT_POINT=	${.OBJDIR}/mnt
RDSSHD_VND=	${.OBJDIR}/vnd
RDSSHD_BOOT=	${.OBJDIR}/boot
RDSSHD_OBJCHECK=	${.OBJDIR}/.rdsshd-obj-ok
RDSSHD_MAKEFILE=	${.CURDIR}/Makefile.rdsshd
RDSSHD_INITMAKEFILE=	${.CURDIR}/Makefile.init
RDSSHD_KERNELCONF=	${.CURDIR}/${RDSSHD_RAMDISK}
RDSSHD_BASECONF=	${RDSSHD_TOP}/sys/arch/${MACHINE}/conf/RAMDISK_CD
RDSSHD_KERNELCONFDEPS=	${RDSSHD_BASECONF}
RDSSHD_LISTS=	${RDSSHD_BASEDIR}/list ${.CURDIR}/list.sshd \
		${RDSSHD_STAGE}/list.console
RDSSHD_INITSRC=	${RDSSHD_INITSRCDIR}/init.c
RDSSHD_INIT=	${RDSSHD_STAGE}/init
RDSSHD_INSTALLERPATCH=	${.CURDIR}/installer.sshd.patch
RDSSHD_CONSOLEPATCH=	${.CURDIR}/console-lock.sshd.patch
RDSSHD_INITPATCH=	${.CURDIR}/init.sshd.patch
RDSSHD_SSHDCONF=	${.CURDIR}/sshd_config
RDSSHD_MRMAKEFSARGS?=	-s 20m \
		-o rdroot,minfree=0,bsize=4096,fsize=512,density=4096
RDSSHD_BINS=	${RDSSHD_STAGE}/bin/sshd \
		${RDSSHD_STAGE}/bin/ssh-keygen \
		${RDSSHD_STAGE}/bin/sshd-session \
		${RDSSHD_STAGE}/bin/sshd-auth

RDSSHD_INITDEP=
.if ${RDSSHD_CONSOLE_LOCK:L} == "yes"
RDSSHD_INITDEP=	${RDSSHD_INIT}
.endif

.PHONY: rdsshd
rdsshd: bsdsshd.rd ${RDSSHD_FS}

.PHONY: rdsshd-objcheck
rdsshd-objcheck: ${RDSSHD_OBJCHECK}

${RDSSHD_OBJCHECK}:
	@if [ "${.OBJDIR}" = "${.CURDIR}" ]; then \
		echo "private object directory is not active;" >&2; \
		echo "run 'make -f Makefile.rdsshd obj' separately first" >&2; \
		exit 1; \
	fi
	touch $@

${RDSSHD_KERNEL}: ${RDSSHD_OBJCHECK} ${RDSSHD_MAKEFILE} \
	    ${RDSSHD_KERNELCONF} ${RDSSHD_KERNELCONFDEPS}
	install -d -o ${BUILDUSER} -g ${WOBJGROUP} ${RDSSHD_KERNELOBJDIR}
	su ${BUILDUSER} -c \
	    'config -b ${RDSSHD_KERNELOBJDIR} -s ${RDSSHD_TOP}/sys \
	    ${RDSSHD_KERNELCONF} && cd ${RDSSHD_KERNELOBJDIR} && \
	    MAKEOBJDIR=${RDSSHD_KERNELOBJDIR} ${MAKE} clean && \
	    exec env MAKEOBJDIR=${RDSSHD_KERNELOBJDIR} ${MAKE} ${MFLAGS}'
	cp -p ${RDSSHD_KERNELOBJDIR}/bsd $@

bsdsshd.gz: bsdsshd.rd
	objcopy -g -x -R .comment -R .SUNW_ctf \
	    -K rd_root_size -K rd_root_image \
	    bsdsshd.rd bsdsshd.strip
	gzip -9cn bsdsshd.strip > bsdsshd.gz
.if !empty(RDSSHD_HOST_KEY)
	chmod 600 bsdsshd.strip $@
.endif

.PHONY: rdsshd-stock-deps rdsshd-instbin
rdsshd-stock-deps: ${RDSSHD_OBJCHECK} ${RDSSHD_MAKEFILE}
	@_objroot=`cd ${RDSSHD_BASEDIR} && ${MAKE} -V BSDOBJDIR`; \
	if [ ! -d "$$_objroot" ]; then \
		echo "normal OpenBSD object root does not exist: $$_objroot" >&2; \
		echo "create it before building rdsshd" >&2; \
		exit 1; \
	fi
	cd ${RDSSHD_TOP}/lib && ${MAKE} obj
	cd ${RDSSHD_TOP}/distrib/special && ${MAKE} obj
	cd ${RDSSHD_BASEDIR} && ${MAKE} obj
	@_srcdir=`cd ${RDSSHD_BASEDIR} && pwd`; \
	_objdir=`cd ${RDSSHD_BASEDIR} && ${MAKE} -V .OBJDIR`; \
	if [ "$$_objdir" = "$$_srcdir" ] || [ ! -d "$$_objdir" ]; then \
		echo "normal ramdisk_cd object directory is not active" >&2; \
		exit 1; \
	fi
	cd ${RDSSHD_TOP}/distrib/special/libstubs && ${MAKE} ${MFLAGS}

rdsshd-instbin: rdsshd-stock-deps
	cd ${RDSSHD_BASEDIR} && ${MAKE} ${MFLAGS} instbin
	install -d ${RDSSHD_BUILDOBJDIR}
	@_objdir=`cd ${RDSSHD_BASEDIR} && ${MAKE} -V .OBJDIR`; \
	if [ ! -f "$$_objdir/instbin" ]; then \
		echo "stock ramdisk_cd instbin was not built" >&2; \
		exit 1; \
	fi; \
	cp -p "$$_objdir/instbin" ${RDSSHD_INSTBIN}

bsdsshd.rd: rdsshd-files ${RDSSHD_INITDEP} rdsshd-instbin \
	    ${RDSSHD_KERNEL}
	install -d ${RDSSHD_RDOBJDIR}
	rm -f ${RDSSHD_RDOBJDIR}/instbin \
	    ${RDSSHD_RDOBJDIR}/mr.fs \
	    ${RDSSHD_RDOBJDIR}/bsd.rd
	cp -p ${RDSSHD_INSTBIN} ${RDSSHD_RDOBJDIR}/instbin
	rm -rf ${RDSSHD_RDOBJDIR}/mr.fs.d
	install -d -o root -g wheel ${RDSSHD_RDOBJDIR}/mr.fs.d
	mtree -def ${RDSSHD_MTREE} -p ${RDSSHD_RDOBJDIR}/mr.fs.d -u
	CURDIR=${RDSSHD_BASEDIR} OBJDIR=${RDSSHD_RDOBJDIR} OSrev=${OSrev} \
	    TARGDIR=${RDSSHD_RDOBJDIR}/mr.fs.d UTILS=${RDSSHD_UTILS} \
	    RELEASEDIR=${RELEASEDIR} sh ${RDSSHD_UTILS}/runlist.sh \
	    ${RDSSHD_LISTS}
	rm ${RDSSHD_RDOBJDIR}/mr.fs.d/instbin
	makefs ${RDSSHD_MRMAKEFSARGS} ${RDSSHD_RDOBJDIR}/mr.fs \
	    ${RDSSHD_RDOBJDIR}/mr.fs.d
	cp -p ${RDSSHD_KERNEL} ${RDSSHD_RDOBJDIR}/bsd.rd
	rdsetroot ${RDSSHD_RDOBJDIR}/bsd.rd ${RDSSHD_RDOBJDIR}/mr.fs
	cp ${RDSSHD_RDOBJDIR}/bsd.rd $@
.if !empty(RDSSHD_HOST_KEY)
	chmod 600 ${RDSSHD_RDOBJDIR}/mr.fs \
	    ${RDSSHD_RDOBJDIR}/bsd.rd $@
.endif

${RDSSHD_FS}: bsdsshd.gz
	-umount -f ${RDSSHD_MOUNT_POINT} >/dev/null 2>&1
	@if [ -e ${RDSSHD_VND} ] && [ ! -s ${RDSSHD_VND} ]; then \
		rm -f ${RDSSHD_VND}; \
	fi
	@if [ -e ${RDSSHD_VND} ]; then \
		echo "stale private vnd state; run" \
		    "'make -f Makefile.rdsshd unconfig-rdsshd' first" >&2; \
		exit 1; \
	fi
	install -d ${RDSSHD_MOUNT_POINT}
	dd if=/dev/zero of=${RDSSHD_FS} bs=512 count=${RDSSHD_FSSIZE}
	vnconfig -v ${.OBJDIR}/${RDSSHD_FS} > ${RDSSHD_VND}
	fdisk -yi -l ${RDSSHD_FSSIZE} -b 960 -f ${DESTDIR}/usr/mdec/mbr \
	    `cat ${RDSSHD_VND}`
	echo '/ *' | disklabel -wAT- `cat ${RDSSHD_VND}`
	newfs -t msdos /dev/r`cat ${RDSSHD_VND}`i
	mount ${RDSSHD_MOUNT_ARGS_MSDOS} /dev/`cat ${RDSSHD_VND}`i \
	    ${RDSSHD_MOUNT_POINT}
	mkdir -p ${RDSSHD_MOUNT_POINT}/efi/boot
	cp ${RDSSHD_EFIBOOT} ${RDSSHD_MOUNT_POINT}/efi/boot
	umount ${RDSSHD_MOUNT_POINT}
	newfs -O 1 -m 0 -o space -i 524288 -c ${RDSSHD_FSSIZE} \
	    /dev/r`cat ${RDSSHD_VND}`a
	mount /dev/`cat ${RDSSHD_VND}`a ${RDSSHD_MOUNT_POINT}
	objcopy -S -R .comment ${DESTDIR}/usr/mdec/boot ${RDSSHD_BOOT}
	installboot -v -r ${RDSSHD_MOUNT_POINT} `cat ${RDSSHD_VND}` \
	    ${DESTDIR}/usr/mdec/biosboot ${RDSSHD_BOOT}
	install -c -m 555 -o root -g wheel bsdsshd.gz \
	    ${RDSSHD_MOUNT_POINT}/bsd
	df -i ${RDSSHD_MOUNT_POINT}
	umount ${RDSSHD_MOUNT_POINT}
	vnconfig -u `cat ${RDSSHD_VND}`
	rm -f ${RDSSHD_VND}
.if !empty(RDSSHD_HOST_KEY)
	chmod 600 $@
.endif

.PHONY: rdsshd-check rdsshd-files rdsshd-scripts
rdsshd-check:
	@if [ -z "${RDSSHD_AUTHORIZED_KEYS}" ]; then \
		echo "set RDSSHD_AUTHORIZED_KEYS to a public key file" >&2; \
		exit 1; \
	fi
	@case "${RDSSHD_CONSOLE_LOCK:L}" in \
	yes|no) ;; \
	*) echo "RDSSHD_CONSOLE_LOCK must be yes or no" >&2; exit 1;; \
	esac
	@case "${RDSSHD_KERNEL_STACK_PROTECTOR:L}" in \
	yes|no) ;; \
	*) echo "RDSSHD_KERNEL_STACK_PROTECTOR must be yes or no" >&2; exit 1;; \
	esac

${RDSSHD_INITSRC}: ${RDSSHD_OBJCHECK} ${RDSSHD_TOP}/sbin/init/init.c \
	    ${RDSSHD_INITPATCH}
	install -d ${RDSSHD_INITSRCDIR}
	rm -f ${RDSSHD_INITSRC}.tmp ${RDSSHD_INITSRC}.tmp.orig \
	    ${RDSSHD_INITSRC}.tmp.rej
	cp ${RDSSHD_TOP}/sbin/init/init.c ${RDSSHD_INITSRC}.tmp
	cd ${RDSSHD_INITSRCDIR} && \
	    patch -f -s -p0 -F0 < ${RDSSHD_INITPATCH}
	mv ${RDSSHD_INITSRC}.tmp ${RDSSHD_INITSRC}

${RDSSHD_INIT}: ${RDSSHD_INITSRC} \
	    ${RDSSHD_TOP}/sbin/init/pathnames.h ${RDSSHD_INITMAKEFILE} \
	    ${RDSSHD_BASEDIR}/../../special/init/Makefile \
	    ${RDSSHD_BASEDIR}/../../special/Makefile.inc
	install -d ${RDSSHD_INITOBJDIR} ${RDSSHD_STAGE}
	cd ${RDSSHD_BASEDIR}/../../special/init && \
	    MAKEOBJDIR=${RDSSHD_INITOBJDIR} ${MAKE} ${MFLAGS} \
	    -f ${RDSSHD_INITMAKEFILE} \
	    RDSSHD_INITSRCDIR=${RDSSHD_INITSRCDIR} init
	install -c -s ${RDSSHD_INITOBJDIR}/init $@

rdsshd-scripts: ${RDSSHD_OBJCHECK} ${RDSSHD_UTILS}/install.sub \
	    ${RDSSHD_UTILS}/dot.profile \
	    ${RDSSHD_INSTALLERPATCH} ${RDSSHD_CONSOLEPATCH}
	install -d ${RDSSHD_STAGE}
	rm -f ${RDSSHD_STAGE}/install.sub.tmp \
	    ${RDSSHD_STAGE}/install.sub.tmp.orig \
	    ${RDSSHD_STAGE}/install.sub.tmp.rej \
	    ${RDSSHD_STAGE}/dot.profile.tmp \
	    ${RDSSHD_STAGE}/dot.profile.tmp.orig \
	    ${RDSSHD_STAGE}/dot.profile.tmp.rej
	cp ${RDSSHD_UTILS}/install.sub ${RDSSHD_STAGE}/install.sub.tmp
	cp ${RDSSHD_UTILS}/dot.profile ${RDSSHD_STAGE}/dot.profile.tmp
	cd ${RDSSHD_STAGE} && \
	    patch -f -s -p0 -F0 < ${RDSSHD_INSTALLERPATCH}
.if ${RDSSHD_CONSOLE_LOCK:L} == "yes"
	cd ${RDSSHD_STAGE} && \
	    patch -f -s -p0 -F0 < ${RDSSHD_CONSOLEPATCH}
.endif
	chmod 755 ${RDSSHD_STAGE}/install.sub.tmp
	mv ${RDSSHD_STAGE}/install.sub.tmp ${RDSSHD_STAGE}/install.sub
	mv ${RDSSHD_STAGE}/dot.profile.tmp ${RDSSHD_STAGE}/dot.profile

rdsshd-files: rdsshd-check rdsshd-scripts ${RDSSHD_BINS} \
	    ${RDSSHD_SSHDCONF}
	install -d ${RDSSHD_STAGE}
	@if [ "${RDSSHD_CONSOLE_LOCK:L}" = yes ]; then \
		echo 'COPY ${RDSSHD_INIT} sbin/init'; \
	fi > ${RDSSHD_STAGE}/list.console
	sed '/^root:/s|:/bin/ksh$$|:/bin/sh|' \
	    ${RDSSHD_UTILS}/master.passwd > ${RDSSHD_STAGE}/master.passwd
	grep '^root:.*:/bin/sh$$' ${RDSSHD_STAGE}/master.passwd >/dev/null
	sed -e '/^[	 ]*$$/d' -e '/^[	 ]*#/d' \
	    < "${RDSSHD_AUTHORIZED_KEYS}" > ${RDSSHD_STAGE}/authorized_keys
	test -s ${RDSSHD_STAGE}/authorized_keys
	@_n=0; while IFS= read -r _key; do \
		_n=$$((_n + 1)); \
		if ! printf '%s\n' "$$_key" | \
		    ${RDSSHD_STAGE}/bin/ssh-keygen -l -f - >/dev/null 2>&1; then \
			echo "invalid public key on line $$_n of RDSSHD_AUTHORIZED_KEYS" >&2; \
			exit 1; \
		fi; \
	done < ${RDSSHD_STAGE}/authorized_keys
	grep '^sshd:' ${RDSSHD_STAGE}/master.passwd >/dev/null || \
	    grep '^sshd:' ${RDSSHD_TOP}/etc/master.passwd >> \
	    ${RDSSHD_STAGE}/master.passwd
	cp ${RDSSHD_UTILS}/group ${RDSSHD_STAGE}/group
	grep '^sshd:' ${RDSSHD_STAGE}/group >/dev/null || \
	    grep '^sshd:' ${RDSSHD_TOP}/etc/group >> ${RDSSHD_STAGE}/group
	{ \
	    printf 'System hostname = %s\n' '${RDSSHD_AI_HOSTNAME}'; \
	    printf 'Network interface to configure = %s\n' '${RDSSHD_AI_IF}'; \
	    printf 'IPv4 address for %s = %s\n' \
		'${RDSSHD_AI_IF}' '${RDSSHD_AI_IPV4}'; \
	    case '${RDSSHD_AI_IPV4}' in \
	    none|autoconf|dhcp) ;; \
	    *) printf 'Netmask for %s = %s\n' \
		'${RDSSHD_AI_IF}' '${RDSSHD_AI_NETMASK}'; \
	       printf 'Default IPv4 route = %s\n' '${RDSSHD_AI_ROUTE}' ;; \
	    esac; \
	    printf 'IPv6 address for %s = %s\n' \
		'${RDSSHD_AI_IF}' '${RDSSHD_AI_IPV6}'; \
	    printf 'Network interface to configure = done\n'; \
	    printf 'DNS domain name = %s\n' '${RDSSHD_AI_DOMAIN}'; \
	    printf 'DNS nameservers = %s\n' '${RDSSHD_AI_DNS}'; \
	} > ${RDSSHD_STAGE}/auto_install.conf
	sed 's|^Port .*|Port ${RDSSHD_PORT}|' ${RDSSHD_SSHDCONF} > \
	    ${RDSSHD_STAGE}/sshd_config
	rm -f ${RDSSHD_STAGE}/ssh_host_ed25519_key \
	    ${RDSSHD_STAGE}/ssh_host_ed25519_key.pub \
	    ${RDSSHD_STAGE}/ssh_host_ed25519_key.test \
	    ${RDSSHD_STAGE}/ssh_host_ed25519_key.test.pub \
	    ${RDSSHD_STAGE}/sshd_config.test
	@if [ -n "${RDSSHD_HOST_KEY}" ]; then \
		if ! ${RDSSHD_STAGE}/bin/ssh-keygen -y -P '' \
		    -f "${RDSSHD_HOST_KEY}" 2>/dev/null | grep -q '^ssh-ed25519 '; then \
			echo "RDSSHD_HOST_KEY is not an unencrypted Ed25519 private key" >&2; \
			exit 1; \
		fi; \
		install -c -m 600 "${RDSSHD_HOST_KEY}" \
		    ${RDSSHD_STAGE}/ssh_host_ed25519_key; \
	fi
	@_key=${RDSSHD_STAGE}/ssh_host_ed25519_key; \
	_testkey=${RDSSHD_STAGE}/ssh_host_ed25519_key.test; \
	_testconf=${RDSSHD_STAGE}/sshd_config.test; \
	if [[ ! -s $$_key ]]; then \
		_key=$$_testkey; \
		${RDSSHD_STAGE}/bin/ssh-keygen -q -t ed25519 -N '' \
		    -f $$_key || exit 1; \
	fi; \
	sed "s|^HostKey .*|HostKey $$_key|" \
	    ${RDSSHD_STAGE}/sshd_config > $$_testconf; \
	${RDSSHD_STAGE}/bin/sshd -t -f $$_testconf; \
	_status=$$?; \
	rm -f $$_testconf $$_testkey $$_testkey.pub; \
	exit $$_status
${RDSSHD_STAGE}/bin/sshd: ${RDSSHD_OBJCHECK} ${RDSSHD_MAKEFILE}
	install -d ${RDSSHD_STAGE}/bin ${RDSSHD_SSHOBJDIR}/sshd
	cd ${RDSSHD_TOP}/usr.bin/ssh/sshd && \
	    MAKEOBJDIR=${RDSSHD_SSHOBJDIR}/sshd ${MAKE} ${MFLAGS} \
	    LDSTATIC="${STATIC}" ZLIB=no
	install -c -s ${RDSSHD_SSHOBJDIR}/sshd/sshd $@

${RDSSHD_STAGE}/bin/ssh-keygen: ${RDSSHD_OBJCHECK} ${RDSSHD_MAKEFILE}
	install -d ${RDSSHD_STAGE}/bin ${RDSSHD_SSHOBJDIR}/ssh-keygen
	cd ${RDSSHD_TOP}/usr.bin/ssh/ssh-keygen && \
	    MAKEOBJDIR=${RDSSHD_SSHOBJDIR}/ssh-keygen ${MAKE} ${MFLAGS} \
	    LDSTATIC="${STATIC}" ZLIB=no
	install -c -s ${RDSSHD_SSHOBJDIR}/ssh-keygen/ssh-keygen $@

${RDSSHD_STAGE}/bin/sshd-session: ${RDSSHD_OBJCHECK} ${RDSSHD_MAKEFILE}
	install -d ${RDSSHD_STAGE}/bin ${RDSSHD_SSHOBJDIR}/sshd-session
	cd ${RDSSHD_TOP}/usr.bin/ssh/sshd-session && \
	    MAKEOBJDIR=${RDSSHD_SSHOBJDIR}/sshd-session ${MAKE} ${MFLAGS} \
	    LDSTATIC="${STATIC}" ZLIB=no
	install -c -s ${RDSSHD_SSHOBJDIR}/sshd-session/sshd-session $@

${RDSSHD_STAGE}/bin/sshd-auth: ${RDSSHD_OBJCHECK} ${RDSSHD_MAKEFILE}
	install -d ${RDSSHD_STAGE}/bin ${RDSSHD_SSHOBJDIR}/sshd-auth
	cd ${RDSSHD_TOP}/usr.bin/ssh/sshd-auth && \
	    MAKEOBJDIR=${RDSSHD_SSHOBJDIR}/sshd-auth ${MAKE} ${MFLAGS} \
	    LDSTATIC="${STATIC}" ZLIB=no
	install -c -s ${RDSSHD_SSHOBJDIR}/sshd-auth/sshd-auth $@

.PHONY: unconfig-rdsshd
unconfig-rdsshd:
	-umount -f ${RDSSHD_MOUNT_POINT} >/dev/null 2>&1
	@if [ -e ${RDSSHD_VND} ] && [ ! -s ${RDSSHD_VND} ]; then \
		rm -f ${RDSSHD_VND}; \
	elif [ -f ${RDSSHD_VND} ]; then \
		_vnd=`cat ${RDSSHD_VND}`; \
		_unit=$${_vnd#vnd}; \
		if [ "vnd$$_unit" != "$$_vnd" ] || [ -z "$$_unit" ]; then \
			echo "invalid private vnd state: $$_vnd" >&2; exit 1; \
		fi; \
		case "$$_unit" in \
		*[!0-9]*) echo "invalid private vnd state: $$_vnd" >&2; exit 1;; \
		esac; \
		_info=`vnconfig -l "$$_vnd"` || exit 1; \
		case "$$_info" in \
		"$$_vnd: not in use") rm -f ${RDSSHD_VND} ;; \
		"$$_vnd: covering ${.OBJDIR}/${RDSSHD_FS} on "*) \
			vnconfig -u "$$_vnd" && rm -f ${RDSSHD_VND} ;; \
		*) echo "refusing to detach vnd not owned by rdsshd: $$_info" >&2; \
			exit 1 ;; \
		esac; \
	fi

.ifdef RELEASEDIR
.PHONY: install-rdsshd
install-rdsshd: bsdsshd.gz ${RDSSHD_FS}
	cp bsdsshd.gz ${RELEASEDIR}/bsdsshd.rd
	cp ${RDSSHD_FS} ${RELEASEDIR}
.if empty(RDSSHD_HOST_KEY)
	chmod a+r ${RELEASEDIR}/bsdsshd.rd
.else
	chmod 600 ${RELEASEDIR}/bsdsshd.rd ${RELEASEDIR}/${RDSSHD_FS}
.endif
.endif

.PHONY: clean-rdsshd clean cleandir
clean-rdsshd: unconfig-rdsshd
	rm -f bsdsshd.rd bsdsshd.gz bsdsshd.strip ${RDSSHD_FS} \
	    ${.OBJDIR}/bsd ${.OBJDIR}/bsd.no-propolice ${RDSSHD_BOOT} \
	    ${RDSSHD_OBJCHECK}
	rm -rf ${RDSSHD_BUILDOBJDIR} ${RDSSHD_STAGE} ${RDSSHD_RDOBJDIR} \
	    ${RDSSHD_SSHOBJDIR} ${RDSSHD_INITOBJDIR} ${RDSSHD_INITSRCDIR}
	-rmdir ${RDSSHD_MOUNT_POINT}

clean cleandir: clean-rdsshd

.PHONY: prepare-unpatch-rdsshd
prepare-unpatch-rdsshd: clean-rdsshd
	@if [ -L ${.CURDIR}/obj ]; then \
		_obj=`readlink ${.CURDIR}/obj`; \
		echo "empty private object directory may be removed: $$_obj"; \
		rm -f ${.CURDIR}/obj; \
	fi

.include <bsd.obj.mk>