72 files changed, 493 insertions, 366 deletions

diff --git a/.github/codeql.yml b/.github/codeql.yml
new file mode 100644
index 0000000..6ff8337
--- /dev/null
+++ b/.github/codeql.yml
@@ -0,0 +1,9 @@
+query-filters:
+  - exclude:
+      id: cpp/commented-out-code
+  - exclude:
+      id: cpp/long-switch
+  - exclude:
+      id: cpp/loop-variable-changed
+  - exclude:
+      id: cpp/poorly-documented-function
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..5ace460
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3ad924f..3890bb0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -69,27 +69,21 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Run tests
-        uses: vmactions/freebsd-vm@v1
+        uses: cross-platform-actions/action@v0.24.0
         with:
-          release: "14.0"
-          usesh: true
-          copyback: false
+          operating_system: freebsd
+          version: "14.0"
+          sync_files: runner-to-vm
 
-          prepare: |
-            pkg install -y \
+          run: |
+            sudo pkg install -y \
                 bash \
                 expect \
                 oniguruma \
                 pkgconf \
-                sudo \
                 tcl-wrapper
-            pw useradd -n action -m -G wheel -s /usr/local/bin/bash
-            echo "%wheel ALL=(ALL) NOPASSWD: ALL" >>/usr/local/etc/sudoers
-            mount -t fdescfs none /dev/fd
-
-          run: |
-            chown -R action:action .
-            sudo -u action make -j$(nproc) distcheck
+            sudo mount -t fdescfs none /dev/fd
+            make -j$(nproc) distcheck
 
   openbsd:
     name: OpenBSD
@@ -100,27 +94,21 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Run tests
-        uses: vmactions/openbsd-vm@v1
+        uses: cross-platform-actions/action@v0.24.0
         with:
-          release: "7.5"
-          usesh: true
-          copyback: false
+          operating_system: openbsd
+          version: "7.5"
+          sync_files: runner-to-vm
 
-          prepare: |
-            pkg_add \
+          run: |
+            sudo pkg_add \
                 bash \
                 expect \
                 gmake \
                 oniguruma
-            adduser -group USER -batch action wheel </dev/null
-            cp /etc/examples/doas.conf /etc/doas.conf
-            echo "permit nopass keepenv :wheel" >>/etc/doas.conf
-
-          run: |
-            chown -R action:action .
             jobs=$(sysctl -n hw.ncpu)
-            doas -u action gmake config
-            doas -u action gmake -j$jobs check TEST_FLAGS="--sudo=doas --verbose=skipped"
+            gmake -j$jobs config
+            gmake -j$jobs check TEST_FLAGS="--sudo --verbose=skipped"
 
   netbsd:
     name: NetBSD
@@ -131,30 +119,22 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Run tests
-        uses: vmactions/netbsd-vm@v1
+        uses: cross-platform-actions/action@v0.24.0
         with:
-          release: "10.0"
-          usesh: true
-          copyback: false
+          operating_system: netbsd
+          version: "10.0"
+          sync_files: runner-to-vm
 
-          prepare: |
+          run: |
             PATH="/sbin:/usr/sbin:$PATH"
-            pkg_add \
+            sudo pkgin -y install \
                 bash \
-                clang \
                 oniguruma \
                 pkgconf \
-                sudo \
                 tcl-expect
-            useradd -m -G wheel -g =uid action
-            echo "%wheel ALL=(ALL) NOPASSWD: ALL" >>/usr/pkg/etc/sudoers
-
-          run: |
-            PATH="/sbin:/usr/sbin:$PATH"
-            chown -R action:action .
             jobs=$(sysctl -n hw.ncpu)
-            sudo -u action make config CC=clang
-            sudo -u action make -j$jobs check TEST_FLAGS="--sudo --verbose=skipped"
+            make -j$jobs config
+            make -j$jobs check TEST_FLAGS="--sudo --verbose=skipped"
 
   dragonflybsd:
     name: DragonFly BSD
diff --git a/.github/workflows/codecov.yml b/.github/workflows/codecov.yml
index 2abe531..2245f40 100644
--- a/.github/workflows/codecov.yml
+++ b/.github/workflows/codecov.yml
@@ -29,7 +29,7 @@ jobs:
           make -j$(nproc) check TEST_FLAGS="--sudo"
           gcov -abcfpu obj/*/*.o
 
-      - uses: codecov/codecov-action@v3
+      - uses: codecov/codecov-action@v4
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           fail_ci_if_error: true
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index a2c224a..c21fda5 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -39,15 +39,19 @@ jobs:
               libonig-dev \
               liburing-dev
 
+      - name: Configure
+        run: |
+          make -j$(nproc) config
+
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v3
         with:
           languages: cpp
           queries: +security-and-quality
+          config-file: .github/codeql.yml
 
       - name: Build
         run: |
-          make config
           make -j$(nproc) all
 
       - name: Perform CodeQL Analysis
diff --git a/bench/bench.sh b/bench/bench.sh
index e4b5511..1526fe5 100644
--- a/bench/bench.sh
+++ b/bench/bench.sh
@@ -221,7 +221,8 @@ setup() {
     fi
 
     echo "Building bfs ..."
-    as-user make -s -j"$nproc" release all
+    as-user make -s -j"$nproc" RELEASE=y
+    as-user make -s -j"$nproc" all
 
     as-user mkdir -p bench/corpus
 
@@ -253,7 +254,12 @@ setup() {
                 echo "Building bfs $commit ..."
                 cd "$worktree"
                 as-user git checkout -qd "$commit" --
-                as-user make -s -j"$nproc" release
+                if [ -e config ]; then
+                    as-user make -s -j"$nproc" config RELEASE=1
+                    as-user make -s -j"$nproc"
+                else
+                    as-user make -s -j"$nproc" release
+                fi
                 if [ -e ./bin/bfs ]; then
                     as-user cp ./bin/bfs "$bin/bfs-$commit"
                 else
diff --git a/config/config.mk b/config/config.mk
index 5750b49..280c6ac 100644
--- a/config/config.mk
+++ b/config/config.mk
@@ -44,34 +44,19 @@ ${GEN}/vars.mk::
 # Sets the build flags.  This depends on vars.mk and uses a recursive make so
 # that the default flags can depend on variables like ${OS}.
 ${GEN}/flags.mk: ${GEN}/vars.mk
-	@+${MAKE} -sf config/flags.mk
+	@+${MAKE} -sf config/flags.mk $@
 .PHONY: ${GEN}/flags.mk
 
 # Check for dependency generation support
 ${GEN}/deps.mk: ${GEN}/flags.mk
-	@+${MAKE} -sf config/deps.mk
+	@+${MAKE} -sf config/deps.mk $@
 .PHONY: ${GEN}/deps.mk
 
-# External dependencies
-PKG_MKS := \
-    ${GEN}/libacl.mk \
-    ${GEN}/libcap.mk \
-    ${GEN}/libselinux.mk \
-    ${GEN}/liburing.mk \
-    ${GEN}/oniguruma.mk
-
 # Auto-detect dependencies and their build flags
-${GEN}/pkgs.mk: ${PKG_MKS}
-	@printf '# %s\n' "${TGT}" >$@
-	@printf 'include $${GEN}/%s\n' ${.ALLSRC:${GEN}/%=%} >>$@
-	@+${MAKE} -sf config/pkgs.mk
+${GEN}/pkgs.mk: ${GEN}/flags.mk
+	@+${MAKE} -sf config/pkgs.mk $@
 .PHONY: ${GEN}/pkgs.mk
 
-# Auto-detect dependencies
-${PKG_MKS}: ${GEN}/flags.mk
-	@+${MAKE} -sf config/pkg.mk TARGET=$@
-.PHONY: ${PKG_MKS}
-
 # Compile-time feature detection
 ${GEN}/config.h: ${CONFIG}
 	@+${MAKE} -sf config/header.mk $@
diff --git a/config/cc-define.sh b/config/define-if.sh
index edb5c87..059c1ac 100755
--- a/config/cc-define.sh
+++ b/config/define-if.sh
@@ -3,17 +3,18 @@
 # Copyright © Tavian Barnes <tavianator@tavianator.com>
 # SPDX-License-Identifier: 0BSD
 
-# Output a C preprocessor definition based on whether a C source file could be
-# compiled successfully
+# Output a C preprocessor definition based on whether a command succeeds
 
 set -eu
 
 SLUG="${1#config/}"
 SLUG="${SLUG%.c}"
-MACRO="BFS_HAS_$(printf '%s' "$SLUG" | tr 'a-z-' 'A-Z_')"
+MACRO="BFS_$(printf '%s' "$SLUG" | tr '/a-z-' '_A-Z_')"
+shift
 
-if config/cc.sh "$1"; then
+if "$@"; then
     printf '#define %s true\n' "$MACRO"
 else
     printf '#define %s false\n' "$MACRO"
+    exit 1
 fi
diff --git a/config/deps.mk b/config/deps.mk
index 2201f06..ac394a5 100644
--- a/config/deps.mk
+++ b/config/deps.mk
@@ -15,4 +15,4 @@ ${GEN}/deps.mk::
 	    printf 'DEPFLAGS = -MD -MP\n'; \
 	fi >>$@ 2>$@.log
 	${VCAT} $@
-	@printf -- '-include %s\n' ${OBJS:.o=.d} >>$@
+	printf -- '-include %s\n' ${OBJS:.o=.d} >>$@
diff --git a/config/flags.mk b/config/flags.mk
index 8a2e50e..837c30f 100644
--- a/config/flags.mk
+++ b/config/flags.mk
@@ -45,7 +45,7 @@ export BFS_CFLAGS= -std=c17 -pthread
 LDLIBS,DragonFly := -lposix1e
 LDLIBS,Linux := -lrt
 LDLIBS,NetBSD := -lutil
-LDLIBS,SunOS := -lsocket -lnsl
+LDLIBS,SunOS := -lsec -lsocket -lnsl
 export BFS_LDLIBS=${LDLIBS,${OS}}
 
 # Build profiles
@@ -75,12 +75,13 @@ export TSAN_CFLAGS=${TSAN_CFLAGS,${_TSAN}}
 export UBSAN_CFLAGS=${UBSAN_CFLAGS,${_UBSAN}}
 
 SAN_CFLAGS,y := -fno-sanitize-recover=all
-NO_SAN := ${NOR,${_ASAN},${_LSAN},${_MSAN},${_TSAN},${_UBSAN}}
-SAN := ${NOT,${NO_SAN}}
+INSANE := ${NOT,${_ASAN}${_LSAN}${_MSAN}${_TSAN}${_UBSAN}}
+SAN := ${NOT,${INSANE}}
 export SAN_CFLAGS=${SAN_CFLAGS,${SAN}}
 
 # MSAN and TSAN both need all code to be instrumented
-NOLIBS ?= ${NOT,${NOR,${_MSAN},${_TSAN}}}
+YESLIBS := ${NOT,${_MSAN}${_TSAN}}
+NOLIBS ?= ${NOT,${YESLIBS}}
 export XNOLIBS=${NOLIBS}
 
 # gcov only intercepts fork()/exec() with -std=gnu*
diff --git a/config/has/acl-get-entry.c b/config/has/acl-get-entry.c
new file mode 100644
index 0000000..3cce771
--- /dev/null
+++ b/config/has/acl-get-entry.c
@@ -0,0 +1,8 @@
+#include <sys/types.h>
+#include <sys/acl.h>
+
+int main(void) {
+	acl_t acl = acl_get_file(".", ACL_TYPE_DEFAULT);
+	acl_entry_t entry;
+	return acl_get_entry(acl, ACL_FIRST_ENTRY, &entry);
+}
diff --git a/config/has/acl-get-file.c b/config/has/acl-get-file.c
new file mode 100644
index 0000000..89fbf23
--- /dev/null
+++ b/config/has/acl-get-file.c
@@ -0,0 +1,8 @@
+#include <stddef.h>
+#include <sys/types.h>
+#include <sys/acl.h>
+
+int main(void) {
+	acl_t acl = acl_get_file(".", ACL_TYPE_DEFAULT);
+	return acl == (acl_t)NULL;
+}
diff --git a/config/has/acl-get-tag-type.c b/config/has/acl-get-tag-type.c
new file mode 100644
index 0000000..2901956
--- /dev/null
+++ b/config/has/acl-get-tag-type.c
@@ -0,0 +1,10 @@
+#include <string.h>
+#include <sys/types.h>
+#include <sys/acl.h>
+
+int main(void) {
+	acl_entry_t entry;
+	memset(&entry, 0, sizeof(entry));
+	acl_tag_t tag;
+	return acl_get_tag_type(entry, &tag);
+}
diff --git a/config/acl-is-trivial-np.c b/config/has/acl-is-trivial-np.c
index 4178238..9ca9fc7 100644
--- a/config/acl-is-trivial-np.c
+++ b/config/has/acl-is-trivial-np.c
@@ -1,6 +1,7 @@
 // Copyright © Tavian Barnes <tavianator@tavianator.com>
 // SPDX-License-Identifier: 0BSD
 
+#include <sys/types.h>
 #include <sys/acl.h>
 
 int main(void) {
diff --git a/config/has/acl-trivial.c b/config/has/acl-trivial.c
new file mode 100644
index 0000000..7efc838
--- /dev/null
+++ b/config/has/acl-trivial.c
@@ -0,0 +1,8 @@
+// Copyright © Tavian Barnes <tavianator@tavianator.com>
+// SPDX-License-Identifier: 0BSD
+
+#include <sys/acl.h>
+
+int main(void) {
+	return acl_trivial(".");
+}
diff --git a/config/aligned-alloc.c b/config/has/aligned-alloc.c
index 4460038..4460038 100644
--- a/config/aligned-alloc.c
+++ b/config/has/aligned-alloc.c
diff --git a/config/confstr.c b/config/has/confstr.c
index 58280b4..58280b4 100644
--- a/config/confstr.c
+++ b/config/has/confstr.c
diff --git a/config/has/extattr-get-file.c b/config/has/extattr-get-file.c
new file mode 100644
index 0000000..ac9cf96
--- /dev/null
+++ b/config/has/extattr-get-file.c
@@ -0,0 +1,10 @@
+// Copyright © Tavian Barnes <tavianator@tavianator.com>
+// SPDX-License-Identifier: 0BSD
+
+#include <stddef.h>
+#include <sys/types.h>
+#include <sys/extattr.h>
+
+int main(void) {
+	return extattr_get_file("file", EXTATTR_NAMESPACE_USER, "xattr", NULL, 0);
+}
diff --git a/config/has/extattr-get-link.c b/config/has/extattr-get-link.c
new file mode 100644
index 0000000..c35be5b
--- /dev/null
+++ b/config/has/extattr-get-link.c
@@ -0,0 +1,10 @@
+// Copyright © Tavian Barnes <tavianator@tavianator.com>
+// SPDX-License-Identifier: 0BSD
+
+#include <stddef.h>
+#include <sys/types.h>
+#include <sys/extattr.h>
+
+int main(void) {
+	return extattr_get_link("link", EXTATTR_NAMESPACE_USER, "xattr", NULL, 0);
+}
diff --git a/config/has/extattr-list-file.c b/config/has/extattr-list-file.c
new file mode 100644
index 0000000..e68a8bb
--- /dev/null
+++ b/config/has/extattr-list-file.c
@@ -0,0 +1,10 @@
+// Copyright © Tavian Barnes <tavianator@tavianator.com>
+// SPDX-License-Identifier: 0BSD
+
+#include <stddef.h>
+#include <sys/types.h>
+#include <sys/extattr.h>
+
+int main(void) {
+	return extattr_list_file("file", EXTATTR_NAMESPACE_USER, NULL, 0);
+}
diff --git a/config/has/extattr-list-link.c b/config/has/extattr-list-link.c
new file mode 100644
index 0000000..49f0ec2
--- /dev/null
+++ b/config/has/extattr-list-link.c
@@ -0,0 +1,10 @@
+// Copyright © Tavian Barnes <tavianator@tavianator.com>
+// SPDX-License-Identifier: 0BSD
+
+#include <stddef.h>
+#include <sys/types.h>
+#include <sys/extattr.h>
+
+int main(void) {
+	return extattr_list_link("link", EXTATTR_NAMESPACE_USER, NULL, 0);
+}
diff --git a/config/fdclosedir.c b/config/has/fdclosedir.c
index f4ad1f5..f4ad1f5 100644
--- a/config/fdclosedir.c
+++ b/config/has/fdclosedir.c
diff --git a/config/getdents.c b/config/has/getdents.c
index d0d4228..d0d4228 100644
--- a/config/getdents.c
+++ b/config/has/getdents.c
diff --git a/config/getdents64-syscall.c b/config/has/getdents64-syscall.c
index 4838c14..4838c14 100644
--- a/config/getdents64-syscall.c
+++ b/config/has/getdents64-syscall.c
diff --git a/config/getdents64.c b/config/has/getdents64.c
index 1abf36d..1abf36d 100644
--- a/config/getdents64.c
+++ b/config/has/getdents64.c
diff --git a/config/getprogname-gnu.c b/config/has/getprogname-gnu.c
index 6b97c5e..6b97c5e 100644
--- a/config/getprogname-gnu.c
+++ b/config/has/getprogname-gnu.c
diff --git a/config/getprogname.c b/config/has/getprogname.c
index 83dc8e8..83dc8e8 100644
--- a/config/getprogname.c
+++ b/config/has/getprogname.c
diff --git a/config/has/max-align-t.c b/config/has/max-align-t.c
new file mode 100644
index 0000000..96165ce
--- /dev/null
+++ b/config/has/max-align-t.c
@@ -0,0 +1,8 @@
+// Copyright © Tavian Barnes <tavianator@tavianator.com>
+// SPDX-License-Identifier: 0BSD
+
+#include <stddef.h>
+
+int main(void) {
+	return _Alignof(max_align_t);
+}
diff --git a/config/pipe2.c b/config/has/pipe2.c
index 4cb43b5..4cb43b5 100644
--- a/config/pipe2.c
+++ b/config/has/pipe2.c
diff --git a/config/posix-spawn-addfchdir-np.c b/config/has/posix-spawn-addfchdir-np.c
index b870a53..b870a53 100644
--- a/config/posix-spawn-addfchdir-np.c
+++ b/config/has/posix-spawn-addfchdir-np.c
diff --git a/config/posix-spawn-addfchdir.c b/config/has/posix-spawn-addfchdir.c
index c52ff81..c52ff81 100644
--- a/config/posix-spawn-addfchdir.c
+++ b/config/has/posix-spawn-addfchdir.c
diff --git a/config/st-acmtim.c b/config/has/st-acmtim.c
index d687ab0..d687ab0 100644
--- a/config/st-acmtim.c
+++ b/config/has/st-acmtim.c
diff --git a/config/st-acmtimespec.c b/config/has/st-acmtimespec.c
index f747bc0..f747bc0 100644
--- a/config/st-acmtimespec.c
+++ b/config/has/st-acmtimespec.c
diff --git a/config/st-birthtim.c b/config/has/st-birthtim.c
index 4964571..4964571 100644
--- a/config/st-birthtim.c
+++ b/config/has/st-birthtim.c
diff --git a/config/st-birthtimespec.c b/config/has/st-birthtimespec.c
index 91a613f..91a613f 100644
--- a/config/st-birthtimespec.c
+++ b/config/has/st-birthtimespec.c
diff --git a/config/st-flags.c b/config/has/st-flags.c
index b1d0c32..b1d0c32 100644
--- a/config/st-flags.c
+++ b/