landlock is applied only to the ui process to drop fs access and in the fs process to limit where telescope can read/write files. The network process is more difficult to landlock because while in theory it doesn't need *any* fs access, in practice it needs to read (at least) files inside /etc/ for DNS to work.

ncurses has "--with-termlib" build option, which forces some symbols from libncurses.so to be moved to libtinfo.so. It caused the following error: ld: ui.o: undefined reference to symbol 'keypad' ld: /lib64/libtinfow.so.6: error adding symbols: DSO missing from command line

Looking at the build failure for the nix package on darwin I noticed that explicit_bzero is used by recallocarray but not included in the compat layer...

on libevent2 we need to wrap evbuffer_add with evbuffer_freeze/evbuffer_unfreeze. Not sure exactly why, probably because we're doing some evbuffer_enable/disable/enable-again. Retain compatibility with the custom libevent1 in base on OpenBSD.

Fixed the dist tarball generation