Add a clean pkg_add implementation on top of libarchive and libfetch.
Known regressions:
- "pkg_add -" (aka reading from stdin) is currently not supported
- "pkg_add -s" is not supported either
- no progress reports for the downloads
- binary packages with hardlinks created by pkg_create before
  pkg_install-20080422 will not extract correctly (libarchive issue)
- no adhoc check for potential conflicts between dependencies and
  already installed packages

Features:
- Twice as fast for the typical case of /var/tmp and /usr/pkg on
  different filesystems
- Standalone
- implicit conflict detection before actual installation.
Move to pkg_admin wrappers for audit-packages and
download-vulnerability-list.
Move configuration parser into libinstall.
Add a new VERIFY_CMD to be used by pkg_add soon.
Avoid using SHA512_End. OpenSSL provides the other SHA512_* functions,
but not this one and mixing implementations results in very strange
errors.
Add support PKCS7 signatures in packages and pkg-vulnerabilities.
The support for non-native OpenSSL still needs to be done, e.g.
ensure static linkage for that. Documentation is essentially missing.
Add quick_pkg_match to decide whether a pattern can match a package at
all. Use it to speed up pkg_match and the audit-history backend.
This improves ``pkg_admin audit'' from 1.333s to 0.098s and
``pkg_admin audit php libpng'' from 0.034s to 0.029s on my laptop.
Fix a stupid comparision bug that resulted in the PKCS7 signature
covering the GPG signature as well, which is not intended.
Make the parser to decide what parts are the real content and what parts
are signatures more strict. This also allows us to later drop the GPG
signature if we want to.
Fix a segfault when no archive was found as the signature cookie is not
valid in that case.
Don't include signature stuff if the crypto support is not requested.
Separate standard and non-standard headers. Deal with err.h correctly.
Add variable to control how packages are installed.
VERIFIED_INSTALLATION supports:
never (default): print signature, but don't care about it.
always: check for valid signature, abort otherwise
trusted: ask for packages without valid signature
interactive: always ask before installation
Bring pkg_add man page somewhat in sync with reality.
Restore older (and somewhat bogus) behaviour of modifying the +CONTENTS
file when -p is given to pkg_add.
Define __UNCONST if needed.
Pass the simple part of the pattern as glob hint.
Make sure to close the archive when not all required files where found.
Consistently use the libnbcompat header for md5 if this is not a native
NetBSD build.
Merge license changes from the HEAD.
pkg_install-20080524:
Stop installation the pkg_view and linkform script as part of
pkg_install. They are the only remaining user of the pax dependency.
This was discussed was agc@ and the consensus is that if someone really
wants them, they should be pulled into a separate less essential
package.
Require libarchive 2.5.4b and fallback to internal version otherwise.