39 files changed, 214 insertions, 168 deletions
diff --git a/.gitignore b/.gitignore
index fb2bda6..40f76d0 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,12 +3,12 @@
 /nshd.service
 /nshd.sysusers
 
-/.gopath
-.var.*
-.tmp.*
 *.o
 *~
 parabola-keyring-*
 parabola-hackers-*
 
+.tmp.*
+.var.*
+
 /gitfiles.mk
diff --git a/.gitmodules b/.gitmodules
index 434287e..5b9a9ba 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -1,15 +1,15 @@
-[submodule        "go/gopkg.in/yaml.v2"]
-	path =     go/gopkg.in/yaml.v2
+[submodule    "go/src/gopkg.in/yaml.v2"]
+	path = go/src/gopkg.in/yaml.v2
 	url = https://gopkg.in/yaml.v2/
-[submodule        "go/git.lukeshu.com/go/libgnulinux"]
-	path =     go/git.lukeshu.com/go/libgnulinux
+[submodule    "go/src/git.lukeshu.com/go/libgnulinux"]
+	path = go/src/git.lukeshu.com/go/libgnulinux
 	url = https://git.lukeshu.com/go/libgnulinux/
-[submodule        "go/git.lukeshu.com/go/libnslcd"]
-	path =     go/git.lukeshu.com/go/libnslcd
+[submodule    "go/src/git.lukeshu.com/go/libnslcd"]
+	path = go/src/git.lukeshu.com/go/libnslcd
 	url = https://git.lukeshu.com/go/libnslcd/
-[submodule        "go/git.lukeshu.com/go/libsystemd"]
-	path =     go/git.lukeshu.com/go/libsystemd
+[submodule    "go/src/git.lukeshu.com/go/libsystemd"]
+	path = go/src/git.lukeshu.com/go/libsystemd
 	url = https://git.lukeshu.com/go/libsystemd/
-[submodule        "go/golang.org/x/sys"]
-	path =     go/golang.org/x/sys
+[submodule    "go/src/golang.org/x/sys"]
+	path = go/src/golang.org/x/sys
 	url = https://go.googlesource.com/sys
diff --git a/GNUmakefile b/GNUmakefile
index cc5a40d..8b86fb9 100644
--- a/GNUmakefile
+++ b/GNUmakefile
@@ -4,10 +4,9 @@
 # Most of the complexity is dancing around to avoid having any
 # possibly conflicting identifiers.
 
-MAKEFLAGS += --no-print-directory
 rest = $(wordlist 2,$(words $1),$1)
 target = $(or $(firstword $(MAKECMDGOALS)),default)
 $(or $(call rest,$(MAKECMDGOALS)),_$(target)): $(target)
 	@:
 $(target):
-	@+$(MAKE) -f Makefile --no-builtin-rules --no-builtin-variables $(MAKECMDGOALS)
+	@+$(MAKE) --no-print-directory -f Makefile --no-builtin-rules --no-builtin-variables $(MAKECMDGOALS)
diff --git a/LICENSE.bsd3.txt b/LICENSE.bsd3.txt
index 92d2b94..f33946f 120000
--- a/LICENSE.bsd3.txt
+++ b/LICENSE.bsd3.txt
@@ -1 +1 @@
-go/golang.org/x/sys/LICENSE
-\ No newline at end of file
+go/src/golang.org/x/sys/LICENSE
+\ No newline at end of file
diff --git a/LICENSE.txt b/LICENSE.txt
index 57a0df1..ac8d066 100644
--- a/LICENSE.txt
+++ b/LICENSE.txt
@@ -1,19 +1,16 @@
 The software in this repository is under a number of licenses:
 
- scripts/                                   GPL v2+
- src/nshd/                                  GPL v2+
- test/                                      LGPL v2.1+
+ bin/                                           GPL v2+
+ go/src/nshd/                                   GPL v2+
+ go/src/gopkg.in/yaml.v2                        LGPL v3, with linking exception
+ go/src/golang.org/x/sys/unix                   3-clause BSD license
+ go/src/git.lukeshu.com/go/libgnulinux/dl       GPL v2+, with documentation output clarification
+ go/src/git.lukeshu.com/go/libgnulinux/inotify  LGPL v2.1+
+ go/src/git.lukeshu.com/go/libgnulinux/getgr    LGPL v2.1+
+ go/src/git.lukeshu.com/go/libnslcd/            LGPL v2.1+
+ go/src/git.lukeshu.com/go/libsystemd/          Apache v2.0
 
- go/gopkg.in/yaml.v2                        LGPL v3, with linking exception
- go/golang.org/x/sys/unix                   3-clause BSD license
-
- go/git.lukeshu.com/go/libgnulinux/dl       GPL v2+, with documentation output clarification
- go/git.lukeshu.com/go/libgnulinux/inotify  LGPL v2.1+
- go/git.lukeshu.com/go/libgnulinux/getgr    LGPL v2.1+
- go/git.lukeshu.com/go/libnslcd/            LGPL v2.1+
- go/git.lukeshu.com/go/libsystemd/          Apache v2.0
-
- build-aux/                                 AGPL v3+
+ build-aux/                                     AGPL v3+
 
 The general notion is that the build system is AGPL (v3+), the core
 application is GPL (v2+), while supporting libraries that might be
@@ -26,4 +23,10 @@ exceptions:
  - The YAML and sys/unix libraries use other licenses because they are
    3rd-party libraries, and that's how the authors licensed them.
 
+The effective license of the 'nshd' program as a whole is GPL v3+; it
+links together code that is GPL v2+ with code that is Apache v2.0; the
+GPL v2 and Apache v2.0 are incompatible; while the GPL v3 (and
+presumably future versions) is compatible with Apache v2.0; so one is
+forced to take the "any later version" option on the GPL v2+ code.
+
 For more details, see each individual file.
diff --git a/Makefile b/Makefile
index 11b5c59..f1839b1 100644
--- a/Makefile
+++ b/Makefile
@@ -17,9 +17,12 @@ include config.mk
 include $(topsrcdir)/build-aux/Makefile.head.mk
 
 files.src.src := $(filter-out go/golang.org/x/sys/plan9/% go/golang.org/x/sys/windows/%,$(files.src.src))
-var = .var.
-programs = nshd nshd-setuid nshd-tester common.rb
-scripts = $(filter-out %.c %.o $(programs) common.rb common.rb.in,$(notdir $(wildcard $(srcdir)/bin/*)))
+
+bins_c      = nshd-setuid nshd-tester
+bins_go     = nshd
+bins_lib    = common.rb
+bins_script = $(filter-out %.c %.o %.in $(bins_c) $(bins_go) $(bins_lib),$(notdir $(wildcard $(srcdir)/bin/*)))
+bins = $(bins_c) $(bins_go) $(bins_lib) $(bins_script)
 
 .PHONY: FORCE
 .SECONDARY:
@@ -36,12 +39,6 @@ cgo_variables = CGO_ENABLED CGO_CFLAGS CGO_CPPFLAGS CGO_CXXFLAGS CGO_LDFLAGS CC
 $(foreach v,$(cgo_variables),$(eval $v ?=))
 export $(cgo_variables)
 
-$(outdir)/.gopath/src:
-	rm -rf -- $(@D)
-	mkdir $(@D)
-	ln -sr $(srcdir)/go $@
-	touch $@
-
 #
 # Generate (pre-tarball)
 
@@ -56,61 +53,53 @@ $(srcdir)/LICENSE.apache-2.0.txt: $(NET)
 $(srcdir)/LICENSE.wtfpl-2.txt: $(NET)
 	curl http://www.wtfpl.net/txt/copying/ > $@
 
-files.generate: go-generate
-go-generate: .gopath/src
-	+GOPATH=$(abspath $(outdir)/.gopath) go generate git.lukeshu.com/...
+$(outdir)/$(files.generate): go-generate
+go-generate:
+	+GOPATH=$(abspath $(srcdir)/go) go generate git.lukeshu.com/...
 .PHONY: go-generate
-files.src.int += .gopath/ .gopath/*
 at.targets += go-generate
 
 #
 # Build (post-tarball)
 
-files.out.all += $(addprefix bin/,$(programs)) nshd.service nshd.sysusers
-files.out.int += bin/*.o .gopath/ .gopath/* .tmp* .var*
+files.out.all += $(addprefix bin/,$(filter-out $(bins_script),$(bins))) nshd.service nshd.sysusers
+files.out.int += go/pkg/ go/bin/ go/bin/*
 
-# Dependencies
-$(outdir)/bin/nshd-setuid: -ldl
-$(outdir)/nshd.service: $(var)user $(var)bindir
-$(outdir)/nshd.sysusers: $(var)user
-$(outdir)/bin/common.rb: $(var)conf_file
-
-$(outdir)/.gopath/bin/cmd-nshd: \
-  $(outdir)/go/cmd-nshd/main.go \
-  $(outdir)/go/parabola_hackers/users.go \
-  $(outdir)/go/parabola_hackers/passwords.go
-$(outdir)/go/cmd-nshd/main.go: $(var)conf_file
-$(outdir)/go/parabola_hackers/users.go: $(var)bindir
-$(outdir)/go/parabola_hackers/passwords.go: $(var)shadow_file
-files.out.all += $(outdir)/go/cmd-nshd/main.go
-files.out.all += $(outdir)/go/parabola_hackers/users.go
-files.out.all += $(outdir)/go/parabola_hackers/passwords.go
-
-# Go: copy out of .gopath
-$(outdir)/bin/nshd: \
-$(outdir)/bin/%: $(outdir)/.gopath/bin/cmd-%
+# Go
+$(addprefix %/bin/,$(bins_go)): %/src
+	GOPATH=$(abspath $*) go install $(bins_go)
+$(outdir)/bin/%: $(outdir)/go/bin/%
 	cp -T $< $@
-# Go: compile+link
-$(outdir)/.gopath/bin/cmd-nshd: \
-$(outdir)/.gopath/bin/cmd-%: FORCE go-generate
-	GOPATH=$(abspath $(outdir)/.gopath) go install $(@F)
-
-# C: compile
-$(outdir)/%.o: $(srcdir)/%.c $(var)CC $(var)CPPFLAGS $(var)CFLAGS
-	$(CC) $(CPPFLAGS) $(CFLAGS) -c -o $@ $(filter-out $(var)%,$^)
-# C: link
-$(outdir)/bin/nshd-tester $(outdir)/bin/nshd-setuid: \
-$(outdir)/%: $(outdir)/%.o $(var)CC $(var)LDFLAGS
-	$(CC) $(LDFLAGS) -o $@ $(filter-out $(var)%,$^)
-
+# C
+$(outdir)/bin/%: $(srcdir)/bin/%.c $(var.)CC $(var.)CPPFLAGS $(var.)CFLAGS
+	$(CC) $(CPPFLAGS) $(CFLAGS) $(LDFLAGS) -o $@ $(filter-out $(var.)%,$^)
 # Basic variable substitution
 $(outdir)/%: $(srcdir)/%.in
-	< $< sed $(foreach v,$(patsubst $(var)%,%,$(filter $(var)%,$^)), -e 's|@$v@|$($v)|g' ) > $@
+	< $< sed $(foreach v,$(patsubst $(var.)%,%,$(filter $(var.)%,$^)), -e 's|@$v@|$($v)|g' ) > $@
+$(outdir)/bin/%: $(srcdir)/bin/%.in
+	< $< sed $(foreach v,$(patsubst $(var.)%,%,$(filter $(var.)%,$^)), -e 's|@$v@|$($v)|g' ) > $@
+
+# Dependencies
+$(outdir)/bin/nshd-setuid: -ldl
+$(outdir)/nshd.service: $(var.)user $(var.)bindir
+$(outdir)/nshd.sysusers: $(var.)user
+$(outdir)/bin/common.rb: $(var.)conf_file
+
+$(outdir)/go/src/nshd/main.go: $(var.)conf_file
+$(outdir)/go/src/nshd/nshd_files/users.go: $(var.)bindir
+$(outdir)/go/src/nshd/nshd_files/passwords.go: $(var.)shadow_file
+
+goconf = \
+  $(outdir)/go/src/nshd/main.go \
+  $(outdir)/go/src/nshd/nshd_files/users.go \
+  $(outdir)/go/src/nshd/nshd_files/passwords.go
+$(outdir)/go/bin/nshd: $(goconf) $(outdir)/$(files.generate)
+files.out.all += $(goconf)
 
 
 # Install
 
-files.sys.all += $(addprefix $(bindir)/,$(programs) $(scripts)) $(systemunitdir)/nshd.socket $(systemunitdir)/nshd.service $(sysusersdir)/nshd.conf $(conf_file) $(shadow_file)
+files.sys.all += $(addprefix $(bindir)/,$(bins)) $(systemunitdir)/nshd.socket $(systemunitdir)/nshd.service $(sysusersdir)/nshd.conf $(conf_file) $(shadow_file)
 
 $(DESTDIR)$(bindir)/%: $(outdir)/bin/%
 	$(NORMAL_INSTALL)
@@ -132,7 +121,7 @@ $(DESTDIR)$(bindir)/common.rb: $(srcdir)/bin/common.rb
 $(DESTDIR)$(conf_file): $(srcdir)/parabola-hackers.yml
 	$(NORMAL_INSTALL)
 	install -TDm644 $< $@
-$(DESTDIR)$(shadow_file): $(var)user $(DESTDIR)$(sysusersdir)/nshd.conf
+$(DESTDIR)$(shadow_file): $(var.)user $(DESTDIR)$(sysusersdir)/nshd.conf
 	$(NORMAL_INSTALL)
 	install -d $(@D)
 	touch $@
diff --git a/README.md b/README.md
index 132a7da..6e766a5 100644
--- a/README.md
+++ b/README.md
@@ -16,8 +16,10 @@ The most important 4 programs are:
 
 The others are:
 
- - `meta-normalize-stdio`: used by `meta-check`
  - `meta-cat`: used by `nshd`
+ - `meta-normalize-stdio`: used by `meta-check`
+ - `nshd-setuid`: used by `nshd`
+ - `nshd-tester`: used to test `nshd`
  - `pgp-list-keyids`: used by `pacman-make-keyring`
  - `uid-map`: used by `pacman-make-keyring`
 
@@ -95,7 +97,7 @@ Then enable and start `nshd.socket`:
     systemctl enable --now nshd.socket
 
 ----
-Copyright (C) 2014, 2016  Luke Shumaker
+Copyright (C) 2014, 2016-2017  Luke Shumaker
 
 This documentation file is placed into the public domain.  If that is
 not possible in your legal system, I grant you permission to use it in
diff --git a/build-aux/Makefile.README.mk b/build-aux/Makefile.README.mk
new file mode 100644
index 0000000..fe9010a
--- /dev/null
+++ b/build-aux/Makefile.README.mk
@@ -0,0 +1,20 @@
+# This Makefile is a minimal stub that exists to allow the
+# `at-modules` set of Make targets to print documentation for the
+# present Autothing modules.
+#
+# This file is part of the documentation for Autothing.
+#
+# Copyright (C) 2017  Luke Shumaker
+#
+# This documentation file is placed into the public domain.  If that
+# is not possible in your legal system, I grant you permission to use
+# it in absolutely every way that I can legally grant to you.
+
+dist.pkgname = autothing
+dist.version = 1.0
+gnuconf.pkgname = autothing
+
+topoutdir ?= .
+topsrcdir ?= .
+include $(topsrcdir)/build-aux/Makefile.head.mk
+include $(topsrcdir)/build-aux/Makefile.tail.mk
diff --git a/build-aux/Makefile.each.tail/00-var.mk b/build-aux/Makefile.each.tail/00-var.mk
index c2fd9d7..954defb 100644
--- a/build-aux/Makefile.each.tail/00-var.mk
+++ b/build-aux/Makefile.each.tail/00-var.mk
@@ -1,4 +1,4 @@
-# Copyright (C) 2016  Luke Shumaker
+# Copyright (C) 2016-2017  Luke Shumaker
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License as published by
@@ -13,10 +13,10 @@
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-mod.var.depends += quote write-ifchanged
+mod.var.depends += files quote write-ifchanged
 
 $(outdir)/.var.%: _var.FORCE
 	@printf '%s' $(call quote.shell,$($*)) | sed 's/^/#/' | $(WRITE_IFCHANGED) $@
 -include $(wildcard $(outdir)/.var.*)
 
-at.targets += $(addprefix $(outdir)/,.var.%)
+files.out.int += .var.*
diff --git a/build-aux/Makefile.each.tail/10-files.mk b/build-aux/Makefile.each.tail/10-files.mk
index 3bb3bc2..e22b216 100644
--- a/build-aux/Makefile.each.tail/10-files.mk
+++ b/build-aux/Makefile.each.tail/10-files.mk
@@ -1,4 +1,4 @@
-# Copyright (C) 2015-2016  Luke Shumaker
+# Copyright (C) 2015-2017  Luke Shumaker
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License as published by
@@ -37,21 +37,21 @@ $(eval \
     $$(outdir)/install-$(_files.g): $$(_files.sys.$(_files.g))$(at.nl)))
 
 # Destructive targets
-_files.uninstall   = $(_files.sys)
-_files.mostlyclean = $(filter-out $(_files.out.slow) $(_files.out.cfg),$(_files.out))
-_files.clean       = $(filter-out                    $(_files.out.cfg),$(_files.out))
-_files.distclean   =                                                   $(_files.out)
-$(addprefix $(outdir)/,uninstall mostlyclean clean distclean): %: %-hook
-	$(RM)    -- $(sort $(filter-out %/,$(_files.$(@F))))
-	$(RM) -r -- $(sort $(filter     %/,$(_files.$(@F))))
-	$(RMDIR_P) -- $(sort $(dir $(_files.$(@F))))
-_files.maintainer-clean   = $(filter-out $(_files.src.cfg) $(_files.src.src),$(_files.src))
-_files.$(files.vcsclean)  = $(filter-out                   $(_files.src.src),$(_files.src))
-$(addprefix $(outdir)/,maintainer-clean $(files.vcsclean)): $(outdir)/%: $(outdir)/distclean $(outdir)/%-hook
-	@echo 'This command is intended for maintainers to use; it'
-	@echo 'deletes files that may need special tools to rebuild.'
-	$(RM)    -- $(sort $(filter-out %/,$(_files.$(@F))))
-	$(RM) -r -- $(sort $(filter     %/,$(_files.$(@F))))
-	$(RMDIR_P) -- $(sort $(dir $(_files.$(@F))))
+#
+# We do our on $(srcdir) / $(outdir) prefixing here because
+# at.addprefix (while necessary for dependency lists) doesn't preserve
+# trailing slashes, which we care about here; while also not caring
+# about the path normalization that at.addprefix does.
+_files.uninstall   = $(addprefix $(DESTDIR),$(files.sys))
+_files.mostlyclean = $(addprefix $(srcdir)/,$(filter-out $(files.out.slow) $(files.out.cfg),$(files.out)))
+_files.clean       = $(addprefix $(srcdir)/,$(filter-out                   $(files.out.cfg),$(files.out)))
+_files.distclean   = $(addprefix $(srcdir)/,                                                $(files.out))
+_files.maintainer-clean  = $(files.distclean) $(addprefix $(srcdir)/,$(filter-out $(files.src.cfg) $(files.src.src),$(files.src)))
+_files.$(files.vcsclean) = $(files.distclean) $(addprefix $(srcdir)/,$(filter-out                  $(files.src.src),$(files.src)))
+$(addprefix $(outdir)/,uninstall mostlyclean clean distclean maintainer-clean $(files.vcsclean)): %: %-hook
+	$(call _files.XARGS,$(RM)    -- {},                                      $(sort $(filter-out %/,$(_files.$(@F)))) )
+	$(call _files.XARGS,$(RM) -r -- {},                                      $(sort $(filter     %/,$(_files.$(@F)))) )
+	$(call _files.XARGS,$(RMDIR_P) -- {} 2>/dev/null || true,$(filter-out ./,$(sort $(dir           $(_files.$(@F))))))
+$(addprefix $(outdir)/,maintainer-clean $(files.vcsclean)): _files.maintainer-clean-warning
 $(foreach t,uninstall mostlyclean clean distclean maintainer-clean $(files.vcsclean), $(outdir)/$t-hook)::
 .PHONY: $(foreach t,uninstall mostlyclean clean distclean maintainer-clean $(files.vcsclean), $(outdir)/$t-hook)
diff --git a/build-aux/Makefile.each.tail/10-nested.mk b/build-aux/Makefile.each.tail/10-nested.mk
index 5e5a40b..667ec6f 100644
--- a/build-aux/Makefile.each.tail/10-nested.mk
+++ b/build-aux/Makefile.each.tail/10-nested.mk
@@ -1,4 +1,4 @@
-# Copyright (C) 2016  Luke Shumaker
+# Copyright (C) 2016-2017  Luke Shumaker
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License as published by
@@ -18,3 +18,4 @@ $(eval $(foreach _tmp.nested,$(nested.targets),\
 .PHONY: $(addprefix $(outdir)/,$(nested.targets))
 
 at.subdirs += $(nested.subdirs)
+at.targets += $(addprefix $(outdir)/,$(nested.targets))
diff --git a/build-aux/Makefile.each.tail/11-texinfo.mk b/build-aux/Makefile.each.tail/11-texinfo.mk
index 9491820..1ee5843 100644
--- a/build-aux/Makefile.each.tail/11-texinfo.mk
+++ b/build-aux/Makefile.each.tail/11-texinfo.mk
@@ -26,10 +26,6 @@ files.sys.html += $(foreach f,$(texinfo.docs), $(htmldir)/$f.html )
 files.sys.pdf  += $(foreach f,$(texinfo.docs), $(pdfdir)/$f.pdf   )
 files.sys.ps   += $(foreach f,$(texinfo.docs), $(psdir)/$f.ps     )
 
-$(outdir)/install:
-	$(POST_INSTALL)
-	$(foreach f,$(texinfo.docs),$(INSTALL_INFO) $(DESTDIR)$(infodir)/$f.info $(DESTDIR)$(infodir)/dir$(at.nl))
-
 $(outdir)/%.info: $(srcdir)/%.texi; $(MAKEINFO)  -o $(@D) $<
 $(outdir)/%.info: $(outdir)/%.texi; $(MAKEINFO)  -o $(@D) $<
 $(outdir)/%.dvi : $(srcdir)/%.texi; $(TEXI2DVI)  -o $(@D) $<
diff --git a/build-aux/Makefile.head.mk b/build-aux/Makefile.head.mk
index f4eb51d..6ac3d49 100644
--- a/build-aux/Makefile.head.mk
+++ b/build-aux/Makefile.head.mk
@@ -32,17 +32,19 @@ _at.relbase = $(strip                                                   \
 _at.relto = $(strip                                                     \
   $(if $(call _at.is_subdir,$1,$2),                                     \
        $(patsubst %/.,%,$(patsubst $(abspath $1)/%,%,$(abspath $2)/.)), \
-       ../$(call _at.relto,$(dir $1),$2)))
+       ../$(call _at.relto,$(dir $(abspath $1)),$2)))
 
 # These 3 functions only take one operand; we define public multi-operand
 # versions below.
-_at.path = $(strip                                                            \
-  $(if $(call _at.is_subdir,$(topoutdir),$1),                                 \
-       $(patsubst %/.,%,$(topoutdir)/$(call _at.relto,.,$1)),                 \
-       $(if $(call _at.is_subdir,$(topsrcdir),$1),                            \
-            $(patsubst %/.,%,$(topsrcdir)/$(call _at.relto,$(topsrcdir),$1)), \
-            $(abspath $1))))
-_at.out2src = $(call _at.path,$(if $(call _at.is_subdir,$(topoutdir),$1),$(topsrcdir)/$(call _at.path,$1),$1))
+_at.path = $(strip $(or                                                                                         \
+  $(if $(call _at.is_subdir,      .     ,$1),                              $(call _at.relto,      .     ,$1) ), \
+  $(if $(call _at.is_subdir,$(topoutdir),$1),$(patsubst %/.,%,$(topoutdir)/$(call _at.relto,$(topoutdir),$1))), \
+  $(if $(call _at.is_subdir,$(topsrcdir),$1),$(patsubst %/.,%,$(topsrcdir)/$(call _at.relto,$(topsrcdir),$1))), \
+  $(abspath $1)))
+_at.out2src = $(call _at.path,$(strip                  \
+  $(if $(call _at.is_subdir,$(topoutdir),$1),          \
+       $(topsrcdir)/$(call _at.relto,$(topoutdir),$1), \
+       $1)))
 _at.addprefix = $(call _at.path,$(if $(filter-out /%,$2),$1/$2,$2))
 
 _at.rest = $(wordlist 2,$(words $1),$1)
@@ -103,9 +105,7 @@ ifeq ($(call _at.is_subdir,$(topoutdir),$(outdir)),)
 $(error Autothing: not a subdirectory of topoutdir=$(topoutdir): $(outdir))
 endif
 
-# Don't use at.out2src because we *know* that $(outdir) is inside $(topoutdir),
-# and has already had $(_at.path) called on it.
-srcdir := $(call _at.path,$(topsrcdir)/$(outdir))
+srcdir := $(call _at.out2src,$(outdir))
 ifeq ($(call _at.is_subdir,$(topsrcdir),$(srcdir)),)
 $(error Autothing: not a subdirectory of topsrcdir=$(topsrcdir): $(srcdir))
 endif
diff --git a/build-aux/Makefile.once.head/00-var.mk b/build-aux/Makefile.once.head/00-var.mk
index 1f50f21..7c9e6ff 100644
--- a/build-aux/Makefile.once.head/00-var.mk
+++ b/build-aux/Makefile.once.head/00-var.mk
@@ -1,4 +1,4 @@
-# Copyright (C) 2016  Luke Shumaker
+# Copyright (C) 2016-2017  Luke Shumaker
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License as published by
@@ -20,14 +20,17 @@ define mod.var.doc
 # Outputs:
 #   Target            : `$(outdir)/.var.%`
 #   Directory variable: `at.targets`
+#   Directory variable: `var.`
 #
 # It's a well-known secret that many files generated by a Makefile vary with
 # the values of particular variables, but that GNU Make can't track these
 # dependencies.  Well, with some cleverness, it actually can!
 #
 # With this module, to depend on the value of a variable, depend on
-# `$(outdir)/.var.VARNAME`.
+# `$(outdir)/.var.VARNAME`, or `$(var.)VARNAME` for short.
 endef
 mod.var.doc := $(value mod.var.doc)
 
+var. = $(patsubst ./%,%,$(outdir)/.var.)
+
 .PHONY: _var.FORCE
diff --git a/build-aux/Makefile.once.head/10-dist.mk b/build-aux/Makefile.once.head/10-dist.mk
index 27b39ec..3621195 100644
--- a/build-aux/Makefile.once.head/10-dist.mk
+++ b/build-aux/Makefile.once.head/10-dist.mk
@@ -1,4 +1,4 @@
-# Copyright (C) 2015-2016  Luke Shumaker
+# Copyright (C) 2015-2017  Luke Shumaker
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License as published by
@@ -50,6 +50,12 @@ define mod.dist.doc
 endef
 mod.dist.doc := $(value mod.dist.doc)
 
+PACKAGE_TARNAME ?=
+PACKAGE ?=
+PACKAGE_NAME ?=
+PACKAGE_VERSION ?=
+VERSION ?=
+
 # Developer configuration
 
 dist.exts ?= .tar.gz
diff --git a/build-aux/Makefile.once.head/10-files.mk b/build-aux/Makefile.once.head/10-files.mk
index f6fcf30..55c41cb 100644
--- a/build-aux/Makefile.once.head/10-files.mk
+++ b/build-aux/Makefile.once.head/10-files.mk
@@ -1,4 +1,4 @@
-# Copyright (C) 2015-2016  Luke Shumaker
+# Copyright (C) 2015-2017  Luke Shumaker
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License as published by
@@ -26,15 +26,15 @@ define mod.files.doc
 #   - Global variable    : `files.default  ?= all`
 #   - Global variable    : `files.vcsclean ?= files.vcsclean`
 #   - Global variable    : `files.generate ?= files.generate`
-#   - Directory variable : `files.src.src`
-#   - Directory variable : `files.src.int`
-#   - Directory variable : `files.src.cfg`
-#   - Directory variable : `files.src.gen`
-#   - Directory variable : `files.out.slow`
-#   - Directory variable : `files.out.int`
-#   - Directory variable : `files.out.cfg`
-#   - Directory variable : `files.out.$(files.groups)` (well, $(addprefix...))
-#   - Directory variable : `files.sys.$(files.groups)` (well, $(addprefix...))
+#   - Directory variable : `files.src.src`  # Sources
+#   - Directory variable : `files.src.int`  # Intermediates; deletable
+#   - Directory variable : `files.src.cfg`  # Outputs needed to run ./configure
+#   - Directory variable : `files.src.gen`  # Other outputs
+#   - Directory variable : `files.out.slow` # Things to exclude from `make mostlyclean`
+#   - Directory variable : `files.out.int`  # Intermediates
+#   - Directory variable : `files.out.cfg`  # Outputs created by ./configure
+#   - Directory variable : `files.out.$(group)` for `group` in `$(files.groups)`
+#   - Directory variable : `files.sys.$(group)` for `group` in `$(files.groups)`
 # Outputs:
 #   - Global variable    : `nested.targets`
 #   - Global variable    : `at.targets`
@@ -43,7 +43,7 @@ define mod.files.doc
 #   - Directory variable : `files.out`
 #   - Directory variable : `files.sys`
 #   - Creative .PHONY targets:
-#     - `$(outdir)/$(files.generate))`
+#     - `$(outdir)/$(files.generate)`
 #     - `$(outdir)/$(group)` for `group` in `$(files.groups)`
 #     - `$(outdir)/install`
 #     - `$(outdir)/install-$(group)` for `group` in `$(filter-out $(files.default),$(files.groups))`
@@ -59,6 +59,10 @@ define mod.files.doc
 # Basic `*` wildcards are supported.  Use `*`, not `%`; it will automatically
 # substitute `*`->`%` where appropriate.
 #
+# Each of the destructive targets depends on `$(target)-hook`, which
+# is defined to be a "double-colon rule" allowing you to add your own
+# code.
+#
 # TODO: prose documentation
 endef
 mod.files.doc := $(value mod.files.doc)
@@ -76,7 +80,7 @@ nested.targets += install installdirs
 nested.targets += $(foreach g,$(files.groups),$g)
 nested.targets += $(foreach g,$(filter-out $(files.default),$(files.groups)),install-$g install-$gdirs)
 # Standard destructive PHONY targets
-nested.targets += uninstall mostlyclean clean distclean maintainer-clean
+nested.targets += uninstall mostlyclean clean distclean maintainer-clean $(files.vcsclean)
 
 # User configuration
 
@@ -85,3 +89,12 @@ DESTDIR ?=
 RM      ?= rm -f
 RMDIR_P ?= rmdir -p --ignore-fail-on-non-empty
 TRUE    ?= true
+
+# Utility functions
+
+_files.XARGS = $(if $(strip $2),$(subst {},$(strip $2),$1))
+
+_files.maintainer-clean-warning:
+	@echo 'This command is intended for maintainers to use; it'
+	@echo 'deletes files that may need special tools to rebuild.'
+.PHONY: _files.maintainer-clean-warning
diff --git a/build-aux/Makefile.once.head/00-gitfiles.mk b/build-aux/Makefile.once.head/10-gitfiles.mk
index 8566a7f..8566a7f 100644
--- a/build-aux/Makefile.once.head/00-gitfiles.mk
+++ b/build-aux/Makefile.once.head/10-gitfiles.mk
diff --git a/build-aux/Makefile.once.head/10-gnuconf.mk b/build-aux/Makefile.once.head/10-gnuconf.mk
index e24dfa1..87baa14 100644
--- a/build-aux/Makefile.once.head/10-gnuconf.mk
+++ b/build-aux/Makefile.once.head/10-gnuconf.mk
@@ -30,6 +30,9 @@ define mod.gnuconf.doc
 endef
 mod.gnuconf.doc := $(value mod.gnuconf.doc)
 
+PACKAGE_TARNAME ?=
+PACKAGE ?=
+PACKAGE_NAME ?=
 gnuconf.pkgname ?= $(firstword $(PACKAGE_TARNAME) $(PACKAGE) $(PACKAGE_NAME))
 ifeq ($(gnuconf.pkgname),)
 $(error Autothing module: gnuconf: gnuconf.pkgname must be set)
diff --git a/build-aux/Makefile.once.head/10-nested.mk b/build-aux/Makefile.once.head/10-nested.mk
index 4f181a9..d903d53 100644
--- a/build-aux/Makefile.once.head/10-nested.mk
+++ b/build-aux/Makefile.once.head/10-nested.mk
@@ -1,4 +1,4 @@
-# Copyright (C) 2016  Luke Shumaker
+# Copyright (C) 2016-2017  Luke Shumaker
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License as published by
@@ -21,6 +21,7 @@ define mod.nested.doc
 # Outputs:
 #   - .PHONY Targets     : `$(addprefix $(outdir)/,$(nested.targets))`
 #   - Variable           : `at.subdirs`
+#   - Variable           : `at.targets`
 #
 # The Autothing `at.subdirs` slates a subdirectory's Makefile for inclusion,
 # but doesn't help with recursive targets like `all`, `install`, or `clean`,
diff --git a/build-aux/Makefile.once.head/10-texinfo.mk b/build-aux/Makefile.once.head/10-texinfo.mk
index aac2c28..d24852d 100644
--- a/build-aux/Makefile.once.head/10-texinfo.mk
+++ b/build-aux/Makefile.once.head/10-texinfo.mk
@@ -29,17 +29,13 @@ define mod.texinfo.doc
 #   - Directory variable : `files.out.{dvi,html,pdf,ps}`
 #   - Directory variable : `files.sys.{dvi,html,pdf,ps,all}`
 #   - .PHONY target      : `$(outdir)/info`
-#   - .PHONY target      : `$(outdir)/install` (see below)
 #   - Target             : `$(outdir)/%.info`
 #   - Target             : `$(outdir)/%.dvi`
 #   - target             : `$(outdir)/%.html`
 #   - target             : `$(outdir)/%.pdf`
 #   - Target             : `$(outdir)/%.ps`
 #
-# The module counts on the `$(outdir)/install` target being defined by
-# `files`, but not having a rule that executes once the dependencies
-# have been taken care of; it adds a "post-install" rule to add the
-# info files to the index.
+# TODO: prose documentation
 endef
 mod.texinfo.doc := $(value mod.texinfo.doc)
 
diff --git a/go/.gitignore b/go/.gitignore
new file mode 100644
index 0000000..4c48abf
--- /dev/null
+++ b/go/.gitignore
@@ -0,0 +1,2 @@
+/pkg/
+/bin/
diff --git a/go/git.lukeshu.com/go/libgnulinux b/go/src/git.lukeshu.com/go/libgnulinux
-Subproject b2bae3c73817740b48a4698c6aa863d70234a64
+Subproject b2bae3c73817740b48a4698c6aa863d70234a64
diff --git a/go/git.lukeshu.com/go/libnslcd b/go/src/git.lukeshu.com/go/libnslcd
-Subproject 939ef442f33dadf17f60ebf9f0c1fbaaa27f0c6
+Subproject 939ef442f33dadf17f60ebf9f0c1fbaaa27f0c6
diff --git a/go/git.lukeshu.com/go/libsystemd b/go/src/git.lukeshu.com/go/libsystemd
-Subproject 3f19c1f98bd00eda75d1f547dc5f484cd32db6b
+Subproject 3f19c1f98bd00eda75d1f547dc5f484cd32db6b
diff --git a/go/golang.org/x/sys b/go/src/golang.org/x/sys
-Subproject d75a52659825e75fff6158388dddc6a5b04f9ba
+Subproject d75a52659825e75fff6158388dddc6a5b04f9ba
diff --git a/go/gopkg.in/yaml.v2 b/go/src/gopkg.in/yaml.v2
-Subproject f7716cbe52baa25d2e9b0d0da546fcf909fc16b
+Subproject f7716cbe52baa25d2e9b0d0da546fcf909fc16b
diff --git a/go/cmd-nshd/.gitignore b/go/src/nshd/.gitignore
index 00870e2..00870e2 100644
--- a/go/cmd-nshd/.gitignore
+++ b/go/src/nshd/.gitignore
diff --git a/go/cmd-nshd/main.go.in b/go/src/nshd/main.go.in
index 260f553..5564128 100644
--- a/go/cmd-nshd/main.go.in
+++ b/go/src/nshd/main.go.in
@@ -20,13 +20,13 @@ package main
 
 import (
 	"os"
-	hackers_nslcd_backend "parabola_hackers/nslcd_backend"
+	"nshd/nslcd_backend"
 
 	"git.lukeshu.com/go/libnslcd/nslcd_systemd"
 )
 
 func main() {
-	backend := &hackers_nslcd_backend.Hackers{
+	backend := &nslcd_backend.Hackers{
 		CfgFilename: "@conf_file@",
 	}
 	os.Exit(int(nslcd_systemd.Main(backend)))
diff --git a/go/parabola_hackers/.gitignore b/go/src/nshd/nshd_files/.gitignore
index 3be3f08..3be3f08 100644
--- a/go/parabola_hackers/.gitignore
+++ b/go/src/nshd/nshd_files/.gitignore
diff --git a/go/parabola_hackers/passwords.go.in b/go/src/nshd/nshd_files/passwords.go.in
index 7065eb1..679f7c0 100644
--- a/go/parabola_hackers/passwords.go.in
+++ b/go/src/nshd/nshd_files/passwords.go.in
@@ -14,7 +14,7 @@
 // License along with this manual; if not, see
 // <http://www.gnu.org/licenses/>.
 
-package parabola_hackers
+package nshd_files
 
 import (
 	"fmt"
diff --git a/go/parabola_hackers/users.go.in b/go/src/nshd/nshd_files/users.go.in
index 3a307be..51703fd 100644
--- a/go/parabola_hackers/users.go.in
+++ b/go/src/nshd/nshd_files/users.go.in
@@ -14,12 +14,14 @@
 // License along with this manual; if not, see
 // <http://www.gnu.org/licenses/>.
 
-package parabola_hackers
+package nshd_files
 
 import (
 	"fmt"
 	"os/exec"
 
+	"nshd/util"
+
 	yaml "gopkg.in/yaml.v2"
 	p "git.lukeshu.com/go/libnslcd/nslcd_proto"
 	"git.lukeshu.com/go/libsystemd/sd_daemon"
@@ -126,7 +128,7 @@ func parseUser(_data interface{}) (ret User, err error) {
 				}
 			}
 			if !e {
-				ret.Groups = Set2list(groups)
+				ret.Groups = util.Set2list(groups)
 			}
 		}
 	}
diff --git a/go/parabola_hackers/nslcd_backend/db_config.go b/go/src/nshd/nslcd_backend/db_config.go
index 556aa76..d00bf02 100644
--- a/go/parabola_hackers/nslcd_backend/db_config.go
+++ b/go/src/nshd/nslcd_backend/db_config.go
@@ -14,7 +14,7 @@
 // License along with this manual; if not, see
 // <http://www.gnu.org/licenses/>.
 
-package hackers_nslcd_backend
+package nslcd_backend
 
 import (
 	p "git.lukeshu.com/go/libnslcd/nslcd_proto"
diff --git a/go/parabola_hackers/nslcd_backend/db_group.go b/go/src/nshd/nslcd_backend/db_group.go
index 41f049e..04c7e3b 100644
--- a/go/parabola_hackers/nslcd_backend/db_group.go
+++ b/go/src/nshd/nslcd_backend/db_group.go
@@ -14,10 +14,10 @@
 // License along with this manual; if not, see
 // <http://www.gnu.org/licenses/>.
 
-package hackers_nslcd_backend
+package nslcd_backend
 
 import (
-	"parabola_hackers"
+	"nshd/util"
 
 	p "git.lukeshu.com/go/libnslcd/nslcd_proto"
 	s "golang.org/x/sys/unix"
@@ -34,7 +34,7 @@ func (o *Hackers) groupByName(name string, users bool) p.Group {
 	}
 	var members_list []string
 	if users {
-		members_list = parabola_hackers.Set2list(members_set)
+		members_list = util.Set2list(members_set)
 	} else {
 		members_list = make([]string, 0)
 	}
@@ -57,7 +57,7 @@ func (o *Hackers) groupByGid(gid int32, users bool) p.Group {
 	}
 	var members_list []string
 	if users {
-		members_list = parabola_hackers.Set2list(members_set)
+		members_list = util.Set2list(members_set)
 	} else {
 		members_list = make([]string, 0)
 	}
diff --git a/go/parabola_hackers/nslcd_backend/db_pam.go b/go/src/nshd/nslcd_backend/db_pam.go
index 0538e70..b704620 100644
--- a/go/parabola_hackers/nslcd_backend/db_pam.go
+++ b/go/src/nshd/nslcd_backend/db_pam.go
@@ -14,12 +14,14 @@
 // License along with this manual; if not, see
 // <http://www.gnu.org/licenses/>.
 
-package hackers_nslcd_backend
+package nslcd_backend
 
 import (
 	"fmt"
 	"os"
-	"parabola_hackers"
+
+	"nshd/util"
+	"nshd/nshd_files"
 
 	s "golang.org/x/sys/unix"
 	p "git.lukeshu.com/go/libnslcd/nslcd_proto"
@@ -35,7 +37,7 @@ func checkPassword(password string, hash string) bool {
 func hashPassword(newPassword string, oldHash string) string {
 	salt := oldHash
 	if salt == "!" {
-		str, err := parabola_hackers.RandomString(crypt.SaltAlphabet, 8)
+		str, err := util.RandomString(crypt.SaltAlphabet, 8)
 		if err != nil {
 			sd_daemon.Log.Err("Could not generate a random string")
 			str = ""
@@ -118,7 +120,7 @@ func (o *Hackers) PAM_SessionOpen(cred s.Ucred, req p.Request_PAM_SessionOpen) <
 	go func() {
 		defer close(ret)
 
-		sessionid, err := parabola_hackers.RandomString(alphabet, 24)
+		sessionid, err := util.RandomString(alphabet, 24)
 		if err != nil {
 			return
 		}
@@ -185,7 +187,7 @@ func (o *Hackers) PAM_PwMod(cred s.Ucred, req p.Request_PAM_PwMod) <-chan p.PAM_
 			passwords[ouser.Passwd.Name] = ouser.Passwd.PwHash
 		}
 		passwords[user.Passwd.Name] = user.Passwd.PwHash
-		err := parabola_hackers.SaveAllPasswords(passwords)
+		err := nshd_files.SaveAllPasswords(passwords)
 		if err != nil {
 			sd_daemon.Log.Err(fmt.Sprintf("Writing passwords to disk: %v", err))
 			return
diff --git a/go/parabola_hackers/nslcd_backend/db_passwd.go b/go/src/nshd/nslcd_backend/db_passwd.go
index c5faf5c..ace127e 100644
--- a/go/parabola_hackers/nslcd_backend/db_passwd.go
+++ b/go/src/nshd/nslcd_backend/db_passwd.go
@@ -14,7 +14,7 @@
 // License along with this manual; if not, see
 // <http://www.gnu.org/licenses/>.
 
-package hackers_nslcd_backend
+package nslcd_backend
 
 import (
 	p "git.lukeshu.com/go/libnslcd/nslcd_proto"
@@ -24,9 +24,16 @@ import (
 /* Note that the output password hash value should be one of:
    <empty> - no password set, allow login without password
    !       - used to prevent logins
-   x       - "valid" encrypted password that does not match any valid password
-             often used to indicate that the password is defined elsewhere
-   other   - encrypted password, in crypt(3) format */
+   x       - "valid" encrypted password that does not match any valid
+             password often used to indicate that the password is
+             defined elsewhere (i.e., in the shadow database)
+   other   - encrypted password, in crypt(3) format
+
+   A "!" prefix on a password hash "locks" the account; therefore a a
+   hash of "!" says "no login"; while a hash of "x" says "you may log
+   in", but fails to authorize; passing the buck to the next database.
+
+  */
 
 func (o *Hackers) Passwd_ByName(cred s.Ucred, req p.Request_Passwd_ByName) <-chan p.Passwd {
 	o.lock.RLock()
diff --git a/go/parabola_hackers/nslcd_backend/db_shadow.go b/go/src/nshd/nslcd_backend/db_shadow.go
index 58b13ec..ab1d68f 100644
--- a/go/parabola_hackers/nslcd_backend/db_shadow.go
+++ b/go/src/nshd/nslcd_backend/db_shadow.go
@@ -14,7 +14,7 @@
 // License along with this manual; if not, see
 // <http://www.gnu.org/licenses/>.
 
-package hackers_nslcd_backend
+package nslcd_backend
 
 import (
 	p "git.lukeshu.com/go/libnslcd/nslcd_proto"
diff --git a/go/parabola_hackers/nslcd_backend/hackers.go b/go/src/nshd/nslcd_backend/hackers.go
index 9cff815..44107b2 100644
--- a/go/parabola_hackers/nslcd_backend/hackers.go
+++ b/go/src/nshd/nslcd_backend/hackers.go
@@ -14,15 +14,16 @@
 // License along with this manual; if not, see
 // <http://www.gnu.org/licenses/>.
 
-// Package hackers_nslcd_backend is an nslcd_server Backend that
+// Package nslcd_backend is an nslcd_server Backend that
 // speaks to hackers.git.
-package hackers_nslcd_backend
+package nslcd_backend
 
 import (
 	"fmt"
-	"parabola_hackers"
 	"sync"
 
+	"nshd/nshd_files"
+
 	"git.lukeshu.com/go/libnslcd/nslcd_server"
 	"git.lukeshu.com/go/libnslcd/nslcd_systemd"
 	"git.lukeshu.com/go/libsystemd/sd_daemon"
@@ -39,7 +40,7 @@ type Hackers struct {
 	CfgFilename string
 
 	cfg    config
-	users  map[int32]parabola_hackers.User
+	users  map[int32]nshd_files.User
 	groups map[string]map[string]bool
 }
 
@@ -61,7 +62,7 @@ func (o *Hackers) Close() {
 	o.lock.Lock()
 	defer o.lock.Unlock()
 
-	o.users = make(map[int32]parabola_hackers.User, 0)
+	o.users = make(map[int32]nshd_files.User, 0)
 	o.groups = make(map[string]map[string]bool)
 }
 
@@ -78,12 +79,12 @@ func (o *Hackers) Reload() error {
 	sd_daemon.Log.Info(fmt.Sprintf("hackers.git: pam_password_prohibit_message: %#v", o.cfg.Pam_password_prohibit_message))
 
 	sd_daemon.Log.Debug("hackers.git: Parsing user data")
-	o.users, err = parabola_hackers.LoadAllUsers()
+	o.users, err = nshd_files.LoadAllUsers()
 	if err != nil {
 		return err
 	}
 
-	passwords, err := parabola_hackers.LoadAllPasswords()
+	passwords, err := nshd_files.LoadAllPasswords()
 	if err != nil {
 		return err
 	}
diff --git a/go/parabola_hackers/nslcd_backend/util.go b/go/src/nshd/nslcd_backend/util.go
index a3b2b5d..aa29b03 100644
--- a/go/parabola_hackers/nslcd_backend/util.go
+++ b/go/src/nshd/nslcd_backend/util.go
@@ -14,7 +14,7 @@
 // License along with this manual; if not, see
 // <http://www.gnu.org/licenses/>.
 
-package hackers_nslcd_backend
+package nslcd_backend
 
 import (
 	"io/ioutil"
diff --git a/go/parabola_hackers/util.go b/go/src/nshd/util/util.go
index 9a241db..4d3fd57 100644
--- a/go/parabola_hackers/util.go
+++ b/go/src/nshd/util/util.go
@@ -14,7 +14,7 @@
 // License along with this manual; if not, see
 // <http://www.gnu.org/licenses/>.
 
-package parabola_hackers
+package util
 
 import (
 	"crypto/rand"