> I am not sure, if it would be a good idea to have two diffs:
> - one with the security patches in
> - one without, as there are people who follow the cert lists a bit.

I don't think so.

My personal opinion: If you patch your source tree, you take
responsiblity for making it work (including making future patches
apply cleanly to it).

Were I keeping a local source tree for 1.3.x, and applying local
patches, i'd do something like:

	cvs import the 1.3 sources

	apply patches on the trunk

	try to cvs import the 1.3.1 sources, discover there wasn't a
	complete set, send hate-mail off to the NetBSD developers.

	import the 1.3.2 sources

	merge with the previous vendor branch import (i.e. to merge
	patches, etc.)


I can't address your other concerns, though (e.g. the missing
files(?)), since i've not as much as looked at the patch.  8-)


cgd