20 files changed, 66 insertions, 58 deletions
diff --git a/doc/index.html b/doc/index.html
index 9ba1daf..c3d74dc 100644
--- a/doc/index.html
+++ b/doc/index.html
@@ -44,7 +44,7 @@ compiled with IPv6 support, s6-networking is IPv6-ready.
  <li> A POSIX-compliant system with a standard C development environment </li>
  <li> GNU make, version 3.81 or later </li>
  <li> <a href="http://skarnet.org/software/skalibs/">skalibs</a> version
-2.4.0.1 or later. It's a build-time requirement. It's also a run-time
+2.4.0.2 or later. It's a build-time requirement. It's also a run-time
 requirement if you link against the shared version of the skalibs
 library. </li>
  <li> <a href="http://skarnet.org/software/execline/">execline</a> version
diff --git a/doc/upgrade.html b/doc/upgrade.html
index b2cfe21..dfd90f0 100644
--- a/doc/upgrade.html
+++ b/doc/upgrade.html
@@ -21,7 +21,7 @@
 <h2> in 2.2.1.0 </h2>
 
 <ul>
- <li> skalibs dependency bumped to 2.4.0.1. </li>
+ <li> skalibs dependency bumped to 2.4.0.2. </li>
  <li> SSL/TLS support added:
   <ul>
    <li> <a href="s6-tlsclient.html">s6-tlsclient</a> </li>
diff --git a/package/deps.mak b/package/deps.mak
index a92c30e..88054c1 100644
--- a/package/deps.mak
+++ b/package/deps.mak
@@ -2,7 +2,7 @@
 # This file has been generated by tools/gen-deps.sh
 #
 
-src/include/s6-networking/s6net.h: src/include/s6-networking/ident.h src/include/s6-networking/s6net-utils.h
+src/include/s6-networking/s6net.h: src/include/s6-networking/ident.h
 src/sbearssl/sbearssl-internal.h: src/include/s6-networking/sbearssl.h
 src/clock/s6-clockadd.o src/clock/s6-clockadd.lo: src/clock/s6-clockadd.c
 src/clock/s6-clockview.o src/clock/s6-clockview.lo: src/clock/s6-clockview.c
@@ -24,7 +24,6 @@ src/conn-tools/s6-tlsc.o src/conn-tools/s6-tlsc.lo: src/conn-tools/s6-tlsc.c src
 src/conn-tools/s6-tlsclient.o src/conn-tools/s6-tlsclient.lo: src/conn-tools/s6-tlsclient.c src/include/s6-networking/config.h
 src/conn-tools/s6-tlsd.o src/conn-tools/s6-tlsd.lo: src/conn-tools/s6-tlsd.c src/include/s6-networking/config.h src/include/s6-networking/sbearssl.h src/include/s6-networking/stls.h
 src/conn-tools/s6-tlsserver.o src/conn-tools/s6-tlsserver.lo: src/conn-tools/s6-tlsserver.c src/include/s6-networking/config.h
-src/libs6net/s6net_clean_tls_and_spawn.o src/libs6net/s6net_clean_tls_and_spawn.lo: src/libs6net/s6net_clean_tls_and_spawn.c src/include/s6-networking/s6net-utils.h
 src/libs6net/s6net_ident_client.o src/libs6net/s6net_ident_client.lo: src/libs6net/s6net_ident_client.c src/include/s6-networking/ident.h
 src/libs6net/s6net_ident_error.o src/libs6net/s6net_ident_error.lo: src/libs6net/s6net_ident_error.c src/include/s6-networking/ident.h
 src/libs6net/s6net_ident_reply_get.o src/libs6net/s6net_ident_reply_get.lo: src/libs6net/s6net_ident_reply_get.c src/include/s6-networking/ident.h
@@ -37,6 +36,7 @@ src/sbearssl/sbearssl_cert_from.o src/sbearssl/sbearssl_cert_from.lo: src/sbears
 src/sbearssl/sbearssl_cert_readbigpem.o src/sbearssl/sbearssl_cert_readbigpem.lo: src/sbearssl/sbearssl_cert_readbigpem.c src/include/s6-networking/sbearssl.h
 src/sbearssl/sbearssl_cert_readfile.o src/sbearssl/sbearssl_cert_readfile.lo: src/sbearssl/sbearssl_cert_readfile.c src/include/s6-networking/sbearssl.h
 src/sbearssl/sbearssl_cert_to.o src/sbearssl/sbearssl_cert_to.lo: src/sbearssl/sbearssl_cert_to.c src/include/s6-networking/sbearssl.h
+src/sbearssl/sbearssl_clean_tls_and_spawn.o src/sbearssl/sbearssl_clean_tls_and_spawn.lo: src/sbearssl/sbearssl_clean_tls_and_spawn.c src/sbearssl/sbearssl-internal.h
 src/sbearssl/sbearssl_ec_issuer_keytype.o src/sbearssl/sbearssl_ec_issuer_keytype.lo: src/sbearssl/sbearssl_ec_issuer_keytype.c src/include/s6-networking/sbearssl.h src/sbearssl/sbearssl-internal.h
 src/sbearssl/sbearssl_ec_pkey_from.o src/sbearssl/sbearssl_ec_pkey_from.lo: src/sbearssl/sbearssl_ec_pkey_from.c src/include/s6-networking/sbearssl.h
 src/sbearssl/sbearssl_ec_pkey_to.o src/sbearssl/sbearssl_ec_pkey_to.lo: src/sbearssl/sbearssl_ec_pkey_to.c src/include/s6-networking/sbearssl.h
@@ -54,8 +54,8 @@ src/sbearssl/sbearssl_rsa_pkey_to.o src/sbearssl/sbearssl_rsa_pkey_to.lo: src/sb
 src/sbearssl/sbearssl_rsa_skey_from.o src/sbearssl/sbearssl_rsa_skey_from.lo: src/sbearssl/sbearssl_rsa_skey_from.c src/include/s6-networking/sbearssl.h
 src/sbearssl/sbearssl_rsa_skey_to.o src/sbearssl/sbearssl_rsa_skey_to.lo: src/sbearssl/sbearssl_rsa_skey_to.c src/include/s6-networking/sbearssl.h
 src/sbearssl/sbearssl_run.o src/sbearssl/sbearssl_run.lo: src/sbearssl/sbearssl_run.c src/include/s6-networking/sbearssl.h
-src/sbearssl/sbearssl_s6tlsc.o src/sbearssl/sbearssl_s6tlsc.lo: src/sbearssl/sbearssl_s6tlsc.c src/include/s6-networking/s6net-utils.h src/include/s6-networking/sbearssl.h
-src/sbearssl/sbearssl_s6tlsd.o src/sbearssl/sbearssl_s6tlsd.lo: src/sbearssl/sbearssl_s6tlsd.c src/include/s6-networking/s6net-utils.h src/include/s6-networking/sbearssl.h
+src/sbearssl/sbearssl_s6tlsc.o src/sbearssl/sbearssl_s6tlsc.lo: src/sbearssl/sbearssl_s6tlsc.c src/include/s6-networking/sbearssl.h
+src/sbearssl/sbearssl_s6tlsd.o src/sbearssl/sbearssl_s6tlsd.lo: src/sbearssl/sbearssl_s6tlsd.c src/include/s6-networking/sbearssl.h
 src/sbearssl/sbearssl_skey_from.o src/sbearssl/sbearssl_skey_from.lo: src/sbearssl/sbearssl_skey_from.c src/include/s6-networking/sbearssl.h
 src/sbearssl/sbearssl_skey_readfile.o src/sbearssl/sbearssl_skey_readfile.lo: src/sbearssl/sbearssl_skey_readfile.c src/include/s6-networking/sbearssl.h
 src/sbearssl/sbearssl_skey_to.o src/sbearssl/sbearssl_skey_to.lo: src/sbearssl/sbearssl_skey_to.c src/include/s6-networking/sbearssl.h
@@ -66,9 +66,10 @@ src/sbearssl/sbearssl_ta_readdir.o src/sbearssl/sbearssl_ta_readdir.lo: src/sbea
 src/sbearssl/sbearssl_ta_readfile.o src/sbearssl/sbearssl_ta_readfile.lo: src/sbearssl/sbearssl_ta_readfile.c src/include/s6-networking/sbearssl.h
 src/sbearssl/sbearssl_ta_to.o src/sbearssl/sbearssl_ta_to.lo: src/sbearssl/sbearssl_ta_to.c src/include/s6-networking/sbearssl.h
 src/sbearssl/sbearssl_x509_minimal_set_tai.o src/sbearssl/sbearssl_x509_minimal_set_tai.lo: src/sbearssl/sbearssl_x509_minimal_set_tai.c src/include/s6-networking/sbearssl.h
+src/stls/stls_clean_tls_and_spawn.o src/stls/stls_clean_tls_and_spawn.lo: src/stls/stls_clean_tls_and_spawn.c src/stls/stls-internal.h
 src/stls/stls_run.o src/stls/stls_run.lo: src/stls/stls_run.c src/include/s6-networking/stls.h
-src/stls/stls_s6tlsc.o src/stls/stls_s6tlsc.lo: src/stls/stls_s6tlsc.c src/include/s6-networking/s6net-utils.h src/include/s6-networking/stls.h
-src/stls/stls_s6tlsd.o src/stls/stls_s6tlsd.lo: src/stls/stls_s6tlsd.c src/include/s6-networking/s6net-utils.h src/include/s6-networking/stls.h
+src/stls/stls_s6tlsc.o src/stls/stls_s6tlsc.lo: src/stls/stls_s6tlsc.c src/include/s6-networking/stls.h src/stls/stls-internal.h
+src/stls/stls_s6tlsd.o src/stls/stls_s6tlsd.lo: src/stls/stls_s6tlsd.c src/include/s6-networking/stls.h src/stls/stls-internal.h
 
 s6-clockadd: EXTRA_LIBS := ${SYSCLOCK_LIB}
 s6-clockadd: src/clock/s6-clockadd.o -lskarnet
@@ -102,22 +103,22 @@ s6-tcpserver6-socketbinder: EXTRA_LIBS := ${SOCKET_LIB}
 s6-tcpserver6-socketbinder: src/conn-tools/s6-tcpserver6-socketbinder.o -lskarnet
 s6-tcpserver6d: EXTRA_LIBS := ${SOCKET_LIB}
 s6-tcpserver6d: src/conn-tools/s6-tcpserver6d.o -lskarnet
-s6-tlsc: EXTRA_LIBS := ${CRYPTO_LIB} ${SOCKET_LIB} ${TAINNOW_LIB}
-s6-tlsc: src/conn-tools/s6-tlsc.o ${LIBCRYPTOSUPPORT} ${LIBS6NET} -lskarnet
+s6-tlsc: EXTRA_LIBS := ${CRYPTO_LIB} ${SOCKET_LIB} ${SPAWN_LIB} ${TAINNOW_LIB}
+s6-tlsc: src/conn-tools/s6-tlsc.o ${LIBCRYPTOSUPPORT} -lskarnet
 s6-tlsclient: EXTRA_LIBS :=
 s6-tlsclient: src/conn-tools/s6-tlsclient.o -lskarnet
-s6-tlsd: EXTRA_LIBS := ${CRYPTO_LIB} ${SOCKET_LIB} ${TAINNOW_LIB}
-s6-tlsd: src/conn-tools/s6-tlsd.o ${LIBCRYPTOSUPPORT} ${LIBS6NET} -lskarnet
+s6-tlsd: EXTRA_LIBS := ${CRYPTO_LIB} ${SOCKET_LIB} ${SPAWN_LIB} ${TAINNOW_LIB}
+s6-tlsd: src/conn-tools/s6-tlsd.o ${LIBCRYPTOSUPPORT} -lskarnet
 s6-tlsserver: EXTRA_LIBS :=
 s6-tlsserver: src/conn-tools/s6-tlsserver.o -lskarnet
-libs6net.a.xyzzy: src/libs6net/s6net_ident_client.o src/libs6net/s6net_ident_reply_get.o src/libs6net/s6net_ident_reply_parse.o src/libs6net/s6net_ident_error.o src/libs6net/s6net_clean_tls_and_spawn.o
+libs6net.a.xyzzy: src/libs6net/s6net_ident_client.o src/libs6net/s6net_ident_reply_get.o src/libs6net/s6net_ident_reply_parse.o src/libs6net/s6net_ident_error.o
 libs6net.so.xyzzy: EXTRA_LIBS := -lskarnet
-libs6net.so.xyzzy: src/libs6net/s6net_ident_client.lo src/libs6net/s6net_ident_reply_get.lo src/libs6net/s6net_ident_reply_parse.lo src/libs6net/s6net_ident_error.lo src/libs6net/s6net_clean_tls_and_spawn.lo
+libs6net.so.xyzzy: src/libs6net/s6net_ident_client.lo src/libs6net/s6net_ident_reply_get.lo src/libs6net/s6net_ident_reply_parse.lo src/libs6net/s6net_ident_error.lo
 minidentd: EXTRA_LIBS := ${SOCKET_LIB} ${TAINNOW_LIB}
 minidentd: src/minidentd/minidentd.o src/minidentd/mgetuid.o -lskarnet
-libsbearssl.a.xyzzy: src/sbearssl/sbearssl_append.o src/sbearssl/sbearssl_cert_from.o src/sbearssl/sbearssl_cert_readbigpem.o src/sbearssl/sbearssl_cert_readfile.o src/sbearssl/sbearssl_cert_to.o src/sbearssl/sbearssl_ec_issuer_keytype.o src/sbearssl/sbearssl_ec_pkey_from.o src/sbearssl/sbearssl_ec_pkey_to.o src/sbearssl/sbearssl_ec_skey_from.o src/sbearssl/sbearssl_ec_skey_to.o src/sbearssl/sbearssl_error_str.o src/sbearssl/sbearssl_isder.o src/sbearssl/sbearssl_pem_decode_from_buffer.o src/sbearssl/sbearssl_pem_decode_from_string.o src/sbearssl/sbearssl_pem_push.o src/sbearssl/sbearssl_pkey_from.o src/sbearssl/sbearssl_pkey_to.o src/sbearssl/sbearssl_rsa_pkey_from.o src/sbearssl/sbearssl_rsa_pkey_to.o src/sbearssl/sbearssl_rsa_skey_from.o src/sbearssl/sbearssl_rsa_skey_to.o src/sbearssl/sbearssl_run.o src/sbearssl/sbearssl_skey_from.o src/sbearssl/sbearssl_skey_readfile.o src/sbearssl/sbearssl_skey_to.o src/sbearssl/sbearssl_ta_cert.o src/sbearssl/sbearssl_ta_certs.o src/sbearssl/sbearssl_ta_from.o src/sbearssl/sbearssl_ta_readdir.o src/sbearssl/sbearssl_ta_readfile.o src/sbearssl/sbearssl_ta_to.o src/sbearssl/sbearssl_x509_minimal_set_tai.o src/sbearssl/sbearssl_s6tlsc.o src/sbearssl/sbearssl_s6tlsd.o
-libsbearssl.so.xyzzy: EXTRA_LIBS := -lbearssl -ls6net -lskarnet
-libsbearssl.so.xyzzy: src/sbearssl/sbearssl_append.lo src/sbearssl/sbearssl_cert_from.lo src/sbearssl/sbearssl_cert_readbigpem.lo src/sbearssl/sbearssl_cert_readfile.lo src/sbearssl/sbearssl_cert_to.lo src/sbearssl/sbearssl_ec_issuer_keytype.lo src/sbearssl/sbearssl_ec_pkey_from.lo src/sbearssl/sbearssl_ec_pkey_to.lo src/sbearssl/sbearssl_ec_skey_from.lo src/sbearssl/sbearssl_ec_skey_to.lo src/sbearssl/sbearssl_error_str.lo src/sbearssl/sbearssl_isder.lo src/sbearssl/sbearssl_pem_decode_from_buffer.lo src/sbearssl/sbearssl_pem_decode_from_string.lo src/sbearssl/sbearssl_pem_push.lo src/sbearssl/sbearssl_pkey_from.lo src/sbearssl/sbearssl_pkey_to.lo src/sbearssl/sbearssl_rsa_pkey_from.lo src/sbearssl/sbearssl_rsa_pkey_to.lo src/sbearssl/sbearssl_rsa_skey_from.lo src/sbearssl/sbearssl_rsa_skey_to.lo src/sbearssl/sbearssl_run.lo src/sbearssl/sbearssl_skey_from.lo src/sbearssl/sbearssl_skey_readfile.lo src/sbearssl/sbearssl_skey_to.lo src/sbearssl/sbearssl_ta_cert.lo src/sbearssl/sbearssl_ta_certs.lo src/sbearssl/sbearssl_ta_from.lo src/sbearssl/sbearssl_ta_readdir.lo src/sbearssl/sbearssl_ta_readfile.lo src/sbearssl/sbearssl_ta_to.lo src/sbearssl/sbearssl_x509_minimal_set_tai.lo src/sbearssl/sbearssl_s6tlsc.lo src/sbearssl/sbearssl_s6tlsd.lo
-libstls.a.xyzzy: src/stls/stls_run.o src/stls/stls_s6tlsc.o src/stls/stls_s6tlsd.o
-libstls.so.xyzzy: EXTRA_LIBS := -ltls -ls6net -lskarnet
-libstls.so.xyzzy: src/stls/stls_run.lo src/stls/stls_s6tlsc.lo src/stls/stls_s6tlsd.lo
+libsbearssl.a.xyzzy: src/sbearssl/sbearssl_append.o src/sbearssl/sbearssl_clean_tls_and_spawn.o src/sbearssl/sbearssl_cert_from.o src/sbearssl/sbearssl_cert_readbigpem.o src/sbearssl/sbearssl_cert_readfile.o src/sbearssl/sbearssl_cert_to.o src/sbearssl/sbearssl_ec_issuer_keytype.o src/sbearssl/sbearssl_ec_pkey_from.o src/sbearssl/sbearssl_ec_pkey_to.o src/sbearssl/sbearssl_ec_skey_from.o src/sbearssl/sbearssl_ec_skey_to.o src/sbearssl/sbearssl_error_str.o src/sbearssl/sbearssl_isder.o src/sbearssl/sbearssl_pem_decode_from_buffer.o src/sbearssl/sbearssl_pem_decode_from_string.o src/sbearssl/sbearssl_pem_push.o src/sbearssl/sbearssl_pkey_from.o src/sbearssl/sbearssl_pkey_to.o src/sbearssl/sbearssl_rsa_pkey_from.o src/sbearssl/sbearssl_rsa_pkey_to.o src/sbearssl/sbearssl_rsa_skey_from.o src/sbearssl/sbearssl_rsa_skey_to.o src/sbearssl/sbearssl_run.o src/sbearssl/sbearssl_skey_from.o src/sbearssl/sbearssl_skey_readfile.o src/sbearssl/sbearssl_skey_to.o src/sbearssl/sbearssl_ta_cert.o src/sbearssl/sbearssl_ta_certs.o src/sbearssl/sbearssl_ta_from.o src/sbearssl/sbearssl_ta_readdir.o src/sbearssl/sbearssl_ta_readfile.o src/sbearssl/sbearssl_ta_to.o src/sbearssl/sbearssl_x509_minimal_set_tai.o src/sbearssl/sbearssl_s6tlsc.o src/sbearssl/sbearssl_s6tlsd.o
+libsbearssl.so.xyzzy: EXTRA_LIBS := -lbearssl -lskarnet
+libsbearssl.so.xyzzy: src/sbearssl/sbearssl_append.lo src/sbearssl/sbearssl_clean_tls_and_spawn.lo src/sbearssl/sbearssl_cert_from.lo src/sbearssl/sbearssl_cert_readbigpem.lo src/sbearssl/sbearssl_cert_readfile.lo src/sbearssl/sbearssl_cert_to.lo src/sbearssl/sbearssl_ec_issuer_keytype.lo src/sbearssl/sbearssl_ec_pkey_from.lo src/sbearssl/sbearssl_ec_pkey_to.lo src/sbearssl/sbearssl_ec_skey_from.lo src/sbearssl/sbearssl_ec_skey_to.lo src/sbearssl/sbearssl_error_str.lo src/sbearssl/sbearssl_isder.lo src/sbearssl/sbearssl_pem_decode_from_buffer.lo src/sbearssl/sbearssl_pem_decode_from_string.lo src/sbearssl/sbearssl_pem_push.lo src/sbearssl/sbearssl_pkey_from.lo src/sbearssl/sbearssl_pkey_to.lo src/sbearssl/sbearssl_rsa_pkey_from.lo src/sbearssl/sbearssl_rsa_pkey_to.lo src/sbearssl/sbearssl_rsa_skey_from.lo src/sbearssl/sbearssl_rsa_skey_to.lo src/sbearssl/sbearssl_run.lo src/sbearssl/sbearssl_skey_from.lo src/sbearssl/sbearssl_skey_readfile.lo src/sbearssl/sbearssl_skey_to.lo src/sbearssl/sbearssl_ta_cert.lo src/sbearssl/sbearssl_ta_certs.lo src/sbearssl/sbearssl_ta_from.lo src/sbearssl/sbearssl_ta_readdir.lo src/sbearssl/sbearssl_ta_readfile.lo src/sbearssl/sbearssl_ta_to.lo src/sbearssl/sbearssl_x509_minimal_set_tai.lo src/sbearssl/sbearssl_s6tlsc.lo src/sbearssl/sbearssl_s6tlsd.lo
+libstls.a.xyzzy: src/stls/stls_clean_tls_and_spawn.o src/stls/stls_run.o src/stls/stls_s6tlsc.o src/stls/stls_s6tlsd.o
+libstls.so.xyzzy: EXTRA_LIBS := -ltls -lskarnet
+libstls.so.xyzzy: src/stls/stls_clean_tls_and_spawn.lo src/stls/stls_run.lo src/stls/stls_s6tlsc.lo src/stls/stls_s6tlsd.lo
diff --git a/src/conn-tools/deps-exe/s6-tlsc b/src/conn-tools/deps-exe/s6-tlsc
index 953d34f..60671be 100644
--- a/src/conn-tools/deps-exe/s6-tlsc
+++ b/src/conn-tools/deps-exe/s6-tlsc
@@ -1,5 +1,4 @@
 ${LIBCRYPTOSUPPORT}
-${LIBS6NET}
 -lskarnet
 ${CRYPTO_LIB}
 ${SOCKET_LIB}
diff --git a/src/conn-tools/deps-exe/s6-tlsd b/src/conn-tools/deps-exe/s6-tlsd
index 953d34f..60671be 100644
--- a/src/conn-tools/deps-exe/s6-tlsd
+++ b/src/conn-tools/deps-exe/s6-tlsd
@@ -1,5 +1,4 @@
 ${LIBCRYPTOSUPPORT}
-${LIBS6NET}
 -lskarnet
 ${CRYPTO_LIB}
 ${SOCKET_LIB}
diff --git a/src/include/s6-networking/s6net-utils.h b/src/include/s6-networking/s6net-utils.h
deleted file mode 100644
index 2e7d2f9..0000000
--- a/src/include/s6-networking/s6net-utils.h
+++ /dev/null
@@ -1,10 +0,0 @@
-/* ISC license. */
-
-#ifndef S6NET_UTILS_H
-#define S6NET_UTILS_H
-
-#include <sys/types.h>
-
-extern pid_t s6net_clean_tls_and_spawn (char const *const *, char const *const *, int *, uint32_t) ;
-
-#endif
diff --git a/src/include/s6-networking/s6net.h b/src/include/s6-networking/s6net.h
index fef4ef7..8778527 100644
--- a/src/include/s6-networking/s6net.h
+++ b/src/include/s6-networking/s6net.h
@@ -4,6 +4,5 @@
 #define S6NET_H
 
 #include <s6-networking/ident.h>
-#include <s6-networking/s6net-utils.h>
 
 #endif
diff --git a/src/include/s6-networking/stls.h b/src/include/s6-networking/stls.h
index dff3bcf..dbb55fe 100644
--- a/src/include/s6-networking/stls.h
+++ b/src/include/s6-networking/stls.h
@@ -1,7 +1,7 @@
 /* ISC license. */
 
-#ifndef STLS_INTERNAL_H
-#define STLS_INTERNAL_H
+#ifndef STLS_H
+#define STLS_H
 
 #include <sys/types.h>
 #include <tls.h>
diff --git a/src/libs6net/deps-lib/s6net b/src/libs6net/deps-lib/s6net
index b8be843..27067c4 100644
--- a/src/libs6net/deps-lib/s6net
+++ b/src/libs6net/deps-lib/s6net
@@ -2,5 +2,4 @@ s6net_ident_client.o
 s6net_ident_reply_get.o
 s6net_ident_reply_parse.o
 s6net_ident_error.o
-s6net_clean_tls_and_spawn.o
 -lskarnet
diff --git a/src/sbearssl/deps-lib/sbearssl b/src/sbearssl/deps-lib/sbearssl
index d5964e6..b3e69bb 100644
--- a/src/sbearssl/deps-lib/sbearssl
+++ b/src/sbearssl/deps-lib/sbearssl
@@ -1,4 +1,5 @@
 sbearssl_append.o
+sbearssl_clean_tls_and_spawn.o
 sbearssl_cert_from.o
 sbearssl_cert_readbigpem.o
 sbearssl_cert_readfile.o
@@ -33,5 +34,4 @@ sbearssl_x509_minimal_set_tai.o
 sbearssl_s6tlsc.o
 sbearssl_s6tlsd.o
 -lbearssl
--ls6net
 -lskarnet
diff --git a/src/sbearssl/sbearssl-internal.h b/src/sbearssl/sbearssl-internal.h
index eee3b84..ac5e4e2 100644
--- a/src/sbearssl/sbearssl-internal.h
+++ b/src/sbearssl/sbearssl-internal.h
@@ -18,5 +18,6 @@ struct sbearssl_strallocerr_s
 
 extern void sbearssl_append (void *, void const *, size_t) ;
 extern int sbearssl_pem_push (br_pem_decoder_context *, char const *, size_t, sbearssl_pemobject *, genalloc *, sbearssl_strallocerr *, int *) ;
+extern pid_t sbearssl_clean_tls_and_spawn (char const *const *, char const *const *, int *, uint32_t) ;
 
 #endif
diff --git a/src/libs6net/s6net_clean_tls_and_spawn.c b/src/sbearssl/sbearssl_clean_tls_and_spawn.c
index 67ba79b..258db90 100644
--- a/src/libs6net/s6net_clean_tls_and_spawn.c
+++ b/src/sbearssl/sbearssl_clean_tls_and_spawn.c
@@ -3,9 +3,9 @@
 #include <sys/types.h>
 #include <skalibs/env.h>
 #include <skalibs/djbunix.h>
-#include <s6-networking/s6net-utils.h>
+#include "sbearssl-internal.h"
 
-pid_t s6net_clean_tls_and_spawn (char const *const *argv, char const *const *envp, int *fds, uint32_t options)
+pid_t sbearssl_clean_tls_and_spawn (char const *const *argv, char const *const *envp, int *fds, uint32_t options)
 {
   if (!(options & 1)) return child_spawn2(argv[0], argv, envp, fds) ;
   else
diff --git a/src/sbearssl/sbearssl_s6tlsc.c b/src/sbearssl/sbearssl_s6tlsc.c
index f20f293..598774a 100644
--- a/src/sbearssl/sbearssl_s6tlsc.c
+++ b/src/sbearssl/sbearssl_s6tlsc.c
@@ -11,7 +11,6 @@
 #include <skalibs/genalloc.h>
 #include <skalibs/djbunix.h>
 #include <skalibs/random.h>
-#include <s6-networking/s6net-utils.h>
 #include <s6-networking/sbearssl.h>
 
 int sbearssl_s6tlsc (char const *const *argv, char const *const *envp, tain_t const *tto, uint32_t preoptions, uint32_t options, uid_t uid, gid_t gid, unsigned int verbosity, char const *servername, int *sfd)
@@ -67,7 +66,7 @@ int sbearssl_s6tlsc (char const *const *argv, char const *const *envp, tain_t co
     br_ssl_engine_inject_entropy(&cc.eng, buf, 32) ;
     random_finish() ;
 
-    pid = s6net_clean_tls_and_spawn(argv, envp, fds, !!(preoptions & 2)) ;
+    pid = sbearssl_clean_tls_and_spawn(argv, envp, fds, !!(preoptions & 2)) ;
     if (gid && setgid(gid) < 0) strerr_diefu1sys(111, "setgid") ;
     if (uid && setuid(uid) < 0) strerr_diefu1sys(111, "setuid") ;
 
diff --git a/src/sbearssl/sbearssl_s6tlsd.c b/src/sbearssl/sbearssl_s6tlsd.c
index 2cb3d21..aa32ed1 100644
--- a/src/sbearssl/sbearssl_s6tlsd.c
+++ b/src/sbearssl/sbearssl_s6tlsd.c
@@ -11,7 +11,6 @@
 #include <skalibs/genalloc.h>
 #include <skalibs/djbunix.h>
 #include <skalibs/random.h>
-#include <s6-networking/s6net-utils.h>
 #include <s6-networking/sbearssl.h>
 
 int sbearssl_s6tlsd (char const *const *argv, char const *const *envp, tain_t const *tto, uint32_t preoptions, uint32_t options, uid_t uid, gid_t gid, unsigned int verbosity)
diff --git a/src/stls/deps-lib/stls b/src/stls/deps-lib/stls
index f215998..03cebfa 100644
--- a/src/stls/deps-lib/stls
+++ b/src/stls/deps-lib/stls
@@ -1,6 +1,6 @@
+stls_clean_tls_and_spawn.o
 stls_run.o
 stls_s6tlsc.o
 stls_s6tlsd.o
 -ltls
--ls6net
 -lskarnet
diff --git a/src/stls/stls-internal.h b/src/stls/stls-internal.h
new file mode 100644
index 0000000..85fc825
--- /dev/null
+++ b/src/stls/stls-internal.h
@@ -0,0 +1,10 @@
+/* ISC license. */
+
+#ifndef STLS_INTERNAL_H
+#define STLS_INTERNAL_H
+
+#include <sys/types.h>
+
+extern pid_t stls_clean_tls_and_spawn (char const *const *, char const *const *, int *, uint32_t) ;
+
+#endif
diff --git a/src/stls/stls_clean_tls_and_spawn.c b/src/stls/stls_clean_tls_and_spawn.c
new file mode 100644
index 0000000..37ea619
--- /dev/null
+++ b/src/stls/stls_clean_tls_and_spawn.c
@@ -0,0 +1,21 @@
+/* ISC license. */
+
+#include <sys/types.h>
+#include <skalibs/env.h>
+#include <skalibs/djbunix.h>
+#include "stls-internal.h"
+
+pid_t stls_clean_tls_and_spawn (char const *const *argv, char const *const *envp, int *fds, uint32_t options)
+{
+  if (!(options & 1)) return child_spawn2(argv[0], argv, envp, fds) ;
+  else
+  {
+    char const modifs[] = "CADIR\0CAFILE\0KEYFILE\0CERTFILE\0TLS_UID\0TLS_GID" ;
+    size_t modiflen = sizeof(modifs) ;
+    size_t n = env_len(envp) ;
+    char const *newenv[n + 7] ;
+    size_t newenvlen = env_merge(newenv, n+7, envp, n, modifs, modiflen) ;
+    if (!newenvlen) return 0 ;
+    return child_spawn2(argv[0], argv, newenv, fds) ;
+  }
+}
diff --git a/src/stls/stls_s6tlsc.c b/src/stls/stls_s6tlsc.c
index bafc2b8..9c30b60 100644
--- a/src/stls/stls_s6tlsc.c
+++ b/src/stls/stls_s6tlsc.c
@@ -8,21 +8,12 @@
 #include <skalibs/tai.h>
 #include <skalibs/env.h>
 #include <skalibs/djbunix.h>
-#include <s6-networking/s6net-utils.h>
 #include <s6-networking/stls.h>
+#include "stls-internal.h"
 
 #define diecfg(cfg, s) strerr_diefu3x(96, (s), ": ", tls_config_error(cfg))
 #define diectx(e, ctx, s) strerr_diefu3x(e, (s), ": ", tls_error(ctx))
 
-#ifdef DEBUG
-# include <skalibs/buffer.h>
-# include <skalibs/strerr2.h>
-# include <skalibs/lolstdio.h>
-# define PLM(...) (bprintf(buffer_2, "%s: debug: ", PROG), bprintf(buffer_2, __VA_ARGS__), buffer_putflush(buffer_2, "\n", 1))
-#else
-# define PLM(...)
-#endif
-
 int stls_s6tlsc (char const *const *argv, char const *const *envp, tain_t const *tto, uint32_t preoptions, uint32_t options, uid_t uid, gid_t gid, unsigned int verbosity, char const *servername, int *sfd)
 {
   int fds[4] = { sfd[0], sfd[1], sfd[0], sfd[1] } ;
@@ -83,7 +74,7 @@ int stls_s6tlsc (char const *const *argv, char const *const *envp, tain_t const
   if (!ctx) strerr_diefu1sys(111, "tls_client") ;
   if (tls_configure(ctx, cfg) < 0) diectx(97, ctx, "tls_configure") ;
 
-  pid = s6net_clean_tls_and_spawn(argv, envp, fds, !!(preoptions & 2)) ;
+  pid = stls_clean_tls_and_spawn(argv, envp, fds, !!(preoptions & 2)) ;
   if (!pid) strerr_diefu2sys(111, "spawn ", argv[0]) ;
   if (gid && setgid(gid) < 0) strerr_diefu1sys(111, "setgid") ;
   if (uid && setuid(uid) < 0) strerr_diefu1sys(111, "setuid") ;
diff --git a/src/stls/stls_s6tlsd.c b/src/stls/stls_s6tlsd.c
index 64cf01f..0e82ab0 100644
--- a/src/stls/stls_s6tlsd.c
+++ b/src/stls/stls_s6tlsd.c
@@ -8,8 +8,8 @@
 #include <skalibs/tai.h>
 #include <skalibs/env.h>
 #include <skalibs/djbunix.h>
-#include <s6-networking/s6net-utils.h>
 #include <s6-networking/stls.h>
+#include "stls-internal.h"
 
 #define diecfg(cfg, s) strerr_diefu3x(96, (s), ": ", tls_config_error(cfg))
 #define diectx(e, ctx, s) strerr_diefu3x(e, (s), ": ", tls_error(ctx))
@@ -71,7 +71,7 @@ int stls_s6tlsd (char const *const *argv, char const *const *envp, tain_t const
   if (tls_configure(ctx, cfg) < 0) diectx(97, ctx, "tls_configure") ;
   tls_config_free(cfg) ;
 
-  pid = s6net_clean_tls_and_spawn(argv, envp, fds, !!(preoptions & 2)) ;
+  pid = stls_clean_tls_and_spawn(argv, envp, fds, !!(preoptions & 2)) ;
   if (!pid) strerr_diefu2sys(111, "spawn ", argv[0]) ;
   if (gid && setgid(gid) < 0) strerr_diefu1sys(111, "setgid") ;
   if (uid && setuid(uid) < 0) strerr_diefu1sys(111, "setuid") ;
diff --git a/tools/gen-deps.sh b/tools/gen-deps.sh
index 5c96dd1..4eb487e 100755
--- a/tools/gen-deps.sh
+++ b/tools/gen-deps.sh
@@ -59,7 +59,7 @@ for dir in $(ls -1 src | grep -v ^include) ; do
     deps=
     libs=
     while read dep ; do
-      if echo $dep | grep -q -e ^-l -e '^\${.*_LIB}' ; then
+      if echo $dep | grep -q -e ^-l -e '^\${LIB.*}$' -e '^\${.*_LIB}$' ; then
         libs="$libs $dep"
       else
         deps="$deps src/$dir/$dep"
@@ -77,7 +77,7 @@ for dir in $(ls -1 src | grep -v ^include) ; do
       if echo $dep | grep -q -- \\.o$ ; then
         dep="src/$dir/$dep"
       fi
-      if echo $dep | grep -q -- '^\${.*_LIB}' ; then
+      if echo $dep | grep -q -- '^\${.*_LIB}$' ; then
         libs="$libs $dep"
       else
         deps="$deps $dep"