From: Ondřej Surý <ondrej@isc.org>
Date: Mon, 9 Mar 2020 15:17:26 +0000 (+0100)
Subject: Use the new sorting rules to regroup #include headers
X-Git-Tag: v9.17.1~63^2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=3178974f0c1d0c395808a75676199eea1f25ddc2;p=thirdparty%2Fbind9.git

Use the new sorting rules to regroup #include headers
---

diff --git a/bin/check/named-checkconf.c b/bin/check/named-checkconf.c
index ae3da7514e2..a503c37086e 100644
--- a/bin/check/named-checkconf.c
+++ b/bin/check/named-checkconf.c
@@ -38,10 +38,10 @@
 #include <isccfg/grammar.h>
 #include <isccfg/namedconf.h>
 
-#include "check-tool.h"
-
 #include <bind9/check.h>
 
+#include "check-tool.h"
+
 static const char *program = "named-checkconf";
 
 static bool loadplugins = true;
diff --git a/bin/confgen/ddns-confgen.c b/bin/confgen/ddns-confgen.c
index 427924ea367..ac3e3d068a4 100644
--- a/bin/confgen/ddns-confgen.c
+++ b/bin/confgen/ddns-confgen.c
@@ -42,11 +42,12 @@
 #include <dns/name.h>
 #include <dns/result.h>
 
-#include "keygen.h"
-#include "util.h"
+#include <dst/dst.h>
 
 #include <confgen/os.h>
-#include <dst/dst.h>
+
+#include "keygen.h"
+#include "util.h"
 
 #define KEYGEN_DEFAULT	"tsig-key"
 #define CONFGEN_DEFAULT "ddns-key"
diff --git a/bin/confgen/keygen.c b/bin/confgen/keygen.c
index 3ad4e57a9a4..35d850fae00 100644
--- a/bin/confgen/keygen.c
+++ b/bin/confgen/keygen.c
@@ -12,7 +12,6 @@
 /*! \file */
 
 #include "keygen.h"
-
 #include <stdarg.h>
 #include <stdlib.h>
 
@@ -24,14 +23,16 @@
 #include <isc/result.h>
 #include <isc/string.h>
 
+#include <pk11/site.h>
+
 #include <dns/keyvalues.h>
 #include <dns/name.h>
 
-#include "util.h"
+#include <dst/dst.h>
 
 #include <confgen/os.h>
-#include <dst/dst.h>
-#include <pk11/site.h>
+
+#include "util.h"
 
 /*%
  * Convert algorithm type to string.
diff --git a/bin/confgen/rndc-confgen.c b/bin/confgen/rndc-confgen.c
index 980e3432665..90a1d7e9997 100644
--- a/bin/confgen/rndc-confgen.c
+++ b/bin/confgen/rndc-confgen.c
@@ -37,15 +37,17 @@
 #include <isc/time.h>
 #include <isc/util.h>
 
+#include <pk11/site.h>
+
 #include <dns/keyvalues.h>
 #include <dns/name.h>
 
-#include "keygen.h"
-#include "util.h"
+#include <dst/dst.h>
 
 #include <confgen/os.h>
-#include <dst/dst.h>
-#include <pk11/site.h>
+
+#include "keygen.h"
+#include "util.h"
 
 #define DEFAULT_KEYNAME "rndc-key"
 #define DEFAULT_SERVER	"127.0.0.1"
diff --git a/bin/confgen/unix/os.c b/bin/confgen/unix/os.c
index 4af6234b69b..0975b5c83ba 100644
--- a/bin/confgen/unix/os.c
+++ b/bin/confgen/unix/os.c
@@ -15,11 +15,11 @@
 #include <fcntl.h>
 #include <pwd.h>
 #include <stdio.h>
+#include <sys/stat.h>
+#include <sys/types.h>
 #include <unistd.h>
 
 #include <confgen/os.h>
-#include <sys/stat.h>
-#include <sys/types.h>
 
 int
 set_user(FILE *fd, const char *user) {
diff --git a/bin/confgen/util.c b/bin/confgen/util.c
index a6dc649e33a..f76015fa57c 100644
--- a/bin/confgen/util.c
+++ b/bin/confgen/util.c
@@ -12,7 +12,6 @@
 /*! \file */
 
 #include "util.h"
-
 #include <stdarg.h>
 #include <stdbool.h>
 #include <stdio.h>
diff --git a/bin/confgen/win32/os.c b/bin/confgen/win32/os.c
index 582475d00a7..59f12194367 100644
--- a/bin/confgen/win32/os.c
+++ b/bin/confgen/win32/os.c
@@ -13,11 +13,11 @@
 #include <fcntl.h>
 #include <io.h>
 #include <stdio.h>
+#include <sys/stat.h>
+#include <sys/types.h>
 #include <unistd.h>
 
 #include <confgen/os.h>
-#include <sys/stat.h>
-#include <sys/types.h>
 
 int
 set_user(FILE *fd, const char *user) {
diff --git a/bin/delv/delv.c b/bin/delv/delv.c
index a9b49f9d652..c4bdbb4b3a8 100644
--- a/bin/delv/delv.c
+++ b/bin/delv/delv.c
@@ -12,11 +12,10 @@
 #include <bind.keys.h>
 
 #ifndef WIN32
-#include <netdb.h>
-#include <signal.h>
-
 #include <arpa/inet.h>
+#include <netdb.h>
 #include <netinet/in.h>
+#include <signal.h>
 #include <sys/socket.h>
 #include <sys/types.h>
 #endif /* ifndef WIN32 */
@@ -66,11 +65,12 @@
 #include <dns/secalg.h>
 #include <dns/view.h>
 
+#include <dst/dst.h>
+#include <dst/result.h>
+
 #include <isccfg/log.h>
 #include <isccfg/namedconf.h>
 
-#include <dst/dst.h>
-#include <dst/result.h>
 #include <irs/netdb.h>
 #include <irs/resconf.h>
 
diff --git a/bin/dig/dig.c b/bin/dig/dig.c
index 81570094039..92c0f826c72 100644
--- a/bin/dig/dig.c
+++ b/bin/dig/dig.c
@@ -26,6 +26,8 @@
 #include <isc/task.h>
 #include <isc/util.h>
 
+#include <pk11/site.h>
+
 #include <dns/byaddr.h>
 #include <dns/fixedname.h>
 #include <dns/masterdump.h>
@@ -40,7 +42,6 @@
 #include <dns/tsig.h>
 
 #include <dig/dig.h>
-#include <pk11/site.h>
 
 #define ADD_STRING(b, s)                                          \
 	{                                                         \
diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
index e578168488d..168365fe595 100644
--- a/bin/dig/dighost.c
+++ b/bin/dig/dighost.c
@@ -57,6 +57,8 @@
 #include <isc/types.h>
 #include <isc/util.h>
 
+#include <pk11/site.h>
+
 #include <dns/byaddr.h>
 #include <dns/fixedname.h>
 #include <dns/log.h>
@@ -72,14 +74,16 @@
 #include <dns/result.h>
 #include <dns/tsig.h>
 
+#include <dst/dst.h>
+#include <dst/result.h>
+
 #include <isccfg/namedconf.h>
 
+#include <irs/resconf.h>
+
 #include <bind9/getaddresses.h>
+
 #include <dig/dig.h>
-#include <dst/dst.h>
-#include <dst/result.h>
-#include <irs/resconf.h>
-#include <pk11/site.h>
 
 #if USE_PKCS11
 #include <pk11/result.h>
diff --git a/bin/dnssec/dnssec-keyfromlabel.c b/bin/dnssec/dnssec-keyfromlabel.c
index 915d61db247..3d2d24eae8f 100644
--- a/bin/dnssec/dnssec-keyfromlabel.c
+++ b/bin/dnssec/dnssec-keyfromlabel.c
@@ -24,6 +24,8 @@
 #include <isc/string.h>
 #include <isc/util.h>
 
+#include <pk11/site.h>
+
 #include <dns/dnssec.h>
 #include <dns/fixedname.h>
 #include <dns/keyvalues.h>
@@ -34,7 +36,6 @@
 #include <dns/secalg.h>
 
 #include <dst/dst.h>
-#include <pk11/site.h>
 
 #if USE_PKCS11
 #include <pk11/result.h>
diff --git a/bin/dnssec/dnssec-keygen.c b/bin/dnssec/dnssec-keygen.c
index f765c1fb31c..36724bec963 100644
--- a/bin/dnssec/dnssec-keygen.c
+++ b/bin/dnssec/dnssec-keygen.c
@@ -39,6 +39,8 @@
 #include <isc/string.h>
 #include <isc/util.h>
 
+#include <pk11/site.h>
+
 #include <dns/dnssec.h>
 #include <dns/fixedname.h>
 #include <dns/kasp.h>
@@ -49,14 +51,13 @@
 #include <dns/result.h>
 #include <dns/secalg.h>
 
+#include <dst/dst.h>
+
 #include <isccfg/cfg.h>
 #include <isccfg/grammar.h>
 #include <isccfg/kaspconf.h>
 #include <isccfg/namedconf.h>
 
-#include <dst/dst.h>
-#include <pk11/site.h>
-
 #if USE_PKCS11
 #include <pk11/result.h>
 #endif /* if USE_PKCS11 */
diff --git a/bin/named/config.c b/bin/named/config.c
index 85bad357168..b452262ee1e 100644
--- a/bin/named/config.c
+++ b/bin/named/config.c
@@ -25,6 +25,8 @@
 #include <isc/string.h>
 #include <isc/util.h>
 
+#include <pk11/site.h>
+
 #include <dns/fixedname.h>
 #include <dns/name.h>
 #include <dns/rdataclass.h>
@@ -32,13 +34,13 @@
 #include <dns/tsig.h>
 #include <dns/zone.h>
 
+#include <dst/dst.h>
+
 #include <isccfg/grammar.h>
 #include <isccfg/namedconf.h>
 
-#include <dst/dst.h>
 #include <named/config.h>
 #include <named/globals.h>
-#include <pk11/site.h>
 
 /*% default configuration */
 static char defaultconf[] = "\
diff --git a/bin/named/control.c b/bin/named/control.c
index 1b52f282bf1..7bb146017f2 100644
--- a/bin/named/control.c
+++ b/bin/named/control.c
@@ -26,6 +26,7 @@
 #include <isccc/alist.h>
 #include <isccc/cc.h>
 #include <isccc/result.h>
+
 #include <named/control.h>
 #include <named/globals.h>
 #include <named/log.h>
diff --git a/bin/named/controlconf.c b/bin/named/controlconf.c
index e12ac6895a2..4c0127b7a69 100644
--- a/bin/named/controlconf.c
+++ b/bin/named/controlconf.c
@@ -31,9 +31,6 @@
 
 #include <dns/result.h>
 
-#include <isccfg/namedconf.h>
-
-#include <bind9/check.h>
 #include <isccc/alist.h>
 #include <isccc/cc.h>
 #include <isccc/ccmsg.h>
@@ -42,6 +39,11 @@
 #include <isccc/sexpr.h>
 #include <isccc/symtab.h>
 #include <isccc/util.h>
+
+#include <isccfg/namedconf.h>
+
+#include <bind9/check.h>
+
 #include <named/config.h>
 #include <named/control.h>
 #include <named/log.h>
diff --git a/bin/named/fuzz.c b/bin/named/fuzz.c
index f79d69df6aa..e94d953210a 100644
--- a/bin/named/fuzz.c
+++ b/bin/named/fuzz.c
@@ -15,6 +15,7 @@
 #include <named/fuzz.h>
 
 #ifdef ENABLE_AFL
+#include <arpa/inet.h>
 #include <errno.h>
 #include <pthread.h>
 #include <signal.h>
@@ -30,7 +31,6 @@
 
 #include <dns/log.h>
 
-#include <arpa/inet.h>
 #include <named/globals.h>
 #include <named/log.h>
 #include <named/server.h>
diff --git a/bin/named/main.c b/bin/named/main.c
index 6f8139287c3..603e8a1b5e0 100644
--- a/bin/named/main.c
+++ b/bin/named/main.c
@@ -44,6 +44,7 @@
 #include <dns/view.h>
 
 #include <dst/result.h>
+
 #include <isccc/result.h>
 #if USE_PKCS11
 #include <pk11/result.h>
diff --git a/bin/named/server.c b/bin/named/server.c
index fa30fcb4fe5..ee23f102d2b 100644
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -16,6 +16,8 @@
 #include <limits.h>
 #include <stdbool.h>
 #include <stdlib.h>
+#include <sys/stat.h>
+#include <sys/types.h>
 #include <unistd.h>
 
 #include <isc/aes.h>
@@ -91,6 +93,9 @@
 #include <dns/zone.h>
 #include <dns/zt.h>
 
+#include <dst/dst.h>
+#include <dst/result.h>
+
 #include <isccfg/grammar.h>
 #include <isccfg/kaspconf.h>
 #include <isccfg/namedconf.h>
@@ -101,12 +106,9 @@
 #include <ns/listenlist.h>
 
 #include <bind9/check.h>
-#include <dst/dst.h>
-#include <dst/result.h>
+
 #include <named/config.h>
 #include <named/control.h>
-#include <sys/stat.h>
-#include <sys/types.h>
 #if defined(HAVE_GEOIP2)
 #include <named/geoip.h>
 #endif /* HAVE_GEOIP2 */
diff --git a/bin/named/statschannel.c b/bin/named/statschannel.c
index e02c1f056ee..c3568b1216d 100644
--- a/bin/named/statschannel.c
+++ b/bin/named/statschannel.c
@@ -43,9 +43,8 @@
 #include <named/statschannel.h>
 
 #if HAVE_JSON_C
-#include <linkhash.h>
-
 #include <json_object.h>
+#include <linkhash.h>
 #endif /* HAVE_JSON_C */
 
 #if HAVE_LIBXML2
diff --git a/bin/named/tkeyconf.c b/bin/named/tkeyconf.c
index 87caf772345..4247e559de6 100644
--- a/bin/named/tkeyconf.c
+++ b/bin/named/tkeyconf.c
@@ -22,9 +22,10 @@
 #include <dns/name.h>
 #include <dns/tkey.h>
 
+#include <dst/gssapi.h>
+
 #include <isccfg/cfg.h>
 
-#include <dst/gssapi.h>
 #include <named/tkeyconf.h>
 
 #define RETERR(x)                            \
diff --git a/bin/named/unix/os.c b/bin/named/unix/os.c
index 98098cf0037..54f0a694bf6 100644
--- a/bin/named/unix/os.c
+++ b/bin/named/unix/os.c
@@ -12,7 +12,6 @@
 /*! \file */
 #include <stdarg.h>
 #include <stdbool.h>
-
 #include <sys/stat.h>
 #include <sys/types.h> /* dev_t FreeBSD 2.1 */
 #ifdef HAVE_UNAME
diff --git a/bin/named/win32/os.c b/bin/named/win32/os.c
index 36617530c4f..a7edacaf535 100644
--- a/bin/named/win32/os.c
+++ b/bin/named/win32/os.c
@@ -18,6 +18,8 @@
 #include <stdbool.h>
 #include <stdio.h>
 #include <stdlib.h>
+#include <sys/stat.h>
+#include <sys/types.h>
 #include <syslog.h>
 
 #include <isc/ntpaths.h>
@@ -32,8 +34,6 @@
 #include <named/main.h>
 #include <named/ntservice.h>
 #include <named/os.h>
-#include <sys/stat.h>
-#include <sys/types.h>
 
 static char *lockfile = NULL;
 static char *pidfile = NULL;
diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
index 783644934cf..9144a7570c6 100644
--- a/bin/nsupdate/nsupdate.c
+++ b/bin/nsupdate/nsupdate.c
@@ -45,6 +45,8 @@
 #include <isc/types.h>
 #include <isc/util.h>
 
+#include <pk11/site.h>
+
 #include <dns/callbacks.h>
 #include <dns/dispatch.h>
 #include <dns/dnssec.h>
@@ -66,11 +68,11 @@
 #include <dns/tkey.h>
 #include <dns/tsig.h>
 
+#include <dst/dst.h>
+
 #include <isccfg/namedconf.h>
 
-#include <dst/dst.h>
 #include <irs/resconf.h>
-#include <pk11/site.h>
 
 #ifdef GSSAPI
 #include <dst/gssapi.h>
diff --git a/bin/pkcs11/pkcs11-destroy.c b/bin/pkcs11/pkcs11-destroy.c
index 57f0e966744..191f02c7d2e 100644
--- a/bin/pkcs11/pkcs11-destroy.c
+++ b/bin/pkcs11/pkcs11-destroy.c
@@ -50,6 +50,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <sys/types.h>
 
 #include <isc/commandline.h>
 #include <isc/print.h>
@@ -58,7 +59,6 @@
 
 #include <pk11/pk11.h>
 #include <pk11/result.h>
-#include <sys/types.h>
 
 #ifdef WIN32
 #define sleep(x) Sleep(x)
diff --git a/bin/pkcs11/pkcs11-keygen.c b/bin/pkcs11/pkcs11-keygen.c
index 7c89a5c64c3..4af024cc1cf 100644
--- a/bin/pkcs11/pkcs11-keygen.c
+++ b/bin/pkcs11/pkcs11-keygen.c
@@ -59,6 +59,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <sys/types.h>
 
 #include <isc/commandline.h>
 #include <isc/print.h>
@@ -70,7 +71,6 @@
 #include <pk11/pk11.h>
 #include <pk11/result.h>
 #include <pkcs11/eddsa.h>
-#include <sys/types.h>
 
 /* Define static key template values */
 static CK_BBOOL truevalue = TRUE;
diff --git a/bin/pkcs11/pkcs11-list.c b/bin/pkcs11/pkcs11-list.c
index 8680a44f5ef..097a2b411a2 100644
--- a/bin/pkcs11/pkcs11-list.c
+++ b/bin/pkcs11/pkcs11-list.c
@@ -43,6 +43,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <sys/types.h>
 
 #include <isc/commandline.h>
 #include <isc/print.h>
@@ -51,7 +52,6 @@
 
 #include <pk11/pk11.h>
 #include <pk11/result.h>
-#include <sys/types.h>
 
 int
 main(int argc, char *argv[]) {
diff --git a/bin/pkcs11/pkcs11-tokens.c b/bin/pkcs11/pkcs11-tokens.c
index df802234845..01bddf7e946 100644
--- a/bin/pkcs11/pkcs11-tokens.c
+++ b/bin/pkcs11/pkcs11-tokens.c
@@ -18,6 +18,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <sys/types.h>
 
 #include <isc/commandline.h>
 #include <isc/mem.h>
@@ -27,7 +28,6 @@
 
 #include <pk11/pk11.h>
 #include <pk11/result.h>
-#include <sys/types.h>
 
 int
 main(int argc, char *argv[]) {
diff --git a/bin/rndc/rndc.c b/bin/rndc/rndc.c
index 1713671186d..6a3b2f3b2b7 100644
--- a/bin/rndc/rndc.c
+++ b/bin/rndc/rndc.c
@@ -33,13 +33,10 @@
 #include <isc/thread.h>
 #include <isc/util.h>
 
-#include <dns/name.h>
-
-#include <isccfg/namedconf.h>
+#include <pk11/site.h>
 
-#include "util.h"
+#include <dns/name.h>
 
-#include <bind9/getaddresses.h>
 #include <isccc/alist.h>
 #include <isccc/base64.h>
 #include <isccc/cc.h>
@@ -48,7 +45,12 @@
 #include <isccc/sexpr.h>
 #include <isccc/types.h>
 #include <isccc/util.h>
-#include <pk11/site.h>
+
+#include <isccfg/namedconf.h>
+
+#include <bind9/getaddresses.h>
+
+#include "util.h"
 
 #define SERVERADDRS 10
 
diff --git a/bin/rndc/util.c b/bin/rndc/util.c
index a6dc649e33a..f76015fa57c 100644
--- a/bin/rndc/util.c
+++ b/bin/rndc/util.c
@@ -12,7 +12,6 @@
 /*! \file */
 
 #include "util.h"
-
 #include <stdarg.h>
 #include <stdbool.h>
 #include <stdio.h>
diff --git a/bin/tests/optional/fsaccess_test.c b/bin/tests/optional/fsaccess_test.c
index c4e7ae17ea0..5a422105b34 100644
--- a/bin/tests/optional/fsaccess_test.c
+++ b/bin/tests/optional/fsaccess_test.c
@@ -14,14 +14,13 @@
 #include <errno.h>
 #include <stdio.h>
 #include <stdlib.h>
+#include <sys/stat.h>  /* Non-portable. */
+#include <sys/types.h> /* Non-portable. */
 
 #include <isc/fsaccess.h>
 #include <isc/print.h>
 #include <isc/result.h>
 
-#include <sys/stat.h>  /* Non-portable. */
-#include <sys/types.h> /* Non-portable. */
-
 #define PATH "/tmp/fsaccess"
 
 int
diff --git a/bin/tests/optional/zone_test.c b/bin/tests/optional/zone_test.c
index 2425f64ee0d..e250aab9411 100644
--- a/bin/tests/optional/zone_test.c
+++ b/bin/tests/optional/zone_test.c
@@ -10,6 +10,10 @@
  */
 
 #include <stdlib.h>
+#include <sys/param.h>
+#include <sys/select.h>
+#include <sys/time.h>
+#include <sys/types.h>
 #include <unistd.h>
 
 #include <isc/app.h>
@@ -29,11 +33,6 @@
 #include <dns/result.h>
 #include <dns/zone.h>
 
-#include <sys/param.h>
-#include <sys/select.h>
-#include <sys/time.h>
-#include <sys/types.h>
-
 static int debug = 0;
 static int quiet = 0;
 static int stats = 0;
diff --git a/bin/tests/system/dlzexternal/driver.c b/bin/tests/system/dlzexternal/driver.c
index a641b89a350..443f22a2237 100644
--- a/bin/tests/system/dlzexternal/driver.c
+++ b/bin/tests/system/dlzexternal/driver.c
@@ -15,7 +15,6 @@
  */
 
 #include "driver.h"
-
 #include <inttypes.h>
 #include <stdarg.h>
 #include <stdbool.h>
diff --git a/bin/tests/system/dyndb/driver/db.c b/bin/tests/system/dyndb/driver/db.c
index c79da577d80..406fa7abdcb 100644
--- a/bin/tests/system/dyndb/driver/db.c
+++ b/bin/tests/system/dyndb/driver/db.c
@@ -12,7 +12,6 @@
  */
 
 #include "db.h"
-
 #include <inttypes.h>
 #include <stdbool.h>
 
diff --git a/bin/tests/system/dyndb/driver/zone.c b/bin/tests/system/dyndb/driver/zone.c
index 07509eb3b22..da85ecb82e4 100644
--- a/bin/tests/system/dyndb/driver/zone.c
+++ b/bin/tests/system/dyndb/driver/zone.c
@@ -5,7 +5,6 @@
  */
 
 #include "zone.h"
-
 #include <inttypes.h>
 #include <stdbool.h>
 
diff --git a/bin/tests/system/rndc/gencheck.c b/bin/tests/system/rndc/gencheck.c
index fca84b67425..a62b2f229ef 100644
--- a/bin/tests/system/rndc/gencheck.c
+++ b/bin/tests/system/rndc/gencheck.c
@@ -13,12 +13,11 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <sys/stat.h>
 #include <unistd.h>
 
 #include <isc/print.h>
 
-#include <sys/stat.h>
-
 #define USAGE "usage: gencheck <filename>\n"
 
 static int
diff --git a/bin/tests/system/rpz/dnsrps.c b/bin/tests/system/rpz/dnsrps.c
index 1e72f7d842d..ceafc48e272 100644
--- a/bin/tests/system/rpz/dnsrps.c
+++ b/bin/tests/system/rpz/dnsrps.c
@@ -27,14 +27,13 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <sys/stat.h>
+#include <sys/types.h>
 #include <unistd.h>
 
 #include <isc/print.h>
 #include <isc/util.h>
 
-#include <sys/stat.h>
-#include <sys/types.h>
-
 #ifdef USE_DNSRPS
 #define LIBRPZ_LIB_OPEN DNSRPS_LIB_OPEN
 #include <dns/librpz.h>
diff --git a/bin/tests/system/rsabigexponent/bigkey.c b/bin/tests/system/rsabigexponent/bigkey.c
index 5651f5adab6..fcb8f6932ad 100644
--- a/bin/tests/system/rsabigexponent/bigkey.c
+++ b/bin/tests/system/rsabigexponent/bigkey.c
@@ -23,6 +23,12 @@
 
 #define DST_KEY_INTERNAL
 
+#include <openssl/bn.h>
+#include <openssl/err.h>
+#include <openssl/evp.h>
+#include <openssl/objects.h>
+#include <openssl/rsa.h>
+
 #include <dns/dnssec.h>
 #include <dns/fixedname.h>
 #include <dns/keyvalues.h>
@@ -34,11 +40,6 @@
 
 #include <dst/dst.h>
 #include <dst/result.h>
-#include <openssl/bn.h>
-#include <openssl/err.h>
-#include <openssl/evp.h>
-#include <openssl/objects.h>
-#include <openssl/rsa.h>
 
 dst_key_t *key;
 dns_fixedname_t fname;
diff --git a/bin/tests/system/tkey/keycreate.c b/bin/tests/system/tkey/keycreate.c
index 3830d93dad2..c14e5c1065d 100644
--- a/bin/tests/system/tkey/keycreate.c
+++ b/bin/tests/system/tkey/keycreate.c
@@ -26,6 +26,8 @@
 #include <isc/timer.h>
 #include <isc/util.h>
 
+#include <pk11/site.h>
+
 #include <dns/dispatch.h>
 #include <dns/fixedname.h>
 #include <dns/keyvalues.h>
@@ -38,7 +40,6 @@
 #include <dns/view.h>
 
 #include <dst/result.h>
-#include <pk11/site.h>
 
 #define CHECK(str, x)                                        \
 	{                                                    \
diff --git a/bin/tests/system/tkey/keydelete.c b/bin/tests/system/tkey/keydelete.c
index 5ba95716317..5c61f5919b8 100644
--- a/bin/tests/system/tkey/keydelete.c
+++ b/bin/tests/system/tkey/keydelete.c
@@ -25,6 +25,8 @@
 #include <isc/timer.h>
 #include <isc/util.h>
 
+#include <pk11/site.h>
+
 #include <dns/dispatch.h>
 #include <dns/fixedname.h>
 #include <dns/keyvalues.h>
@@ -37,7 +39,6 @@
 #include <dns/view.h>
 
 #include <dst/result.h>
-#include <pk11/site.h>
 
 #define CHECK(str, x)                                        \
 	{                                                    \
diff --git a/bin/tools/dnstap-read.c b/bin/tools/dnstap-read.c
index 7d2f5ab09cc..fd38fe21a03 100644
--- a/bin/tools/dnstap-read.c
+++ b/bin/tools/dnstap-read.c
@@ -31,6 +31,8 @@
 #include <stdbool.h>
 #include <stdlib.h>
 
+#include <protobuf-c/protobuf-c.h>
+
 #include <isc/buffer.h>
 #include <isc/commandline.h>
 #include <isc/hex.h>
@@ -48,8 +50,6 @@
 
 #include "lib/dns/dnstap.pb-c.h"
 
-#include <protobuf-c/protobuf-c.h>
-
 isc_mem_t *mctx = NULL;
 bool memrecord = false;
 bool printmessage = false;
diff --git a/bin/tools/mdig.c b/bin/tools/mdig.c
index 68acdd744b5..1ce0e432215 100644
--- a/bin/tools/mdig.c
+++ b/bin/tools/mdig.c
@@ -49,9 +49,10 @@
 #include <dns/types.h>
 #include <dns/view.h>
 
-#include <bind9/getaddresses.h>
 #include <dst/result.h>
 
+#include <bind9/getaddresses.h>
+
 #define CHECK(str, x)                                                       \
 	{                                                                   \
 		if ((x) != ISC_R_SUCCESS) {                                 \
diff --git a/contrib/dlz/drivers/dlz_filesystem_driver.c b/contrib/dlz/drivers/dlz_filesystem_driver.c
index 5afb1b0b426..779ab1c7894 100644
--- a/contrib/dlz/drivers/dlz_filesystem_driver.c
+++ b/contrib/dlz/drivers/dlz_filesystem_driver.c
@@ -46,6 +46,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <sys/stat.h>
 
 #include <isc/dir.h>
 #include <isc/mem.h>
@@ -61,7 +62,6 @@
 
 #include <dlz/dlz_filesystem_driver.h>
 #include <named/globals.h>
-#include <sys/stat.h>
 
 static dns_sdlzimplementation_t *dlz_fs = NULL;
 
diff --git a/contrib/dlz/drivers/dlz_postgres_driver.c b/contrib/dlz/drivers/dlz_postgres_driver.c
index 8a712889539..d5a46c5159f 100644
--- a/contrib/dlz/drivers/dlz_postgres_driver.c
+++ b/contrib/dlz/drivers/dlz_postgres_driver.c
@@ -62,9 +62,8 @@
 #include <named/globals.h>
 
 /* temporarily include time. */
-#include <time.h>
-
 #include <libpq-fe.h>
+#include <time.h>
 
 static dns_sdlzimplementation_t *dlz_postgres = NULL;
 
diff --git a/contrib/dlz/modules/filesystem/dir.c b/contrib/dlz/modules/filesystem/dir.c
index d7fd02a7505..cc06b3bcadf 100644
--- a/contrib/dlz/modules/filesystem/dir.c
+++ b/contrib/dlz/modules/filesystem/dir.c
@@ -15,17 +15,15 @@
  */
 
 #include "dir.h"
-
 #include <ctype.h>
 #include <errno.h>
 #include <string.h>
+#include <sys/stat.h>
+#include <sys/types.h>
 #include <unistd.h>
 
 #include "dlz_minimal.h"
 
-#include <sys/stat.h>
-#include <sys/types.h>
-
 void
 dir_init(dir_t *dir) {
 	dir->entry.name[0] = '\0';
diff --git a/contrib/dlz/modules/filesystem/dir.h b/contrib/dlz/modules/filesystem/dir.h
index 9b1c445610c..c8be683bfda 100644
--- a/contrib/dlz/modules/filesystem/dir.h
+++ b/contrib/dlz/modules/filesystem/dir.h
@@ -15,9 +15,9 @@
  */
 
 #include <dirent.h>
+#include <sys/types.h>
 
 #include <dlz_minimal.h>
-#include <sys/types.h>
 
 #define DIR_NAMEMAX 256
 #define DIR_PATHMAX 1024
diff --git a/contrib/dlz/modules/filesystem/dlz_filesystem_dynamic.c b/contrib/dlz/modules/filesystem/dlz_filesystem_dynamic.c
index c6be12165fd..a6049c2849c 100644
--- a/contrib/dlz/modules/filesystem/dlz_filesystem_dynamic.c
+++ b/contrib/dlz/modules/filesystem/dlz_filesystem_dynamic.c
@@ -52,13 +52,12 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <sys/stat.h>
 
 #include "dir.h"
 #include "dlz_list.h"
 #include "dlz_minimal.h"
 
-#include <sys/stat.h>
-
 typedef struct config_data {
 	char *basedir;
 	int basedirsize;
diff --git a/contrib/dlz/modules/include/dlz_minimal.h b/contrib/dlz/modules/include/dlz_minimal.h
index 98a791749d3..6f0717c96f8 100644
--- a/contrib/dlz/modules/include/dlz_minimal.h
+++ b/contrib/dlz/modules/include/dlz_minimal.h
@@ -28,7 +28,6 @@
 
 #include <inttypes.h>
 #include <stdbool.h>
-
 #include <sys/socket.h>
 #include <sys/types.h>
 #ifdef ISC_PLATFORM_HAVESYSUNH
diff --git a/contrib/dlz/modules/mysql/dlz_mysql_dynamic.c b/contrib/dlz/modules/mysql/dlz_mysql_dynamic.c
index 60f39c08802..1a40112b794 100644
--- a/contrib/dlz/modules/mysql/dlz_mysql_dynamic.c
+++ b/contrib/dlz/modules/mysql/dlz_mysql_dynamic.c
@@ -52,11 +52,12 @@
 #include <stdlib.h>
 #include <string.h>
 
+#include <mysql/mysql.h>
+
 #include <dlz_dbi.h>
 #include <dlz_list.h>
 #include <dlz_minimal.h>
 #include <dlz_pthread.h>
-#include <mysql/mysql.h>
 
 #define dbc_search_limit 30
 #define ALLNODES	 1
diff --git a/contrib/dlz/modules/mysqldyn/dlz_mysqldyn_mod.c b/contrib/dlz/modules/mysqldyn/dlz_mysqldyn_mod.c
index 47acb7c903f..9a2ca2370fb 100644
--- a/contrib/dlz/modules/mysqldyn/dlz_mysqldyn_mod.c
+++ b/contrib/dlz/modules/mysqldyn/dlz_mysqldyn_mod.c
@@ -43,22 +43,23 @@
 #include <ifaddrs.h>
 #include <inttypes.h>
 #include <netdb.h>
+#include <netinet/in.h>
 #include <pthread.h>
 #include <stdarg.h>
 #include <stdbool.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <sys/socket.h>
+#include <sys/types.h>
 #include <unistd.h>
 
+#include <mysql/errmsg.h>
+#include <mysql/mysql.h>
+
 #include <dlz_list.h>
 #include <dlz_minimal.h>
 #include <dlz_pthread.h>
-#include <mysql/errmsg.h>
-#include <mysql/mysql.h>
-#include <netinet/in.h>
-#include <sys/socket.h>
-#include <sys/types.h>
 
 /*
  * The SQL queries that will be used for lookups and updates are defined
diff --git a/contrib/dlz/modules/perl/dlz_perl_driver.c b/contrib/dlz/modules/perl/dlz_perl_driver.c
index 89cb5c16505..15d4c9c699b 100644
--- a/contrib/dlz/modules/perl/dlz_perl_driver.c
+++ b/contrib/dlz/modules/perl/dlz_perl_driver.c
@@ -58,7 +58,6 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 #include "dlz_perl_driver.h"
-
 #include <EXTERN.h>
 #include <perl.h>
 #include <stdio.h>
diff --git a/fuzz/main.c b/fuzz/main.c
index 10157b5ab9e..607c830b963 100644
--- a/fuzz/main.c
+++ b/fuzz/main.c
@@ -15,12 +15,11 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <sys/stat.h>
 #include <unistd.h>
 
 #include "fuzz.h"
 
-#include <sys/stat.h>
-
 #ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
 
 #include <dirent.h>
diff --git a/lib/bind9/check.c b/lib/bind9/check.c
index 037c9e218f4..3668bf90f37 100644
--- a/lib/bind9/check.c
+++ b/lib/bind9/check.c
@@ -35,6 +35,8 @@
 #include <isc/symtab.h>
 #include <isc/util.h>
 
+#include <pk11/site.h>
+
 #include <dns/acl.h>
 #include <dns/dnstap.h>
 #include <dns/fixedname.h>
@@ -47,6 +49,9 @@
 #include <dns/secalg.h>
 #include <dns/ssu.h>
 
+#include <dst/dst.h>
+#include <dst/result.h>
+
 #include <isccfg/aclconf.h>
 #include <isccfg/cfg.h>
 #include <isccfg/grammar.h>
@@ -56,9 +61,6 @@
 #include <ns/hooks.h>
 
 #include <bind9/check.h>
-#include <dst/dst.h>
-#include <dst/result.h>
-#include <pk11/site.h>
 
 static isc_result_t
 fileexist(const cfg_obj_t *obj, isc_symtab_t *symtab, bool writeable,
diff --git a/lib/dns/dispatch.c b/lib/dns/dispatch.c
index 0e1ff4369f8..bb5cd8d430c 100644
--- a/lib/dns/dispatch.c
+++ b/lib/dns/dispatch.c
@@ -14,6 +14,7 @@
 #include <inttypes.h>
 #include <stdbool.h>
 #include <stdlib.h>
+#include <sys/types.h>
 #include <unistd.h>
 
 #include <isc/mem.h>
@@ -38,8 +39,6 @@
 #include <dns/tcpmsg.h>
 #include <dns/types.h>
 
-#include <sys/types.h>
-
 typedef ISC_LIST(dns_dispentry_t) dns_displist_t;
 
 typedef struct dispsocket dispsocket_t;
diff --git a/lib/dns/dnssec.c b/lib/dns/dnssec.c
index 4501d96ed4c..4d2f864bfa8 100644
--- a/lib/dns/dnssec.c
+++ b/lib/dns/dnssec.c
@@ -23,6 +23,8 @@
 #include <isc/string.h>
 #include <isc/util.h>
 
+#include <pk11/site.h>
+
 #include <dns/db.h>
 #include <dns/diff.h>
 #include <dns/dnssec.h>
@@ -40,7 +42,6 @@
 #include <dns/tsig.h> /* for DNS_TSIG_FUDGE */
 
 #include <dst/result.h>
-#include <pk11/site.h>
 
 LIBDNS_EXTERNAL_DATA isc_stats_t *dns_dnssec_stats;
 
diff --git a/lib/dns/dnstap.c b/lib/dns/dnstap.c
index 7207cdf6726..55efea3f507 100644
--- a/lib/dns/dnstap.c
+++ b/lib/dns/dnstap.c
@@ -51,6 +51,8 @@
 #include <stdbool.h>
 #include <stdlib.h>
 
+#include <protobuf-c/protobuf-c.h>
+
 #include <isc/buffer.h>
 #include <isc/file.h>
 #include <isc/log.h>
@@ -78,8 +80,6 @@
 
 #include "dnstap.pb-c.h"
 
-#include <protobuf-c/protobuf-c.h>
-
 #define DTENV_MAGIC	 ISC_MAGIC('D', 't', 'n', 'v')
 #define VALID_DTENV(env) ISC_MAGIC_VALID(env, DTENV_MAGIC)
 
diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c
index ee61e24b74c..d7a71dd806f 100644
--- a/lib/dns/dst_api.c
+++ b/lib/dns/dst_api.c
@@ -58,10 +58,10 @@
 #include <dns/ttl.h>
 #include <dns/types.h>
 
-#include "dst_internal.h"
-
 #include <dst/result.h>
 
+#include "dst_internal.h"
+
 #define DST_AS_STR(t) ((t).value.as_textregion.base)
 
 #define NEXTTOKEN(lex, opt, token)                       \
diff --git a/lib/dns/dst_internal.h b/lib/dns/dst_internal.h
index 3859fbdd7f5..bce2a9f9d27 100644
--- a/lib/dns/dst_internal.h
+++ b/lib/dns/dst_internal.h
@@ -43,15 +43,16 @@
 #include <pk11/site.h>
 #endif /* USE_PKCS11 */
 
-#include <dns/time.h>
-
-#include <dst/dst.h>
 #include <openssl/dh.h>
 #include <openssl/err.h>
 #include <openssl/evp.h>
 #include <openssl/objects.h>
 #include <openssl/rsa.h>
 
+#include <dns/time.h>
+
+#include <dst/dst.h>
+
 ISC_LANG_BEGINDECLS
 
 #define KEY_MAGIC ISC_MAGIC('D', 'S', 'T', 'K')
diff --git a/lib/dns/dst_openssl.h b/lib/dns/dst_openssl.h
index 05fc34915eb..4848b264f5c 100644
--- a/lib/dns/dst_openssl.h
+++ b/lib/dns/dst_openssl.h
@@ -12,10 +12,6 @@
 #ifndef DST_OPENSSL_H
 #define DST_OPENSSL_H 1
 
-#include <isc/lang.h>
-#include <isc/log.h>
-#include <isc/result.h>
-
 #include <openssl/bn.h>
 #include <openssl/conf.h>
 #include <openssl/crypto.h>
@@ -23,6 +19,10 @@
 #include <openssl/evp.h>
 #include <openssl/rand.h>
 
+#include <isc/lang.h>
+#include <isc/log.h>
+#include <isc/result.h>
+
 #if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
 /*
  * These are new in OpenSSL 1.1.0.  BN_GENCB _cb needs to be declared in
diff --git a/lib/dns/dst_parse.c b/lib/dns/dst_parse.c
index a6e01d5adcf..dac416e9c03 100644
--- a/lib/dns/dst_parse.c
+++ b/lib/dns/dst_parse.c
@@ -24,7 +24,6 @@
  */
 
 #include "dst_parse.h"
-
 #include <inttypes.h>
 #include <stdbool.h>
 
@@ -39,14 +38,14 @@
 #include <isc/string.h>
 #include <isc/util.h>
 
+#include <pk11/site.h>
+
 #include <dns/log.h>
 #include <dns/time.h>
 
 #include "dst/result.h"
 #include "dst_internal.h"
 
-#include <pk11/site.h>
-
 #define DST_AS_STR(t) ((t).value.as_textregion.base)
 
 #define PRIVATE_KEY_STR "Private-key-format:"
diff --git a/lib/dns/gen-unix.h b/lib/dns/gen-unix.h
index 29c5f6e2ad2..36f5b4729ec 100644
--- a/lib/dns/gen-unix.h
+++ b/lib/dns/gen-unix.h
@@ -29,12 +29,11 @@
 #include <errno.h>
 #include <stdbool.h>
 #include <stdlib.h>
-#include <unistd.h> /* XXXDCL Required for ?. */
+#include <sys/types.h> /* Required on some systems for dirent.h. */
+#include <unistd.h>    /* XXXDCL Required for ?. */
 
 #include <isc/lang.h>
 
-#include <sys/types.h> /* Required on some systems for dirent.h. */
-
 #ifdef NEED_OPTARG
 extern char *optarg;
 #endif /* ifdef NEED_OPTARG */
diff --git a/lib/dns/gen.c b/lib/dns/gen.c
index 0868af328f2..77cd75746b8 100644
--- a/lib/dns/gen.c
+++ b/lib/dns/gen.c
@@ -31,9 +31,8 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
-#include <time.h>
-
 #include <sys/types.h>
+#include <time.h>
 
 #ifndef PATH_MAX
 #define PATH_MAX 1024
diff --git a/lib/dns/gssapi_link.c b/lib/dns/gssapi_link.c
index 8159426fed9..3a939709d4f 100644
--- a/lib/dns/gssapi_link.c
+++ b/lib/dns/gssapi_link.c
@@ -20,12 +20,12 @@
 #include <isc/string.h>
 #include <isc/util.h>
 
-#include "dst_internal.h"
-#include "dst_parse.h"
-
 #include <dst/gssapi.h>
 #include <dst/result.h>
 
+#include "dst_internal.h"
+#include "dst_parse.h"
+
 #define INITIAL_BUFFER_SIZE 1024
 #define BUFFER_EXTRA	    1024
 
diff --git a/lib/dns/gssapictx.c b/lib/dns/gssapictx.c
index 6eb5fee34e3..18f1280a283 100644
--- a/lib/dns/gssapictx.c
+++ b/lib/dns/gssapictx.c
@@ -37,11 +37,11 @@
 #include <dns/result.h>
 #include <dns/types.h>
 
-#include "dst_internal.h"
-
 #include <dst/gssapi.h>
 #include <dst/result.h>
 
+#include "dst_internal.h"
+
 /*
  * If we're using our own SPNEGO implementation (see configure.in),
  * pull it in now.  Otherwise, we just use whatever GSSAPI supplies.
diff --git a/lib/dns/hmac_link.c b/lib/dns/hmac_link.c
index 1de026e634c..7524fcf0626 100644
--- a/lib/dns/hmac_link.c
+++ b/lib/dns/hmac_link.c
@@ -38,10 +38,11 @@
 #include <isc/string.h>
 #include <isc/util.h>
 
-#include "dst_internal.h"
+#include <pk11/site.h>
 
 #include <dst/result.h>
-#include <pk11/site.h>
+
+#include "dst_internal.h"
 #ifdef HAVE_FIPS_MODE
 #include "dst_openssl.h" /* FIPS_mode() prototype */
 #endif			 /* ifdef HAVE_FIPS_MODE */
diff --git a/lib/dns/key.c b/lib/dns/key.c
index bc3da5f75c6..391db8159e6 100644
--- a/lib/dns/key.c
+++ b/lib/dns/key.c
@@ -19,10 +19,10 @@
 
 #include <dns/keyvalues.h>
 
-#include "dst_internal.h"
-
 #include <dst/dst.h>
 
+#include "dst_internal.h"
+
 uint16_t
 dst_region_computeid(const isc_region_t *source) {
 	uint32_t ac;
diff --git a/lib/dns/openssl_link.c b/lib/dns/openssl_link.c
index 7760cf2e2c5..5327b017a31 100644
--- a/lib/dns/openssl_link.c
+++ b/lib/dns/openssl_link.c
@@ -33,11 +33,11 @@
 
 #include <dns/log.h>
 
+#include <dst/result.h>
+
 #include "dst_internal.h"
 #include "dst_openssl.h"
 
-#include <dst/result.h>
-
 static isc_mem_t *dst__mctx = NULL;
 
 #if !defined(OPENSSL_NO_ENGINE)
diff --git a/lib/dns/openssldh_link.c b/lib/dns/openssldh_link.c
index 9ac2b81e78a..3a310058255 100644
--- a/lib/dns/openssldh_link.c
+++ b/lib/dns/openssldh_link.c
@@ -29,19 +29,21 @@
 #include <inttypes.h>
 #include <stdbool.h>
 
+#include <openssl/opensslv.h>
+
 #include <isc/mem.h>
 #include <isc/safe.h>
 #include <isc/string.h>
 #include <isc/util.h>
 
+#include <pk11/site.h>
+
+#include <dst/result.h>
+
 #include "dst_internal.h"
 #include "dst_openssl.h"
 #include "dst_parse.h"
 
-#include <dst/result.h>
-#include <openssl/opensslv.h>
-#include <pk11/site.h>
-
 #define PRIME2 "02"
 
 #define PRIME768                                                               \
diff --git a/lib/dns/opensslecdsa_link.c b/lib/dns/opensslecdsa_link.c
index 4624cc837bf..29d3fd29831 100644
--- a/lib/dns/opensslecdsa_link.c
+++ b/lib/dns/opensslecdsa_link.c
@@ -15,6 +15,11 @@
 
 #include <stdbool.h>
 
+#include <openssl/bn.h>
+#include <openssl/ecdsa.h>
+#include <openssl/err.h>
+#include <openssl/objects.h>
+
 #include <isc/mem.h>
 #include <isc/safe.h>
 #include <isc/string.h>
@@ -22,16 +27,12 @@
 
 #include <dns/keyvalues.h>
 
+#include <dst/result.h>
+
 #include "dst_internal.h"
 #include "dst_openssl.h"
 #include "dst_parse.h"
 
-#include <dst/result.h>
-#include <openssl/bn.h>
-#include <openssl/ecdsa.h>
-#include <openssl/err.h>
-#include <openssl/objects.h>
-
 #ifndef NID_X9_62_prime256v1
 #error "P-256 group is not known (NID_X9_62_prime256v1)"
 #endif /* ifndef NID_X9_62_prime256v1 */
diff --git a/lib/dns/openssleddsa_link.c b/lib/dns/openssleddsa_link.c
index c98903e1bb7..19c52670af1 100644
--- a/lib/dns/openssleddsa_link.c
+++ b/lib/dns/openssleddsa_link.c
@@ -15,6 +15,11 @@
 
 #include <stdbool.h>
 
+#include <openssl/err.h>
+#include <openssl/evp.h>
+#include <openssl/objects.h>
+#include <openssl/x509.h>
+
 #include <isc/mem.h>
 #include <isc/result.h>
 #include <isc/safe.h>
@@ -23,17 +28,13 @@
 
 #include <dns/keyvalues.h>
 
+#include <dst/result.h>
+
 #include "dst_internal.h"
 #include "dst_openssl.h"
 #include "dst_parse.h"
 #include "openssl_shim.h"
 
-#include <dst/result.h>
-#include <openssl/err.h>
-#include <openssl/evp.h>
-#include <openssl/objects.h>
-#include <openssl/x509.h>
-
 #define DST_RET(a)        \
 	{                 \
 		ret = a;  \
diff --git a/lib/dns/opensslrsa_link.c b/lib/dns/opensslrsa_link.c
index 932fde9c901..b334de0f964 100644
--- a/lib/dns/opensslrsa_link.c
+++ b/lib/dns/opensslrsa_link.c
@@ -14,21 +14,23 @@
 #include <inttypes.h>
 #include <stdbool.h>
 
+#include <openssl/bn.h>
+#include <openssl/err.h>
+#include <openssl/objects.h>
+#include <openssl/rsa.h>
+
 #include <isc/mem.h>
 #include <isc/safe.h>
 #include <isc/string.h>
 #include <isc/util.h>
 
+#include <pk11/site.h>
+
+#include <dst/result.h>
+
 #include "dst_internal.h"
 #include "dst_openssl.h"
 #include "dst_parse.h"
-
-#include <dst/result.h>
-#include <openssl/bn.h>
-#include <openssl/err.h>
-#include <openssl/objects.h>
-#include <openssl/rsa.h>
-#include <pk11/site.h>
 #if !defined(OPENSSL_NO_ENGINE)
 #include <openssl/engine.h>
 #endif /* if !defined(OPENSSL_NO_ENGINE) */
diff --git a/lib/dns/pkcs11.c b/lib/dns/pkcs11.c
index 03489e16c7d..bbe847d377c 100644
--- a/lib/dns/pkcs11.c
+++ b/lib/dns/pkcs11.c
@@ -13,15 +13,15 @@
 
 #include <isc/util.h>
 
+#include <pk11/internal.h>
+#include <pk11/pk11.h>
+
 #include <dns/log.h>
 #include <dns/result.h>
 
 #include "dst_internal.h"
 #include "dst_pkcs11.h"
 
-#include <pk11/internal.h>
-#include <pk11/pk11.h>
-
 isc_result_t
 dst__pkcs11_toresult(const char *funcname, const char *file, int line,
 		     isc_result_t fallback, CK_RV rv) {
diff --git a/lib/dns/pkcs11ecdsa_link.c b/lib/dns/pkcs11ecdsa_link.c
index f010d0e6bf6..e7b87bf1001 100644
--- a/lib/dns/pkcs11ecdsa_link.c
+++ b/lib/dns/pkcs11ecdsa_link.c
@@ -20,18 +20,19 @@
 #include <isc/string.h>
 #include <isc/util.h>
 
+#include <pk11/constants.h>
+#include <pk11/internal.h>
+#include <pk11/pk11.h>
+#include <pkcs11/pkcs11.h>
+
 #include <dns/keyvalues.h>
 
+#include <dst/result.h>
+
 #include "dst_internal.h"
 #include "dst_parse.h"
 #include "dst_pkcs11.h"
 
-#include <dst/result.h>
-#include <pk11/constants.h>
-#include <pk11/internal.h>
-#include <pk11/pk11.h>
-#include <pkcs11/pkcs11.h>
-
 /*
  * FIPS 186-3 ECDSA keys:
  *  mechanisms:
diff --git a/lib/dns/pkcs11eddsa_link.c b/lib/dns/pkcs11eddsa_link.c
index 22c8444ee12..c3fc059b609 100644
--- a/lib/dns/pkcs11eddsa_link.c
+++ b/lib/dns/pkcs11eddsa_link.c
@@ -20,19 +20,20 @@
 #include <isc/string.h>
 #include <isc/util.h>
 
-#include <dns/keyvalues.h>
-
-#include "dst_internal.h"
-#include "dst_parse.h"
-#include "dst_pkcs11.h"
-
-#include <dst/result.h>
 #include <pk11/constants.h>
 #include <pk11/internal.h>
 #include <pk11/pk11.h>
 #include <pkcs11/eddsa.h>
 #include <pkcs11/pkcs11.h>
 
+#include <dns/keyvalues.h>
+
+#include <dst/result.h>
+
+#include "dst_internal.h"
+#include "dst_parse.h"
+#include "dst_pkcs11.h"
+
 /*
  * FIPS 186-3 EDDSA keys:
  *  mechanisms:
diff --git a/lib/dns/pkcs11rsa_link.c b/lib/dns/pkcs11rsa_link.c
index be805801857..117c3185e1f 100644
--- a/lib/dns/pkcs11rsa_link.c
+++ b/lib/dns/pkcs11rsa_link.c
@@ -21,14 +21,15 @@
 #include <isc/string.h>
 #include <isc/util.h>
 
+#include <pk11/internal.h>
+#include <pk11/site.h>
+
+#include <dst/result.h>
+
 #include "dst_internal.h"
 #include "dst_parse.h"
 #include "dst_pkcs11.h"
 
-#include <dst/result.h>
-#include <pk11/internal.h>
-#include <pk11/site.h>
-
 /*
  * Limit the size of public exponents.
  */
diff --git a/lib/dns/rbt.c b/lib/dns/rbt.c
index 46967018b05..da38f76155d 100644
--- a/lib/dns/rbt.c
+++ b/lib/dns/rbt.c
@@ -13,6 +13,7 @@
 
 #include <inttypes.h>
 #include <stdbool.h>
+#include <sys/stat.h>
 
 #include <isc/crc64.h>
 #include <isc/file.h>
@@ -27,8 +28,6 @@
 #include <isc/string.h>
 #include <isc/util.h>
 
-#include <sys/stat.h>
-
 /*%
  * This define is so dns/name.h (included by dns/fixedname.h) uses more
  * efficient macro calls instead of functions for a few operations.
diff --git a/lib/dns/rcode.c b/lib/dns/rcode.c
index 7a8f6fac2dd..327248efd6b 100644
--- a/lib/dns/rcode.c
+++ b/lib/dns/rcode.c
@@ -24,6 +24,8 @@
 #include <isc/types.h>
 #include <isc/util.h>
 
+#include <pk11/site.h>
+
 #include <dns/cert.h>
 #include <dns/ds.h>
 #include <dns/dsdigest.h>
@@ -35,8 +37,6 @@
 #include <dns/secalg.h>
 #include <dns/secproto.h>
 
-#include <pk11/site.h>
-
 #define RETERR(x)                        \
 	do {                             \
 		isc_result_t _r = (x);   \
diff --git a/lib/dns/spnego.c b/lib/dns/spnego.c
index 67f9034ce8d..c8efafe474f 100644
--- a/lib/dns/spnego.c
+++ b/lib/dns/spnego.c
@@ -152,11 +152,11 @@
 #include <dns/result.h>
 #include <dns/types.h>
 
-#include "dst_internal.h"
-
 #include <dst/gssapi.h>
 #include <dst/result.h>
 
+#include "dst_internal.h"
+
 /*
  * The API we export
  */
diff --git a/lib/dns/tests/dh_test.c b/lib/dns/tests/dh_test.c
index 473c1749ad8..05f5bcc40d2 100644
--- a/lib/dns/tests/dh_test.c
+++ b/lib/dns/tests/dh_test.c
@@ -25,14 +25,15 @@
 #include <isc/string.h>
 #include <isc/util.h>
 
+#include <pk11/site.h>
+
 #include <dns/name.h>
 
+#include <dst/result.h>
+
 #include "../dst_internal.h"
 #include "dnstest.h"
 
-#include <dst/result.h>
-#include <pk11/site.h>
-
 #if USE_OPENSSL
 static int
 _setup(void **state) {
diff --git a/lib/dns/tests/dst_test.c b/lib/dns/tests/dst_test.c
index b41b15e1a78..9720efdca1b 100644
--- a/lib/dns/tests/dst_test.c
+++ b/lib/dns/tests/dst_test.c
@@ -28,12 +28,12 @@
 #include <isc/string.h>
 #include <isc/util.h>
 
-#include "../dst_internal.h"
-#include "dnstest.h"
-
 #include <dst/dst.h>
 #include <dst/result.h>
 
+#include "../dst_internal.h"
+#include "dnstest.h"
+
 static int
 _setup(void **state) {
 	isc_result_t result;
diff --git a/lib/dns/tests/keytable_test.c b/lib/dns/tests/keytable_test.c
index 740a16ef1e2..40fd712cc44 100644
--- a/lib/dns/tests/keytable_test.c
+++ b/lib/dns/tests/keytable_test.c
@@ -38,10 +38,10 @@
 #include <dns/rootns.h>
 #include <dns/view.h>
 
-#include "dnstest.h"
-
 #include <dst/dst.h>
 
+#include "dnstest.h"
+
 static int
 _setup(void **state) {
 	isc_result_t result;
diff --git a/lib/dns/tests/private_test.c b/lib/dns/tests/private_test.c
index 6ea06ab922e..c08233d70eb 100644
--- a/lib/dns/tests/private_test.c
+++ b/lib/dns/tests/private_test.c
@@ -31,10 +31,10 @@
 #include <dns/rdataclass.h>
 #include <dns/rdatatype.h>
 
-#include "dnstest.h"
-
 #include <dst/dst.h>
 
+#include "dnstest.h"
+
 static dns_rdatatype_t privatetype = 65534;
 
 static int
diff --git a/lib/dns/tests/rbt_serialize_test.c b/lib/dns/tests/rbt_serialize_test.c
index 9ca45031af4..7c3bc14fa10 100644
--- a/lib/dns/tests/rbt_serialize_test.c
+++ b/lib/dns/tests/rbt_serialize_test.c
@@ -18,9 +18,8 @@
 #include <stdarg.h>
 #include <stddef.h>
 #include <stdlib.h>
-#include <unistd.h>
-
 #include <sys/mman.h>
+#include <unistd.h>
 
 #define UNIT_TESTING
 #include <cmocka.h>
@@ -48,10 +47,10 @@
 #include <dns/rbt.h>
 #include <dns/result.h>
 
-#include "dnstest.h"
-
 #include <dst/dst.h>
 
+#include "dnstest.h"
+
 #ifndef MAP_FILE
 #define MAP_FILE 0
 #endif /* ifndef MAP_FILE */
diff --git a/lib/dns/tests/rbt_test.c b/lib/dns/tests/rbt_test.c
index bf63730c8d8..a88790e655d 100644
--- a/lib/dns/tests/rbt_test.c
+++ b/lib/dns/tests/rbt_test.c
@@ -51,10 +51,10 @@
 #include <dns/rbt.h>
 #include <dns/result.h>
 
-#include "dnstest.h"
-
 #include <dst/dst.h>
 
+#include "dnstest.h"
+
 typedef struct {
 	dns_rbt_t *rbt;
 	dns_rbt_t *rbt_distances;
diff --git a/lib/dns/tests/rsa_test.c b/lib/dns/tests/rsa_test.c
index 61e02f28ded..45512830b32 100644
--- a/lib/dns/tests/rsa_test.c
+++ b/lib/dns/tests/rsa_test.c
@@ -26,11 +26,11 @@
 #include <isc/print.h>
 #include <isc/util.h>
 
+#include <pk11/site.h>
+
 #include "../dst_internal.h"
 #include "dnstest.h"
 
-#include <pk11/site.h>
-
 static int
 _setup(void **state) {
 	isc_result_t result;
diff --git a/lib/dns/tests/sigs_test.c b/lib/dns/tests/sigs_test.c
index 1b9f2993981..f408d1db12b 100644
--- a/lib/dns/tests/sigs_test.c
+++ b/lib/dns/tests/sigs_test.c
@@ -42,11 +42,11 @@
 #include <dns/types.h>
 #include <dns/zone.h>
 
+#include <dst/dst.h>
+
 #include "../zone_p.h"
 #include "dnstest.h"
 
-#include <dst/dst.h>
-
 static int
 _setup(void **state) {
 	isc_result_t result;
diff --git a/lib/dns/tkey.c b/lib/dns/tkey.c
index 8802d02f2e3..1e6fa5ae4c2 100644
--- a/lib/dns/tkey.c
+++ b/lib/dns/tkey.c
@@ -23,6 +23,8 @@
 #include <isc/string.h>
 #include <isc/util.h>
 
+#include <pk11/site.h>
+
 #include <dns/dnssec.h>
 #include <dns/fixedname.h>
 #include <dns/keyvalues.h>
@@ -37,11 +39,10 @@
 #include <dns/tkey.h>
 #include <dns/tsig.h>
 
-#include "dst_internal.h"
-
 #include <dst/dst.h>
 #include <dst/gssapi.h>
-#include <pk11/site.h>
+
+#include "dst_internal.h"
 
 #define TEMP_BUFFER_SZ	   8192
 #define TKEY_RANDOM_AMOUNT 16
diff --git a/lib/dns/tsec.c b/lib/dns/tsec.c
index 05e2e279352..bcd196182c1 100644
--- a/lib/dns/tsec.c
+++ b/lib/dns/tsec.c
@@ -12,12 +12,13 @@
 #include <isc/mem.h>
 #include <isc/util.h>
 
+#include <pk11/site.h>
+
 #include <dns/result.h>
 #include <dns/tsec.h>
 #include <dns/tsig.h>
 
 #include <dst/dst.h>
-#include <pk11/site.h>
 
 #define DNS_TSEC_MAGIC	  ISC_MAGIC('T', 's', 'e', 'c')
 #define DNS_TSEC_VALID(t) ISC_MAGIC_VALID(t, DNS_TSEC_MAGIC)
diff --git a/lib/dns/tsig.c b/lib/dns/tsig.c
index 94787c970a1..02a6775502b 100644
--- a/lib/dns/tsig.c
+++ b/lib/dns/tsig.c
@@ -24,6 +24,8 @@
 #include <isc/time.h>
 #include <isc/util.h>
 
+#include <pk11/site.h>
+
 #include <dns/fixedname.h>
 #include <dns/keyvalues.h>
 #include <dns/log.h>
@@ -36,10 +38,9 @@
 #include <dns/result.h>
 #include <dns/tsig.h>
 
-#include "tsig_p.h"
-
 #include <dst/result.h>
-#include <pk11/site.h>
+
+#include "tsig_p.h"
 
 #define TSIG_MAGIC	  ISC_MAGIC('T', 'S', 'I', 'G')
 #define VALID_TSIG_KEY(x) ISC_MAGIC_VALID(x, TSIG_MAGIC)
diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 04f4b8e74b4..90edb339a69 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -83,10 +83,10 @@
 #include <dns/zoneverify.h>
 #include <dns/zt.h>
 
-#include "zone_p.h"
-
 #include <dst/dst.h>
 
+#include "zone_p.h"
+
 #define ZONE_MAGIC	     ISC_MAGIC('Z', 'O', 'N', 'E')
 #define DNS_ZONE_VALID(zone) ISC_MAGIC_VALID(zone, ZONE_MAGIC)
 
diff --git a/lib/irs/resconf.c b/lib/irs/resconf.c
index 36dea5720d4..532a8cd0e18 100644
--- a/lib/irs/resconf.c
+++ b/lib/irs/resconf.c
@@ -34,7 +34,6 @@
 
 #ifndef WIN32
 #include <netdb.h>
-
 #include <sys/socket.h>
 #include <sys/types.h>
 #endif /* ifndef WIN32 */
diff --git a/lib/irs/win32/resconf.c b/lib/irs/win32/resconf.c
index e972b9cffc2..466b7fb73c0 100644
--- a/lib/irs/win32/resconf.c
+++ b/lib/irs/win32/resconf.c
@@ -22,7 +22,6 @@
 #define HAVE_GET_WIN32_NAMESERVERS 1
 
 #include "../resconf.c"
-
 #include <iphlpapi.h>
 
 #define TCPIP_SUBKEY "SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters"
diff --git a/lib/isc/aes.c b/lib/isc/aes.c
index 4d9cadb5cd7..faf5dcfe071 100644
--- a/lib/isc/aes.c
+++ b/lib/isc/aes.c
@@ -11,6 +11,9 @@
 
 /*! \file isc/aes.c */
 
+#include <openssl/evp.h>
+#include <openssl/opensslv.h>
+
 #include <isc/aes.h>
 #include <isc/assertions.h>
 #include <isc/platform.h>
@@ -18,9 +21,6 @@
 #include <isc/types.h>
 #include <isc/util.h>
 
-#include <openssl/evp.h>
-#include <openssl/opensslv.h>
-
 #if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
 #define EVP_CIPHER_CTX_new()   &(_context), EVP_CIPHER_CTX_init(&_context)
 #define EVP_CIPHER_CTX_free(c) RUNTIME_CHECK(EVP_CIPHER_CTX_cleanup(c) == 1)
diff --git a/lib/isc/app.c b/lib/isc/app.c
index 9513780948b..28f46568c72 100644
--- a/lib/isc/app.c
+++ b/lib/isc/app.c
@@ -15,14 +15,12 @@
 #include <stdbool.h>
 #include <stddef.h>
 #include <stdlib.h>
-#include <unistd.h>
-
 #include <sys/types.h>
+#include <unistd.h>
 
 #ifndef WIN32
 #include <inttypes.h>
 #include <signal.h>
-
 #include <sys/time.h>
 #endif /* WIN32 */
 
diff --git a/lib/isc/entropy.c b/lib/isc/entropy.c
index 9e0ba1da4f6..727e206b726 100644
--- a/lib/isc/entropy.c
+++ b/lib/isc/entropy.c
@@ -9,14 +9,14 @@
  * information regarding copyright ownership.
  */
 
+#include <openssl/err.h>
+#include <openssl/rand.h>
+
 #include <isc/types.h>
 #include <isc/util.h>
 
 #include "entropy_private.h"
 
-#include <openssl/err.h>
-#include <openssl/rand.h>
-
 void
 isc_entropy_get(void *buf, size_t buflen) {
 	if (RAND_bytes(buf, buflen) < 1) {
diff --git a/lib/isc/hmac.c b/lib/isc/hmac.c
index b5b3f1f412d..4a9c97abc85 100644
--- a/lib/isc/hmac.c
+++ b/lib/isc/hmac.c
@@ -9,6 +9,9 @@
  * information regarding copyright ownership.
  */
 
+#include <openssl/hmac.h>
+#include <openssl/opensslv.h>
+
 #include <isc/assertions.h>
 #include <isc/hmac.h>
 #include <isc/md.h>
@@ -20,9 +23,6 @@
 
 #include "openssl_shim.h"
 
-#include <openssl/hmac.h>
-#include <openssl/opensslv.h>
-
 isc_hmac_t *
 isc_hmac_new(void) {
 	isc_hmac_t *hmac = HMAC_CTX_new();
diff --git a/lib/isc/log.c b/lib/isc/log.c
index bb2cf59b57e..3b5e5b6e6af 100644
--- a/lib/isc/log.c
+++ b/lib/isc/log.c
@@ -16,6 +16,7 @@
 #include <limits.h>
 #include <stdbool.h>
 #include <stdlib.h>
+#include <sys/types.h> /* dev_t FreeBSD 2.1 */
 #include <time.h>
 
 #include <isc/dir.h>
@@ -31,8 +32,6 @@
 #include <isc/time.h>
 #include <isc/util.h>
 
-#include <sys/types.h> /* dev_t FreeBSD 2.1 */
-
 #define LCTX_MAGIC	    ISC_MAGIC('L', 'c', 't', 'x')
 #define VALID_CONTEXT(lctx) ISC_MAGIC_VALID(lctx, LCTX_MAGIC)
 
diff --git a/lib/isc/md.c b/lib/isc/md.c
index 101a16cdd90..0c572cc7556 100644
--- a/lib/isc/md.c
+++ b/lib/isc/md.c
@@ -11,15 +11,15 @@
 
 #include <stdio.h>
 
+#include <openssl/err.h>
+#include <openssl/evp.h>
+#include <openssl/opensslv.h>
+
 #include <isc/md.h>
 #include <isc/util.h>
 
 #include "openssl_shim.h"
 
-#include <openssl/err.h>
-#include <openssl/evp.h>
-#include <openssl/opensslv.h>
-
 isc_md_t *
 isc_md_new(void) {
 	isc_md_t *md = EVP_MD_CTX_new();
diff --git a/lib/isc/netmgr/uv-compat.c b/lib/isc/netmgr/uv-compat.c
index 41dc0cd96d8..4b6cbd74166 100644
--- a/lib/isc/netmgr/uv-compat.c
+++ b/lib/isc/netmgr/uv-compat.c
@@ -10,7 +10,6 @@
  */
 
 #include "uv-compat.h"
-
 #include <unistd.h>
 
 #include <isc/util.h>
@@ -92,7 +91,6 @@ isc_uv_import(uv_stream_t *stream, isc_uv_stream_info_t *info) {
 #else /* WIN32 */
 /* Adapted from libuv/src/unix/internal.h */
 #include <fcntl.h>
-
 #include <sys/ioctl.h>
 
 static int
diff --git a/lib/isc/openssl_shim.c b/lib/isc/openssl_shim.c
index c3c3dd3540d..2f9995b92a5 100644
--- a/lib/isc/openssl_shim.c
+++ b/lib/isc/openssl_shim.c
@@ -10,7 +10,6 @@
  */
 
 #include "openssl_shim.h"
-
 #include <stdlib.h>
 #include <string.h>
 
diff --git a/lib/isc/pk11.c b/lib/isc/pk11.c
index f39cfaae915..78e43326d19 100644
--- a/lib/isc/pk11.c
+++ b/lib/isc/pk11.c
@@ -27,7 +27,6 @@
 #include <isc/thread.h>
 #include <isc/util.h>
 
-#include <dst/result.h>
 #include <pk11/internal.h>
 #include <pk11/pk11.h>
 #include <pk11/result.h>
@@ -35,6 +34,8 @@
 #include <pkcs11/eddsa.h>
 #include <pkcs11/pkcs11.h>
 
+#include <dst/result.h>
+
 /* was 32 octets, Petr Spacek suggested 1024, SoftHSMv2 uses 256... */
 #ifndef PINLEN
 #define PINLEN 256
diff --git a/lib/isc/pthreads/mutex.c b/lib/isc/pthreads/mutex.c
index cae12d22c13..899406ef73d 100644
--- a/lib/isc/pthreads/mutex.c
+++ b/lib/isc/pthreads/mutex.c
@@ -14,6 +14,7 @@
 #include <errno.h>
 #include <stdbool.h>
 #include <stdio.h>
+#include <sys/time.h>
 #include <time.h>
 
 #include <isc/mutex.h>
@@ -23,8 +24,6 @@
 #include <isc/string.h>
 #include <isc/util.h>
 
-#include <sys/time.h>
-
 #if ISC_MUTEX_PROFILE
 
 /*@{*/
diff --git a/lib/isc/tests/isctest.c b/lib/isc/tests/isctest.c
index cfc29a9ab65..ba8fa7ac79a 100644
--- a/lib/isc/tests/isctest.c
+++ b/lib/isc/tests/isctest.c
@@ -12,7 +12,6 @@
 /*! \file */
 
 #include "isctest.h"
-
 #include <inttypes.h>
 #include <stdbool.h>
 #include <stdlib.h>
diff --git a/lib/isc/unix/dir.c b/lib/isc/unix/dir.c
index 82a25e34c1d..cc850341f5f 100644
--- a/lib/isc/unix/dir.c
+++ b/lib/isc/unix/dir.c
@@ -13,6 +13,8 @@
 
 #include <ctype.h>
 #include <errno.h>
+#include <sys/stat.h>
+#include <sys/types.h>
 #include <unistd.h>
 
 #include <isc/dir.h>
@@ -24,9 +26,6 @@
 
 #include "errno2result.h"
 
-#include <sys/stat.h>
-#include <sys/types.h>
-
 #define ISC_DIR_MAGIC  ISC_MAGIC('D', 'I', 'R', '*')
 #define VALID_DIR(dir) ISC_MAGIC_VALID(dir, ISC_DIR_MAGIC)
 
diff --git a/lib/isc/unix/errno2result.c b/lib/isc/unix/errno2result.c
index 58c137f7f25..e3e2644dde6 100644
--- a/lib/isc/unix/errno2result.c
+++ b/lib/isc/unix/errno2result.c
@@ -12,7 +12,6 @@
 /*! \file */
 
 #include "errno2result.h"
-
 #include <stdbool.h>
 
 #include <isc/platform.h>
diff --git a/lib/isc/unix/file.c b/lib/isc/unix/file.c
index e5555f3514f..2ff411d15ab 100644
--- a/lib/isc/unix/file.c
+++ b/lib/isc/unix/file.c
@@ -46,11 +46,10 @@
 #include <limits.h>
 #include <stdbool.h>
 #include <stdlib.h>
-#include <time.h>   /* Required for utimes on some platforms. */
-#include <unistd.h> /* Required for mkstemp on NetBSD. */
-
 #include <sys/stat.h>
 #include <sys/time.h>
+#include <time.h>   /* Required for utimes on some platforms. */
+#include <unistd.h> /* Required for mkstemp on NetBSD. */
 
 #ifdef HAVE_SYS_MMAN_H
 #include <sys/mman.h>
diff --git a/lib/isc/unix/fsaccess.c b/lib/isc/unix/fsaccess.c
index ea18c2d8d01..bade1c2bbf2 100644
--- a/lib/isc/unix/fsaccess.c
+++ b/lib/isc/unix/fsaccess.c
@@ -11,12 +11,11 @@
 
 #include <errno.h>
 #include <stdbool.h>
-
-#include "errno2result.h"
-
 #include <sys/stat.h>
 #include <sys/types.h>
 
+#include "errno2result.h"
+
 /*! \file
  * \brief
  * The OS-independent part of the API is in lib/isc.
diff --git a/lib/isc/unix/include/isc/dir.h b/lib/isc/unix/include/isc/dir.h
index 9d789c40d76..30fda926a96 100644
--- a/lib/isc/unix/include/isc/dir.h
+++ b/lib/isc/unix/include/isc/dir.h
@@ -15,13 +15,12 @@
 /*! \file */
 
 #include <dirent.h>
+#include <sys/types.h> /* Required on some systems. */
 
 #include <isc/lang.h>
 #include <isc/platform.h>
 #include <isc/result.h>
 
-#include <sys/types.h> /* Required on some systems. */
-
 /*% Directory Entry */
 typedef struct isc_direntry {
 	char name[NAME_MAX];
diff --git a/lib/isc/unix/include/isc/net.h b/lib/isc/unix/include/isc/net.h
index b8cd5c87f6a..f37c173b583 100644
--- a/lib/isc/unix/include/isc/net.h
+++ b/lib/isc/unix/include/isc/net.h
@@ -64,18 +64,17 @@
 /***
  *** Imports.
  ***/
-#include <inttypes.h>
-
-#include <isc/lang.h>
-#include <isc/platform.h>
-#include <isc/types.h>
-
 #include <arpa/inet.h> /* Contractual promise. */
+#include <inttypes.h>
 #include <net/if.h>
 #include <netinet/in.h> /* Contractual promise. */
 #include <sys/socket.h> /* Contractual promise. */
 #include <sys/types.h>
 
+#include <isc/lang.h>
+#include <isc/platform.h>
+#include <isc/types.h>
+
 #ifndef IN6ADDR_LOOPBACK_INIT
 #ifdef s6_addr
 /*% IPv6 address loopback init */
diff --git a/lib/isc/unix/include/isc/offset.h b/lib/isc/unix/include/isc/offset.h
index 06d6aa36266..1c8dece3dbc 100644
--- a/lib/isc/unix/include/isc/offset.h
+++ b/lib/isc/unix/include/isc/offset.h
@@ -18,7 +18,6 @@
  */
 #include <limits.h> /* Required for CHAR_BIT. */
 #include <stddef.h> /* For Linux Standard Base. */
-
 #include <sys/types.h>
 
 typedef off_t isc_offset_t;
diff --git a/lib/isc/unix/net.c b/lib/isc/unix/net.c
index c1c907de947..bf11cccaf53 100644
--- a/lib/isc/unix/net.c
+++ b/lib/isc/unix/net.c
@@ -10,7 +10,6 @@
  */
 
 #include <stdbool.h>
-
 #include <sys/types.h>
 
 #if defined(HAVE_SYS_SYSCTL_H) && !defined(__linux__)
@@ -21,6 +20,7 @@
 #endif /* if defined(HAVE_SYS_SYSCTL_H) && !defined(__linux__) */
 #include <errno.h>
 #include <fcntl.h>
+#include <sys/uio.h>
 #include <unistd.h>
 
 #include <isc/log.h>
@@ -31,8 +31,6 @@
 #include <isc/string.h>
 #include <isc/util.h>
 
-#include <sys/uio.h>
-
 #ifndef socklen_t
 #define socklen_t unsigned int
 #endif /* ifndef socklen_t */
diff --git a/lib/isc/unix/resource.c b/lib/isc/unix/resource.c
index 0a81638e265..1541fe8af3c 100644
--- a/lib/isc/unix/resource.c
+++ b/lib/isc/unix/resource.c
@@ -11,16 +11,15 @@
 
 #include <inttypes.h>
 #include <stdbool.h>
+#include <sys/resource.h>
+#include <sys/time.h> /* Required on some systems for <sys/resource.h>. */
+#include <sys/types.h>
 
 #include <isc/platform.h>
 #include <isc/resource.h>
 #include <isc/result.h>
 #include <isc/util.h>
 
-#include <sys/resource.h>
-#include <sys/time.h> /* Required on some systems for <sys/resource.h>. */
-#include <sys/types.h>
-
 #ifdef __linux__
 #include <linux/fs.h> /* To get the large NR_OPEN. */
 #endif		      /* ifdef __linux__ */
diff --git a/lib/isc/unix/socket.c b/lib/isc/unix/socket.c
index e7800a52cd3..da2b7d01535 100644
--- a/lib/isc/unix/socket.c
+++ b/lib/isc/unix/socket.c
@@ -13,7 +13,6 @@
 
 #include <inttypes.h>
 #include <stdbool.h>
-
 #include <sys/param.h>
 #include <sys/socket.h>
 #include <sys/stat.h>
@@ -74,10 +73,10 @@
 #include <devpoll.h>
 #endif /* if defined(HAVE_SYS_DEVPOLL_H) */
 
-#include "errno2result.h"
-
 #include <netinet/tcp.h>
 
+#include "errno2result.h"
+
 #ifdef ENABLE_TCP_FASTOPEN
 #include <netinet/tcp.h>
 #endif /* ifdef ENABLE_TCP_FASTOPEN */
diff --git a/lib/isc/unix/stdtime.c b/lib/isc/unix/stdtime.c
index 9886e921f4f..33c86714af2 100644
--- a/lib/isc/unix/stdtime.c
+++ b/lib/isc/unix/stdtime.c
@@ -14,13 +14,12 @@
 #include <stdbool.h>
 #include <stddef.h> /* NULL */
 #include <stdlib.h> /* NULL */
+#include <sys/time.h>
 #include <syslog.h>
 
 #include <isc/stdtime.h>
 #include <isc/util.h>
 
-#include <sys/time.h>
-
 #ifndef ISC_FIX_TV_USEC
 #define ISC_FIX_TV_USEC 1
 #endif /* ifndef ISC_FIX_TV_USEC */
diff --git a/lib/isc/unix/time.c b/lib/isc/unix/time.c
index 86dfca606df..8fc1ec8c4ce 100644
--- a/lib/isc/unix/time.c
+++ b/lib/isc/unix/time.c
@@ -16,6 +16,7 @@
 #include <limits.h>
 #include <stdbool.h>
 #include <stdlib.h>
+#include <sys/time.h> /* Required for struct timeval on some platforms. */
 #include <syslog.h>
 #include <time.h>
 
@@ -28,8 +29,6 @@
 #include <isc/tm.h>
 #include <isc/util.h>
 
-#include <sys/time.h> /* Required for struct timeval on some platforms. */
-
 #define NS_PER_S  1000000000 /*%< Nanoseconds per second. */
 #define NS_PER_US 1000	     /*%< Nanoseconds per microsecond. */
 #define NS_PER_MS 1000000    /*%< Nanoseconds per millisecond. */
diff --git a/lib/isc/win32/dir.c b/lib/isc/win32/dir.c
index 898fb7a9721..dedc7236dff 100644
--- a/lib/isc/win32/dir.c
+++ b/lib/isc/win32/dir.c
@@ -13,6 +13,7 @@
 #include <io.h>
 #include <process.h>
 #include <string.h>
+#include <sys/stat.h>
 
 #include <isc/assertions.h>
 #include <isc/dir.h>
@@ -23,8 +24,6 @@
 
 #include "errno2result.h"
 
-#include <sys/stat.h>
-
 #define ISC_DIR_MAGIC  ISC_MAGIC('D', 'I', 'R', '*')
 #define VALID_DIR(dir) ISC_MAGIC_VALID(dir, ISC_DIR_MAGIC)
 
diff --git a/lib/isc/win32/errno2result.c b/lib/isc/win32/errno2result.c
index ba73f80913a..838811a5759 100644
--- a/lib/isc/win32/errno2result.c
+++ b/lib/isc/win32/errno2result.c
@@ -10,7 +10,6 @@
  */
 
 #include "errno2result.h"
-
 #include <stdbool.h>
 #include <winsock2.h>
 
diff --git a/lib/isc/win32/file.c b/lib/isc/win32/file.c
index 41472b76b52..7e5e07539d6 100644
--- a/lib/isc/win32/file.c
+++ b/lib/isc/win32/file.c
@@ -18,6 +18,8 @@
 #include <process.h>
 #include <stdbool.h>
 #include <stdlib.h>
+#include <sys/stat.h>
+#include <sys/utime.h>
 
 #include <isc/file.h>
 #include <isc/md.h>
@@ -33,9 +35,6 @@
 
 #include "errno2result.h"
 
-#include <sys/stat.h>
-#include <sys/utime.h>
-
 static const char alphnum[] = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuv"
 			      "wxyz0123456789";
 
diff --git a/lib/isc/win32/fsaccess.c b/lib/isc/win32/fsaccess.c
index 3342f7c5e77..030d8884e53 100644
--- a/lib/isc/win32/fsaccess.c
+++ b/lib/isc/win32/fsaccess.c
@@ -23,6 +23,8 @@
 #include <errno.h>
 #include <io.h>
 #include <stdbool.h>
+#include <sys/stat.h>
+#include <sys/types.h>
 
 #include <isc/file.h>
 #include <isc/stat.h>
@@ -30,9 +32,6 @@
 
 #include "errno2result.h"
 
-#include <sys/stat.h>
-#include <sys/types.h>
-
 /*
  * The OS-independent part of the API is in lib/isc.
  */
diff --git a/lib/isc/win32/include/isc/net.h b/lib/isc/win32/include/isc/net.h
index c6b56acd6a3..af0019ca43e 100644
--- a/lib/isc/win32/include/isc/net.h
+++ b/lib/isc/win32/include/isc/net.h
@@ -76,6 +76,7 @@
 #define _WINSOCKAPI_ /* Prevent inclusion of winsock.h in windows.h */
 #endif		     /* ifndef _WINSOCKAPI_ */
 
+#include <sys/types.h>
 #include <winsock2.h>
 #include <ws2tcpip.h>
 
@@ -83,8 +84,6 @@
 #include <isc/lang.h>
 #include <isc/types.h>
 
-#include <sys/types.h>
-
 /*
  * This is here because named client, interfacemgr.c, etc. use the name as
  * a variable
diff --git a/lib/isc/win32/include/isc/offset.h b/lib/isc/win32/include/isc/offset.h
index 2e4090a6efd..985d05aac5d 100644
--- a/lib/isc/win32/include/isc/offset.h
+++ b/lib/isc/win32/include/isc/offset.h
@@ -16,7 +16,6 @@
  * File offsets are operating-system dependent.
  */
 #include <limits.h> /* Required for CHAR_BIT. */
-
 #include <sys/types.h>
 
 typedef _off_t isc_offset_t;
diff --git a/lib/isc/win32/interfaceiter.c b/lib/isc/win32/interfaceiter.c
index 39994a6f032..a9fcd295dc9 100644
--- a/lib/isc/win32/interfaceiter.c
+++ b/lib/isc/win32/interfaceiter.c
@@ -17,6 +17,7 @@
 #include <stdbool.h>
 #include <stdio.h>
 #include <stdlib.h>
+#include <sys/types.h>
 #include <winsock2.h>
 #include <ws2tcpip.h>
 
@@ -29,8 +30,6 @@
 #include <isc/types.h>
 #include <isc/util.h>
 
-#include <sys/types.h>
-
 void
 InitSockets(void);
 
diff --git a/lib/isc/win32/stdio.c b/lib/isc/win32/stdio.c
index 0b214437a44..9bfb7f92847 100644
--- a/lib/isc/win32/stdio.c
+++ b/lib/isc/win32/stdio.c
@@ -11,15 +11,14 @@
 
 #include <errno.h>
 #include <io.h>
+#include <sys/stat.h>
+#include <sys/types.h>
 
 #include <isc/stdio.h>
 #include <isc/util.h>
 
 #include "errno2result.h"
 
-#include <sys/stat.h>
-#include <sys/types.h>
-
 isc_result_t
 isc_stdio_open(const char *filename, const char *mode, FILE **fp) {
 	FILE *f;
diff --git a/lib/isccc/cc.c b/lib/isccc/cc.c
index 47c093eac42..e781e92e2d2 100644
--- a/lib/isccc/cc.c
+++ b/lib/isccc/cc.c
@@ -36,6 +36,8 @@
 #include <isc/print.h>
 #include <isc/safe.h>
 
+#include <pk11/site.h>
+
 #include <isccc/alist.h>
 #include <isccc/base64.h>
 #include <isccc/cc.h>
@@ -44,7 +46,6 @@
 #include <isccc/symtab.h>
 #include <isccc/symtype.h>
 #include <isccc/util.h>
-#include <pk11/site.h>
 
 #define MAX_TAGS     256
 #define DUP_LIFETIME 900
diff --git a/lib/ns/tests/nstest.c b/lib/ns/tests/nstest.c
index 2e09d9662fe..38cf4db69bd 100644
--- a/lib/ns/tests/nstest.c
+++ b/lib/ns/tests/nstest.c
@@ -12,7 +12,6 @@
 /*! \file */
 
 #include "nstest.h"
-
 #include <inttypes.h>
 #include <stdbool.h>
 #include <stdlib.h>
diff --git a/lib/samples/nsprobe.c b/lib/samples/nsprobe.c
index 1a1f7bf12cd..5ac09c8b673 100644
--- a/lib/samples/nsprobe.c
+++ b/lib/samples/nsprobe.c
@@ -11,10 +11,9 @@
 
 #ifndef WIN32
 #include <netdb.h>
-#include <unistd.h>
-
 #include <sys/socket.h>
 #include <sys/types.h>
+#include <unistd.h>
 #endif /* ifndef WIN32 */
 
 #include <stdbool.h>
diff --git a/lib/samples/resolve.c b/lib/samples/resolve.c
index 005ec1daf0b..14666350833 100644
--- a/lib/samples/resolve.c
+++ b/lib/samples/resolve.c
@@ -10,13 +10,12 @@
  */
 
 #ifndef WIN32
-#include <netdb.h>
-#include <unistd.h>
-
 #include <arpa/inet.h>
+#include <netdb.h>
 #include <netinet/in.h>
 #include <sys/socket.h>
 #include <sys/types.h>
+#include <unistd.h>
 #endif /* ifndef WIN32 */
 
 #include <stdbool.h>
@@ -50,6 +49,7 @@
 #include <dns/secalg.h>
 
 #include <dst/dst.h>
+
 #include <irs/netdb.h>
 #include <irs/resconf.h>
 
diff --git a/lib/samples/sample-async.c b/lib/samples/sample-async.c
index c0fb6fecfa7..302d31212df 100644
--- a/lib/samples/sample-async.c
+++ b/lib/samples/sample-async.c
@@ -10,12 +10,11 @@
  */
 
 #ifndef WIN32
-#include <unistd.h>
-
 #include <arpa/inet.h>
 #include <netinet/in.h>
 #include <sys/socket.h>
 #include <sys/types.h>
+#include <unistd.h>
 #endif /* ifndef WIN32 */
 
 #include <stdbool.h>
diff --git a/lib/samples/sample-request.c b/lib/samples/sample-request.c
index 6378f033784..d3290c4b557 100644
--- a/lib/samples/sample-request.c
+++ b/lib/samples/sample-request.c
@@ -10,13 +10,12 @@
  */
 
 #ifndef WIN32
-#include <netdb.h>
-#include <unistd.h>
-
 #include <arpa/inet.h>
+#include <netdb.h>
 #include <netinet/in.h>
 #include <sys/socket.h>
 #include <sys/types.h>
+#include <unistd.h>
 #endif /* ifndef WIN32 */
 
 #include <stdio.h>
diff --git a/lib/samples/sample-update.c b/lib/samples/sample-update.c
index b40b56059c6..1ed3d7bd457 100644
--- a/lib/samples/sample-update.c
+++ b/lib/samples/sample-update.c
@@ -10,13 +10,12 @@
  */
 
 #ifndef WIN32
-#include <netdb.h>
-#include <unistd.h>
-
 #include <arpa/inet.h>
+#include <netdb.h>
 #include <netinet/in.h>
 #include <sys/socket.h>
 #include <sys/types.h>
+#include <unistd.h>
 #endif /* ifndef WIN32 */
 
 #include <ctype.h>