Import of pkgsrc-2013Q2

security/openssl/DESCR

@@ -0,0 +1,8 @@
+The OpenSSL Project is a collaborative effort to develop a
+robust, commercial-grade, full-featured, and Open Source
+toolkit implementing the Secure Sockets Layer (SSL v2/v3)
+and Transport Layer Security (TLS v1) protocols as well as
+a full-strength general purpose cryptography library. The
+project is managed by a worldwide community of volunteers
+that use the Internet to communicate, plan, and develop the
+OpenSSL toolkit and its related documentation.

security/openssl/Makefile

@@ -0,0 +1,145 @@
+# $NetBSD: Makefile,v 1.178 2013/06/07 07:17:15 obache Exp $
+
+DISTNAME=	openssl-1.0.1e
+MASTER_SITES=	http://ftp.openssl.org/source/
+PKGREVISION=	1
+SVR4_PKGNAME=	ossl
+CATEGORIES=	security
+
+MAINTAINER=	pkgsrc-users@NetBSD.org
+HOMEPAGE=	http://www.openssl.org/
+COMMENT=	Secure Socket Layer and cryptographic library
+
+CONFLICTS=	SSLeay-[0-9]* ssleay-[0-9]*
+
+CRYPTO=		yes
+
+PKG_INSTALLATION_TYPES=	overwrite pkgviews
+
+BUILD_DEPENDS+=	p5-Perl4-CoreLibs-[0-9]*:../../devel/p5-Perl4-CoreLibs
+
+.include "../../mk/bsd.prefs.mk"
+.include "../../mk/compiler.mk"
+
+EXTRACT_USING=		gtar
+USE_TOOLS+=		fgrep gmake perl
+TEST_TARGET=		tests
+MAKE_JOBS_SAFE=		no
+
+HAS_CONFIGURE=		yes
+CONFIGURE_SCRIPT=	./config
+CONFIGURE_ARGS+=	--prefix=${PREFIX:Q}
+CONFIGURE_ARGS+=	--install_prefix=${DESTDIR}
+CONFIGURE_ARGS+=	--openssldir=${PKG_SYSCONFDIR:Q}
+CONFIGURE_ARGS+=	shared no-fips
+
+.if ${OPSYS} == "SunOS"
+.  if ${MACHINE_ARCH} == "sparc"
+OPENSSL_MACHINE_ARCH=	${SPARC_TARGET_ARCH}
+.  elif ${MACHINE_ARCH} == "i386"
+OPENSSL_MACHINE_ARCH=	x86
+.  elif ${MACHINE_ARCH} == "x86_64"
+OPENSSL_MACHINE_ARCH=	${MACHINE_ARCH}
+.  endif
+# only override the configure target if we know the platform, falling
+# back to ./config's autodetection if not.
+.  if defined(OPENSSL_MACHINE_ARCH) && !empty(OPENSSL_MACHINE_ARCH)
+CONFIGURE_SCRIPT=	./Configure
+.    if !empty(CC_VERSION:Mgcc*)
+CONFIGURE_ARGS+=	solaris${${ABI}==64:?64:}-${OPENSSL_MACHINE_ARCH}-gcc
+.    else
+CONFIGURE_ARGS+=	solaris${${ABI}==64:?64:}-${OPENSSL_MACHINE_ARCH}-cc
+.    endif
+.  endif
+.elif ${OPSYS} == "IRIX"
+CONFIGURE_ARGS+=	no-asm
+.  if ${ABI} == "64"
+CONFIGURE_SCRIPT=	./Configure
+.    if !empty(CC_VERSION:Mgcc*)
+CONFIGURE_ARGS+=	irix64-mips4-gcc
+.    else
+CONFIGURE_ARGS+=	irix64-mips4-cc
+.    endif
+.  endif
+.elif ${OPSYS} == "OSF1"
+PLIST_OPSYS=		PLIST.osf1
+CONFIGURE_SCRIPT=	./Configure
+.  if !empty(CC_VERSION:Mgcc*)
+CONFIGURE_ARGS+=	tru64-alpha-gcc
+.  else
+CONFIGURE_ARGS+=	tru64-alpha-cc
+.  endif
+.elif ${OPSYS} == "Darwin"
+CONFIGURE_SCRIPT=	./Configure
+.  if defined(ABI) && ${ABI} == "64"
+CONFIGURE_ARGS+=	darwin64-${MACHINE_ARCH}-cc
+.  elif ${MACHINE_ARCH} == "powerpc"
+CONFIGURE_ARGS+=	darwin-ppc-cc
+.  else
+CONFIGURE_ARGS+=	darwin-${MACHINE_ARCH}-cc
+.  endif
+
+.include "../../mk/dlopen.buildlink3.mk"
+
+SUBST_CLASSES+=		dl
+SUBST_MESSAGE.dl=	Adding dynamic link compatibility library.
+SUBST_STAGE.dl=		post-configure
+SUBST_FILES.dl=		Makefile apps/Makefile crypto/Makefile \
+			crypto/pkcs7/Makefile test/Makefile
+SUBST_SED.dl=		-e 's,^EX_LIBS=,EX_LIBS=${DL_LDFLAGS:Q} ,g'
+
+.elif ${OPSYS} == "Interix"
+
+SUBST_CLASSES+=		soname
+SUBST_STAGE.soname=	post-configure
+SUBST_FILES.soname=	Makefile.shared
+SUBST_SED.soname=	-e 's/-Wl,-soname=/-Wl,-h,/g'
+
+.elif ${OPSYS} == "HPUX"
+
+CONFIGURE_SCRIPT=	./Configure
+
+.  if ${ABI} == "64"
+.    if ${MACHINE_ARCH} == "hppa"
+CONFIGURE_ARGS+=	hpux64-parisc2-${CC}
+.    else
+CONFIGURE_ARGS+=	hpux64-ia64-${CC}
+.    endif
+.  else
+.    if ${MACHINE_ARCH} == "hppa"
+CONFIGURE_ARGS+=	hpux-parisc-${CC}
+.    else
+CONFIGURE_ARGS+=	hpux-ia64-${CC}
+.    endif
+.  endif
+
+.endif
+
+.include "../../security/openssl/options.mk"
+
+CONFIGURE_ARGS+=	${CFLAGS} ${LDFLAGS}
+CONFIGURE_ENV+=		PERL=${PERL5:Q}
+
+PLIST_OPSYS?=		${PKGDIR}/PLIST.${LOWER_OPSYS:C/([.0-9]*)$//}
+.if exists(${PLIST_OPSYS})
+PLIST_SHLIB=		${PLIST_OPSYS}
+.else
+PLIST_SHLIB=		${PKGDIR}/PLIST.shlib
+.endif
+PLIST_SRC=		${PLIST_SHLIB}
+PLIST_SRC+=		${PKGDIR}/PLIST.common
+PLIST_SUBST+=		SHLIB_VERSION=${OPENSSL_VERS:C/[^0-9]*$//}
+PLIST_SUBST+=		SHLIB_MAJOR=${OPENSSL_VERS:C/\..*$//}
+
+PKG_SYSCONFSUBDIR=	openssl
+CONF_FILES=		${PREFIX}/share/examples/openssl/openssl.cnf	\
+			${PKG_SYSCONFDIR}/openssl.cnf
+OWN_DIRS=		${PKG_SYSCONFDIR}/certs ${PKG_SYSCONFDIR}/private
+
+INSTALLATION_DIRS+=	share/examples/openssl
+
+# Fix the path to perl in various scripts.
+pre-configure:
+	cd ${WRKSRC} && ${PERL5} util/perlpath.pl ${PERL5}
+
+.include "../../mk/bsd.pkg.mk"

security/openssl/PLIST.osf1

@@ -0,0 +1,3 @@
+@comment $NetBSD: PLIST.osf1,v 1.1 2007/08/04 14:29:43 tnn Exp $
+lib/libcrypto.so
+lib/libssl.so

security/openssl/PLIST.shlib

@@ -0,0 +1,5 @@
+@comment $NetBSD: PLIST.shlib,v 1.3 2013/02/06 21:40:33 jperkin Exp $
+lib/libcrypto.so
+lib/libcrypto.so.1.0.0
+lib/libssl.so
+lib/libssl.so.1.0.0

security/openssl/buildlink3.mk

@@ -0,0 +1,26 @@
+# $NetBSD: buildlink3.mk,v 1.47 2013/04/03 11:56:20 obache Exp $
+
+BUILDLINK_TREE+=	openssl
+
+.if !defined(OPENSSL_BUILDLINK3_MK)
+OPENSSL_BUILDLINK3_MK:=
+
+.  include "../../mk/bsd.fast.prefs.mk"
+
+BUILDLINK_API_DEPENDS.openssl+=	openssl>=0.9.6m
+BUILDLINK_ABI_DEPENDS.openssl+=	openssl>=1.0.1c
+BUILDLINK_PKGSRCDIR.openssl?=	../../security/openssl
+
+# Ensure that -lcrypt comes before -lcrypto when linking so that the
+# system crypt() routine is used.
+#
+.if ${OPSYS} != "Cygwin"
+WRAPPER_REORDER_CMDS+=	reorder:l:crypt:crypto
+.endif
+
+SSLBASE=	${BUILDLINK_PREFIX.openssl}
+BUILD_DEFS+=	SSLBASE
+
+.endif # OPENSSL_BUILDLINK3_MK
+
+BUILDLINK_TREE+=	-openssl

security/openssl/builtin.mk

@@ -0,0 +1,319 @@
+# $NetBSD: builtin.mk,v 1.33 2013/06/13 07:51:26 adam Exp $
+
+BUILTIN_PKG:=	openssl
+
+BUILTIN_FIND_LIBS:=		des
+BUILTIN_FIND_FILES_VAR:=	H_OPENSSLCONF H_OPENSSLV
+BUILTIN_FIND_FILES.H_OPENSSLCONF= /usr/include/openssl/opensslconf.h \
+				/usr/sfw/include/openssl/opensslconf.h \
+				/boot/common/include/openssl/opensslconf.h
+BUILTIN_FIND_FILES.H_OPENSSLV=	/usr/include/openssl/opensslv.h \
+				/usr/sfw/include/openssl/opensslv.h \
+				/boot/common/include/openssl/opensslv.h
+
+.include "../../mk/buildlink3/bsd.builtin.mk"
+
+###
+### Determine if there is a built-in implementation of the package and
+### set IS_BUILTIN.<pkg> appropriately ("yes" or "no").
+###
+.if !defined(IS_BUILTIN.openssl)
+IS_BUILTIN.openssl=	no
+.  if empty(H_OPENSSLV:M__nonexistent__) && empty(H_OPENSSLV:M${LOCALBASE}/*)
+IS_BUILTIN.openssl=	yes
+.  endif
+.endif
+MAKEVARS+=	IS_BUILTIN.openssl
+
+###
+### If there is a built-in implementation, then set BUILTIN_PKG.<pkg> to
+### a package name to represent the built-in package.
+###
+.if !defined(BUILTIN_PKG.openssl) && \
+    !empty(IS_BUILTIN.openssl:M[yY][eE][sS]) && \
+    empty(H_OPENSSLV:M__nonexistent__)
+BUILTIN_VERSION.openssl!=						\
+	${AWK} 'BEGIN { hex="0123456789abcdef";				\
+			split("abcdefghijklmnopqrstuvwxyz", alpha, "");	\
+		}							\
+		/\#define[ 	]*OPENSSL_VERSION_NUMBER/ {		\
+			major = index(hex, substr($$3, 3, 1)) - 1;	\
+			i = 16 * (index(hex, substr($$3, 4, 1)) - 1);	\
+			i += index(hex, substr($$3, 5, 1)) - 1;		\
+			minor = "."i;					\
+			i = 16 * (index(hex, substr($$3, 6, 1)) - 1);	\
+			i += index(hex, substr($$3, 7, 1)) - 1;		\
+			teeny = "."i;					\
+			i = 16 * (index(hex, substr($$3, 8, 1)) - 1);	\
+			i += index(hex, substr($$3, 9, 1)) - 1;		\
+			if (i == 0) {					\
+				patchlevel = "";			\
+			} else if (i > 26) {				\
+				patchlevel = "a";			\
+			} else {					\
+				patchlevel = alpha[i];			\
+			}						\
+			printf "%s%s%s%s\n",				\
+				major, minor, teeny, patchlevel;	\
+			exit 0;						\
+		}							\
+	' ${H_OPENSSLV}
+
+.  if !empty(BUILTIN_VERSION.openssl:M0\.9\.6g) && \
+      empty(H_OPENSSLV:M__nonexistent__)
+#
+# If the native OpenSSL contains the security fixes pulled up to the
+# netbsd-1-6 branch on 2003-11-07, then pretend it's openssl-0.9.6l.
+#
+BUILTIN_OPENSSL_HAS_20031107_FIX!=					\
+	${AWK} 'BEGIN { ans = "no" }					\
+		/OPENSSL_HAS_20031107_FIX/ { ans = "yes" }		\
+		END { print ans; exit 0 }				\
+	' ${H_OPENSSLV}
+.    if !empty(BUILTIN_OPENSSL_HAS_20031107_FIX:M[yY][eE][sS])
+BUILTIN_VERSION.openssl=	0.9.6l
+.    endif
+#
+# If the native OpenSSL contains the security fixes pulled up to the
+# netbsd-1-6 branch on 2004-04-01, then pretend it's openssl-0.9.6m.
+#
+BUILTIN_OPENSSL_HAS_20040401_FIX!=					\
+	${AWK} 'BEGIN { ans = "no" }					\
+		/OPENSSL_HAS_20040401_FIX/ { ans = "yes" }		\
+		END { print ans; exit 0 }				\
+	' ${H_OPENSSLV}
+.    if !empty(BUILTIN_OPENSSL_HAS_20040401_FIX:M[yY][eE][sS])
+BUILTIN_VERSION.openssl=	0.9.6m
+.    endif
+.  elif !empty(BUILTIN_VERSION.openssl:M0\.9\.7d) && \
+        empty(H_OPENSSLV:M__nonexistent__)
+#
+# If the native OpenSSL contains the security fixes pulled up to the
+# netbsd-2-0, netbsd-2, and netbsd-3-0 branches on 2005-10-11, then
+# pretend it's openssl-0.9.7h.
+#
+BUILTIN_OPENSSL_HAS_20051011_FIX!=					\
+	${AWK} 'BEGIN { ans = "no" }					\
+		/OPENSSL_HAS_20051011_FIX/ { ans = "yes" }		\
+		END { print ans; exit 0 }				\
+	' ${H_OPENSSLV}
+.    if !empty(BUILTIN_OPENSSL_HAS_20051011_FIX:M[yY][eE][sS])
+BUILTIN_VERSION.openssl=	0.9.7h
+.    endif
+.  endif
+BUILTIN_PKG.openssl=	openssl-${BUILTIN_VERSION.openssl}
+.endif
+MAKEVARS+=	BUILTIN_PKG.openssl
+MAKEVARS+=	BUILTIN_VERSION.openssl
+
+.if !defined(BUILTIN_OPENSSL_HAS_THREADS) && \
+    !empty(IS_BUILTIN.openssl:M[yY][eE][sS]) && \
+    empty(H_OPENSSLCONF:M__nonexistent__)
+BUILTIN_OPENSSL_HAS_THREADS!=						\
+	${AWK} 'BEGIN { ans = "no" }					\
+		/\#[ 	]*define[ 	]*OPENSSL_THREADS/ { ans= "yes" } \
+		/\#[ 	]*define[ 	]*THREADS/ { ans = "yes" }	\
+		END { print ans; exit 0 }				\
+	' ${H_OPENSSLCONF:Q}
+.endif
+MAKEVARS+=	BUILTIN_OPENSSL_HAS_THREADS
+
+###
+### Determine whether we should use the built-in implementation if it
+### exists, and set USE_BUILTIN.<pkg> appropriate ("yes" or "no").
+###
+.if !defined(USE_BUILTIN.openssl)
+.  if ${PREFER.openssl} == "pkgsrc"
+USE_BUILTIN.openssl=	no
+.  else
+USE_BUILTIN.openssl=	${IS_BUILTIN.openssl}
+.    if defined(BUILTIN_PKG.openssl) && \
+        !empty(IS_BUILTIN.openssl:M[yY][eE][sS])
+USE_BUILTIN.openssl=	yes
+.      for dep_ in ${BUILDLINK_API_DEPENDS.openssl}
+.        if !empty(USE_BUILTIN.openssl:M[yY][eE][sS])
+USE_BUILTIN.openssl!=							\
+	if ${PKG_ADMIN} pmatch ${dep_:Q} ${BUILTIN_PKG.openssl:Q}; then \
+		${ECHO} yes;						\
+	else								\
+		${ECHO} no;						\
+	fi
+.        endif
+.      endfor
+.    endif
+.    if !empty(IS_BUILTIN.openssl:M[yY][eE][sS]) && \
+	defined(USE_FEATURES.openssl)
+.      if !empty(USE_FEATURES.openssl:Mthreads) && \
+	  !empty(BUILTIN_OPENSSL_HAS_THREADS:M[nN][oO])
+USE_BUILTIN.openssl=	no
+.      endif
+.    endif
+.  endif  # PREFER.openssl
+.endif
+MAKEVARS+=	USE_BUILTIN.openssl
+
+###
+### The section below only applies if we are not including this file
+### solely to determine whether a built-in implementation exists.
+###
+CHECK_BUILTIN.openssl?=	no
+.if !empty(CHECK_BUILTIN.openssl:M[nN][oO])
+
+.  if !empty(USE_BUILTIN.openssl:M[yY][eE][sS])
+.    if empty(H_OPENSSLV:M__nonexistent__)
+.      if !empty(H_OPENSSLV:M/usr/sfw/*)
+BUILDLINK_PREFIX.openssl=	/usr/sfw
+BUILDLINK_PASSTHRU_DIRS+=	/usr/sfw
+.      elif !empty(H_OPENSSLV:M/usr/*)
+BUILDLINK_PREFIX.openssl=	/usr
+.      elif !empty(H_OPENSSLV:M/boot/common/*)
+BUILDLINK_PREFIX.openssl=	/boot/common
+.      endif
+.    endif
+.  endif
+
+# By default, we don't bother with the old DES API.
+USE_OLD_DES_API?=	no
+.  if !empty(USE_OLD_DES_API:M[yY][eE][sS])
+#
+# If we're using the old DES API, then check to see if the old DES
+# code was factored out into a separate library and header files and
+# no longer a part of libcrypto.
+#
+.    if !empty(USE_BUILTIN.openssl:M[yY][eE][sS])
+.      if exists(${BUILDLINK_PREFIX.openssl}/include/des.h) && \
+          !empty(BUILTIN_LIB_FOUND.des:M[yY][eE][sS])
+BUILDLINK_TRANSFORM+=	l:crypto:des:crypto
+WRAPPER_REORDER_CMDS+=	reorder:l:des:crypto
+.      endif
+.    endif
+
+# The idea is to avoid the need to patch source files for packages that
+# use OpenSSL for DES support by ensuring that including <openssl/des.h>
+# will always present the old DES API.
+#
+# (1) If des_old.h exists, then we're using OpenSSL>=0.9.7, and
+#     <openssl/des.h> already does the right thing.
+#
+# (2) If des_old.h doesn't exist, then one of two things is happening:
+#     (a) If <openssl/des.h> is old and (only) supports the old DES API,
+#         then <openssl/des.h> does the right thing.
+#     (b) If it's NetBSD's Special(TM) one that stripped out the old DES
+#         support into a separate library and header (-ldes, <des.h>),
+#         then we create a new header <openssl/des.h> that includes the
+#         system one and <des.h>, and we create an <openssl/des_old.h>
+#         that just includes <des.h>.
+#
+BUILDLINK_TARGETS+=	buildlink-openssl-des-h
+.    if !target(buildlink-openssl-des-h)
+.PHONY: buildlink-openssl-des-h
+buildlink-openssl-des-h:
+	${RUN}								\
+	bl_odes_h="${BUILDLINK_DIR}/include/openssl/des.h";		\
+	bl_odes_old_h="${BUILDLINK_DIR}/include/openssl/des_old.h";	\
+	odes_h="${BUILDLINK_PREFIX.openssl}/include/openssl/des.h";	\
+	odes_old_h="${BUILDLINK_PREFIX.openssl}/include/openssl/des_old.h"; \
+	des_h="${BUILDLINK_PREFIX.openssl}/include/des.h";		\
+	if ${TEST} -f "$$odes_old_h"; then				\
+		${ECHO_BUILDLINK_MSG} "<openssl/des.h> supports old DES API."; \
+		exit 0;							\
+	elif ${GREP} -q "des_cblock" "$$odes_h" 2>/dev/null; then	\
+		${ECHO_BUILDLINK_MSG} "<openssl/des.h> supports old DES API."; \
+		exit 0;							\
+	elif ${TEST} -f "$$des_h" -a -f "$$odes_h"; then		\
+		${ECHO_BUILDLINK_MSG} "Creating $$bl_odes_h";		\
+		${RM} -f $$bl_odes_h;					\
+		${MKDIR} `${DIRNAME} $$bl_odes_h`;			\
+		( ${ECHO} "/* Created by openssl/builtin.mk:${.TARGET} */"; \
+		  ${ECHO} "#include \"$$odes_h\"";			\
+		  ${ECHO} "#include \"$$des_h\"";			\
+		) > $$bl_odes_h;					\
+		${ECHO_BUILDLINK_MSG} "Creating $$bl_odes_old_h";	\
+		${RM} -f $$bl_odes_old_h;				\
+		${MKDIR} `${DIRNAME} $$bl_odes_old_h`;			\
+		( ${ECHO} "/* Created by openssl/builtin.mk:${.TARGET} */"; \
+		  ${ECHO} "#include \"$$des_h\"";			\
+		) > $$bl_odes_old_h;					\
+		exit 0;							\
+	else								\
+		${ECHO} "Unable to find headers for old DES API.";	\
+		exit 1;							\
+	fi
+.    endif
+.  endif  # USE_OLD_DES_API == yes
+
+.  if defined(PKG_SYSCONFDIR.openssl)
+SSLDIR=	${PKG_SYSCONFDIR.openssl}
+.  elif !empty(USE_BUILTIN.openssl:M[yY][eE][sS])
+.    if ${OPSYS} == "NetBSD"
+SSLDIR=	/etc/openssl
+.    elif ${OPSYS} == "Haiku"
+SSLDIR=	/boot/common/ssl
+.    else
+SSLDIR=	/etc/ssl 		# most likely place
+.    endif
+.  else
+SSLDIR=	${PKG_SYSCONFBASEDIR}/openssl
+.  endif
+
+SSLCERTS=	${SSLDIR}/certs
+SSLKEYS=	${SSLDIR}/private
+
+BUILD_DEFS+=	SSLDIR SSLCERTS SSLKEYS
+
+# create pc files for builtin version; other versions assumed to contain them
+# If we are using the builtin version, check whether it has a *.pc
+# files or not.  If the latter, generate fake ones.
+.  if !empty(USE_BUILTIN.openssl:M[Yy][Ee][Ss])
+BUILDLINK_TARGETS+=	openssl-fake-pc
+
+.    if !defined(HAS_OPENSSL_FAKE_PC)
+HAS_OPENSSL_FAKE_PC=
+
+openssl-fake-pc:
+	${RUN} \
+	src=${BUILDLINK_PREFIX.openssl}/lib${LIBABISUFFIX}/pkgconfig/libcrypto.pc; \
+	dst=${BUILDLINK_DIR}/lib/pkgconfig/libcrypto.pc; \
+	${MKDIR} ${BUILDLINK_DIR}/lib/pkgconfig; \
+	if ${TEST} -f $${src}; then \
+		${LN} -sf $${src} $${dst}; \
+	else \
+		{ ${ECHO} "Name: OpenSSL-libcrypto"; \
+		${ECHO} "Description: OpenSSL cryptography library"; \
+		${ECHO} "Version: ${BUILTIN_VERSION.openssl}"; \
+		${ECHO} "Libs: -L${BUILDLINK_PREFIX.openssl}/lib${LIBABISUFFIX} -lcrypto"; \
+		${ECHO} "Cflags: -I${BUILDLINK_PREFIX.openssl}/include"; \
+		} >$${dst}; \
+	fi
+	${RUN} \
+	src=${BUILDLINK_PREFIX.openssl}/lib${LIBABISUFFIX}/pkgconfig/libssl.pc; \
+	dst=${BUILDLINK_DIR}/lib/pkgconfig/libssl.pc; \
+	${MKDIR} ${BUILDLINK_DIR}/lib/pkgconfig; \
+	if ${TEST} -f $${src}; then \
+		${LN} -sf $${src} $${dst}; \
+	else \
+		{ ${ECHO} "Name: OpenSSL"; \
+		${ECHO} "Description: Secure Sockets Layer and cryptography libraries"; \
+		${ECHO} "Version: ${BUILTIN_VERSION.openssl}"; \
+		${ECHO} "Libs: -L${BUILDLINK_PREFIX.openssl}/lib${LIBABISUFFIX} -lssl -lcrypto"; \
+		${ECHO} "Cflags: -I${BUILDLINK_PREFIX.openssl}/include"; \
+		} >$${dst}; \
+	fi
+	${RUN} \
+	src=${BUILDLINK_PREFIX.openssl}/lib${LIBABISUFFIX}/pkgconfig/openssl.pc; \
+	dst=${BUILDLINK_DIR}/lib/pkgconfig/openssl.pc; \
+	${MKDIR} ${BUILDLINK_DIR}/lib/pkgconfig; \
+	if ${TEST} -f $${src}; then \
+		${LN} -sf $${src} $${dst}; \
+	else \
+		{ ${ECHO} "Name: OpenSSL"; \
+		${ECHO} "Description: Secure Sockets Layer and cryptography libraries and tools"; \
+		${ECHO} "Version: ${BUILTIN_VERSION.openssl}"; \
+		${ECHO} "Libs: -L${BUILDLINK_PREFIX.openssl}/lib${LIBABISUFFIX} -lssl -lcrypto"; \
+		${ECHO} "Cflags: -I${BUILDLINK_PREFIX.openssl}/include"; \
+		} >$${dst}; \
+	fi
+.    endif
+.  endif
+
+.endif	# CHECK_BUILTIN.openssl

security/openssl/distinfo

@@ -0,0 +1,33 @@
+$NetBSD: distinfo,v 1.97 2013/06/13 07:51:26 adam Exp $
+
+SHA1 (openssl-1.0.1e.tar.gz) = 3f1b1223c9e8189bfe4e186d86449775bd903460
+RMD160 (openssl-1.0.1e.tar.gz) = 380827c16f18bed4f2eb3d54a387c7c089b2b299
+Size (openssl-1.0.1e.tar.gz) = 4459777 bytes
+SHA1 (patch-aa) = c4b27857698c108fe495fe65ea8857b77e89a655
+SHA1 (patch-ac) = 78148ee9601f67f377a3f8d841bdcf85bd7cfdfe
+SHA1 (patch-ad) = bb86ac463fc4ab8b485df5f1a4fb9c13c1fc41c3
+SHA1 (patch-ae) = 7a58f1765a3761321dcc8dafc5fe2e33207be480
+SHA1 (patch-af) = 376f474f3809365a20a53cfe1c91eca4bc02a5cd
+SHA1 (patch-ag) = b407200455878a8a151fc9b4f771fe17552d04fc
+SHA1 (patch-ak) = 049250b9bd42e6f155145703135dab39a7ec17e0
+SHA1 (patch-doc_apps_cms.pod) = 24792a0db2d8566e0f8b52833de300f538f6a92e
+SHA1 (patch-doc_apps_smine.pod) = 277aee087892f867402ea73bae10383fe24d6e08
+SHA1 (patch-doc_crypto_X509__STORE__CTX__get__error.pod) = 39ceb8d8d88f47794c257286c958daa5c408dfd2
+SHA1 (patch-doc_ssl_SSL__COMP__add__compression__method.pod) = f3fcbe0eae26ac8e24fe937e529ea0dba6ea1639
+SHA1 (patch-doc_ssl_SSL__CTX__add__session.pod) = db72b7e04bb74595a78bc09379854957dcfaa4c7
+SHA1 (patch-doc_ssl_SSL__CTX__load__verify__locations.pod) = d0fd17e118a1bd19c729a0930a52925b9bb81d6d
+SHA1 (patch-doc_ssl_SSL__CTX__set__client__CA__list.pod) = 964ea426276741f89a9d02dd75baaaabc97e0943
+SHA1 (patch-doc_ssl_SSL__CTX__set__session__id__context.pod) = b5d711fcf9512c82ec2c7aa61303377006ebfca7
+SHA1 (patch-doc_ssl_SSL__CTX__set__ssl__version.pod) = 79340b3f4cfa4293362a79c336e0768711153930
+SHA1 (patch-doc_ssl_SSL__CTX__use__psk__identity__hint.pod) = e39c7f0ac0edaadf0462f78947fa40b11084cced
+SHA1 (patch-doc_ssl_SSL__accept.pod) = c5ca9e0333de10d2032d03cf3ce0d9e41b6b495f
+SHA1 (patch-doc_ssl_SSL__clear.pod) = c7d2eb126137ee642294466f0ea9019fcd5e9b92
+SHA1 (patch-doc_ssl_SSL__connect.pod) = 78a21f325f5749f0ed491ee71467a4a89848dfe3
+SHA1 (patch-doc_ssl_SSL__do__handshake.pod) = 7b8c392568ef965c1709fc3fefe572f591007b24
+SHA1 (patch-doc_ssl_SSL__read.pod) = 2a6db16242aceeee645f5b48a9725c5530fbbb8c
+SHA1 (patch-doc_ssl_SSL__session__reused.pod) = 0ed7425cf8b098c97ab223cd368c4b18f5187ae5
+SHA1 (patch-doc_ssl_SSL__set__fd.pod) = 68e3f6f3ff0fdfb2113cebb8f08e6d42c442fa2f
+SHA1 (patch-doc_ssl_SSL__set__session.pod) = e4d8442f4fc827520ca20f108050fcd6314dd41d
+SHA1 (patch-doc_ssl_SSL__shutdown.pod) = ca5b1fd9fda9405907697e848614f050978cfb90
+SHA1 (patch-doc_ssl_SSL__write.pod) = 67efd6d0de0a0db34c18c62e4a939c0ea49442ca
+SHA1 (patch-engines_ccgost_Makefile) = 08999f0f40969883482ad9ffc1aa9959ed7d402c

security/openssl/options.mk

@@ -0,0 +1,47 @@
+# $NetBSD: options.mk,v 1.9 2013/02/06 21:40:33 jperkin Exp $
+
+PKG_OPTIONS_VAR=	PKG_OPTIONS.openssl
+PKG_SUPPORTED_OPTIONS=	idea md2 mdc2 rc5 zlib threads
+PKG_SUGGESTED_OPTIONS=	md2 threads
+
+.include "../../mk/bsd.options.mk"
+
+OPENSSL_LICENSE=	# empty
+
+PLIST_VARS+=		${PKG_SUPPORTED_OPTIONS}
+
+#
+# Support optional algorithms
+#
+.for alg in idea md2 mdc2 rc5
+.  if !empty(PKG_OPTIONS:M${alg})
+CONFIGURE_ARGS+=	enable-${alg}
+PLIST.${alg}=		yes
+.  else
+CONFIGURE_ARGS+=	no-${alg}
+.  endif
+.endfor
+
+# A license file is needed.
+# US Patent: 5724428, 5835600, 6269163
+.if !empty(PKG_OPTIONS:Mrc5)
+OPENSSL_LICENSE+=	rc5-nonlicense
+.endif
+
+.if !empty(PKG_OPTIONS:Mzlib)
+CONFIGURE_ARGS+=	zlib
+.include "../../devel/zlib/buildlink3.mk"
+.else
+CONFIGURE_ARGS+=	no-zlib
+.endif
+
+.if !empty(PKG_OPTIONS:Mthreads)
+CONFIGURE_ARGS+=	threads
+.else
+CONFIGURE_ARGS+=	no-threads
+.endif
+
+.if !empty(OPENSSL_LICENSE)
+# pkgsrc does not handle multiple licenses
+LICENSE=	openssl-patented-algorithms-nonlicense
+.endif

security/openssl/patches/patch-aa

@@ -0,0 +1,69 @@
+$NetBSD: patch-aa,v 1.25 2012/05/22 06:00:11 joerg Exp $
+
+--- config.orig	2011-07-15 19:59:31.000000000 +0000
++++ config
+@@ -49,6 +49,7 @@ done
+ # First get uname entries that we use below
+ 
+ [ "$MACHINE" ] || MACHINE=`(uname -m) 2>/dev/null` || MACHINE="unknown"
++[ "$MACHINE_ARCH" ] || MACHINE_ARCH=`(uname -p) 2>/dev/null` || MACHINE_ARCH="unknown"
+ [ "$RELEASE" ] || RELEASE=`(uname -r) 2>/dev/null` || RELEASE="unknown"
+ [ "$SYSTEM" ] || SYSTEM=`(uname -s) 2>/dev/null`  || SYSTEM="unknown"
+ [ "$BUILD" ] || VERSION=`(uname -v) 2>/dev/null` || VERSION="unknown"
+@@ -154,6 +155,10 @@ case "${SYSTEM}:${RELEASE}:${VERSION}:${
+ 	echo "mips4-sgi-irix64"; exit 0
+ 	;;
+ 
++    Interix:*)
++	echo "i386-pc-interix"; exit 0
++	;;
++
+     Linux:[2-9].*)
+ 	echo "${MACHINE}-whatever-linux2"; exit 0
+ 	;;
+@@ -210,12 +215,12 @@ case "${SYSTEM}:${RELEASE}:${VERSION}:${
+ 	echo "${MACHINE}-whatever-freebsd"; exit 0
+ 	;;
+ 
+-    NetBSD:*:*:*386*)
+-        echo "`(/usr/sbin/sysctl -n hw.model || /sbin/sysctl -n hw.model) | sed 's,.*\(.\)86-class.*,i\186,'`-whatever-netbsd"; exit 0
++    DragonFly:*)
++	echo "${MACHINE}-whatever-dragonfly"; exit 0
+ 	;;
+ 
+     NetBSD:*)
+-	echo "${MACHINE}-whatever-netbsd"; exit 0
++	echo "${MACHINE_ARCH}-whatever-netbsd"; exit 0
+ 	;;
+ 
+     OpenBSD:*)
+@@ -661,13 +666,18 @@ case "$GUESSOS" in
+ 	;;
+   *-*-sunos4)		OUT="sunos-$CC" ;;
+ 
++  alpha-*-netbsd|arm-*-netbsd|arm32-*-netbsd|m68000-*-netbsd|m68k-*-netbsd|\
++  mipseb-*-netbsd|mipsel-*-netbsd|ns32k-*-netbsd|powerpc-*-netbsd|\
++  sparc-*-netbsd|sparc64-*-netbsd|vax-*-netbsd|x86_64-*-netbsd)
++			OUT="NetBSD-${MACHINE_ARCH}" ;;
++
+   *86*-*-bsdi4)		OUT="BSD-x86-elf"; options="$options no-sse2 -ldl" ;;
+   alpha*-*-*bsd*)	OUT="BSD-generic64"; options="$options -DL_ENDIAN" ;;
+   powerpc64-*-*bsd*)	OUT="BSD-generic64"; options="$options -DB_ENDIAN" ;;
+   sparc64-*-*bsd*)	OUT="BSD-sparc64" ;;
+   ia64-*-*bsd*)		OUT="BSD-ia64" ;;
+-  amd64-*-*bsd*)	OUT="BSD-x86_64" ;;
+-  *86*-*-*bsd*)		# mimic ld behaviour when it's looking for libc...
++  amd64-*-*bsd*|x86_64-*-dragonfly*)	OUT="BSD-x86_64" ;;
++  *86*-*-*bsd*|*-dragonfly*) # mimic ld behaviour when it's looking for libc...
+ 			if [ -L /usr/lib/libc.so ]; then	# [Free|Net]BSD
+ 			    libc=/usr/lib/libc.so
+ 			else					# OpenBSD
+@@ -680,6 +690,8 @@ case "$GUESSOS" in
+ 			esac ;;
+   *-*-*bsd*)		OUT="BSD-generic32" ;;
+ 
++  *-*-interix)		OUT="Interix" ;;
++
+   *-*-osf)		OUT="osf1-alpha-cc" ;;
+   *-*-tru64)		OUT="tru64-alpha-cc" ;;
+   *-*-[Uu]nix[Ww]are7)

security/openssl/patches/patch-ac

@@ -0,0 +1,78 @@
+$NetBSD: patch-ac,v 1.41 2013/06/13 07:51:26 adam Exp $
+
+* Avoid -fast on Solaris, creates non-portable packages which depend on
+  host-specific CPU features.
+* Allow absolute paths in CFLAGS, e.g. -isysroot /path
+
+--- Configure.orig	2012-03-14 22:20:40.000000000 +0000
++++ Configure
+@@ -225,8 +225,8 @@ my %table=(
+ "solaris64-x86_64-gcc","gcc:-m64 -O3 -Wall -DL_ENDIAN::-D_REENTRANT::-lsocket -lnsl -ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_UNROLL:${x86_64_asm}:elf:dlfcn:solaris-shared:-fPIC:-m64 -shared -static-libgcc:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::/64",
+  
+ #### Solaris x86 with Sun C setups
+-"solaris-x86-cc","cc:-fast -O -Xa::-D_REENTRANT::-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_PTR DES_UNROLL BF_PTR:${no_asm}:dlfcn:solaris-shared:-KPIC:-G -dy -z text:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+-"solaris64-x86_64-cc","cc:-fast -xarch=amd64 -xstrconst -Xa -DL_ENDIAN::-D_REENTRANT::-lsocket -lnsl -ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_UNROLL:${x86_64_asm}:elf:dlfcn:solaris-shared:-KPIC:-xarch=amd64 -G -dy -z text:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::/64",
++"solaris-x86-cc","cc:-xO5 -Xa::-D_REENTRANT::-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_PTR DES_UNROLL BF_PTR:${no_asm}:dlfcn:solaris-shared:-KPIC:-G -dy -z text:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
++"solaris64-x86_64-cc","cc:-xO5 -xarch=amd64 -xstrconst -Xa -DL_ENDIAN::-D_REENTRANT::-lsocket -lnsl -ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_UNROLL:${x86_64_asm}:elf:dlfcn:solaris-shared:-KPIC:-xarch=amd64 -G -dy -z text:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::/64",
+ 
+ #### SPARC Solaris with GNU C setups
+ "solaris-sparcv7-gcc","gcc:-O3 -fomit-frame-pointer -Wall -DB_ENDIAN -DBN_DIV2W::-D_REENTRANT::-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:${no_asm}:dlfcn:solaris-shared:-fPIC:-shared:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+@@ -338,6 +338,7 @@ my %table=(
+ #
+ "osf1-alpha-gcc", "gcc:-O3::(unknown):::SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_UNROLL DES_RISC1:${alpha_asm}:dlfcn:alpha-osf1-shared:::.so",
+ "osf1-alpha-cc",  "cc:-std1 -tune host -O4 -readonly_strings::(unknown):::SIXTY_FOUR_BIT_LONG RC4_CHUNK:${alpha_asm}:dlfcn:alpha-osf1-shared:::.so",
++"tru64-alpha-gcc", "gcc:-O3::-pthread:::SIXTY_FOUR_BIT_LONG RC4_CHUNK:${no_asm}:dlfcn:alpha-osf1-shared::-Wl,-msym:.so",
+ "tru64-alpha-cc", "cc:-std1 -tune host -fast -readonly_strings::-pthread:::SIXTY_FOUR_BIT_LONG RC4_CHUNK:${alpha_asm}:dlfcn:alpha-osf1-shared::-msym:.so",
+ 
+ ####
+@@ -423,6 +424,25 @@ my %table=(
+ "BSD-ia64",	"gcc:-DL_ENDIAN -DTERMIOS -O3 -Wall::${BSDthreads}:::SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_UNROLL DES_INT:${ia64_asm}:dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+ "BSD-x86_64",	"gcc:-DL_ENDIAN -DTERMIOS -O3 -Wall::${BSDthreads}:::SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_UNROLL:${x86_64_asm}:elf:dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+ 
++"NetBSD","gcc:-DTERMIOS -O2 -Wall::(unknown):::BN_LLONG MD2_CHAR RC4_INDEX DES_UNROLL::::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
++"NetBSD-alpha", "gcc:-DTERMIOS -DL_ENDIAN -O2 -Wall::(unknown):::SIXTY_FOUR_BIT_LONG DES_INT DES_PTR DES_RISC2::::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
++"NetBSD-arm", "gcc:-DTERMIOS -DL_ENDIAN -O2 -Wall::(unknown):::BN_LLONG MD2_CHAR RC4_INDEX DES_UNROLL::::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
++"NetBSD-arm32", "gcc:-DTERMIOS -DL_ENDIAN -O2 -Wall::(unknown):::BN_LLONG MD2_CHAR RC4_INDEX DES_UNROLL::::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
++"NetBSD-m68000", "gcc:-DTERMIOS -DB_ENDIAN -O2 -Wall::(unknown):::BN_LLONG MD2_CHAR RC4_INDEX::::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
++"NetBSD-m68k", "gcc:-DTERMIOS -DB_ENDIAN -O2 -m68020-40 -Wall::(unknown):::BN_LLONG MD2_CHAR RC4_INDEX::::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
++"NetBSD-mipseb", "gcc:-DTERMIOS -DB_ENDIAN -O2 -Wall::(unknown):::BN_LLONG MD2_CHAR RC4_INDEX DES_UNROLL::::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
++"NetBSD-mipsel", "gcc:-DTERMIOS -DL_ENDIAN -O2 -Wall::(unknown):::BN_LLONG MD2_CHAR RC4_INDEX DES_UNROLL::::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
++"NetBSD-ns32k", "gcc:-DTERMIOS -DL_ENDIAN -O2 -Wall::(unknown):::BN_LLONG MD2_CHAR RC4_INDEX DES_UNROLL::::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
++"NetBSD-powerpc", "gcc:-DTERMIOS -DB_ENDIAN -O2 -Wall::(unknown):::BN_LLONG MD2_CHAR RC4_INDEX DES_UNROLL::::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
++"NetBSD-sparc", "gcc:-DTERMIOS -DB_ENDIAN -O2 -Wall::(unknown):::BN_LLONG MD2_CHAR RC4_INDEX DES_UNROLL::::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
++"NetBSD-sparc64", "gcc:-DB_ENDIAN -DTERMIOS -O3 -DMD32_REG_T=int -Wall::(unknown):ULTRASPARC::SIXTY_FOUR_BIT_LONG DES_INT DES_PTR DES_RISC2 BF_PTR::::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
++"NetBSD-vax", "gcc:-DTERMIOS -DL_ENDIAN -O2 -Wall::(unknown):::BN_LLONG MD2_CHAR RC4_INDEX DES_UNROLL::::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
++"NetBSD-x86-aout", "gcc:-DTERMIOS -DL_ENDIAN -O2 -Wall::(unknown):::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_asm}:a.out:dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
++"NetBSD-x86-elf", "gcc:-DTERMIOS -DL_ENDIAN -O2 -Wall::(unknown):::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
++"NetBSD-x86_64", "gcc:-DTERMIOS -DL_ENDIAN -DMD32_REG_T=int -O2::(unknown):::SIXTY_FOUR_BIT_LONG RC4_CHUNK BF_PTR2 DES_INT DES_UNROLL:${x86_64_asm}:elf:dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
++"Interix","gcc:-DTERMIOS -DL_ENDIAN -O2 -Wall::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}::::::::::::dlfcn:bsd-gcc-shared::-Wl,--image-base,0x5e000000:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
++"DragonFly-i386",  "gcc:-DTERMIOS -DL_ENDIAN -fomit-frame-pointer -O3 -m486 -Wall::-pthread -D_REENTRANT -D_THREAD_SAFE -D_THREADSAFE:::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
++
+ "bsdi-elf-gcc",     "gcc:-DPERL5 -DL_ENDIAN -fomit-frame-pointer -O3 -march=i486 -Wall::(unknown)::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+ 
+ "nextstep",	"cc:-O -Wall:<libc.h>:(unknown):::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:::",
+@@ -865,13 +885,13 @@ PROCESS_ARGS:
+ 			# The check for the option is there so scripts aren't
+ 			# broken
+ 			}
+-		elsif (/^[-+]/)
++		elsif (/^[-+\/]/)
+ 			{
+ 			if (/^-[lL](.*)$/ or /^-Wl,/)
+ 				{
+ 				$libs.=$_." ";
+ 				}
+-			elsif (/^-[^-]/ or /^\+/)
++			elsif (/^-[^-]/ or /^\+/ or /^\//)
+ 				{
+ 				$_ =~ s/%([0-9a-f]{1,2})/chr(hex($1))/gei;
+ 				$flags.=$_." ";
+@@ -1674,7 +1694,7 @@ while (<IN>)
+ 	elsif ($shared_extension ne "" && $shared_extension =~ /^\.s([ol])\.[^\.]*\.[^\.]*$/)
+ 		{
+ 		my $sotmp = $1;
+-		s/^SHARED_LIBS_LINK_EXTS=.*/SHARED_LIBS_LINK_EXTS=.s$sotmp.\$(SHLIB_MAJOR) .s$sotmp/;
++		s/^SHARED_LIBS_LINK_EXTS=.*/SHARED_LIBS_LINK_EXTS=.s$sotmp/;
+ 		}
+ 	elsif ($shared_extension ne "" && $shared_extension =~ /^\.[^\.]*\.[^\.]*\.dylib$/)
+ 		{

security/openssl/patches/patch-ad

@@ -0,0 +1,32 @@
+$NetBSD: patch-ad,v 1.16 2008/01/17 06:42:48 tnn Exp $
+
+--- apps/Makefile.orig	2007-02-23 02:01:03.000000000 +0100
++++ apps/Makefile	2007-07-31 17:18:49.000000000 +0200
+@@ -4,6 +4,7 @@
+ 
+ DIR=		apps
+ TOP=		..
++EXAMPLEDIR=	$(INSTALLTOP)/share/examples/openssl
+ CC=		cc
+ INCLUDES=	-I$(TOP) -I../include $(KRB5_INCLUDES)
+ CFLAG=		-g -static
+@@ -109,13 +110,13 @@ install:
+ 	@set -e; for i in $(SCRIPTS); \
+ 	do  \
+ 	(echo installing $$i; \
+-	 cp $$i $(INSTALL_PREFIX)$(OPENSSLDIR)/misc/$$i.new; \
+-	 chmod 755 $(INSTALL_PREFIX)$(OPENSSLDIR)/misc/$$i.new; \
+-	 mv -f $(INSTALL_PREFIX)$(OPENSSLDIR)/misc/$$i.new $(INSTALL_PREFIX)$(OPENSSLDIR)/misc/$$i ); \
++	 cp $$i $(INSTALL_PREFIX)$(EXAMPLEDIR)/$$i.new; \
++	 chmod 755 $(INSTALL_PREFIX)$(EXAMPLEDIR)/$$i.new; \
++	 mv -f $(INSTALL_PREFIX)$(EXAMPLEDIR)/$$i.new $(INSTALL_PREFIX)$(EXAMPLEDIR)/$$i ); \
+ 	 done
+-	@cp openssl.cnf $(INSTALL_PREFIX)$(OPENSSLDIR)/openssl.cnf.new; \
+-	chmod 644 $(INSTALL_PREFIX)$(OPENSSLDIR)/openssl.cnf.new; \
+-	mv -f  $(INSTALL_PREFIX)$(OPENSSLDIR)/openssl.cnf.new $(INSTALL_PREFIX)$(OPENSSLDIR)/openssl.cnf
++	@cp openssl.cnf $(INSTALL_PREFIX)$(EXAMPLEDIR)/openssl.cnf.new; \
++	chmod 644 $(INSTALL_PREFIX)$(EXAMPLEDIR)/openssl.cnf.new; \
++	mv -f  $(INSTALL_PREFIX)$(EXAMPLEDIR)/openssl.cnf.new $(INSTALL_PREFIX)$(EXAMPLEDIR)/openssl.cnf
+ 
+ tags:
+ 	ctags $(SRC)

security/openssl/patches/patch-ae

@@ -0,0 +1,25 @@
+$NetBSD: patch-ae,v 1.8 2008/01/17 06:42:48 tnn Exp $
+
+--- tools/Makefile.orig	2006-02-04 02:49:36.000000000 +0100
++++ tools/Makefile	2007-07-31 17:20:05.000000000 +0200
+@@ -4,6 +4,7 @@
+ 
+ DIR=	tools
+ TOP=	..
++EXAMPLEDIR=	$(INSTALLTOP)/share/examples/openssl
+ CC=	cc
+ INCLUDES= -I$(TOP) -I../../include
+ CFLAG=-g
+@@ -28,9 +29,9 @@ install:
+ 	done;
+ 	@for i in $(MISC_APPS) ; \
+ 	do  \
+-	(cp $$i $(INSTALL_PREFIX)$(OPENSSLDIR)/misc/$$i.new; \
+-	chmod 755 $(INSTALL_PREFIX)$(OPENSSLDIR)/misc/$$i.new; \
+-	mv -f $(INSTALL_PREFIX)$(OPENSSLDIR)/misc/$$i.new $(INSTALL_PREFIX)$(OPENSSLDIR)/misc/$$i ); \
++	(cp $$i $(INSTALL_PREFIX)$(EXAMPLEDIR)/$$i.new; \
++	chmod 755 $(INSTALL_PREFIX)$(EXAMPLEDIR)/$$i.new; \
++	mv -f $(INSTALL_PREFIX)$(EXAMPLEDIR)/$$i.new $(INSTALL_PREFIX)$(EXAMPLEDIR)/$$i ); \
+ 	done;
+ 
+ files:

security/openssl/patches/patch-af

@@ -0,0 +1,98 @@
+$NetBSD: patch-af,v 1.25 2013/02/06 21:40:34 jperkin Exp $
+
+--- Makefile.org.orig	2012-04-22 13:25:19.000000000 +0000
++++ Makefile.org
+@@ -28,6 +28,7 @@ INSTALLTOP=/usr/local/ssl
+ 
+ # Do not edit this manually. Use Configure --openssldir=DIR do change this!
+ OPENSSLDIR=/usr/local/ssl
++EXAMPLEDIR=$(INSTALLTOP)/share/examples/openssl
+ 
+ # NO_IDEA - Define to build without the IDEA algorithm
+ # NO_RC4  - Define to build without the RC4 algorithm
+@@ -157,7 +158,7 @@ TESTS = alltests
+ 
+ MAKEFILE= Makefile
+ 
+-MANDIR=$(OPENSSLDIR)/man
++MANDIR=$(INSTALLTOP)/$(PKGMANDIR)
+ MAN1=1
+ MAN3=3
+ MANSUFFIX=
+@@ -174,6 +175,7 @@ SHARED_CRYPTO=libcrypto$(SHLIB_EXT)
+ SHARED_SSL=libssl$(SHLIB_EXT)
+ SHARED_LIBS=
+ SHARED_LIBS_LINK_EXTS=
++LIBRPATH=$(INSTALLTOP)/lib
+ SHARED_LDFLAGS=
+ 
+ GENERAL=        Makefile
+@@ -537,7 +539,7 @@ dist:
+ dist_pem_h:
+ 	(cd crypto/pem; $(MAKE) -e $(BUILDENV) pem.h; $(MAKE) clean)
+ 
+-install: all install_docs install_sw
++install: install_docs install_sw
+ 
+ install_sw:
+ 	@$(PERL) $(TOP)/util/mkdir-p.pl $(INSTALL_PREFIX)$(INSTALLTOP)/bin \
+@@ -648,35 +650,53 @@ install_docs:
+ 	set -e; for i in doc/apps/*.pod; do \
+ 		fn=`basename $$i .pod`; \
+ 		sec=`$(PERL) util/extract-section.pl 1 < $$i`; \
+-		echo "installing man$$sec/$$fn.$${sec}$(MANSUFFIX)"; \
++		case "$$fn" in \
++		CA.pl|openssl) ofn="$$fn" ;; \
++		*) ofn="openssl_$$fn" ;; \
++		esac; \
++		echo "installing man$$sec/$$ofn.$${sec}$(MANSUFFIX)"; \
+ 		(cd `$(PERL) util/dirname.pl $$i`; \
+ 		sh -c "$$pod2man \
+ 			--section=$$sec --center=OpenSSL \
+ 			--release=$(VERSION) `basename $$i`") \
+-			>  $(INSTALL_PREFIX)$(MANDIR)/man$$sec/$$fn.$${sec}$(MANSUFFIX); \
++			>  $(INSTALL_PREFIX)$(MANDIR)/man$$sec/$$ofn.$${sec}$(MANSUFFIX); \
+ 		$(PERL) util/extract-names.pl < $$i | \
+ 			(grep -v $$filecase "^$$fn\$$"; true) | \
+ 			(grep -v "[	]"; true) | \
+ 			(cd $(INSTALL_PREFIX)$(MANDIR)/man$$sec/; \
+ 			 while read n; do \
+-				PLATFORM=$(PLATFORM) $$here/util/point.sh $$fn.$${sec}$(MANSUFFIX) "$$n".$${sec}$(MANSUFFIX); \
++				case "$$n" in \
++				CA.pl|openssl) on="$$n" ;; \
++				*) on="openssl_$$n" ;; \
++				esac; \
++				PLATFORM=$(PLATFORM) $$here/util/point.sh $$ofn.$${sec}$(MANSUFFIX) "$$on".$${sec}$(MANSUFFIX); \
+ 			 done); \
+ 	done; \
+ 	set -e; for i in doc/crypto/*.pod doc/ssl/*.pod; do \
+ 		fn=`basename $$i .pod`; \
+ 		sec=`$(PERL) util/extract-section.pl 3 < $$i`; \
+-		echo "installing man$$sec/$$fn.$${sec}$(MANSUFFIX)"; \
++		case "$$fn" in \
++		ui*) ofn="openssl_$$fn" ;; \
++		[A-Z]*|*_*) ofn="$$fn" ;; \
++		*) ofn="openssl_$$fn" ;; \
++		esac; \
++		echo "installing man$$sec/$$ofn.$${sec}$(MANSUFFIX)"; \
+ 		(cd `$(PERL) util/dirname.pl $$i`; \
+ 		sh -c "$$pod2man \
+ 			--section=$$sec --center=OpenSSL \
+ 			--release=$(VERSION) `basename $$i`") \
+-			>  $(INSTALL_PREFIX)$(MANDIR)/man$$sec/$$fn.$${sec}$(MANSUFFIX); \
++			>  $(INSTALL_PREFIX)$(MANDIR)/man$$sec/$$ofn.$${sec}$(MANSUFFIX); \
+ 		$(PERL) util/extract-names.pl < $$i | \
+ 			(grep -v $$filecase "^$$fn\$$"; true) | \
+ 			(grep -v "[	]"; true) | \
+ 			(cd $(INSTALL_PREFIX)$(MANDIR)/man$$sec/; \
+ 			 while read n; do \
+-				PLATFORM=$(PLATFORM) $$here/util/point.sh $$fn.$${sec}$(MANSUFFIX) "$$n".$${sec}$(MANSUFFIX); \
++				case "$$n" in \
++				ui*) on="openssl_$$n" ;; \
++				[A-Z]*|*_*) on="$$n" ;; \
++				*) on="openssl_$$n" ;; \
++				esac; \
++				PLATFORM=$(PLATFORM) $$here/util/point.sh $$ofn.$${sec}$(MANSUFFIX) "$$on".$${sec}$(MANSUFFIX); \
+ 			 done); \
+ 	done
+ 

security/openssl/patches/patch-ag

@@ -0,0 +1,67 @@
+$NetBSD: patch-ag,v 1.12 2013/02/06 21:40:34 jperkin Exp $
+
+--- Makefile.shared.orig	2010-08-21 11:37:17.000000000 +0000
++++ Makefile.shared
+@@ -315,6 +315,11 @@ link_o.alpha-osf1:
+ 	@ if $(DETECT_GNU_LD); then \
+ 		$(DO_GNU_SO); \
+ 	else \
++		if ($(CC) -v 2>&1 | grep gcc) > /dev/null; then \
++			WL="-Wl,"; DELIM=","; \
++		else \
++			WL=""; DELIM=" "; \
++		fi; \
+ 		SHLIB=lib$(LIBNAME).so; \
+ 		SHLIB_SUFFIX=; \
+ 		SHLIB_HIST=`echo "$(LIBCOMPATVERSIONS)" | cut -d';' -f2 | sed -e 's/ */:/'`; \
+@@ -324,11 +329,11 @@ link_o.alpha-osf1:
+ 			SHLIB_HIST="$(LIBVERSION)"; \
+ 		fi; \
+ 		SHLIB_SOVER=; \
+-		ALLSYMSFLAGS='-all'; \
+-		NOALLSYMSFLAGS='-none'; \
++		ALLSYMSFLAGS="$${WL}-all"; \
++		NOALLSYMSFLAGS="$${WL}-none"; \
+ 		SHAREDFLAGS="$(CFLAGS) $(SHARED_LDFLAGS) -shared -Wl,-B,symbolic"; \
+ 		if [ -n "$$SHLIB_HIST" ]; then \
+-			SHAREDFLAGS="$$SHAREDFLAGS -set_version $$SHLIB_HIST"; \
++			SHAREDFLAGS="$$SHAREDFLAGS $${WL}-set_version$${DELIM}$$SHLIB_HIST"; \
+ 		fi; \
+ 	fi; \
+ 	$(LINK_SO_O)
+@@ -336,6 +341,11 @@ link_a.alpha-osf1:
+ 	@ if $(DETECT_GNU_LD); then \
+ 		$(DO_GNU_SO); \
+ 	else \
++		if ($(CC) -v 2>&1 | grep gcc) > /dev/null; then \
++			WL="-Wl,"; DELIM=","; \
++		else \
++			WL=""; DELIM=" "; \
++		fi; \
+ 		SHLIB=lib$(LIBNAME).so; \
+ 		SHLIB_SUFFIX=; \
+ 		SHLIB_HIST=`echo "$(LIBCOMPATVERSIONS)" | cut -d';' -f2 | sed -e 's/ */:/'`; \
+@@ -345,11 +355,11 @@ link_a.alpha-osf1:
+ 			SHLIB_HIST="$(LIBVERSION)"; \
+ 		fi; \
+ 		SHLIB_SOVER=; \
+-		ALLSYMSFLAGS='-all'; \
+-		NOALLSYMSFLAGS='-none'; \
++		ALLSYMSFLAGS="$${WL}-all"; \
++		NOALLSYMSFLAGS="$${WL}-none"; \
+ 		SHAREDFLAGS="$(CFLAGS) $(SHARED_LDFLAGS) -shared -Wl,-B,symbolic"; \
+ 		if [ -n "$$SHLIB_HIST" ]; then \
+-			SHAREDFLAGS="$$SHAREDFLAGS -set_version $$SHLIB_HIST"; \
++			SHAREDFLAGS="$$SHAREDFLAGS $${WL}-set_version$${DELIM}$$SHLIB_HIST"; \
+ 		fi; \
+ 	fi; \
+ 	$(LINK_SO_A)
+@@ -484,7 +494,7 @@ link_a.irix:
+ 		($(CC) -v 2>&1 | grep gcc) > /dev/null && MINUSWL="-Wl,"; \
+ 		ALLSYMSFLAGS="$${MINUSWL}-all"; \
+ 		NOALLSYMSFLAGS="$${MINUSWL}-none"; \
+-		SHAREDFLAGS="$(CFLAGS) $(SHARED_LDFLAGS) -shared -Wl,-soname,$$SHLIB$$SHLIB_SOVER$$SHLIB_SUFFIX,-B,symbolic"; \
++		SHAREDFLAGS="$(CFLAGS) -Wl,-rpath,$(LIBRPATH) $(SHARED_LDFLAGS) -shared -Wl,-soname,$$SHLIB$$SHLIB_SOVER$$SHLIB_SUFFIX,-B,symbolic"; \
+ 	fi; \
+ 	$(LINK_SO_A)
+ link_app.irix:

security/openssl/patches/patch-ak

@@ -0,0 +1,22 @@
+$NetBSD: patch-ak,v 1.6 2008/01/17 06:42:49 tnn Exp $
+
+--- crypto/bn/bn_prime.pl.orig	2003-09-25 15:57:58.000000000 +0200
++++ crypto/bn/bn_prime.pl	2007-07-31 17:53:39.000000000 +0200
+@@ -1,6 +1,8 @@
+ #!/usr/local/bin/perl
+ # bn_prime.pl
+ 
++use POSIX;
++
+ $num=2048;
+ $num=$ARGV[0] if ($#ARGV >= 0);
+ 
+@@ -9,7 +11,7 @@ $p=1;
+ loop: while ($#primes < $num-1)
+ 	{
+ 	$p+=2;
+-	$s=int(sqrt($p));
++	$s=floor(sqrt($p));
+ 
+ 	for ($i=0; defined($primes[$i]) && $primes[$i]<=$s; $i++)
+ 		{

security/openssl/patches/patch-doc_apps_cms.pod

@@ -0,0 +1,36 @@
+$NetBSD: patch-doc_apps_cms.pod,v 1.1 2013/06/01 08:03:55 sbd Exp $
+
+Fix openssl pod docs to work with the very picky pod2man from perl-5.18.0.
+
+--- doc/apps/cms.pod.orig	2013-02-11 15:26:04.000000000 +0000
++++ doc/apps/cms.pod
+@@ -454,24 +454,24 @@ remains DER.
+ 
+ the operation was completely successfully.
+ 
+-=item 1 
++=item Z<>1
+ 
+ an error occurred parsing the command options.
+ 
+-=item 2
++=item Z<>2
+ 
+ one of the input files could not be read.
+ 
+-=item 3
++=item Z<>3
+ 
+ an error occurred creating the CMS file or when reading the MIME
+ message.
+ 
+-=item 4
++=item Z<>4
+ 
+ an error occurred decrypting or verifying the message.
+ 
+-=item 5
++=item Z<>5
+ 
+ the message was verified correctly but an error occurred writing out
+ the signers certificates.

security/openssl/patches/patch-doc_apps_smine.pod

@@ -0,0 +1,36 @@
+$NetBSD: patch-doc_apps_smine.pod,v 1.1 2013/06/01 08:03:55 sbd Exp $
+
+Fix openssl pod docs to work with the very picky pod2man from perl-5.18.0.
+
+--- doc/apps/smime.pod.orig	2013-02-11 15:26:04.000000000 +0000
++++ doc/apps/smime.pod
+@@ -312,24 +312,24 @@ remains DER.
+ 
+ the operation was completely successfully.
+ 
+-=item 1 
++=item Z<>1 
+ 
+ an error occurred parsing the command options.
+ 
+-=item 2
++=item Z<>2
+ 
+ one of the input files could not be read.
+ 
+-=item 3
++=item Z<>3
+ 
+ an error occurred creating the PKCS#7 file or when reading the MIME
+ message.
+ 
+-=item 4
++=item Z<>4
+ 
+ an error occurred decrypting or verifying the message.
+ 
+-=item 5
++=item Z<>5
+ 
+ the message was verified correctly but an error occurred writing out
+ the signers certificates.

security/openssl/patches/patch-doc_crypto_X509__STORE__CTX__get__error.pod

@@ -0,0 +1,15 @@
+$NetBSD: patch-doc_crypto_X509__STORE__CTX__get__error.pod,v 1.1 2013/06/01 08:03:55 sbd Exp $
+
+Fix openssl pod docs to work with the very picky pod2man from perl-5.18.0.
+
+--- doc/crypto/X509_STORE_CTX_get_error.pod.orig	2013-02-11 15:26:04.000000000 +0000
++++ doc/crypto/X509_STORE_CTX_get_error.pod
+@@ -278,6 +278,8 @@ happen if extended CRL checking is enabl
+ an application specific error. This will never be returned unless explicitly
+ set by an application.
+ 
++=back
++
+ =head1 NOTES
+ 
+ The above functions should be used instead of directly referencing the fields

security/openssl/patches/patch-doc_ssl_SSL__COMP__add__compression__method.pod

@@ -0,0 +1,15 @@
+$NetBSD: patch-doc_ssl_SSL__COMP__add__compression__method.pod,v 1.1 2013/06/01 08:03:55 sbd Exp $
+
+Fix openssl pod docs to work with the very picky pod2man from perl-5.18.0.
+
+--- doc/ssl/SSL_COMP_add_compression_method.pod.orig	2013-02-11 15:02:48.000000000 +0000
++++ doc/ssl/SSL_COMP_add_compression_method.pod
+@@ -57,7 +57,7 @@ SSL_COMP_add_compression_method() may re
+ 
+ The operation succeeded.
+ 
+-=item 1
++=item Z<>1
+ 
+ The operation failed. Check the error queue to find out the reason.
+ 

security/openssl/patches/patch-doc_ssl_SSL__CTX__add__session.pod

@@ -0,0 +1,15 @@
+$NetBSD: patch-doc_ssl_SSL__CTX__add__session.pod,v 1.1 2013/06/01 08:03:55 sbd Exp $
+
+Fix openssl pod docs to work with the very picky pod2man from perl-5.18.0.
+
+--- doc/ssl/SSL_CTX_add_session.pod.orig	2013-02-11 15:02:48.000000000 +0000
++++ doc/ssl/SSL_CTX_add_session.pod
+@@ -58,7 +58,7 @@ The following values are returned by all
+  the same (identical) session twice. In case of the remove operation, the
+  session was not found in the cache.
+ 
+-=item 1
++=item Z<>1
+  
+  The operation succeeded.
+ 

security/openssl/patches/patch-doc_ssl_SSL__CTX__load__verify__locations.pod

@@ -0,0 +1,15 @@
+$NetBSD: patch-doc_ssl_SSL__CTX__load__verify__locations.pod,v 1.1 2013/06/01 08:03:55 sbd Exp $
+
+Fix openssl pod docs to work with the very picky pod2man from perl-5.18.0.
+
+--- doc/ssl/SSL_CTX_load_verify_locations.pod.orig	2013-02-11 15:02:48.000000000 +0000
++++ doc/ssl/SSL_CTX_load_verify_locations.pod
+@@ -106,7 +106,7 @@ The operation failed because B<CAfile> a
+ processing at one of the locations specified failed. Check the error
+ stack to find out the reason.
+ 
+-=item 1
++=item Z<>1
+ 
+ The operation succeeded.
+ 

security/openssl/patches/patch-doc_ssl_SSL__CTX__set__client__CA__list.pod

@@ -0,0 +1,20 @@
+$NetBSD: patch-doc_ssl_SSL__CTX__set__client__CA__list.pod,v 1.1 2013/06/01 08:03:55 sbd Exp $
+
+Fix openssl pod docs to work with the very picky pod2man from perl-5.18.0.
+
+--- doc/ssl/SSL_CTX_set_client_CA_list.pod.orig	2013-02-11 15:02:48.000000000 +0000
++++ doc/ssl/SSL_CTX_set_client_CA_list.pod
+@@ -66,11 +66,11 @@ values:
+ 
+ =over 4
+ 
+-=item 1
++=item Z<>1
+ 
+ The operation succeeded.
+ 
+-=item 0
++=item Z<>0
+ 
+ A failure while manipulating the STACK_OF(X509_NAME) object occurred or
+ the X509_NAME could not be extracted from B<cacert>. Check the error stack

security/openssl/patches/patch-doc_ssl_SSL__CTX__set__session__id__context.pod

@@ -0,0 +1,15 @@
+$NetBSD: patch-doc_ssl_SSL__CTX__set__session__id__context.pod,v 1.1 2013/06/01 08:03:55 sbd Exp $
+
+Fix openssl pod docs to work with the very picky pod2man from perl-5.18.0.
+
+--- doc/ssl/SSL_CTX_set_session_id_context.pod.orig	2013-02-11 15:02:48.000000000 +0000
++++ doc/ssl/SSL_CTX_set_session_id_context.pod
+@@ -70,7 +70,7 @@ The length B<sid_ctx_len> of the session
+ the maximum allowed length of B<SSL_MAX_SSL_SESSION_ID_LENGTH>. The error
+ is logged to the error stack.
+ 
+-=item 1
++=item Z<>1
+ 
+ The operation succeeded.
+ 

security/openssl/patches/patch-doc_ssl_SSL__CTX__set__ssl__version.pod

@@ -0,0 +1,15 @@
+$NetBSD: patch-doc_ssl_SSL__CTX__set__ssl__version.pod,v 1.1 2013/06/01 08:03:55 sbd Exp $
+
+Fix openssl pod docs to work with the very picky pod2man from perl-5.18.0.
+
+--- doc/ssl/SSL_CTX_set_ssl_version.pod.orig	2013-02-11 15:26:04.000000000 +0000
++++ doc/ssl/SSL_CTX_set_ssl_version.pod
+@@ -46,7 +46,7 @@ and SSL_set_ssl_method():
+ 
+ The new choice failed, check the error stack to find out the reason.
+ 
+-=item 1
++=item Z<>1
+ 
+ The operation succeeded.
+ 

security/openssl/patches/patch-doc_ssl_SSL__CTX__use__psk__identity__hint.pod

@@ -0,0 +1,28 @@
+$NetBSD: patch-doc_ssl_SSL__CTX__use__psk__identity__hint.pod,v 1.1 2013/06/01 08:03:55 sbd Exp $
+
+Fix openssl pod docs to work with the very picky pod2man from perl-5.18.0.
+
+--- doc/ssl/SSL_CTX_use_psk_identity_hint.pod.orig	2013-02-11 15:26:04.000000000 +0000
++++ doc/ssl/SSL_CTX_use_psk_identity_hint.pod
+@@ -81,6 +81,8 @@ SSL_CTX_use_psk_identity_hint() and SSL_
+ 
+ Return values from the server callback are interpreted as follows:
+ 
++=over 1
++
+ =item > 0
+ 
+ PSK identity was found and the server callback has provided the PSK
+@@ -94,9 +96,11 @@ data to B<psk> and return the length of
+ connection will fail with decryption_error before it will be finished
+ completely.
+ 
+-=item 0
++=item Z<>0
+ 
+ PSK identity was not found. An "unknown_psk_identity" alert message
+ will be sent and the connection setup fails.
+ 
++=back
++
+ =cut

security/openssl/patches/patch-doc_ssl_SSL__accept.pod

@@ -0,0 +1,21 @@
+$NetBSD: patch-doc_ssl_SSL__accept.pod,v 1.1 2013/06/01 08:03:55 sbd Exp $
+
+Fix openssl pod docs to work with the very picky pod2man from perl-5.18.0.
+
+--- doc/ssl/SSL_accept.pod.orig	2013-02-11 15:02:48.000000000 +0000
++++ doc/ssl/SSL_accept.pod
+@@ -44,12 +44,12 @@ The following return values can occur:
+ 
+ =over 4
+ 
+-=item 1
++=item Z<>1
+ 
+ The TLS/SSL handshake was successfully completed, a TLS/SSL connection has been
+ established.
+ 
+-=item 0
++=item Z<>0
+ 
+ The TLS/SSL handshake was not successful but was shut down controlled and
+ by the specifications of the TLS/SSL protocol. Call SSL_get_error() with the

security/openssl/patches/patch-doc_ssl_SSL__clear.pod

@@ -0,0 +1,15 @@
+$NetBSD: patch-doc_ssl_SSL__clear.pod,v 1.1 2013/06/01 08:03:55 sbd Exp $
+
+Fix openssl pod docs to work with the very picky pod2man from perl-5.18.0.
+
+--- doc/ssl/SSL_clear.pod.orig	2013-02-11 15:02:48.000000000 +0000
++++ doc/ssl/SSL_clear.pod
+@@ -61,7 +61,7 @@ The following return values can occur:
+ The SSL_clear() operation could not be performed. Check the error stack to
+ find out the reason.
+ 
+-=item 1
++=item Z<>1
+ 
+ The SSL_clear() operation was successful.
+ 

security/openssl/patches/patch-doc_ssl_SSL__connect.pod

@@ -0,0 +1,28 @@
+$NetBSD: patch-doc_ssl_SSL__connect.pod,v 1.1 2013/06/01 08:03:55 sbd Exp $
+
+Fix openssl pod docs to work with the very picky pod2man from perl-5.18.0.
+
+--- doc/ssl/SSL_connect.pod.orig	2013-02-11 15:02:48.000000000 +0000
++++ doc/ssl/SSL_connect.pod
+@@ -41,18 +41,18 @@ The following return values can occur:
+ 
+ =over 4
+ 
+-=item 1
++=item Z<>1
+ 
+ The TLS/SSL handshake was successfully completed, a TLS/SSL connection has been
+ established.
+ 
+-=item 0
++=item Z<>0
+ 
+ The TLS/SSL handshake was not successful but was shut down controlled and
+ by the specifications of the TLS/SSL protocol. Call SSL_get_error() with the
+ return value B<ret> to find out the reason.
+ 
+-=item E<lt>0
++=item Z<>E<lt>0
+ 
+ The TLS/SSL handshake was not successful, because a fatal error occurred either
+ at the protocol level or a connection failure occurred. The shutdown was

security/openssl/patches/patch-doc_ssl_SSL__do__handshake.pod

@@ -0,0 +1,21 @@
+$NetBSD: patch-doc_ssl_SSL__do__handshake.pod,v 1.1 2013/06/01 08:03:55 sbd Exp $
+
+Fix openssl pod docs to work with the very picky pod2man from perl-5.18.0.
+
+--- doc/ssl/SSL_do_handshake.pod.orig	2013-02-11 15:02:48.000000000 +0000
++++ doc/ssl/SSL_do_handshake.pod
+@@ -45,12 +45,12 @@ The following return values can occur:
+ 
+ =over 4
+ 
+-=item 1
++=item Z<>1
+ 
+ The TLS/SSL handshake was successfully completed, a TLS/SSL connection has been
+ established.
+ 
+-=item 0
++=item Z<>0
+ 
+ The TLS/SSL handshake was not successful but was shut down controlled and
+ by the specifications of the TLS/SSL protocol. Call SSL_get_error() with the

security/openssl/patches/patch-doc_ssl_SSL__read.pod

@@ -0,0 +1,15 @@
+$NetBSD: patch-doc_ssl_SSL__read.pod,v 1.1 2013/06/01 08:03:55 sbd Exp $
+
+Fix openssl pod docs to work with the very picky pod2man from perl-5.18.0.
+
+--- doc/ssl/SSL_read.pod.orig	2013-02-11 15:02:48.000000000 +0000
++++ doc/ssl/SSL_read.pod
+@@ -86,7 +86,7 @@ The following return values can occur:
+ The read operation was successful; the return value is the number of
+ bytes actually read from the TLS/SSL connection.
+ 
+-=item 0
++=item Z<>0
+ 
+ The read operation was not successful. The reason may either be a clean
+ shutdown due to a "close notify" alert sent by the peer (in which case

security/openssl/patches/patch-doc_ssl_SSL__session__reused.pod

@@ -0,0 +1,15 @@
+$NetBSD: patch-doc_ssl_SSL__session__reused.pod,v 1.1 2013/06/01 08:03:55 sbd Exp $
+
+Fix openssl pod docs to work with the very picky pod2man from perl-5.18.0.
+
+--- doc/ssl/SSL_session_reused.pod.orig	2013-02-11 15:02:48.000000000 +0000
++++ doc/ssl/SSL_session_reused.pod
+@@ -31,7 +31,7 @@ The following return values can occur:
+ 
+ A new session was negotiated.
+ 
+-=item 1
++=item Z<>1
+ 
+ A session was reused.
+ 

security/openssl/patches/patch-doc_ssl_SSL__set__fd.pod

@@ -0,0 +1,15 @@
+$NetBSD: patch-doc_ssl_SSL__set__fd.pod,v 1.1 2013/06/01 08:03:55 sbd Exp $
+
+Fix openssl pod docs to work with the very picky pod2man from perl-5.18.0.
+
+--- doc/ssl/SSL_set_fd.pod.orig	2013-02-11 15:02:48.000000000 +0000
++++ doc/ssl/SSL_set_fd.pod
+@@ -39,7 +39,7 @@ The following return values can occur:
+ 
+ The operation failed. Check the error stack to find out why.
+ 
+-=item 1
++=item Z<>1
+ 
+ The operation succeeded.
+ 

security/openssl/patches/patch-doc_ssl_SSL__set__session.pod

@@ -0,0 +1,15 @@
+$NetBSD: patch-doc_ssl_SSL__set__session.pod,v 1.1 2013/06/01 08:03:55 sbd Exp $
+
+Fix openssl pod docs to work with the very picky pod2man from perl-5.18.0.
+
+--- doc/ssl/SSL_set_session.pod.orig	2013-02-11 15:02:48.000000000 +0000
++++ doc/ssl/SSL_set_session.pod
+@@ -41,7 +41,7 @@ The following return values can occur:
+ 
+ The operation failed; check the error stack to find out the reason.
+ 
+-=item 1
++=item Z<>1
+ 
+ The operation succeeded.
+ 

security/openssl/patches/patch-doc_ssl_SSL__shutdown.pod

@@ -0,0 +1,21 @@
+$NetBSD: patch-doc_ssl_SSL__shutdown.pod,v 1.1 2013/06/01 08:03:55 sbd Exp $
+
+Fix openssl pod docs to work with the very picky pod2man from perl-5.18.0.
+
+--- doc/ssl/SSL_shutdown.pod.orig	2013-02-11 15:02:48.000000000 +0000
++++ doc/ssl/SSL_shutdown.pod
+@@ -92,12 +92,12 @@ The following return values can occur:
+ 
+ =over 4
+ 
+-=item 1
++=item Z<>1
+ 
+ The shutdown was successfully completed. The "close notify" alert was sent
+ and the peer's "close notify" alert was received.
+ 
+-=item 0
++=item Z<>0
+ 
+ The shutdown is not yet finished. Call SSL_shutdown() for a second time,
+ if a bidirectional shutdown shall be performed.

security/openssl/patches/patch-doc_ssl_SSL__write.pod

@@ -0,0 +1,15 @@
+$NetBSD: patch-doc_ssl_SSL__write.pod,v 1.1 2013/06/01 08:03:55 sbd Exp $
+
+Fix openssl pod docs to work with the very picky pod2man from perl-5.18.0.
+
+--- doc/ssl/SSL_write.pod.orig	2013-02-11 15:02:48.000000000 +0000
++++ doc/ssl/SSL_write.pod
+@@ -79,7 +79,7 @@ The following return values can occur:
+ The write operation was successful, the return value is the number of
+ bytes actually written to the TLS/SSL connection.
+ 
+-=item 0
++=item Z<>0
+ 
+ The write operation was not successful. Probably the underlying connection
+ was closed. Call SSL_get_error() with the return value B<ret> to find out,

security/openssl/patches/patch-engines_ccgost_Makefile

@@ -0,0 +1,15 @@
+$NetBSD: patch-engines_ccgost_Makefile,v 1.1 2013/02/06 21:40:34 jperkin Exp $
+
+* Make sure rpath is set properly on the libgost.so engine lib.
+
+--- engines/ccgost/Makefile.orig	2012-04-26 10:42:20.000000000 +0000
++++ engines/ccgost/Makefile	2013-02-04 13:27:37.220193130 +0000
+@@ -32,7 +32,7 @@ lib: $(LIBOBJ)
+ 		$(MAKE) -f $(TOP)/Makefile.shared -e \
+ 			LIBNAME=$(LIBNAME) \
+ 			LIBEXTRAS='$(LIBOBJ)' \
+-			LIBDEPS='-L$(TOP) -lcrypto' \
++			LIBDEPS='-L$(TOP) -lcrypto $(EX_LIBS)' \
+ 			link_o.$(SHLIB_TARGET); \
+ 	else \
+ 		$(AR) $(LIB) $(LIBOBJ); \