15 files changed, 36 insertions, 84 deletions

diff --git a/secure/lib/libssh/Makefile b/secure/lib/libssh/Makefile
index 36b4d7606de9..d23330da1e8d 100644
--- a/secure/lib/libssh/Makefile
+++ b/secure/lib/libssh/Makefile
@@ -34,17 +34,14 @@ SRCS+=	getrrsetbyname.c
 LDNSDIR=	${.CURDIR}/../../../contrib/ldns
 CFLAGS+=	-DHAVE_LDNS=1 -I${LDNSDIR}
 SRCS+=	getrrsetbyname-ldns.c
-DPADD+=	${LIBLDNS}
-LDADD+=	${LDLDNS}
-USEPRIVATELIB+= ldns
+LIBADD+=	ldns
 .endif
 
 CFLAGS+= -I${SSHDIR} -include ssh_namespace.h
 
 .if ${MK_KERBEROS_SUPPORT} != "no"
 CFLAGS+= -include krb5_config.h
-DPADD+=	${LIBGSSAPI} ${LIBKRB5} ${LIBHX509} ${LIBASN1} ${LIBCOM_ERR} ${LIBMD} ${LIBROKEN}
-LDADD+=	-lgssapi -lkrb5 -lhx509 -lasn1 -lcom_err -lmd -lroken
+LIBADD+=	gssapi krb5 hx509 asn1 com_err md roken
 .endif
 
 .if ${MK_OPENSSH_NONE_CIPHER} != "no"
@@ -53,8 +50,7 @@ CFLAGS+= -DNONE_CIPHER_ENABLED
 
 NO_LINT=
 
-DPADD+=	${LIBCRYPTO} ${LIBCRYPT} ${LIBZ}
-LDADD+=	-lcrypto -lcrypt -lz
+LIBADD+=	crypto crypt z
 
 .include <bsd.lib.mk>
 
diff --git a/secure/lib/libssl/Makefile b/secure/lib/libssl/Makefile
index f03eb70a487a..b39858fd2d75 100644
--- a/secure/lib/libssl/Makefile
+++ b/secure/lib/libssl/Makefile
@@ -21,8 +21,7 @@ SRCS=	bio_ssl.c d1_both.c d1_clnt.c d1_enc.c d1_lib.c d1_meth.c d1_pkt.c \
 INCS=	dtls1.h kssl.h srtp.h ssl.h ssl2.h ssl23.h ssl3.h tls1.h
 INCSDIR=${INCLUDEDIR}/openssl
 
-DPADD=	${LIBCRYPTO}
-LDADD=	-lcrypto
+LIBADD=	crypto
 
 .include <bsd.lib.mk>
 
diff --git a/secure/libexec/sftp-server/Makefile b/secure/libexec/sftp-server/Makefile
index ebddba95f2fd..3e55cc9db7eb 100644
--- a/secure/libexec/sftp-server/Makefile
+++ b/secure/libexec/sftp-server/Makefile
@@ -12,9 +12,7 @@ CFLAGS+=-I${SSHDIR} -include ssh_namespace.h
 SRCS+=	roaming_dummy.c
 .endif
 
-DPADD=	${LIBSSH}
-LDADD=  ${LDSSH}
-USEPRIVATELIB= ssh
+LIBADD=	ssh
 
 .if ${MK_LDNS} != "no"
 CFLAGS+=	-DHAVE_LDNS=1
@@ -23,8 +21,7 @@ CFLAGS+=	-DHAVE_LDNS=1
 #USEPRIVATELIB+= ldns
 .endif
 
-DPADD+=	${LIBCRYPT} ${LIBCRYPTO} ${LIBZ}
-LDADD+=	-lcrypt -lcrypto -lz
+LIBADD+=	crypto crypto z
 
 .include <bsd.prog.mk>
 
diff --git a/secure/libexec/ssh-keysign/Makefile b/secure/libexec/ssh-keysign/Makefile
index f248666baace..01e51ef70f15 100644
--- a/secure/libexec/ssh-keysign/Makefile
+++ b/secure/libexec/ssh-keysign/Makefile
@@ -8,9 +8,7 @@ MAN=	ssh-keysign.8
 CFLAGS+=-I${SSHDIR} -include ssh_namespace.h
 BINMODE=4555
 
-DPADD=	${LIBSSH}
-LDADD=	${LDSSH}
-USEPRIVATELIB= ssh
+LIBADD=	ssh
 
 .if ${MK_LDNS} != "no"
 CFLAGS+=	-DHAVE_LDNS=1
@@ -19,8 +17,7 @@ CFLAGS+=	-DHAVE_LDNS=1
 #USEPRIVATELIB+= ldns
 .endif
 
-DPADD+= ${LIBCRYPT} ${LIBCRYPTO} ${LIBZ}
-LDADD+= -lcrypt -lcrypto -lz
+LIBADD+=	crypt crypto z
 
 .include <bsd.prog.mk>
 
diff --git a/secure/libexec/ssh-pkcs11-helper/Makefile b/secure/libexec/ssh-pkcs11-helper/Makefile
index b73416f25dd1..55f151a66638 100644
--- a/secure/libexec/ssh-pkcs11-helper/Makefile
+++ b/secure/libexec/ssh-pkcs11-helper/Makefile
@@ -12,9 +12,7 @@ CFLAGS+=-I${SSHDIR} -include ssh_namespace.h
 SRCS+=	roaming_dummy.c
 .endif
 
-DPADD=	${LIBSSH}
-LDADD=	${LDSSH}
-USEPRIVATELIB= ssh
+LIBADD=	ssh
 
 .if ${MK_LDNS} != "no"
 CFLAGS+=	-DHAVE_LDNS=1
@@ -23,8 +21,7 @@ CFLAGS+=	-DHAVE_LDNS=1
 #USEPRIVATELIB+= ldns
 .endif
 
-DPADD+= ${LIBCRYPT} ${LIBCRYPTO} ${LIBZ}
-LDADD+= -lcrypt -lcrypto -lz
+LIBADD+=	crypt crypto z
 
 .include <bsd.prog.mk>
 
diff --git a/secure/usr.bin/bdes/Makefile b/secure/usr.bin/bdes/Makefile
index 306fc2cfe054..ceadd1202730 100644
--- a/secure/usr.bin/bdes/Makefile
+++ b/secure/usr.bin/bdes/Makefile
@@ -5,7 +5,6 @@ PROG=	bdes
 
 WARNS?=	2
 
-DPADD=	${LIBCRYPTO}
-LDADD=	-lcrypto
+LIBADD=	crypto
 
 .include <bsd.prog.mk>
diff --git a/secure/usr.bin/openssl/Makefile b/secure/usr.bin/openssl/Makefile
index 89deb68699ae..ccc1b6f08d7c 100644
--- a/secure/usr.bin/openssl/Makefile
+++ b/secure/usr.bin/openssl/Makefile
@@ -2,8 +2,7 @@
 
 PROG=	openssl
 
-DPADD=	${LIBSSL} ${LIBCRYPTO}
-LDADD=	-lssl -lcrypto
+LIBADD=	ssl crypto
 
 .if exists(Makefile.man)
 .include "Makefile.man"
diff --git a/secure/usr.bin/scp/Makefile b/secure/usr.bin/scp/Makefile
index 1d77d4fd13b1..12a3caf3914b 100644
--- a/secure/usr.bin/scp/Makefile
+++ b/secure/usr.bin/scp/Makefile
@@ -11,9 +11,7 @@ CFLAGS+=-I${SSHDIR} -include ssh_namespace.h
 SRCS+=	roaming_dummy.c
 .endif
 
-DPADD=	${LIBSSH}
-LDADD=	${LDSSH}
-USEPRIVATELIB= ssh
+LIBADD=	ssh
 
 .if ${MK_LDNS} != "no"
 CFLAGS+=	-DHAVE_LDNS=1
@@ -22,8 +20,7 @@ CFLAGS+=	-DHAVE_LDNS=1
 #USEPRIVATELIB+= ldns
 .endif
 
-DPADD+= ${LIBCRYPT} ${LIBCRYPTO} ${LIBZ}
-LDADD+= -lcrypt -lcrypto -lz
+LIBADD+=	crypt crypto z
 
 .include <bsd.prog.mk>
 
diff --git a/secure/usr.bin/sftp/Makefile b/secure/usr.bin/sftp/Makefile
index 96f9d04132ec..ef130d806cd5 100644
--- a/secure/usr.bin/sftp/Makefile
+++ b/secure/usr.bin/sftp/Makefile
@@ -11,9 +11,7 @@ CFLAGS+=-I${SSHDIR} -include ssh_namespace.h
 SRCS+=	roaming_dummy.c
 .endif
 
-DPADD=	${LIBSSH} ${LIBEDIT} ${LIBNCURSESW}
-LDADD=	${LDSSH} -ledit -lncursesw
-USEPRIVATELIB= ssh
+LIBADD=	ssh edit
 
 .if ${MK_LDNS} != "no"
 CFLAGS+=	-DHAVE_LDNS=1
@@ -22,8 +20,7 @@ CFLAGS+=	-DHAVE_LDNS=1
 #USEPRIVATELIB+= ldns
 .endif
 
-DPADD+= ${LIBCRYPT} ${LIBCRYPTO} ${LIBZ}
-LDADD+= -lcrypt -lcrypto -lz
+LIABDD+=	crypt crypto z
 
 .include <bsd.prog.mk>
 
diff --git a/secure/usr.bin/ssh-add/Makefile b/secure/usr.bin/ssh-add/Makefile
index fe8739be2436..2484a7bb93bd 100644
--- a/secure/usr.bin/ssh-add/Makefile
+++ b/secure/usr.bin/ssh-add/Makefile
@@ -11,9 +11,7 @@ CFLAGS+=-I${SSHDIR} -include ssh_namespace.h
 SRCS+=	roaming_dummy.c
 .endif
 
-DPADD=	${LIBSSH}
-LDADD=	${LDSSH}
-USEPRIVATELIB= ssh
+LIBADD=	ssh
 
 .if ${MK_LDNS} != "no"
 CFLAGS+=	-DHAVE_LDNS=1
@@ -22,8 +20,7 @@ CFLAGS+=	-DHAVE_LDNS=1
 #USEPRIVATELIB+= ldns
 .endif
 
-DPADD+= ${LIBCRYPT} ${LIBCRYPTO} ${LIBZ}
-LDADD+= -lcrypt -lcrypto -lz
+LIBADD+=	crypt crypto z
 
 .include <bsd.prog.mk>
 
diff --git a/secure/usr.bin/ssh-agent/Makefile b/secure/usr.bin/ssh-agent/Makefile
index b5c98b75a9eb..807f7474e4d2 100644
--- a/secure/usr.bin/ssh-agent/Makefile
+++ b/secure/usr.bin/ssh-agent/Makefile
@@ -11,9 +11,7 @@ CFLAGS+=-I${SSHDIR} -include ssh_namespace.h
 SRCS+=	roaming_dummy.c
 .endif
 
-DPADD=	${LIBSSH}
-LDADD=	${LDSSH}
-USEPRIVATELIB= ssh
+LIBADD=	ssh
 
 .if ${MK_LDNS} != "no"
 CFLAGS+=	-DHAVE_LDNS=1
@@ -22,8 +20,7 @@ CFLAGS+=	-DHAVE_LDNS=1
 #USEPRIVATELIB+= ldns
 .endif
 
-DPADD+= ${LIBCRYPT} ${LIBCRYPTO} ${LIBZ}
-LDADD+= -lcrypt -lcrypto -lz
+LIBADD+=	crypt crypto z
 
 .include <bsd.prog.mk>
 
diff --git a/secure/usr.bin/ssh-keygen/Makefile b/secure/usr.bin/ssh-keygen/Makefile
index 62e3927a258b..c2654bad1073 100644
--- a/secure/usr.bin/ssh-keygen/Makefile
+++ b/secure/usr.bin/ssh-keygen/Makefile
@@ -11,19 +11,14 @@ CFLAGS+=-I${SSHDIR} -include ssh_namespace.h
 SRCS+=	roaming_dummy.c
 .endif
 
-DPADD=	${LIBSSH}
-LDADD=	${LDSSH}
-USEPRIVATELIB= ssh
+LIBADD=	ssh
 
 .if ${MK_LDNS} != "no"
 CFLAGS+=	-DHAVE_LDNS=1
-DPADD+=	${LIBLDNS}
-LDADD+=	${LDLDNS}
-USEPRIVATELIB+= ldns
+LIBADD+=	ldns
 .endif
 
-DPADD+= ${LIBCRYPT} ${LIBCRYPTO} ${LIBZ}
-LDADD+= -lcrypt -lcrypto -lz
+LIBADD+=	crypt crypto z
 
 .include <bsd.prog.mk>
 
diff --git a/secure/usr.bin/ssh-keyscan/Makefile b/secure/usr.bin/ssh-keyscan/Makefile
index 44659187c0e7..b4f97a563641 100644
--- a/secure/usr.bin/ssh-keyscan/Makefile
+++ b/secure/usr.bin/ssh-keyscan/Makefile
@@ -6,9 +6,7 @@ PROG=	ssh-keyscan
 SRCS=	ssh-keyscan.c roaming_dummy.c
 CFLAGS+=-I${SSHDIR} -include ssh_namespace.h
 
-DPADD=	${LIBSSH}
-LDADD=	${LDSSH}
-USEPRIVATELIB= ssh
+LIBADD=	ssh
 
 .if ${MK_LDNS} != "no"
 CFLAGS+=	-DHAVE_LDNS=1
@@ -17,8 +15,7 @@ CFLAGS+=	-DHAVE_LDNS=1
 #USEPRIVATELIB+= ldns
 .endif
 
-DPADD+= ${LIBCRYPT} ${LIBCRYPTO} ${LIBZ}
-LDADD+= -lcrypt -lcrypto -lz
+LIBADD+=	crypt crypto z
 
 .include <bsd.prog.mk>
 
diff --git a/secure/usr.bin/ssh/Makefile b/secure/usr.bin/ssh/Makefile
index 3c969cdaa3d4..2f2f97b26fc0 100644
--- a/secure/usr.bin/ssh/Makefile
+++ b/secure/usr.bin/ssh/Makefile
@@ -15,29 +15,23 @@ SRCS=	ssh.c readconf.c clientloop.c sshtty.c \
 # gss-genr.c really belongs in libssh; see src/secure/lib/libssh/Makefile
 SRCS+=	gss-genr.c
 
-DPADD=	${LIBSSH} ${LIBUTIL}
-LDADD=	${LDSSH} -lutil
-USEPRIVATELIB= ssh
+LIBADD=	ssh util
 
 .if ${MK_LDNS} != "no"
 CFLAGS+=	-DHAVE_LDNS=1
-DPADD+=	${LIBLDNS}
-LDADD+=	${LDLDNS}
-USEPRIVATELIB+= ldns
+LIBADD+=	ldns
 .endif
 
 .if ${MK_KERBEROS_SUPPORT} != "no"
 CFLAGS+= -include krb5_config.h
-DPADD+=	 ${LIBGSSAPI}
-LDADD+=	 -lgssapi
+LIBADD+=	gssapi
 .endif
 
 .if ${MK_OPENSSH_NONE_CIPHER} != "no"
 CFLAGS+= -DNONE_CIPHER_ENABLED
 .endif
 
-DPADD+= ${LIBCRYPT} ${LIBCRYPTO} ${LIBZ}
-LDADD+= -lcrypt -lcrypto -lz
+LIBADD+=	crypt crypto z
 
 .if defined(LOCALBASE)
 CFLAGS+= -DXAUTH_PATH=\"${LOCALBASE}/bin/xauth\"
diff --git a/secure/usr.sbin/sshd/Makefile b/secure/usr.sbin/sshd/Makefile
index 721531552c52..f95c8c653322 100644
--- a/secure/usr.sbin/sshd/Makefile
+++ b/secure/usr.sbin/sshd/Makefile
@@ -25,9 +25,7 @@ SRCS+=	gss-genr.c
 MAN=	sshd.8 sshd_config.5
 CFLAGS+=-I${SSHDIR} -include ssh_namespace.h
 
-DPADD=	${LIBSSH} ${LIBUTIL} ${LIBWRAP} ${LIBPAM}
-LDADD=	${LDSSH} -lutil -lwrap ${MINUSLPAM}
-USEPRIVATELIB= ssh
+LIBADD=	ssh util wrap pam
 
 .if ${MK_LDNS} != "no"
 CFLAGS+=	-DHAVE_LDNS=1
@@ -38,33 +36,29 @@ CFLAGS+=	-DHAVE_LDNS=1
 
 .if ${MK_AUDIT} != "no"
 CFLAGS+= -DUSE_BSM_AUDIT -DHAVE_GETAUDIT_ADDR
-DPADD+=  ${LIBBSM}
-LDADD+=  -lbsm
+LIBADD+=	bsm
 .endif
 
 .if ${MK_KERBEROS_SUPPORT} != "no"
 CFLAGS+= -include krb5_config.h
-DPADD+=	 ${LIBGSSAPI_KRB5} ${LIBGSSAPI} ${LIBKRB5} ${LIBHX509} ${LIBASN1} \
-	${LIBCOM_ERR} ${LIBROKEN} ${LIBWIND} ${LIBHEIMBASE} ${LIBHEIMIPCC}
-LDADD+=	 -lgssapi_krb5 -lgssapi -lkrb5 -lhx509 -lasn1 \
-	-lcom_err -lroken -lwind -lheimbase ${LDHEIMIPCC}
+LIBADD+=	gssapi_krb5 gssapi krb5 hx509 asn1 com_err roken wind heimbase \
+		heimipcc
 .endif
 
 .if ${MK_OPENSSH_NONE_CIPHER} != "no"
 CFLAGS+= -DNONE_CIPHER_ENABLED
 .endif
 
-DPADD+= ${LIBCRYPT} ${LIBCRYPTO} ${LIBZ}
-LDADD+= -lcrypt -lcrypto -lz
+LIBADD+= crypt crypto z
 
 # Fix the order of NEEDED entries for libthr and libc. The libthr
 # needs to interpose libc symbols, leaving the libthr loading as
 # dependency of krb causes reversed order and broken interposing. Put
 # the threading library last on the linker command line, just before
 # the -lc added by a compiler driver.
+# XXX In theory the framework now takes care of that, it needs to be checked
 .if ${MK_KERBEROS_SUPPORT} != "no"
-DPADD+= ${LIBPTHREAD}
-LDADD+= -lpthread
+LIBADD+=	pthread
 .endif
 
 .if defined(LOCALBASE)