Update cyrus-sasl to 1.5.24nb2:

* Move headers to ${PREFIX}/include and get rid of need for the MD5
  headers.
* Move creation of cyrus user and mail group from cyrus-imapd to cyrus-sasl.
* Always compile support for pwcheck.
* Supply a ${PREFIX}/etc/rc.d/pwcheck script that drops in the rc.d startup
  scheme.
* Supply a sasl-config script that can return compiler flags needed for
  linking against -lsasl.
* Install documentation.
* Supply DEINSTALL/INSTALL scripts to manage the /var/pwcheck directory
  and /etc/sasldb shared secrets database.
* Improve the descriptions in the COMMENT and DESCR files.
* Make me the maintainer.

22 files changed, 966 insertions, 112 deletions

diff --git a/security/cyrus-sasl/Makefile b/security/cyrus-sasl/Makefile
index 1221fc6c8a3..a7aa43156b9 100644
--- a/security/cyrus-sasl/Makefile
+++ b/security/cyrus-sasl/Makefile
@@ -1,50 +1,125 @@
-# $NetBSD: Makefile,v 1.4 2000/12/08 14:32:00 wiz Exp $
+# $NetBSD: Makefile,v 1.5 2000/12/10 09:43:36 jlam Exp $
 
-DISTNAME=	cyrus-sasl-1.5.24
-PKGNAME=	${DISTNAME}nb1
-CATEGORIES=	security
-MASTER_SITES=	ftp://ftp.andrew.cmu.edu/pub/cyrus-mail/
+DISTNAME=		cyrus-sasl-1.5.24
+PKGNAME=		${DISTNAME}nb2
+CATEGORIES=		security
+MASTER_SITES=		ftp://ftp.andrew.cmu.edu/pub/cyrus-mail/ \
+			ftp://ftp.andrew.cmu.edu/pub/cyrus-mail/OLD-VERSIONS/sasl/
 
-MAINTAINER=	packages@netbsd.org
-HOMEPAGE=	http://asg.web.cmu.edu/cyrus/imapd/
+MAINTAINER=		jlam@netbsd.org
+HOMEPAGE=		http://asg.web.cmu.edu/cyrus/imapd/
 
-GNU_CONFIGURE=		yes
-USE_LIBTOOL=		yes
+BUILD_DEPENDS+=		automake:../../devel/automake
+
+GNU_CONFIGURE=		# defined
+USE_SSL=		# defined
+USE_GMAKE=		# defined
+USE_LIBTOOL=		# defined
 LTCONFIG_OVERRIDE=	${WRKSRC}/config/ltconfig
 
 .include "../../mk/bsd.prefs.mk"
 
-.if !exists(/usr/include/openssl/rc4.h)
-DEPENDS+=	openssl-0.9.*:../../security/openssl
-CONFIGURE_ENV+=	CPPFLAGS="-I${PREFIX}/include"
-.endif
+# CYRUS_USER		username of the Cyrus administrator
+# CYRUS_GROUP		group of the Cyrus administrator
+#
+CYRUS_USER?=		cyrus
+CYRUS_GROUP?=		mail
+
+BUILD_DEFS+=		CYRUS_USER CYRUS_GROUP
 
+PLIST_SRC=		${PKGDIR}/PLIST.common
+
+CONFIGURE_ARGS+=	--with-pwcheck=/var/pwcheck
+CONFIGURE_ARGS+=	--with-dblib=ndbm
+CONFIGURE_ARGS+=	--with-dbpath=/etc/sasldb
 CONFIGURE_ARGS+=	--with-plugindir=${PREFIX}/lib/sasl
+CONFIGURE_ARGS+=	--with-rc4=${SSLBASE}
 
 .if defined(USE_PAM)
 CONFIGURE_ARGS+=	--with-pam=${PREFIX}
 DEPENDS+=		PAM-*:../../security/PAM
 .endif
-.if defined(CYRUS_USE_PWCHECK)
-CONFIGURE_ARGS+=	--with-pwcheck
-.endif
-.if defined(KERBEROS) && (${KERBEROS} == 4)
-CONFIGURE_ARGS+=	--enable-krb4=${PREFIX}
+
+# Authentication mechanisms
+CONFIGURE_ARGS+=	--enable-anon		# ANONYMOUS
+CONFIGURE_ARGS+=	--enable-cram		# CRAM-MD5
+CONFIGURE_ARGS+=	--enable-digest		# DIGEST-MD5
+CONFIGURE_ARGS+=	--disable-login		# --- no LOGIN
+CONFIGURE_ARGS+=	--enable-plain		# PLAIN
+CONFIGURE_ARGS+=	--disable-scram		# --- no SCRAM-MD5
+CONFIGURE_ARGS+=	--disable-sia		# --- no SIA
+CONFIGURE_ARGS+=	--disable-srp		# --- no SRP
+CONFIGURE_ARGS+=	--disable-x509		# --- no X.509
+
+.if defined(KERBEROS) && ${KERBEROS} == 4
+CONFIGURE_ARGS+=	--enable-krb4=${PREFIX}	# KERBEROS_V4
 DEPENDS+=		kth-krb4-*:../../security/kth-krb4
+PLIST_SRC+=		${PKGDIR}/PLIST.krb4
 .else
-CONFIGURE_ARGS+=	--disable-krb4
+CONFIGURE_ARGS+=	--disable-krb4		# --- no KERBEROS_V4
 .endif
 
-PLIST_SRC=	${WRKDIR}/.PLIST_SRC
+.if ${OPSYS} == "SunOS" || (defined(KERBEROS) && ${KERBEROS} == 5)
+USE_KERBEROS=		# defined
+CONFIGURE_ARGS+=	--enable-gssapi=/usr	# GSSAPI
+PLIST_SRC+=		${PKGDIR}/PLIST.krb5
+.else
+CONFIGURE_ARGS+=	--disable-gssapi	# --- no GSSAPI
+.endif
 
-post-build:
-	${ECHO} > ${PLIST_SRC}
-.if defined(CYRUS_USE_PWCHECK)
-	${CAT} ${PKGDIR}/PLIST.pwcheck >> ${PLIST_SRC}
+PLIST_SRC+=		${PKGDIR}/PLIST.plugins
+
+.if ${OPSYS} == "NetBSD"
+.if exists(/usr/sbin/user)
+ADDUSER=		/usr/sbin/useradd
+ADDGROUP=		/usr/sbin/groupadd
+.else
+DEPENDS+=		user>=20000313:../../sysutils/user
+ADDUSER=		${LOCALBASE}/sbin/useradd
+ADDGROUP=		${LOCALBASE}/sbin/groupadd
 .endif
-.if defined(KERBEROS) && (${KERBEROS} == 4)
-	${CAT} ${PKGDIR}/PLIST.krb4 >> ${PLIST_SRC}
+.elif ${OPSYS} == "SunOS"
+ADDUSER=		useradd
+ADDGROUP=		groupadd
 .endif
-	${CAT} ${PKGDIR}/PLIST.common ${PKGDIR}/PLIST.${LOWER_OPSYS} >> ${PLIST_SRC}
+
+DEINSTALL_FILE=		${WRKDIR}/DEINSTALL
+INSTALL_FILE=		${WRKDIR}/INSTALL
+
+HTMLDIR=		${PREFIX}/share/doc/html/cyrus-sasl
+
+post-extract:
+	cd ${WRKSRC}; ${RM} -f include/md5.h
+	${CP} ${FILESDIR}/sasl-config.in ${WRKSRC}/plugins
+
+pre-configure:
+	cd ${WRKSRC} && autoheader && autoconf && automake --gnu
+
+post-build:
+	${SED}	-e "s,@PREFIX@,${PREFIX},g" \
+		< ${FILESDIR}/pwcheck.sh > ${WRKDIR}/pwcheck.sh
+
+pre-install:
+	${SED}	-e "s,@CYRUS_USER@,${CYRUS_USER},g" \
+		-e "s,@CYRUS_GROUP@,${CYRUS_GROUP},g" \
+		< ${PKGDIR}/DEINSTALL > ${DEINSTALL_FILE}
+	${SED}	-e "s,@CYRUS_USER@,${CYRUS_USER},g" \
+		-e "s,@CYRUS_GROUP@,${CYRUS_GROUP},g" \
+		-e "s,@ADDUSER@,${ADDUSER},g" \
+		-e "s,@CHGRP@,${CHGRP},g" \
+		-e "s,@CHMOD@,${CHMOD},g" \
+		-e "s,@CHOWN@,${CHOWN},g" \
+		-e "s,@GREP@,${GREP},g" \
+		-e "s,@MKDIR@,${MKDIR},g" \
+		-e "s,@RM@,${RM},g" \
+		-e "s,@TOUCH@,${TOUCH},g" \
+		< ${PKGDIR}/INSTALL > ${INSTALL_FILE}
+	PKG_PREFIX=${PREFIX} ${SH} ${INSTALL_FILE} ${PKGNAME} PRE-INSTALL
+
+post-install:
+	${INSTALL_SCRIPT} ${WRKDIR}/pwcheck.sh ${PREFIX}/etc/rc.d/pwcheck
+	${INSTALL_DATA_DIR} ${HTMLDIR}
+	cd ${WRKSRC}/doc; ${INSTALL_DATA} *.html *.txt ${HTMLDIR}
+	PKG_PREFIX=${PREFIX} ${SH} ${INSTALL_FILE} ${PKGNAME} POST-INSTALL
 
 .include "../../mk/bsd.pkg.mk"
diff --git a/security/cyrus-sasl/files/patch-sum b/security/cyrus-sasl/files/patch-sum
index cd5196e074d..392fa393a3a 100644
--- a/security/cyrus-sasl/files/patch-sum
+++ b/security/cyrus-sasl/files/patch-sum
@@ -1,4 +1,10 @@
-$NetBSD: patch-sum,v 1.2 2000/12/08 14:32:01 wiz Exp $
+$NetBSD: patch-sum,v 1.3 2000/12/10 09:43:37 jlam Exp $
 
-MD5 (patch-aa) = b52859d030d1017a4ed95ce103f9f53d
-MD5 (patch-ab) = f2e1354733f40c1be91cb784858f9b97
+MD5 (patch-aa) = 58314d0341661a6a0a65f138a933b50d
+MD5 (patch-ab) = e06e64a8beeccc8389f36ae6b1de045e
+MD5 (patch-ac) = a7e24938129451cf1badf0dee37ed070
+MD5 (patch-ad) = 53b8e850263ca1fab1115e66b061a869
+MD5 (patch-ae) = 608e7a8a4e9ffa8701904f66b0770e5b
+MD5 (patch-af) = 0594f8bc52a4fb8e81db024404c3ebcc
+MD5 (patch-ag) = e7e127c693b44728fb974ce589a075eb
+MD5 (patch-ah) = e848e4172a104e48f34be29b8653457b
diff --git a/security/cyrus-sasl/files/pwcheck.sh b/security/cyrus-sasl/files/pwcheck.sh
new file mode 100644
index 00000000000..fe63b450a6f
--- /dev/null
+++ b/security/cyrus-sasl/files/pwcheck.sh
@@ -0,0 +1,56 @@
+#!/bin/sh
+#
+# $NetBSD: pwcheck.sh,v 1.1 2000/12/10 09:43:37 jlam Exp $
+#
+# The pwcheck daemon allows UNIX password authentication with Cyrus SASL.
+#
+# PROVIDE: pwcheck
+# REQUIRE: DAEMON
+
+
+name="pwcheck"
+command=@PREFIX@/sbin/${name}
+command_args="& sleep 2"
+
+pid=`ps -ax | awk '{print $1,$5}' | grep ${name} | awk '{print $1}'`
+
+cmd=${1:-start}
+
+case ${cmd} in
+start)
+	if [ "$pid" = "" -a -x ${command} ]
+	then
+		echo "Starting ${name}."
+		${command} ${command_args}
+	fi
+	;;
+
+restart)
+	( $0 stop )
+	sleep 1
+	$0 start
+	;;
+
+stop)
+	if [ "$pid" != "" ]
+	then
+		echo "Stopping ${name}."
+		kill $pid
+	fi
+	;;
+
+status)
+	if [ "$pid" != "" ]
+	then
+		echo "${name} is running as pid ${pid}."
+	else
+		echo "${name} is not running."
+	fi
+	;;
+
+*)
+	echo 1>&2 "Usage: ${name} [restart|start|stop|status]"
+	exit 1
+	;;
+esac
+exit 0
diff --git a/security/cyrus-sasl/files/sasl-config.in b/security/cyrus-sasl/files/sasl-config.in
new file mode 100644
index 00000000000..606c73a2058
--- /dev/null
+++ b/security/cyrus-sasl/files/sasl-config.in
@@ -0,0 +1,102 @@
+#!/bin/sh
+#
+# $NetBSD: sasl-config.in,v 1.1 2000/12/10 09:43:37 jlam Exp $
+
+sasl_libs="%%sasl_config_LIBS%%"
+sasl_cflags="%%sasl_config_CFLAGS%%"
+
+prefix=%%prefix%%
+exec_prefix=${prefix}
+exec_prefix_set=no
+
+usage()
+{
+	cat <<EOF
+Usage: sasl-config [OPTIONS]
+Options:
+	[--prefix[=DIR]]
+	[--exec-prefix[=DIR]]
+	[--version]
+	[--libs]
+	[--cflags]
+EOF
+	exit $1
+}
+
+if test $# -eq 0; then
+	usage 1 1>&2
+fi
+
+while test $# -gt 0; do
+  case "$1" in
+  -*=*) optarg=`echo "$1" | sed 's/[-_a-zA-Z0-9]*=//'` ;;
+  *) optarg= ;;
+  esac
+
+  case $1 in
+    --prefix=*)
+      prefix=$optarg
+      if test $exec_prefix_set = no ; then
+        exec_prefix=$optarg
+      fi
+      ;;
+    --prefix)
+      echo_prefix=yes
+      ;;
+    --exec-prefix=*)
+      exec_prefix=$optarg
+      exec_prefix_set=yes
+      ;;
+    --exec-prefix)
+      echo_exec_prefix=yes
+      ;;
+    --version)
+      echo %%VERSION%%
+      ;;
+    --cflags)
+      echo_cflags=yes
+      ;;
+    --libs)
+      echo_libs=yes
+      ;;
+    *)
+      usage 1 1>&2
+      ;;
+  esac
+  shift
+done
+
+if test "$echo_prefix" = "yes"; then
+	echo $prefix
+fi
+
+if test "$echo_exec_prefix" = "yes"; then
+	echo $exec_prefix
+fi
+
+if test "$echo_cflags" = "yes"; then
+      if test ${prefix}/include != /usr/include ; then
+        includes=-I${prefix}/include
+        for i in $sasl_cflags ; do
+          if test $i = -I${prefix}/include ; then
+            includes=""
+          fi
+        done
+      fi
+      echo $includes $sasl_cflags
+fi
+
+if test "$echo_libs" = "yes"; then
+      libdirs="-L${exec_prefix}/lib -Wl,-R${exec_prefix}/lib"
+      for i in $sasl_libs ; do
+        if test $i != -L${exec_prefix}/lib -a $i != -Wl,-R${exec_prefix}/lib ; then
+          if test -z "$my_sasl_libs" ; then
+            my_sasl_libs="$i"
+          else
+            my_sasl_libs="$my_sasl_libs $i"
+          fi
+        fi
+      done
+
+      echo $libdirs $my_sasl_libs
+fi
diff --git a/security/cyrus-sasl/patches/patch-aa b/security/cyrus-sasl/patches/patch-aa
index 9caebd2d635..453c5143d37 100644
--- a/security/cyrus-sasl/patches/patch-aa
+++ b/security/cyrus-sasl/patches/patch-aa
@@ -1,35 +1,34 @@
-$NetBSD: patch-aa,v 1.1.1.1 2000/08/25 15:23:49 jlam Exp $
+$NetBSD: patch-aa,v 1.2 2000/12/10 09:43:37 jlam Exp $
 
---- include/Makefile.in	Fri Jul 21 04:36:01 2000
-+++ include/Makefile.in	Fri Aug  4 12:12:16 2000
-@@ -246,17 +246,17 @@
+--- configure.in.orig	Thu Jul 20 22:35:01 2000
++++ configure.in
+@@ -65,9 +65,12 @@
  
- install-includeHEADERS: $(include_HEADERS)
- 	@$(NORMAL_INSTALL)
--	$(mkinstalldirs) $(DESTDIR)$(includedir)
-+	$(mkinstalldirs) $(DESTDIR)$(pkgincludedir)
- 	@list='$(include_HEADERS)'; for p in $$list; do \
- 	  if test -f "$$p"; then d= ; else d="$(srcdir)/"; fi; \
--	  echo " $(INSTALL_DATA) $$d$$p $(DESTDIR)$(includedir)/$$p"; \
--	  $(INSTALL_DATA) $$d$$p $(DESTDIR)$(includedir)/$$p; \
-+	  echo " $(INSTALL_DATA) $$d$$p $(DESTDIR)$(pkgincludedir)/$$p"; \
-+	  $(INSTALL_DATA) $$d$$p $(DESTDIR)$(pkgincludedir)/$$p; \
- 	done
+ dnl check for -R, etc. switch
+ CMU_GUESS_RUNPATH_SWITCH
+-dnl let's just link against local.  otherwise we never find anything useful.
+-CPPFLAGS="-I/usr/local/include ${CPPFLAGS}"
+-CMU_ADD_LIBPATH("/usr/local/lib")
++
++AC_PATH_PROG(SED, sed, no)
++if test "$SED" = "no"; then
++  AC_ERROR([sed is required to build sasl-config])
++fi
++AC_SUBST(SED)
  
- uninstall-includeHEADERS:
- 	@$(NORMAL_UNINSTALL)
- 	list='$(include_HEADERS)'; for p in $$list; do \
--	  rm -f $(DESTDIR)$(includedir)/$$p; \
-+	  rm -f $(DESTDIR)$(pkgincludedir)/$$p; \
- 	done
+ AM_DISABLE_STATIC
  
- tags: TAGS
-@@ -327,7 +327,7 @@
- install-strip:
- 	$(MAKE) $(AM_MAKEFLAGS) AM_INSTALL_PROGRAM_FLAGS=-s install
- installdirs:
--	$(mkinstalldirs)  $(DESTDIR)$(includedir)
-+	$(mkinstalldirs)  $(DESTDIR)$(pkgincludedir)
+@@ -352,8 +355,11 @@
+     CPPFLAGS="$CPPFLAGS -I${with_des}/include"
+     LDFLAGS="$LDFLAGS -L${with_des}/lib"
+   fi
+-  AC_CHECK_LIB(des, des_pcbc_encrypt, [LIB_DES="-ldes";
+-				       with_des=yes], with_des=no)
++  AC_CHECK_LIB(des, des_pcbc_encrypt,
++	AC_CHECK_HEADER(des.h, [LIB_DES="-ldes";
++				with_des=yes],
++			with_des=no),
++	with_des=no)
  
- 
- mostlyclean-generic:
+   if test "$with_des" = no; then
+     dnl if openssl is around, we might be able to use that for des
diff --git a/security/cyrus-sasl/patches/patch-ab b/security/cyrus-sasl/patches/patch-ab
index 90d98beb252..f2ec479e850 100644
--- a/security/cyrus-sasl/patches/patch-ab
+++ b/security/cyrus-sasl/patches/patch-ab
@@ -1,13 +1,13 @@
-$NetBSD: patch-ab,v 1.1 2000/12/08 14:32:01 wiz Exp $
+$NetBSD: patch-ab,v 1.2 2000/12/10 09:43:37 jlam Exp $
 
---- configure.orig	Fri Jul 21 04:35:50 2000
-+++ configure
-@@ -3512,6 +3512,8 @@
-   echo "$ac_t""yes" 1>&6
-   LIB_DES="-ldes";
- 				       with_des=yes
-+# we want the des code form openssl
-+				       with_des=no
- else
-   echo "$ac_t""no" 1>&6
- with_des=no
+--- include/Makefile.am.orig	Wed Mar  8 16:54:33 2000
++++ include/Makefile.am
+@@ -42,7 +42,7 @@
+ #
+ ################################################################
+ 
+-include_HEADERS = hmac-md5.h md5.h md5global.h sasl.h saslplug.h saslutil.h
++include_HEADERS = hmac-md5.h sasl.h saslplug.h saslutil.h
+ 
+ noinst_PROGRAMS = makemd5
+ 
diff --git a/security/cyrus-sasl/patches/patch-ac b/security/cyrus-sasl/patches/patch-ac
new file mode 100644
index 00000000000..641812fc2f8
--- /dev/null
+++ b/security/cyrus-sasl/patches/patch-ac
@@ -0,0 +1,15 @@
+$NetBSD: patch-ac,v 1.1 2000/12/10 09:43:37 jlam Exp $
+
+--- include/hmac-md5.h.orig	Mon Nov 16 15:06:38 1998
++++ include/hmac-md5.h
+@@ -15,8 +15,8 @@
+  *  values stored in network byte order (Big Endian)
+  */
+ typedef struct HMAC_MD5_STATE_s {
+-    UINT4 istate[4];
+-    UINT4 ostate[4];
++    u_int32_t istate[4];
++    u_int32_t ostate[4];
+ } HMAC_MD5_STATE;
+ 
+ /* One step hmac computation
diff --git a/security/cyrus-sasl/patches/patch-ad b/security/cyrus-sasl/patches/patch-ad
new file mode 100644
index 00000000000..b5e2e7a1497
--- /dev/null
+++ b/security/cyrus-sasl/patches/patch-ad
@@ -0,0 +1,17 @@
+$NetBSD: patch-ad,v 1.1 2000/12/10 09:43:37 jlam Exp $
+
+--- include/saslplug.h.orig	Sun Feb 27 17:39:02 2000
++++ include/saslplug.h
+@@ -4,11 +4,8 @@
+ #ifndef SASLPLUG_H
+ #define SASLPLUG_H 1
+ 
+-#ifndef MD5GLOBAL_H
+-#include "md5global.h"
+-#endif
+ #ifndef MD5_H
+-#include "md5.h"
++#include <md5.h>
+ #endif
+ #ifndef HMAC_MD5_H
+ #include "hmac-md5.h"
diff --git a/security/cyrus-sasl/patches/patch-ae b/security/cyrus-sasl/patches/patch-ae
new file mode 100644
index 00000000000..e4bde9d97c6
--- /dev/null
+++ b/security/cyrus-sasl/patches/patch-ae
@@ -0,0 +1,395 @@
+$NetBSD: patch-ae,v 1.1 2000/12/10 09:43:37 jlam Exp $
+
+--- lib/md5.c.orig	Mon Mar 29 16:26:14 1999
++++ lib/md5.c
+@@ -24,327 +24,10 @@
+ */
+ 
+ #include <config.h>
+-#include "md5global.h"
+-#include "md5.h"
++#include <md5.h>
++#include <string.h>
+ #include "hmac-md5.h"
+ 
+-/* Constants for MD5Transform routine.
+-*/
+-
+-#define S11 7
+-#define S12 12
+-#define S13 17
+-#define S14 22
+-#define S21 5
+-#define S22 9
+-#define S23 14
+-#define S24 20
+-#define S31 4
+-#define S32 11
+-#define S33 16
+-#define S34 23
+-#define S41 6
+-#define S42 10
+-#define S43 15
+-#define S44 21
+-
+-static void MD5Transform PROTO_LIST ((UINT4 [4], unsigned char [64]));
+-static void Encode PROTO_LIST
+-       ((unsigned char *, UINT4 *, unsigned int)); 
+-static void Decode PROTO_LIST
+-       ((UINT4 *, unsigned char *, unsigned int)); 
+-static void MD5_memcpy PROTO_LIST ((POINTER, POINTER, unsigned int));
+-static void MD5_memset PROTO_LIST ((POINTER, int, unsigned int));
+-
+-static unsigned char PADDING[64] = {
+-       0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+-       0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 
+-};
+-
+-/* F, G, H and I are basic MD5 functions.
+-
+-        */
+-#ifdef I
+-/* This might be defined via NANA */
+-#undef I
+-#endif
+-
+-#define F(x, y, z) (((x) & (y)) | ((~x) & (z)))
+-#define G(x, y, z) (((x) & (z)) | ((y) & (~z)))
+-#define H(x, y, z) ((x) ^ (y) ^ (z))
+-#define I(x, y, z) ((y) ^ ((x) | (~z)))
+-
+-/* ROTATE_LEFT rotates x left n bits.
+-
+-        */
+-
+-#define ROTATE_LEFT(x, n) (((x) << (n)) | ((x) >> (32-(n))))
+-
+-/* FF, GG, HH, and II transformations for rounds 1, 2, 3, and 4.
+-Rotation is separate from addition to prevent recomputation.
+-*/
+-
+-#define FF(a, b, c, d, x, s, ac) { (a) += F ((b), (c), (d)) + (x) + (UINT4)(ac); (a) = ROTATE_LEFT ((a), (s));        (a) += (b);        } 
+-#define GG(a, b, c, d, x, s, ac) {        (a) += G ((b), (c), (d)) + (x) + (UINT4)(ac);        (a) = ROTATE_LEFT ((a), (s));        (a) += (b);         } 
+-#define HH(a, b, c, d, x, s, ac) {        (a) += H ((b), (c), (d)) + (x) + (UINT4)(ac);        (a) = ROTATE_LEFT ((a), (s));        (a) += (b);        } 
+-#define II(a, b, c, d, x, s, ac) {        (a) += I ((b), (c), (d)) + (x) + (UINT4)(ac);        (a) = ROTATE_LEFT ((a), (s));        (a) += (b);        } 
+-
+-/* MD5 initialization. Begins an MD5 operation, writing a new context.
+-*/
+-
+-void MD5Init (context)
+-MD5_CTX *context; /* context */
+-{
+-       context->count[0] = context->count[1] = 0; 
+-
+-         /* Load magic initialization constants.
+-
+-*/
+-       context->state[0] = 0x67452301; 
+-       context->state[1] = 0xefcdab89; 
+-       context->state[2] = 0x98badcfe; 
+-       context->state[3] = 0x10325476; 
+-}
+-
+-/* MD5 block update operation. Continues an MD5 message-digest
+-       operation, processing another message block, and updating the context. 
+-*/
+-
+-void MD5Update (context, input, inputLen)
+-MD5_CTX *context; /* context */
+-unsigned char *input; /* input block */
+-unsigned int inputLen; /* length of input block */
+-{
+-       unsigned int i, index, partLen; 
+-
+-         /* Compute number of bytes mod 64 */
+-         index = (unsigned int)((context->count[0] >> 3) & 0x3F);
+-
+-         /* Update number of bits */
+-         if ((context->count[0] += ((UINT4)inputLen << 3))
+-          < ((UINT4)inputLen << 3))
+-        context->count[1]++;
+-         context->count[1] += ((UINT4)inputLen >> 29);
+-
+-       partLen = 64 - index; 
+-
+-         /* Transform as many times as possible.
+-
+-*/
+-       if (inputLen >= partLen) { 
+-       MD5_memcpy 
+-       ((POINTER)&context->buffer[index], (POINTER)input, partLen); MD5Transform
+-       (context->state, context->buffer); 
+-
+-       for (i = partLen; i + 63 < inputLen; i += 64) 
+-       MD5Transform (context->state, &input[i]); 
+-
+-       index = 0; 
+-       } 
+-       else 
+-       i = 0; 
+-
+-         /* Buffer remaining input */
+-         MD5_memcpy
+-        ((POINTER)&context->buffer[index], (POINTER)&input[i],
+-         inputLen-i);
+-
+-}
+-
+-/* MD5 finalization. Ends an MD5 message-digest operation, writing the
+-       the message digest and zeroizing the context. 
+-
+-        */
+-
+-void MD5Final (digest, context)
+-unsigned char digest[16]; /* message digest */
+-MD5_CTX *context; /* context */
+-{
+-       unsigned char bits[8]; 
+-       unsigned int index, padLen; 
+-
+-         /* Save number of bits */
+-         Encode (bits, context->count, 8);
+-
+-         /* Pad out to 56 mod 64.
+-
+-*/
+-       index = (unsigned int)((context->count[0] >> 3) & 0x3f); 
+-       padLen = (index < 56) ? (56 - index) : (120 - index); 
+-       MD5Update (context, PADDING, padLen); 
+-
+-         /* Append length (before padding) */
+-         MD5Update (context, bits, 8);
+-
+-         /* Store state in digest */
+-         Encode (digest, context->state, 16);
+-
+-         /* Zeroize sensitive information.
+-
+-*/
+-       MD5_memset ((POINTER)context, 0, sizeof (*context)); 
+-}
+-
+-/* MD5 basic transformation. Transforms state based on block.
+-
+-        */
+-
+-static void MD5Transform (state, block)
+-UINT4 state[4];
+-unsigned char block[64];
+-{
+-       UINT4 a = state[0], b = state[1], c = state[2], d = state[3], x[16]; 
+-
+-       Decode (x, block, 64); 
+-
+-         /* Round 1 */
+-         FF (a, b, c, d, x[ 0], S11, 0xd76aa478); /* 1 */
+-         FF (d, a, b, c, x[ 1], S12, 0xe8c7b756); /* 2 */
+-         FF (c, d, a, b, x[ 2], S13, 0x242070db); /* 3 */
+-         FF (b, c, d, a, x[ 3], S14, 0xc1bdceee); /* 4 */
+-         FF (a, b, c, d, x[ 4], S11, 0xf57c0faf); /* 5 */
+-         FF (d, a, b, c, x[ 5], S12, 0x4787c62a); /* 6 */
+-         FF (c, d, a, b, x[ 6], S13, 0xa8304613); /* 7 */
+-         FF (b, c, d, a, x[ 7], S14, 0xfd469501); /* 8 */
+-         FF (a, b, c, d, x[ 8], S11, 0x698098d8); /* 9 */
+-         FF (d, a, b, c, x[ 9], S12, 0x8b44f7af); /* 10 */
+-         FF (c, d, a, b, x[10], S13, 0xffff5bb1); /* 11 */
+-         FF (b, c, d, a, x[11], S14, 0x895cd7be); /* 12 */
+-         FF (a, b, c, d, x[12], S11, 0x6b901122); /* 13 */
+-         FF (d, a, b, c, x[13], S12, 0xfd987193); /* 14 */
+-         FF (c, d, a, b, x[14], S13, 0xa679438e); /* 15 */
+-         FF (b, c, d, a, x[15], S14, 0x49b40821); /* 16 */
+-
+-        /* Round 2 */
+-         GG (a, b, c, d, x[ 1], S21, 0xf61e2562); /* 17 */
+-         GG (d, a, b, c, x[ 6], S22, 0xc040b340); /* 18 */
+-         GG (c, d, a, b, x[11], S23, 0x265e5a51); /* 19 */
+-         GG (b, c, d, a, x[ 0], S24, 0xe9b6c7aa); /* 20 */
+-         GG (a, b, c, d, x[ 5], S21, 0xd62f105d); /* 21 */
+-         GG (d, a, b, c, x[10], S22,  0x2441453); /* 22 */
+-         GG (c, d, a, b, x[15], S23, 0xd8a1e681); /* 23 */
+-         GG (b, c, d, a, x[ 4], S24, 0xe7d3fbc8); /* 24 */
+-         GG (a, b, c, d, x[ 9], S21, 0x21e1cde6); /* 25 */
+-         GG (d, a, b, c, x[14], S22, 0xc33707d6); /* 26 */
+-         GG (c, d, a, b, x[ 3], S23, 0xf4d50d87); /* 27 */
+-	 GG (b, c, d, a, x[ 8], S24, 0x455a14ed); /* 28 */ 
+-	 GG (a, b, c, d, x[13], S21, 0xa9e3e905); /* 29 */ 
+-	 GG (d, a, b, c, x[ 2], S22, 0xfcefa3f8); /* 30 */ 
+-	 GG (c, d, a, b, x[ 7], S23, 0x676f02d9); /* 31 */ 
+-	 GG (b, c, d, a, x[12], S24, 0x8d2a4c8a); /* 32 */ 
+-
+-         /* Round 3 */
+-         HH (a, b, c, d, x[ 5], S31, 0xfffa3942); /* 33 */
+-         HH (d, a, b, c, x[ 8], S32, 0x8771f681); /* 34 */
+-         HH (c, d, a, b, x[11], S33, 0x6d9d6122); /* 35 */
+-         HH (b, c, d, a, x[14], S34, 0xfde5380c); /* 36 */
+-         HH (a, b, c, d, x[ 1], S31, 0xa4beea44); /* 37 */
+-         HH (d, a, b, c, x[ 4], S32, 0x4bdecfa9); /* 38 */
+-         HH (c, d, a, b, x[ 7], S33, 0xf6bb4b60); /* 39 */
+-         HH (b, c, d, a, x[10], S34, 0xbebfbc70); /* 40 */
+-         HH (a, b, c, d, x[13], S31, 0x289b7ec6); /* 41 */
+-         HH (d, a, b, c, x[ 0], S32, 0xeaa127fa); /* 42 */
+-         HH (c, d, a, b, x[ 3], S33, 0xd4ef3085); /* 43 */
+-         HH (b, c, d, a, x[ 6], S34,  0x4881d05); /* 44 */
+-         HH (a, b, c, d, x[ 9], S31, 0xd9d4d039); /* 45 */
+-         HH (d, a, b, c, x[12], S32, 0xe6db99e5); /* 46 */
+-         HH (c, d, a, b, x[15], S33, 0x1fa27cf8); /* 47 */
+-         HH (b, c, d, a, x[ 2], S34, 0xc4ac5665); /* 48 */
+-
+-         /* Round 4 */
+-         II (a, b, c, d, x[ 0], S41, 0xf4292244); /* 49 */
+-         II (d, a, b, c, x[ 7], S42, 0x432aff97); /* 50 */
+-         II (c, d, a, b, x[14], S43, 0xab9423a7); /* 51 */
+-         II (b, c, d, a, x[ 5], S44, 0xfc93a039); /* 52 */
+-         II (a, b, c, d, x[12], S41, 0x655b59c3); /* 53 */
+-         II (d, a, b, c, x[ 3], S42, 0x8f0ccc92); /* 54 */
+-         II (c, d, a, b, x[10], S43, 0xffeff47d); /* 55 */
+-         II (b, c, d, a, x[ 1], S44, 0x85845dd1); /* 56 */
+-         II (a, b, c, d, x[ 8], S41, 0x6fa87e4f); /* 57 */
+-         II (d, a, b, c, x[15], S42, 0xfe2ce6e0); /* 58 */
+-         II (c, d, a, b, x[ 6], S43, 0xa3014314); /* 59 */
+-         II (b, c, d, a, x[13], S44, 0x4e0811a1); /* 60 */
+-         II (a, b, c, d, x[ 4], S41, 0xf7537e82); /* 61 */
+-         II (d, a, b, c, x[11], S42, 0xbd3af235); /* 62 */
+-         II (c, d, a, b, x[ 2], S43, 0x2ad7d2bb); /* 63 */
+-         II (b, c, d, a, x[ 9], S44, 0xeb86d391); /* 64 */
+-
+-       state[0] += a; 
+-       state[1] += b; 
+-       state[2] += c; 
+-       state[3] += d; 
+-
+-         /* Zeroize sensitive information.
+-	 */
+-       MD5_memset ((POINTER)x, 0, sizeof (x)); 
+-}
+-
+-/* Encodes input (UINT4) into output (unsigned char). Assumes len is
+-       a multiple of 4. 
+-
+-        */
+-
+-static void Encode (output, input, len)
+-unsigned char *output;
+-UINT4 *input;
+-unsigned int len;
+-{
+-       unsigned int i, j; 
+-
+-       for (i = 0, j = 0; j < len; i++, j += 4) { 
+-       output[j] = (unsigned char)(input[i] & 0xff); 
+-       output[j+1] = (unsigned char)((input[i] >> 8) & 0xff); 
+-       output[j+2] = (unsigned char)((input[i] >> 16) & 0xff); 
+-       output[j+3] = (unsigned char)((input[i] >> 24) & 0xff); 
+-       } 
+-}
+-
+-/* Decodes input (unsigned char) into output (UINT4). Assumes len is
+-       a multiple of 4. 
+-
+-        */
+-
+-static void Decode (output, input, len)
+-UINT4 *output;
+-unsigned char *input;
+-unsigned int len;
+-{
+-       unsigned int i, j; 
+-
+-       for (i = 0, j = 0; j < len; i++, j += 4) 
+-       output[i] = ((UINT4)input[j]) | (((UINT4)input[j+1]) << 8) | (((UINT4)input[j+2]) << 16)
+-       | (((UINT4)input[j+3]) << 24); 
+-}
+-
+-/* Note: Replace "for loop" with standard memcpy if possible.
+-
+-        */
+-
+-static void MD5_memcpy (output, input, len)
+-POINTER output;
+-POINTER input;
+-unsigned int len;
+-{
+-       unsigned int i; 
+-
+-       for (i = 0; i < len; i++) 
+-	      output[i] = input[i]; 
+-}
+-
+-/* Note: Replace "for loop" with standard memset if possible.
+-*/
+-
+-static void MD5_memset (output, value, len)
+-POINTER output;
+-int value;
+-unsigned int len;
+-{
+-       unsigned int i; 
+-
+-       for (i = 0; i < len; i++) 
+-       ((char *)output)[i] = (char)value; 
+-}
+-
+ void hmac_md5_init(HMAC_MD5_CTX *hmac,
+ 		   const unsigned char *key,
+ 		   int key_len)
+@@ -382,10 +65,10 @@
+    */
+ 
+   /* start out by storing key in pads */
+-  MD5_memset(k_ipad, '\0', sizeof k_ipad);
+-  MD5_memset(k_opad, '\0', sizeof k_opad);
+-  MD5_memcpy( k_ipad, key, key_len);
+-  MD5_memcpy( k_opad, key, key_len);
++  memset(k_ipad, '\0', sizeof k_ipad);
++  memset(k_opad, '\0', sizeof k_opad);
++  memcpy( k_ipad, key, key_len);
++  memcpy( k_opad, key, key_len);
+ 
+   /* XOR key with ipad and opad values */
+   for (i=0; i<64; i++) {
+@@ -400,9 +83,9 @@
+   MD5Update(&hmac->octx, k_opad, 64);     /* apply outer pad */
+ 
+   /* scrub the pads and key context (if used) */
+-  MD5_memset(&k_ipad, 0, sizeof(k_ipad));
+-  MD5_memset(&k_opad, 0, sizeof(k_opad));
+-  MD5_memset(&tk, 0, sizeof(tk));
++  memset(&k_ipad, 0, sizeof(k_ipad));
++  memset(&k_opad, 0, sizeof(k_opad));
++  memset(&tk, 0, sizeof(tk));
+ 
+   /* and we're done. */
+ }
+@@ -427,7 +110,7 @@
+     state->istate[lupe] = htonl(hmac.ictx.state[lupe]);
+     state->ostate[lupe] = htonl(hmac.octx.state[lupe]);
+   }
+-  MD5_memset(&hmac, 0, sizeof(hmac));
++  memset(&hmac, 0, sizeof(hmac));
+ }
+ 
+ 
+@@ -435,7 +118,7 @@
+ 		     HMAC_MD5_STATE *state)
+ {
+   unsigned lupe;
+-  MD5_memset(hmac, 0, sizeof(HMAC_MD5_CTX));
++  memset(hmac, 0, sizeof(HMAC_MD5_CTX));
+   for (lupe = 0; lupe < 4; lupe++) {
+     hmac->ictx.state[lupe] = ntohl(state->istate[lupe]);
+     hmac->octx.state[lupe] = ntohl(state->ostate[lupe]);
+@@ -497,10 +180,10 @@
+    */
+ 
+   /* start out by storing key in pads */
+-  MD5_memset(k_ipad, '\0', sizeof k_ipad);
+-  MD5_memset(k_opad, '\0', sizeof k_opad);
+-  MD5_memcpy( k_ipad, key, key_len);
+-  MD5_memcpy( k_opad, key, key_len);
++  memset(k_ipad, '\0', sizeof k_ipad);
++  memset(k_opad, '\0', sizeof k_opad);
++  memcpy( k_ipad, key, key_len);
++  memcpy( k_opad, key, key_len);
+ 
+   /* XOR key with ipad and opad values */
+   for (i=0; i<64; i++) {
diff --git a/security/cyrus-sasl/patches/patch-af b/security/cyrus-sasl/patches/patch-af
new file mode 100644
index 00000000000..14abe036488
--- /dev/null
+++ b/security/cyrus-sasl/patches/patch-af
@@ -0,0 +1,26 @@
+$NetBSD: patch-af,v 1.1 2000/12/10 09:43:37 jlam Exp $
+
+--- plugins/Makefile.am.orig	Thu Jul 20 22:25:51 2000
++++ plugins/Makefile.am
+@@ -66,6 +66,10 @@
+ sasl_LTLIBRARIES = @SASL_MECHS@
+ EXTRA_LTLIBRARIES = libplain.la libanonymous.la libkerberos4.la libcrammd5.la libscrammd5.la libgssapiv2.la libdigestmd5.la liblogin.la libsrp.la
+ 
++bin_SCRIPTS = sasl-config
++sasl_config_CFLAGS = $(CPPFLAGS)
++sasl_config_LIBS = $(libplain_la_LIBADD) $(libkerberos4_la_LIBADD) $(libgssapiv2_la_LIBADD) $(libdigestmd5_la_LIBADD) $(liblogin_la_LIBADD) $(libsrp_la_LIBADD)
++
+ libplain_la_SOURCES = plain.c
+ libplain_la_LDFLAGS = -version-info $(plain_version)
+ libplain_la_LIBADD = $(PLAIN_LIBS)
+@@ -102,3 +106,10 @@
+ # libx509_la_SOURCES = x509.c
+ # libx509_la_LDFLAGS = -version-info $(x509_version)
+ # libx509_la_LIBADD = $(X509_LIBS)
++
++sasl-config: sasl-config.in
++	$(SED)	-e "s,%%sasl_config_LIBS%%,$(sasl_config_LIBS),g" \
++		-e "s,%%sasl_config_CFLAGS%%,$(sasl_config_CFLAGS),g" \
++		-e "s,%%prefix%%,$(prefix),g" \
++		-e "s,%%VERSION%%,$(VERSION),g" \
++		< sasl-config.in > sasl-config
diff --git a/security/cyrus-sasl/patches/patch-ag b/security/cyrus-sasl/patches/patch-ag
new file mode 100644
index 00000000000..ad8013ec6ca
--- /dev/null
+++ b/security/cyrus-sasl/patches/patch-ag
@@ -0,0 +1,13 @@
+$NetBSD: patch-ag,v 1.1 2000/12/10 09:43:38 jlam Exp $
+
+--- plugins/cram.c.orig	Sat Mar 11 21:20:00 2000
++++ plugins/cram.c
+@@ -425,7 +425,7 @@
+ 
+     HMAC_MD5_CTX tmphmac;
+     char *digest_str = NULL;
+-    UINT4 digest[4];
++    u_int32_t digest[4];
+ 
+     VL(("CRAM-MD5 Step 2\n"));
+     VL(("Clientin: %s\n",clientin));
diff --git a/security/cyrus-sasl/patches/patch-ah b/security/cyrus-sasl/patches/patch-ah
new file mode 100644
index 00000000000..c68dd0bda66
--- /dev/null
+++ b/security/cyrus-sasl/patches/patch-ah
@@ -0,0 +1,16 @@
+$NetBSD: patch-ah,v 1.1 2000/12/10 09:43:38 jlam Exp $
+
+--- plugins/gssapi.c.orig	Thu Jul 20 22:06:52 2000
++++ plugins/gssapi.c
+@@ -50,6 +50,11 @@
+ #include <gssapi/gssapi.h>
+ #endif
+ 
++/* Heimdal has this, but MIT Kerberos doesn't */
++#ifndef GSS_C_NO_NAME
++#define GSS_C_NO_NAME  ((gss_name_t) 0)
++#endif
++
+ #ifdef WIN32
+ #include <winsock.h>
+ #else
diff --git a/security/cyrus-sasl/pkg/COMMENT b/security/cyrus-sasl/pkg/COMMENT
index 10e9f92a9ec..03e56ad6bbd 100644
--- a/security/cyrus-sasl/pkg/COMMENT
+++ b/security/cyrus-sasl/pkg/COMMENT
@@ -1 +1 @@
-SASL Library
+Simple Authentication and Security Layer
diff --git a/security/cyrus-sasl/pkg/DEINSTALL b/security/cyrus-sasl/pkg/DEINSTALL
new file mode 100644
index 00000000000..e19454c5736
--- /dev/null
+++ b/security/cyrus-sasl/pkg/DEINSTALL
@@ -0,0 +1,40 @@
+#!/bin/sh
+#
+# $NetBSD: DEINSTALL,v 1.1 2000/12/10 09:43:38 jlam Exp $
+
+PKGNAME=$1
+STAGE=$2
+
+USER=@CYRUS_USER@
+GROUP=@CYRUS_GROUP@
+
+SASLDB=/etc/sasldb.db
+PWCHECKDIR=/var/pwcheck
+
+case ${STAGE} in
+DEINSTALL)
+	;;
+
+POST-DEINSTALL)
+	rm -rf ${PWCHECKDIR}
+	cat << EOF
+===========================================================================
+If you won't be using ${PKGNAME} any longer, you may want to remove
+
+  * the \`${USER}' user
+
+  * the \`${GROUP}' group
+
+  * the following files:
+
+	${SASLDB}
+===========================================================================
+EOF
+	;;
+
+*)
+	echo "Unexpected argument: ${STAGE}"
+	exit 1
+	;;
+esac
+exit 0
diff --git a/security/cyrus-sasl/pkg/DESCR b/security/cyrus-sasl/pkg/DESCR
index 787b9466fe1..5a3474499b8 100644
--- a/security/cyrus-sasl/pkg/DESCR
+++ b/security/cyrus-sasl/pkg/DESCR
@@ -1,14 +1,14 @@
-SASL Library
+SASL is a method for adding authentication support to connection-based
+protocols.  To use SASL, a protocol includes a command for identifying and
+authenticating a user to a server and for optionally negotiating protection
+of subsequent protocol interactions.  If its use is negotiated, a security
+layer is inserted between the protocol and the connection.
 
-This is the Cyrus SASL API implentation. It can be used on the client
-or server side to provide authentication. See RFC 2222 for more
-information.
-
-The latest version is available at:
-ftp://ftp.andrew.cmu.edu/pub/cyrus-mail/
+This is the Cyrus SASL API implentation. It can be used on the client or
+server side to provide authentication. See RFC 2222 for more information.
 
 There's a mailing list for Cyrus SASL.  Subscribe by sending a message
-to majordomo@lists.andrew.cmu.edu with the body "subscribe
-cyrus-sasl". The mailing list is available via anonymous IMAP at
+to majordomo@lists.andrew.cmu.edu with the body "subscribe cyrus-sasl".
+The mailing list is available via anonymous IMAP at
 imap://cyrus.andrew.cmu.edu/archive.cyrus-sasl or via the web at
 http://asg.web.cmu.edu/archive/mailbox.php3?mailbox=archive.cyrus-sasl.
diff --git a/security/cyrus-sasl/pkg/INSTALL b/security/cyrus-sasl/pkg/INSTALL
new file mode 100644
index 00000000000..ad150fe553c
--- /dev/null
+++ b/security/cyrus-sasl/pkg/INSTALL
@@ -0,0 +1,83 @@
+#! /bin/sh
+#
+# $NetBSD: INSTALL,v 1.1 2000/12/10 09:43:38 jlam Exp $
+
+PKGNAME=$1
+STAGE=$2
+
+USER="@CYRUS_USER@"
+GROUP="@CYRUS_GROUP@"
+
+ADDUSER="@ADDUSER@"
+ADDGROUP="@ADDGROUP@"
+CHGRP="@CHGRP@"
+CHMOD="@CHMOD@"
+CHOWN="@CHOWN@"
+GREP="@GREP@"
+MKDIR="@MKDIR@"
+RM="@RM@"
+TOUCH="@TOUCH@"
+
+SASLDB=/etc/sasldb.db
+PWCHECKDIR=/var/pwcheck
+
+case ${STAGE} in
+PRE-INSTALL)
+	# Group... the default's shipped with NetBSD
+	# We need to check that ${GROUP} exists before adding the user.
+	# Do it with chgrp to be able to use NIS.
+	#
+	${TOUCH} "/tmp/grouptest.$$"
+	${CHGRP} ${GROUP} "/tmp/grouptest.$$" >/dev/null 2>&1
+	if [ $? -eq 0 ]
+	then
+		echo "Group '${GROUP}' already exists...proceeding."
+	else
+		echo "Creating '${GROUP}' group..."
+		${ADDGROUP} ${GROUP}
+		echo "Done."
+	fi
+	${RM} -f "/tmp/grouptest.$$"
+
+	# Use `finger' to be able to use NIS.
+	#
+	finger ${USER} 2>&1 | ${GREP} -q "no such user"
+	if [ $? -eq 0 ]
+	then
+		echo "Creating '${USER}' user..."
+		${ADDUSER} -c "Cyrus User" -g ${GROUP} -s /bin/sh ${USER}
+		echo "Done."
+	else    
+		echo "User '${USER}' already exists...proceeding."
+	fi
+	;;
+
+POST-INSTALL)
+	# Create empty sasldb shared secrets database with proper permissions
+	# for saslpasswd.
+	#
+	if [ -f ${SASLDB} ]
+	then
+		echo "${SASLDB} already exists."
+	else
+		echo "Creating empty ${SASLDB}..."
+		echo password | ${PKG_PREFIX}/sbin/saslpasswd -p user
+		${PKG_PREFIX}/sbin/saslpasswd -d user
+		${CHOWN} ${USER} ${SASLDB}
+		${CHMOD} 600 ${SASLDB}
+		echo "Done."
+	fi
+
+	# Create directory with proper permissions for pwcheck socket.
+	#
+	${MKDIR} ${PWCHECKDIR}
+	${CHOWN} ${USER} ${PWCHECKDIR}
+	${CHMOD} 700 ${PWCHECKDIR}
+	;;
+
+*)
+	echo "Unexpected argument: ${STAGE}"
+	exit 1
+	;;
+esac
+exit 0
diff --git a/security/cyrus-sasl/pkg/PLIST.common b/security/cyrus-sasl/pkg/PLIST.common
index b4d0e3517cc..10b27c5745c 100644
--- a/security/cyrus-sasl/pkg/PLIST.common
+++ b/security/cyrus-sasl/pkg/PLIST.common
@@ -1,27 +1,14 @@
-@comment $NetBSD: PLIST.common,v 1.1.1.1 2000/08/25 15:23:49 jlam Exp $
-include/cyrus-sasl/hmac-md5.h
-include/cyrus-sasl/md5.h
-include/cyrus-sasl/md5global.h
-include/cyrus-sasl/sasl.h
-include/cyrus-sasl/saslplug.h
-include/cyrus-sasl/saslutil.h
+@comment $NetBSD: PLIST.common,v 1.2 2000/12/10 09:43:38 jlam Exp $
+bin/sasl-config
+etc/rc.d/pwcheck
+include/hmac-md5.h
+include/sasl.h
+include/saslplug.h
+include/saslutil.h
 lib/libsasl.a
 lib/libsasl.la
 lib/libsasl.so.8.8
-lib/sasl/libanonymous.a
-lib/sasl/libanonymous.la
-lib/sasl/libanonymous.so.1.15
-lib/sasl/libcrammd5.a
-lib/sasl/libcrammd5.la
-lib/sasl/libcrammd5.so.1.15
-lib/sasl/libdigestmd5.a
-lib/sasl/libdigestmd5.la
-lib/sasl/libdigestmd5.so.0.17
-lib/sasl/libplain.a
-lib/sasl/libplain.la
-lib/sasl/libplain.so.1.14
-sbin/sasldblistusers
-sbin/saslpasswd
+man/man3/sasl.3
 man/man3/sasl_authorize_t.3
 man/man3/sasl_done.3
 man/man3/sasl_callbacks.3
@@ -46,8 +33,20 @@ man/man3/sasl_server_start.3
 man/man3/sasl_server_step.3
 man/man3/sasl_setprop.3
 man/man3/sasl_usererr.3
-man/man3/sasl.3
 man/man8/sasldblistusers.8
 man/man8/saslpasswd.8
-@dirrm lib/sasl
-@dirrm include/cyrus-sasl
+sbin/pwcheck
+sbin/sasldblistusers
+sbin/saslpasswd
+share/doc/html/cyrus-sasl/draft-leach-digest-sasl-05.txt
+share/doc/html/cyrus-sasl/draft-newman-auth-scram-03.txt
+share/doc/html/cyrus-sasl/gssapi.html
+share/doc/html/cyrus-sasl/index.html
+share/doc/html/cyrus-sasl/programming.html
+share/doc/html/cyrus-sasl/rfc1321.txt
+share/doc/html/cyrus-sasl/rfc2095.txt
+share/doc/html/cyrus-sasl/rfc2104.txt
+share/doc/html/cyrus-sasl/rfc2222.txt
+share/doc/html/cyrus-sasl/rfc2245.txt
+share/doc/html/cyrus-sasl/sysadmin.html
+@dirrm share/doc/html/cyrus-sasl
diff --git a/security/cyrus-sasl/pkg/PLIST.krb5 b/security/cyrus-sasl/pkg/PLIST.krb5
new file mode 100644
index 00000000000..8d8cabc50a0
--- /dev/null
+++ b/security/cyrus-sasl/pkg/PLIST.krb5
@@ -0,0 +1,4 @@
+@comment $NetBSD: PLIST.krb5,v 1.1 2000/12/10 09:43:38 jlam Exp $
+lib/sasl/libgssapiv2.a
+lib/sasl/libgssapiv2.la
+lib/sasl/libgssapiv2.so.1.14
diff --git a/security/cyrus-sasl/pkg/PLIST.netbsd b/security/cyrus-sasl/pkg/PLIST.netbsd
deleted file mode 100644
index 7885d8fdac2..00000000000
--- a/security/cyrus-sasl/pkg/PLIST.netbsd
+++ /dev/null
@@ -1 +0,0 @@
-@comment $NetBSD: PLIST.netbsd,v 1.1.1.1 2000/08/25 15:23:49 jlam Exp $
diff --git a/security/cyrus-sasl/pkg/PLIST.plugins b/security/cyrus-sasl/pkg/PLIST.plugins
new file mode 100644
index 00000000000..4390f0c59bb
--- /dev/null
+++ b/security/cyrus-sasl/pkg/PLIST.plugins
@@ -0,0 +1,14 @@
+@comment $NetBSD: PLIST.plugins,v 1.1 2000/12/10 09:43:38 jlam Exp $
+lib/sasl/libanonymous.a
+lib/sasl/libanonymous.la
+lib/sasl/libanonymous.so.1.15
+lib/sasl/libcrammd5.a
+lib/sasl/libcrammd5.la
+lib/sasl/libcrammd5.so.1.15
+lib/sasl/libdigestmd5.a
+lib/sasl/libdigestmd5.la
+lib/sasl/libdigestmd5.so.0.17
+lib/sasl/libplain.a
+lib/sasl/libplain.la
+lib/sasl/libplain.so.1.14
+@unexec rmdir -p %D/lib/sasl 2>/dev/null || true
diff --git a/security/cyrus-sasl/pkg/PLIST.pwcheck b/security/cyrus-sasl/pkg/PLIST.pwcheck
deleted file mode 100644
index f52fa8e7387..00000000000
--- a/security/cyrus-sasl/pkg/PLIST.pwcheck
+++ /dev/null
@@ -1,2 +0,0 @@
-@comment $NetBSD: PLIST.pwcheck,v 1.1 2000/10/25 08:00:25 rh Exp $
-sbin/pwcheck
diff --git a/security/cyrus-sasl/pkg/PLIST.solaris b/security/cyrus-sasl/pkg/PLIST.solaris
deleted file mode 100644
index 1f7eb0da552..00000000000
--- a/security/cyrus-sasl/pkg/PLIST.solaris
+++ /dev/null
@@ -1,3 +0,0 @@
-@comment $NetBSD: PLIST.solaris,v 1.1.1.1 2000/08/25 15:23:49 jlam Exp $
-lib/sasl/libgssapiv2.la
-lib/sasl/libgssapiv2.so.1.14