Convert to use bsd.options.mk. The relevant options variable to set

for each package can be determined by invoking:

	make show-var VARNAME=PKG_OPTIONS_VAR

The old options are still supported unless the variable named in
PKG_OPTIONS_VAR is set within make(1) (usually via /etc/mk.conf).

19 files changed, 294 insertions, 149 deletions

diff --git a/security/PAM/Makefile b/security/PAM/Makefile
index aefd544b413..d2b401c77e3 100644
--- a/security/PAM/Makefile
+++ b/security/PAM/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.24 2004/07/06 22:49:29 jlam Exp $
+# $NetBSD: Makefile,v 1.25 2004/07/30 21:05:41 jlam Exp $
 #
 
 DISTNAME=	Linux-PAM-0.77
@@ -38,7 +38,20 @@ MESSAGE_SUBST+=		PAM_MODULEDIR=${PAM_MODULEDIR}
 
 .include "../../mk/bsd.prefs.mk"
 
-.if !empty(USE_LIBCRACK:M[yY][eE][sS])
+# Global and legacy options
+.if defined(USE_LIBCRACK)
+.  if !defined(PKG_OPTIONS.PAM)
+.    if defined(USE_LIBCRACK) && !empty(USE_LIBCRACK:M[yY][eE][sS])
+PKG_OPTIONS.PAM+=	libcrack
+.    endif
+.  endif
+.endif
+
+PKG_OPTIONS_VAR=	PKG_OPTIONS.PAM
+PKG_SUPPORTED_OPTIONS=	libcrack
+.include "../../mk/bsd.options.mk"
+
+.if !empty(PKG_OPTIONS:Mlibcrack)
 .  include "../../security/libcrack/buildlink3.mk"
 CONFIGURE_ARGS+=	--with-libcrack
 PLIST_SUBST+=		USE_LIBCRACK=
@@ -74,6 +87,8 @@ CONF_FILES=		${EGDIR}/pam.conf ${PKG_SYSCONFBASEDIR}/pam.conf
 CONF_FILES+=		${EGDIR}/${FILE} ${PKG_SYSCONFDIR}/${FILE}
 .endfor
 
+.include "../../mk/bdb.buildlink3.mk"
+
 post-configure:
 	cd ${WRKSRC}; for file in libpam/pam_private.h; do		\
 		${SED}	-e "s|/etc/|${PKG_SYSCONFBASEDIR}/|g"		\
@@ -99,5 +114,4 @@ post-install:
 .endif
 	${INSTALL_DATA_DIR} ${DOCDIR}
 
-.include "../../mk/bdb.buildlink3.mk"
 .include "../../mk/bsd.pkg.mk"
diff --git a/security/cyrus-sasl/Makefile b/security/cyrus-sasl/Makefile
index 7e2c80a0849..05df812292b 100644
--- a/security/cyrus-sasl/Makefile
+++ b/security/cyrus-sasl/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.43 2004/03/26 02:27:52 wiz Exp $
+# $NetBSD: Makefile,v 1.44 2004/07/30 21:05:41 jlam Exp $
 
 .include "Makefile.common"
 
@@ -6,32 +6,52 @@ PKGREVISION=	6
 SVR4_PKGNAME=	csasl
 COMMENT=	Simple Authentication and Security Layer
 
-PLIST_SRC+=		${.CURDIR}/PLIST.common
-
 # Authentication mechanisms
 CONFIGURE_ARGS+=	--enable-anon		# ANONYMOUS
 CONFIGURE_ARGS+=	--enable-cram		# CRAM-MD5
-
 CONFIGURE_ARGS+=	--enable-plain		# PLAIN
-.if defined(USE_PAM)
+CONFIGURE_ARGS+=	--enable-digest		# DIGEST-MD5
+CONFIGURE_ARGS+=	--with-rc4=${SSLBASE}
+.include "../../security/openssl/buildlink3.mk"
+
+# Global and legacy options
+.if defined(KERBEROS) || defined(USE_PAM) || defined(SASL_USE_GSSAPI)
+.  if !defined(PKG_OPTIONS.cyrus-sasl)
+.    if defined(KERBEROS)
+PKG_OPTIONS.cyrus-sasl+=	kerberos
+.    endif
+.    if defined(USE_PAM) && !empty(USE_PAM:M[yY][eE][sS])     
+PKG_OPTIONS.cyrus-sasl+=	PAM
+.    endif
+.    if defined(SASL_USE_GSSAPI) && !empty(SASL_USE_GSSAPI:M[yY][eE][sS])     
+PKG_OPTIONS.cyrus-sasl+=	gssapi
+.    endif
+.  endif
+.endif
+
+PKG_OPTIONS_VAR=	PKG_OPTIONS.cyrus-sasl
+PKG_SUPPORTED_OPTIONS=	PAM gssapi kerberos
+.include "../../mk/bsd.options.mk"
+
+.if !empty(PKG_OPTIONS:MPAM)
 .  include "../../security/PAM/buildlink3.mk"
-BUILD_DEFS+=		USE_PAM
 CONFIGURE_ARGS+=	--with-pam=${BUILDLINK_PREFIX.pam}
 .endif
 
-CONFIGURE_ARGS+=	--enable-digest		# DIGEST-MD5
-CONFIGURE_ARGS+=	--with-rc4=${SSLBASE}
-.include "../../security/openssl/buildlink3.mk"
+.if !empty(PKG_OPTIONS:Mkerberos)
+.  if empty(PKG_OPTIONS:Mgssapi)
+PKG_OPTIONS+=		gssapi
+.  endif
+.endif
 
-.if defined(KERBEROS) || \
-    (defined(SASL_USE_GSSAPI) && !empty(SASL_USE_GSSAPI:M[yY][eE][sS]))
+.if !empty(PKG_OPTIONS:Mgssapi)
 .  include "../../mk/krb5.buildlink3.mk"
 CONFIGURE_ARGS+=	--enable-gssapi=${KRB5BASE}	# GSSAPI
-PLIST_SRC+=		${.CURDIR}/PLIST.krb5
+PLIST_SUBST+=		GSSAPI=
+.else
+PLIST_SUBST+=		GSSAPI="@comment "
 .endif
 
-PLIST_SRC+=		${.CURDIR}/PLIST.plugins
-
 USE_PKGINSTALL=		YES
 DEINSTALL_EXTRA_TMPL+=	${.CURDIR}/DEINSTALL
 INSTALL_EXTRA_TMPL+=	${.CURDIR}/INSTALL
diff --git a/security/cyrus-sasl/PLIST.common b/security/cyrus-sasl/PLIST
index 761fa92d0e2..e02e521e7b4 100644
--- a/security/cyrus-sasl/PLIST.common
+++ b/security/cyrus-sasl/PLIST
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST.common,v 1.5 2004/04/23 22:07:58 reed Exp $
+@comment $NetBSD: PLIST,v 1.1 2004/07/30 21:05:41 jlam Exp $
 bin/sasl-config
 include/hmac-md5.h
 include/sasl.h
@@ -9,6 +9,31 @@ lib/libsasl.la
 lib/libsasl.so
 lib/libsasl.so.8
 lib/libsasl.so.8.10
+lib/sasl/libanonymous.a
+lib/sasl/libanonymous.la
+lib/sasl/libanonymous.so
+lib/sasl/libanonymous.so.1
+lib/sasl/libanonymous.so.1.16
+lib/sasl/libcrammd5.a
+lib/sasl/libcrammd5.la
+lib/sasl/libcrammd5.so
+lib/sasl/libcrammd5.so.1
+lib/sasl/libcrammd5.so.1.17
+lib/sasl/libdigestmd5.a
+lib/sasl/libdigestmd5.la
+lib/sasl/libdigestmd5.so
+lib/sasl/libdigestmd5.so.0
+lib/sasl/libdigestmd5.so.0.19
+${GSSAPI}lib/sasl/libgssapiv2.a
+${GSSAPI}lib/sasl/libgssapiv2.la
+${GSSAPI}lib/sasl/libgssapiv2.so
+${GSSAPI}lib/sasl/libgssapiv2.so.1
+${GSSAPI}lib/sasl/libgssapiv2.so.1.18
+lib/sasl/libplain.a
+lib/sasl/libplain.la
+lib/sasl/libplain.so
+lib/sasl/libplain.so.1
+lib/sasl/libplain.so.1.15
 man/man3/sasl.3
 man/man3/sasl_authorize_t.3
 man/man3/sasl_done.3
@@ -53,4 +78,3 @@ share/doc/html/cyrus-sasl/rfc2245.txt
 share/doc/html/cyrus-sasl/rfc2831.txt
 share/doc/html/cyrus-sasl/sysadmin.html
 @dirrm share/doc/html/cyrus-sasl
-@unexec ${RM} -rf ${SASLSOCKETDIR}
diff --git a/security/cyrus-sasl/PLIST.krb5 b/security/cyrus-sasl/PLIST.krb5
deleted file mode 100644
index 6414431fe12..00000000000
--- a/security/cyrus-sasl/PLIST.krb5
+++ /dev/null
@@ -1,6 +0,0 @@
-@comment $NetBSD: PLIST.krb5,v 1.2 2002/03/24 23:30:18 wiz Exp $
-lib/sasl/libgssapiv2.a
-lib/sasl/libgssapiv2.la
-lib/sasl/libgssapiv2.so
-lib/sasl/libgssapiv2.so.1
-lib/sasl/libgssapiv2.so.1.18
diff --git a/security/cyrus-sasl/PLIST.plugins b/security/cyrus-sasl/PLIST.plugins
deleted file mode 100644
index 44faf5cf8dc..00000000000
--- a/security/cyrus-sasl/PLIST.plugins
+++ /dev/null
@@ -1,21 +0,0 @@
-@comment $NetBSD: PLIST.plugins,v 1.4 2002/01/31 20:42:09 jlam Exp $
-lib/sasl/libanonymous.a
-lib/sasl/libanonymous.la
-lib/sasl/libanonymous.so
-lib/sasl/libanonymous.so.1
-lib/sasl/libanonymous.so.1.16
-lib/sasl/libcrammd5.a
-lib/sasl/libcrammd5.la
-lib/sasl/libcrammd5.so
-lib/sasl/libcrammd5.so.1
-lib/sasl/libcrammd5.so.1.17
-lib/sasl/libdigestmd5.a
-lib/sasl/libdigestmd5.la
-lib/sasl/libdigestmd5.so
-lib/sasl/libdigestmd5.so.0
-lib/sasl/libdigestmd5.so.0.19
-lib/sasl/libplain.a
-lib/sasl/libplain.la
-lib/sasl/libplain.so
-lib/sasl/libplain.so.1
-lib/sasl/libplain.so.1.15
diff --git a/security/cyrus-sasl/buildlink3.mk b/security/cyrus-sasl/buildlink3.mk
index 67283f730d8..95355ef7331 100644
--- a/security/cyrus-sasl/buildlink3.mk
+++ b/security/cyrus-sasl/buildlink3.mk
@@ -1,4 +1,4 @@
-# $NetBSD: buildlink3.mk,v 1.2 2004/03/26 02:27:52 wiz Exp $
+# $NetBSD: buildlink3.mk,v 1.3 2004/07/30 21:05:41 jlam Exp $
 
 BUILDLINK_DEPTH:=		${BUILDLINK_DEPTH}+
 CYRUS_SASL_BUILDLINK3_MK:=	${CYRUS_SASL_BUILDLINK3_MK}+
@@ -18,7 +18,9 @@ BUILDLINK_RECOMMENDED.cyrus-sasl?=	cyrus-sasl>=1.5.27nb6
 BUILDLINK_PKGSRCDIR.cyrus-sasl?=	../../security/cyrus-sasl
 .endif	# CYRUS_SASL_BUILDLINK3_MK
 
-.if defined(USE_PAM)
+PKG_OPTIONS.cyrus-sasl?=	${PKG_DEFAULT_OPTIONS}
+
+.if !empty(PKG_OPTIONS.cyrus-sasl:MPAM)
 .  include "../../security/PAM/buildlink3.mk"
 .endif
 
diff --git a/security/cyrus-sasl2/Makefile b/security/cyrus-sasl2/Makefile
index 459d29b515f..d1bd3693dc4 100644
--- a/security/cyrus-sasl2/Makefile
+++ b/security/cyrus-sasl2/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.32 2004/07/08 21:11:25 recht Exp $
+# $NetBSD: Makefile,v 1.33 2004/07/30 21:05:41 jlam Exp $
 
 .include "Makefile.common"
 
@@ -6,8 +6,6 @@ PKGREVISION=	3
 SVR4_PKGNAME=	csasl
 COMMENT=	Simple Authentication and Security Layer
 
-PLIST_SRC+=		${PKGDIR}/PLIST.common
-
 .if exists(/usr/include/ndbm.h)
 SASL_DBTYPE?=		ndbm
 .else
@@ -42,6 +40,8 @@ AUTHDAEMONVAR?=		${VARBASE}/authdaemon
 CONFIGURE_ARGS+=        --with-authdaemond=${AUTHDAEMONVAR}
 BUILD_DEFS+=		AUTHDAEMONVAR
 
+.include "Makefile.options"
+
 .if exists(/dev/urandom)
 SASL_ENTROPY_SOURCE?=	/dev/urandom
 .endif
@@ -50,21 +50,6 @@ CONFIGURE_ARGS+=	--with-devrandom=${SASL_ENTROPY_SOURCE}
 .endif
 BUILD_DEFS+=		SASL_ENTROPY_SOURCE
 
-.if defined(KERBEROS)
-SASL_USE_GSSAPI=	yes
-.endif
-.if (defined(SASL_USE_GSSAPI) && !empty(SASL_USE_GSSAPI:M[yY][eE][sS]))
-.  include "../../mk/krb5.buildlink3.mk"
-CONFIGURE_ARGS+=	--enable-gssapi=${KRB5BASE}	# GSSAPI
-CONFIGURE_ARGS+=	--with-gss_impl=${GSSIMPL.${KRB5_TYPE}}
-GSSIMPL.heimdal=	heimdal
-GSSIMPL.mit-krb5=	mit
-PLIST_SRC+=		${PKGDIR}/PLIST.krb5
-.endif
-BUILD_DEFS+=		SASL_USE_GSSAPI
-
-PLIST_SRC+=		${PKGDIR}/PLIST.plugins
-
 USE_PKGINSTALL=		YES
 DEINSTALL_EXTRA_TMPL+=	${.CURDIR}/DEINSTALL
 
diff --git a/security/cyrus-sasl2/Makefile.options b/security/cyrus-sasl2/Makefile.options
new file mode 100644
index 00000000000..a33fbc55c1f
--- /dev/null
+++ b/security/cyrus-sasl2/Makefile.options
@@ -0,0 +1,40 @@
+# $NetBSD: Makefile.options,v 1.1 2004/07/30 21:05:41 jlam Exp $
+
+# Global and legacy options
+.if defined(KERBEROS) || defined(SASL_USE_GSSAPI)
+.  if !defined(PKG_OPTIONS.cyrus-sasl)
+.    if defined(KERBEROS) 
+PKG_OPTIONS.cyrus-sasl+=	kerberos
+.    endif
+.    if defined(SASL_USE_GSSAPI) && !empty(SASL_USE_GSSAPI:M[yY][eE][sS])
+PKG_OPTIONS.cyrus-sasl+=	gssapi
+.    endif
+.  endif
+.endif
+
+PKG_OPTIONS_VAR=	PKG_OPTIONS.cyrus-sasl
+PKG_SUPPORTED_OPTIONS=	gssapi kerberos
+.include "../../mk/bsd.options.mk"
+
+###
+### Kerberos authentication is via GSSAPI.
+###
+.if !empty(PKG_OPTIONS:Mkerberos)
+.  if empty(PKG_OPTIONS:Mgssapi)
+PKG_OPTIONS+=	gssapi
+.  endif
+.endif
+
+###
+### Authentication via GSSAPI (which supports primarily Kerberos 5)
+###
+.if !empty(PKG_OPTIONS:Mgssapi)
+.  include "../../mk/krb5.buildlink3.mk"
+CONFIGURE_ARGS+=	--enable-gssapi=${KRB5BASE}
+CONFIGURE_ARGS+=	--with-gss_impl=${GSSIMPL.${KRB5_TYPE}}
+GSSIMPL.heimdal=	heimdal
+GSSIMPL.mit-krb5=	mit
+PLIST_SUBST+=		GSSAPI=
+.else
+PLIST_SUBST+=		GSSAPI="@comment "
+.endif
diff --git a/security/cyrus-sasl2/PLIST.common b/security/cyrus-sasl2/PLIST
index 3a4421e68cb..9fef67e86b1 100644
--- a/security/cyrus-sasl2/PLIST.common
+++ b/security/cyrus-sasl2/PLIST
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST.common,v 1.13 2004/03/29 05:47:31 jlam Exp $
+@comment $NetBSD: PLIST,v 1.1 2004/07/30 21:05:41 jlam Exp $
 include/sasl/hmac-md5.h
 include/sasl/md5.h
 include/sasl/md5global.h
@@ -11,6 +11,34 @@ lib/libsasl2.la
 lib/libsasl2.so
 lib/libsasl2.so.2
 lib/libsasl2.so.2.18
+lib/sasl2/libanonymous.la
+lib/sasl2/libanonymous.so
+lib/sasl2/libanonymous.so.2
+lib/sasl2/libanonymous.so.2.18
+lib/sasl2/libcrammd5.la
+lib/sasl2/libcrammd5.so
+lib/sasl2/libcrammd5.so.2
+lib/sasl2/libcrammd5.so.2.18
+lib/sasl2/libdigestmd5.la
+lib/sasl2/libdigestmd5.so
+lib/sasl2/libdigestmd5.so.2
+lib/sasl2/libdigestmd5.so.2.18
+${GSSAPI}lib/sasl2/libgssapiv2.la
+${GSSAPI}lib/sasl2/libgssapiv2.so
+${GSSAPI}lib/sasl2/libgssapiv2.so.2
+${GSSAPI}lib/sasl2/libgssapiv2.so.2.18
+lib/sasl2/libotp.la
+lib/sasl2/libotp.so
+lib/sasl2/libotp.so.2
+lib/sasl2/libotp.so.2.18
+lib/sasl2/libplain.la
+lib/sasl2/libplain.so
+lib/sasl2/libplain.so.2
+lib/sasl2/libplain.so.2.18
+lib/sasl2/libsasldb.la
+lib/sasl2/libsasldb.so
+lib/sasl2/libsasldb.so.2
+lib/sasl2/libsasldb.so.2.18
 man/man3/sasl.3
 man/man3/sasl_authorize_t.3
 man/man3/sasl_auxprop.3
diff --git a/security/cyrus-sasl2/PLIST.krb5 b/security/cyrus-sasl2/PLIST.krb5
deleted file mode 100644
index d6e66038610..00000000000
--- a/security/cyrus-sasl2/PLIST.krb5
+++ /dev/null
@@ -1,5 +0,0 @@
-@comment $NetBSD: PLIST.krb5,v 1.9 2004/03/29 05:47:31 jlam Exp $
-lib/sasl2/libgssapiv2.la
-lib/sasl2/libgssapiv2.so
-lib/sasl2/libgssapiv2.so.2
-lib/sasl2/libgssapiv2.so.2.18
diff --git a/security/cyrus-sasl2/PLIST.plugins b/security/cyrus-sasl2/PLIST.plugins
deleted file mode 100644
index 12b69f45061..00000000000
--- a/security/cyrus-sasl2/PLIST.plugins
+++ /dev/null
@@ -1,25 +0,0 @@
-@comment $NetBSD: PLIST.plugins,v 1.8 2004/03/29 05:47:31 jlam Exp $
-lib/sasl2/libanonymous.la
-lib/sasl2/libanonymous.so
-lib/sasl2/libanonymous.so.2
-lib/sasl2/libanonymous.so.2.18
-lib/sasl2/libcrammd5.la
-lib/sasl2/libcrammd5.so
-lib/sasl2/libcrammd5.so.2
-lib/sasl2/libcrammd5.so.2.18
-lib/sasl2/libdigestmd5.la
-lib/sasl2/libdigestmd5.so
-lib/sasl2/libdigestmd5.so.2
-lib/sasl2/libdigestmd5.so.2.18
-lib/sasl2/libotp.la
-lib/sasl2/libotp.so
-lib/sasl2/libotp.so.2
-lib/sasl2/libotp.so.2.18
-lib/sasl2/libplain.la
-lib/sasl2/libplain.so
-lib/sasl2/libplain.so.2
-lib/sasl2/libplain.so.2.18
-lib/sasl2/libsasldb.la
-lib/sasl2/libsasldb.so
-lib/sasl2/libsasldb.so.2
-lib/sasl2/libsasldb.so.2.18
diff --git a/security/cyrus-saslauthd/Makefile b/security/cyrus-saslauthd/Makefile
index ee328de2feb..7b849e5dd62 100644
--- a/security/cyrus-saslauthd/Makefile
+++ b/security/cyrus-saslauthd/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.15 2004/07/25 04:35:14 grant Exp $
+# $NetBSD: Makefile,v 1.16 2004/07/30 21:05:42 jlam Exp $
 
 DISTNAME=	cyrus-sasl-2.1.18
 PKGNAME=	${DISTNAME:S/sasl/saslauthd/}
@@ -23,41 +23,15 @@ COMMENT=		Cyrus SASL plaintext authentication daemon
 USE_BUILDLINK3=		yes
 GNU_CONFIGURE=		yes
 CONFIGURE_ARGS+=	--sysconfdir=${PKG_SYSCONFDIR}
-PLIST_SRC=		${PKGDIR}/PLIST
 
 ALL_TARGET=		all saslcache testsaslauthd
 
-BUILD_DEFS+=		USE_PAM USE_OPENLDAP SASL_USE_GSSAPI
-
 SASLSOCKETDIR?=		${VARBASE}/run/saslauthd
 BUILD_DEFS+=		SASLSOCKETDIR
 FILES_SUBST+=		SASLSOCKETDIR=${SASLSOCKETDIR}
 CONFIGURE_ARGS+=	--with-saslauthd="${SASLSOCKETDIR}"
 
-.if defined(USE_PAM)
-.  include "../../security/PAM/buildlink3.mk"
-CONFIGURE_ARGS+=	--with-pam=${BUILDLINK_PREFIX.pam}
-.endif
-
-.if defined(USE_OPENLDAP) && !empty(USE_OPENLDAP:M[Yy][Ee][Ss])
-.  include "../../databases/openldap/buildlink3.mk"
-.  include "../../security/cyrus-sasl2/buildlink3.mk"
-BUILDLINK_INCDIRS.cyrus-sasl=	include/sasl
-CONFIGURE_ARGS+=	--with-ldap=${BUILDLINK_PREFIX.openldap}
-CONFIGURE_ARGS+=	--with-openssl=${SSLBASE}
-PLIST_SRC+=		${PKGDIR}/PLIST.ldap
-.endif
-
-.if defined(KERBEROS)
-SASL_USE_GSSAPI=	yes
-.endif
-.if (defined(SASL_USE_GSSAPI) && !empty(SASL_USE_GSSAPI:M[yY][eE][sS]))
-.  include "../../mk/krb5.buildlink3.mk"
-CONFIGURE_ARGS+=	--enable-gssapi=${KRB5BASE}
-CONFIGURE_ARGS+=	--with-gss_impl=${GSSIMPL.${KRB5_TYPE}}
-GSSIMPL.heimdal=	heimdal
-GSSIMPL.mit-krb5=	mit
-.endif
+.include "Makefile.options"
 
 USE_PKGINSTALL=		yes
 DEINSTALL_EXTRA_TMPL=	${PKGDIR}/DEINSTALL
@@ -80,11 +54,10 @@ post-install:
 	for f in saslcache testsaslauthd; do				\
 		${INSTALL_PROGRAM} ${WRKSRC}/$$f ${PREFIX}/bin/$$f;	\
 	done
-.if defined(USE_OPENLDAP) && !empty(USE_OPENLDAP:M[Yy][Ee][Ss])
+.if !empty(PKG_OPTIONS:Mldap)
 	${INSTALL_DATA_DIR} ${PREFIX}/share/doc/cyrus-saslauthd
-	${INSTALL_DATA} ${WRKSRC}/LDAP_SASLAUTHD \
+	${INSTALL_DATA} ${WRKSRC}/LDAP_SASLAUTHD			\
 		${PREFIX}/share/doc/cyrus-saslauthd
 .endif
 
-.include "../../security/openssl/buildlink3.mk"
 .include "../../mk/bsd.pkg.mk"
diff --git a/security/cyrus-saslauthd/Makefile.options b/security/cyrus-saslauthd/Makefile.options
new file mode 100644
index 00000000000..25bb5dc61a7
--- /dev/null
+++ b/security/cyrus-saslauthd/Makefile.options
@@ -0,0 +1,68 @@
+# $NetBSD: Makefile.options,v 1.1 2004/07/30 21:05:42 jlam Exp $
+
+# Global and legacy options
+.if defined(KERBEROS) || defined(USE_PAM) || defined(USE_OPENLDAP) || \
+    defined(SASL_USE_GSSAPI)
+.  if !defined(PKG_OPTIONS.cyrus-saslauthd)
+.    if defined(KERBEROS)
+PKG_OPTIONS.cyrus-saslauthd+=	kerberos
+.    endif
+.    if defined(USE_PAM) && !empty(USE_PAM:M[yY][eE][sS])
+PKG_OPTIONS.cyrus-saslauthd+=	PAM
+.    endif
+.    if defined(USE_OPENLDAP) && !empty(USE_OPENLDAP:M[yY][eE][sS])
+PKG_OPTIONS.cyrus-saslauthd+=	ldap
+.    endif
+.    if defined(SASL_USE_GSSAPI) && !empty(SASL_USE_GSSAPI:M[yY][eE][sS])
+PKG_OPTIONS.cyrus-saslauthd+=	gssapi
+.    endif
+.  endif
+.endif
+
+PKG_OPTIONS_VAR=	PKG_OPTIONS.cyrus-saslauthd
+PKG_SUPPORTED_OPTIONS=	PAM kerberos ldap gssapi
+.include "../../mk/bsd.options.mk"
+
+###
+### PAM (Pluggable Authentication Mechanism)
+###
+.if !empty(PKG_OPTIONS:MPAM)
+.  include "../../security/PAM/buildlink3.mk"
+CONFIGURE_ARGS+=	--with-pam=${BUILDLINK_PREFIX.pam}
+.endif
+
+###
+### Authentication against information stored in an LDAP directory
+###
+.if !empty(PKG_OPTIONS:Mldap)
+.  include "../../databases/openldap/buildlink3.mk"
+.  include "../../security/cyrus-sasl2/buildlink3.mk"
+.  include "../../security/openssl/buildlink3.mk"
+BUILDLINK_INCDIRS.cyrus-sasl=	include/sasl
+CONFIGURE_ARGS+=	--with-ldap=${BUILDLINK_PREFIX.openldap}
+CONFIGURE_ARGS+=	--with-openssl=${SSLBASE}
+PLIST_SUBST+=		LDAP=
+.else
+CONFIGURE_ARGS+=	--without-openssl
+PLIST_SUBST+=		LDAP="@comment "
+.endif
+
+###
+### Kerberos authentication is via GSSAPI.
+###
+.if !empty(PKG_OPTIONS:Mkerberos)
+.  if empty(PKG_OPTIONS:Mgssapi)
+PKG_OPTIONS+=		gssapi
+.  endif
+.endif
+
+###
+### Authentication via GSSAPI (which supports primarily Kerberos 5)
+###
+.if !empty(PKG_OPTIONS:Mgssapi)
+.  include "../../mk/krb5.buildlink3.mk"
+CONFIGURE_ARGS+=	--enable-gssapi=${KRB5BASE}
+CONFIGURE_ARGS+=	--with-gss_impl=${GSSIMPL.${KRB5_TYPE}}
+GSSIMPL.heimdal=	heimdal
+GSSIMPL.mit-krb5=	mit
+.endif
diff --git a/security/cyrus-saslauthd/PLIST b/security/cyrus-saslauthd/PLIST
index 578a945e3b2..e68e6f3ad14 100644
--- a/security/cyrus-saslauthd/PLIST
+++ b/security/cyrus-saslauthd/PLIST
@@ -1,5 +1,7 @@
-@comment $NetBSD: PLIST,v 1.4 2004/04/23 22:07:58 reed Exp $
+@comment $NetBSD: PLIST,v 1.5 2004/07/30 21:05:42 jlam Exp $
 bin/saslcache
 bin/testsaslauthd
 man/man8/saslauthd.8
 sbin/saslauthd
+${LDAP}share/doc/cyrus-saslauthd/LDAP_SASLAUTHD
+${LDAP}@dirrm share/doc/cyrus-saslauthd
diff --git a/security/cyrus-saslauthd/PLIST.ldap b/security/cyrus-saslauthd/PLIST.ldap
deleted file mode 100644
index 85d4f30be66..00000000000
--- a/security/cyrus-saslauthd/PLIST.ldap
+++ /dev/null
@@ -1,3 +0,0 @@
-@comment $NetBSD: PLIST.ldap,v 1.2 2004/01/13 08:13:42 jlam Exp $
-share/doc/cyrus-saslauthd/LDAP_SASLAUTHD
-@dirrm share/doc/cyrus-saslauthd
diff --git a/security/heimdal/Makefile b/security/heimdal/Makefile
index 71e43171d00..a79ee8d8778 100644
--- a/security/heimdal/Makefile
+++ b/security/heimdal/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.17 2004/07/24 14:01:20 jlam Exp $
+# $NetBSD: Makefile,v 1.18 2004/07/30 21:05:42 jlam Exp $
 
 DISTNAME=	heimdal-0.6.1
 PKGREVISION=	1
@@ -34,19 +34,33 @@ BUILDLINK_INCDIRS.readline=	include/readline
 CONFIGURE_ARGS+=	--with-readline=${BUILDLINK_PREFIX.readline}
 LIBS.SunOS=		-ltermcap
 
-BUILD_DEFS+=		USE_DB4
-.if defined(USE_DB4) && !empty(USE_DB4:M[yY][eE][sS])
+CONFIGURE_ARGS+=	--with-openssl=${SSLBASE}
+.include "../../security/openssl/buildlink3.mk"
+
+# Global and legacy options
+.if defined(USE_DB4) || defined(KERBEROS_PREFIX_CMDS)
+.  if !defined(PKG_OPTIONS.mit-krb5)
+.    if defined(USE_DB4) && !empty(USE_DB4:M[yY][eE][sS])     
+PKG_OPTIONS.mit-krb5+=  db4
+.    endif
+.    if defined(KERBEROS_PREFIX_CMDS) && !empty(KERBEROS_PREFIX_CMDS:M[yY][eE][sS])     
+PKG_OPTIONS.mit-krb5+=  prefix-cmds
+.    endif
+.  endif
+.endif
+
+PKG_OPTIONS_VAR=	PKG_OPTIONS.heimdal
+PKG_SUPPORTED_OPTIONS=	db4 prefix-cmds #ldap
+.include "../../mk/bsd.options.mk"
+
+.if !empty(PKG_OPTIONS:Mdb4)
 .  include "../../databases/db4/buildlink3.mk"
 .else
 .  include "../../mk/bdb.buildlink3.mk"
 .endif
 
-CONFIGURE_ARGS+=	--with-openssl=${SSLBASE}
-.include "../../security/openssl/buildlink3.mk"
-
 # XXX Using Heimdal with an LDAP backend isn't supported yet.
-#BUILD_DEFS+=		HEIMDAL_USE_LDAP
-#.if defined(HEIMDAL_USE_LDAP) && !empty(HEIMDAL_USE_LDAP:M[yY][eE][sS])
+#.if !empty(PKG_OPTIONS:Mldap)
 #.  include "../../databases/openldap/buildlink3.mk"
 #CONFIGURE_ARGS+=	--with-openldap=${BUILDLINK_PREFIX.openldap}
 #.endif
@@ -54,8 +68,7 @@ CONFIGURE_ARGS+=	--with-openssl=${SSLBASE}
 # Rename some of Heimdal's applications so they won't conflict with
 # other packages.
 #
-BUILD_DEFS+=	KERBEROS_PREFIX_CMDS
-.if !empty(KERBEROS_PREFIX_CMDS:M[yY][eE][sS])
+.if !empty(PKG_OPTIONS:Mprefix-cmds)
 KRB5_PREFIX=		k
 HEIMDAL_TRANSFORM=	s/^ftp/${KRB5_PREFIX}&/;			\
 			s/^login/${KRB5_PREFIX}&/;			\
diff --git a/security/mit-krb5/Makefile b/security/mit-krb5/Makefile
index 2f44c795bda..14b8f91c400 100644
--- a/security/mit-krb5/Makefile
+++ b/security/mit-krb5/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.9 2004/07/24 13:56:09 jlam Exp $
+# $NetBSD: Makefile,v 1.10 2004/07/30 21:05:42 jlam Exp $
 
 DISTNAME=	krb5-1.3.4
 PKGNAME=	mit-${DISTNAME}
@@ -54,11 +54,23 @@ CONFIGURE_ARGS+=	--without-krb4
 CONFIGURE_ARGS+=	--without-tcl
 MAKE_ENV+=		ROOT_USER=${ROOT_USER}
 
+# Global and legacy options
+.if defined(KERBEROS_PREFIX_CMDS)
+.  if !defined(PKG_OPTIONS.mit-krb5)
+.    if defined(KERBEROS_PREFIX_CMDS) && !empty(KERBEROS_PREFIX_CMDS:M[yY][eE][sS])
+PKG_OPTIONS.mit-krb5+=	prefix-cmds
+.    endif
+.  endif
+.endif
+
+PKG_OPTIONS_VAR=	PKG_OPTIONS.mit-krb5
+PKG_SUPPORTED_OPTIONS=	prefix-cmds
+.include "../../mk/bsd.options.mk"
+
 # Rename some of MIT krb5's applications so they won't conflict with
 # other packages.
 #
-BUILD_DEFS+=		KERBEROS_PREFIX_CMDS
-.if !empty(KERBEROS_PREFIX_CMDS:M[yY][eE][sS])
+.if !empty(PKG_OPTIONS:Mprefix-cmds)
 KRB5_PREFIX=		k
 MIT_KRB5_TRANSFORM=	s/^ftp/${KRB5_PREFIX}&/;			\
 			s/^rcp/${KRB5_PREFIX}&/;			\
diff --git a/security/openssl/Makefile b/security/openssl/Makefile
index 57a3e18ecb6..502e3dd505f 100644
--- a/security/openssl/Makefile
+++ b/security/openssl/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.92 2004/03/26 08:33:49 jlam Exp $
+# $NetBSD: Makefile,v 1.93 2004/07/30 21:05:42 jlam Exp $
 
 DISTNAME=		openssl-0.9.6m
 SVR4_PKGNAME=		ossl
@@ -34,7 +34,20 @@ CONFIGURE_ARGS+=	shared
 # IDEA, RC5, and MDC2 are disabled due to licensing and/or patent issues.
 CONFIGURE_ARGS+=	no-idea no-rc5 no-mdc2
 
-.if defined(USE_RSAREF2) && ${USE_RSAREF2} == "YES"
+# Global and legacy options
+.if defined(USE_RSAREF2)
+.  if !defined(PKG_OPTIONS.openssl)
+.    if defined(USE_RSAREF2) && !empty(USE_RSAREF2:M[yY][eE][sS])
+PKG_OPTIONS.openssl+=	rsaref
+.    endif
+.  endif
+.endif
+
+PKG_OPTIONS_VAR=	PKG_OPTIONS.openssl
+PKG_SUPPORTED_OPTIONS=	rsaref
+.include "../../mk/bsd.options.mk"
+
+.if !empty(PKG_OPTIONS:Mrsaref)
 .  include "../../security/rsaref/buildlink3.mk"
 CONFIGURE_ARGS+=	rsaref
 PLIST_RSAREF=		${PKGDIR}/PLIST.rsaref
diff --git a/security/sudo/Makefile b/security/sudo/Makefile
index 53aa519060c..e66d4f85b10 100644
--- a/security/sudo/Makefile
+++ b/security/sudo/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.63 2004/03/22 08:45:56 jlam Exp $
+# $NetBSD: Makefile,v 1.64 2004/07/30 21:05:42 jlam Exp $
 #
 
 DISTNAME=		sudo-1.6.7p5
@@ -32,9 +32,20 @@ CONFIGURE_ARGS+=	--with-skey
 CONFIGURE_ARGS+=	--without-skey
 .endif
 
+# Global and legacy options
 .if defined(KERBEROS)
-CONFIGURE_ARGS+=	--without-kerb4
+.  if !defined(PKG_OPTIONS.sudo)
+PKG_OPTIONS.sudo+=	kerberos
+.  endif
+.endif
+
+PKG_OPTIONS_VAR=	PKG_OPTIONS.sudo
+PKG_SUPPORTED_OPTIONS=	kerberos
+.include "../../mk/bsd.options.mk"
+
+.if !empty(PKG_OPTIONS:Mkerberos)
 .  include "../../mk/krb5.buildlink3.mk"
+CONFIGURE_ARGS+=	--without-kerb4
 CONFIGURE_ARGS+=	--with-kerb5
 .else
 CONFIGURE_ARGS+=	--without-kerb5