Massive cleanup of buildlink3.mk and builtin.mk files in pkgsrc.

Several changes are involved since they are all interrelated.  These
changes affect about 1000 files.

The first major change is rewriting bsd.builtin.mk as well as all of
the builtin.mk files to follow the new example in bsd.builtin.mk.
The loop to include all of the builtin.mk files needed by the package
is moved from bsd.builtin.mk and into bsd.buildlink3.mk.  bsd.builtin.mk
is now included by each of the individual builtin.mk files and provides
some common logic for all of the builtin.mk files.  Currently, this
includes the computation for whether the native or pkgsrc version of
the package is preferred.  This causes USE_BUILTIN.* to be correctly
set when one builtin.mk file includes another.

The second major change is teach the builtin.mk files to consider
files under ${LOCALBASE} to be from pkgsrc-controlled packages.  Most
of the builtin.mk files test for the presence of built-in software by
checking for the existence of certain files, e.g. <pthread.h>, and we
now assume that if that file is under ${LOCALBASE}, then it must be
from pkgsrc.  This modification is a nod toward LOCALBASE=/usr.  The
exceptions to this new check are the X11 distribution packages, which
are handled specially as noted below.

The third major change is providing builtin.mk and version.mk files
for each of the X11 distribution packages in pkgsrc.  The builtin.mk
file can detect whether the native X11 distribution is the same as
the one provided by pkgsrc, and the version.mk file computes the
version of the X11 distribution package, whether it's built-in or not.

The fourth major change is that the buildlink3.mk files for X11 packages
that install parts which are part of X11 distribution packages, e.g.
Xpm, Xcursor, etc., now use imake to query the X11 distribution for
whether the software is already provided by the X11 distribution.
This is more accurate than grepping for a symbol name in the imake
config files.  Using imake required sprinkling various builtin-imake.mk
helper files into pkgsrc directories.  These files are used as input
to imake since imake can't use stdin for that purpose.

The fifth major change is in how packages note that they use X11.
Instead of setting USE_X11, package Makefiles should now include
x11.buildlink3.mk instead.  This causes the X11 package buildlink3
and builtin logic to be executed at the correct place for buildlink3.mk
and builtin.mk files that previously set USE_X11, and fixes packages
that relied on buildlink3.mk files to implicitly note that X11 is
needed.  Package buildlink3.mk should also include x11.buildlink3.mk
when linking against the package libraries requires also linking
against the X11 libraries.  Where it was obvious, redundant inclusions
of x11.buildlink3.mk have been removed.

18 files changed, 503 insertions, 325 deletions

diff --git a/security/PAM/builtin.mk b/security/PAM/builtin.mk
index ca7acf2e9d9..3b3c81f2e01 100644
--- a/security/PAM/builtin.mk
+++ b/security/PAM/builtin.mk
@@ -1,35 +1,57 @@
-# $NetBSD: builtin.mk,v 1.11 2005/01/14 07:54:20 jlam Exp $
+# $NetBSD: builtin.mk,v 1.12 2005/06/01 18:03:20 jlam Exp $
 
-.include "../../mk/bsd.prefs.mk"
+BUILTIN_PKG:=	linux-pam
 
-_LINUX_PAM_APPL_HEADERS=	/usr/include/pam/pam_appl.h		\
-				/usr/include/security/pam_appl.h
-_LINUX_PAM_IDENT=		The Linux-PAM Framework layer API
+BUILTIN_FIND_FILES_VAR:=	H_LINUX_PAM
+BUILTIN_FIND_FILES.H_LINUX_PAM=	/usr/include/security/pam_appl.h	\
+				/usr/include/pam/pam_appl.h
+BUILTIN_FIND_GREP.H_LINUX_PAM=	The Linux-PAM Framework layer API
 
+.include "../../mk/buildlink3/bsd.builtin.mk"
+
+###
+### Determine if there is a built-in implementation of the package and
+### set IS_BUILTIN.<pkg> appropriately ("yes" or "no").
+###
 .if !defined(IS_BUILTIN.linux-pam)
 IS_BUILTIN.linux-pam=	no
-.  for _inc_ in ${_LINUX_PAM_APPL_HEADERS}
-.    if !empty(IS_BUILTIN.linux-pam:M[nN][oO]) && exists(${_inc_})
-IS_BUILTIN.linux-pam!=	\
-	case ${_inc_} in						\
-	${LOCALBASE}/*)							\
-		${ECHO} "no";						\
-		;;							\
-	*)								\
-		if ${GREP} -q "${_LINUX_PAM_IDENT}" ${_inc_}; then	\
-			${ECHO} "yes";					\
-		else							\
-			${ECHO} "no";					\
-		fi;							\
-		;;							\
-	esac
-.    endif
-.  endfor
-BUILDLINK_VARS+=	IS_BUILTIN.linux-pam
-.endif	# IS_BUILTIN.linux-pam
+.  if empty(H_LINUX_PAM:M${LOCALBASE}/*) && exists(${H_LINUX_PAM})
+IS_BUILTIN.linux-pam=	yes
+.  endif
+.endif
+MAKEVARS+=	IS_BUILTIN.linux-pam
 
-USE_BUILTIN.linux-pam?=	${IS_BUILTIN.linux-pam}
+###
+### Determine whether we should use the built-in implementation if it
+### exists, and set USE_BUILTIN.<pkg> appropriate ("yes" or "no").
+###
+.if !defined(USE_BUILTIN.linux-pam)
+.  if ${PREFER.linux-pam} == "pkgsrc"
+USE_BUILTIN.linux-pam=	no
+.  else
+USE_BUILTIN.linux-pam=	${IS_BUILTIN.linux-pam}
+.    if defined(BUILTIN_PKG.linux-pam) && \
+        !empty(IS_BUILTIN.linux-pam:M[yY][eE][sS])
+USE_BUILTIN.linux-pam=	yes
+.      for _dep_ in ${BUILDLINK_DEPENDS.linux-pam}
+.        if !empty(USE_BUILTIN.linux-pam:M[yY][eE][sS])
+USE_BUILTIN.linux-pam!=							\
+	if ${PKG_ADMIN} pmatch ${_dep_:Q} ${BUILTIN_PKG.linux-pam:Q}; then \
+		${ECHO} yes;						\
+	else								\
+		${ECHO} no;						\
+	fi
+.        endif
+.      endfor
+.    endif
+.  endif  # PREFER.linux-pam
+.endif
+MAKEVARS+=	USE_BUILTIN.linux-pam
 
+###
+### The section below only applies if we are not including this file
+### solely to determine whether a built-in implementation exists.
+###
 CHECK_BUILTIN.linux-pam?=	no
 .if !empty(CHECK_BUILTIN.linux-pam:M[nN][oO])
 
@@ -41,10 +63,11 @@ BUILDLINK_TARGETS+=	buildlink-pam-security
 .PHONY: buildlink-pam-security
 buildlink-pam-security:
 	${_PKG_SILENT}${_PKG_DEBUG}					\
-	if [ -d ${BUILDLINK_PREFIX.linux-pam}/include/pam ]; then	\
-		${RM} -fr ${BUILDLINK_DIR}/include/security;		\
-		${LN} -fs ${BUILDLINK_PREFIX.linux-pam}/include/pam	\
-			${BUILDLINK_DIR}/include/security;		\
+	src=${BUILDLINK_PREFIX.linux-pam:Q}"/include/pam";		\
+	dest=${BUILDLINK_DIR:Q}"/include/security";			\
+	if ${TEST} -d "$$src"; then					\
+		${RM} -fr "$$dest";					\
+		${LN} -fs "$$src" "$$dest";				\
 	fi
 .  endif
 
diff --git a/security/dsniff/Makefile b/security/dsniff/Makefile
index 36f845f1112..9d60be39320 100644
--- a/security/dsniff/Makefile
+++ b/security/dsniff/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.24 2005/03/22 01:07:07 wiz Exp $
+# $NetBSD: Makefile,v 1.25 2005/06/01 18:03:20 jlam Exp $
 
 .include "Makefile.common"
 
@@ -7,9 +7,10 @@ COMMENT=	Password sniffer (webspy)
 
 DEPENDS+=	dsniff-nox11-[0-9]*:../../security/dsniff-nox11
 
-USE_X11=	yes
 BUILD_TARGET=	libmissing.a webspy
 
+.include "../../mk/x11.buildlink3.mk"
+
 do-install:
 	${INSTALL_PROGRAM} ${WRKSRC}/webspy ${PREFIX}/sbin
 	${INSTALL_MAN} ${WRKSRC}/webspy.8 ${PREFIX}/man/man8
diff --git a/security/heimdal/builtin.mk b/security/heimdal/builtin.mk
index f8ff20aae46..c33504f7b0a 100644
--- a/security/heimdal/builtin.mk
+++ b/security/heimdal/builtin.mk
@@ -1,83 +1,100 @@
-# $NetBSD: builtin.mk,v 1.3 2004/09/14 15:10:09 jlam Exp $
+# $NetBSD: builtin.mk,v 1.4 2005/06/01 18:03:20 jlam Exp $
 
-_KRB5_KRB5_H=	/usr/include/krb5/krb5.h
+BUILTIN_PKG:=	heimdal
 
+BUILTIN_FIND_FILES_VAR:=	H_HEIMDAL
+BUILTIN_FIND_FILES.H_HEIMDAL=	/usr/include/krb5/krb5.h
+BUILTIN_FIND_GREP.H_HEIMDAL=	heimdal_version
+
+.include "../../mk/buildlink3/bsd.builtin.mk"
+
+###
+### Determine if there is a built-in implementation of the package and
+### set IS_BUILTIN.<pkg> appropriately ("yes" or "no").
+###
 .if !defined(IS_BUILTIN.heimdal)
 IS_BUILTIN.heimdal=	no
-.  if exists(${_KRB5_KRB5_H})
-IS_BUILTIN.heimdal!=							\
-	if ${GREP} -q heimdal_version ${_KRB5_KRB5_H}; then		\
-		${ECHO} "yes";						\
-	else								\
-		${ECHO} "no";						\
-	fi
-.    if !empty(IS_BUILTIN.heimdal:M[yY][eE][sS])
-#
-# Create an appropriate name for the built-in package distributed
-# with the system.  This package name can be used to check against
-# BUILDLINK_DEPENDS.<pkg> to see if we need to install the pkgsrc
-# version or if the built-in one is sufficient.
+.  if empty(H_HEIMDAL:M${LOCALBASE}/*) && exists(${H_HEIMDAL})
+IS_BUILTIN.heimdal=	yes
+.  endif
+.endif
+MAKEVARS+=	IS_BUILTIN.heimdal
+
+###
+### If there is a built-in implementation, then set BUILTIN_PKG.<pkg> to
+### a package name to represent the built-in package.
+###
+.if !defined(BUILTIN_PKG.heimdal) && \
+    !empty(IS_BUILTIN.heimdal:M[yY][eE][sS])
 #
 # heimdal<=0.6 doesn't have a method of checking the headers to discover
 # the version number of the software.  Match up heimdal versions with
 # OS versions for an approximate determination of the heimdal version.
 #
-.      if !defined(_HEIMDAL_VERSION)
-_HEIMDAL_VERSIONS=	0.6  0.5  0.4e  0.3f  0.3e
-_HEIMDAL_0.6.3=		NetBSD-[2-9]*-*
-_HEIMDAL_0.6.2=		# empty
-_HEIMDAL_0.6.1=		NetBSD-1.6[U-Z]-* NetBSD-1.6Z*-*
-_HEIMDAL_0.6=		NetBSD-1.6[U-Z]-* NetBSD-1.6Z*-* NetBSD-[2-9]*-*
-_HEIMDAL_0.5=		NetBSD-1.6[I-T]-*
-_HEIMDAL_0.4e=		NetBSD-1.6[A-H]-*				\
+_BLTN_HEIMDAL_VERSIONS=	0.6  0.5  0.4e  0.3f  0.3e
+_BLTN_HEIMDAL_0.6.3=	NetBSD-[2-9]*-*
+_BLTN_HEIMDAL_0.6.2=	# empty
+_BLTN_HEIMDAL_0.6.1=	NetBSD-1.6[U-Z]-* NetBSD-1.6Z*-*
+_BLTN_HEIMDAL_0.6=	NetBSD-1.6[U-Z]-* NetBSD-1.6Z*-* NetBSD-[2-9]*-*
+_BLTN_HEIMDAL_0.5=	NetBSD-1.6[I-T]-*
+_BLTN_HEIMDAL_0.4e=	NetBSD-1.6[A-H]-*				\
 			NetBSD-1.6-* NetBSD-1.6_*-* NetBSD-1.6.*-*	\
 			NetBSD-1.5[YZ]-* NetBSD-1.5Z*-*
-_HEIMDAL_0.3f=		NetBSD-1.5X-*
-_HEIMDAL_0.3e=		NetBSD-1.5[UVW]-*				\
+_BLTN_HEIMDAL_0.3f=	NetBSD-1.5X-*
+_BLTN_HEIMDAL_0.3e=	NetBSD-1.5[UVW]-*				\
 			NetBSD-1.5.*-*
-.        for _heimdal_version_ in ${_HEIMDAL_VERSIONS}
-.          for _pattern_ in ${_HEIMDAL_${_heimdal_version_}}
-.            if !empty(MACHINE_PLATFORM:M${_pattern_})
-_HEIMDAL_VERSION?=	${_heimdal_version_}
-.            endif
-.          endfor
-.        endfor
-_HEIMDAL_VERSION?=	0.2t
+.  for _heimdal_version_ in ${_BLTN_HEIMDAL_VERSIONS}
+.    for _pattern_ in ${_BLTN_HEIMDAL_${_heimdal_version_}}
+.      if !empty(MACHINE_PLATFORM:M${_pattern_})
+BUILTIN_VERSION.heimdal?=	${_heimdal_version_}
 .      endif
-BUILTIN_PKG.heimdal=	heimdal-${_HEIMDAL_VERSION}
-MAKEFLAGS+=		BUILTIN_PKG.heimdal=${BUILTIN_PKG.heimdal}
-.    endif
-.  endif
-MAKEFLAGS+=	IS_BUILTIN.heimdal=${IS_BUILTIN.heimdal}
+.    endfor
+.  endfor
+BUILTIN_VERSION.heimdal?=	0.2t
+BUILTIN_PKG.heimdal=		heimdal-${BUILTIN_VERSION.heimdal}
 .endif
+MAKEVARS+=	BUILTIN_PKG.heimdal
 
+###
+### Determine whether we should use the built-in implementation if it
+### exists, and set USE_BUILTIN.<pkg> appropriate ("yes" or "no").
+###
 .if !defined(USE_BUILTIN.heimdal)
-USE_BUILTIN.heimdal?=	${IS_BUILTIN.heimdal}
-
-.  if defined(BUILTIN_PKG.heimdal)
+.  if ${PREFER.heimdal} == "pkgsrc"
+USE_BUILTIN.heimdal=	${IS_BUILTIN.heimdal}
+.  else
+USE_BUILTIN.heimdal=	${IS_BUILTIN.heimdal}
+.    if defined(BUILTIN_PKG.heimdal) && \
+        !empty(IS_BUILTIN.heimdal:M[yY][eE][sS])
 USE_BUILTIN.heimdal=	yes
-.    for _depend_ in ${BUILDLINK_DEPENDS.heimdal}
-.      if !empty(USE_BUILTIN.heimdal:M[yY][eE][sS])
-USE_BUILTIN.heimdal!=	\
-	if ${PKG_ADMIN} pmatch '${_depend_}' ${BUILTIN_PKG.heimdal}; then \
-		${ECHO} "yes";						\
+.      for _dep_ in ${BUILDLINK_DEPENDS.heimdal}
+.        if !empty(USE_BUILTIN.heimdal:M[yY][eE][sS])
+USE_BUILTIN.heimdal!=							\
+	if ${PKG_ADMIN} pmatch ${_dep_:Q} ${BUILTIN_PKG.heimdal:Q}; then \
+		${ECHO} yes;						\
 	else								\
-		${ECHO} "no";						\
+		${ECHO} no;						\
 	fi
-.      endif
-.    endfor
-.  endif
-.endif	# USE_BUILTIN.heimdal
+.        endif
+.      endfor
+.    endif
+.  endif  # PREFER.heimdal
+.endif
+MAKEVARS+=	USE_BUILTIN.heimdal
 
+###
+### The section below only applies if we are not including this file
+### solely to determine whether a built-in implementation exists.
+###
 CHECK_BUILTIN.heimdal?=	no
 .if !empty(CHECK_BUILTIN.heimdal:M[nN][oO])
 
-.if !empty(USE_BUILTIN.heimdal:M[nN][oO])
+.  if !empty(USE_BUILTIN.heimdal:M[nN][oO])
 BUILDLINK_DEPENDS.heimdal+=	heimdal>=0.6
 
 KRB5_CONFIG?=	${BUILDLINK_PREFIX.heimdal}/bin/krb5-config
-CONFIGURE_ENV+=	KRB5_CONFIG="${KRB5_CONFIG}"
-MAKE_ENV+=	KRB5_CONFIG="${KRB5_CONFIG}"
-.endif
+CONFIGURE_ENV+=	KRB5_CONFIG=${KRB5_CONFIG:Q}
+MAKE_ENV+=	KRB5_CONFIG=${KRB5_CONFIG:Q}
+.  endif
 
 .endif	# CHECK_BUILTIN.heimdal
diff --git a/security/kth-krb4/Makefile b/security/kth-krb4/Makefile
index 9a0308b8d73..982cb010861 100644
--- a/security/kth-krb4/Makefile
+++ b/security/kth-krb4/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.37 2005/04/11 21:47:12 tv Exp $
+# $NetBSD: Makefile,v 1.38 2005/06/01 18:03:21 jlam Exp $
 #
 
 DISTNAME=		krb4-1.2.1
@@ -16,7 +16,6 @@ CONFLICTS+=		libdes-[0-9]*
 
 CRYPTO=			yes
 
-USE_X11=		yes
 USE_LIBTOOL=		yes
 GNU_CONFIGURE=		yes
 CONFIGURE_ARGS+=	--includedir=${PREFIX}/include/kerberosIV
@@ -65,4 +64,5 @@ post-install:
 	${INSTALL_DATA} ${FILESDIR}/services-1.5.diff ${EXAMPLEDIR}
 
 .include "../../security/openssl/buildlink3.mk"
+.include "../../mk/x11.buildlink3.mk"
 .include "../../mk/bsd.pkg.mk"
diff --git a/security/libdes/builtin.mk b/security/libdes/builtin.mk
index d864ba4b1f0..710e3277265 100644
--- a/security/libdes/builtin.mk
+++ b/security/libdes/builtin.mk
@@ -1,28 +1,72 @@
-# $NetBSD: builtin.mk,v 1.3 2004/12/11 00:32:16 jlam Exp $
+# $NetBSD: builtin.mk,v 1.4 2005/06/01 18:03:21 jlam Exp $
 
+BUILTIN_PKG:=	libdes
+
+BUILTIN_FIND_FILES_VAR:=	H_LIBDES
+BUILTIN_FIND_FILES.H_LIBDES=	/usr/include/libdes.h /usr/include/des.h
+
+.include "../../mk/buildlink3/bsd.builtin.mk"
+
+###
+### Determine if there is a built-in implementation of the package and
+### set IS_BUILTIN.<pkg> appropriately ("yes" or "no").
+###
 .if !defined(IS_BUILTIN.libdes)
-IS_BUILTIN.libdes=		no
-.  if exists(/usr/include/libdes.h) || exists(/usr/include/des.h)
-IS_BUILTIN.libdes=		yes
+IS_BUILTIN.libdes=	no
+.  if empty(H_LIBDES:M${LOCALBASE}/*) && exists(${H_LIBDES})
+IS_BUILTIN.libdes=	yes
 .  endif
-.endif	# IS_BUILTIN.libdes
+.endif
+MAKEVARS+=	IS_BUILTIN.libdes
 
-USE_BUILTIN.libdes?=	${IS_BUILTIN.libdes}
+###
+### Determine whether we should use the built-in implementation if it
+### exists, and set USE_BUILTIN.<pkg> appropriate ("yes" or "no").
+###
+.if !defined(USE_BUILTIN.libdes)
+.  if ${PREFER.libdes} == "pkgsrc"
+USE_BUILTIN.libdes=	no
+.  else
+USE_BUILTIN.libdes=	${IS_BUILTIN.libdes}
+.    if defined(BUILTIN_PKG.libdes) && \
+        !empty(IS_BUILTIN.libdes:M[yY][eE][sS])
+USE_BUILTIN.libdes=	yes
+.      for _dep_ in ${BUILDLINK_DEPENDS.libdes}
+.        if !empty(USE_BUILTIN.libdes:M[yY][eE][sS])
+USE_BUILTIN.libdes!=							\
+	if ${PKG_ADMIN} pmatch ${_dep_:Q} ${BUILTIN_PKG.libdes:Q}; then	\
+		${ECHO} yes;						\
+	else								\
+		${ECHO} no;						\
+	fi
+.        endif
+.      endfor
+.    endif
+.  endif  # PREFER.libdes
+.endif
+MAKEVARS+=	USE_BUILTIN.libdes
 
+###
+### The section below only applies if we are not including this file
+### solely to determine whether a built-in implementation exists.
+###
 CHECK_BUILTIN.libdes?=	no
 .if !empty(CHECK_BUILTIN.libdes:M[nN][oO])
+
 .  if !empty(USE_BUILTIN.libdes:M[yY][eE][sS])
 BUILDLINK_TARGETS+=	buildlink-libdes-libdes-h
-.    if !target(buildlink-libdes-libdes-h)
+.  endif
+
+.  if !target(buildlink-libdes-libdes-h)
 .PHONY: buildlink-libdes-libdes-h
 buildlink-libdes-libdes-h:
 	${_PKG_SILENT}${_PKG_DEBUG}					\
-	dest="${BUILDLINK_DIR}/include/libdes.h";			\
 	src="/usr/include/des.h";					\
+	dest=${BUILDLINK_DIR:Q}"/include/libdes.h";			\
 	if ${TEST} ! -f "$$dest" -a -f "$$src"; then			\
-		${MKDIR} -p `${DIRNAME} $$dest`;			\
-		${LN} -fs $$src $$dest;					\
+		${MKDIR} -p `${DIRNAME} "$$dest"`;			\
+		${LN} -fs "$$src" "$$dest";				\
 	fi
-.    endif
-.  endif # USE_BUILTIN.libdes == yes
+.  endif
+
 .endif	# CHECK_BUILTIN.libdes
diff --git a/security/nessus-core/Makefile b/security/nessus-core/Makefile
index b886e5a3250..d5f46839d16 100644
--- a/security/nessus-core/Makefile
+++ b/security/nessus-core/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.20 2005/04/11 21:47:14 tv Exp $
+# $NetBSD: Makefile,v 1.21 2005/06/01 18:03:21 jlam Exp $
 
 .include 	"../nessus/Makefile.common"
 
@@ -8,7 +8,6 @@ COMMENT=	Core module of the Nessus Network Security Scanner
 
 WRKSRC=		${WRKDIR}/nessus-core
 USE_PKGINSTALL=		yes
-USE_X11=		yes
 GNU_CONFIGURE=		yes
 CONFIGURE_ARGS+=	--enable-gtk --with-x --localstatedir=${VARBASE}
 CONFIGURE_ENV+=		ac_cv_path_GTKCONFIG="pkg-config gtk+-2.0" \
diff --git a/security/nessus/Makefile b/security/nessus/Makefile
index f7878cc4523..abca4e156f7 100644
--- a/security/nessus/Makefile
+++ b/security/nessus/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.24 2005/04/04 09:31:46 adam Exp $
+# $NetBSD: Makefile,v 1.25 2005/06/01 18:03:21 jlam Exp $
 
 .include	"../nessus/Makefile.common"
 
@@ -11,7 +11,6 @@ COMMENT=	The Nessus Network Security Scanner
 DEPENDS+=	nessus-core-${VERS}:../nessus-core
 DEPENDS+=	nessus-plugins-${VERS}:../nessus-plugins
 
-USE_X11=	yes
 EXTRACT_ONLY=	# empty
 NO_CHECKSUM=	yes
 NO_CONFIGURE=	yes
diff --git a/security/openpam/builtin.mk b/security/openpam/builtin.mk
index 004a00eb720..a1a64a6d582 100644
--- a/security/openpam/builtin.mk
+++ b/security/openpam/builtin.mk
@@ -1,40 +1,61 @@
-# $NetBSD: builtin.mk,v 1.2 2005/01/14 07:47:29 jlam Exp $
+# $NetBSD: builtin.mk,v 1.3 2005/06/01 18:03:21 jlam Exp $
 
-_SECURITY_OPENPAM_VERSION_H=	/usr/include/security/openpam_version.h
+BUILTIN_PKG:=	openpam
 
+BUILTIN_FIND_FILES_VAR:=	H_OPENPAM
+BUILTIN_FIND_FILES.H_OPENPAM=	/usr/include/security/openpam_version.h
+
+.include "../../mk/buildlink3/bsd.builtin.mk"
+
+###
+### Determine if there is a built-in implementation of the package and
+### set IS_BUILTIN.<pkg> appropriately ("yes" or "no").
+###
 .if !defined(IS_BUILTIN.openpam)
 IS_BUILTIN.openpam=	no
-.  if empty(_SECURITY_OPENPAM_VERSION_H:M${LOCALBASE}/*) && \
-      exists(${_SECURITY_OPENPAM_VERSION_H})
+.  if empty(H_OPENPAM:M${LOCALBASE}/*) && exists(${H_OPENPAM})
 IS_BUILTIN.openpam=	yes
-#
-# Create an appropriate package name for the built-in software
-# distributed with the system.  This package name can be used to check
-# against BUILDLINK_DEPENDS.<pkg> to see if we need to install the
-# pkgsrc version or if the built-in one is sufficient.
-#
-_OPENPAM_VERSION!=	${AWK} '/\#define[ 	]*_OPENPAM_VERSION[ 	]/ {print $$3; }' ${_SECURITY_OPENPAM_VERSION_H}
-BUILTIN_PKG.openpam=	openpam-${_OPENPAM_VERSION}
-BUILDLINK_VARS+=	BUILTIN_PKG.openpam
 .  endif
-BUILDLINK_VARS+=	IS_BUILTIN.openpam
-.endif	# IS_BUILTIN.openpam
+.endif
+MAKEVARS+=	IS_BUILTIN.openpam
 
-.if !defined(USE_BUILTIN.openpam)
-USE_BUILTIN.openpam?=	${IS_BUILTIN.openpam}
+###
+### If there is a built-in implementation, then set BUILTIN_PKG.<pkg> to
+### a package name to represent the built-in package.
+###
+.if !defined(BUILTIN_PKG.openpam) && \
+    !empty(IS_BUILTIN.openpam:M[yY][eE][sS]) && \
+    exists(${H_OPENPAM})
+BUILTIN_VERSION.openpam!=	\
+	${AWK} '/\#define[ 	]*_OPENPAM_VERSION[ 	]/ {print $$3; }' \
+		${H_OPENPAM}
+BUILTIN_PKG.openpam=	openpam-${BUILTIN_VERSION.openpam}
+.endif
+MAKEVARS+=	BUILTIN_PKG.openpam
 
-.  if defined(BUILTIN_PKG.openpam)
+###
+### Determine whether we should use the built-in implementation if it
+### exists, and set USE_BUILTIN.<pkg> appropriate ("yes" or "no").
+###
+.if !defined(USE_BUILTIN.openpam)
+.  if ${PREFER.openpam} == "pkgsrc"
+USE_BUILTIN.openpam=	${IS_BUILTIN.openpam}
+.  else
+USE_BUILTIN.openpam=	${IS_BUILTIN.openpam}
+.    if defined(BUILTIN_PKG.openpam) && \
+        !empty(IS_BUILTIN.openpam:M[yY][eE][sS])
 USE_BUILTIN.openpam=	yes
-.    for _depend_ in ${BUILDLINK_DEPENDS.openpam}
-.      if !empty(USE_BUILTIN.openpam:M[yY][eE][sS])
-USE_BUILTIN.openpam!=	\
-	if ${PKG_ADMIN} pmatch '${_depend_}' ${BUILTIN_PKG.openpam}; then \
-		${ECHO} "yes";						\
+.      for _dep_ in ${BUILDLINK_DEPENDS.openpam}
+.        if !empty(USE_BUILTIN.openpam:M[yY][eE][sS])
+USE_BUILTIN.openpam!=							\
+	if ${PKG_ADMIN} pmatch ${_dep_:Q} ${BUILTIN_PKG.openpam:Q}; then \
+		${ECHO} yes;						\
 	else								\
-		${ECHO} "no";						\
+		${ECHO} no;						\
 	fi
-.      endif
-.    endfor
-.  endif
-BUILDLINK_VARS+=	USE_BUILTIN.openpam
-.endif	# USE_BUILTIN.openpam
+.        endif
+.      endfor
+.    endif
+.  endif  # PREFER.openpam
+.endif
+MAKEVARS+=	USE_BUILTIN.openpam
diff --git a/security/openssl/builtin.mk b/security/openssl/builtin.mk
index 6d8fe6e0609..35a9f1ef9c4 100644
--- a/security/openssl/builtin.mk
+++ b/security/openssl/builtin.mk
@@ -1,172 +1,145 @@
-# $NetBSD: builtin.mk,v 1.12 2005/03/23 09:06:38 jlam Exp $
+# $NetBSD: builtin.mk,v 1.13 2005/06/01 18:03:21 jlam Exp $
 
-_OPENSSL_PKGSRC_PKGNAME=	openssl-0.9.7f
-_OPENSSL_OPENSSLV_H=		/usr/include/openssl/opensslv.h
+BUILTIN_PKG:=	openssl
 
-.for _lib_ in des
-.  if !defined(_BLNK_LIB_FOUND.${_lib_})
-_BLNK_LIB_FOUND.${_lib_}!=	\
-	if ${TEST} "`${ECHO} /usr/lib/lib${_lib_}.*`" != "/usr/lib/lib${_lib_}.*"; then \
-		${ECHO} "yes";						\
-	elif ${TEST} "`${ECHO} /lib/lib${_lib_}.*`" != "/lib/lib${_lib_}.*"; then \
-		${ECHO} "yes";						\
-	else								\
-		${ECHO} "no";						\
-	fi
-BUILDLINK_VARS+=	_BLNK_LIB_FOUND.${_lib_}
-.  endif
-.endfor
-.undef _lib_
+BUILTIN_FIND_LIBS:=		des
+BUILTIN_FIND_FILES_VAR:=	H_OPENSSL
+BUILTIN_FIND_FILES.H_OPENSSL=	/usr/include/openssl/opensslv.h
+
+.include "../../mk/buildlink3/bsd.builtin.mk"
 
+###
+### Determine if there is a built-in implementation of the package and
+### set IS_BUILTIN.<pkg> appropriately ("yes" or "no").
+###
 .if !defined(IS_BUILTIN.openssl)
 IS_BUILTIN.openssl=	no
-.  if exists(${_OPENSSL_OPENSSLV_H})
+.  if empty(H_OPENSSL:M${LOCALBASE}/*) && exists(${H_OPENSSL})
 IS_BUILTIN.openssl=	yes
-#
-# Create an appropriate name for the built-in package distributed
-# with the system.  This package name can be used to check against
-# BUILDLINK_DEPENDS.<pkg> to see if we need to install the pkgsrc
-# version or if the built-in one is sufficient.
-#
-_OPENSSL_MAJOR!=							\
-	${AWK} 'BEGIN { hex="0123456789abcdef" }			\
-		/\#define[ 	]*OPENSSL_VERSION_NUMBER/ {		\
-			i = index(hex, substr($$3, 3, 1)) - 1;		\
-			print i;					\
-			exit 0;						\
+.  endif
+.endif
+MAKEVARS+=	IS_BUILTIN.openssl
+
+###
+### If there is a built-in implementation, then set BUILTIN_PKG.<pkg> to
+### a package name to represent the built-in package.
+###
+.if !defined(BUILTIN_PKG.openssl) && \
+    !empty(IS_BUILTIN.openssl:M[yY][eE][sS]) && \
+    exists (${H_OPENSSL})
+BUILTIN_VERSION.openssl!=						\
+	${AWK} 'BEGIN { hex="0123456789abcdef";				\
+			split("abcdefghijklmnopqrstuvwxyz", alpha, "");	\
 		}							\
-	' ${_OPENSSL_OPENSSLV_H}
-_OPENSSL_MINOR!=							\
-	${AWK} 'BEGIN { hex="0123456789abcdef" }			\
 		/\#define[ 	]*OPENSSL_VERSION_NUMBER/ {		\
+			major = index(hex, substr($$3, 3, 1)) - 1;	\
 			i = 16 * (index(hex, substr($$3, 4, 1)) - 1);	\
 			i += index(hex, substr($$3, 5, 1)) - 1;		\
-			print i;					\
-			exit 0;						\
-		}							\
-	' ${_OPENSSL_OPENSSLV_H}
-_OPENSSL_TEENY!=							\
-	${AWK} 'BEGIN { hex="0123456789abcdef" }			\
-		/\#define[ 	]*OPENSSL_VERSION_NUMBER/ {		\
+			minor = "."i;					\
 			i = 16 * (index(hex, substr($$3, 6, 1)) - 1);	\
 			i += index(hex, substr($$3, 7, 1)) - 1;		\
-			print i;					\
-			exit 0;						\
-		}							\
-	' ${_OPENSSL_OPENSSLV_H}
-_OPENSSL_PATCHLEVEL!=							\
-	${AWK} 'BEGIN { hex="0123456789abcdef";				\
-			split("abcdefghijklmnopqrstuvwxyz", alpha, "");	\
-		}							\
-		/\#define[ 	]*OPENSSL_VERSION_NUMBER/ {		\
+			teeny = "."i;					\
 			i = 16 * (index(hex, substr($$3, 8, 1)) - 1);	\
 			i += index(hex, substr($$3, 9, 1)) - 1;		\
 			if (i == 0) {					\
-				print "";				\
+				patchlevel = "";			\
 			} else if (i > 26) {				\
-				print "a";				\
+				patchlevel = "a";			\
 			} else {					\
-				print alpha[i];				\
+				patchlevel = alpha[i];			\
 			}						\
+			printf "%s%s%s%s\n",				\
+				major, minor, teeny, patchlevel;	\
 			exit 0;						\
 		}							\
-	' ${_OPENSSL_OPENSSLV_H}
-_OPENSSL_VERSION=	${_OPENSSL_MAJOR}.${_OPENSSL_MINOR}.${_OPENSSL_TEENY}${_OPENSSL_PATCHLEVEL}
-BUILTIN_PKG.openssl=	openssl-${_OPENSSL_VERSION}
-.    if !empty(_OPENSSL_VERSION:M0\.9\.6g)
+	' ${H_OPENSSL}
+
+.  if !empty(BUILTIN_VERSION.openssl:M0\.9\.6g) && \
+      exists(${H_OPENSSL})
 #
 # If the native OpenSSL contains the security fixes pulled up to the
 # netbsd-1-6 branch on 2003-11-07, then pretend it's openssl-0.9.6l.
 #    
-_OPENSSL_HAS_20031107_FIX!=						\
+BUILTIN_OPENSSL_HAS_20031107_FIX!=					\
 	${AWK} 'BEGIN { ans = "no" }					\
 		/OPENSSL_HAS_20031107_FIX/ { ans = "yes" }		\
 		END { print ans; exit 0 }				\
-	' ${_OPENSSL_OPENSSLV_H}
-.      if !empty(_OPENSSL_HAS_20031107_FIX:M[yY][eE][sS])
-BUILTIN_PKG.openssl=	openssl-0.9.6l
-.      endif
+	' ${H_OPENSSL}
+.    if !empty(BUILTIN_OPENSSL_HAS_20031107_FIX:M[yY][eE][sS])
+BUILTIN_VERSION.openssl=	0.9.6l
+.    endif
 #
 # If the native OpenSSL contains the security fixes pulled up to the
 # netbsd-1-6 branch on 2004-04-01, then pretend it's openssl-0.9.6m.
 #    
-_OPENSSL_HAS_20040401_FIX!=						\
+BUILTIN_OPENSSL_HAS_20040401_FIX!=					\
 	${AWK} 'BEGIN { ans = "no" }					\
 		/OPENSSL_HAS_20040401_FIX/ { ans = "yes" }		\
 		END { print ans; exit 0 }				\
-	' ${_OPENSSL_OPENSSLV_H}
-.      if !empty(_OPENSSL_HAS_20040401_FIX:M[yY][eE][sS])
-BUILTIN_PKG.openssl=	openssl-0.9.6m
-.      endif
+	' ${H_OPENSSL}
+.    if !empty(BUILTIN_OPENSSL_HAS_20040401_FIX:M[yY][eE][sS])
+BUILTIN_VERSION.openssl=	-0.9.6m
 .    endif
-BUILDLINK_VARS+=	BUILTIN_PKG.openssl
 .  endif
-BUILDLINK_VARS+=	IS_BUILTIN.openssl
-.endif	# IS_BUILTIN.openssl
+BUILTIN_PKG.openssl=	openssl-${BUILTIN_VERSION.openssl}
+.endif
+MAKEVARS+=	BUILTIN_PKG.openssl
 
+###
+### Determine whether we should use the built-in implementation if it
+### exists, and set USE_BUILTIN.<pkg> appropriate ("yes" or "no").
+###
 .if !defined(USE_BUILTIN.openssl)
-USE_BUILTIN.openssl?=	${IS_BUILTIN.openssl}
-
-.  if defined(BUILTIN_PKG.openssl)
+.  if ${PREFER.openssl} == "pkgsrc"
+USE_BUILTIN.openssl=	${IS_BUILTIN.openssl}
+.  else
+USE_BUILTIN.openssl=	${IS_BUILTIN.openssl}
+.    if defined(BUILTIN_PKG.openssl) && \
+        !empty(IS_BUILTIN.openssl:M[yY][eE][sS])
 USE_BUILTIN.openssl=	yes
-.    for _depend_ in ${BUILDLINK_DEPENDS.openssl}
-.      if !empty(USE_BUILTIN.openssl:M[yY][eE][sS])
-USE_BUILTIN.openssl!=	\
-	if ${PKG_ADMIN} pmatch '${_depend_}' ${BUILTIN_PKG.openssl}; then \
-		${ECHO} "yes";						\
-	else								\
-		${ECHO} "no";						\
-	fi
-.      endif
-.    endfor
-.  endif
-.endif	# USE_BUILTIN.openssl
-
-CHECK_BUILTIN.openssl?=	no
-.if !empty(CHECK_BUILTIN.openssl:M[nN][oO])
-
-.if !defined(_NEED_NEWER_OPENSSL)
-_NEED_NEWER_OPENSSL?=	no
-.  for _depend_ in ${BUILDLINK_DEPENDS.openssl}
-.    if !empty(_NEED_NEWER_OPENSSL:M[nN][oO])
-_NEED_NEWER_OPENSSL!=	\
-	if ${PKG_ADMIN} pmatch '${_depend_}' ${_OPENSSL_PKGSRC_PKGNAME}; then \
-		${ECHO} "no";						\
+.      for _dep_ in ${BUILDLINK_DEPENDS.openssl}
+.        if !empty(USE_BUILTIN.openssl:M[yY][eE][sS])
+USE_BUILTIN.openssl!=							\
+	if ${PKG_ADMIN} pmatch ${_dep_:Q} ${BUILTIN_PKG.openssl:Q}; then \
+		${ECHO} yes;						\
 	else								\
-		${ECHO} "yes";						\
+		${ECHO} no;						\
 	fi
+.        endif
+.      endfor
 .    endif
-.  endfor
-BUILDLINK_VARS+=	_NEED_NEWER_OPENSSL
+.  endif  # PREFER.openssl
 .endif
+MAKEVARS+=	USE_BUILTIN.openssl
 
-.if !empty(USE_BUILTIN.openssl:M[nN][oO]) && \
-    !empty(_NEED_NEWER_OPENSSL:M[yY][eE][sS])
-PKG_SKIP_REASON=	\
-	"Unable to satisfy dependency: ${BUILDLINK_DEPENDS.openssl}"
-.endif
+###
+### The section below only applies if we are not including this file
+### solely to determine whether a built-in implementation exists.
+###
+CHECK_BUILTIN.openssl?=	no
+.if !empty(CHECK_BUILTIN.openssl:M[nN][oO])
 
-.if !empty(USE_BUILTIN.openssl:M[yY][eE][sS])
+.  if !empty(USE_BUILTIN.openssl:M[yY][eE][sS])
 BUILDLINK_PREFIX.openssl=	/usr
-.endif
+.  endif
 
 # By default, we don't bother with the old DES API.
 USE_OLD_DES_API?=	no
-.if !empty(USE_OLD_DES_API:M[yY][eE][sS])
+.  if !empty(USE_OLD_DES_API:M[yY][eE][sS])
 #
 # If we're using the old DES API, then check to see if the old DES
 # code was factored out into a separate library and header files and
 # no longer a part of libcrypto.
 #
-.  if !empty(USE_BUILTIN.openssl:M[yY][eE][sS])
-.    if exists(${BUILDLINK_PREFIX.openssl}/include/des.h) && \
-        !empty(_BLNK_LIB_FOUND.des:M[yY][eE][sS])
+.    if !empty(USE_BUILTIN.openssl:M[yY][eE][sS])
+.      if exists(${BUILDLINK_PREFIX.openssl}/include/des.h) && \
+          !empty(BUILTIN_LIB_FOUND.des:M[yY][eE][sS])
 BUILDLINK_TRANSFORM+=	l:crypto:des:crypto
 WRAPPER_REORDER_CMDS+=	reorder:l:des:crypto
+.      endif
 .    endif
-.  endif
 
-# The idea is to prevent needing to patch source files for packages that
+# The idea is to avoid the need to patch source files for packages that
 # use OpenSSL for DES support by ensuring that including <openssl/des.h>
 # will always present the old DES API.
 #
@@ -182,7 +155,7 @@ WRAPPER_REORDER_CMDS+=	reorder:l:des:crypto
 #         system one and <des.h>.
 #
 BUILDLINK_TARGETS+=	buildlink-openssl-des-h
-.  if !target(buildlink-openssl-des-h)
+.    if !target(buildlink-openssl-des-h)
 .PHONY: buildlink-openssl-des-h
 buildlink-openssl-des-h:
 	${_PKG_SILENT}${_PKG_DEBUG}					\
@@ -209,22 +182,22 @@ buildlink-openssl-des-h:
 		${ECHO} "Unable to find headers for old DES API.";	\
 		exit 1;							\
 	fi
-.  endif
-.endif # USE_OLD_DES_API == yes
+.    endif
+.  endif  # USE_OLD_DES_API == yes
 
-.if defined(PKG_SYSCONFDIR.openssl)
+.  if defined(PKG_SYSCONFDIR.openssl)
 SSLCERTS=	${PKG_SYSCONFDIR.openssl}/certs
 SSLKEYS=	${PKG_SYSCONFDIR.openssl}/private
-.elif ${OPSYS} == "NetBSD"
+.  elif ${OPSYS} == "NetBSD"
 SSLCERTS=	/etc/openssl/certs
 SSLKEYS=	/etc/openssl/private
-.elif !empty(USE_BUILTIN.openssl:M[yY][eE][sS])
+.  elif !empty(USE_BUILTIN.openssl:M[yY][eE][sS])
 SSLCERTS=	/etc/ssl/certs		# likely place where certs live
 SSLKEYS=	/etc/ssl/private	# likely place where private keys live
-.else
+.  else
 SSLCERTS=	${PKG_SYSCONFBASEDIR}/openssl/certs
 SSLKEYS=	${PKG_SYSCONFBASEDIR}/openssl/private
-.endif
+.  endif
 BUILD_DEFS+=	SSLCERTS SSLKEYS
 
 .endif	# CHECK_BUILTIN.openssl
diff --git a/security/pflkm/builtin.mk b/security/pflkm/builtin.mk
index 755b860181c..b31464f1b7b 100644
--- a/security/pflkm/builtin.mk
+++ b/security/pflkm/builtin.mk
@@ -1,29 +1,87 @@
-# $NetBSD: builtin.mk,v 1.3 2005/05/11 22:01:28 peter Exp $
+# $NetBSD: builtin.mk,v 1.4 2005/06/01 18:03:21 jlam Exp $
 
-_PF_VERSION=	3.7	# pkg default
-_PF_PFVAR_H=	/usr/include/net/pfvar.h
+BUILTIN_PKG:=	pflkm
 
-.if !defined(IS_BUILTIN.pflkm)
-IS_BUILTIN.pflkm=	no
-.  if exists(${_PF_PFVAR_H})
-IS_BUILTIN.pflkm=	yes
+BUILTIN_FIND_FILES_VAR:=	H_PFLKM
+BUILTIN_FIND_FILES.H_PFLKM=	/usr/include/net/pfvar.h
 
+.include "../../mk/buildlink3/bsd.builtin.mk"
+
+# Compute the version number of the PF API by checking for the presence
+# of symbols added in newer versions and store the result in ${PF_VERSION}.
+#
+.if !defined(PF_VERSION)
+PF_VERSION=	3.7	# package default
+.  if exists(${H_PFLKM})
 # OpenBSD 3.7: pf_threshold added
-_PF_3_7!=	${GREP} -c pf_threshold ${_PF_PFVAR_H} || ${TRUE}
+_BLTN_PF_3_7!=	${GREP} -c pf_threshold ${H_PFLKM} || ${TRUE}
 # OpenBSD 3.6: pf_cksum_fixup added
-_PF_3_6!=	${GREP} -c pf_cksum_fixup ${_PF_PFVAR_H} || ${TRUE}
-
-.if ${_PF_3_7} == "1"
-BUILTIN_PKG.pflkm=	3.7
-.elif ${_PF_3_6} == "1"
-BUILTIN_PKG.pflkm=	3.6
-.else
-BUILTIN_PKG.pflkm=	3.5
+_BLTN_PF_3_6!=	${GREP} -c pf_cksum_fixup ${H_PFLKM} || ${TRUE}
+
+.    if ${_BLTN_PF_3_7} == "1"
+PF_VERSION=	3.7
+.    elif ${_BLTN_PF_3_6} == "1"
+PF_VERSION=	3.6
+.    else
+PF_VERSION=	3.5
+.    endif
+.  endif
 .endif
+MAKEVARS+=	PF_VERSION
 
-_PF_VERSION=		${BUILTIN_PKG.pflkm}
+###
+### Determine if there is a built-in implementation of the package and
+### set IS_BUILTIN.<pkg> appropriately ("yes" or "no").
+###
+.if !defined(IS_BUILTIN.pflkm)
+IS_BUILTIN.pflkm=	no
+.  if empty(H_PFLKM:M${LOCALBASE}/*) && exists(${H_PFLKM})
+IS_BUILTIN.pflkm=	yes
+.  endif
+.endif
+MAKEVARS+=	IS_BUILTIN.pflkm
 
-.  endif	# exists(${_PF_PFVAR_H})
-.endif	# IS_BUILTIN.pflkm
+###
+### If there is a built-in implementation, then set BUILTIN_PKG.<pkg> to
+### a package name to represent the built-in package.
+###
+.if !defined(BUILTIN_PKG.pflkm) && \
+    !empty(IS_BUILTIN.pflkm:M[yY][eE][sS])
+.  if ${PF_VERSION} == "3.7"
+BUILTIN_PKG.pflkm=	20050519	# release date for PF API 3.7
+.  elif ${PF_VERSION} == "3.6"
+BUILTIN_PKG.pflkm=	20041101	# release date for PF API 3.6
+.  elif ${PF_VERSION} == "3.5"
+BUILTIN_PKG.pflkm=	20040501	# release date for PF API 3.5
+.  else
+BUILTIN_PKG.pflkm=	20040501	# release date for PF API 3.5
+.  endif
+.endif
+MAKEVARS+=	BUILTIN_PKG.pflkm
 
-USE_BUILTIN.pflkm?=	${IS_BUILTIN.pflkm}
+###
+### Determine whether we should use the built-in implementation if it
+### exists, and set USE_BUILTIN.<pkg> appropriate ("yes" or "no").
+###
+.if !defined(USE_BUILTIN.pflkm)
+.  if ${PREFER.pflkm} == "pkgsrc"
+USE_BUILTIN.pflkm=	no
+.  else
+USE_BUILTIN.pflkm=	${IS_BUILTIN.pflkm}
+.    if defined(BUILTIN_PKG.pflkm) && \
+        !empty(IS_BUILTIN.pflkm:M[yY][eE][sS])
+USE_BUILTIN.pflkm=	yes
+.      for _dep_ in ${BUILDLINK_DEPENDS.pflkm}
+.        if !empty(USE_BUILTIN.pflkm:M[yY][eE][sS])
+USE_BUILTIN.pflkm!=							\
+	if ${PKG_ADMIN} pmatch ${_dep_:Q} ${BUILTIN_PKG.pflkm:Q}; then	\
+		${ECHO} yes;						\
+	else								\
+		${ECHO} no;						\
+	fi
+.        endif
+.      endfor
+.    endif
+.  endif  # PREFER.pflkm
+.endif
+MAKEVARS+=	USE_BUILTIN.pflkm
diff --git a/security/putty/Makefile b/security/putty/Makefile
index 2e8583d6bb9..66529df4bad 100644
--- a/security/putty/Makefile
+++ b/security/putty/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.6 2005/05/22 20:08:30 jlam Exp $
+# $NetBSD: Makefile,v 1.7 2005/06/01 18:03:21 jlam Exp $
 #
 
 DISTNAME=	putty-0.58
@@ -10,7 +10,6 @@ HOMEPAGE=	http://www.chiark.greenend.org.uk/~sgtatham/putty/
 COMMENT=	Free implementation of Telnet and SSH for Win32 and Unix platforms
 
 USE_TOOLS+=	gmake
-USE_X11=	yes
 BUILD_DIRS=	${WRKSRC}/unix
 
 MAKEFILE=	Makefile.gtk
diff --git a/security/qca-tls/Makefile b/security/qca-tls/Makefile
index 7041f8f915b..45280ecf711 100644
--- a/security/qca-tls/Makefile
+++ b/security/qca-tls/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.6 2005/05/22 20:08:31 jlam Exp $
+# $NetBSD: Makefile,v 1.7 2005/06/01 18:03:21 jlam Exp $
 
 DISTNAME=	qca-tls-1.0
 PKGREVISION=	# empty
@@ -12,7 +12,6 @@ COMMENT=	Cross-platform crypto API for QT - TLS plugin
 
 USE_TOOLS+=	gmake
 USE_LIBTOOL=	yes
-USE_X11=	yes
 HAS_CONFIGURE=	yes
 
 CONFIGURE_ARGS+=        --with-openssl-inc=${SSLBASE}/include
diff --git a/security/qca/Makefile b/security/qca/Makefile
index d2325185e12..a0f275a3e72 100644
--- a/security/qca/Makefile
+++ b/security/qca/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.3 2005/05/22 20:08:31 jlam Exp $
+# $NetBSD: Makefile,v 1.4 2005/06/01 18:03:21 jlam Exp $
 
 DISTNAME=	qca-1.0
 PKGREVISION=	# empty
@@ -12,7 +12,6 @@ COMMENT=	Cross-platform crypto API for QT
 
 USE_TOOLS+= gmake
 USE_LIBTOOL=	yes
-USE_X11=	yes
 HAS_CONFIGURE=	yes
 
 do-install:
diff --git a/security/seahorse/Makefile b/security/seahorse/Makefile
index 3caed767863..9351ed34d31 100644
--- a/security/seahorse/Makefile
+++ b/security/seahorse/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.37 2005/05/22 20:08:31 jlam Exp $
+# $NetBSD: Makefile,v 1.38 2005/06/01 18:03:21 jlam Exp $
 
 DISTNAME=	seahorse-0.7.8
 CATEGORIES=	security
@@ -17,7 +17,6 @@ USE_DIRS+=		gnome2-1.5
 USE_TOOLS+=		gmake
 USE_LIBTOOL=		yes
 USE_PKGLOCALEDIR=	yes
-USE_X11=		yes
 
 CONFIGURE_ARGS=		--disable-gedit
 
diff --git a/security/skey/builtin.mk b/security/skey/builtin.mk
index 521879bccc9..0430d5cf856 100644
--- a/security/skey/builtin.mk
+++ b/security/skey/builtin.mk
@@ -1,54 +1,61 @@
-# $NetBSD: builtin.mk,v 1.1 2004/04/28 03:35:58 jlam Exp $
+# $NetBSD: builtin.mk,v 1.2 2005/06/01 18:03:21 jlam Exp $
 
-_SKEY_H=	/usr/include/skey.h
+BUILTIN_PKG:=	skey
 
+BUILTIN_FIND_FILES_VAR:=	H_SKEY
+BUILTIN_FIND_FILES.H_SKEY=	/usr/include/skey.h
+
+.include "../../mk/buildlink3/bsd.builtin.mk"
+
+###
+### Determine if there is a built-in implementation of the package and
+### set IS_BUILTIN.<pkg> appropriately ("yes" or "no").
+###
 .if !defined(IS_BUILTIN.skey)
 IS_BUILTIN.skey=	no
-.  if exists(${_SKEY_H})
+.  if empty(H_SKEY:M${LOCALBASE}/*) && exists(${H_SKEY})
 IS_BUILTIN.skey=	yes
+.  endif
+.endif
+MAKEVARS+=	IS_BUILTIN.skey
+
+###
+### If there is a built-in implementation, then set BUILTIN_PKG.<pkg> to
+### a package name to represent the built-in package.
+###
+.if !defined(BUILTIN_PKG.skey) && \
+    !empty(IS_BUILTIN.skey:M[yY][eE][sS) && \
+    exists(${H_SKEY})
 # XXX
 # XXX Consider the native skey to be skey-1.1.5.
 # XXX
 BUILTIN_PKG.skey=	skey-1.1.5
-BUILDLINK_VARS+=	BUILTIN_PKG.skey
-.  endif
-BUILDLINK_VARS+=	IS_BUILTIN.skey
-.endif	# IS_BUILTIN.skey
+.endif
+MAKEVARS+=	BUILTIN_PKG.skey
 
+###
+### Determine whether we should use the built-in implementation if it
+### exists, and set USE_BUILTIN.<pkg> appropriate ("yes" or "no").
+###
 .if !defined(USE_BUILTIN.skey)
-USE_BUILTIN.skey?=	${IS_BUILTIN.skey}
-PREFER.skey?=		pkgsrc
-
-.  if defined(BUILTIN_PKG.skey)
+.  if ${PREFER.skey} == "pkgsrc"
+USE_BUILTIN.skey=	no
+.  else
+USE_BUILTIN.skey=	${IS_BUILTIN.skey}
+.    if defined(BUILTIN_PKG.skey) && \
+        !empty(IS_BUILTIN.skey:M[yY][eE][sS])
 USE_BUILTIN.skey=	yes
-.    for _depend_ in ${BUILDLINK_DEPENDS.skey}
-.      if !empty(USE_BUILTIN.skey:M[yY][eE][sS])
-USE_BUILTIN.skey!=	\
-	if ${PKG_ADMIN} pmatch '${_depend_}' ${BUILTIN_PKG.skey}; then	\
-		${ECHO} "yes";						\
+.      for _dep_ in ${BUILDLINK_DEPENDS.skey}
+.        if !empty(USE_BUILTIN.skey:M[yY][eE][sS])
+USE_BUILTIN.skey!=							\
+	if ${PKG_ADMIN} pmatch ${_dep_:Q} ${BUILTIN_PKG.skey:Q}; then	\
+		${ECHO} yes;						\
 	else								\
-		${ECHO} "no";						\
+		${ECHO} no;						\
 	fi
-.      endif
-.    endfor
-.  endif
-
-.  if ${PREFER.skey} == "native"
-.    if (${OPSYS} == "NetBSD") && exists(${_SKEY_H})
-USE_BUILTIN.skey=	yes
-_INCOMPAT_SKEY?=	# should be set from defs.${OPSYS}.mk
-.      for _pattern_ in ${_INCOMPAT_SKEY} ${INCOMPAT_SKEY}
-.        if !empty(MACHINE_PLATFORM:M${_pattern_})
-USE_BUILTIN.skey=	no
 .        endif
 .      endfor
 .    endif
-.  endif
-
-.  if defined(USE_SKEY)
-.    if !empty(IS_BUILTIN.skey:M[nN][oO]) && \
-        (${PREFER.skey} == "pkgsrc")
-USE_BUILTIN.skey=	no
-.    endif
-.  endif
-.endif	# USE_BUILTIN.skey
+.  endif  # PREFER.skey
+.endif
+MAKEVARS+=	USE_BUILTIN.skey
diff --git a/security/ssh2/Makefile b/security/ssh2/Makefile
index bbe9f3aeae2..5915610855a 100644
--- a/security/ssh2/Makefile
+++ b/security/ssh2/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.10 2004/12/28 02:47:49 reed Exp $
+# $NetBSD: Makefile,v 1.11 2005/06/01 18:03:21 jlam Exp $
 #
 
 PKGNAME=	${DISTNAME:C/ssh-/ssh2-/}
@@ -7,8 +7,8 @@ PKGREVISION=	3
 
 CONFLICTS=	ssh2-nox11-[0-9]*
 
-USE_X11=		YES
 CONFIGURE_ARGS+=	--with-x	# be explicit
 
+.include "../../mk/x11.buildlink3.mk"
 .include "../../security/ssh2/Makefile.common"
 .include "../../mk/bsd.pkg.mk"
diff --git a/security/ssh2/Makefile.common b/security/ssh2/Makefile.common
index 10a8fc4e76e..08a251fbc3f 100644
--- a/security/ssh2/Makefile.common
+++ b/security/ssh2/Makefile.common
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile.common,v 1.12 2005/04/11 21:47:19 tv Exp $
+# $NetBSD: Makefile.common,v 1.13 2005/06/01 18:03:21 jlam Exp $
 #
 
 DISTNAME=	ssh-3.2.9.1
@@ -97,3 +97,4 @@ post-install:
 .endfor
 
 .include "../../security/tcp_wrappers/buildlink3.mk"
+.include "../../mk/x11.buildlink3.mk"
diff --git a/security/tcp_wrappers/builtin.mk b/security/tcp_wrappers/builtin.mk
index f6bf3efd730..d571b5df8e8 100644
--- a/security/tcp_wrappers/builtin.mk
+++ b/security/tcp_wrappers/builtin.mk
@@ -1,11 +1,50 @@
-# $NetBSD: builtin.mk,v 1.5 2005/05/17 21:53:20 gavan Exp $
+# $NetBSD: builtin.mk,v 1.6 2005/06/01 18:03:21 jlam Exp $
 
+BUILTIN_PKG:=	tcp_wrappers
+
+BUILTIN_FIND_LIBS:=			wrap
+BUILTIN_FIND_FILES_VAR:=		H_TCP_WRAPPERS
+BUILTIN_FIND_FILES.H_TCP_WRAPPERS=	/usr/include/tcpd.h
+
+.include "../../mk/buildlink3/bsd.builtin.mk"
+
+###
+### Determine if there is a built-in implementation of the package and
+### set IS_BUILTIN.<pkg> appropriately ("yes" or "no").
+###
 .if !defined(IS_BUILTIN.tcp_wrappers)
 IS_BUILTIN.tcp_wrappers=	no
-.  if exists(/usr/include/tcpd.h) && (exists(/usr/lib${ABI}/libwrap.so) || \
-					exists(/usr/lib${ABI}/libwrap.a))
+.  if empty(H_TCP_WRAPPERS:M${LOCALBASE}/*) && \
+      exists(${H_TCP_WRAPPERS}) && \
+      !empty(BUILTIN_LIB_FOUND.wrap:M[yY][eE][sS])
 IS_BUILTIN.tcp_wrappers=	yes
 .  endif
-.endif	# IS_BUILTIN.tcp_wrappers
+.endif
+MAKEVARS+=	IS_BUILTIN.tcp_wrappers
 
-USE_BUILTIN.tcp_wrappers?=	${IS_BUILTIN.tcp_wrappers}
+###
+### Determine whether we should use the built-in implementation if it
+### exists, and set USE_BUILTIN.<pkg> appropriate ("yes" or "no").
+###
+.if !defined(USE_BUILTIN.tcp_wrappers)
+.  if ${PREFER.tcp_wrappers} == "pkgsrc"
+USE_BUILTIN.tcp_wrappers=	no
+.  else
+USE_BUILTIN.tcp_wrappers=	${IS_BUILTIN.tcp_wrappers}
+.    if defined(BUILTIN_PKG.tcp_wrappers) && \
+        !empty(IS_BUILTIN.tcp_wrappers:M[yY][eE][sS])
+USE_BUILTIN.tcp_wrappers=	yes
+.      for _dep_ in ${BUILDLINK_DEPENDS.tcp_wrappers}
+.        if !empty(USE_BUILTIN.tcp_wrappers:M[yY][eE][sS])
+USE_BUILTIN.tcp_wrappers!=						\
+	if ${PKG_ADMIN} pmatch ${_dep_:Q} ${BUILTIN_PKG.tcp_wrappers:Q}; then \
+		${ECHO} yes;						\
+	else								\
+		${ECHO} no;						\
+	fi
+.        endif
+.      endfor
+.    endif
+.  endif  # PREFER.tcp_wrappers
+.endif
+MAKEVARS+=	USE_BUILTIN.tcp_wrappers