Major SSL/GSSAPI revamp,

[mat]

• Second pass with the kerberos bits.

[mat]

• Add a bit to qa.sh to detect bad linking with OpenSSL, and also detect
• Add a qa bit about kerberos.

[dinoex]

in ssk.mk:

​.if exists(${LOCALBASE}/lib/libcrypto.so.37)

This check fails if an older Version is installed, and will break the update on normal FreeBSD systems.

[mat]

In D5865#125413, @dinoex wrote:

in ssk.mk:

​.if exists(${LOCALBASE}/lib/libcrypto.so.37)

This check fails if an older Version is installed, and will break the update on normal FreeBSD systems.

This is just to help things going, the right way to say "I want this" is to set in your make.conf:

DEFAULT_VERSIONS=    ssl=libressl

[mat]

• Rework the selection of the SSL port to use.

[mat]

Rebase.

[dinoex]

a) I see no way a user can set DEFAULT_VERSIONS to the version from base.
the API for openssl from base and openssl from ports are not compatible.

b) POLA: DEFAULT_VERSIONS should default to openssl from base.

Please check.

[mat]

In D5865#129664, @dinoex wrote:

a) I see no way a user can set DEFAULT_VERSIONS to the version from base.
the API for openssl from base and openssl from ports are not compatible.

b) POLA: DEFAULT_VERSIONS should default to openssl from base.

Please check.

I don't have to check, the goal is to *never* depend on OpenSSL or GSSAPI from base.