rand_unix.c: Ensure requests to KERN_ARND don't exceed 256 bytes.
[openssl.git] / Configure
index 93e7c0b7511b24acbbd98dd79fa8450a29a1dfbf..2e9efaa5f3da8f2ff1bde4c58e4f3b43d9596cdb 100755 (executable)
--- a/Configure
+++ b/Configure
@@ -1,6 +1,6 @@
 #! /usr/bin/env perl
 # -*- mode: perl; -*-
-# Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2016-2020 The OpenSSL Project Authors. All Rights Reserved.
 #
 # Licensed under the OpenSSL license (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
@@ -21,7 +21,10 @@ use OpenSSL::Glob;
 
 # see INSTALL for instructions.
 
-my $usage="Usage: Configure [no-<cipher> ...] [enable-<cipher> ...] [-Dxxx] [-lxxx] [-Lxxx] [-fxxx] [-Kxxx] [no-hw-xxx|no-hw] [[no-]threads] [[no-]shared] [[no-]zlib|zlib-dynamic] [no-asm] [no-dso] [no-egd] [sctp] [386] [--prefix=DIR] [--openssldir=OPENSSLDIR] [--with-xxx[=vvv]] [--config=FILE] os/compiler[:flags]\n";
+my $orig_death_handler = $SIG{__DIE__};
+$SIG{__DIE__} = \&death_handler;
+
+my $usage="Usage: Configure [no-<cipher> ...] [enable-<cipher> ...] [-Dxxx] [-lxxx] [-Lxxx] [-fxxx] [-Kxxx] [no-hw-xxx|no-hw] [[no-]threads] [[no-]shared] [[no-]zlib|zlib-dynamic] [no-asm] [no-egd] [sctp] [386] [--prefix=DIR] [--openssldir=OPENSSLDIR] [--with-xxx[=vvv]] [--config=FILE] os/compiler[:flags]\n";
 
 # Options:
 #
@@ -51,16 +54,14 @@ my $usage="Usage: Configure [no-<cipher> ...] [enable-<cipher> ...] [-Dxxx] [-lx
 # [no-]threads  [don't] try to create a library that is suitable for
 #               multithreaded applications (default is "threads" if we
 #               know how to do it)
-# [no-]shared  [don't] try to create shared libraries when supported.
+# [no-]shared   [don't] try to create shared libraries when supported.
 # [no-]pic      [don't] try to build position independent code when supported.
 #               If disabled, it also disables shared and dynamic-engine.
 # no-asm        do not use assembler
-# no-dso        do not compile in any native shared-library methods. This
-#               will ensure that all methods just return NULL.
 # no-egd        do not compile support for the entropy-gathering daemon APIs
 # [no-]zlib     [don't] compile support for zlib compression.
-# zlib-dynamic Like "zlib", but the zlib library is expected to be a shared
-#              library and will be loaded in run-time by the OpenSSL library.
+# zlib-dynamic  Like "zlib", but the zlib library is expected to be a shared
+#               library and will be loaded in run-time by the OpenSSL library.
 # sctp          include SCTP support
 # enable-weak-ssl-ciphers
 #               Enable weak ciphers that are disabled by default.
@@ -68,11 +69,19 @@ my $usage="Usage: Configure [no-<cipher> ...] [enable-<cipher> ...] [-Dxxx] [-lx
 # no-sse2       disables IA-32 SSE2 code in assembly modules, the above
 #               mentioned '386' option implies this one
 # no-<cipher>   build without specified algorithm (rsa, idea, rc5, ...)
-# -<xxx> +<xxx> compiler options are passed through
+# -<xxx> +<xxx> All options which are unknown to the 'Configure' script are
+# /<xxx>        passed through to the compiler. Unix-style options beginning
+#               with a '-' or '+' are recognized, as well as Windows-style
+#               options beginning with a '/'. If the option contains arguments
+#               separated by spaces, then the URL-style notation %20 can be
+#               used for the space character in order to avoid having to quote
+#               the option. For example, -opt%20arg gets expanded to -opt arg.
+#               In fact, any ASCII character can be encoded as %xx using its
+#               hexadecimal encoding.
 # -static       while -static is also a pass-through compiler option (and
 #               as such is limited to environments where it's actually
 #               meaningful), it triggers a number configuration options,
-#               namely no-dso, no-pic, no-shared and no-threads. It is
+#               namely no-pic, no-shared and no-threads. It is
 #               argued that the only reason to produce statically linked
 #               binaries (and in context it means executables linked with
 #               -static flag, and not just executables linked with static
@@ -86,22 +95,20 @@ my $usage="Usage: Configure [no-<cipher> ...] [enable-<cipher> ...] [-Dxxx] [-lx
 #               linked openssl executable has rather debugging value than
 #               production quality.
 #
-# DEBUG_SAFESTACK use type-safe stacks to enforce type-safety on stack items
-#              provided to stack calls. Generates unique stack functions for
-#              each possible stack type.
-# BN_LLONG     use the type 'long long' in crypto/bn/bn.h
-# RC4_CHAR     use 'char' instead of 'int' for RC4_INT in crypto/rc4/rc4.h
+# BN_LLONG      use the type 'long long' in crypto/bn/bn.h
+# RC4_CHAR      use 'char' instead of 'int' for RC4_INT in crypto/rc4/rc4.h
 # Following are set automatically by this script
 #
-# MD5_ASM      use some extra md5 assembler,
-# SHA1_ASM     use some extra sha1 assembler, must define L_ENDIAN for x86
-# RMD160_ASM   use some extra ripemd160 assembler,
-# SHA256_ASM   sha256_block is implemented in assembler
-# SHA512_ASM   sha512_block is implemented in assembler
-# AES_ASM      AES_[en|de]crypt is implemented in assembler
+# MD5_ASM       use some extra md5 assembler,
+# SHA1_ASM      use some extra sha1 assembler, must define L_ENDIAN for x86
+# RMD160_ASM    use some extra ripemd160 assembler,
+# SHA256_ASM    sha256_block is implemented in assembler
+# SHA512_ASM    sha512_block is implemented in assembler
+# AES_ASM       AES_[en|de]crypt is implemented in assembler
 
-# Minimum warning options... any contributions to OpenSSL should at least get
-# past these.
+# Minimum warning options... any contributions to OpenSSL should at least
+# get past these.  Note that we only use these with C compilers, not with
+# C++ compilers.
 
 # DEBUG_UNUSED enables __owur (warn unused result) checks.
 # -DPEDANTIC complements -pedantic and is meant to mask code that
@@ -116,21 +123,23 @@ my $usage="Usage: Configure [no-<cipher> ...] [enable-<cipher> ...] [-Dxxx] [-lx
 # code, so we just tell compiler to be pedantic about everything
 # but 'long long' type.
 
-my $gcc_devteam_warn = "-DDEBUG_UNUSED"
-        . " -DPEDANTIC -pedantic -Wno-long-long"
-        . " -Wall"
-        . " -Wextra"
-        . " -Wno-unused-parameter"
-        . " -Wno-missing-field-initializers"
-        . " -Wswitch"
-        . " -Wsign-compare"
-        . " -Wmissing-prototypes"
-        . " -Wshadow"
-        . " -Wformat"
-        . " -Wtype-limits"
-        . " -Wundef"
-        . " -Werror"
-        ;
+my @gcc_devteam_warn = qw(
+    -DDEBUG_UNUSED
+    -DPEDANTIC -pedantic -Wno-long-long
+    -Wall
+    -Wextra
+    -Wno-unused-parameter
+    -Wno-missing-field-initializers
+    -Wswitch
+    -Wsign-compare
+    -Wshadow
+    -Wformat
+    -Wtype-limits
+    -Wundef
+    -Werror
+    -Wmissing-prototypes
+    -Wstrict-prototypes
+);
 
 # These are used in addition to $gcc_devteam_warn when the compiler is clang.
 # TODO(openssl-team): fix problems and investigate if (at least) the
@@ -140,16 +149,20 @@ my $gcc_devteam_warn = "-DDEBUG_UNUSED"
 #       -Wlanguage-extension-token -- no, we use asm()
 #       -Wunused-macros -- no, too tricky for BN and _XOPEN_SOURCE etc
 #       -Wextended-offsetof -- no, needed in CMS ASN1 code
-my $clang_devteam_warn = ""
-        . " -Wswitch-default"
-        . " -Wno-parentheses-equality"
-        . " -Wno-language-extension-token"
-        . " -Wno-extended-offsetof"
-        . " -Wconditional-uninitialized"
-        . " -Wincompatible-pointer-types-discards-qualifiers"
-        . " -Wmissing-variable-declarations"
-        . " -Wno-unknown-warning-option"
-        ;
+my @clang_devteam_warn = qw(
+    -Wno-unknown-warning-option
+    -Wswitch-default
+    -Wno-parentheses-equality
+    -Wno-language-extension-token
+    -Wno-extended-offsetof
+    -Wconditional-uninitialized
+    -Wincompatible-pointer-types-discards-qualifiers
+    -Wmissing-variable-declarations
+);
+
+my @cl_devteam_warn = qw(
+    /WX
+);
 
 # This adds backtrace information to the memory leak info.  Is only used
 # when crypto-mdebug-backtrace is enabled.
@@ -179,6 +192,10 @@ my $apitable = {
 our %table = ();
 our %config = ();
 our %withargs = ();
+our $now_printing;      # set to current entry's name in print_table_entry
+                        # (todo: right thing would be to encapsulate name
+                        # into %target [class] and make print_table_entry
+                        # a method)
 
 # Forward declarations ###############################################
 
@@ -214,20 +231,20 @@ if (grep /^reconf(igure)?$/, @argvcopy) {
     die "reconfiguring with other arguments present isn't supported"
         if scalar @argvcopy > 1;
     if (-f "./configdata.pm") {
-       my $file = "./configdata.pm";
-       unless (my $return = do $file) {
-           die "couldn't parse $file: $@" if $@;
+        my $file = "./configdata.pm";
+        unless (my $return = do $file) {
+            die "couldn't parse $file: $@" if $@;
             die "couldn't do $file: $!"    unless defined $return;
             die "couldn't run $file"       unless $return;
-       }
+        }
 
-       @argvcopy = defined($configdata::config{perlargv}) ?
-           @{$configdata::config{perlargv}} : ();
-       die "Incorrect data to reconfigure, please do a normal configuration\n"
-           if (grep(/^reconf/,@argvcopy));
-       $config{perlenv} = $configdata::config{perlenv} // {};
+        @argvcopy = defined($configdata::config{perlargv}) ?
+            @{$configdata::config{perlargv}} : ();
+        die "Incorrect data to reconfigure, please do a normal configuration\n"
+            if (grep(/^reconf/,@argvcopy));
+        $config{perlenv} = $configdata::config{perlenv} // {};
     } else {
-       die "Insufficient data to reconfigure, please do a normal configuration\n";
+        die "Insufficient data to reconfigure, please do a normal configuration\n";
     }
 }
 
@@ -242,8 +259,8 @@ $config{shlib_version_history} = "unknown";
 collect_information(
     collect_from_file(catfile($srcdir,'include/openssl/opensslv.h')),
     qr/OPENSSL.VERSION.TEXT.*OpenSSL (\S+) / => sub { $config{version} = $1; },
-    qr/OPENSSL.VERSION.NUMBER.*(0x\S+)/             => sub { $config{version_num}=$1 },
-    qr/SHLIB_VERSION_NUMBER *"([^"]+)"/             => sub { $config{shlib_version_number}=$1 },
+    qr/OPENSSL.VERSION.NUMBER.*(0x\S+)/      => sub { $config{version_num}=$1 },
+    qr/SHLIB_VERSION_NUMBER *"([^"]+)"/      => sub { $config{shlib_version_number}=$1 },
     qr/SHLIB_VERSION_HISTORY *"([^"]*)"/     => sub { $config{shlib_version_history}=$1 }
     );
 if ($config{shlib_version_history} ne "") { $config{shlib_version_history} .= ":"; }
@@ -255,7 +272,7 @@ if ($config{shlib_version_history} ne "") { $config{shlib_version_history} .= ":
 die "erroneous version information in opensslv.h: ",
     "$config{major}, $config{minor}, $config{shlib_major}, $config{shlib_minor}\n"
     if ($config{major} eq "" || $config{minor} eq ""
-       || $config{shlib_major} eq "" ||  $config{shlib_minor} eq "");
+        || $config{shlib_major} eq "" ||  $config{shlib_minor} eq "");
 
 # Collect target configurations
 
@@ -297,7 +314,7 @@ $config{sdirs} = [
     "objects",
     "md2", "md4", "md5", "sha", "mdc2", "hmac", "ripemd", "whrlpool", "poly1305", "blake2", "siphash", "sm3",
     "des", "aes", "rc2", "rc4", "rc5", "idea", "aria", "bf", "cast", "camellia", "seed", "sm4", "chacha", "modes",
-    "bn", "ec", "rsa", "dsa", "dh", "dso", "engine",
+    "bn", "ec", "rsa", "dsa", "dh", "sm2", "dso", "engine",
     "buffer", "bio", "stack", "lhash", "rand", "err",
     "evp", "asn1", "pem", "x509", "x509v3", "conf", "txt_db", "pkcs7", "pkcs12", "comp", "ocsp", "ui",
     "cms", "ts", "srp", "cmac", "ct", "async", "kdf", "store"
@@ -321,8 +338,10 @@ my @disablables = (
     "async",
     "autoalginit",
     "autoerrinit",
+    "autoload-config",
     "bf",
     "blake2",
+    "buildtest-c\\+\\+",
     "camellia",
     "capieng",
     "cast",
@@ -365,6 +384,7 @@ my @disablables = (
     "msan",
     "multiblock",
     "nextprotoneg",
+    "pinshared",
     "ocb",
     "ocsp",
     "pic",
@@ -382,6 +402,7 @@ my @disablables = (
     "seed",
     "shared",
     "siphash",
+    "sm2",
     "sm3",
     "sm4",
     "sock",
@@ -395,7 +416,6 @@ my @disablables = (
     "tests",
     "threads",
     "tls",
-    "tls13downgrade",
     "ts",
     "ubsan",
     "ui-console",
@@ -406,10 +426,10 @@ my @disablables = (
     "zlib-dynamic",
     );
 foreach my $proto ((@tls, @dtls))
-       {
-       push(@disablables, $proto);
-       push(@disablables, "$proto-method") unless $proto eq "tls1_3";
-       }
+        {
+        push(@disablables, $proto);
+        push(@disablables, "$proto-method") unless $proto eq "tls1_3";
+        }
 
 my %deprecated_disablables = (
     "ssl2" => undef,
@@ -418,63 +438,61 @@ my %deprecated_disablables = (
     "ui" => "ui-console",
     );
 
-# All of the following is disabled by default (RC5 was enabled before 0.9.8):
+# All of the following are disabled by default:
 
 our %disabled = ( # "what"         => "comment"
-                  "asan"               => "default",
-                 "crypto-mdebug"       => "default",
-                 "crypto-mdebug-backtrace" => "default",
-                 "devcryptoeng"        => "default",
-                 "ec_nistp_64_gcc_128" => "default",
-                 "egd"                 => "default",
-                 "external-tests"      => "default",
-                 "fuzz-libfuzzer"      => "default",
-                 "fuzz-afl"            => "default",
-                 "heartbeats"          => "default",
-                 "md2"                 => "default",
+                  "asan"                => "default",
+                  "buildtest-c++"       => "default",
+                  "crypto-mdebug"       => "default",
+                  "crypto-mdebug-backtrace" => "default",
+                  "devcryptoeng"        => "default",
+                  "ec_nistp_64_gcc_128" => "default",
+                  "egd"                 => "default",
+                  "external-tests"      => "default",
+                  "fuzz-libfuzzer"      => "default",
+                  "fuzz-afl"            => "default",
+                  "heartbeats"          => "default",
+                  "md2"                 => "default",
                   "msan"                => "default",
-                 "rc5"                 => "default",
-                 "sctp"                => "default",
-                 "ssl-trace"           => "default",
-                 "ssl3"                => "default",
-                 "ssl3-method"         => "default",
-                  "ubsan"              => "default",
-                 "tls13downgrade"      => "default",
-                 "unit-test"           => "default",
-                 "weak-ssl-ciphers"    => "default",
-                 "zlib"                => "default",
-                 "zlib-dynamic"        => "default",
-               );
+                  "rc5"                 => "default",
+                  "sctp"                => "default",
+                  "ssl-trace"           => "default",
+                  "ssl3"                => "default",
+                  "ssl3-method"         => "default",
+                  "ubsan"               => "default",
+                  "unit-test"           => "default",
+                  "weak-ssl-ciphers"    => "default",
+                  "zlib"                => "default",
+                  "zlib-dynamic"        => "default",
+                );
 
 # Note: => pair form used for aesthetics, not to truly make a hash table
 my @disable_cascades = (
-    # "what"           => [ "cascade", ... ]
+    # "what"            => [ "cascade", ... ]
     sub { $config{processor} eq "386" }
-                       => [ "sse2" ],
-    "ssl"              => [ "ssl3" ],
-    "ssl3-method"      => [ "ssl3" ],
-    "zlib"             => [ "zlib-dynamic" ],
-    "des"              => [ "mdc2" ],
-    "ec"               => [ "ecdsa", "ecdh" ],
-
-    "dgram"            => [ "dtls", "sctp" ],
-    "sock"             => [ "dgram" ],
-    "dtls"             => [ @dtls ],
+                        => [ "sse2" ],
+    "ssl"               => [ "ssl3" ],
+    "ssl3-method"       => [ "ssl3" ],
+    "zlib"              => [ "zlib-dynamic" ],
+    "des"               => [ "mdc2" ],
+    "ec"                => [ "ecdsa", "ecdh" ],
+
+    "dgram"             => [ "dtls", "sctp" ],
+    "sock"              => [ "dgram" ],
+    "dtls"              => [ @dtls ],
     sub { 0 == scalar grep { !$disabled{$_} } @dtls }
-                       => [ "dtls" ],
+                        => [ "dtls" ],
 
-    "tls"              => [ @tls ],
+    "tls"               => [ @tls ],
     sub { 0 == scalar grep { !$disabled{$_} } @tls }
-                       => [ "tls" ],
+                        => [ "tls" ],
 
     "crypto-mdebug"     => [ "crypto-mdebug-backtrace" ],
 
-    # Without DSO, we can't load dynamic engines, so don't build them dynamic
-    "dso"               => [ "dynamic-engine" ],
-
     # Without position independent code, there can be no shared libraries or DSOs
     "pic"               => [ "shared" ],
     "shared"            => [ "dynamic-engine" ],
+    "dso"               => [ "dynamic-engine" ],
     "engine"            => [ "afalgeng", "devcryptoeng" ],
 
     # no-autoalginit is only useful when building non-shared
@@ -484,7 +502,8 @@ my @disable_cascades = (
     "apps"              => [ "tests" ],
     "tests"             => [ "external-tests" ],
     "comp"              => [ "zlib" ],
-    "ec"                => [ "tls1_3" ],
+    "ec"                => [ "tls1_3", "sm2" ],
+    "sm3"               => [ "sm2" ],
     sub { !$disabled{"unit-test"} } => [ "heartbeats" ],
 
     sub { !$disabled{"msan"} } => [ "asm" ],
@@ -497,14 +516,14 @@ my @list = (reverse @tls);
 while ((my $first, my $second) = (shift @list, shift @list)) {
     last unless @list;
     push @disable_cascades, ( sub { !$disabled{$first} && $disabled{$second} }
-                             => [ @list ] );
+                              => [ @list ] );
     unshift @list, $second;
 }
 my @list = (reverse @dtls);
 while ((my $first, my $second) = (shift @list, shift @list)) {
     last unless @list;
     push @disable_cascades, ( sub { !$disabled{$first} && $disabled{$second} }
-                             => [ @list ] );
+                              => [ @list ] );
     unshift @list, $second;
 }
 
@@ -514,7 +533,7 @@ while ((my $first, my $second) = (shift @list, shift @list)) {
 
 &usage if ($#ARGV < 0);
 
-# For the "make variables" CINCLUDES and CDEFINES, we support lists with
+# For the "make variables" CPPINCLUDES and CPPDEFINES, we support lists with
 # platform specific list separators.  Users from those platforms should
 # recognise those separators from how you set up the PATH to find executables.
 # The default is the Unix like separator, :, but as an exception, we also
@@ -523,29 +542,32 @@ my $list_separator_re =
     { VMS           => qr/(?<!\^),/,
       MSWin32       => qr/(?<!\\);/ } -> {$^O} // qr/(?<!\\)[:\s]/;
 # All the "make variables" we support
+# Some get pre-populated for the sake of backward compatibility
+# (we supported those before the change to "make variable" support.
 my %user = (
-    AR          => undef,
+    AR          => env('AR'),
     ARFLAGS     => [],
     AS          => undef,
     ASFLAGS     => [],
-    CC          => undef,
-    CFLAGS      => [],
-    CXX         => undef,
-    CXXFLAGS    => [],
+    CC          => env('CC'),
+    CFLAGS      => [ env('CFLAGS') || () ],
+    CXX         => env('CXX'),
+    CXXFLAGS    => [ env('CXXFLAGS') || () ],
     CPP         => undef,
-    CPPFLAGS    => [],  # -D, -I, -Wp,
+    CPPFLAGS    => [ env('CPPFLAGS') || () ],  # -D, -I, -Wp,
     CPPDEFINES  => [],  # Alternative for -D
     CPPINCLUDES => [],  # Alternative for -I
-    CROSS_COMPILE => undef,
-    HASHBANGPERL=> undef,
+    CROSS_COMPILE => env('CROSS_COMPILE'),
+    HASHBANGPERL=> env('HASHBANGPERL') || env('PERL'),
     LD          => undef,
-    LDFLAGS     => [],  # -L, -Wl,
-    LDLIBS      => [],  # -l
+    LDFLAGS     => [ env('LDFLAGS') || () ],  # -L, -Wl,
+    LDLIBS      => [ env('LDLIBS') || () ],  # -l
     MT          => undef,
     MTFLAGS     => [],
-    RANLIB      => undef,
-    RC          => undef,
-    RCFLAGS     => [],
+    PERL        => env('PERL') || ($^O ne "VMS" ? $^X : "perl"),
+    RANLIB      => env('RANLIB'),
+    RC          => env('RC') || env('WINDRES'),
+    RCFLAGS     => [ env('RCFLAGS') || () ],
     RM          => undef,
    );
 # Info about what "make variables" may be prefixed with the cross compiler
@@ -562,21 +584,38 @@ my %useradd = (
     CXXFLAGS    => [],
     LDFLAGS     => [],
     LDLIBS      => [],
+    RCFLAGS     => [],
    );
 
 my %user_synonyms = (
     HASHBANGPERL=> 'PERL',
     RC          => 'WINDRES',
    );
-my %user_to_target = (
-    # If not given here, the value is the lc of the key
-    CPPDEFINES  => 'defines',
-    CPPINCLUDES => 'includes',
-    CROSS_COMPILE => 'cross_compile_prefix',
-    LDFLAGS     => 'lflags',
-    LDLIBS      => 'ex_libs',
+
+# Some target attributes have been renamed, this is the translation table
+my %target_attr_translate =(
+    ar          => 'AR',
+    as          => 'AS',
+    cc          => 'CC',
+    cxx         => 'CXX',
+    cpp         => 'CPP',
+    hashbangperl => 'HASHBANGPERL',
+    ld          => 'LD',
+    mt          => 'MT',
+    ranlib      => 'RANLIB',
+    rc          => 'RC',
+    rm          => 'RM',
    );
 
+# Initialisers coming from 'config' scripts
+$config{defines} = [ split(/$list_separator_re/, env('__CNF_CPPDEFINES')) ];
+$config{includes} = [ split(/$list_separator_re/, env('__CNF_CPPINCLUDES')) ];
+$config{cppflags} = [ env('__CNF_CPPFLAGS') || () ];
+$config{cflags} = [ env('__CNF_CFLAGS') || () ];
+$config{cxxflags} = [ env('__CNF_CXXFLAGS') || () ];
+$config{lflags} = [ env('__CNF_LDFLAGS') || () ];
+$config{ex_libs} = [ env('__CNF_LDLIBS') || () ];
+
 $config{openssl_api_defines}=[];
 $config{openssl_algorithm_defines}=[];
 $config{openssl_thread_defines}=[];
@@ -586,47 +625,50 @@ $config{options}="";
 $config{build_type} = "release";
 my $target="";
 
+my %cmdvars = ();               # Stores FOO='blah' type arguments
 my %unsupported_options = ();
 my %deprecated_options = ();
 # If you change this, update apps/version.c
 my @known_seed_sources = qw(getrandom devrandom os egd none rdcpu librandom);
 my @seed_sources = ();
 while (@argvcopy)
-       {
-       $_ = shift @argvcopy;
-
-       # Support env variable assignments among the options
-       if (m|^(\w+)=(.+)?$|)
-               {
-               $config{perlenv}->{$1} = $2;
-               # Every time a variable is given as a configuration argument,
-               # it acts as a reset if the variable.
-               if (exists $user{$1})
-                       {
-                       $user{$1} = ref $user{$1} eq "ARRAY" ? [] : undef;
-                       }
-               if (exists $useradd{$1})
-                       {
-                       $useradd{$1} = [];
-                       }
-               next;
-               }
-
-       # VMS is a case insensitive environment, and depending on settings
-       # out of our control, we may receive options uppercased.  Let's
-       # downcase at least the part before any equal sign.
-       if ($^O eq "VMS")
-               {
-               s/^([^=]*)/lc($1)/e;
-               }
-       s /^-no-/no-/; # some people just can't read the instructions
-
-       # rewrite some options in "enable-..." form
-       s /^-?-?shared$/enable-shared/;
-       s /^sctp$/enable-sctp/;
-       s /^threads$/enable-threads/;
-       s /^zlib$/enable-zlib/;
-       s /^zlib-dynamic$/enable-zlib-dynamic/;
+        {
+        $_ = shift @argvcopy;
+
+        # Support env variable assignments among the options
+        if (m|^(\w+)=(.+)?$|)
+                {
+                $cmdvars{$1} = $2;
+                # Every time a variable is given as a configuration argument,
+                # it acts as a reset if the variable.
+                if (exists $user{$1})
+                        {
+                        $user{$1} = ref $user{$1} eq "ARRAY" ? [] : undef;
+                        }
+                #if (exists $useradd{$1})
+                #       {
+                #       $useradd{$1} = [];
+                #       }
+                next;
+                }
+
+        # VMS is a case insensitive environment, and depending on settings
+        # out of our control, we may receive options uppercased.  Let's
+        # downcase at least the part before any equal sign.
+        if ($^O eq "VMS")
+                {
+                s/^([^=]*)/lc($1)/e;
+                }
+
+        # some people just can't read the instructions, clang people have to...
+        s/^-no-(?!integrated-as)/no-/;
+
+        # rewrite some options in "enable-..." form
+        s /^-?-?shared$/enable-shared/;
+        s /^sctp$/enable-sctp/;
+        s /^threads$/enable-threads/;
+        s /^zlib$/enable-zlib/;
+        s /^zlib-dynamic$/enable-zlib-dynamic/;
 
         if (/^(no|disable|enable)-(.+)$/)
                 {
@@ -680,21 +722,24 @@ while (@argvcopy)
                         }
                 elsif (exists $deprecated_disablables{$1})
                         {
-                        $deprecated_options{$_} = 1;
-                        if (defined $deprecated_disablables{$1})
+                        if ($deprecated_disablables{$1} ne "")
                                 {
-                                $disabled{$deprecated_disablables{$1}} = "option";
+                                $deprecated_options{$_} = 1;
+                                if (defined $deprecated_disablables{$1})
+                                        {
+                                        $disabled{$deprecated_disablables{$1}} = "option";
+                                        }
                                 }
                         }
                 else
                         {
                         $disabled{$1} = "option";
                         }
-               # No longer an automatic choice
-               $auto_threads = 0 if ($1 eq "threads");
-               }
-       elsif (/^enable-(.+)$/)
-               {
+                # No longer an automatic choice
+                $auto_threads = 0 if ($1 eq "threads");
+                }
+        elsif (/^enable-(.+)$/)
+                {
                 if ($1 eq "static-engine")
                         {
                         $disabled{"dynamic-engine"} = "option";
@@ -707,221 +752,283 @@ while (@argvcopy)
                         {
                         delete $disabled{"zlib"};
                         }
-               my $algo = $1;
-               delete $disabled{$algo};
-
-               # No longer an automatic choice
-               $auto_threads = 0 if ($1 eq "threads");
-               }
-       elsif (/^--strict-warnings$/)
-               {
-               $strict_warnings = 1;
-               }
-       elsif (/^--debug$/)
-               {
-               $config{build_type} = "debug";
-               }
-       elsif (/^--release$/)
-               {
-               $config{build_type} = "release";
-               }
-       elsif (/^386$/)
-               { $config{processor}=386; }
-       elsif (/^fips$/)
-               {
-               die "FIPS mode not supported\n";
-               }
-       elsif (/^rsaref$/)
-               {
-               # No RSAref support any more since it's not needed.
-               # The check for the option is there so scripts aren't
-               # broken
-               }
-       elsif (/^nofipscanistercheck$/)
-               {
-               die "FIPS mode not supported\n";
-               }
-       elsif (/^[-+]/)
-               {
-               if (/^--prefix=(.*)$/)
-                       {
-                       $config{prefix}=$1;
-                       die "Directory given with --prefix MUST be absolute\n"
-                               unless file_name_is_absolute($config{prefix});
-                       }
-               elsif (/^--api=(.*)$/)
-                       {
-                       $config{api}=$1;
-                       }
-               elsif (/^--libdir=(.*)$/)
-                       {
-                       $config{libdir}=$1;
-                       }
-               elsif (/^--openssldir=(.*)$/)
-                       {
-                       $config{openssldir}=$1;
-                       }
-               elsif (/^--with-zlib-lib=(.*)$/)
-                       {
-                       $withargs{zlib_lib}=$1;
-                       }
-               elsif (/^--with-zlib-include=(.*)$/)
-                       {
-                       $withargs{zlib_include}=$1;
-                       }
-               elsif (/^--with-fuzzer-lib=(.*)$/)
-                       {
-                       $withargs{fuzzer_lib}=$1;
-                       }
-               elsif (/^--with-fuzzer-include=(.*)$/)
-                       {
-                       $withargs{fuzzer_include}=$1;
-                       }
-               elsif (/^--with-rand-seed=(.*)$/)
-                       {
-                       foreach my $x (split(m|,|, $1))
-                           {
-                           die "Unknown --with-rand-seed choice $x\n"
-                               if ! grep { $x eq $_ } @known_seed_sources;
-                           push @seed_sources, $x;
-                           }
+                my $algo = $1;
+                delete $disabled{$algo};
+
+                # No longer an automatic choice
+                $auto_threads = 0 if ($1 eq "threads");
+                }
+        elsif (/^--strict-warnings$/)
+                {
+                # Pretend that our strict flags is a C flag, and replace it
+                # with the proper flags later on
+                push @{$useradd{CFLAGS}}, '--ossl-strict-warnings';
+                $strict_warnings=1;
+                }
+        elsif (/^--debug$/)
+                {
+                $config{build_type} = "debug";
+                }
+        elsif (/^--release$/)
+                {
+                $config{build_type} = "release";
+                }
+        elsif (/^386$/)
+                { $config{processor}=386; }
+        elsif (/^fips$/)
+                {
+                die "FIPS mode not supported\n";
+                }
+        elsif (/^rsaref$/)
+                {
+                # No RSAref support any more since it's not needed.
+                # The check for the option is there so scripts aren't
+                # broken
+                }
+        elsif (/^nofipscanistercheck$/)
+                {
+                die "FIPS mode not supported\n";
+                }
+        elsif (m|^[-+/]|)
+                {
+                if (/^--prefix=(.*)$/)
+                        {
+                        $config{prefix}=$1;
+                        die "Directory given with --prefix MUST be absolute\n"
+                                unless file_name_is_absolute($config{prefix});
+                        }
+                elsif (/^--api=(.*)$/)
+                        {
+                        $config{api}=$1;
+                        }
+                elsif (/^--libdir=(.*)$/)
+                        {
+                        $config{libdir}=$1;
+                        }
+                elsif (/^--openssldir=(.*)$/)
+                        {
+                        $config{openssldir}=$1;
+                        }
+                elsif (/^--with-zlib-lib=(.*)$/)
+                        {
+                        $withargs{zlib_lib}=$1;
+                        }
+                elsif (/^--with-zlib-include=(.*)$/)
+                        {
+                        $withargs{zlib_include}=$1;
+                        }
+                elsif (/^--with-fuzzer-lib=(.*)$/)
+                        {
+                        $withargs{fuzzer_lib}=$1;
+                        }
+                elsif (/^--with-fuzzer-include=(.*)$/)
+                        {
+                        $withargs{fuzzer_include}=$1;
+                        }
+                elsif (/^--with-rand-seed=(.*)$/)
+                        {
+                        foreach my $x (split(m|,|, $1))
+                            {
+                            die "Unknown --with-rand-seed choice $x\n"
+                                if ! grep { $x eq $_ } @known_seed_sources;
+                            push @seed_sources, $x;
+                            }
+                        }
+                elsif (/^--cross-compile-prefix=(.*)$/)
+                        {
+                        $user{CROSS_COMPILE}=$1;
+                        }
+                elsif (/^--config=(.*)$/)
+                        {
+                        read_config $1;
+                        }
+                elsif (/^-l(.*)$/)
+                        {
+                        push @{$useradd{LDLIBS}}, $_;
+                        }
+                elsif (/^-framework$/)
+                        {
+                        push @{$useradd{LDLIBS}}, $_, shift(@argvcopy);
+                        }
+                elsif (/^-L(.*)$/ or /^-Wl,/)
+                        {
+                        push @{$useradd{LDFLAGS}}, $_;
+                        }
+                elsif (/^-rpath$/ or /^-R$/)
+                        # -rpath is the OSF1 rpath flag
+                        # -R is the old Solaris rpath flag
+                        {
+                        my $rpath = shift(@argvcopy) || "";
+                        $rpath .= " " if $rpath ne "";
+                        push @{$useradd{LDFLAGS}}, $_, $rpath;
+                        }
+                elsif (/^-static$/)
+                        {
+                        push @{$useradd{LDFLAGS}}, $_;
+                        }
+                elsif (m|^[-/]D(.*)$|)
+                        {
+                        push @{$useradd{CPPDEFINES}}, $1;
+                        }
+                elsif (m|^[-/]I(.*)$|)
+                        {
+                        push @{$useradd{CPPINCLUDES}}, $1;
+                        }
+                elsif (/^-Wp,$/)
+                        {
+                        push @{$useradd{CPPFLAGS}}, $1;
                         }
-               elsif (/^--cross-compile-prefix=(.*)$/)
-                       {
-                       $user{CROSS_COMPILE}=$1;
-                       }
-               elsif (/^--config=(.*)$/)
-                       {
-                       read_config $1;
-                       }
-               elsif (/^-L(.*)$/)
-                       {
-                       push @{$useradd{LDFLAGS}}, $_;
-                       }
-               elsif (/^-l(.*)$/ or /^-Wl,/)
-                       {
-                       push @{$useradd{LDLIBS}}, $_;
-                       }
-               elsif (/^-framework$/)
-                       {
-                       push @{$useradd{LDLIBS}}, $_, shift(@argvcopy);
-                       }
-               elsif (/^-rpath$/ or /^-R$/)
-                       # -rpath is the OSF1 rpath flag
-                       # -R is the old Solaris rpath flag
-                       {
-                       my $rpath = shift(@argvcopy) || "";
-                       $rpath .= " " if $rpath ne "";
-                       push @{$useradd{LDFLAGS}}, $_, $rpath;
-                       }
-               elsif (/^-static$/)
-                       {
-                       push @{$useradd{LDFLAGS}}, $_;
-                       $disabled{"dso"} = "forced";
-                       $disabled{"pic"} = "forced";
-                       $disabled{"shared"} = "forced";
-                       $disabled{"threads"} = "forced";
-                       }
-               elsif (/^-D(.*)$/)
-                       {
-                       push @{$useradd{CPPDEFINES}}, $1;
-                       }
-               elsif (/^-I(.*)$/)
-                       {
-                       push @{$useradd{CPPINCLUDES}}, $1;
-                       }
-               elsif (/^-Wp,$/)
-                       {
-                       push @{$useradd{CPPFLAGS}}, $1;
-                       }
-               else    # common if (/^[-+]/), just pass down...
-                       {
-                       $_ =~ s/%([0-9a-f]{1,2})/chr(hex($1))/gei;
-                       push @{$useradd{CFLAGS}}, $_;
-                       push @{$useradd{CXXFLAGS}}, $_;
-                       }
-               }
-       else
-               {
-               die "target already defined - $target (offending arg: $_)\n" if ($target ne "");
-               $target=$_;
-               }
-       unless ($_ eq $target || /^no-/ || /^disable-/)
-               {
-               # "no-..." follows later after implied deactivations
-               # have been derived.  (Don't take this too seriously,
-               # we really only write OPTIONS to the Makefile out of
-               # nostalgia.)
-
-               if ($config{options} eq "")
-                       { $config{options} = $_; }
-               else
-                       { $config{options} .= " ".$_; }
-               }
-
-        if (defined($config{api}) && !exists $apitable->{$config{api}}) {
-               die "***** Unsupported api compatibility level: $config{api}\n",
-        }
-
-       if (keys %deprecated_options)
-               {
-               warn "***** Deprecated options: ",
-                       join(", ", keys %deprecated_options), "\n";
-               }
-       if (keys %unsupported_options)
-               {
-               die "***** Unsupported options: ",
-                       join(", ", keys %unsupported_options), "\n";
-               }
-       }
+                else    # common if (/^[-+]/), just pass down...
+                        {
+                        # Treat %xx as an ASCII code (e.g. replace %20 by a space character).
+                        # This provides a simple way to pass options with arguments separated
+                        # by spaces without quoting (e.g. -opt%20arg translates to -opt arg).
+                        $_ =~ s/%([0-9a-f]{1,2})/chr(hex($1))/gei;
+                        push @{$useradd{CFLAGS}}, $_;
+                        push @{$useradd{CXXFLAGS}}, $_;
+                        }
+                }
+        elsif (m|^/|)
+                {
+                # Treat %xx as an ASCII code (e.g. replace %20 by a space character).
+                # This provides a simple way to pass options with arguments separated
+                # by spaces without quoting (e.g. /opt%20arg translates to /opt arg).
+                $_ =~ s/%([0-9a-f]{1,2})/chr(hex($1))/gei;
+                push @{$useradd{CFLAGS}}, $_;
+                push @{$useradd{CXXFLAGS}}, $_;
+                }
+        else
+                {
+                die "target already defined - $target (offending arg: $_)\n" if ($target ne "");
+                $target=$_;
+                }
+        unless ($_ eq $target || /^no-/ || /^disable-/)
+                {
+                # "no-..." follows later after implied deactivations
+                # have been derived.  (Don't take this too seriously,
+                # we really only write OPTIONS to the Makefile out of
+                # nostalgia.)
+
+                if ($config{options} eq "")
+                        { $config{options} = $_; }
+                else
+                        { $config{options} .= " ".$_; }
+                }
+        }
 
+if (defined($config{api}) && !exists $apitable->{$config{api}}) {
+        die "***** Unsupported api compatibility level: $config{api}\n",
+}
+
+if (keys %deprecated_options)
+        {
+        warn "***** Deprecated options: ",
+                join(", ", keys %deprecated_options), "\n";
+        }
+if (keys %unsupported_options)
+        {
+        die "***** Unsupported options: ",
+                join(", ", keys %unsupported_options), "\n";
+        }
+
+# If any %useradd entry has been set, we must check that the "make
+# variables" haven't been set.  We start by checking of any %useradd entry
+# is set.
+if (grep { scalar @$_ > 0 } values %useradd) {
+    # Hash of env / make variables names.  The possible values are:
+    # 1 - "make vars"
+    # 2 - %useradd entry set
+    # 3 - both set
+    my %detected_vars =
+        map { my $v = 0;
+              $v += 1 if $cmdvars{$_};
+              $v += 2 if @{$useradd{$_}};
+              $_ => $v }
+        keys %useradd;
+
+    # If any of the corresponding "make variables" is set, we error
+    if (grep { $_ & 1 } values %detected_vars) {
+        my $names = join(', ', grep { $detected_vars{$_} > 0 }
+                               sort keys %detected_vars);
+        die <<"_____";
+***** Mixing make variables and additional compiler/linker flags as
+***** configure command line option is not permitted.
+***** Affected make variables: $names
+_____
+    }
+}
+
+# Check through all supported command line variables to see if any of them
+# were set, and canonicalise the values we got.  If no compiler or linker
+# flag or anything else that affects %useradd was set, we also check the
+# environment for values.
+my $anyuseradd =
+    grep { defined $_ && (ref $_ ne 'ARRAY' || @$_) } values %useradd;
 foreach (keys %user) {
-    my $value = env($_);
-    $value //= defined $user_synonyms{$_} ? env($user_synonyms{$_}) : undef;
+    my $value = $cmdvars{$_};
+    $value //= env($_) unless $anyuseradd;
+    $value //=
+        defined $user_synonyms{$_} ? $cmdvars{$user_synonyms{$_}} : undef;
+    $value //= defined $user_synonyms{$_} ? env($user_synonyms{$_}) : undef
+        unless $anyuseradd;
 
     if (defined $value) {
         if (ref $user{$_} eq 'ARRAY') {
-            $user{$_} = [ split /$list_separator_re/, $value ];
+            if ($_ eq 'CPPDEFINES' || $_ eq 'CPPINCLUDES') {
+                $user{$_} = [ split /$list_separator_re/, $value ];
+            } else {
+                $user{$_} = [ $value ];
+            }
         } elsif (!defined $user{$_}) {
             $user{$_} = $value;
         }
     }
 }
 
-if (grep { $_ =~ /(^|\s)-Wl,-rpath,/ } ($user{LDLIBS} ? @{$user{LDLIBS}} : ())
+if (grep { /-rpath\b/ } ($user{LDFLAGS} ? @{$user{LDFLAGS}} : ())
     && !$disabled{shared}
     && !($disabled{asan} && $disabled{msan} && $disabled{ubsan})) {
     die "***** Cannot simultaneously use -rpath, shared libraries, and\n",
-       "***** any of asan, msan or ubsan\n";
+        "***** any of asan, msan or ubsan\n";
 }
 
-my @tocheckfor = (keys %disabled);
-while (@tocheckfor) {
-    my %new_tocheckfor = ();
-    my @cascade_copy = (@disable_cascades);
-    while (@cascade_copy) {
-       my ($test, $descendents) = (shift @cascade_copy, shift @cascade_copy);
-       if (ref($test) eq "CODE" ? $test->() : defined($disabled{$test})) {
-           foreach(grep { !defined($disabled{$_}) } @$descendents) {
-               $new_tocheckfor{$_} = 1; $disabled{$_} = "forced";
-           }
-       }
+sub disable {
+    my $disable_type = shift;
+
+    for (@_) {
+        $disabled{$_} = $disable_type;
+    }
+
+    my @tocheckfor = (@_ ? @_ : keys %disabled);
+    while (@tocheckfor) {
+        my %new_tocheckfor = ();
+        my @cascade_copy = (@disable_cascades);
+        while (@cascade_copy) {
+            my ($test, $descendents) =
+                (shift @cascade_copy, shift @cascade_copy);
+            if (ref($test) eq "CODE" ? $test->() : defined($disabled{$test})) {
+                foreach (grep { !defined($disabled{$_}) } @$descendents) {
+                    $new_tocheckfor{$_} = 1; $disabled{$_} = "cascade";
+                }
+            }
+        }
+        @tocheckfor = (keys %new_tocheckfor);
     }
-    @tocheckfor = (keys %new_tocheckfor);
 }
+disable();                     # First cascade run
 
 our $die = sub { die @_; };
 if ($target eq "TABLE") {
     local $die = sub { warn @_; };
     foreach (sort keys %table) {
-       print_table_entry($_, "TABLE");
+        print_table_entry($_, "TABLE");
     }
     exit 0;
 }
 
 if ($target eq "LIST") {
     foreach (sort keys %table) {
-       print $_,"\n" unless $table{$_}->{template};
+        print $_,"\n" unless $table{$_}->{template};
     }
     exit 0;
 }
@@ -930,7 +1037,7 @@ if ($target eq "HASH") {
     local $die = sub { warn @_; };
     print "%table = (\n";
     foreach (sort keys %table) {
-       print_table_entry($_, "HASH");
+        print_table_entry($_, "HASH");
     }
     exit 0;
 }
@@ -942,12 +1049,26 @@ if (scalar(@seed_sources) == 0) {
     print "Using os-specific seed configuration\n";
     push @seed_sources, 'os';
 }
-die "Cannot seed with none and anything else"
-    if scalar(grep { $_ eq 'none' } @seed_sources) > 0
-        && scalar(@seed_sources) > 1;
+if (scalar(grep { $_ eq 'none' } @seed_sources) > 0) {
+    die "Cannot seed with none and anything else" if scalar(@seed_sources) > 1;
+    warn <<_____ if scalar(@seed_sources) == 1;
+
+============================== WARNING ===============================
+You have selected the --with-rand-seed=none option, which effectively
+disables automatic reseeding of the OpenSSL random generator.
+All operations depending on the random generator such as creating keys
+will not work unless the random generator is seeded manually by the
+application.
+
+Please read the 'Note on random number generation' section in the
+INSTALL instructions and the RAND_DRBG(7) manual page for more details.
+============================== WARNING ===============================
+
+_____
+}
 push @{$config{openssl_other_defines}},
      map { (my $x = $_) =~ tr|[\-a-z]|[_A-Z]|; "OPENSSL_RAND_SEED_$x" }
-       @seed_sources;
+        @seed_sources;
 
 # Backward compatibility?
 if ($target =~ m/^CygWin32(-.*)$/) {
@@ -961,57 +1082,28 @@ if ($d) {
 
     # If we do not find debug-foo in the table, the target is set to foo.
     if (!$table{$target}) {
-       $target = $t;
+        $target = $t;
     }
 }
+
+&usage if !$table{$target} || $table{$target}->{template};
+
 $config{target} = $target;
 my %target = resolve_config($target);
 
-&usage if (!%target || $target{template});
+foreach (keys %target_attr_translate) {
+    $target{$target_attr_translate{$_}} = $target{$_}
+        if $target{$_};
+    delete $target{$_};
+}
 
 %target = ( %{$table{DEFAULTS}}, %target );
 
-# Make the flags to build DSOs the same as for shared libraries unless they
-# are already defined
-$target{module_cflags} = $target{shared_cflag} unless defined $target{module_cflags};
-$target{module_cxxflags} = $target{shared_cxxflag} unless defined $target{module_cxxflags};
-$target{module_ldflags} = $target{shared_ldflag} unless defined $target{module_ldflags};
-{
-    my $shared_info_pl =
-        catfile(dirname($0), "Configurations", "shared-info.pl");
-    my %shared_info = read_eval_file($shared_info_pl);
-    push @{$target{_conf_fname_int}}, $shared_info_pl;
-    my $si = $target{shared_target};
-    while (ref $si ne "HASH") {
-        last if ! defined $si;
-        if (ref $si eq "CODE") {
-            $si = $si->();
-        } else {
-            $si = $shared_info{$si};
-        }
-    }
-
-    # Some of the 'shared_target' values don't have any entried in
-    # %shared_info.  That's perfectly fine, AS LONG AS the build file
-    # template knows how to handle this.  That is currently the case for
-    # Windows and VMS.
-    if (defined $si) {
-        # Just as above, copy certain shared_* attributes to the corresponding
-        # module_ attribute unless the latter is already defined
-        $si->{module_cflags} = $si->{shared_cflag} unless defined $si->{module_cflags};
-        $si->{module_cxxflags} = $si->{shared_cxxflag} unless defined $si->{module_cxxflags};
-        $si->{module_ldflags} = $si->{shared_ldflag} unless defined $si->{module_ldflags};
-        foreach (sort keys %$si) {
-            $target{$_} = defined $target{$_}
-                ? add($si->{$_})->($target{$_})
-                : $si->{$_};
-        }
-    }
-}
-
 my %conf_files = map { $_ => 1 } (@{$target{_conf_fname_int}});
 $config{conf_files} = [ sort keys %conf_files ];
 
+# Using sub disable within these loops may prove fragile, so we run
+# a cascade afterwards
 foreach my $feature (@{$target{disable}}) {
     if (exists $deprecated_disablables{$feature}) {
         warn "***** config $target disables deprecated feature $feature\n";
@@ -1021,34 +1113,34 @@ foreach my $feature (@{$target{disable}}) {
     $disabled{$feature} = 'config';
 }
 foreach my $feature (@{$target{enable}}) {
-    if ("default" eq ($disabled{$_} // "")) {
+    if ("default" eq ($disabled{$feature} // "")) {
         if (exists $deprecated_disablables{$feature}) {
             warn "***** config $target enables deprecated feature $feature\n";
         } elsif (!grep { $feature eq $_ } @disablables) {
             die "***** config $target enables unknown feature $feature\n";
         }
-        delete $disabled{$_};
+        delete $disabled{$feature};
     }
 }
+disable();                      # Run a cascade now
 
-$target{cxxflags}//=$target{cflags} if $target{cxx};
+$target{CXXFLAGS}//=$target{CFLAGS} if $target{CXX};
+$target{cxxflags}//=$target{cflags} if $target{CXX};
 $target{exe_extension}="";
 $target{exe_extension}=".exe" if ($config{target} eq "DJGPP"
                                   || $config{target} =~ /^(?:Cygwin|mingw)/);
 $target{exe_extension}=".pm"  if ($config{target} =~ /vos/);
 
 ($target{shared_extension_simple}=$target{shared_extension})
-    =~ s|\.\$\(SHLIB_VERSION_NUMBER\)||;
-$target{dso_extension}=$target{shared_extension_simple};
+    =~ s|\.\$\(SHLIB_VERSION_NUMBER\)||
+    unless defined($target{shared_extension_simple});
+$target{dso_extension}//=$target{shared_extension_simple};
 ($target{shared_import_extension}=$target{shared_extension_simple}.".a")
     if ($config{target} =~ /^(?:Cygwin|mingw)/);
 
-# Allow overriding the names of some tools.  USE WITH CARE
-# Note: only Unix cares about HASHBANGPERL...  that explains
-# the default string.
-$config{perl} =    ($^O ne "VMS" ? $^X : "perl");
+# Fill %config with values from %user, and in case those are undefined or
+# empty, use values from %target (acting as a default).
 foreach (keys %user) {
-    my $target_key = $user_to_target{$_} // lc $_;
     my $ref_type = ref $user{$_};
 
     # Temporary function.  Takes an intended ref type (empty string or "ARRAY")
@@ -1074,52 +1166,30 @@ foreach (keys %user) {
         return $value;
     };
 
-    $config{$target_key} =
+    $config{$_} =
         $mkvalue->($ref_type, $user{$_})
-        || $mkvalue->($ref_type, $target{$target_key});
-    delete $config{$target_key} unless defined $config{$target_key};
+        || $mkvalue->($ref_type, $target{$_});
+    delete $config{$_} unless defined $config{$_};
 }
-$config{plib_lflags} = [ $target{plib_lflags} ];
-
-# Allow overriding the build file name
-$config{build_file} = env('BUILDFILE') || $target{build_file} || "Makefile";
-
-my %disabled_info = ();         # For configdata.pm
-foreach my $what (sort keys %disabled) {
-    $config{options} .= " no-$what";
 
-    if (!grep { $what eq $_ } ( 'dso', 'threads', 'shared', 'pic',
-                                'dynamic-engine', 'makedepend',
-                                'zlib-dynamic', 'zlib', 'sse2' )) {
-        (my $WHAT = uc $what) =~ s|-|_|g;
-
-        # Fix up C macro end names
-        $WHAT = "RMD160" if $what eq "ripemd";
-
-        # fix-up crypto/directory name(s)
-        $what = "ripemd" if $what eq "rmd160";
-        $what = "whrlpool" if $what eq "whirlpool";
-
-        my $macro = $disabled_info{$what}->{macro} = "OPENSSL_NO_$WHAT";
-
-        if ((grep { $what eq $_ } @{$config{sdirs}})
-                && $what ne 'async' && $what ne 'err') {
-            @{$config{sdirs}} = grep { $what ne $_} @{$config{sdirs}};
-            $disabled_info{$what}->{skipped} = [ catdir('crypto', $what) ];
-
-            if ($what ne 'engine') {
-                push @{$config{openssl_algorithm_defines}}, $macro;
-            } else {
-                @{$config{dirs}} = grep !/^engines$/, @{$config{dirs}};
-                push @{$disabled_info{engine}->{skipped}}, catdir('engines');
-                push @{$config{openssl_other_defines}}, $macro;
-            }
-        } else {
-            push @{$config{openssl_other_defines}}, $macro;
-        }
+# Finish up %config by appending things the user gave us on the command line
+# apart from "make variables"
+foreach (keys %useradd) {
+    # The must all be lists, so we assert that here
+    die "internal error: \$useradd{$_} isn't an ARRAY\n"
+        unless ref $useradd{$_} eq 'ARRAY';
 
+    if (defined $config{$_}) {
+        push @{$config{$_}}, @{$useradd{$_}};
+    } else {
+        $config{$_} = [ @{$useradd{$_}} ];
     }
 }
+# At this point, we can forget everything about %user and %useradd,
+# because it's now all been merged into the corresponding $config entry
+
+# Allow overriding the build file name
+$config{build_file} = env('BUILDFILE') || $target{build_file} || "Makefile";
 
 # Make sure build_scheme is consistent.
 $target{build_scheme} = [ $target{build_scheme} ]
@@ -1149,53 +1219,29 @@ foreach my $checker (($builder_platform."-".$target{build_file}."-checker.pm",
 
 push @{$config{defines}}, "NDEBUG"    if $config{build_type} eq "release";
 
-if ($target =~ /^mingw/ && `$config{cc} --target-help 2>&1` =~ m/-mno-cygwin/m)
-       {
-       push @{$config{cflags}}, "-mno-cygwin";
-       push @{$config{cxxflags}}, "-mno-cygwin" if $config{cxx};
-       push @{$config{shared_ldflag}}, "-mno-cygwin";
-       }
+if ($target =~ /^mingw/ && `$config{CC} --target-help 2>&1` =~ m/-mno-cygwin/m)
+        {
+        push @{$config{cflags}}, "-mno-cygwin";
+        push @{$config{cxxflags}}, "-mno-cygwin" if $config{CXX};
+        push @{$config{shared_ldflag}}, "-mno-cygwin";
+        }
 
 if ($target =~ /linux.*-mips/ && !$disabled{asm}
-        && !grep { $_ !~ /-m(ips|arch=)/ } (@{$user{CFLAGS}},
-                                            @{$useradd{CFLAGS}})) {
-       # minimally required architecture flags for assembly modules
-       my $value;
-       $value = '-mips2' if ($target =~ /mips32/);
-       $value = '-mips3' if ($target =~ /mips64/);
-       unshift @{$config{cflags}}, $value;
-       unshift @{$config{cxxflags}}, $value if $config{cxx};
-}
-
-# The DSO code currently always implements all functions so that no
-# applications will have to worry about that from a compilation point
-# of view. However, the "method"s may return zero unless that platform
-# has support compiled in for them. Currently each method is enabled
-# by a define "DSO_<name>" ... we translate the "dso_scheme" config
-# string entry into using the following logic;
-if (!$disabled{dso} && $target{dso_scheme} ne "")
-       {
-       $target{dso_scheme} =~ tr/[a-z]/[A-Z]/;
-       if ($target{dso_scheme} eq "DLFCN")
-               {
-               unshift @{$config{defines}}, "DSO_DLFCN", "HAVE_DLFCN_H";
-               }
-       elsif ($target{dso_scheme} eq "DLFCN_NO_H")
-               {
-               unshift @{$config{defines}}, "DSO_DLFCN";
-               }
-       else
-               {
-               unshift @{$config{defines}}, "DSO_$target{dso_scheme}";
-               }
-       }
+        && !grep { $_ !~ /-m(ips|arch=)/ } (@{$config{CFLAGS}})) {
+        # minimally required architecture flags for assembly modules
+        my $value;
+        $value = '-mips2' if ($target =~ /mips32/);
+        $value = '-mips3' if ($target =~ /mips64/);
+        unshift @{$config{cflags}}, $value;
+        unshift @{$config{cxxflags}}, $value if $config{CXX};
+}
 
 # If threads aren't disabled, check how possible they are
 unless ($disabled{threads}) {
     if ($auto_threads) {
         # Enabled by default, disable it forcibly if unavailable
         if ($target{thread_scheme} eq "(unknown)") {
-            $disabled{threads} = "unavailable";
+            disable("unavailable", 'threads');
         }
     } else {
         # The user chose to enable threads explicitly, let's see
@@ -1206,8 +1252,7 @@ unless ($disabled{threads}) {
             # system-dependent compiler options that are necessary.  We
             # can't truly check that the given options are correct, but
             # we expect the user to know what [s]He is doing.
-            if (!@{$user{CFLAGS}} && !@{$useradd{CFLAGS}}
-                    && !@{$user{CPPDEFINES}} && !@{$useradd{CPPDEFINES}}) {
+            if (!@{$config{CFLAGS}} && !@{$config{CPPDEFINES}}) {
                 die "You asked for multi-threading support, but didn't\n"
                     ,"provide any system-specific compiler options\n";
             }
@@ -1228,44 +1273,36 @@ if (defined($disabled{"deprecated"})) {
 
 my $no_shared_warn=0;
 if ($target{shared_target} eq "")
-       {
-       $no_shared_warn = 1
-           if (!$disabled{shared} || !$disabled{"dynamic-engine"});
-       $disabled{shared} = "no-shared-target";
-       $disabled{pic} = $disabled{shared} = $disabled{"dynamic-engine"} =
-           "no-shared-target";
-       }
+        {
+        $no_shared_warn = 1
+            if (!$disabled{shared} || !$disabled{"dynamic-engine"});
+        disable('no-shared-target', 'pic');
+        }
 
 if ($disabled{"dynamic-engine"}) {
-        push @{$config{defines}}, "OPENSSL_NO_DYNAMIC_ENGINE";
         $config{dynamic_engines} = 0;
 } else {
-        push @{$config{defines}}, "OPENSSL_NO_STATIC_ENGINE";
         $config{dynamic_engines} = 1;
 }
 
 unless ($disabled{asan}) {
     push @{$config{cflags}}, "-fsanitize=address";
-    push @{$config{cxxflags}}, "-fsanitize=address" if $config{cxx};
 }
 
 unless ($disabled{ubsan}) {
     # -DPEDANTIC or -fnosanitize=alignment may also be required on some
     # platforms.
     push @{$config{cflags}}, "-fsanitize=undefined", "-fno-sanitize-recover=all";
-    push @{$config{cxxflags}}, "-fsanitize=undefined", "-fno-sanitize-recover=all"
-        if $config{cxx};
 }
 
 unless ($disabled{msan}) {
   push @{$config{cflags}}, "-fsanitize=memory";
-  push @{$config{cxxflags}}, "-fsanitize=memory" if $config{cxx};
 }
 
 unless ($disabled{"fuzz-libfuzzer"} && $disabled{"fuzz-afl"}
         && $disabled{asan} && $disabled{ubsan} && $disabled{msan}) {
     push @{$config{cflags}}, "-fno-omit-frame-pointer", "-g";
-    push @{$config{cxxflags}}, "-fno-omit-frame-pointer", "-g" if $config{cxx};
+    push @{$config{cxxflags}}, "-fno-omit-frame-pointer", "-g" if $config{CXX};
 }
 #
 # Platform fix-ups
@@ -1273,91 +1310,99 @@ unless ($disabled{"fuzz-libfuzzer"} && $disabled{"fuzz-afl"}
 
 # This saves the build files from having to check
 if ($disabled{pic})
-       {
-       foreach (qw(shared_cflag shared_cxxflag shared_cppflag
-                   shared_defines shared_includes shared_ldflag
-                   module_cflags module_cxxflags module_cppflags
-                   module_defines module_includes module_lflags))
-               {
-               delete $config{$_};
-               $target{$_} = "";
-               }
-       }
+        {
+        foreach (qw(shared_cflag shared_cxxflag shared_cppflag
+                    shared_defines shared_includes shared_ldflag
+                    module_cflags module_cxxflags module_cppflags
+                    module_defines module_includes module_lflags))
+                {
+                delete $config{$_};
+                $target{$_} = "";
+                }
+        }
 else
-       {
-       push @{$config{defines}}, "OPENSSL_PIC";
-       }
+        {
+        push @{$config{lib_defines}}, "OPENSSL_PIC";
+        }
 
 if ($target{sys_id} ne "")
-       {
-       push @{$config{openssl_sys_defines}}, "OPENSSL_SYS_$target{sys_id}";
-       }
+        {
+        push @{$config{openssl_sys_defines}}, "OPENSSL_SYS_$target{sys_id}";
+        }
 
 unless ($disabled{asm}) {
     $target{cpuid_asm_src}=$table{DEFAULTS}->{cpuid_asm_src} if ($config{processor} eq "386");
-    push @{$config{defines}}, "OPENSSL_CPUID_OBJ" if ($target{cpuid_asm_src} ne "mem_clr.c");
+    push @{$config{lib_defines}}, "OPENSSL_CPUID_OBJ" if ($target{cpuid_asm_src} ne "mem_clr.c");
 
     $target{bn_asm_src} =~ s/\w+-gf2m.c// if (defined($disabled{ec2m}));
 
     # bn-586 is the only one implementing bn_*_part_words
-    push @{$config{defines}}, "OPENSSL_BN_ASM_PART_WORDS" if ($target{bn_asm_src} =~ /bn-586/);
-    push @{$config{defines}}, "OPENSSL_IA32_SSE2" if (!$disabled{sse2} && $target{bn_asm_src} =~ /86/);
+    push @{$config{lib_defines}}, "OPENSSL_BN_ASM_PART_WORDS" if ($target{bn_asm_src} =~ /bn-586/);
+    push @{$config{lib_defines}}, "OPENSSL_IA32_SSE2" if (!$disabled{sse2} && $target{bn_asm_src} =~ /86/);
 
-    push @{$config{defines}}, "OPENSSL_BN_ASM_MONT" if ($target{bn_asm_src} =~ /-mont/);
-    push @{$config{defines}}, "OPENSSL_BN_ASM_MONT5" if ($target{bn_asm_src} =~ /-mont5/);
-    push @{$config{defines}}, "OPENSSL_BN_ASM_GF2m" if ($target{bn_asm_src} =~ /-gf2m/);
+    push @{$config{lib_defines}}, "OPENSSL_BN_ASM_MONT" if ($target{bn_asm_src} =~ /-mont/);
+    push @{$config{lib_defines}}, "OPENSSL_BN_ASM_MONT5" if ($target{bn_asm_src} =~ /-mont5/);
+    push @{$config{lib_defines}}, "OPENSSL_BN_ASM_GF2m" if ($target{bn_asm_src} =~ /-gf2m/);
+    push @{$config{lib_defines}}, "BN_DIV3W" if ($target{bn_asm_src} =~ /-div3w/);
 
     if ($target{sha1_asm_src}) {
-       push @{$config{defines}}, "SHA1_ASM"   if ($target{sha1_asm_src} =~ /sx86/ || $target{sha1_asm_src} =~ /sha1/);
-       push @{$config{defines}}, "SHA256_ASM" if ($target{sha1_asm_src} =~ /sha256/);
-       push @{$config{defines}}, "SHA512_ASM" if ($target{sha1_asm_src} =~ /sha512/);
+        push @{$config{lib_defines}}, "SHA1_ASM"   if ($target{sha1_asm_src} =~ /sx86/ || $target{sha1_asm_src} =~ /sha1/);
+        push @{$config{lib_defines}}, "SHA256_ASM" if ($target{sha1_asm_src} =~ /sha256/);
+        push @{$config{lib_defines}}, "SHA512_ASM" if ($target{sha1_asm_src} =~ /sha512/);
+    }
+    if ($target{keccak1600_asm_src} ne $table{DEFAULTS}->{keccak1600_asm_src}) {
+        push @{$config{lib_defines}}, "KECCAK1600_ASM";
     }
     if ($target{rc4_asm_src} ne $table{DEFAULTS}->{rc4_asm_src}) {
-       push @{$config{defines}}, "RC4_ASM";
+        push @{$config{lib_defines}}, "RC4_ASM";
     }
     if ($target{md5_asm_src}) {
-       push @{$config{defines}}, "MD5_ASM";
+        push @{$config{lib_defines}}, "MD5_ASM";
     }
     $target{cast_asm_src}=$table{DEFAULTS}->{cast_asm_src} unless $disabled{pic}; # CAST assembler is not PIC
     if ($target{rmd160_asm_src}) {
-       push @{$config{defines}}, "RMD160_ASM";
+        push @{$config{lib_defines}}, "RMD160_ASM";
     }
     if ($target{aes_asm_src}) {
-       push @{$config{defines}}, "AES_ASM" if ($target{aes_asm_src} =~ m/\baes-/);;
-       # aes-ctr.fake is not a real file, only indication that assembler
-       # module implements AES_ctr32_encrypt...
-       push @{$config{defines}}, "AES_CTR_ASM" if ($target{aes_asm_src} =~ s/\s*aes-ctr\.fake//);
-       # aes-xts.fake indicates presence of AES_xts_[en|de]crypt...
-       push @{$config{defines}}, "AES_XTS_ASM" if ($target{aes_asm_src} =~ s/\s*aes-xts\.fake//);
-       $target{aes_asm_src} =~ s/\s*(vpaes|aesni)-x86\.s//g if ($disabled{sse2});
-       push @{$config{defines}}, "VPAES_ASM" if ($target{aes_asm_src} =~ m/vpaes/);
-       push @{$config{defines}}, "BSAES_ASM" if ($target{aes_asm_src} =~ m/bsaes/);
+        push @{$config{lib_defines}}, "AES_ASM" if ($target{aes_asm_src} =~ m/\baes-/);;
+        push @{$config{lib_defines}}, "AESNI_ASM" if ($target{aes_asm_src} =~ m/\baesni-/);;
+        # aes-ctr.fake is not a real file, only indication that assembler
+        # module implements AES_ctr32_encrypt...
+        push @{$config{lib_defines}}, "AES_CTR_ASM" if ($target{aes_asm_src} =~ s/\s*aes-ctr\.fake//);
+        # aes-xts.fake indicates presence of AES_xts_[en|de]crypt...
+        push @{$config{lib_defines}}, "AES_XTS_ASM" if ($target{aes_asm_src} =~ s/\s*aes-xts\.fake//);
+        $target{aes_asm_src} =~ s/\s*(vpaes|aesni)-x86\.s//g if ($disabled{sse2});
+        push @{$config{lib_defines}}, "VPAES_ASM" if ($target{aes_asm_src} =~ m/vpaes/);
+        push @{$config{lib_defines}}, "BSAES_ASM" if ($target{aes_asm_src} =~ m/bsaes/);
     }
     if ($target{wp_asm_src} =~ /mmx/) {
         if ($config{processor} eq "386") {
-           $target{wp_asm_src}=$table{DEFAULTS}->{wp_asm_src};
-       } elsif (!$disabled{"whirlpool"}) {
-           push @{$config{defines}}, "WHIRLPOOL_ASM";
-       }
+            $target{wp_asm_src}=$table{DEFAULTS}->{wp_asm_src};
+        } elsif (!$disabled{"whirlpool"}) {
+            push @{$config{lib_defines}}, "WHIRLPOOL_ASM";
+        }
     }
     if ($target{modes_asm_src} =~ /ghash-/) {
-       push @{$config{defines}}, "GHASH_ASM";
+        push @{$config{lib_defines}}, "GHASH_ASM";
     }
     if ($target{ec_asm_src} =~ /ecp_nistz256/) {
-       push @{$config{defines}}, "ECP_NISTZ256_ASM";
+        push @{$config{lib_defines}}, "ECP_NISTZ256_ASM";
     }
     if ($target{ec_asm_src} =~ /x25519/) {
-       push @{$config{defines}}, "X25519_ASM";
+        push @{$config{lib_defines}}, "X25519_ASM";
     }
     if ($target{padlock_asm_src} ne $table{DEFAULTS}->{padlock_asm_src}) {
-       push @{$config{defines}}, "PADLOCK_ASM";
+        push @{$config{dso_defines}}, "PADLOCK_ASM";
     }
     if ($target{poly1305_asm_src} ne "") {
-       push @{$config{defines}}, "POLY1305_ASM";
+        push @{$config{lib_defines}}, "POLY1305_ASM";
     }
 }
 
-my %predefined = compiler_predefined($config{cc});
+my %predefined_C = compiler_predefined($config{CROSS_COMPILE}.$config{CC});
+my %predefined_CXX = $config{CXX}
+    ? compiler_predefined($config{CROSS_COMPILE}.$config{CXX})
+    : ();
 
 # Check for makedepend capabilities.
 if (!$disabled{makedepend}) {
@@ -1365,39 +1410,62 @@ if (!$disabled{makedepend}) {
         # For VC- and vms- targets, there's nothing more to do here.  The
         # functionality is hard coded in the corresponding build files for
         # cl (Windows) and CC/DECC (VMS).
-    } elsif ($predefined{__GNUC__} >= 3) {
+    } elsif (($predefined_C{__GNUC__} // -1) >= 3
+             && !($predefined_C{__APPLE_CC__} && !$predefined_C{__clang__})) {
         # We know that GNU C version 3 and up as well as all clang
-        # versions support dependency generation
-        $config{makedepprog} = "\$(CROSS_COMPILE)$config{cc}";
+        # versions support dependency generation, but Xcode did not
+        # handle $cc -M before clang support (but claims __GNUC__ = 3)
+        $config{makedepprog} = "\$(CROSS_COMPILE)$config{CC}";
     } else {
         # In all other cases, we look for 'makedepend', and disable the
         # capability if not found.
         $config{makedepprog} = which('makedepend');
-        $disabled{makedepend} = "unavailable" unless $config{makedepprog};
+        disable('unavailable', 'makedepend') unless $config{makedepprog};
     }
 }
 
+if (!$disabled{asm} && !$predefined_C{__MACH__} && $^O ne 'VMS') {
+    # probe for -Wa,--noexecstack option...
+    if ($predefined_C{__clang__}) {
+        # clang has builtin assembler, which doesn't recognize --help,
+        # but it apparently recognizes the option in question on all
+        # supported platforms even when it's meaningless. In other words
+        # probe would fail, but probed option always accepted...
+        push @{$config{cflags}}, "-Wa,--noexecstack", "-Qunused-arguments";
+    } else {
+        my $cc = $config{CROSS_COMPILE}.$config{CC};
+        open(PIPE, "$cc -Wa,--help -c -o null.$$.o -x assembler /dev/null 2>&1 |");
+        while(<PIPE>) {
+            if (m/--noexecstack/) {
+                push @{$config{cflags}}, "-Wa,--noexecstack";
+                last;
+            }
+        }
+        close(PIPE);
+        unlink("null.$$.o");
+    }
+}
 
 # Deal with bn_ops ###################################################
 
-$config{bn_ll}                 =0;
-$config{export_var_as_fn}      =0;
+$config{bn_ll}                  =0;
+$config{export_var_as_fn}       =0;
 my $def_int="unsigned int";
-$config{rc4_int}               =$def_int;
+$config{rc4_int}                =$def_int;
 ($config{b64l},$config{b64},$config{b32})=(0,0,1);
 
 my $count = 0;
 foreach (sort split(/\s+/,$target{bn_ops})) {
     $count++ if /SIXTY_FOUR_BIT|SIXTY_FOUR_BIT_LONG|THIRTY_TWO_BIT/;
     $config{export_var_as_fn}=1                 if $_ eq 'EXPORT_VAR_AS_FN';
-    $config{bn_ll}=1                           if $_ eq 'BN_LLONG';
-    $config{rc4_int}="unsigned char"           if $_ eq 'RC4_CHAR';
+    $config{bn_ll}=1                            if $_ eq 'BN_LLONG';
+    $config{rc4_int}="unsigned char"            if $_ eq 'RC4_CHAR';
     ($config{b64l},$config{b64},$config{b32})
-       =(0,1,0)                                if $_ eq 'SIXTY_FOUR_BIT';
+        =(0,1,0)                                if $_ eq 'SIXTY_FOUR_BIT';
     ($config{b64l},$config{b64},$config{b32})
-       =(1,0,0)                                if $_ eq 'SIXTY_FOUR_BIT_LONG';
+        =(1,0,0)                                if $_ eq 'SIXTY_FOUR_BIT_LONG';
     ($config{b64l},$config{b64},$config{b32})
-       =(0,0,1)                                if $_ eq 'THIRTY_TWO_BIT';
+        =(0,0,1)                                if $_ eq 'THIRTY_TWO_BIT';
 }
 die "Exactly one of SIXTY_FOUR_BIT|SIXTY_FOUR_BIT_LONG|THIRTY_TWO_BIT can be set in bn_ops\n"
     if $count > 1;
@@ -1410,7 +1478,7 @@ die "Exactly one of SIXTY_FOUR_BIT|SIXTY_FOUR_BIT_LONG|THIRTY_TWO_BIT can be set
 $config{cflags} = [ map { (my $x = $_) =~ s/([\\\"])/\\$1/g; $x }
                         @{$config{cflags}} ];
 $config{cxxflags} = [ map { (my $x = $_) =~ s/([\\\"])/\\$1/g; $x }
-                          @{$config{cxxflags}} ] if $config{cxx};
+                          @{$config{cxxflags}} ] if $config{CXX};
 
 if (defined($config{api})) {
     $config{openssl_api_defines} = [ "OPENSSL_MIN_API=".$apitable->{$config{api}} ];
@@ -1418,97 +1486,172 @@ if (defined($config{api})) {
     push @{$config{defines}}, $apiflag;
 }
 
-if (defined($predefined{__clang__}) && !$disabled{asm}) {
-    push @{$config{cflags}}, "-Qunused-arguments";
-    push @{$config{cxxflags}}, "-Qunused-arguments" if $config{cxx};
+my @strict_warnings_collection=();
+if ($strict_warnings)
+        {
+        my $wopt;
+        my $gccver = $predefined_C{__GNUC__} // -1;
+
+        if ($gccver >= 4)
+                {
+                push @strict_warnings_collection, @gcc_devteam_warn;
+                push @strict_warnings_collection, @clang_devteam_warn
+                    if (defined($predefined_C{__clang__}));
+                }
+        elsif ($config{target} =~ /^VC-/)
+                {
+                push @strict_warnings_collection, @cl_devteam_warn;
+                }
+        else
+                {
+                warn "WARNING --strict-warnings requires gcc[>=4] or gcc-alike, or MSVC"
+                }
+        }
+
+if (grep { $_ eq '-static' } @{$config{LDFLAGS}}) {
+    disable('static', 'pic', 'threads');
 }
 
-if ($strict_warnings)
-       {
-       my $wopt;
-       my $gccver = $predefined{__GNUC__} // -1;
-
-       die "ERROR --strict-warnings requires gcc[>=4] or gcc-alike"
-            unless $gccver >= 4;
-       $gcc_devteam_warn .= " -Wmisleading-indentation" if $gccver >= 6;
-       foreach $wopt (split /\s+/, $gcc_devteam_warn)
-               {
-               push @{$config{cflags}}, $wopt
-                       unless grep { $_ eq $wopt } @{$config{cflags}};
-               push @{$config{cxxflags}}, $wopt
-                       if ($config{cxx}
-                           && !grep { $_ eq $wopt } @{$config{cxxflags}});
-               }
-       if (defined($predefined{__clang__}))
-               {
-               foreach $wopt (split /\s+/, $clang_devteam_warn)
-                       {
-                       push @{$config{cflags}}, $wopt
-                               unless grep { $_ eq $wopt } @{$config{cflags}};
-                       push @{$config{cxxflags}}, $wopt
-                               if ($config{cxx}
-                                   && !grep { $_ eq $wopt } @{$config{cxxflags}});
-                       }
-               }
-       }
+$config{CFLAGS} = [ map { $_ eq '--ossl-strict-warnings'
+                              ? @strict_warnings_collection
+                              : ( $_ ) }
+                    @{$config{CFLAGS}} ];
 
 unless ($disabled{"crypto-mdebug-backtrace"})
-       {
-       foreach my $wopt (split /\s+/, $memleak_devteam_backtrace)
-               {
-               push @{$config{cflags}}, $wopt
-                       unless grep { $_ eq $wopt } @{$config{cflags}};
-               push @{$config{cxxflags}}, $wopt
-                       if ($config{cxx}
-                           && !grep { $_ eq $wopt } @{$config{cxxflags}});
-               }
-       if ($target =~ /^BSD-/)
-               {
-               push @{$config{ex_libs}}, "-lexecinfo";
-               }
-       }
+        {
+        foreach my $wopt (split /\s+/, $memleak_devteam_backtrace)
+                {
+                push @{$config{cflags}}, $wopt
+                        unless grep { $_ eq $wopt } @{$config{cflags}};
+                }
+        if ($target =~ /^BSD-/)
+                {
+                push @{$config{ex_libs}}, "-lexecinfo";
+                }
+        }
 
 unless ($disabled{afalgeng}) {
     $config{afalgeng}="";
-    if ($target =~ m/^linux/) {
+    if (grep { $_ eq 'afalgeng' } @{$target{enable}}) {
         my $minver = 4*10000 + 1*100 + 0;
-        if ($config{cross_compile_prefix} eq "") {
+        if ($config{CROSS_COMPILE} eq "") {
             my $verstr = `uname -r`;
             my ($ma, $mi1, $mi2) = split("\\.", $verstr);
             ($mi2) = $mi2 =~ /(\d+)/;
             my $ver = $ma*10000 + $mi1*100 + $mi2;
             if ($ver < $minver) {
-                $disabled{afalgeng} = "too-old-kernel";
+                disable('too-old-kernel', 'afalgeng');
             } else {
                 push @{$config{engdirs}}, "afalg";
             }
         } else {
-            $disabled{afalgeng} = "cross-compiling";
+            disable('cross-compiling', 'afalgeng');
         }
     } else {
-        $disabled{afalgeng}  = "not-linux";
+        disable('not-linux', 'afalgeng');
     }
 }
 
-push @{$config{openssl_other_defines}}, "OPENSSL_NO_AFALGENG" if ($disabled{afalgeng});
+unless ($disabled{devcryptoeng}) {
+    if ($target =~ m/^BSD/) {
+        my $maxver = 5*100 + 7;
+        my $sysstr = `uname -s`;
+        my $verstr = `uname -r`;
+        $sysstr =~ s|\R$||;
+        $verstr =~ s|\R$||;
+        my ($ma, $mi, @rest) = split m|\.|, $verstr;
+        my $ver = $ma*100 + $mi;
+        if ($sysstr eq 'OpenBSD' && $ver >= $maxver) {
+            disable('too-new-kernel', 'devcryptoeng');
+        }
+    }
+}
 
-# Finish up %config by appending things the user gave us on the command line
-# apart from "make variables"
-foreach (keys %useradd) {
-    # The must all be lists, so we assert that here
-    die "internal error: \$useradd{$_} isn't an ARRAY\n"
-        unless ref $useradd{$_} eq 'ARRAY';
+# Get the extra flags used when building shared libraries and modules.  We
+# do this late because some of them depend on %disabled.
 
-    my $target_key = $user_to_target{$_} // lc $_;
+# Make the flags to build DSOs the same as for shared libraries unless they
+# are already defined
+$target{module_cflags} = $target{shared_cflag} unless defined $target{module_cflags};
+$target{module_cxxflags} = $target{shared_cxxflag} unless defined $target{module_cxxflags};
+$target{module_ldflags} = $target{shared_ldflag} unless defined $target{module_ldflags};
+{
+    my $shared_info_pl =
+        catfile(dirname($0), "Configurations", "shared-info.pl");
+    my %shared_info = read_eval_file($shared_info_pl);
+    push @{$target{_conf_fname_int}}, $shared_info_pl;
+    my $si = $target{shared_target};
+    while (ref $si ne "HASH") {
+        last if ! defined $si;
+        if (ref $si eq "CODE") {
+            $si = $si->();
+        } else {
+            $si = $shared_info{$si};
+        }
+    }
+
+    # Some of the 'shared_target' values don't have any entries in
+    # %shared_info.  That's perfectly fine, AS LONG AS the build file
+    # template knows how to handle this.  That is currently the case for
+    # Windows and VMS.
+    if (defined $si) {
+        # Just as above, copy certain shared_* attributes to the corresponding
+        # module_ attribute unless the latter is already defined
+        $si->{module_cflags} = $si->{shared_cflag} unless defined $si->{module_cflags};
+        $si->{module_cxxflags} = $si->{shared_cxxflag} unless defined $si->{module_cxxflags};
+        $si->{module_ldflags} = $si->{shared_ldflag} unless defined $si->{module_ldflags};
+        foreach (sort keys %$si) {
+            $target{$_} = defined $target{$_}
+                ? add($si->{$_})->($target{$_})
+                : $si->{$_};
+        }
+    }
+}
+
+# ALL MODIFICATIONS TO %disabled, %config and %target MUST BE DONE FROM HERE ON
+
+my %disabled_info = ();         # For configdata.pm
+foreach my $what (sort keys %disabled) {
+    $config{options} .= " no-$what";
+
+    if (!grep { $what eq $_ } ( 'buildtest-c++', 'threads', 'shared', 'pic',
+                                'dynamic-engine', 'makedepend',
+                                'zlib-dynamic', 'zlib', 'sse2' )) {
+        (my $WHAT = uc $what) =~ s|-|_|g;
+
+        # Fix up C macro end names
+        $WHAT = "RMD160" if $what eq "ripemd";
+
+        # fix-up crypto/directory name(s)
+        $what = "ripemd" if $what eq "rmd160";
+        $what = "whrlpool" if $what eq "whirlpool";
+
+        my $macro = $disabled_info{$what}->{macro} = "OPENSSL_NO_$WHAT";
+
+        if ((grep { $what eq $_ } @{$config{sdirs}})
+                && $what ne 'async' && $what ne 'err' && $what ne 'dso') {
+            @{$config{sdirs}} = grep { $what ne $_} @{$config{sdirs}};
+            $disabled_info{$what}->{skipped} = [ catdir('crypto', $what) ];
+
+            if ($what ne 'engine') {
+                push @{$config{openssl_algorithm_defines}}, $macro;
+            } else {
+                @{$config{dirs}} = grep !/^engines$/, @{$config{dirs}};
+                push @{$disabled_info{engine}->{skipped}}, catdir('engines');
+                push @{$config{openssl_other_defines}}, $macro;
+            }
+        } else {
+            push @{$config{openssl_other_defines}}, $macro;
+        }
 
-    if (defined $config{$target_key}) {
-        push @{$config{$target_key}}, @{$useradd{$_}};
-    } else {
-        $config{$target_key} = [ @{$useradd{$_}} ];
     }
 }
 
-# ALL MODIFICATIONS TO %config and %target MUST BE DONE FROM HERE ON
+if ($disabled{"dynamic-engine"}) {
+    push @{$config{openssl_other_defines}}, "OPENSSL_NO_DYNAMIC_ENGINE";
+} else {
+    push @{$config{openssl_other_defines}}, "OPENSSL_NO_STATIC_ENGINE";
+}
 
 # If we use the unified build, collect information from build.info files
 my %unified_info = ();
@@ -1553,41 +1696,43 @@ if ($builder eq "unified") {
     # Store the name of the template file we will build the build file from
     # in %config.  This may be useful for the build file itself.
     my @build_file_template_names =
-       ( $builder_platform."-".$target{build_file}.".tmpl",
-         $target{build_file}.".tmpl" );
+        ( $builder_platform."-".$target{build_file}.".tmpl",
+          $target{build_file}.".tmpl" );
     my @build_file_templates = ();
 
     # First, look in the user provided directory, if given
     if (defined env($local_config_envname)) {
-       @build_file_templates =
-           map {
-               if ($^O eq 'VMS') {
-                   # VMS environment variables are logical names,
-                   # which can be used as is
-                   $local_config_envname . ':' . $_;
-               } else {
-                   catfile(env($local_config_envname), $_);
-               }
-           }
-           @build_file_template_names;
+        @build_file_templates =
+            map {
+                if ($^O eq 'VMS') {
+                    # VMS environment variables are logical names,
+                    # which can be used as is
+                    $local_config_envname . ':' . $_;
+                } else {
+                    catfile(env($local_config_envname), $_);
+                }
+            }
+            @build_file_template_names;
     }
     # Then, look in our standard directory
     push @build_file_templates,
-       ( map { cleanfile($srcdir, catfile("Configurations", $_), $blddir) }
-         @build_file_template_names );
+        ( map { cleanfile($srcdir, catfile("Configurations", $_), $blddir) }
+          @build_file_template_names );
 
     my $build_file_template;
     for $_ (@build_file_templates) {
-       $build_file_template = $_;
+        $build_file_template = $_;
         last if -f $build_file_template;
 
         $build_file_template = undef;
     }
     if (!defined $build_file_template) {
-       die "*** Couldn't find any of:\n", join("\n", @build_file_templates), "\n";
+        die "*** Couldn't find any of:\n", join("\n", @build_file_templates), "\n";
     }
     $config{build_file_templates}
-      = [ $build_file_template,
+      = [ cleanfile($srcdir, catfile("Configurations", "common0.tmpl"),
+                    $blddir),
+          $build_file_template,
           cleanfile($srcdir, catfile("Configurations", "common.tmpl"),
                     $blddir) ];
 
@@ -1641,6 +1786,10 @@ if ($builder eq "unified") {
         my %sharednames = ();
         my %generate = ();
 
+        # We want to detect configdata.pm in the source tree, so we
+        # don't use it if the build tree is different.
+        my $src_configdata = cleanfile($srcdir, "configdata.pm", $blddir);
+
         push @{$config{build_infos}}, catfile(abs2rel($sourced, $blddir), $f);
         my $template =
             Text::Template->new(TYPE => 'FILE',
@@ -1937,7 +2086,7 @@ EOF
 
                 # If it isn't in the source tree, we assume it's generated
                 # in the build tree
-                if (! -f $s || $generate{$_}) {
+                if ($s eq $src_configdata || ! -f $s || $generate{$_}) {
                     $s = cleanfile($buildd, $_, $blddir);
                 }
                 # We recognise C++, C and asm files
@@ -1948,6 +2097,13 @@ EOF
                     $o = cleanfile($buildd, $o, $blddir);
                     $unified_info{sources}->{$ddest}->{$o} = 1;
                     $unified_info{sources}->{$o}->{$s} = 1;
+                } elsif ($s =~ /\.rc$/) {
+                    # We also recognise resource files
+                    my $o = $_;
+                    $o =~ s/\.rc$/.res/; # Resource configuration
+                    my $o = cleanfile($buildd, $o, $blddir);
+                    $unified_info{sources}->{$ddest}->{$o} = 1;
+                    $unified_info{sources}->{$o}->{$s} = 1;
                 } else {
                     $unified_info{sources}->{$ddest}->{$s} = 1;
                 }
@@ -1965,7 +2121,7 @@ EOF
 
                 # If it isn't in the source tree, we assume it's generated
                 # in the build tree
-                if (! -f $s || $generate{$_}) {
+                if ($s eq $src_configdata || ! -f $s || $generate{$_}) {
                     $s = cleanfile($buildd, $_, $blddir);
                 }
 
@@ -2015,7 +2171,7 @@ EOF
 
             # If the destination doesn't exist in source, it can only be
             # a generated file in the build tree.
-            if ($ddest ne "" && ! -f $ddest) {
+            if ($ddest ne "" && ($ddest eq $src_configdata || ! -f $ddest)) {
                 $ddest = cleanfile($buildd, $_, $blddir);
                 if ($unified_info{rename}->{$ddest}) {
                     $ddest = $unified_info{rename}->{$ddest};
@@ -2029,7 +2185,8 @@ EOF
                 # in the build tree rather than the source tree, and assume
                 # and that there are lines to build it in a BEGINRAW..ENDRAW
                 # section or in the Makefile template.
-                if (! -f $d
+                if ($d eq $src_configdata
+                    || ! -f $d
                     || (grep { $d eq $_ }
                         map { cleanfile($srcdir, $_, $blddir) }
                         grep { /\.h$/ } keys %{$unified_info{generate}})) {
@@ -2056,7 +2213,7 @@ EOF
 
             # If the destination doesn't exist in source, it can only be
             # a generated file in the build tree.
-            if (! -f $ddest) {
+            if ($ddest eq $src_configdata || ! -f $ddest) {
                 $ddest = cleanfile($buildd, $_, $blddir);
                 if ($unified_info{rename}->{$ddest}) {
                     $ddest = $unified_info{rename}->{$ddest};
@@ -2083,22 +2240,28 @@ EOF
 
     # Massage the result
 
+    # If the user configured no-shared, we allow no shared sources
+    if ($disabled{shared}) {
+        foreach (keys %{$unified_info{shared_sources}}) {
+            foreach (keys %{$unified_info{shared_sources}->{$_}}) {
+                delete $unified_info{sources}->{$_};
+            }
+        }
+        $unified_info{shared_sources} = {};
+    }
+
     # If we depend on a header file or a perl module, add an inclusion of
     # its directory to allow smoothe inclusion
     foreach my $dest (keys %{$unified_info{depends}}) {
         next if $dest eq "";
         foreach my $d (keys %{$unified_info{depends}->{$dest}}) {
             next unless $d =~ /\.(h|pm)$/;
-            if ($d eq "configdata.pm"
-                    || defined($unified_info{generate}->{$d})) {
-                my $i = cleandir($blddir, dirname($d));
-                push @{$unified_info{includes}->{$dest}->{build}}, $i
-                    unless grep { $_ eq $i } @{$unified_info{includes}->{$dest}->{build}};
-            } else {
-                my $i = cleandir($srcdir, dirname($d));
-                push @{$unified_info{includes}->{$dest}->{source}}, $i
-                    unless grep { $_ eq $i } @{$unified_info{includes}->{$dest}->{source}};
-            }
+            my $i = dirname($d);
+            my $spot =
+                $d eq "configdata.pm" || defined($unified_info{generate}->{$d})
+                ? 'build' : 'source';
+            push @{$unified_info{includes}->{$dest}->{$spot}}, $i
+                unless grep { $_ eq $i } @{$unified_info{includes}->{$dest}->{$spot}};
         }
     }
 
@@ -2111,8 +2274,8 @@ EOF
             next unless defined($unified_info{includes}->{$dest}->{$k});
             my @incs = reverse @{$unified_info{includes}->{$dest}->{$k}};
             foreach my $obj (grep /\.o$/,
-                             (keys %{$unified_info{sources}->{$dest}},
-                              keys %{$unified_info{shared_sources}->{$dest}})) {
+                             (keys %{$unified_info{sources}->{$dest} // {}},
+                              keys %{$unified_info{shared_sources}->{$dest} // {}})) {
                 foreach my $inc (@incs) {
                     unshift @{$unified_info{includes}->{$obj}->{$k}}, $inc
                         unless grep { $_ eq $inc } @{$unified_info{includes}->{$obj}->{$k}};
@@ -2151,6 +2314,42 @@ EOF
                 [ @{$unified_info{includes}->{$dest}->{source}} ];
         }
     }
+
+    # For convenience collect information regarding directories where
+    # files are generated, those generated files and the end product
+    # they end up in where applicable.  Then, add build rules for those
+    # directories
+    my %loopinfo = ( "lib" => [ @{$unified_info{libraries}} ],
+                     "dso" => [ @{$unified_info{engines}} ],
+                     "bin" => [ @{$unified_info{programs}} ],
+                     "script" => [ @{$unified_info{scripts}} ] );
+    foreach my $type (keys %loopinfo) {
+        foreach my $product (@{$loopinfo{$type}}) {
+            my %dirs = ();
+            my $pd = dirname($product);
+
+            foreach (@{$unified_info{sources}->{$product} // []},
+                     @{$unified_info{shared_sources}->{$product} // []}) {
+                my $d = dirname($_);
+
+                # We don't want to create targets for source directories
+                # when building out of source
+                next if ($config{sourcedir} ne $config{builddir}
+                             && $d =~ m|^\Q$config{sourcedir}\E|);
+                # We already have a "test" target, and the current directory
+                # is just silly to make a target for
+                next if $d eq "test" || $d eq ".";
+
+                $dirs{$d} = 1;
+                push @{$unified_info{dirinfo}->{$d}->{deps}}, $_
+                    if $d ne $pd;
+            }
+            foreach (keys %dirs) {
+                push @{$unified_info{dirinfo}->{$_}->{products}->{$type}},
+                    $product;
+            }
+        }
+    }
 }
 
 # For the schemes that need it, we provide the old *_obj configs
@@ -2168,7 +2367,7 @@ foreach (grep /_(asm|aux)_src$/, keys %target) {
 print "Creating configdata.pm\n";
 open(OUT,">configdata.pm") || die "unable to create configdata.pm: $!\n";
 print OUT <<"EOF";
-#! $config{hashbangperl}
+#! $config{HASHBANGPERL}
 
 package configdata;
 
@@ -2184,11 +2383,11 @@ EOF
 print OUT "our %config = (\n";
 foreach (sort keys %config) {
     if (ref($config{$_}) eq "ARRAY") {
-       print OUT "  ", $_, " => [ ", join(", ",
-                                          map { quotify("perl", $_) }
-                                          @{$config{$_}}), " ],\n";
+        print OUT "  ", $_, " => [ ", join(", ",
+                                           map { quotify("perl", $_) }
+                                           @{$config{$_}}), " ],\n";
     } elsif (ref($config{$_}) eq "HASH") {
-       print OUT "  ", $_, " => {";
+        print OUT "  ", $_, " => {";
         if (scalar keys %{$config{$_}} > 0) {
             print OUT "\n";
             foreach my $key (sort keys %{$config{$_}}) {
@@ -2204,7 +2403,7 @@ foreach (sort keys %config) {
         }
         print OUT "},\n";
     } else {
-       print OUT "  ", $_, " => ", quotify("perl", $config{$_}), ",\n"
+        print OUT "  ", $_, " => ", quotify("perl", $config{$_}), ",\n"
     }
 }
 print OUT <<"EOF";
@@ -2214,11 +2413,11 @@ EOF
 print OUT "our %target = (\n";
 foreach (sort keys %target) {
     if (ref($target{$_}) eq "ARRAY") {
-       print OUT "  ", $_, " => [ ", join(", ",
-                                          map { quotify("perl", $_) }
-                                          @{$target{$_}}), " ],\n";
+        print OUT "  ", $_, " => [ ", join(", ",
+                                           map { quotify("perl", $_) }
+                                           @{$target{$_}}), " ],\n";
     } else {
-       print OUT "  ", $_, " => ", quotify("perl", $target{$_}), ",\n"
+        print OUT "  ", $_, " => ", quotify("perl", $target{$_}), ",\n"
     }
 }
 print OUT <<"EOF";
@@ -2251,11 +2450,11 @@ EOF
 print OUT "our %withargs = (\n";
 foreach (sort keys %withargs) {
     if (ref($withargs{$_}) eq "ARRAY") {
-       print OUT "  ", $_, " => [ ", join(", ",
-                                          map { quotify("perl", $_) }
-                                          @{$withargs{$_}}), " ],\n";
+        print OUT "  ", $_, " => [ ", join(", ",
+                                           map { quotify("perl", $_) }
+                                           @{$withargs{$_}}), " ],\n";
     } else {
-       print OUT "  ", $_, " => ", quotify("perl", $withargs{$_}), ",\n"
+        print OUT "  ", $_, " => ", quotify("perl", $withargs{$_}), ",\n"
     }
 }
 print OUT <<"EOF";
@@ -2306,10 +2505,9 @@ EOF
 }
 print OUT
     "# The following data is only used when this files is use as a script\n";
-print OUT "my \%makevars = (\n";
+print OUT "my \@makevars = (\n";
 foreach (sort keys %user) {
-    print OUT '    ',$_,' ' x (20 - length $_),'=> ',
-        "'",$user_to_target{$_} || lc $_,"',\n";
+    print OUT "    '",$_,"',\n";
 }
 print OUT ");\n";
 print OUT "my \%disabled_info = (\n";
@@ -2383,7 +2581,7 @@ _____
     if ($dump || $cmdline) {
         print "\nCommand line (with current working directory = $here):\n\n";
         print '    ',join(' ',
-                          $config{perl},
+                          $config{PERL},
                           catfile($config{sourcedir}, 'Configure'),
                           @{$config{perlargv}}), "\n";
         print "\nPerl information:\n\n";
@@ -2440,17 +2638,17 @@ _____
     }
     if ($dump || $makevars) {
         print "\nMakevars:\n\n";
-        foreach my $var (sort keys %makevars) {
+        foreach my $var (@makevars) {
             my $prefix = '';
-            $prefix = $config{cross_compile_prefix}
+            $prefix = $config{CROSS_COMPILE}
                 if grep { $var eq $_ } @user_crossable;
             $prefix //= '';
             print '    ',$var,' ' x (16 - length $var),'= ',
-                (ref $config{$makevars{$var}} eq 'ARRAY'
-                 ? join(' ', @{$config{$makevars{$var}}})
-                 : $prefix.$config{$makevars{$var}}),
+                (ref $config{$var} eq 'ARRAY'
+                 ? join(' ', @{$config{$var}})
+                 : $prefix.$config{$var}),
                 "\n"
-                if defined $config{$makevars{$var}};
+                if defined $config{$var};
         }
 
         my @buildfile = ($config{builddir}, $config{build_file});
@@ -2483,9 +2681,9 @@ _____
     if ($reconf) {
         if ($verbose) {
             print 'Reconfiguring with: ', join(' ',@{$config{perlargv}}), "\n";
-           foreach (sort keys %{$config{perlenv}}) {
-               print '    ',$_,' = ',($config{perlenv}->{$_} || ""),"\n";
-           }
+            foreach (sort keys %{$config{perlenv}}) {
+                print '    ',$_,' = ',($config{perlenv}->{$_} || ""),"\n";
+            }
         }
 
         chdir $here;
@@ -2604,6 +2802,8 @@ my %builders = (
 
 $builders{$builder}->($builder_platform, @builder_opts);
 
+$SIG{__DIE__} = $orig_death_handler;
+
 print <<"EOF" if ($disabled{threads} eq "unavailable");
 
 The library could not be configured for supporting multi-threaded
@@ -2620,22 +2820,20 @@ or position independent code, please let us know (but please first make sure
 you have tried with a current version of OpenSSL).
 EOF
 
-print <<"EOF" if (-f catfile($srcdir, "configdata.pm") && $srcdir ne $blddir);
-
-WARNING: there are indications that another build was made in the source
-directory.  This build may have picked up artifacts from that build, the
-safest course of action is to clean the source directory and redo this
-configuration.
-EOF
-
 print <<"EOF";
 
 **********************************************************************
 ***                                                                ***
-***   If you want to report a building issue, please include the   ***
-***   output from this command:                                    ***
+***   OpenSSL has been successfully configured                     ***
 ***                                                                ***
-***     perl configdata.pm --dump                                  ***
+***   If you encounter a problem while building, please open an    ***
+***   issue on GitHub <https://github.com/openssl/openssl/issues>  ***
+***   and include the output from the following command:           ***
+***                                                                ***
+***       perl configdata.pm --dump                                ***
+***                                                                ***
+***   (If you are new to OpenSSL, you might want to consult the    ***
+***   'Troubleshooting' section in the INSTALL file first)         ***
 ***                                                                ***
 **********************************************************************
 EOF
@@ -2647,6 +2845,24 @@ exit(0);
 # Helpers and utility functions
 #
 
+# Death handler, to print a helpful message in case of failure #######
+#
+sub death_handler {
+    die @_ if $^S;              # To prevent the added message in eval blocks
+    my $build_file = $target{build_file} // "build file";
+    my @message = ( <<"_____", @_ );
+
+Failure!  $build_file wasn't produced.
+Please read INSTALL and associated NOTES files.  You may also have to look over
+your available compiler tool chain or change your configuration.
+
+_____
+
+    # Dying is terminal, so it's ok to reset the signal handler here.
+    $SIG{__DIE__} = $orig_death_handler;
+    die @message;
+}
+
 # Configuration file reading #########################################
 
 # Note: All of the helper functions are for lazy evaluation.  They all
@@ -2662,7 +2878,7 @@ exit(0);
 sub asm {
     my @x = @_;
     sub {
-       $disabled{asm} ? () : @x;
+        $disabled{asm} ? () : @x;
     }
 }
 
@@ -2711,7 +2927,10 @@ sub threads {
     return sub { add($disabled{threads} ? () : @flags)->(); }
 }
 
-
+sub shared {
+    my @flags = @_;
+    return sub { add($disabled{shared} ? () : @flags)->(); }
+}
 
 our $add_called = 0;
 # Helper function to implement adding values to already existing configuration
@@ -2725,29 +2944,29 @@ sub _add {
     my $found_array = !defined($separator);
 
     my @values =
-       map {
-           my $res = $_;
-           while (ref($res) eq "CODE") {
-               $res = $res->();
-           }
-           if (defined($res)) {
-               if (ref($res) eq "ARRAY") {
-                   $found_array = 1;
-                   @$res;
-               } else {
-                   $res;
-               }
-           } else {
-               ();
-           }
+        map {
+            my $res = $_;
+            while (ref($res) eq "CODE") {
+                $res = $res->();
+            }
+            if (defined($res)) {
+                if (ref($res) eq "ARRAY") {
+                    $found_array = 1;
+                    @$res;
+                } else {
+                    $res;
+                }
+            } else {
+                ();
+            }
     } (@_);
 
     $add_called = 1;
 
     if ($found_array) {
-       [ @values ];
+        [ @values ];
     } else {
-       join($separator, grep { defined($_) && $_ ne "" } @values);
+        join($separator, grep { defined($_) && $_ ne "" } @values);
     }
 }
 sub add_before {
@@ -2797,10 +3016,10 @@ sub read_config {
     my %targets;
 
     {
-       # Protect certain tables from tampering
-       local %table = ();
+        # Protect certain tables from tampering
+        local %table = ();
 
-       %targets = read_eval_file($fname);
+        %targets = read_eval_file($fname);
     }
     my %preexisting = ();
     foreach (sort keys %targets) {
@@ -2816,14 +3035,14 @@ EOF
 
     # For each target, check that it's configured with a hash table.
     foreach (keys %targets) {
-       if (ref($targets{$_}) ne "HASH") {
-           if (ref($targets{$_}) eq "") {
-               warn "Deprecated target configuration for $_, ignoring...\n";
-           } else {
-               warn "Misconfigured target configuration for $_ (should be a hash table), ignoring...\n";
-           }
-           delete $targets{$_};
-       } else {
+        if (ref($targets{$_}) ne "HASH") {
+            if (ref($targets{$_}) eq "") {
+                warn "Deprecated target configuration for $_, ignoring...\n";
+            } else {
+                warn "Misconfigured target configuration for $_ (should be a hash table), ignoring...\n";
+            }
+            delete $targets{$_};
+        } else {
             $targets{$_}->{_conf_fname_int} = add([ $fname ]);
         }
     }
@@ -2842,13 +3061,13 @@ sub resolve_config {
 #    my $extra_checks = defined($ENV{CONFIGURE_EXTRA_CHECKS});
 
     if (grep { $_ eq $target } @breadcrumbs) {
-       die "inherit_from loop!  target backtrace:\n  "
-           ,$target,"\n  ",join("\n  ", @breadcrumbs),"\n";
+        die "inherit_from loop!  target backtrace:\n  "
+            ,$target,"\n  ",join("\n  ", @breadcrumbs),"\n";
     }
 
     if (!defined($table{$target})) {
-       warn "Warning! target $target doesn't exist!\n";
-       return ();
+        warn "Warning! target $target doesn't exist!\n";
+        return ();
     }
     # Recurse through all inheritances.  They will be resolved on the
     # fly, so when this operation is done, they will all just be a
@@ -2858,22 +3077,22 @@ sub resolve_config {
     # this stage is done.
     my %combined_inheritance = ();
     if ($table{$target}->{inherit_from}) {
-       my @inherit_from =
-           map { ref($_) eq "CODE" ? $_->() : $_ } @{$table{$target}->{inherit_from}};
-       foreach (@inherit_from) {
-           my %inherited_config = resolve_config($_, $target, @breadcrumbs);
-
-           # 'template' is a marker that's considered private to
-           # the config that had it.
-           delete $inherited_config{template};
-
-           foreach (keys %inherited_config) {
-               if (!$combined_inheritance{$_}) {
-                   $combined_inheritance{$_} = [];
-               }
-               push @{$combined_inheritance{$_}}, $inherited_config{$_};
-           }
-       }
+        my @inherit_from =
+            map { ref($_) eq "CODE" ? $_->() : $_ } @{$table{$target}->{inherit_from}};
+        foreach (@inherit_from) {
+            my %inherited_config = resolve_config($_, $target, @breadcrumbs);
+
+            # 'template' is a marker that's considered private to
+            # the config that had it.
+            delete $inherited_config{template};
+
+            foreach (keys %inherited_config) {
+                if (!$combined_inheritance{$_}) {
+                    $combined_inheritance{$_} = [];
+                }
+                push @{$combined_inheritance{$_}}, $inherited_config{$_};
+            }
+        }
     }
 
     # We won't need inherit_from in this target any more, since we've
@@ -2894,14 +3113,14 @@ sub resolve_config {
     my $default_combiner = add();
 
     my %all_keys =
-       map { $_ => 1 } (keys %combined_inheritance,
-                        keys %{$table{$target}});
+        map { $_ => 1 } (keys %combined_inheritance,
+                         keys %{$table{$target}});
 
     sub process_values {
-       my $object    = shift;
-       my $inherited = shift;  # Always a [ list ]
-       my $target    = shift;
-       my $entry     = shift;
+        my $object    = shift;
+        my $inherited = shift;  # Always a [ list ]
+        my $target    = shift;
+        my $entry     = shift;
 
         $add_called = 0;
 
@@ -2926,16 +3145,16 @@ sub resolve_config {
     foreach (sort keys %all_keys) {
         my $previous = $combined_inheritance{$_};
 
-       # Current target doesn't have a value for the current key?
-       # Assign it the default combiner, the rest of this loop body
-       # will handle it just like any other coderef.
-       if (!exists $table{$target}->{$_}) {
-           $table{$target}->{$_} = $default_combiner;
-       }
+        # Current target doesn't have a value for the current key?
+        # Assign it the default combiner, the rest of this loop body
+        # will handle it just like any other coderef.
+        if (!exists $table{$target}->{$_}) {
+            $table{$target}->{$_} = $default_combiner;
+        }
 
-       $table{$target}->{$_} = process_values($table{$target}->{$_},
-                                              $combined_inheritance{$_},
-                                              $target, $_);
+        $table{$target}->{$_} = process_values($table{$target}->{$_},
+                                               $combined_inheritance{$_},
+                                               $target, $_);
         unless(defined($table{$target}->{$_})) {
             delete $table{$target}->{$_};
         }
@@ -2950,39 +3169,39 @@ sub resolve_config {
 }
 
 sub usage
-       {
-       print STDERR $usage;
-       print STDERR "\npick os/compiler from:\n";
-       my $j=0;
-       my $i;
+        {
+        print STDERR $usage;
+        print STDERR "\npick os/compiler from:\n";
+        my $j=0;
+        my $i;
         my $k=0;
-       foreach $i (sort keys %table)
-               {
-               next if $table{$i}->{template};
-               next if $i =~ /^debug/;
-               $k += length($i) + 1;
-               if ($k > 78)
-                       {
-                       print STDERR "\n";
-                       $k=length($i);
-                       }
-               print STDERR $i . " ";
-               }
-       foreach $i (sort keys %table)
-               {
-               next if $table{$i}->{template};
-               next if $i !~ /^debug/;
-               $k += length($i) + 1;
-               if ($k > 78)
-                       {
-                       print STDERR "\n";
-                       $k=length($i);
-                       }
-               print STDERR $i . " ";
-               }
-       print STDERR "\n\nNOTE: If in doubt, on Unix-ish systems use './config'.\n";
-       exit(1);
-       }
+        foreach $i (sort keys %table)
+                {
+                next if $table{$i}->{template};
+                next if $i =~ /^debug/;
+                $k += length($i) + 1;
+                if ($k > 78)
+                        {
+                        print STDERR "\n";
+                        $k=length($i);
+                        }
+                print STDERR $i . " ";
+                }
+        foreach $i (sort keys %table)
+                {
+                next if $table{$i}->{template};
+                next if $i !~ /^debug/;
+                $k += length($i) + 1;
+                if ($k > 78)
+                        {
+                        print STDERR "\n";
+                        $k=length($i);
+                        }
+                print STDERR $i . " ";
+                }
+        print STDERR "\n\nNOTE: If in doubt, on Unix-ish systems use './config'.\n";
+        exit(1);
+        }
 
 sub run_dofile
 {
@@ -2994,7 +3213,7 @@ sub run_dofile
     foreach (@templates) {
         die "Can't open $_, $!" unless -f $_;
     }
-    my $perlcmd = (quotify("maybeshell", $config{perl}))[0];
+    my $perlcmd = (quotify("maybeshell", $config{PERL}))[0];
     my $cmd = "$perlcmd \"-I.\" \"-Mconfigdata\" \"$dofile\" -o\"Configure\" \"".join("\" \"",@templates)."\" > \"$out.new\"";
     #print STDERR "DEBUG[run_dofile]: \$cmd = $cmd\n";
     system($cmd);
@@ -3004,28 +3223,27 @@ sub run_dofile
 
 sub compiler_predefined {
     state %predefined;
-    my $default_compiler = shift;
+    my $cc = shift;
 
     return () if $^O eq 'VMS';
 
-    die 'compiler_predefined called without a default compiler'
-        unless $default_compiler;
+    die 'compiler_predefined called without a compiler command'
+        unless $cc;
 
-    if (! $predefined{$default_compiler}) {
-        my $cc = "$config{cross_compile_prefix}$default_compiler";
+    if (! $predefined{$cc}) {
 
-        $predefined{$default_compiler} = {};
+        $predefined{$cc} = {};
 
         # collect compiler pre-defines from gcc or gcc-alike...
         open(PIPE, "$cc -dM -E -x c /dev/null 2>&1 |");
         while (my $l = <PIPE>) {
             $l =~ m/^#define\s+(\w+(?:\(\w+\))?)(?:\s+(.+))?/ or last;
-            $predefined{$default_compiler}->{$1} = $2 // '';
+            $predefined{$cc}->{$1} = $2 // '';
         }
         close(PIPE);
     }
 
-    return %{$predefined{$default_compiler}};
+    return %{$predefined{$cc}};
 }
 
 sub which
@@ -3052,13 +3270,16 @@ sub which
 sub env
 {
     my $name = shift;
+    my %opts = @_;
 
-    # Note that if $ENV{$name} doesn't exist or is undefined,
-    # $config{perlenv}->{$name} will be created with the value
-    # undef.  This is intentional.
+    unless ($opts{cacheonly}) {
+        # Note that if $ENV{$name} doesn't exist or is undefined,
+        # $config{perlenv}->{$name} will be created with the value
+        # undef.  This is intentional.
 
-    $config{perlenv}->{$name} = $ENV{$name}
-        if ! exists $config{perlenv}->{$name};
+        $config{perlenv}->{$name} = $ENV{$name}
+            if ! exists $config{perlenv}->{$name};
+    }
     return $config{perlenv}->{$name};
 }
 
@@ -3066,78 +3287,77 @@ sub env
 
 sub print_table_entry
 {
-    my $target = shift;
-    my %target = resolve_config($target);
+    local $now_printing = shift;
+    my %target = resolve_config($now_printing);
     my $type = shift;
 
     # Don't print the templates
     return if $target{template};
 
     my @sequence = (
-       "sys_id",
-       "cpp",
-       "cppflags",
-       "defines",
-       "includes",
-       "cc",
-       "cflags",
-       "unistd",
-       "ld",
-       "lflags",
-       "loutflag",
-       "plib_lflags",
-       "ex_libs",
-       "bn_ops",
-       "apps_aux_src",
-       "cpuid_asm_src",
-       "uplink_aux_src",
-       "bn_asm_src",
-       "ec_asm_src",
-       "des_asm_src",
-       "aes_asm_src",
-       "bf_asm_src",
-       "md5_asm_src",
-       "cast_asm_src",
-       "sha1_asm_src",
-       "rc4_asm_src",
-       "rmd160_asm_src",
-       "rc5_asm_src",
-       "wp_asm_src",
-       "cmll_asm_src",
-       "modes_asm_src",
-       "padlock_asm_src",
-       "chacha_asm_src",
-       "poly1035_asm_src",
-       "thread_scheme",
-       "perlasm_scheme",
-       "dso_scheme",
-       "shared_target",
-       "shared_cflag",
-       "shared_defines",
-       "shared_ldflag",
-       "shared_rcflag",
-       "shared_extension",
-       "dso_extension",
-       "obj_extension",
-       "exe_extension",
-       "ranlib",
-       "ar",
-       "arflags",
-       "aroutflag",
-       "rc",
-       "rcflags",
-       "rcoutflag",
-       "mt",
-       "mtflags",
-       "mtinflag",
-       "mtoutflag",
-       "multilib",
-       "build_scheme",
-       );
+        "sys_id",
+        "cpp",
+        "cppflags",
+        "defines",
+        "includes",
+        "cc",
+        "cflags",
+        "unistd",
+        "ld",
+        "lflags",
+        "loutflag",
+        "ex_libs",
+        "bn_ops",
+        "apps_aux_src",
+        "cpuid_asm_src",
+        "uplink_aux_src",
+        "bn_asm_src",
+        "ec_asm_src",
+        "des_asm_src",
+        "aes_asm_src",
+        "bf_asm_src",
+        "md5_asm_src",
+        "cast_asm_src",
+        "sha1_asm_src",
+        "rc4_asm_src",
+        "rmd160_asm_src",
+        "rc5_asm_src",
+        "wp_asm_src",
+        "cmll_asm_src",
+        "modes_asm_src",
+        "padlock_asm_src",
+        "chacha_asm_src",
+        "poly1035_asm_src",
+        "thread_scheme",
+        "perlasm_scheme",
+        "dso_scheme",
+        "shared_target",
+        "shared_cflag",
+        "shared_defines",
+        "shared_ldflag",
+        "shared_rcflag",
+        "shared_extension",
+        "dso_extension",
+        "obj_extension",
+        "exe_extension",
+        "ranlib",
+        "ar",
+        "arflags",
+        "aroutflag",
+        "rc",
+        "rcflags",
+        "rcoutflag",
+        "mt",
+        "mtflags",
+        "mtinflag",
+        "mtoutflag",
+        "multilib",
+        "build_scheme",
+        );
 
     if ($type eq "TABLE") {
-       print "\n";
-       print "*** $target\n";
+        print "\n";
+        print "*** $now_printing\n";
         foreach (@sequence) {
             if (ref($target{$_}) eq "ARRAY") {
                 printf "\$%-12s = %s\n", $_, join(" ", @{$target{$_}});
@@ -3146,19 +3366,19 @@ sub print_table_entry
             }
         }
     } elsif ($type eq "HASH") {
-       my $largest =
-           length((sort { length($a) <=> length($b) } @sequence)[-1]);
-       print "    '$target' => {\n";
-       foreach (@sequence) {
-           if ($target{$_}) {
+        my $largest =
+            length((sort { length($a) <=> length($b) } @sequence)[-1]);
+        print "    '$now_printing' => {\n";
+        foreach (@sequence) {
+            if ($target{$_}) {
                 if (ref($target{$_}) eq "ARRAY") {
                     print "      '",$_,"'"," " x ($largest - length($_))," => [ ",join(", ", map { "'$_'" } @{$target{$_}})," ],\n";
                 } else {
                     print "      '",$_,"'"," " x ($largest - length($_))," => '",$target{$_},"',\n";
                 }
-           }
-       }
-       print "    },\n";
+            }
+        }
+        print "    },\n";
     }
 }
 
@@ -3206,21 +3426,21 @@ sub absolutedir {
 
 sub quotify {
     my %processors = (
-       perl    => sub { my $x = shift;
-                        $x =~ s/([\\\$\@"])/\\$1/g;
-                        return '"'.$x.'"'; },
-       maybeshell => sub { my $x = shift;
-                           (my $y = $x) =~ s/([\\\"])/\\$1/g;
-                           if ($x ne $y || $x =~ m|\s|) {
-                               return '"'.$y.'"';
-                           } else {
-                               return $x;
-                           }
-                       },
-       );
+        perl    => sub { my $x = shift;
+                         $x =~ s/([\\\$\@"])/\\$1/g;
+                         return '"'.$x.'"'; },
+        maybeshell => sub { my $x = shift;
+                            (my $y = $x) =~ s/([\\\"])/\\$1/g;
+                            if ($x ne $y || $x =~ m|\s|) {
+                                return '"'.$y.'"';
+                            } else {
+                                return $x;
+                            }
+                        },
+        );
     my $for = shift;
     my $processor =
-       defined($processors{$for}) ? $processors{$for} : sub { shift; };
+        defined($processors{$for}) ? $processors{$for} : sub { shift; };
 
     return map { $processor->($_); } @_;
 }
@@ -3348,8 +3568,8 @@ sub tokenize {
     }
 
     if ($ENV{CONFIGURE_DEBUG_TOKENIZE}) {
-       print STDERR "DEBUG[tokenize]: Parsed '$debug_line' into:\n";
-       print STDERR "DEBUG[tokenize]: ('", join("', '", @result), "')\n";
+        print STDERR "DEBUG[tokenize]: Parsed '$debug_line' into:\n";
+        print STDERR "DEBUG[tokenize]: ('", join("', '", @result), "')\n";
     }
     return @result;
 }