Don't build RC4 ciphersuites into libssl by default
[openssl.git] / Configure
index afd905c4acac30d76679423e735a3a39e7ca0dbe..e57ff602f9a272e1598c8ec275d366e2c47ccdc0 100755 (executable)
--- a/Configure
+++ b/Configure
@@ -15,7 +15,7 @@ use File::Path qw/mkpath/;
 
 # see INSTALL for instructions.
 
-my $usage="Usage: Configure [no-<cipher> ...] [enable-<cipher> ...] [experimental-<cipher> ...] [-Dxxx] [-lxxx] [-Lxxx] [-fxxx] [-Kxxx] [no-hw-xxx|no-hw] [[no-]threads] [[no-]shared] [[no-]zlib|zlib-dynamic] [no-asm] [no-dso] [no-egd] [sctp] [386] [--prefix=DIR] [--openssldir=OPENSSLDIR] [--with-xxx[=vvv]] [--config=FILE] os/compiler[:flags]\n";
+my $usage="Usage: Configure [no-<cipher> ...] [enable-<cipher> ...] [-Dxxx] [-lxxx] [-Lxxx] [-fxxx] [-Kxxx] [no-hw-xxx|no-hw] [[no-]threads] [[no-]shared] [[no-]zlib|zlib-dynamic] [no-asm] [no-dso] [no-egd] [sctp] [386] [--prefix=DIR] [--openssldir=OPENSSLDIR] [--with-xxx[=vvv]] [--config=FILE] os/compiler[:flags]\n";
 
 # Options:
 #
@@ -32,10 +32,6 @@ my $usage="Usage: Configure [no-<cipher> ...] [enable-<cipher> ...] [experimenta
 #               This becomes the value of OPENSSLDIR in Makefile and in C.
 #               (Default: PREFIX/ssl)
 #
-# --install_prefix  Additional prefix for package builders (empty by
-#               default).  This needn't be set in advance, you can
-#               just as well use "make INSTALL_PREFIX=/whatever install".
-#
 # --cross-compile-prefix Add specified prefix to binutils components.
 #
 # --api         One of 0.9.8, 1.0.0 or 1.1.0.  Do not compile support for
@@ -50,6 +46,8 @@ my $usage="Usage: Configure [no-<cipher> ...] [enable-<cipher> ...] [experimenta
 #               multithreaded applications (default is "threads" if we
 #               know how to do it)
 # [no-]shared  [don't] try to create shared libraries when supported.
+# [no-]pic      [don't] try to build position independent code when supported.
+#               If disabled, it also disables shared and dynamic-engine.
 # no-asm        do not use assembler
 # no-dso        do not compile in any native shared-library methods. This
 #               will ensure that all methods just return NULL.
@@ -59,6 +57,9 @@ my $usage="Usage: Configure [no-<cipher> ...] [enable-<cipher> ...] [experimenta
 #              library and will be loaded in run-time by the OpenSSL library.
 # sctp          include SCTP support
 # 386           generate 80386 code
+# enable-weak-ssl-ciphers
+#               Enable weak ciphers that are disabled by default. This currently
+#               only includes RC4 based ciphers.
 # no-sse2      disables IA-32 SSE2 code, above option implies no-sse2
 # no-<cipher>   build without specified algorithm (rsa, idea, rc5, ...)
 # -<xxx> +<xxx> compiler options are passed through
@@ -80,23 +81,42 @@ my $usage="Usage: Configure [no-<cipher> ...] [enable-<cipher> ...] [experimenta
 # Minimum warning options... any contributions to OpenSSL should at least get
 # past these.
 
-my $gcc_devteam_warn = "-Wall -pedantic -DPEDANTIC -Wno-long-long -Wsign-compare -Wmissing-prototypes -Wshadow -Wformat -Wtype-limits -Werror -DREF_CHECK -DDEBUG_UNUSED";
+my $gcc_devteam_warn = "-DPEDANTIC -DREF_DEBUG -DDEBUG_UNUSED -DBIO_DEBUG"
+        . " -pedantic"
+        . " -Wall"
+        . " -Wno-long-long"
+        . " -Wsign-compare"
+        . " -Wmissing-prototypes"
+        . " -Wshadow"
+        . " -Wformat"
+        . " -Wtype-limits"
+        . " -Werror"
+        ;
 
 # These are used in addition to $gcc_devteam_warn when the compiler is clang.
 # TODO(openssl-team): fix problems and investigate if (at least) the
 # following warnings can also be enabled:
-# -Wswitch-enum, -Wunused-macros, -Wmissing-field-initializers,
-# -Wcast-align,
-# -Wunreachable-code -Wunused-parameter -Wlanguage-extension-token
-# -Wextended-offsetof
-my $clang_devteam_warn = "-Wno-unused-parameter -Wno-missing-field-initializers -Wno-language-extension-token -Wno-extended-offsetof -Wconditional-uninitialized -Qunused-arguments -Wincompatible-pointer-types-discards-qualifiers -Wmissing-variable-declarations";
-
-# Warn that "make depend" should be run?
-my $warn_make_depend = 0;
-
-# These are used in addition to $gcc_devteam_warn unless this is a mingw build.
-# This adds backtrace information to the memory leak info.
-my $memleak_devteam_backtrace = "-rdynamic -DCRYPTO_MDEBUG_BACKTRACE";
+#       -Wswitch-enum
+#       -Wcast-align
+#       -Wunreachable-code
+#       -Wlanguage-extension-token -- no, we use asm()
+#       -Wunused-macros -- no, too tricky for BN and _XOPEN_SOURCE etc
+#       -Wextended-offsetof -- no, needed in CMS ASN1 code
+my $clang_devteam_warn = ""
+        . " -Qunused-arguments"
+        . " -Wextra"
+        . " -Wno-unused-parameter"
+        . " -Wno-missing-field-initializers"
+        . " -Wno-language-extension-token"
+        . " -Wno-extended-offsetof"
+        . " -Wconditional-uninitialized"
+        . " -Wincompatible-pointer-types-discards-qualifiers"
+        . " -Wmissing-variable-declarations"
+        ;
+
+# This adds backtrace information to the memory leak info.  Is only used
+# when crypto-mdebug-backtrace is enabled.
+my $memleak_devteam_backtrace = "-rdynamic";
 
 my $strict_warnings = 0;
 
@@ -107,7 +127,7 @@ my $strict_warnings = 0;
 # which has to be accompanied by explicit -D_THREAD_SAFE and
 # sometimes -D_REENTRANT. FreeBSD 5.x expands it as -lc_r, which
 # seems to be sufficient?
-my $BSDthreads="-pthread -D_THREAD_SAFE -D_REENTRANT";
+our $BSDthreads="-pthread -D_THREAD_SAFE -D_REENTRANT";
 
 #
 # API compability name to version number mapping.
@@ -119,9 +139,9 @@ my $apitable = {
     "0.9.8" => "0x00908000L",
 };
 
-my $base_target = "BASE";   # The template that all other inherit from
 our %table = ();
 our %config = ();
+our %withargs = ();
 
 # Forward declarations ###############################################
 
@@ -187,18 +207,11 @@ $config{prefix}="";
 $config{openssldir}="";
 $config{processor}="";
 $config{libdir}="";
-$config{install_prefix}= "$ENV{'INSTALL_PREFIX'}";
 $config{cross_compile_prefix}="";
 $config{fipslibdir}="/usr/local/ssl/fips-2.0/lib/";
 my $nofipscanistercheck=0;
 $config{baseaddr}="0xFB00000";
-my $no_threads=0;
-my $threads=0;
-$config{no_shared}=0; # but "no-shared" is default
-my $zlib=1;      # but "no-zlib" is default
-my $no_rfc3779=0;
-my $no_asm=0;
-my $no_dso=0;
+my $auto_threads=1;    # enable threads automatically? true by default
 my $default_ranlib;
 $config{fips}=0;
 
@@ -212,7 +225,7 @@ $config{sdirs} = [
     "bn", "ec", "rsa", "dsa", "dh", "dso", "engine",
     "buffer", "bio", "stack", "lhash", "rand", "err",
     "evp", "asn1", "pem", "x509", "x509v3", "conf", "txt_db", "pkcs7", "pkcs12", "comp", "ocsp", "ui",
-    "cms", "ts", "jpake", "srp", "store", "cmac", "ct", "async", "kdf"
+    "cms", "ts", "srp", "cmac", "ct", "async", "kdf"
     ];
 
 # Known TLS and DTLS protocols
@@ -238,6 +251,7 @@ my @disablables = (
     "cms",
     "comp",
     "crypto-mdebug",
+    "crypto-mdebug-backtrace",
     "ct",
     "deprecated",
     "des",
@@ -246,7 +260,7 @@ my @disablables = (
     "dsa",
     "dso",
     "dtls",
-    "dynamic[-_]engine",
+    "dynamic-engine",
     "ec",
     "ec2m",
     "ecdh",
@@ -254,13 +268,13 @@ my @disablables = (
     "ec_nistp_64_gcc_128",
     "egd",
     "engine",
-    "err",                     # Really???
+    "err",
+    "filenames",
     "heartbeats",
     "hmac",
     "hw(-.+)?",
     "idea",
-    "jpake",
-    "locking",                 # Really???
+    "locking",
     "md2",
     "md4",
     "md5",
@@ -269,6 +283,7 @@ my @disablables = (
     "nextprotoneg",
     "ocb",
     "ocsp",
+    "pic",
     "poly1305",
     "posix-io",
     "psk",
@@ -278,6 +293,7 @@ my @disablables = (
     "rdrand",
     "rfc3779",
     "rijndael",                        # Old AES name
+    "ripemd",
     "rmd160",
     "rsa",
     "scrypt",
@@ -294,11 +310,13 @@ my @disablables = (
     "ssl-trace",
     "static-engine",
     "stdio",
-    "store",
     "threads",
     "tls",
+    "ts",
+    "ui",
     "unit-test",
     "whirlpool",
+    "weak-ssl-ciphers",
     "zlib",
     "zlib-dynamic",
     );
@@ -308,24 +326,28 @@ foreach my $proto ((@tls, @dtls))
        push(@disablables, "$proto-method");
        }
 
+my @deprecated_disablables = (
+    "ssl2",
+    );
+
 # All of the following is disabled by default (RC5 was enabled before 0.9.8):
 
-my %disabled = ( # "what"         => "comment" [or special keyword "experimental"]
-                "ec_nistp_64_gcc_128" => "default",
-                "egd"            => "default",
-                "jpake"          => "experimental",
-                "md2"            => "default",
-                "rc5"            => "default",
-                "sctp"           => "default",
-                "shared"         => "default",
-                "ssl-trace"      => "default",
-                "store"          => "experimental",
-                "unit-test"      => "default",
-                "zlib"           => "default",
-                "zlib-dynamic"   => "default",
-                "crypto-mdebug"  => "default",
-              );
-my @experimental = ();
+our %disabled = ( # "what"         => "comment"
+                 "ec_nistp_64_gcc_128" => "default",
+                 "egd"                 => "default",
+                 "md2"                 => "default",
+                 "rc5"                 => "default",
+                 "sctp"                => "default",
+                 "shared"              => "default",
+                 "ssl-trace"           => "default",
+                 "static-engine"       => "default",
+                 "unit-test"           => "default",
+                 "weak-ssl-ciphers"    => "default",
+                 "zlib"                => "default",
+                 "zlib-dynamic"        => "default",
+                 "crypto-mdebug"       => "default",
+                 "heartbeats"          => "default",
+               );
 
 # Note: => pair form used for aesthetics, not to truly make a hash table
 my @disable_cascades = (
@@ -338,7 +360,6 @@ my @disable_cascades = (
     "rijndael"         => [ "aes" ],
     "des"              => [ "mdc2" ],
     "ec"               => [ "ecdsa", "ecdh" ],
-    "psk"              => [ "jpake" ],
 
     "dgram"            => [ "dtls" ],
     "dtls"             => [ @dtls ],
@@ -365,6 +386,14 @@ my @disable_cascades = (
 
     # SRP and HEARTBEATS require TLSEXT
     "tlsext"           => [ "srp", "heartbeats" ],
+
+    "crypto-mdebug"     => [ "crypto-mdebug-backtrace" ],
+
+    # Without DSO, we can't load dynamic engines, so don't build them dynamic
+    "dso"               => [ "dynamic-engine" ],
+
+    # Without position independent code, there can be no shared libraries or DSOs
+    "pic"               => [ "shared", "dynamic-engine" ],
     );
 
 # Avoid protocol support holes.  Also disable all versions below N, if version
@@ -385,30 +414,28 @@ while ((my $first, my $second) = (shift @list, shift @list)) {
     unshift @list, $second;
 }
 
-# Construct the string of what $config{depflags} should look like with the defaults
-# from %disabled above.  (we need this to see if we should advise the user
-# to run "make depend"):
-my $default_depflags = join(" ",
-    map { my $x = $_; $x =~ tr{[a-z]-}{[A-Z]_}; "-DOPENSSL_NO_$x"; }
-    grep { $disabled{$_} !~ /\(no-depflags\)$/ }
-    sort keys %disabled);
-
 # Explicit "no-..." options will be collected in %disabled along with the defaults.
-# To remove something from %disabled, use "enable-foo" (unless it's experimental).
+# To remove something from %disabled, use "enable-foo".
 # For symmetry, "disable-foo" is a synonym for "no-foo".
 
-# For features called "experimental" here, a more explicit "experimental-foo" is needed to enable.
-# We will collect such requests in @experimental.
-# To avoid accidental use of experimental features, applications will have to use -DOPENSSL_EXPERIMENTAL_FOO.
+my @generated_headers = (
+    "include/openssl/opensslconf.h",
+    "crypto/include/internal/bn_conf.h",
+    "crypto/include/internal/dso_conf.h"
+    );
+
+my @generated_by_make_headers = (
+    "crypto/buildinf.h"
+    );
 
 
 my $no_sse2=0;
 
 &usage if ($#ARGV < 0);
 
-my $flags="";
-$config{depflags}="";
-$config{openssl_experimental_defines}=[];
+my $user_cflags="";
+my @user_defines=();
+my $unified = 0;
 $config{openssl_api_defines}=[];
 $config{openssl_algorithm_defines}=[];
 $config{openssl_thread_defines}=[];
@@ -417,9 +444,7 @@ $config{openssl_other_defines}=[];
 my $libs="";
 my $target="";
 $config{options}="";
-my $make_depend=0;
-my %withargs=();
-my $build_prefix = "release_";
+$config{build_type} = "release";
 
 my @argvcopy=@ARGV;
 
@@ -451,7 +476,7 @@ if (grep /^reconf(igure)?$/, @argvcopy) {
         # centered information gathering the reading configdata.pm
         #
         while (<IN>) {
-            chomp;
+            s|\R$||;
             if (/^CONFIGURE_ARGS=\s*(.*)\s*/) {
                 # Older form, we split the string and hope for the best
                 @argvcopy = split /\s+/, $_;
@@ -474,8 +499,16 @@ if (grep /^reconf(igure)?$/, @argvcopy) {
 $config{perlargv} = [ @argvcopy ];
 
 my %unsupported_options = ();
+my %deprecated_options = ();
 foreach (@argvcopy)
        {
+       # VMS is a case insensitive environment, and depending on settings
+       # out of our control, we may receive options uppercased.  Let's
+       # downcase at least the part before any equal sign.
+       if ($^O eq "VMS")
+               {
+               s/^([^=]*)/lc($1)/e;
+               }
        s /^-no-/no-/; # some people just can't read the instructions
 
        # rewrite some options in "enable-..." form
@@ -485,10 +518,15 @@ foreach (@argvcopy)
        s /^zlib$/enable-zlib/;
        s /^zlib-dynamic$/enable-zlib-dynamic/;
 
-        if (/^(no|disable|enable|experimental)-(.+)$/)
+        if (/^(no|disable|enable)-(.+)$/)
                {
                my $word = $2;
-               if (!grep { $word =~ /^${_}$/ } @disablables)
+               if (grep { $word =~ /^${_}$/ } @deprecated_disablables)
+                       {
+                       $deprecated_options{$_} = 1;
+                       next;
+                       }
+               elsif (!grep { $word =~ /^${_}$/ } @disablables)
                        {
                        $unsupported_options{$_} = 1;
                        next;
@@ -496,55 +534,69 @@ foreach (@argvcopy)
                }
        if (/^no-(.+)$/ || /^disable-(.+)$/)
                {
-               if (!($disabled{$1} eq "experimental"))
-                       {
-                       foreach my $proto ((@tls, @dtls))
-                               {
-                               if ($1 eq "$proto-method")
-                                       {
-                                       $disabled{"$proto"} = "option($proto-method)";
-                                       last;
-                                       }
-                               }
-                       if ($1 eq "dtls")
-                               {
-                                foreach my $proto (@dtls)
-                                       {
-                                       $disabled{$proto} = "option(dtls)";
-                                       }
-                               }
-                       elsif ($1 eq "ssl")
-                               {
-                               # Last one of its kind
-                               $disabled{"ssl3"} = "option(ssl)";
-                               }
-                       elsif ($1 eq "tls")
-                               {
-                                # XXX: Tests will fail if all SSL/TLS
-                                # protocols are disabled.
-                                foreach my $proto (@tls)
-                                       {
-                                       $disabled{$proto} = "option(tls)";
-                                       }
-                               }
-                       else
-                               {
-                               $disabled{$1} = "option";
-                               }
-                       }
+                foreach my $proto ((@tls, @dtls))
+                        {
+                        if ($1 eq "$proto-method")
+                                {
+                                $disabled{"$proto"} = "option($proto-method)";
+                                last;
+                                }
+                        }
+                if ($1 eq "dtls")
+                        {
+                        foreach my $proto (@dtls)
+                                {
+                                $disabled{$proto} = "option(dtls)";
+                                }
+                        }
+                elsif ($1 eq "ssl")
+                        {
+                        # Last one of its kind
+                        $disabled{"ssl3"} = "option(ssl)";
+                        }
+                elsif ($1 eq "tls")
+                        {
+                        # XXX: Tests will fail if all SSL/TLS
+                        # protocols are disabled.
+                        foreach my $proto (@tls)
+                                {
+                                $disabled{$proto} = "option(tls)";
+                                }
+                        }
+                elsif ($1 eq "static-engine")
+                        {
+                        delete $disabled{"dynamic-engine"};
+                        }
+                elsif ($1 eq "dynamic-engine")
+                        {
+                        $disabled{"dynamic-engine"} = "option";
+                        }
+                else
+                        {
+                        $disabled{$1} = "option";
+                        }
+               # No longer an automatic choice
+               $auto_threads = 0 if ($1 eq "threads");
                }
-       elsif (/^enable-(.+)$/ || /^experimental-(.+)$/)
+       elsif (/^enable-(.+)$/)
                {
+                if ($1 eq "static-engine")
+                        {
+                        $disabled{"dynamic-engine"} = "option";
+                        }
+                elsif ($1 eq "dynamic-engine")
+                        {
+                        delete $disabled{"dynamic-engine"};
+                        }
+                elsif ($1 eq "zlib-dynamic")
+                        {
+                        delete $disabled{"zlib"};
+                        }
                my $algo = $1;
-               if ($disabled{$algo} eq "experimental")
-                       {
-                       die "You are requesting an experimental feature; please say 'experimental-$algo' if you are sure\n"
-                               unless (/^experimental-/);
-                       push @experimental, $algo;
-                       }
                delete $disabled{$algo};
 
-               $threads = 1 if ($algo eq "threads");
+               # No longer an automatic choice
+               $auto_threads = 0 if ($1 eq "threads");
                }
        elsif (/^--strict-warnings$/)
                {
@@ -552,11 +604,11 @@ foreach (@argvcopy)
                }
        elsif (/^--debug$/)
                {
-               $build_prefix = "debug_";
+               $config{build_type} = "debug";
                }
        elsif (/^--release$/)
                {
-               $build_prefix = "release_";
+               $config{build_type} = "release";
                }
        elsif (/^386$/)
                { $config{processor}=386; }
@@ -577,9 +629,15 @@ foreach (@argvcopy)
                }
        elsif (/^[-+]/)
                {
-               if (/^--prefix=(.*)$/)
+               if (/^--unified$/)
+                       {
+                       $unified=1;
+                       }
+               elsif (/^--prefix=(.*)$/)
                        {
                        $config{prefix}=$1;
+                       die "Directory given with --prefix MUST be absolute\n"
+                               unless file_name_is_absolute($config{prefix});
                        }
                elsif (/^--api=(.*)$/)
                        {
@@ -593,10 +651,6 @@ foreach (@argvcopy)
                        {
                        $config{openssldir}=$1;
                        }
-               elsif (/^--install.prefix=(.*)$/)
-                       {
-                       $config{install_prefix}=$1;
-                       }
                elsif (/^--with-zlib-lib=(.*)$/)
                        {
                        $withargs{zlib_lib}=$1;
@@ -625,17 +679,16 @@ foreach (@argvcopy)
                        {
                        $libs.=$_." ";
                        }
+               elsif (/^-D(.*)$/)
+                       {
+                       push @user_defines, $1;
+                       }
                else    # common if (/^[-+]/), just pass down...
                        {
                        $_ =~ s/%([0-9a-f]{1,2})/chr(hex($1))/gei;
-                       $flags.=$_." ";
+                       $user_cflags.=" ".$_;
                        }
                }
-       elsif ($_ =~ /^([^:]+):(.+)$/)
-               {
-               eval "\$table{\$1} = \"$2\""; # allow $xxx constructs in the string
-               $target=$1;
-               }
        else
                {
                die "target already defined - $target (offending arg: $_)\n" if ($target ne "");
@@ -658,6 +711,11 @@ foreach (@argvcopy)
                die "***** Unsupported api compatibility level: $config{api}\n",
         }
 
+       if (keys %deprecated_options)
+               {
+               warn "***** Deprecated options: ",
+                       join(", ", keys %deprecated_options), "\n";
+               }
        if (keys %unsupported_options)
                {
                die "***** Unsupported options: ",
@@ -723,21 +781,27 @@ foreach (sort (keys %disabled))
        printf "    no-%-12s %-10s", $_, "[$disabled{$_}]";
 
        if (/^dso$/)
-               { $no_dso = 1; }
+               { }
        elsif (/^threads$/)
-               { $no_threads = 1; }
+               { }
        elsif (/^shared$/)
-               { $config{no_shared} = 1; }
+               { }
+       elsif (/^pic$/)
+               { }
        elsif (/^zlib$/)
-               { $zlib = 0; }
-       elsif (/^static-engine$/)
+               { }
+       elsif (/^dynamic-engine$/)
                { }
        elsif (/^zlib-dynamic$/)
                { }
        elsif (/^sse2$/)
                { $no_sse2 = 1; }
        elsif (/^engine$/)
-               { @{$config{dirs}} = grep !/^engine$/, @{$config{dirs}}; }
+               {
+               @{$config{dirs}} = grep !/^engines$/, @{$config{dirs}};
+               @{$config{sdirs}} = grep !/^engine$/, @{$config{sdirs}};
+               push @{$config{openssl_other_defines}}, "OPENSSL_NO_ENGINE";
+               }
        else
                {
                my ($ALGO, $algo);
@@ -749,15 +813,13 @@ foreach (sort (keys %disabled))
                        push @{$config{openssl_other_defines}}, "OPENSSL_NO_$ALGO";
                        print " OPENSSL_NO_$ALGO";
 
-                       if (/^err$/)    { $flags .= "-DOPENSSL_NO_ERR "; }
-                       elsif (/^asm$/) { $no_asm = 1; }
+                       if (/^err$/)    { push @user_defines, "OPENSSL_NO_ERR"; }
                        }
                else
                        {
                        ($ALGO,$algo) = ("RMD160","rmd160") if ($algo eq "ripemd");
 
                        push @{$config{openssl_algorithm_defines}}, "OPENSSL_NO_$ALGO";
-                       $config{depflags} .= " -DOPENSSL_NO_$ALGO";
                        print " OPENSSL_NO_$ALGO";
 
                        # fix-up crypto/directory name(s)
@@ -772,24 +834,12 @@ foreach (sort (keys %disabled))
        print "\n";
        }
 
-my $exp_cflags = "";
-
-foreach (sort @experimental)
-       {
-       my $ALGO;
-       ($ALGO = $_) =~ tr/[a-z]/[A-Z]/;
-
-       # opensslconf.h will set OPENSSL_NO_... unless OPENSSL_EXPERIMENTAL_... is defined
-       push @{$config{openssl_experimental_defines}}, "OPENSSL_NO_$ALGO";
-       $exp_cflags .= " -DOPENSSL_EXPERIMENTAL_$ALGO";
-       }
-
 print "Configuring for $target\n";
 
 # Support for legacy targets having a name starting with 'debug-'
 my ($d, $t) = $target =~ m/^(debug-)?(.*)$/;
 if ($d) {
-    $build_prefix = "debug_";
+    $config{build_type} = "debug";
 
     # If we do not find debug-foo in the table, the target is set to foo.
     if (!$table{$target}) {
@@ -797,76 +847,67 @@ if ($d) {
     }
 }
 $config{target} = $target;
-delete $table{$base_target}->{template}; # or the next test will fail.
-my %target = ( %{$table{$base_target}}, resolve_config($target) );
+my %target = resolve_config($target);
 
 &usage if (!%target || $target{template});
 
+%target = ( %{$table{DEFAULTS}}, %target );
+
 $target{exe_extension}="";
-$target{exe_extension}=".exe" if ($config{target} eq "Cygwin" || $config{target} eq "DJGPP" || $config{target} =~ /^mingw/);
+$target{exe_extension}=".exe" if ($config{target} eq "DJGPP"
+                                  || $config{target} =~ /^(?:Cygwin|mingw)/);
 $target{exe_extension}=".nlm" if ($config{target} =~ /netware/);
 $target{exe_extension}=".pm"  if ($config{target} =~ /vos/);
 
-$default_ranlib        = which("ranlib") || "true";
-$config{perl}  = $ENV{'PERL'} || which("perl5") || which("perl") || "perl";
-my $make       = $ENV{'MAKE'} || "make";
+($target{shared_extension_simple}=$target{shared_extension})
+    =~ s|\.\$\(SHLIB_MAJOR\)\.\$\(SHLIB_MINOR\)||;
+$target{dso_extension}=$target{shared_extension_simple};
+($target{shared_import_extension}=$target{shared_extension_simple}.".a")
+    if ($config{target} =~ /^(?:Cygwin|mingw)/);
+
 
 $config{cross_compile_prefix} = $ENV{'CROSS_COMPILE'}
     if $config{cross_compile_prefix} eq "";
 
-$config{prefix} = "/usr/local" if !$config{prefix};
-$config{openssldir} = "ssl" if !$config{openssldir};
-$config{openssldir} = catdir($config{prefix}, $config{openssldir})
-    unless file_name_is_absolute($config{openssldir});
-
-# Allow environment CC to override compiler...
-$target{cc} = $ENV{CC} || $target{cc};
+# Allow overriding the names of some tools.  USE WITH CARE
+$config{perl} =    $ENV{'PERL'}    || which("perl5") || which("perl") || "perl";
+$target{cc} =      $ENV{'CC'}      || $target{cc}      || "cc";
+$target{ranlib} =  $ENV{'RANLIB'}  || $target{ranlib}  || which("ranlib") || "true";
+$target{ar} =      $ENV{'AR'}      || $target{ar}      || "ar";
+$target{nm} =      $ENV{'NM'}      || $target{nm}      || "nm";
 
-# For cflags, lflags, plib_lflags and ex_libs, add the debug_ or release_
-# attributes.
+# For cflags, lflags, plib_lflags, ex_libs and defines, add the debug_
+# or release_ attributes.
 # Do it in such a way that no spurious space is appended (hence the grep).
-$config{cflags} = join(" ",
-                      grep { $_ ne "" } ($target{cflags},
-                                         $target{$build_prefix."cflags"}));
-$config{lflags} = join(" ",
-                      grep { $_ ne "" } ($target{lflags},
-                                         $target{$build_prefix."lflags"}));
-$config{plib_lflags} = join(" ",
-                           grep { $_  ne "" } ($target{plib_lflags},
-                                               $target{$build_prefix."plib_lflags"}));
-$config{ex_libs} = join(" ",
-                       grep { $_  ne "" } ($target{ex_libs},
-                                           $target{$build_prefix."ex_libs"}));
-
-$target{ranlib} = $ENV{'RANLIB'} || $target{ranlib} || $default_ranlib;
-$target{ar} = $ENV{'AR'} || "ar";
-$target{arflags} = "" if !defined($target{arflags});
-$target{nm} = "nm";
+$config{defines} = [];
+$config{cflags} = "";
+$config{ex_libs} = "";
+$config{shared_ldflag} = "";
+
 # Make sure build_scheme is consistent.
 $target{build_scheme} = [ $target{build_scheme} ]
     if ref($target{build_scheme}) ne "ARRAY";
 
+###### TO BE REMOVED BEFORE FINAL RELEASE
+######
+###### If the user has chosen --unified, we give it to them.
+###### The same happens if we detect that they try to build out-of-source.
+if ($target{build_file} eq "Makefile"
+    && $target{build_scheme}->[0] eq "unixmake"
+    && ($unified || $srcdir ne $blddir)) {
+    $target{build_scheme} = [ "unified", "unix" ];
+}
+
 my ($builder, $builder_platform, @builder_opts) =
     @{$target{build_scheme}};
 
-# if $config{prefix}/lib$target{multilib} is not an existing directory, then
-# assume that it's not searched by linker automatically, in
-# which case adding $target{multilib} suffix causes more grief than
-# we're ready to tolerate, so don't...
-$target{multilib}="" if !-d "$config{prefix}/lib$target{multilib}";
-
-$config{libdir}="lib$target{multilib}" if $config{libdir} eq "";
-$config{enginesdir}=$config{prefix} . "/" . $config{libdir}  . "/engines";
-
-$config{cflags} .= "$exp_cflags";
-
-if ($target =~ /^mingw/ && `$target{cc} --target-help 2>&1` !~ m/-mno-cygwin/m)
+if ($target =~ /^mingw/ && `$target{cc} --target-help 2>&1` =~ m/-mno-cygwin/m)
        {
-       $config{cflags} =~ s/-mno-cygwin\s*//;
-       $target{shared_ldflag} =~ s/-mno-cygwin\s*//;
+       $config{cflags} .= " -mno-cygwin";
+       $config{shared_ldflag} .= " -mno-cygwin";
        }
 
-if ($target =~ /linux.*-mips/ && !$no_asm && $flags !~ /-m(ips|arch=)/) {
+if ($target =~ /linux.*-mips/ && !$disabled{asm} && $user_cflags !~ /-m(ips|arch=)/) {
        # minimally required architecture flags for assembly modules
        $config{cflags}="-mips2 $config{cflags}" if ($target =~ /mips32/);
        $config{cflags}="-mips3 $config{cflags}" if ($target =~ /mips64/);
@@ -874,9 +915,7 @@ if ($target =~ /linux.*-mips/ && !$no_asm && $flags !~ /-m(ips|arch=)/) {
 
 my $no_shared_warn=0;
 my $no_user_cflags=0;
-
-if ($flags ne "")      { $config{cflags}="$flags$config{cflags}"; }
-else                   { $no_user_cflags=1;       }
+my $no_user_defines=0;
 
 # The DSO code currently always implements all functions so that no
 # applications will have to worry about that from a compilation point
@@ -884,85 +923,66 @@ else                      { $no_user_cflags=1;       }
 # has support compiled in for them. Currently each method is enabled
 # by a define "DSO_<name>" ... we translate the "dso_scheme" config
 # string entry into using the following logic;
-my $dso_cflags;
-if (!$no_dso && $target{dso_scheme} ne "")
+if (!$disabled{dso} && $target{dso_scheme} ne "")
        {
        $target{dso_scheme} =~ tr/[a-z]/[A-Z]/;
        if ($target{dso_scheme} eq "DLFCN")
                {
-               $dso_cflags = "-DDSO_DLFCN -DHAVE_DLFCN_H";
+               unshift @{$config{defines}}, "DSO_DLFCN", "HAVE_DLFCN_H";
                }
        elsif ($target{dso_scheme} eq "DLFCN_NO_H")
                {
-               $dso_cflags = "-DDSO_DLFCN";
+               unshift @{$config{defines}}, "DSO_DLFCN";
                }
        else
                {
-               $dso_cflags = "-DDSO_$target{dso_scheme}";
-               }
-       $config{cflags} = "$dso_cflags $config{cflags}";
-       }
-
-my $thread_cflags = "";
-my @thread_defines;
-if ($target{thread_cflag} ne "(unknown)" && !$no_threads)
-       {
-       # If we know how to do it, support threads by default.
-       $threads = 1;
-       }
-if ($target{thread_cflag} eq "(unknown)" && $threads)
-       {
-       # If the user asked for "threads", [s]he is also expected to
-       # provide any system-dependent compiler options that are
-       # necessary.
-       if ($no_user_cflags)
-               {
-               print "You asked for multi-threading support, but didn't\n";
-               print "provide any system-specific compiler options\n";
-               exit(1);
+               unshift @{$config{defines}}, "DSO_$target{dso_scheme}";
                }
-       $thread_cflags="-DOPENSSL_THREADS" ;
-       push @thread_defines, "OPENSSL_THREADS";
-       }
-else
-       {
-       $thread_cflags="-DOPENSSL_THREADS $target{thread_cflag}";
-       push @thread_defines, "OPENSSL_THREADS";
        }
 
 $config{ex_libs}="$libs$config{ex_libs}" if ($libs ne "");
 
-if ($no_asm)
+if ($disabled{asm})
        {
-       $config{cflags}=~s/-D[BL]_ENDIAN//              if ($config{fips});
-       }
-
-if ($threads)
-       {
-       $config{cflags} = "$thread_cflags $config{cflags}" if $thread_cflags;
-       push @{$config{openssl_thread_defines}}, @thread_defines;
-       }
-
-if ($zlib)
-       {
-       $config{cflags} = "-DZLIB $config{cflags}";
-       if (defined($disabled{"zlib-dynamic"}))
+       if ($config{fips})
                {
-               if (defined($withargs{zlib_lib}))
-                       {
-                       $config{ex_libs} .= " -L" . $withargs{zlib_lib} . " -lz";
-                       }
-               else
-                       {
-                       $config{ex_libs} .= " -lz";
-                       }
-               }
-       else
-               {
-               $config{cflags} = "-DZLIB_SHARED $config{cflags}";
+               @{$config{defines}} = grep !/^[BL]_ENDIAN$/, @{$config{defines}};
+               @{$target{defines}} = grep !/^[BL]_ENDIAN$/, @{$target{defines}};
                }
        }
 
+# If threads aren't disabled, check how possible they are
+unless ($disabled{threads}) {
+    if ($auto_threads) {
+        # Enabled by default, disable it forcibly if unavailable
+        if ($target{thread_scheme} eq "(unknown)") {
+            $disabled{threads} = "unavailable";
+        }
+    } else {
+        # The user chose to enable threads explicitely, let's see
+        # if there's a chance that's possible
+        if ($target{thread_scheme} eq "(unknown)") {
+            # If the user asked for "threads" and we don't have internal
+            # knowledge how to do it, [s]he is expected to provide any
+            # system-dependent compiler options that are necessary.  We
+            # can't truly check that the given options are correct, but
+            # we expect the user to know what [s]He is doing.
+            if ($no_user_cflags && $no_user_defines) {
+                die "You asked for multi-threading support, but didn't\n"
+                    ,"provide any system-specific compiler options\n";
+            }
+        }
+    }
+}
+
+# If threads still aren't disabled, add a C macro to ensure the source
+# code knows about it.  Any other flag is taken care of by the configs.
+unless($disabled{threads}) {
+    foreach (("defines", "openssl_thread_defines")) {
+        push @{$config{$_}}, "OPENSSL_THREADS";
+    }
+}
+
 # With "deprecated" disable all deprecated features.
 if (defined($disabled{"deprecated"})) {
         $config{api} = $maxapi;
@@ -970,132 +990,113 @@ if (defined($disabled{"deprecated"})) {
 
 if ($target{shared_target} eq "")
        {
-       $no_shared_warn = 1 if !$config{no_shared} && !$config{fips};
-       $config{no_shared} = 1;
-       }
-if (!$config{no_shared})
-       {
-       if ($target{shared_cflag} ne "")
-               {
-               $config{cflags} = "$target{shared_cflag} -DOPENSSL_PIC $config{cflags}";
-               }
+       $no_shared_warn = 1
+           if ((!$disabled{shared} || !$disabled{"dynamic-engine"})
+               && !$config{fips});
+       $disabled{shared} = "no-shared-target";
+       $disabled{pic} = $disabled{shared} = $disabled{"dynamic-engine"} =
+           "no-shared-target";
        }
 
-if ($builder ne "mk1mf")
-       {
-       # add {no-}static-engine to options to allow mkdef.pl to work without extra arguments
-       if ($config{no_shared})
-               {
-               push @{$config{openssl_other_defines}}, "OPENSSL_NO_DYNAMIC_ENGINE";
-               $config{options}.=" static-engine";
-               }
-       else
-               {
-               push @{$config{openssl_other_defines}}, "OPENSSL_NO_STATIC_ENGINE";
-               $config{options}.=" no-static-engine";
-               }
-       }
+if ($disabled{"dynamic-engine"}) {
+        push @{$config{defines}}, "OPENSSL_NO_DYNAMIC_ENGINE";
+        $config{dynamic_engines} = 0;
+} else {
+        push @{$config{defines}}, "OPENSSL_NO_STATIC_ENGINE";
+        $config{dynamic_engines} = 1;
+}
 
 #
 # Platform fix-ups
 #
-# Unlike other OSes (like Solaris, Linux, Tru64, IRIX) BSD run-time
-# linkers (tested OpenBSD, NetBSD and FreeBSD) "demand" RPATH set on
-# .so objects. Apparently application RPATH is not global and does
-# not apply to .so linked with other .so. Problem manifests itself
-# when libssl.so fails to load libcrypto.so. One can argue that we
-# should engrave this into Makefile.shared rules or into BSD-* config
-# lines above. Meanwhile let's try to be cautious and pass -rpath to
-# linker only when --prefix is not /usr.
-if ($target =~ /^BSD-/)
+
+# This saves the build files from having to check
+if ($disabled{pic})
        {
-       $target{shared_ldflag}.=" -Wl,-rpath,\$\$(LIBRPATH)" if ($config{prefix} !~ m|^/usr[/]*$|);
+       $target{shared_cflag} = $target{shared_ldflag} =
+               $target{shared_rcflag} = "";
        }
-
-if ($target{sys_id} ne "")
+else
        {
-       #$config{cflags}="-DOPENSSL_SYS_$target{sys_id} $config{cflags}";
-       push @{$config{openssl_sys_defines}}, "OPENSSL_SYS_$target{sys_id}";
+       push @{$config{defines}}, "OPENSSL_PIC";
        }
 
-if ($target{ranlib} eq "")
+if ($target{sys_id} ne "")
        {
-       $target{ranlib} = $default_ranlib;
+       push @{$config{openssl_sys_defines}}, "OPENSSL_SYS_$target{sys_id}";
        }
 
-if (!$no_asm) {
-    $target{cpuid_asm_src}=$table{BASE}->{cpuid_asm_src} if ($config{processor} eq "386");
-    $target{cpuid_asm_src}.=" uplink.c uplink-x86.s" if ($config{cflags} =~ /-DOPENSSL_USE_APPLINK/);
-
+unless ($disabled{asm}) {
+    $target{cpuid_asm_src}=$table{DEFAULTS}->{cpuid_asm_src} if ($config{processor} eq "386");
     $target{bn_asm_src} =~ s/\w+-gf2m.c// if (defined($disabled{ec2m}));
 
     # bn-586 is the only one implementing bn_*_part_words
-    $config{cflags}.=" -DOPENSSL_BN_ASM_PART_WORDS" if ($target{bn_asm_src} =~ /bn-586/);
-    $config{cflags}.=" -DOPENSSL_IA32_SSE2" if (!$no_sse2 && $target{bn_asm_src} =~ /86/);
+    push @{$config{defines}}, "OPENSSL_BN_ASM_PART_WORDS" if ($target{bn_asm_src} =~ /bn-586/);
+    push @{$config{defines}}, "OPENSSL_IA32_SSE2" if (!$no_sse2 && $target{bn_asm_src} =~ /86/);
 
-    $config{cflags}.=" -DOPENSSL_BN_ASM_MONT" if ($target{bn_asm_src} =~ /-mont/);
-    $config{cflags}.=" -DOPENSSL_BN_ASM_MONT5" if ($target{bn_asm_src} =~ /-mont5/);
-    $config{cflags}.=" -DOPENSSL_BN_ASM_GF2m" if ($target{bn_asm_src} =~ /-gf2m/);
+    push @{$config{defines}}, "OPENSSL_BN_ASM_MONT" if ($target{bn_asm_src} =~ /-mont/);
+    push @{$config{defines}}, "OPENSSL_BN_ASM_MONT5" if ($target{bn_asm_src} =~ /-mont5/);
+    push @{$config{defines}}, "OPENSSL_BN_ASM_GF2m" if ($target{bn_asm_src} =~ /-gf2m/);
 
     if ($config{fips}) {
        push @{$config{openssl_other_defines}}, "OPENSSL_FIPS";
     }
 
     if ($target{sha1_asm_src}) {
-       $config{cflags}.=" -DSHA1_ASM"   if ($target{sha1_asm_src} =~ /sx86/ || $target{sha1_asm_src} =~ /sha1/);
-       $config{cflags}.=" -DSHA256_ASM" if ($target{sha1_asm_src} =~ /sha256/);
-       $config{cflags}.=" -DSHA512_ASM" if ($target{sha1_asm_src} =~ /sha512/);
+       push @{$config{defines}}, "SHA1_ASM"   if ($target{sha1_asm_src} =~ /sx86/ || $target{sha1_asm_src} =~ /sha1/);
+       push @{$config{defines}}, "SHA256_ASM" if ($target{sha1_asm_src} =~ /sha256/);
+       push @{$config{defines}}, "SHA512_ASM" if ($target{sha1_asm_src} =~ /sha512/);
     }
     if ($target{md5_asm_src}) {
-       $config{cflags}.=" -DMD5_ASM";
+       push @{$config{defines}}, "MD5_ASM";
     }
-    $target{cast_asm_src}=$table{BASE}->{cast_asm_src} if (!$config{no_shared}); # CAST assembler is not PIC
+    $target{cast_asm_src}=$table{DEFAULTS}->{cast_asm_src} unless $disabled{pic}; # CAST assembler is not PIC
     if ($target{rmd160_asm_src}) {
-       $config{cflags}.=" -DRMD160_ASM";
+       push @{$config{defines}}, "RMD160_ASM";
     }
     if ($target{aes_asm_src}) {
-       $config{cflags}.=" -DAES_ASM" if ($target{aes_asm_src} =~ m/\baes-/);;
+       push @{$config{defines}}, "AES_ASM" if ($target{aes_asm_src} =~ m/\baes-/);;
        # aes-ctr.fake is not a real file, only indication that assembler
        # module implements AES_ctr32_encrypt...
-       $config{cflags}.=" -DAES_CTR_ASM" if ($target{aes_asm_src} =~ s/\s*aes-ctr\.fake//);
+       push @{$config{defines}}, "AES_CTR_ASM" if ($target{aes_asm_src} =~ s/\s*aes-ctr\.fake//);
        # aes-xts.fake indicates presence of AES_xts_[en|de]crypt...
-       $config{cflags}.=" -DAES_XTS_ASM" if ($target{aes_asm_src} =~ s/\s*aes-xts\.fake//);
+       push @{$config{defines}}, "AES_XTS_ASM" if ($target{aes_asm_src} =~ s/\s*aes-xts\.fake//);
        $target{aes_asm_src} =~ s/\s*(vpaes|aesni)-x86\.s//g if ($no_sse2);
-       $config{cflags}.=" -DVPAES_ASM" if ($target{aes_asm_src} =~ m/vpaes/);
-       $config{cflags}.=" -DBSAES_ASM" if ($target{aes_asm_src} =~ m/bsaes/);
+       push @{$config{defines}}, "VPAES_ASM" if ($target{aes_asm_src} =~ m/vpaes/);
+       push @{$config{defines}}, "BSAES_ASM" if ($target{aes_asm_src} =~ m/bsaes/);
     }
     if ($target{wp_asm_src} =~ /mmx/) {
         if ($config{processor} eq "386") {
-           $target{wp_asm_src}=$table{BASE}->{wp_asm_src};
+           $target{wp_asm_src}=$table{DEFAULTS}->{wp_asm_src};
        } elsif (!$disabled{"whirlpool"}) {
-           $config{cflags}.=" -DWHIRLPOOL_ASM";
+           push @{$config{defines}}, "WHIRLPOOL_ASM";
        }
     }
     if ($target{modes_asm_src} =~ /ghash-/) {
-       $config{cflags}.=" -DGHASH_ASM";
+       push @{$config{defines}}, "GHASH_ASM";
     }
     if ($target{ec_asm_src} =~ /ecp_nistz256/) {
-       $config{cflags}.=" -DECP_NISTZ256_ASM";
+       push @{$config{defines}}, "ECP_NISTZ256_ASM";
     }
     if ($target{poly1305_asm_src} ne "") {
-       $config{cflags}.=" -DPOLY1305_ASM";
+       push @{$config{defines}}, "POLY1305_ASM";
     }
 }
 
-# Is the compiler gcc or clang?  $ecc is used below to see if error-checking
-# can be turned on.
 my $ecc = $target{cc};
-my $ccpcc = "$config{cross_compile_prefix}$target{cc}";
-$config{makedepprog} = 'makedepend';
-open(PIPE, "$ccpcc --version 2>&1 | head -2 |");
-while ( <PIPE> ) {
-    $config{makedepprog} = $ccpcc if /clang|gcc/;
-    $ecc = "clang" if /clang/;
-    $ecc = "gcc" if /gcc/;
+if ($^O ne "VMS") {
+    # Is the compiler gcc or clang?  $ecc is used below to see if
+    # error-checking can be turned on.
+    my $ccpcc = "$config{cross_compile_prefix}$target{cc}";
+    $config{makedepprog} = 'makedepend';
+    open(PIPE, "$ccpcc --version 2>&1 | head -2 |");
+    while ( <PIPE> ) {
+        $config{makedepprog} = $ccpcc if /clang|gcc/;
+        $ecc = "clang" if /clang/;
+        $ecc = "gcc" if /gcc/;
+    }
+    close(PIPE);
 }
-close(PIPE);
-
-$config{depflags} =~ s/^\s*//;
 
 
 # Deal with bn_ops ###################################################
@@ -1131,9 +1132,8 @@ $config{cflags} =~ s/([\\\"])/\\\1/g;
 
 if (defined($config{api})) {
     $config{openssl_api_defines} = [ "OPENSSL_MIN_API=".$apitable->{$config{api}} ];
-    my $apiflag = sprintf("-DOPENSSL_API_COMPAT=%s", $apitable->{$config{api}});
-    $default_depflags .= " $apiflag";
-    $config{cflags} .= " $apiflag";
+    my $apiflag = sprintf("OPENSSL_API_COMPAT=%s", $apitable->{$config{api}});
+    push @{$config{defines}}, $apiflag;
 }
 
 if ($strict_warnings)
@@ -1143,28 +1143,36 @@ if ($strict_warnings)
             unless $ecc eq 'gcc' || $ecc eq 'clang';
        foreach $wopt (split /\s+/, $gcc_devteam_warn)
                {
-               $config{cflags} .= " $wopt" unless ($config{cflags} =~ /(^|\s)$wopt(\s|$)/)
+               $config{cflags} .= " $wopt" unless ($config{cflags} =~ /(?:^|\s)$wopt(?:\s|$)/)
                }
        if ($ecc eq "clang")
                {
                foreach $wopt (split /\s+/, $clang_devteam_warn)
                        {
-                       $config{cflags} .= " $wopt" unless ($config{cflags} =~ /(^|\s)$wopt(\s|$)/)
+                       $config{cflags} .= " $wopt" unless ($config{cflags} =~ /(?:^|\s)$wopt(?:\s|$)/)
                        }
                }
-       if ($target !~ /^mingw/)
+       }
+
+unless ($disabled{"crypto-mdebug-backtrace"})
+       {
+       foreach my $wopt (split /\s+/, $memleak_devteam_backtrace)
                {
-               foreach $wopt (split /\s+/, $memleak_devteam_backtrace)
-                       {
-                       $config{cflags} .= " $wopt" unless ($config{cflags} =~ /(^|\s)$wopt(\s|$)/)
-                       }
-               if ($target =~ /^BSD-/)
-                       {
-                       $config{ex_libs} .= " -lexecinfo";
-                       }
+               $config{cflags} .= " $wopt" unless ($config{cflags} =~ /(?:^|\s)$wopt(?:\s|$)/)
+               }
+       if ($target =~ /^BSD-/)
+               {
+               $config{ex_libs} .= " -lexecinfo";
                }
        }
 
+if ($user_cflags ne "") { $config{cflags}="$config{cflags}$user_cflags"; }
+else                    { $no_user_cflags=1;  }
+if (@user_defines) { $config{defines}=[ @{$config{defines}}, @user_defines ]; }
+else               { $no_user_defines=1;    }
+
+# ALL MODIFICATIONS TO %config and %target MUST BE DONE FROM HERE ON
+
 # If we use the unified build, collect information from build.info files
 my %unified_info = ();
 
@@ -1183,27 +1191,34 @@ if ($builder eq "unified") {
     use with_fallback qw(Text::Template);
 
     sub cleandir {
+        my $base = shift;
         my $dir = shift;
-        my $base = shift || ".";
+        my $relativeto = shift || ".";
+
+        $dir = catdir($base,$dir) unless isabsolute($dir);
 
         # Make sure the directories we're building in exists
         mkpath($dir);
 
-        my $res = abs2rel(absolutedir($dir), rel2abs($base));
+        my $res = abs2rel(absolutedir($dir), rel2abs($relativeto));
         #print STDERR "DEBUG[cleandir]: $dir , $base => $res\n";
         return $res;
     }
 
     sub cleanfile {
+        my $base = shift;
         my $file = shift;
-        my $base = shift || ".";
+        my $relativeto = shift || ".";
+
+        $file = catfile($base,$file) unless isabsolute($file);
+
         my $d = dirname($file);
         my $f = basename($file);
 
         # Make sure the directories we're building in exists
         mkpath($d);
 
-        my $res = abs2rel(catfile(absolutedir($d), $f), rel2abs($base));
+        my $res = abs2rel(catfile(absolutedir($d), $f), rel2abs($relativeto));
         #print STDERR "DEBUG[cleanfile]: $d , $f => $res\n";
         return $res;
     }
@@ -1222,6 +1237,8 @@ if ($builder eq "unified") {
             if (-f catfile($srcdir, "engines", $_, "build.info"));
     }
 
+    $config{build_infos} = [ ];
+
     foreach (@build_infos) {
         my $sourced = catdir($srcdir, $_->[0]);
         my $buildd = catdir($blddir, $_->[0]);
@@ -1245,6 +1262,7 @@ if ($builder eq "unified") {
         my %renames = ();
         my %sharednames = ();
 
+        push @{$config{build_infos}}, catfile(abs2rel($sourced, $blddir), $f);
         my $template = Text::Template->new(TYPE => 'FILE',
                                            SOURCE => catfile($sourced, $f));
         die "Something went wrong with $sourced/$f: $!\n" unless $template;
@@ -1252,6 +1270,7 @@ if ($builder eq "unified") {
             split /^/m,
             $template->fill_in(HASH => { config => \%config,
                                          target => \%target,
+                                         disabled => \%disabled,
                                          builddir => abs2rel($buildd, $blddir),
                                          sourcedir => abs2rel($sourced, $blddir),
                                          buildtop => abs2rel($blddir, $blddir),
@@ -1324,7 +1343,7 @@ if ($builder eq "unified") {
                 my $lineiterator = shift;
                 my $target_kind = $1;
                 while (defined $lineiterator->()) {
-                    chomp;
+                    s|\R$||;
                     if (/^\s*ENDRAW\[((?:\\.|[^\\\]])+)\]\s*$/) {
                         die "ENDRAW doesn't match BEGINRAW"
                             if $1 ne $target_kind;
@@ -1345,8 +1364,8 @@ if ($builder eq "unified") {
             die "$_ renamed to more than one thing: "
                 ,join(" ", @{$renames{$_}}),"\n"
                 if scalar @{$renames{$_}} > 1;
-            my $dest = cleanfile(catfile($buildd, $_), $blddir);
-            my $to = cleanfile(catfile($buildd, $renames{$_}->[0]), $blddir);
+            my $dest = cleanfile($buildd, $_, $blddir);
+            my $to = cleanfile($buildd, $renames{$_}->[0], $blddir);
             die "$dest renamed to more than one thing: "
                 ,$unified_info{rename}->{$dest}, $to
                 unless !defined($unified_info{rename}->{$dest})
@@ -1355,7 +1374,7 @@ if ($builder eq "unified") {
         }
 
         foreach (@programs) {
-            my $program = cleanfile(catfile($buildd, $_), $blddir);
+            my $program = cleanfile($buildd, $_, $blddir);
             if ($unified_info{rename}->{$program}) {
                 $program = $unified_info{rename}->{$program};
             }
@@ -1363,19 +1382,19 @@ if ($builder eq "unified") {
         }
 
         foreach (@libraries) {
-            my $library = cleanfile(catfile($buildd, $_), $blddir);
+            my $library = cleanfile($buildd, $_, $blddir);
             if ($unified_info{rename}->{$library}) {
                 $library = $unified_info{rename}->{$library};
             }
             $unified_info{libraries}->{$library} = 1;
         }
 
-        die <<"EOF" if $config{no_shared} && scalar @engines;
-ENGINES can only be used if configured with 'shared'.
+        die <<"EOF" if scalar @engines and !$config{dynamic_engines};
+ENGINES can only be used if configured with 'dynamic-engine'.
 This is usually a fault in a build.info file.
 EOF
         foreach (@engines) {
-            my $library = cleanfile(catfile($buildd, $_), $blddir);
+            my $library = cleanfile($buildd, $_, $blddir);
             if ($unified_info{rename}->{$library}) {
                 $library = $unified_info{rename}->{$library};
             }
@@ -1383,7 +1402,7 @@ EOF
         }
 
         foreach (@scripts) {
-            my $script = cleanfile(catfile($buildd, $_), $blddir);
+            my $script = cleanfile($buildd, $_, $blddir);
             if ($unified_info{rename}->{$script}) {
                 $script = $unified_info{rename}->{$script};
             }
@@ -1391,24 +1410,23 @@ EOF
         }
 
         foreach (@extra) {
-            my $extra = cleanfile(catfile($buildd, $_), $blddir);
+            my $extra = cleanfile($buildd, $_, $blddir);
             $unified_info{extra}->{$extra} = 1;
         }
 
         push @{$unified_info{rawlines}}, @rawlines;
 
-        if (!$config{no_shared}) {
+        unless ($disabled{shared}) {
             # Check sharednames.
             foreach (keys %sharednames) {
-                my $dest = cleanfile(catfile($buildd, $_), $blddir);
+                my $dest = cleanfile($buildd, $_, $blddir);
                 if ($unified_info{rename}->{$dest}) {
                     $dest = $unified_info{rename}->{$dest};
                 }
                 die "shared_name for $dest with multiple values: "
                     ,join(" ", @{$sharednames{$_}}),"\n"
                     if scalar @{$sharednames{$_}} > 1;
-                my $to = cleanfile(catfile($buildd, $sharednames{$_}->[0]),
-                                   $blddir);
+                my $to = cleanfile($buildd, $sharednames{$_}->[0], $blddir);
                 die "shared_name found for a library $dest that isn't defined\n"
                     unless $unified_info{libraries}->{$dest};
                 die "shared_name for $dest with multiple values: "
@@ -1429,7 +1447,7 @@ EOF
 
         foreach (keys %ordinals) {
             my $dest = $_;
-            my $ddest = cleanfile(catfile($buildd, $_), $blddir);
+            my $ddest = cleanfile($buildd, $_, $blddir);
             if ($unified_info{rename}->{$ddest}) {
                 $ddest = $unified_info{rename}->{$ddest};
             }
@@ -1437,9 +1455,9 @@ EOF
                 my %known_ordinals =
                     (
                      crypto =>
-                     cleanfile(catfile($sourced, "util", "libeay.num"), $blddir),
+                     cleanfile($sourced, catfile("util", "libeay.num"), $blddir),
                      ssl =>
-                     cleanfile(catfile($sourced, "util", "ssleay.num"), $blddir)
+                     cleanfile($sourced, catfile("util", "ssleay.num"), $blddir)
                     );
                 my $o = $known_ordinals{$_};
                 die "Ordinals for $ddest defined more than once\n"
@@ -1450,22 +1468,22 @@ EOF
 
         foreach (keys %sources) {
             my $dest = $_;
-            my $ddest = cleanfile(catfile($buildd, $_), $blddir);
+            my $ddest = cleanfile($buildd, $_, $blddir);
             if ($unified_info{rename}->{$ddest}) {
                 $ddest = $unified_info{rename}->{$ddest};
             }
             foreach (@{$sources{$dest}}) {
-                my $s = cleanfile(catfile($sourced, $_), $blddir);
+                my $s = cleanfile($sourced, $_, $blddir);
 
                 # If it isn't in the source tree, we assume it's generated
                 # in the build tree
                 if (! -f $s) {
-                    $s = cleanfile(catfile($buildd, $_), $blddir);
+                    $s = cleanfile($buildd, $_, $blddir);
                 }
                 # We recognise C and asm files
                 if ($s =~ /\.[csS]\b$/) {
                     (my $o = $_) =~ s/\.[csS]\b$/.o/;
-                    $o = cleanfile(catfile($buildd, $o), $blddir);
+                    $o = cleanfile($buildd, $o, $blddir);
                     $unified_info{sources}->{$ddest}->{$o} = 1;
                     $unified_info{sources}->{$o}->{$s} = 1;
                 } else {
@@ -1476,17 +1494,23 @@ EOF
 
         foreach (keys %depends) {
             my $dest = $_;
-            my $ddest = cleanfile(catfile($buildd, $_), $blddir);
+            my $ddest = cleanfile($buildd, $_, $blddir);
             if ($unified_info{rename}->{$ddest}) {
                 $ddest = $unified_info{rename}->{$ddest};
             }
             foreach (@{$depends{$dest}}) {
-                my $d = cleanfile(catfile($sourced, $_), $blddir);
-
-                # If it isn't found in the source, let's assume it's generated
-                # and that the Makefile template has the lines
-                if (! -f $d) {
-                    $d = cleanfile(catfile($buildd, $_), $blddir);
+                my $d = cleanfile($sourced, $_, $blddir);
+
+                # If we know it's generated, or assume it is because we can't
+                # find it in the source tree, we set file we depend on to be
+                # in the build tree rather than the source tree, and assume
+                # and that there are lines to build it in a BEGINRAW..ENDRAW
+                # section or in the Makefile template.
+                if (! -f $d
+                    || !(grep { $d eq $_ }
+                         map { cleanfile($srcdir, $_, $blddir) }
+                         (@generated_headers, @generated_by_make_headers))) {
+                    $d = cleanfile($buildd, $_, $blddir);
                 }
                 # Take note if the file to depend on is being renamed
                 if ($unified_info{rename}->{$d}) {
@@ -1505,12 +1529,12 @@ EOF
 
         foreach (keys %includes) {
             my $dest = $_;
-            my $ddest = cleanfile(catfile($buildd, $_), $blddir);
+            my $ddest = cleanfile($buildd, $_, $blddir);
             if ($unified_info{rename}->{$ddest}) {
                 $ddest = $unified_info{rename}->{$ddest};
             }
             foreach (@{$includes{$dest}}) {
-                my $i = cleandir(catdir($sourced, $_), $blddir);
+                my $i = cleandir($sourced, $_, $blddir);
                 push @{$unified_info{includes}->{$ddest}}, $i
                     unless grep { $_ eq $i } @{$unified_info{includes}->{$ddest}};
             }
@@ -1533,9 +1557,9 @@ EOF
 
 # For the schemes that need it, we provide the old *_obj configs
 # from the *_asm_obj ones
-foreach (grep /_asm_src$/, keys %target) {
+foreach (grep /_(asm|aux)_src$/, keys %target) {
     my $src = $_;
-    (my $obj = $_) =~ s/_asm_src$/_obj/;
+    (my $obj = $_) =~ s/_(asm|aux)_src$/_obj/;
     ($target{$obj} = $target{$src}) =~ s/\.[csS]\b/.o/g;
 }
 
@@ -1551,7 +1575,7 @@ use warnings;
 use Exporter;
 #use vars qw(\@ISA \@EXPORT);
 our \@ISA = qw(Exporter);
-our \@EXPORT = qw(\%config \%target %withargs %unified_info);
+our \@EXPORT = qw(\%config \%target %disabled %withargs %unified_info);
 
 EOF
 print OUT "our %config = (\n";
@@ -1656,21 +1680,17 @@ EOF
 print OUT "1;\n";
 close(OUT);
 
-die <<"EOF" if $builder ne "unified" && $srcdir ne $blddir;
-
-***** Trying building anywhere else than in the source tree will not
-***** work for target $config{target}.  To make it possible, it needs
-***** to use the "unified" build scheme.
-
-EOF
 
 print "IsMK1MF       =", ($builder eq "mk1mf" ? "yes" : "no"), "\n";
 print "CC            =$target{cc}\n";
-print "CFLAG         =$config{cflags}\n";
-print "LFLAG         =$config{lflags}\n";
-print "PLIB_LFLAG    =$config{plib_lflags}\n";
-print "EX_LIBS       =$config{ex_libs}\n";
+print "CFLAG         =$target{cflags} $config{cflags}\n";
+print "DEFINES       =",join(" ", @{$target{defines}}, @{$config{defines}}),"\n";
+print "LFLAG         =$target{lflags}\n";
+print "PLIB_LFLAG    =$target{plib_lflags}\n";
+print "EX_LIBS       =$target{ex_libs} $config{ex_libs}\n";
+print "APPS_OBJ      =$target{apps_obj}\n";
 print "CPUID_OBJ     =$target{cpuid_obj}\n";
+print "UPLINK_OBJ    =$target{uplink_obj}\n";
 print "BN_ASM        =$target{bn_obj}\n";
 print "EC_ASM        =$target{ec_obj}\n";
 print "DES_ENC       =$target{des_obj}\n";
@@ -1698,14 +1718,10 @@ print "THIRTY_TWO_BIT mode\n" if $config{b32};
 print "BN_LLONG mode\n" if $config{bn_ll};
 print "RC4 uses $config{rc4_int}\n" if $config{rc4_int} != $def_int;
 
-mkpath(catdir($blddir, "include/openssl"));
-run_dofile(catfile($blddir, "include/openssl/opensslconf.h"),
-           catfile($srcdir, "include/openssl/opensslconf.h.in"));
-
-mkpath(catdir($blddir, "crypto/include/internal"));
-foreach my $alg ( 'bn' ) {
-    run_dofile(catfile($blddir, "crypto/include/internal/${alg}_conf.h"),
-               catfile($srcdir, "crypto/include/internal/${alg}_conf.h.in"));
+for (@generated_headers) {
+    mkpath(catdir($blddir, dirname($_)));
+    run_dofile(catfile($blddir, $_),
+               catfile($srcdir, $_.".in"));
 }
 
 ###
@@ -1748,53 +1764,18 @@ my %builders = (
         run_dofile(catfile($blddir, $target{build_file}),
                    $config{build_file_template},
                    catfile($srcdir, "Configurations", "common.tmpl"));
-
-        my $make_command = "$make PERL=\'$config{perl}\'";
-        my $make_targets = "";
-        $make_targets .= " depend"
-            if $config{depflags} ne $default_depflags && $make_depend;
-        (system $make_command.$make_targets) == 0
-            or die "make $make_targets failed"
-            if $make_targets ne "";
-        if ($config{depflags} ne $default_depflags && !$make_depend) {
-            $warn_make_depend++;
-        }
     },
     unixmake => sub {
         build_Makefile();
 
         run_dofile("util/domd", "util/domd.in");
         chmod 0755, "util/domd";
-
-       my $make_command = "$make PERL=\'$config{perl}\'";
-       my $make_targets = "";
-       $make_targets .= " depend"
-           if $config{depflags} ne $default_depflags && $make_depend;
-       (system $make_command.$make_targets) == 0
-           or die "make $make_targets failed"
-           if $make_targets ne "";
-
-       if ($config{depflags} ne $default_depflags && !$make_depend) {
-            $warn_make_depend++;
-        }
     },
     mk1mf => sub {
         my $platform = shift;
         # The only reason we do this is to have something to build MINFO from
         build_Makefile();
 
-       open (OUT,">crypto/buildinf.h") || die "Can't open buildinf.h";
-       printf OUT <<"EOF";
-#ifndef MK1MF_BUILD
-  /* auto-generated by Configure for crypto/cversion.c:
-   * for Unix builds, crypto/Makefile.ssl generates functional definitions;
-   * Windows builds (and other mk1mf builds) compile cversion.c with
-   * -DMK1MF_BUILD and use definitions added to this file by util/mk1mf.pl. */
-  #error "Windows builds (PLATFORM=$target) use mk1mf.pl-created Makefiles"
-#endif
-EOF
-       close(OUT);
-
        # create the ms/version32.rc file if needed
        if ($platform ne "netware") {
            my ($v1, $v2, $v3, $v4);
@@ -1866,7 +1847,7 @@ print <<"EOF";
 Configured for $target.
 EOF
 
-print <<"EOF" if (!$no_threads && !$threads);
+print <<"EOF" if ($disabled{threads} eq "unavailable");
 
 The library could not be configured for supporting multi-threaded
 applications as the compiler options required on this system are not known.
@@ -1875,19 +1856,45 @@ EOF
 
 print <<"EOF" if ($no_shared_warn);
 
-You gave the option 'shared', which is not supported on this platform, so
-we will pretend you gave the option 'no-shared'.  If you know how to implement
-shared libraries, please let us know (but please first make sure you have
-tried with a current version of OpenSSL).
+The options 'shared', 'pic' and 'dynamic-engine' aren't supported on this
+platform, so we will pretend you gave the option 'no-pic', which also disables
+'shared' and 'dynamic-engine'.  If you know how to implement shared libraries
+or position independent code, please let us know (but please first make sure
+you have tried with a current version of OpenSSL).
 EOF
 
-print <<"EOF" if ($warn_make_depend);
+###### TO BE REMOVED BEFORE FINAL RELEASE
+######
+###### If the user hasn't chosen --unified, try to nudge them.
+if ($target{build_file} eq "Makefile"
+    && $target{build_scheme}->[0] eq "unixmake"
+    && !$unified) {
+
+    my $plausible_builddir =
+        abs2rel(rel2abs("../_openssl-build_$target"),rel2abs("."));
+    my $plausible_to_sourcedir =
+        abs2rel(rel2abs("."),rel2abs("../_openssl-build_$target"));
+    print <<"EOF";
+
+----------------------------------------------------------------------
+Please consider configuring with the flag --unified .
+It's to test out a new "unified" building system.
+
+One cool feature is that you can have your build directory elsewhere,
+for example:
 
-*** Because of configuration changes, you MUST do the following before
-*** building:
+    make clean          # Clean the current configuration away
+    mkdir $plausible_builddir
+    cd $plausible_builddir
+    $plausible_to_sourcedir/config --unified
+    make
+    make test
+
+Please report any problem you have.
+----------------------------------------------------------------------
 
-       make depend
 EOF
+}
 
 exit(0);
 
@@ -1899,50 +1906,69 @@ exit(0);
 # Configuration file reading #########################################
 
 # Helper function to implement conditional inheritance depending on the
-# value of $no_asm.  Used in inherit_from values as follows:
+# value of $disabled{asm}.  Used in inherit_from values as follows:
 #
 #      inherit_from => [ "template", asm("asm_tmpl") ]
 #
 sub asm {
     my @x = @_;
     sub {
-       $no_asm ? () : @x;
+       $disabled{asm} ? () : @x;
     }
 }
 
+our $add_called = 0;
 # Helper function to implement adding values to already existing configuration
 # values.  It handles elements that are ARRAYs, CODEs and scalars
 sub _add {
     my $separator = shift;
 
-    # If there's any ARRAY in the collection of values, we will return
-    # an ARRAY of combined values, otherwise a string of joined values
-    # with $separator as the separator.
-    my $found_array = 0;
+    # If there's any ARRAY in the collection of values OR the separator
+    # is undef, we will return an ARRAY of combined values, otherwise a
+    # string of joined values with $separator as the separator.
+    my $found_array = !defined($separator);
 
     my @values =
        map {
-           if (ref($_) eq "ARRAY") {
-               $found_array = 1;
-               @$_;
+           my $res = $_;
+           while (ref($res) eq "CODE") {
+               $res = $res->();
+           }
+           if (defined($res)) {
+               if (ref($res) eq "ARRAY") {
+                   $found_array = 1;
+                   @$res;
+               } else {
+                   $res;
+               }
            } else {
-               $_;
+               ();
            }
     } (@_);
 
+    $add_called = 1;
+
     if ($found_array) {
        [ @values ];
     } else {
-       join($separator, @values);
+       join($separator, grep { defined($_) && $_ ne "" } @values);
     }
 }
 sub add_before {
-    my $separator = shift;
+    my $separator = " ";
+    if (ref($_[$#_]) eq "HASH") {
+        my $opts = pop;
+        $separator = $opts->{separator};
+    }
     my @x = @_;
     sub { _add($separator, @x, @_) };
 }
 sub add {
-    my $separator = shift;
+    my $separator = " ";
+    if (ref($_[$#_]) eq "HASH") {
+        my $opts = pop;
+        $separator = $opts->{separator};
+    }
     my @x = @_;
     sub { _add($separator, @_, @x) };
 }
@@ -1990,6 +2016,8 @@ sub resolve_config {
     my $target = shift;
     my @breadcrumbs = @_;
 
+    my $extra_checks = defined($ENV{CONFIGURE_EXTRA_CHECKS});
+
     if (grep { $_ eq $target } @breadcrumbs) {
        die "inherit_from loop!  target backtrace:\n  "
            ,$target,"\n  ",join("\n  ", @breadcrumbs),"\n";
@@ -2040,12 +2068,40 @@ sub resolve_config {
     #   value.
     # - Otherwise, this target's value is assumed to be a string that
     #   will simply override the inherited list of values.
-    my $default_combiner = add(" ");
+    my $default_combiner = add();
 
     my %all_keys =
        map { $_ => 1 } (keys %combined_inheritance,
                         keys %{$table{$target}});
+
+    sub process_values {
+       my $object    = shift;
+       my $inherited = shift;  # Always a [ list ]
+       my $target    = shift;
+       my $entry     = shift;
+
+        $add_called = 0;
+
+        while(ref($object) eq "CODE") {
+            $object = $object->(@$inherited);
+        }
+        if (!defined($object)) {
+            return ();
+        }
+        elsif (ref($object) eq "ARRAY") {
+            local $add_called;  # To make sure recursive calls don't affect it
+            return [ map { process_values($_, $inherited, $target, $entry) }
+                     @$object ];
+        } elsif (ref($object) eq "") {
+            return $object;
+        } else {
+            die "cannot handle reference type ",ref($object)
+                ," found in target ",$target," -> ",$entry,"\n";
+        }
+    }
+
     foreach (sort keys %all_keys) {
+        my $previous = $combined_inheritance{$_};
 
        # Current target doesn't have a value for the current key?
        # Assign it the default combiner, the rest of this loop body
@@ -2054,20 +2110,16 @@ sub resolve_config {
            $table{$target}->{$_} = $default_combiner;
        }
 
-       my $valuetype = ref($table{$target}->{$_});
-       if ($valuetype eq "CODE") {
-           # CODE reference, execute it with the inherited values as
-           # arguments.
-           $table{$target}->{$_} =
-               $table{$target}->{$_}->(@{$combined_inheritance{$_}});
-       } elsif ($valuetype eq "ARRAY" || $valuetype eq "") {
-           # ARRAY or Scalar, just leave it as is.
-       } else {
-           # Some other type of reference that we don't handle.
-           # Better to abort at this point.
-           die "cannot handle reference type $valuetype,"
-               ," found in target $target -> $_\n";
-       }
+       $table{$target}->{$_} = process_values($table{$target}->{$_},
+                                              $combined_inheritance{$_},
+                                              $target, $_);
+        unless(defined($table{$target}->{$_})) {
+            delete $table{$target}->{$_};
+        }
+        if ($extra_checks &&
+            $previous && !($add_called ||  $previous ~~ $table{$target}->{$_})) {
+            warn "$_ got replaced in $target\n";
+        }
     }
 
     # Finally done, return the result.
@@ -2141,20 +2193,12 @@ sub print_table_entry
        "sys_id",
        "cc",
        "cflags",
-       "debug_cflags",
-       "release_cflags",
-       "thread_cflag",
+       "defines",
        "unistd",
        "ld",
        "lflags",
        "plib_lflags",
        "ex_libs",
-       "debug_lflags",
-       "debug_plib_lflags",
-       "debug_ex_libs",
-       "release_lflags",
-       "release_plib_lflags",
-       "release_ex_libs",
        "bn_ops",
        "cpuid_obj",
        "bn_obj",
@@ -2172,12 +2216,17 @@ sub print_table_entry
        "cmll_obj",
        "modes_obj",
        "padlock_obj",
+       "thread_scheme",
        "perlasm_scheme",
        "dso_scheme",
        "shared_target",
        "shared_cflag",
        "shared_ldflag",
+       "shared_rcflag",
        "shared_extension",
+       "shared_extension_simple",
+       "shared_import_extension",
+       "dso_extension",
        "obj_extension",
        "exe_extension",
        "ranlib",
@@ -2190,14 +2239,24 @@ sub print_table_entry
     if ($type eq "TABLE") {
        print "\n";
        print "*** $target\n";
-       printf "\$%-12s = %s\n", $_, $target{$_} foreach (@sequence);
+        foreach (@sequence) {
+            if (ref($target{$_}) eq "ARRAY") {
+                printf "\$%-12s = %s\n", $_, join(" ", @{$target{$_}});
+            } else {
+                printf "\$%-12s = %s\n", $_, $target{$_};
+            }
+        }
     } elsif ($type eq "HASH") {
        my $largest =
            length((sort { length($a) <=> length($b) } @sequence)[-1]);
        print "    '$target' => {\n";
        foreach (@sequence) {
            if ($target{$_}) {
-               print "      '",$_,"'"," " x ($largest - length($_))," => '",$target{$_},"',\n";
+                if (ref($target{$_}) eq "ARRAY") {
+                    print "      '",$_,"'"," " x ($largest - length($_))," => [ ",join(", ", map { "'$_'" } @{$target{$_}})," ],\n";
+                } else {
+                    print "      '",$_,"'"," " x ($largest - length($_))," => '",$target{$_},"',\n";
+                }
            }
        }
        print "    },\n";
@@ -2206,6 +2265,23 @@ sub print_table_entry
 
 # Utility routines ###################################################
 
+# On VMS, if the given file is a logical name, File::Spec::Functions
+# will consider it an absolute path.  There are cases when we want a
+# purely syntactic check without checking the environment.
+sub isabsolute {
+    my $file = shift;
+
+    # On non-platforms, we just use file_name_is_absolute().
+    return file_name_is_absolute($file) unless $^O eq "VMS";
+
+    # If the file spec includes a device or a directpry spec,
+    # file_name_is_absolute() is perfectly safe.
+    return file_name_is_absolute($file) if $file =~ m|[:\[]|;
+
+    # Here, we know the given file spec isn't absolute
+    return 0;
+}
+
 # Makes a directory absolute and cleans out /../ in paths like foo/../bar
 # On some platforms, this uses rel2abs(), while on others, realpath() is used.
 # realpath() requires that at least all path components except the last is an
@@ -2270,7 +2346,7 @@ sub collect_from_file {
         my $saved_line = "";
         $_ = "";
         while (<$fh>) {
-            chomp;
+            s|\R$||;
             if (defined $line_concat) {
                 $_ = $line_concat->($saved_line, $_);
                 $saved_line = "";
@@ -2301,7 +2377,7 @@ sub collect_from_array {
         my $saved_line = "";
         $_ = "";
         while (defined($_ = shift @array)) {
-            chomp;
+            s|\R$||;
             if (defined $line_concat) {
                 $_ = $line_concat->($saved_line, $_);
                 $saved_line = "";
@@ -2326,7 +2402,7 @@ sub collect_information {
     my %collectors = @_;
 
     while(defined($_ = $lineiterator->())) {
-        chomp;
+        s|\R$||;
         my $found = 0;
         foreach my $re (keys %collectors) {
             if ($re ne "OTHERWISE" && /$re/) {