Our make already uses sh -e when executing commands.
Revert the "set -e" additions and kill unneeded subshells.  ok djm@
Retire Skipjack

There's not much use for the declassified cipher from the 80's
with a questionable license these days.  According to the FIPS
drafts, Skipjack reaches its EOL in December 2010.

The libc portion will be removed after the ports hackathon.

djm and thib agree, no objections from deraadt
Thanks to jsg for digging up FIPS drafts.
More OpenSSL fixes:

- Update local engines for the EVP API change (len u_int => size_t)
- Use hw_cryptodev.c instead of eng_cryptodev.c
- Make x86_64-xlate.pl always write to the output file and not stdout,
  fixing "make -j" builds (spotted by naddy@)

ok naddy@
OpenSSL grows another undocumented header, apparently needed on armish
Disable use of dladdr() on a.out arches, they do not provide it (yet); ok djm@
- Apply security fix for CVE-2010-3864 (+commit 19998 which fixes the fix).

ok djm@ deraadt@
Security fix for CVE-2010-4180 as mentioned in http://www.openssl.org/news/secadv_20101202.txt.
where clients could modify the stored session
cache ciphersuite and in some cases even downgrade the suite to weaker ones.

This code is not enabled by default.

ok djm@
The VIA ciphers are added to an array of CRYPTO_ALGORITHM_MAX length
which should have been declared as CRYPTO_ALGORITHM_MAX + 1,
fix this and reserve enough space for the VIA additions as well.

ok/comments from mikeb & deraadt
move CRYPTO_VIAC3_MAX out of cryptodev.h and into the only
file it will be used from.

requested by/ok mikeb@
- generate and install pkg-config files for openssl, which more and more
projects depend on being present (e.g. various ports).

as discussed with various porters in a hungarian spa
help/feedback from ingo@ and also OK halex@
no objections from djm@
- ensure ${DESTDIR}/usr/lib/pkgconfig/ as running make distrib-dirs is not
common/encouraged practice
- adjust krb5 directories
- zap a trailing tab
- simplify, krb5 handling is not needed.

prompted by brad
Put -I${includedir} back into Cflags so configure script tests like
  test -n "`pkg-config --cflags openssl`"
don't assume that OpenSSL isn't available.

ok miod@, sthen@, ajacoutot@, djm@
fix for CVE-2011-0014 "OCSP stapling vulnerability";
ok markus@ jasper@ miod@

AFAIK nothing in base uses this, though apache2 from ports may be affected.
Remove expired certs.

ok beck@ fgsch@
This script doesn't need write access to $curdir. Just check existence.
Fixes build on NFS src with no root access. ok jasper@
Add the following certs:

DigiCert High Assurance CA-3
Go Daddy Secure Certification Authority
COMODO High-Assurance Secure Server CA
Equifax Secure Certificate Authority
VeriSign Class 3 Public Primary Certification Authority - G5
Entrust Certification Authority - L1C
Entrust.net Secure Server Certification Authority

cross checked with mozilla

ok beck@
back out previous commit.

"if you have checked this I am ok with it"  does not mean

1) not to pay attention to breaking news after I tell you that and
2) not to get ok's from the others this had been shown to.

I am absolutely not ok with thig going in with only *my* ok.  There's a reason why we want more than one ok on important commits

ok deraadt@ for the backout
Adjust to explicitly list ${libdir}.
    ok sthen@