Regression in GSSAPI/libxh509 linking? [PR bin/147175]

Greetings,

it appears that some change to -RECENT (relative to 8-STABLE) breaks  
linking several GSSAPI applications from ports, for instance,  
mail/fetchmail if GSSAPI is enabled.

These applications then compile OK, but fail to link with MD2_Init and  
other MD2 symbols not defined, although the command line (obtained from  
krb5-config gssapi --libs) appears to list -lhx509 and -lcrypto in the  
right order (hx509 first). This is, according to the report, happening on  
-CURRENT, but does NOT happen on 8-STABLE or release candidates to 8.1.

Andrew Reilly posted a patch to the base system Kerberos to bin/147175 to  
add a dependency from the shared hx509 library on libcrypto, however there  
are open questions neither he nor I can answer -- particularly if it's  
fixing the right problem, or if instead the run-time linker needed to be  
fixed.

Please help: read PR bin/147175 and comment if you're knowledgeable about  
either run-time linking, KRB5/GSSAPI, or both :)

Thank you.

-- 
Matthias Andree