pkg/54890: security/openssl BUILDLINK_API_DEPENDS mismatch

[triaxx%netbsd.org@localhost]

>Number:         54890
>Category:       pkg
>Synopsis:       security/openssl BUILDLINK_API_DEPENDS mismatch
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    pkg-manager
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Jan 24 12:50:00 +0000 2020
>Originator:     Frédéric Fauberteau
>Release:        NetBSD 8.0
>Organization:
>Environment:
System: NetBSD hydralisk.triaxx.org 8.0 NetBSD 8.0 (GENERIC) #0: Fri Jan 17 23:04:35 CET 2020  triaxx%hydralisk.triaxx.org@localhost:/mnt/ccd0/sysbuild/hydralisk-8.0/amd64/obj/mnt/ccd0/netbsd/netbsd-8-0-RELEASE/src/sys/arch/amd64/compile/GENERIC amd64
Architecture: x86_64
Machine: amd64
>Description:
When building devel/cmake in a chrooted sandbox, the following error occurs:
===> Creating toolchain wrappers for cmake-3.16.3
ERROR: heimdal>=0.4e heimdal>=0.6 is not installed; can't buildlink files.
*** Error code 1

Stop.
bmake[1]: stopped in /usr/pkgsrc/devel/cmake
*** Error code 1

Stop.
bmake: stopped in /usr/pkgsrc/devel/cmake

The problem is that www/curl (a dependency of devel/cmake) thinks it can use builtin security/heimdal because mk/krb5.buildlink3.mk is included before security/openssl/buildlink3.mk. As a results BUILDLINK_API_DEPENDS.openssl is not defined yet and is set to 1.0.1c (that is less than the builtin version (1.0.2k)). But devel/cmake has security/openssl/buildlink3.mk included before and then BUILDLINK_API_DEPENDS.openssl is set to 1.1.1. devel/cmake thinks that heimdal cannot be used in builtin version since USE_BUILTIN.openssl is no (and then USE_BUILTIN.heimdal is no too).
>How-To-Repeat:
cd /usr/pkgsrc/devel/cmake && make configure
>Fix:
Index: builtin.mk
===================================================================
RCS file: /cvsroot/pkgsrc/security/openssl/builtin.mk,v
retrieving revision 1.45
diff -u -r1.45 builtin.mk
--- builtin.mk  16 Jan 2020 13:30:29 -0000      1.45
+++ builtin.mk  24 Jan 2020 12:36:29 -0000
@@ -87,7 +87,7 @@
 ### take care builtin check case, BUILDLINK_API_DEPENDS may not be defined yet.
 CHECK_BUILTIN.openssl?=                no
 .      if !empty(CHECK_BUILTIN.openssl:M[yY][eE][sS])
-BUILDLINK_API_DEPENDS.openssl?=        openssl>=1.0.1c
+BUILDLINK_API_DEPENDS.openssl?=        openssl>=1.1.1
 .      endif
 .      for dep_ in ${BUILDLINK_API_DEPENDS.openssl}
 .        if !empty(USE_BUILTIN.openssl:M[yY][eE][sS])