[2/4] Remove --enable-crypt and --enable-nss-crypt configure options.

Message ID 7e543341-fcd6-4f0b-a9d9-29a8c604b2b4@app.fastmail.com
State Superseded
Headers
Series Remove libcrypt |

Checks

Context Check Description
redhat-pt-bot/TryBot-apply_patch success Patch applied to master at the time it was sent
linaro-tcwg-bot/tcwg_glibc_build--master-aarch64 success Testing passed
linaro-tcwg-bot/tcwg_glibc_check--master-arm success Testing passed
linaro-tcwg-bot/tcwg_glibc_check--master-aarch64 success Testing passed
linaro-tcwg-bot/tcwg_glibc_build--master-arm success Testing passed

Commit Message

Zack Weinberg Sept. 21, 2023, 8:50 p.m. UTC
  Remove the configure option to enable crypt, the top-level machinery
to build it when the option is active, and all the remaining
references to libcrypt in directories other than crypt/ and manual/.
(There is still code in sysdeps/ belonging to libcrypt.)  This makes
it impossible to build libcrypt, so add a NEWS entry for the removal
at this point, and remove the prototype for crypt() from unistd.h.

The actual code, and the remainder of the documentation, will be
deleted in subsequent patches.
---
 CONTRIBUTED-BY                                |  15 --
 INSTALL                                       |  13 -
 Makeconfig                                    |   5 -
 NEWS                                          |  16 +-
 SHARED-FILES                                  |   2 -
 config.make.in                                |   4 -
 configure                                     | 247 +++++-------------
 configure.ac                                  |  64 -----
 conform/Makefile                              |   5 -
 elf/Makefile                                  |  38 ---
 elf/tst-linkall-static.c                      |   6 -
 manual/install.texi                           |  13 -
 posix/unistd.h                                |  10 -
 scripts/build-many-glibcs.py                  |   9 +-
 scripts/documented.sh                         |   2 +-
 shlib-versions                                |   3 -
 stdio-common/Versions                         |   2 +-
 sysdeps/mach/Makefile                         |   4 +-
 .../sparc/sparc32/sparcv9/multiarch/Makefile  |   8 -
 sysdeps/sparc/sparc64/multiarch/Makefile      |   8 -
 sysdeps/unix/sysv/linux/alpha/shlib-versions  |   1 -
 sysdeps/unix/sysv/linux/arm/Makefile          |   4 -
 22 files changed, 90 insertions(+), 389 deletions(-)
  

Patch

diff --git a/CONTRIBUTED-BY b/CONTRIBUTED-BY
index d53bf90e7a..0cb379cc9d 100644
--- a/CONTRIBUTED-BY
+++ b/CONTRIBUTED-BY
@@ -24,21 +24,6 @@  catgets/gencat.c:
 catgets/open_catalog.c:
     Contributed by Ulrich Drepper, <drepper@gnu.org>.
 
-crypt/md5-crypt.c:
-    Contributed by Ulrich Drepper <drepper@cygnus.com>, 1996.
-
-crypt/sha256-crypt.c:
-    Contributed by Ulrich Drepper <drepper@redhat.com>, 2007.
-
-crypt/sha256.c:
-    Written by Ulrich Drepper <drepper@redhat.com>, 2007.
-
-crypt/sha512-crypt.c:
-    Contributed by Ulrich Drepper <drepper@redhat.com>, 2007.
-
-crypt/sha512.c:
-    Written by Ulrich Drepper <drepper@redhat.com>, 2007.
-
 debug/backtrace.c:
     Contributed by Jakub Jelinek <jakub@redhat.com>, 2003.
 
diff --git a/INSTALL b/INSTALL
index b29916e748..afd88dc5b1 100644
--- a/INSTALL
+++ b/INSTALL
@@ -228,19 +228,6 @@  if ‘CFLAGS’ is specified it must enable optimization.  For example:
      By default for x86_64, the GNU C Library is built with the vector
      math library.  Use this option to disable the vector math library.
 
-‘--enable-crypt’
-     Install the legacy passphrase-hashing library ‘libcrypt’ and the
-     header file ‘crypt.h’.  ‘unistd.h’ will declare the function
-     ‘crypt’ regardless of this option.  Using this option does not
-     change the set of programs that may need to be linked with
-     ‘-lcrypt’; it only means that the GNU C Library will provide that
-     library.
-
-     This option is for hackers and distributions who may not yet be
-     able to use libcrypt alternatives such as libxcrypt and need this
-     legacy implementation as a temporary workaround.  Note that
-     libcrypt may be removed in a future release.
-
 ‘--disable-scv’
      Disable using ‘scv’ instruction for syscalls.  All syscalls will
      use ‘sc’ instead, even if the kernel supports ‘scv’.  PowerPC only.
diff --git a/Makeconfig b/Makeconfig
index c48fcc59e8..3fe827f571 100644
--- a/Makeconfig
+++ b/Makeconfig
@@ -1357,11 +1357,6 @@  all-subdirs = csu assert ctype locale intl catgets math setjmp signal	    \
 	      localedata timezone rt conform debug mathvec support	    \
 	      dlfcn elf
 
-ifeq ($(build-crypt),yes)
-all-subdirs += crypt
-rpath-dirs += crypt
-endif
-
 ifndef avoid-generated
 # sysd-sorted itself will contain rules making the sysd-sorted target
 # depend on Depend files.  But if you just added a Depend file to an
diff --git a/NEWS b/NEWS
index a48c32e76f..ddc3574923 100644
--- a/NEWS
+++ b/NEWS
@@ -33,7 +33,21 @@  Major new features:
 
 Deprecated and removed features, and other changes affecting compatibility:
 
-  [Add deprecations, removals and changes affecting compatibility here]
+* libcrypt has been removed from the GNU C Library.  The configure
+  options "--enable-crypt" and "--enable-nss-crypt" are no longer
+  available.  <crypt.h>, libcrypt.a, and libcrypt.so.1 will not be
+  installed, and <unistd.h> will not declare the crypt function.
+
+  The replacement for libcrypt is libxcrypt, maintained separately from
+  GNU libc, but available under compatible licensing terms, and providing
+  binary backward compatibility with the former libcrypt.  It is currently
+  distributed from <https://github.com/besser82/libxcrypt/>.
+
+  As a consequence of this removal, GNU libc no longer makes any use of
+  the NSS cryptography library (Network Security Services; not to be
+  confused with Name Service Switch).  Distributors of binary packages
+  of GNU libc are advised to check whether their build processes can be
+  simplified.
 
 Changes to build and runtime requirements:
 
diff --git a/SHARED-FILES b/SHARED-FILES
index 03fa41a4fd..2ff44427bc 100644
--- a/SHARED-FILES
+++ b/SHARED-FILES
@@ -27,8 +27,6 @@  gnulib:
   argp/argp-pvh.c
   argp/argp-xinl.c
   argp/argp.h
-  crypt/md5.c
-  crypt/md5.h
   dirent/alphasort.c
   dirent/scandir.c
   # Merged from gnulib 2021-09-21
diff --git a/config.make.in b/config.make.in
index 0c4baa2731..55e8b7563b 100644
--- a/config.make.in
+++ b/config.make.in
@@ -80,16 +80,12 @@  mach-interface-list = @mach_interface_list@
 
 memory-tagging = @memory_tagging@
 
-nss-crypt = @libc_cv_nss_crypt@
-static-nss-crypt = @libc_cv_static_nss_crypt@
-
 # Configuration options.
 build-shared = @shared@
 build-profile = @profile@
 build-static-nss = @static_nss@
 cross-compiling = @cross_compiling@
 force-install = @force_install@
-build-crypt = @build_crypt@
 build-nscd = @build_nscd@
 use-nscd = @use_nscd@
 build-hardcoded-path-in-tests= @hardcoded_path_in_tests@
diff --git a/configure b/configure
index eeb3ef49b8..cb37009c17 100755
--- a/configure
+++ b/configure
@@ -700,9 +700,6 @@  INSTALL_PROGRAM
 base_machine
 build_pt_chown
 build_nscd
-libc_cv_static_nss_crypt
-libc_cv_nss_crypt
-build_crypt
 memory_tagging
 enable_werror
 force_install
@@ -806,8 +803,6 @@  enable_kernel
 enable_werror
 enable_multi_arch
 enable_memory_tagging
-enable_crypt
-enable_nss_crypt
 enable_systemtap
 enable_build_nscd
 enable_nscd
@@ -1481,9 +1476,6 @@  Optional Features:
                           architectures
   --enable-memory-tagging enable memory tagging if supported by the
                           architecture [default=no]
-  --enable-crypt          build and install the legacy passphrase hashing
-                          library, libcrypt
-  --enable-nss-crypt      enable libcrypt to use nss
   --enable-systemtap      enable systemtap static probe points [default=no]
   --disable-build-nscd    disable building and installing the nscd daemon
   --disable-nscd          library functions will not contact the nscd daemon
@@ -1739,6 +1731,44 @@  fi
 
 } # ac_fn_cxx_try_link
 
+# ac_fn_c_try_cpp LINENO
+# ----------------------
+# Try to preprocess conftest.$ac_ext, and return whether this succeeded.
+ac_fn_c_try_cpp ()
+{
+  as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
+  if { { ac_try="$ac_cpp conftest.$ac_ext"
+case "(($ac_try" in
+  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+  *) ac_try_echo=$ac_try;;
+esac
+eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
+printf "%s\n" "$ac_try_echo"; } >&5
+  (eval "$ac_cpp conftest.$ac_ext") 2>conftest.err
+  ac_status=$?
+  if test -s conftest.err; then
+    grep -v '^ *+' conftest.err >conftest.er1
+    cat conftest.er1 >&5
+    mv -f conftest.er1 conftest.err
+  fi
+  printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+  test $ac_status = 0; } > conftest.i && {
+	 test -z "$ac_c_preproc_warn_flag$ac_c_werror_flag" ||
+	 test ! -s conftest.err
+       }
+then :
+  ac_retval=0
+else $as_nop
+  printf "%s\n" "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+    ac_retval=1
+fi
+  eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno
+  as_fn_set_status $ac_retval
+
+} # ac_fn_c_try_cpp
+
 # ac_fn_c_try_link LINENO
 # -----------------------
 # Try to link conftest.$ac_ext, and return whether this succeeded.
@@ -1785,44 +1815,6 @@  fi
   as_fn_set_status $ac_retval
 
 } # ac_fn_c_try_link
-
-# ac_fn_c_try_cpp LINENO
-# ----------------------
-# Try to preprocess conftest.$ac_ext, and return whether this succeeded.
-ac_fn_c_try_cpp ()
-{
-  as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
-  if { { ac_try="$ac_cpp conftest.$ac_ext"
-case "(($ac_try" in
-  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
-  *) ac_try_echo=$ac_try;;
-esac
-eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
-printf "%s\n" "$ac_try_echo"; } >&5
-  (eval "$ac_cpp conftest.$ac_ext") 2>conftest.err
-  ac_status=$?
-  if test -s conftest.err; then
-    grep -v '^ *+' conftest.err >conftest.er1
-    cat conftest.er1 >&5
-    mv -f conftest.er1 conftest.err
-  fi
-  printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
-  test $ac_status = 0; } > conftest.i && {
-	 test -z "$ac_c_preproc_warn_flag$ac_c_werror_flag" ||
-	 test ! -s conftest.err
-       }
-then :
-  ac_retval=0
-else $as_nop
-  printf "%s\n" "$as_me: failed program was:" >&5
-sed 's/^/| /' conftest.$ac_ext >&5
-
-    ac_retval=1
-fi
-  eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno
-  as_fn_set_status $ac_retval
-
-} # ac_fn_c_try_cpp
 ac_configure_args_raw=
 for ac_arg
 do
@@ -2133,9 +2125,7 @@  struct stat;
 /* Most of the following tests are stolen from RCS 5.7 src/conf.sh.  */
 struct buf { int x; };
 struct buf * (*rcsopen) (struct buf *, struct stat *, int);
-static char *e (p, i)
-     char **p;
-     int i;
+static char *e (char **p, int i)
 {
   return p[i];
 }
@@ -2186,6 +2176,7 @@  extern int puts (const char *);
 extern int printf (const char *, ...);
 extern int dprintf (int, const char *, ...);
 extern void *malloc (size_t);
+extern void free (void *);
 
 // Check varargs macros.  These examples are taken from C99 6.10.3.5.
 // dprintf is used instead of fprintf to avoid needing to declare
@@ -4099,11 +4090,11 @@  if test x$ac_prog_cxx_stdcxx = xno
 then :
   { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $CXX option to enable C++11 features" >&5
 printf %s "checking for $CXX option to enable C++11 features... " >&6; }
-if test ${ac_cv_prog_cxx_cxx11+y}
+if test ${ac_cv_prog_cxx_11+y}
 then :
   printf %s "(cached) " >&6
 else $as_nop
-  ac_cv_prog_cxx_cxx11=no
+  ac_cv_prog_cxx_11=no
 ac_save_CXX=$CXX
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
@@ -4145,11 +4136,11 @@  if test x$ac_prog_cxx_stdcxx = xno
 then :
   { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $CXX option to enable C++98 features" >&5
 printf %s "checking for $CXX option to enable C++98 features... " >&6; }
-if test ${ac_cv_prog_cxx_cxx98+y}
+if test ${ac_cv_prog_cxx_98+y}
 then :
   printf %s "(cached) " >&6
 else $as_nop
-  ac_cv_prog_cxx_cxx98=no
+  ac_cv_prog_cxx_98=no
 ac_save_CXX=$CXX
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
@@ -4561,123 +4552,6 @@  if test "$memory_tagging" = yes; then
 fi
 
 
-# Check whether --enable-crypt was given.
-if test ${enable_crypt+y}
-then :
-  enableval=$enable_crypt; build_crypt=$enableval
-else $as_nop
-  build_crypt=no
-fi
-
-
-
-# Check whether --enable-nss-crypt was given.
-if test ${enable_nss_crypt+y}
-then :
-  enableval=$enable_nss_crypt; nss_crypt=$enableval
-else $as_nop
-  nss_crypt=no
-fi
-
-if test x$build_libcrypt = xno && test x$nss_crypt = xyes; then
-  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: --enable-nss-crypt has no effect when libcrypt is disabled" >&5
-printf "%s\n" "$as_me: WARNING: --enable-nss-crypt has no effect when libcrypt is disabled" >&2;}
-  nss_crypt=no
-fi
-if test x$nss_crypt = xyes; then
-  nss_includes=-I$(nss-config --includedir 2>/dev/null)
-  if test $? -ne 0; then
-    as_fn_error $? "cannot find include directory with nss-config" "$LINENO" 5
-  fi
-  nspr_includes=-I$(nspr-config --includedir 2>/dev/null)
-  if test $? -ne 0; then
-    as_fn_error $? "cannot find include directory with nspr-config" "$LINENO" 5
-  fi
-  old_CFLAGS="$CFLAGS"
-  CFLAGS="$CFLAGS $nss_includes $nspr_includes"
-
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
-typedef int PRBool;
-#include <hasht.h>
-#include <nsslowhash.h>
-void f (void) { NSSLOW_Init (); }
-int
-main (void)
-{
-
-  ;
-  return 0;
-}
-_ACEOF
-if ac_fn_c_try_compile "$LINENO"
-then :
-  libc_cv_nss_crypt=yes
-else $as_nop
-  as_fn_error $? "
-cannot find NSS headers with lowlevel hash function interfaces" "$LINENO" 5
-fi
-rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
-  old_LIBS="$LIBS"
-  old_LDFLAGS="$LDFLAGS"
-  LIBS="$LIBS -lfreebl3"
-  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
-typedef int PRBool;
-#include <hasht.h>
-#include <nsslowhash.h>
-int
-main (void)
-{
-NSSLOW_Init();
-  ;
-  return 0;
-}
-_ACEOF
-if ac_fn_c_try_link "$LINENO"
-then :
-  libc_cv_nss_crypt=yes
-else $as_nop
-  as_fn_error $? "
-cannot link program using lowlevel NSS hash functions" "$LINENO" 5
-fi
-rm -f core conftest.err conftest.$ac_objext conftest.beam \
-    conftest$ac_exeext conftest.$ac_ext
-  # Check to see if there is a static NSS cryptographic library.
-  # If there isn't then we can't link anything with libcrypt.a,
-  # and that might mean disabling some static tests.
-  LDFLAGS="$LDFLAGS -static"
-  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
-typedef int PRBool;
-#include <hasht.h>
-#include <nsslowhash.h>
-int
-main (void)
-{
-NSSLOW_Init();
-  ;
-  return 0;
-}
-_ACEOF
-if ac_fn_c_try_link "$LINENO"
-then :
-  libc_cv_static_nss_crypt=yes
-else $as_nop
-  libc_cv_static_nss_crypt=no
-fi
-rm -f core conftest.err conftest.$ac_objext conftest.beam \
-    conftest$ac_exeext conftest.$ac_ext
-  LDFLAGS="$old_LDFLAGS"
-  CFLAGS="$old_CFLAGS"
-  LIBS="$old_LIBS"
-else
-  libc_cv_nss_crypt=no
-  libc_cv_static_nss_crypt=no
-fi
-
-
-
 
 # Check whether --enable-systemtap was given.
 if test ${enable_systemtap+y}
@@ -4688,7 +4562,8 @@  else $as_nop
 fi
 
 if test "x$systemtap" != xno; then
-  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for systemtap static probe support" >&5
+
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for systemtap static probe support" >&5
 printf %s "checking for systemtap static probe support... " >&6; }
 if test ${libc_cv_sdt+y}
 then :
@@ -7453,8 +7328,14 @@  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 
 /* Override any GCC internal prototype to avoid an error.
    Use char because int might match the return type of a GCC
-   builtin and then its argument prototype would still apply.  */
-char is_selinux_enabled ();
+   builtin and then its argument prototype would still apply.
+   The 'extern "C"' is for builds by C++ compilers;
+   although this is not generally supported in C code supporting it here
+   has little cost and some practical benefit (sr 110532).  */
+#ifdef __cplusplus
+extern "C"
+#endif
+char is_selinux_enabled (void);
 int
 main (void)
 {
@@ -7508,8 +7389,14 @@  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 
 /* Override any GCC internal prototype to avoid an error.
    Use char because int might match the return type of a GCC
-   builtin and then its argument prototype would still apply.  */
-char audit_log_user_avc_message ();
+   builtin and then its argument prototype would still apply.
+   The 'extern "C"' is for builds by C++ compilers;
+   although this is not generally supported in C code supporting it here
+   has little cost and some practical benefit (sr 110532).  */
+#ifdef __cplusplus
+extern "C"
+#endif
+char audit_log_user_avc_message (void);
 int
 main (void)
 {
@@ -7558,8 +7445,14 @@  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 
 /* Override any GCC internal prototype to avoid an error.
    Use char because int might match the return type of a GCC
-   builtin and then its argument prototype would still apply.  */
-char cap_init ();
+   builtin and then its argument prototype would still apply.
+   The 'extern "C"' is for builds by C++ compilers;
+   although this is not generally supported in C code supporting it here
+   has little cost and some practical benefit (sr 110532).  */
+#ifdef __cplusplus
+extern "C"
+#endif
+char cap_init (void);
 int
 main (void)
 {
diff --git a/configure.ac b/configure.ac
index 6601331a06..d78926523a 100644
--- a/configure.ac
+++ b/configure.ac
@@ -305,70 +305,6 @@  if test "$memory_tagging" = yes; then
 fi
 AC_SUBST(memory_tagging)
 
-AC_ARG_ENABLE([crypt],
-              AS_HELP_STRING([--enable-crypt],
-                             [build and install the legacy passphrase hashing library, libcrypt]),
-              [build_crypt=$enableval],
-              [build_crypt=no])
-AC_SUBST(build_crypt)
-
-AC_ARG_ENABLE([nss-crypt],
-	      AS_HELP_STRING([--enable-nss-crypt],
-			     [enable libcrypt to use nss]),
-	      [nss_crypt=$enableval],
-	      [nss_crypt=no])
-if test x$build_libcrypt = xno && test x$nss_crypt = xyes; then
-  AC_MSG_WARN([--enable-nss-crypt has no effect when libcrypt is disabled])
-  nss_crypt=no
-fi
-if test x$nss_crypt = xyes; then
-  nss_includes=-I$(nss-config --includedir 2>/dev/null)
-  if test $? -ne 0; then
-    AC_MSG_ERROR([cannot find include directory with nss-config])
-  fi
-  nspr_includes=-I$(nspr-config --includedir 2>/dev/null)
-  if test $? -ne 0; then
-    AC_MSG_ERROR([cannot find include directory with nspr-config])
-  fi
-  old_CFLAGS="$CFLAGS"
-  CFLAGS="$CFLAGS $nss_includes $nspr_includes"
-  AC_COMPILE_IFELSE([AC_LANG_PROGRAM([typedef int PRBool;
-#include <hasht.h>
-#include <nsslowhash.h>
-void f (void) { NSSLOW_Init (); }])],
-	     libc_cv_nss_crypt=yes,
-	     AC_MSG_ERROR([
-cannot find NSS headers with lowlevel hash function interfaces]))
-  old_LIBS="$LIBS"
-  old_LDFLAGS="$LDFLAGS"
-  LIBS="$LIBS -lfreebl3"
-  AC_LINK_IFELSE([AC_LANG_PROGRAM([typedef int PRBool;
-#include <hasht.h>
-#include <nsslowhash.h>],
-				  [NSSLOW_Init();])],
-		 libc_cv_nss_crypt=yes,
-		 AC_MSG_ERROR([
-cannot link program using lowlevel NSS hash functions]))
-  # Check to see if there is a static NSS cryptographic library.
-  # If there isn't then we can't link anything with libcrypt.a,
-  # and that might mean disabling some static tests.
-  LDFLAGS="$LDFLAGS -static"
-  AC_LINK_IFELSE([AC_LANG_PROGRAM([typedef int PRBool;
-#include <hasht.h>
-#include <nsslowhash.h>],
-				  [NSSLOW_Init();])],
-		 libc_cv_static_nss_crypt=yes,
-		 libc_cv_static_nss_crypt=no)
-  LDFLAGS="$old_LDFLAGS"
-  CFLAGS="$old_CFLAGS"
-  LIBS="$old_LIBS"
-else
-  libc_cv_nss_crypt=no
-  libc_cv_static_nss_crypt=no
-fi
-AC_SUBST(libc_cv_nss_crypt)
-AC_SUBST(libc_cv_static_nss_crypt)
-
 
 AC_ARG_ENABLE([systemtap],
               [AS_HELP_STRING([--enable-systemtap],
diff --git a/conform/Makefile b/conform/Makefile
index 454c35f2b6..7078cb85ea 100644
--- a/conform/Makefile
+++ b/conform/Makefile
@@ -212,11 +212,6 @@  linknamespace-libs-XOPEN2K8 = $(linknamespace-libs-xsi)
 linknamespace-libs = $(foreach std,$(conformtest-standards),\
 				   $(linknamespace-libs-$(std)))
 
-ifeq ($(build-crypt),yes)
-linknamespace-libs-xsi += $(common-objpfx)crypt/libcrypt.a
-linknamespace-libs-XPG4 += $(common-objpfx)crypt/libcrypt.a
-endif
-
 $(linknamespace-symlist-stdlibs-tests): $(objpfx)symlist-stdlibs-%: \
 					$(linknamespace-libs)
 	LC_ALL=C $(READELF) -W -s $(linknamespace-libs-$*) > $@; \
diff --git a/elf/Makefile b/elf/Makefile
index 9176cbf1e3..b46dee1c16 100644
--- a/elf/Makefile
+++ b/elf/Makefile
@@ -1217,23 +1217,6 @@  $(objpfx)tst-_dl_addr_inside_object: $(objpfx)dl-addr-obj.os
 CFLAGS-tst-_dl_addr_inside_object.c += $(PIE-ccflag)
 endif
 
-# We can only test static libcrypt use if libcrypt has been built,
-# and either NSS crypto is not in use, or static NSS libraries are
-# available.
-ifeq ($(build-crypt),no)
-CFLAGS-tst-linkall-static.c += -DUSE_CRYPT=0
-else
-ifeq ($(nss-crypt),no)
-CFLAGS-tst-linkall-static.c += -DUSE_CRYPT=1
-else
-ifeq ($(static-nss-crypt),no)
-CFLAGS-tst-linkall-static.c += -DUSE_CRYPT=0
-else
-CFLAGS-tst-linkall-static.c += -DUSE_CRYPT=1
-endif
-endif
-endif
-
 include ../Rules
 
 ifeq (yes,$(build-shared))
@@ -1951,9 +1934,6 @@  endif
 ifeq ($(have-thread-library),yes)
 localplt-built-dso += $(filter-out %_nonshared.a, $(shared-thread-library))
 endif
-ifeq ($(build-crypt),yes)
-localplt-built-dso += $(addprefix $(common-objpfx), crypt/libcrypt.so)
-endif
 ifneq ($(pthread-in-libc),yes)
 localplt-built-dso += $(addprefix $(common-objpfx), rt/librt.so)
 endif
@@ -2438,24 +2418,6 @@  $(objpfx)tst-linkall-static: \
   $(common-objpfx)rt/librt.a \
   $(static-thread-library)
 
-ifeq ($(build-crypt),yes)
-# If we are using NSS crypto and we have the ability to link statically
-# then we include libcrypt.a, otherwise we leave out libcrypt.a and
-# link as much as we can into the tst-linkall-static test.  This assumes
-# that linking with libcrypt.a does everything required to include the
-# static NSS crypto library.
-ifeq (yesyes,$(nss-crypt)$(static-nss-crypt))
-$(objpfx)tst-linkall-static: \
-  $(common-objpfx)crypt/libcrypt.a
-endif
-# If we are not using NSS crypto then we always have the ability to link
-# with libcrypt.a.
-ifeq (no,$(nss-crypt))
-$(objpfx)tst-linkall-static: \
-  $(common-objpfx)crypt/libcrypt.a
-endif
-endif
-
 LDFLAGS-nextmod3.so = -Wl,--version-script=nextmod3.map
 
 # The application depends on the DSO, and the DSO loads the plugin.
diff --git a/elf/tst-linkall-static.c b/elf/tst-linkall-static.c
index d9943aa753..ccb6000d86 100644
--- a/elf/tst-linkall-static.c
+++ b/elf/tst-linkall-static.c
@@ -18,9 +18,6 @@ 
 
 #include <math.h>
 #include <pthread.h>
-#if USE_CRYPT
-# include <crypt.h>
-#endif
 #include <resolv.h>
 #include <dlfcn.h>
 #include <utmp.h>
@@ -34,9 +31,6 @@  void *references[] =
   {
     &pow,                       /* libm */
     &pthread_create,            /* libpthread */
-#if USE_CRYPT
-    &crypt,                     /* libcrypt */
-#endif
     &res_send,                  /* libresolv */
     &dlopen,                    /* libdl */
     &login,                     /* libutil */
diff --git a/manual/install.texi b/manual/install.texi
index a81139780c..ac5310731b 100644
--- a/manual/install.texi
+++ b/manual/install.texi
@@ -256,19 +256,6 @@  configure with @option{--disable-werror}.
 By default for x86_64, @theglibc{} is built with the vector math library.
 Use this option to disable the vector math library.
 
-@item --enable-crypt
-Install the legacy passphrase-hashing library @file{libcrypt} and the
-header file @file{crypt.h}.  @file{unistd.h} will declare the function
-@code{crypt} regardless of this option.  Using this option does not
-change the set of programs that may need to be linked with
-@option{-lcrypt}; it only means that @theglibc{} will provide that
-library.
-
-This option is for hackers and distributions who may not yet be able to
-use libcrypt alternatives such as libxcrypt and need this legacy
-implementation as a temporary workaround.  Note that libcrypt may be
-removed in a future release.
-
 @item --disable-scv
 Disable using @code{scv} instruction for syscalls. All syscalls will use
 @code{sc} instead, even if the kernel supports @code{scv}. PowerPC only.
diff --git a/posix/unistd.h b/posix/unistd.h
index 0477527a60..1f9cd8cbf0 100644
--- a/posix/unistd.h
+++ b/posix/unistd.h
@@ -1150,16 +1150,6 @@  ssize_t copy_file_range (int __infd, __off64_t *__pinoff,
 extern int fdatasync (int __fildes);
 #endif /* Use POSIX199309 */
 
-#ifdef __USE_MISC
-/* One-way hash PHRASE, returning a string suitable for storage in the
-   user database.  SALT selects the one-way function to use, and
-   ensures that no two users' hashes are the same, even if they use
-   the same passphrase.  The return value points to static storage
-   which will be overwritten by the next call to crypt.  */
-extern char *crypt (const char *__key, const char *__salt)
-     __THROW __nonnull ((1, 2));
-#endif
-
 #ifdef	__USE_XOPEN
 /* Swab pairs bytes in the first N bytes of the area pointed to by
    FROM and copy the result to TO.  The value of TO must not be in the
diff --git a/scripts/build-many-glibcs.py b/scripts/build-many-glibcs.py
index 57a5c48b16..1c1c4e5ae2 100755
--- a/scripts/build-many-glibcs.py
+++ b/scripts/build-many-glibcs.py
@@ -431,9 +431,7 @@  class Context(object):
                                       {'variant': 'disable-multi-arch',
                                        'arch': 'sparcv9',
                                        'ccopts': '-m32 -mlong-double-128 -mcpu=v9',
-                                       'cfg': ['--disable-multi-arch']},
-                                      {'variant': 'enable-crypt',
-                                       'cfg': ['--enable-crypt']}])
+                                       'cfg': ['--disable-multi-arch']}])
         self.add_config(arch='x86_64',
                         os_name='linux-gnu',
                         gcc_cfg=['--with-multilib-list=m64,m32,mx32'],
@@ -447,7 +445,6 @@  class Context(object):
                                                '--disable-profile',
                                                '--disable-timezone-tools',
                                                '--disable-mathvec',
-                                               '--disable-crypt',
                                                '--disable-build-nscd',
                                                '--disable-nscd']},
                                       {'variant': 'no-pie',
@@ -468,9 +465,7 @@  class Context(object):
                                       {'arch': 'i586',
                                        'ccopts': '-m32 -march=i586'},
                                       {'variant': 'enable-fortify-source',
-                                       'cfg': ['--enable-fortify-source']},
-                                      {'variant': 'enable-crypt',
-                                       'cfg': ['--enable-crypt']}])
+                                       'cfg': ['--enable-fortify-source']}])
         self.add_config(arch='x86_64',
                         os_name='gnu',
                         gcc_cfg=['--disable-multilib'])
diff --git a/scripts/documented.sh b/scripts/documented.sh
index 7d1ffd4a92..24bb7b3e54 100644
--- a/scripts/documented.sh
+++ b/scripts/documented.sh
@@ -14,7 +14,7 @@  sed -e '/^__fpending$/d' -e '/^__flbf$/d' -e '/^__fbufsize$/d' |
 sed -e '/^alloca$/d' |
 sort -u > DOCUMENTED
 
-nm --extern --define $bindir/libc.so $bindir/math/libm.so $bindir/rt/librt.so $bindir/linuxthreads/libpthread.so $bindir/dlfcn/libdl.so $bindir/crypt/libcrypt.so $bindir/login/libutil.so |
+nm --extern --define $bindir/libc.so $bindir/math/libm.so $bindir/rt/librt.so $bindir/linuxthreads/libpthread.so $bindir/dlfcn/libdl.so $bindir/login/libutil.so |
 grep -E " [TW] ([[:alpha:]]|_[[:alpha:]])" |
 sed 's/\(@.*\)//' |
 cut -b 12- |
diff --git a/shlib-versions b/shlib-versions
index b87ab50c59..b1fd0a5eab 100644
--- a/shlib-versions
+++ b/shlib-versions
@@ -50,9 +50,6 @@  libnss_db=2
 # Version for libnsl with YP and NIS+ functions.
 libnsl=1
 
-# This defines the shared library version numbers we will install.
-libcrypt=1
-
 # The gross patch for programs assuming broken locale implementations.
 libBrokenLocale=1
 
diff --git a/stdio-common/Versions b/stdio-common/Versions
index 4bcfc3fb41..fc6e71ac14 100644
--- a/stdio-common/Versions
+++ b/stdio-common/Versions
@@ -74,7 +74,7 @@  libc {
   GLIBC_PRIVATE {
     # global variables
     _itoa_lower_digits;
-    # Used in libcrypt.
+    # Formerly used in libcrypt.
     __snprintf;
   }
 }
diff --git a/sysdeps/mach/Makefile b/sysdeps/mach/Makefile
index 820c6b849d..a9d4aa04ce 100644
--- a/sysdeps/mach/Makefile
+++ b/sysdeps/mach/Makefile
@@ -50,9 +50,7 @@  mach-before-compile:
 before-compile += $(mach-before-compile)
 endif
 
-ifeq (crypt,$(subdir))
-  LDLIBS-crypt.so += $(objdir)/mach/libmachuser.so
-else ifeq (dlfcn,$(subdir))
+ifeq (dlfcn,$(subdir))
   LDLIBS-dl.so += $(objdir)/mach/libmachuser.so
 else ifeq (nis,$(subdir))
   LDLIBS-nsl.so += $(objdir)/mach/libmachuser.so
diff --git a/sysdeps/sparc/sparc32/sparcv9/multiarch/Makefile b/sysdeps/sparc/sparc32/sparcv9/multiarch/Makefile
index a6d08f3a00..d35f95e8e2 100644
--- a/sysdeps/sparc/sparc32/sparcv9/multiarch/Makefile
+++ b/sysdeps/sparc/sparc32/sparcv9/multiarch/Makefile
@@ -1,11 +1,3 @@ 
-ifeq ($(subdir),crypt)
-libcrypt-sysdep_routines += md5-crop sha256-crop sha512-crop
-endif
-
-ifeq ($(subdir),locale)
-localedef-aux += md5-crop
-endif
-
 ifeq ($(subdir),string)
 sysdep_routines += memcpy-ultra3 memcpy-niagara1 memcpy-niagara2 \
 		   memset-niagara1 memcpy-niagara4 memset-niagara4 \
diff --git a/sysdeps/sparc/sparc64/multiarch/Makefile b/sysdeps/sparc/sparc64/multiarch/Makefile
index eaf758e7aa..5dcd7bbb0e 100644
--- a/sysdeps/sparc/sparc64/multiarch/Makefile
+++ b/sysdeps/sparc/sparc64/multiarch/Makefile
@@ -1,11 +1,3 @@ 
-ifeq ($(subdir),crypt)
-libcrypt-sysdep_routines += md5-crop sha256-crop sha512-crop
-endif
-
-ifeq ($(subdir),locale)
-localedef-aux += md5-crop
-endif
-
 ifeq ($(subdir),string)
 sysdep_routines += memcpy-ultra3 memcpy-niagara1 memcpy-niagara2 \
 		   memset-niagara1 memcpy-niagara4 memset-niagara4 \
diff --git a/sysdeps/unix/sysv/linux/alpha/shlib-versions b/sysdeps/unix/sysv/linux/alpha/shlib-versions
index cd913c257c..bcbbc5454b 100644
--- a/sysdeps/unix/sysv/linux/alpha/shlib-versions
+++ b/sysdeps/unix/sysv/linux/alpha/shlib-versions
@@ -10,5 +10,4 @@  libutil=1.1
 libresolv=2.1
 
 libnsl=1.1
-libcrypt=1.1
 libBrokenLocale=1.1
diff --git a/sysdeps/unix/sysv/linux/arm/Makefile b/sysdeps/unix/sysv/linux/arm/Makefile
index 32db854cbd..e2b5a0eab3 100644
--- a/sysdeps/unix/sysv/linux/arm/Makefile
+++ b/sysdeps/unix/sysv/linux/arm/Makefile
@@ -17,10 +17,6 @@  endif
 
 # Add a syscall function to each library that needs one.
 
-ifeq ($(subdir),crypt)
-libcrypt-sysdep_routines += libc-do-syscall
-endif
-
 ifeq ($(subdir),rt)
 librt-sysdep_routines += libc-do-syscall
 librt-shared-only-routines += libc-do-syscall