[glibc/zack/remove-libcrypt] Remove --enable-crypt and --enable-nss-crypt configure options.

[Zack Weinberg <zack@sourceware.org>]

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=a0b80d284cd22b88fc2da9a06cf81de8f2460e26

commit a0b80d284cd22b88fc2da9a06cf81de8f2460e26
Author: Zack Weinberg <zack@owlfolio.org>
Date:   Thu Sep 21 11:22:47 2023 -0400

    Remove --enable-crypt and --enable-nss-crypt configure options.
    
    This makes it impossible to build libcrypt, so add a NEWS entry for
    the removal at this point, and remove the prototype for crypt() from
    unistd.h.  Also removed at this point are a handful of references to
    libcrypt in other directories (notably elf/, conform/, and SPARCv9
    sysdep Makefiles) and in maintainer-facing scripts and docs.
    
    stdio-common/Versions says that __snprintf is exported as
    GLIBC_PRIVATE because libcrypt uses it.  I doubt that was the only
    ancillary library using that symbol, but I don't know how to find
    other uses, so I left the export in place; it can always be removed
    later.
    
    There are a few files of test data that mention the crypt directory
    and/or its contents, e.g. benchtests/strcoll-inputs/filelist#en_US.UTF-8.
    As best I can tell, the intent of these is just to have a big pile of
    strings and it doesn't matter whether the named files exist, so I
    haven't altered them.
    
    The actual code, and the remainder of the documentation, will be
    deleted in subsequent patches.
    
    (I seem to have a slightly different version of autoconf than the one
    that was last used to regenerate the top-level configure script.  If
    that's a problem, let me know.)

Diff:
---
 CONTRIBUTED-BY                                   |  15 --
 INSTALL                                          |  13 --
 Makeconfig                                       |   5 -
 NEWS                                             |  16 +-
 SHARED-FILES                                     |   2 -
 config.make.in                                   |   4 -
 configure                                        | 229 ++++++-----------------
 configure.ac                                     |  64 -------
 conform/Makefile                                 |   5 -
 elf/Makefile                                     |  38 ----
 elf/tst-linkall-static.c                         |   6 -
 manual/install.texi                              |  13 --
 posix/unistd.h                                   |  10 -
 scripts/build-many-glibcs.py                     |   9 +-
 scripts/documented.sh                            |   2 +-
 shlib-versions                                   |   3 -
 stdio-common/Versions                            |   2 +-
 sysdeps/mach/Makefile                            |   4 +-
 sysdeps/sparc/sparc32/sparcv9/multiarch/Makefile |   8 -
 sysdeps/sparc/sparc64/multiarch/Makefile         |   8 -
 sysdeps/unix/sysv/linux/alpha/shlib-versions     |   1 -
 sysdeps/unix/sysv/linux/arm/Makefile             |   4 -
 22 files changed, 81 insertions(+), 380 deletions(-)

diff --git a/CONTRIBUTED-BY b/CONTRIBUTED-BY
index d53bf90e7a..0cb379cc9d 100644
--- a/CONTRIBUTED-BY
+++ b/CONTRIBUTED-BY
@@ -24,21 +24,6 @@ catgets/gencat.c:
 catgets/open_catalog.c:
     Contributed by Ulrich Drepper, <drepper@gnu.org>.
 
-crypt/md5-crypt.c:
-    Contributed by Ulrich Drepper <drepper@cygnus.com>, 1996.
-
-crypt/sha256-crypt.c:
-    Contributed by Ulrich Drepper <drepper@redhat.com>, 2007.
-
-crypt/sha256.c:
-    Written by Ulrich Drepper <drepper@redhat.com>, 2007.
-
-crypt/sha512-crypt.c:
-    Contributed by Ulrich Drepper <drepper@redhat.com>, 2007.
-
-crypt/sha512.c:
-    Written by Ulrich Drepper <drepper@redhat.com>, 2007.
-
 debug/backtrace.c:
     Contributed by Jakub Jelinek <jakub@redhat.com>, 2003.
 
diff --git a/INSTALL b/INSTALL
index b29916e748..afd88dc5b1 100644
--- a/INSTALL
+++ b/INSTALL
@@ -228,19 +228,6 @@ if ‘CFLAGS’ is specified it must enable optimization.  For example:
      By default for x86_64, the GNU C Library is built with the vector
      math library.  Use this option to disable the vector math library.
 
-‘--enable-crypt’
-     Install the legacy passphrase-hashing library ‘libcrypt’ and the
-     header file ‘crypt.h’.  ‘unistd.h’ will declare the function
-     ‘crypt’ regardless of this option.  Using this option does not
-     change the set of programs that may need to be linked with
-     ‘-lcrypt’; it only means that the GNU C Library will provide that
-     library.
-
-     This option is for hackers and distributions who may not yet be
-     able to use libcrypt alternatives such as libxcrypt and need this
-     legacy implementation as a temporary workaround.  Note that
-     libcrypt may be removed in a future release.
-
 ‘--disable-scv’
      Disable using ‘scv’ instruction for syscalls.  All syscalls will
      use ‘sc’ instead, even if the kernel supports ‘scv’.  PowerPC only.
diff --git a/Makeconfig b/Makeconfig
index c48fcc59e8..3fe827f571 100644
--- a/Makeconfig
+++ b/Makeconfig
@@ -1357,11 +1357,6 @@ all-subdirs = csu assert ctype locale intl catgets math setjmp signal	    \
 	      localedata timezone rt conform debug mathvec support	    \
 	      dlfcn elf
 
-ifeq ($(build-crypt),yes)
-all-subdirs += crypt
-rpath-dirs += crypt
-endif
-
 ifndef avoid-generated
 # sysd-sorted itself will contain rules making the sysd-sorted target
 # depend on Depend files.  But if you just added a Depend file to an
diff --git a/NEWS b/NEWS
index a48c32e76f..ddc3574923 100644
--- a/NEWS
+++ b/NEWS
@@ -33,7 +33,21 @@ Major new features:
 
 Deprecated and removed features, and other changes affecting compatibility:
 
-  [Add deprecations, removals and changes affecting compatibility here]
+* libcrypt has been removed from the GNU C Library.  The configure
+  options "--enable-crypt" and "--enable-nss-crypt" are no longer
+  available.  <crypt.h>, libcrypt.a, and libcrypt.so.1 will not be
+  installed, and <unistd.h> will not declare the crypt function.
+
+  The replacement for libcrypt is libxcrypt, maintained separately from
+  GNU libc, but available under compatible licensing terms, and providing
+  binary backward compatibility with the former libcrypt.  It is currently
+  distributed from <https://github.com/besser82/libxcrypt/>.
+
+  As a consequence of this removal, GNU libc no longer makes any use of
+  the NSS cryptography library (Network Security Services; not to be
+  confused with Name Service Switch).  Distributors of binary packages
+  of GNU libc are advised to check whether their build processes can be
+  simplified.
 
 Changes to build and runtime requirements:
 
diff --git a/SHARED-FILES b/SHARED-FILES
index 03fa41a4fd..2ff44427bc 100644
--- a/SHARED-FILES
+++ b/SHARED-FILES
@@ -27,8 +27,6 @@ gnulib:
   argp/argp-pvh.c
   argp/argp-xinl.c
   argp/argp.h
-  crypt/md5.c
-  crypt/md5.h
   dirent/alphasort.c
   dirent/scandir.c
   # Merged from gnulib 2021-09-21
diff --git a/config.make.in b/config.make.in
index 0c4baa2731..55e8b7563b 100644
--- a/config.make.in
+++ b/config.make.in
@@ -80,16 +80,12 @@ mach-interface-list = @mach_interface_list@
 
 memory-tagging = @memory_tagging@
 
-nss-crypt = @libc_cv_nss_crypt@
-static-nss-crypt = @libc_cv_static_nss_crypt@
-
 # Configuration options.
 build-shared = @shared@
 build-profile = @profile@
 build-static-nss = @static_nss@
 cross-compiling = @cross_compiling@
 force-install = @force_install@
-build-crypt = @build_crypt@
 build-nscd = @build_nscd@
 use-nscd = @use_nscd@
 build-hardcoded-path-in-tests= @hardcoded_path_in_tests@
diff --git a/configure b/configure
index eeb3ef49b8..cb37009c17 100755
--- a/configure
+++ b/configure
@@ -700,9 +700,6 @@ INSTALL_PROGRAM
 base_machine
 build_pt_chown
 build_nscd
-libc_cv_static_nss_crypt
-libc_cv_nss_crypt
-build_crypt
 memory_tagging
 enable_werror
 force_install
@@ -806,8 +803,6 @@ enable_kernel
 enable_werror
 enable_multi_arch
 enable_memory_tagging
-enable_crypt
-enable_nss_crypt
 enable_systemtap
 enable_build_nscd
 enable_nscd
@@ -1481,9 +1476,6 @@ Optional Features:
                           architectures
   --enable-memory-tagging enable memory tagging if supported by the
                           architecture [default=no]
-  --enable-crypt          build and install the legacy passphrase hashing
-                          library, libcrypt
-  --enable-nss-crypt      enable libcrypt to use nss
   --enable-systemtap      enable systemtap static probe points [default=no]
   --disable-build-nscd    disable building and installing the nscd daemon
   --disable-nscd          library functions will not contact the nscd daemon
@@ -1739,21 +1731,20 @@ fi
 
 } # ac_fn_cxx_try_link
 
-# ac_fn_c_try_link LINENO
-# -----------------------
-# Try to link conftest.$ac_ext, and return whether this succeeded.
-ac_fn_c_try_link ()
+# ac_fn_c_try_cpp LINENO
+# ----------------------
+# Try to preprocess conftest.$ac_ext, and return whether this succeeded.
+ac_fn_c_try_cpp ()
 {
   as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
-  rm -f conftest.$ac_objext conftest.beam conftest$ac_exeext
-  if { { ac_try="$ac_link"
+  if { { ac_try="$ac_cpp conftest.$ac_ext"
 case "(($ac_try" in
   *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
   *) ac_try_echo=$ac_try;;
 esac
 eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
 printf "%s\n" "$ac_try_echo"; } >&5
-  (eval "$ac_link") 2>conftest.err
+  (eval "$ac_cpp conftest.$ac_ext") 2>conftest.err
   ac_status=$?
   if test -s conftest.err; then
     grep -v '^ *+' conftest.err >conftest.er1
@@ -1761,12 +1752,9 @@ printf "%s\n" "$ac_try_echo"; } >&5
     mv -f conftest.er1 conftest.err
   fi
   printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
-  test $ac_status = 0; } && {
-	 test -z "$ac_c_werror_flag" ||
+  test $ac_status = 0; } > conftest.i && {
+	 test -z "$ac_c_preproc_warn_flag$ac_c_werror_flag" ||
 	 test ! -s conftest.err
-       } && test -s conftest$ac_exeext && {
-	 test "$cross_compiling" = yes ||
-	 test -x conftest$ac_exeext
        }
 then :
   ac_retval=0
@@ -1774,32 +1762,28 @@ else $as_nop
   printf "%s\n" "$as_me: failed program was:" >&5
 sed 's/^/| /' conftest.$ac_ext >&5
 
-	ac_retval=1
+    ac_retval=1
 fi
-  # Delete the IPA/IPO (Inter Procedural Analysis/Optimization) information
-  # created by the PGI compiler (conftest_ipa8_conftest.oo), as it would
-  # interfere with the next link command; also delete a directory that is
-  # left behind by Apple's compiler.  We do this before executing the actions.
-  rm -rf conftest.dSYM conftest_ipa8_conftest.oo
   eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno
   as_fn_set_status $ac_retval
 
-} # ac_fn_c_try_link
+} # ac_fn_c_try_cpp
 
-# ac_fn_c_try_cpp LINENO
-# ----------------------
-# Try to preprocess conftest.$ac_ext, and return whether this succeeded.
-ac_fn_c_try_cpp ()
+# ac_fn_c_try_link LINENO
+# -----------------------
+# Try to link conftest.$ac_ext, and return whether this succeeded.
+ac_fn_c_try_link ()
 {
   as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
-  if { { ac_try="$ac_cpp conftest.$ac_ext"
+  rm -f conftest.$ac_objext conftest.beam conftest$ac_exeext
+  if { { ac_try="$ac_link"
 case "(($ac_try" in
   *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
   *) ac_try_echo=$ac_try;;
 esac
 eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
 printf "%s\n" "$ac_try_echo"; } >&5
-  (eval "$ac_cpp conftest.$ac_ext") 2>conftest.err
+  (eval "$ac_link") 2>conftest.err
   ac_status=$?
   if test -s conftest.err; then
     grep -v '^ *+' conftest.err >conftest.er1
@@ -1807,9 +1791,12 @@ printf "%s\n" "$ac_try_echo"; } >&5
     mv -f conftest.er1 conftest.err
   fi
   printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
-  test $ac_status = 0; } > conftest.i && {
-	 test -z "$ac_c_preproc_warn_flag$ac_c_werror_flag" ||
+  test $ac_status = 0; } && {
+	 test -z "$ac_c_werror_flag" ||
 	 test ! -s conftest.err
+       } && test -s conftest$ac_exeext && {
+	 test "$cross_compiling" = yes ||
+	 test -x conftest$ac_exeext
        }
 then :
   ac_retval=0
@@ -1817,12 +1804,17 @@ else $as_nop
   printf "%s\n" "$as_me: failed program was:" >&5
 sed 's/^/| /' conftest.$ac_ext >&5
 
-    ac_retval=1
+	ac_retval=1
 fi
+  # Delete the IPA/IPO (Inter Procedural Analysis/Optimization) information
+  # created by the PGI compiler (conftest_ipa8_conftest.oo), as it would
+  # interfere with the next link command; also delete a directory that is
+  # left behind by Apple's compiler.  We do this before executing the actions.
+  rm -rf conftest.dSYM conftest_ipa8_conftest.oo
   eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno
   as_fn_set_status $ac_retval
 
-} # ac_fn_c_try_cpp
+} # ac_fn_c_try_link
 ac_configure_args_raw=
 for ac_arg
 do
@@ -2133,9 +2125,7 @@ struct stat;
 /* Most of the following tests are stolen from RCS 5.7 src/conf.sh.  */
 struct buf { int x; };
 struct buf * (*rcsopen) (struct buf *, struct stat *, int);
-static char *e (p, i)
-     char **p;
-     int i;
+static char *e (char **p, int i)
 {
   return p[i];
 }
@@ -2186,6 +2176,7 @@ extern int puts (const char *);
 extern int printf (const char *, ...);
 extern int dprintf (int, const char *, ...);
 extern void *malloc (size_t);
+extern void free (void *);
 
 // Check varargs macros.  These examples are taken from C99 6.10.3.5.
 // dprintf is used instead of fprintf to avoid needing to declare
@@ -4099,11 +4090,11 @@ if test x$ac_prog_cxx_stdcxx = xno
 then :
   { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $CXX option to enable C++11 features" >&5
 printf %s "checking for $CXX option to enable C++11 features... " >&6; }
-if test ${ac_cv_prog_cxx_cxx11+y}
+if test ${ac_cv_prog_cxx_11+y}
 then :
   printf %s "(cached) " >&6
 else $as_nop
-  ac_cv_prog_cxx_cxx11=no
+  ac_cv_prog_cxx_11=no
 ac_save_CXX=$CXX
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
@@ -4145,11 +4136,11 @@ if test x$ac_prog_cxx_stdcxx = xno
 then :
   { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $CXX option to enable C++98 features" >&5
 printf %s "checking for $CXX option to enable C++98 features... " >&6; }
-if test ${ac_cv_prog_cxx_cxx98+y}
+if test ${ac_cv_prog_cxx_98+y}
 then :
   printf %s "(cached) " >&6
 else $as_nop
-  ac_cv_prog_cxx_cxx98=no
+  ac_cv_prog_cxx_98=no
 ac_save_CXX=$CXX
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
@@ -4561,123 +4552,6 @@ if test "$memory_tagging" = yes; then
 fi
 
 
-# Check whether --enable-crypt was given.
-if test ${enable_crypt+y}
-then :
-  enableval=$enable_crypt; build_crypt=$enableval
-else $as_nop
-  build_crypt=no
-fi
-
-
-
-# Check whether --enable-nss-crypt was given.
-if test ${enable_nss_crypt+y}
-then :
-  enableval=$enable_nss_crypt; nss_crypt=$enableval
-else $as_nop
-  nss_crypt=no
-fi
-
-if test x$build_libcrypt = xno && test x$nss_crypt = xyes; then
-  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: --enable-nss-crypt has no effect when libcrypt is disabled" >&5
-printf "%s\n" "$as_me: WARNING: --enable-nss-crypt has no effect when libcrypt is disabled" >&2;}
-  nss_crypt=no
-fi
-if test x$nss_crypt = xyes; then
-  nss_includes=-I$(nss-config --includedir 2>/dev/null)
-  if test $? -ne 0; then
-    as_fn_error $? "cannot find include directory with nss-config" "$LINENO" 5
-  fi
-  nspr_includes=-I$(nspr-config --includedir 2>/dev/null)
-  if test $? -ne 0; then
-    as_fn_error $? "cannot find include directory with nspr-config" "$LINENO" 5
-  fi
-  old_CFLAGS="$CFLAGS"
-  CFLAGS="$CFLAGS $nss_includes $nspr_includes"
-
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
-typedef int PRBool;
-#include <hasht.h>
-#include <nsslowhash.h>
-void f (void) { NSSLOW_Init (); }
-int
-main (void)
-{
-
-  ;
-  return 0;
-}
-_ACEOF
-if ac_fn_c_try_compile "$LINENO"
-then :
-  libc_cv_nss_crypt=yes
-else $as_nop
-  as_fn_error $? "
-cannot find NSS headers with lowlevel hash function interfaces" "$LINENO" 5
-fi
-rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
-  old_LIBS="$LIBS"
-  old_LDFLAGS="$LDFLAGS"
-  LIBS="$LIBS -lfreebl3"
-  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
-typedef int PRBool;
-#include <hasht.h>
-#include <nsslowhash.h>
-int
-main (void)
-{
-NSSLOW_Init();
-  ;
-  return 0;
-}
-_ACEOF
-if ac_fn_c_try_link "$LINENO"
-then :
-  libc_cv_nss_crypt=yes
-else $as_nop
-  as_fn_error $? "
-cannot link program using lowlevel NSS hash functions" "$LINENO" 5
-fi
-rm -f core conftest.err conftest.$ac_objext conftest.beam \
-    conftest$ac_exeext conftest.$ac_ext
-  # Check to see if there is a static NSS cryptographic library.
-  # If there isn't then we can't link anything with libcrypt.a,
-  # and that might mean disabling some static tests.
-  LDFLAGS="$LDFLAGS -static"
-  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
-typedef int PRBool;
-#include <hasht.h>
-#include <nsslowhash.h>
-int
-main (void)
-{
-NSSLOW_Init();
-  ;
-  return 0;
-}
-_ACEOF
-if ac_fn_c_try_link "$LINENO"
-then :
-  libc_cv_static_nss_crypt=yes
-else $as_nop
-  libc_cv_static_nss_crypt=no
-fi
-rm -f core conftest.err conftest.$ac_objext conftest.beam \
-    conftest$ac_exeext conftest.$ac_ext
-  LDFLAGS="$old_LDFLAGS"
-  CFLAGS="$old_CFLAGS"
-  LIBS="$old_LIBS"
-else
-  libc_cv_nss_crypt=no
-  libc_cv_static_nss_crypt=no
-fi
-
-
-
 
 # Check whether --enable-systemtap was given.
 if test ${enable_systemtap+y}
@@ -4688,7 +4562,8 @@ else $as_nop
 fi
 
 if test "x$systemtap" != xno; then
-  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for systemtap static probe support" >&5
+
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for systemtap static probe support" >&5
 printf %s "checking for systemtap static probe support... " >&6; }
 if test ${libc_cv_sdt+y}
 then :
@@ -7453,8 +7328,14 @@ cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 
 /* Override any GCC internal prototype to avoid an error.
    Use char because int might match the return type of a GCC
-   builtin and then its argument prototype would still apply.  */
-char is_selinux_enabled ();
+   builtin and then its argument prototype would still apply.
+   The 'extern "C"' is for builds by C++ compilers;
+   although this is not generally supported in C code supporting it here
+   has little cost and some practical benefit (sr 110532).  */
+#ifdef __cplusplus
+extern "C"
+#endif
+char is_selinux_enabled (void);
 int
 main (void)
 {
@@ -7508,8 +7389,14 @@ cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 
 /* Override any GCC internal prototype to avoid an error.
    Use char because int might match the return type of a GCC
-   builtin and then its argument prototype would still apply.  */
-char audit_log_user_avc_message ();
+   builtin and then its argument prototype would still apply.
+   The 'extern "C"' is for builds by C++ compilers;
+   although this is not generally supported in C code supporting it here
+   has little cost and some practical benefit (sr 110532).  */
+#ifdef __cplusplus
+extern "C"
+#endif
+char audit_log_user_avc_message (void);
 int
 main (void)
 {
@@ -7558,8 +7445,14 @@ cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 
 /* Override any GCC internal prototype to avoid an error.
    Use char because int might match the return type of a GCC
-   builtin and then its argument prototype would still apply.  */
-char cap_init ();
+   builtin and then its argument prototype would still apply.
+   The 'extern "C"' is for builds by C++ compilers;
+   although this is not generally supported in C code supporting it here
+   has little cost and some practical benefit (sr 110532).  */
+#ifdef __cplusplus
+extern "C"
+#endif
+char cap_init (void);
 int
 main (void)
 {
diff --git a/configure.ac b/configure.ac
index 6601331a06..d78926523a 100644
--- a/configure.ac
+++ b/configure.ac
@@ -305,70 +305,6 @@ if test "$memory_tagging" = yes; then
 fi
 AC_SUBST(memory_tagging)
 
-AC_ARG_ENABLE([crypt],
-              AS_HELP_STRING([--enable-crypt],
-                             [build and install the legacy passphrase hashing library, libcrypt]),
-              [build_crypt=$enableval],
-              [build_crypt=no])
-AC_SUBST(build_crypt)
-
-AC_ARG_ENABLE([nss-crypt],
-	      AS_HELP_STRING([--enable-nss-crypt],
-			     [enable libcrypt to use nss]),
-	      [nss_crypt=$enableval],
-	      [nss_crypt=no])
-if test x$build_libcrypt = xno && test x$nss_crypt = xyes; then
-  AC_MSG_WARN([--enable-nss-crypt has no effect when libcrypt is disabled])
-  nss_crypt=no
-fi
-if test x$nss_crypt = xyes; then
-  nss_includes=-I$(nss-config --includedir 2>/dev/null)
-  if test $? -ne 0; then
-    AC_MSG_ERROR([cannot find include directory with nss-config])
-  fi
-  nspr_includes=-I$(nspr-config --includedir 2>/dev/null)
-  if test $? -ne 0; then
-    AC_MSG_ERROR([cannot find include directory with nspr-config])
-  fi
-  old_CFLAGS="$CFLAGS"
-  CFLAGS="$CFLAGS $nss_includes $nspr_includes"
-  AC_COMPILE_IFELSE([AC_LANG_PROGRAM([typedef int PRBool;
-#include <hasht.h>
-#include <nsslowhash.h>
-void f (void) { NSSLOW_Init (); }])],
-	     libc_cv_nss_crypt=yes,
-	     AC_MSG_ERROR([
-cannot find NSS headers with lowlevel hash function interfaces]))
-  old_LIBS="$LIBS"
-  old_LDFLAGS="$LDFLAGS"
-  LIBS="$LIBS -lfreebl3"
-  AC_LINK_IFELSE([AC_LANG_PROGRAM([typedef int PRBool;
-#include <hasht.h>
-#include <nsslowhash.h>],
-				  [NSSLOW_Init();])],
-		 libc_cv_nss_crypt=yes,
-		 AC_MSG_ERROR([
-cannot link program using lowlevel NSS hash functions]))
-  # Check to see if there is a static NSS cryptographic library.
-  # If there isn't then we can't link anything with libcrypt.a,
-  # and that might mean disabling some static tests.
-  LDFLAGS="$LDFLAGS -static"
-  AC_LINK_IFELSE([AC_LANG_PROGRAM([typedef int PRBool;
-#include <hasht.h>
-#include <nsslowhash.h>],
-				  [NSSLOW_Init();])],
-		 libc_cv_static_nss_crypt=yes,
-		 libc_cv_static_nss_crypt=no)
-  LDFLAGS="$old_LDFLAGS"
-  CFLAGS="$old_CFLAGS"
-  LIBS="$old_LIBS"
-else
-  libc_cv_nss_crypt=no
-  libc_cv_static_nss_crypt=no
-fi
-AC_SUBST(libc_cv_nss_crypt)
-AC_SUBST(libc_cv_static_nss_crypt)
-
 
 AC_ARG_ENABLE([systemtap],
               [AS_HELP_STRING([--enable-systemtap],
diff --git a/conform/Makefile b/conform/Makefile
index 454c35f2b6..7078cb85ea 100644
--- a/conform/Makefile
+++ b/conform/Makefile
@@ -212,11 +212,6 @@ linknamespace-libs-XOPEN2K8 = $(linknamespace-libs-xsi)
 linknamespace-libs = $(foreach std,$(conformtest-standards),\
 				   $(linknamespace-libs-$(std)))
 
-ifeq ($(build-crypt),yes)
-linknamespace-libs-xsi += $(common-objpfx)crypt/libcrypt.a
-linknamespace-libs-XPG4 += $(common-objpfx)crypt/libcrypt.a
-endif
-
 $(linknamespace-symlist-stdlibs-tests): $(objpfx)symlist-stdlibs-%: \
 					$(linknamespace-libs)
 	LC_ALL=C $(READELF) -W -s $(linknamespace-libs-$*) > $@; \
diff --git a/elf/Makefile b/elf/Makefile
index 9176cbf1e3..b46dee1c16 100644
--- a/elf/Makefile
+++ b/elf/Makefile
@@ -1217,23 +1217,6 @@ $(objpfx)tst-_dl_addr_inside_object: $(objpfx)dl-addr-obj.os
 CFLAGS-tst-_dl_addr_inside_object.c += $(PIE-ccflag)
 endif
 
-# We can only test static libcrypt use if libcrypt has been built,
-# and either NSS crypto is not in use, or static NSS libraries are
-# available.
-ifeq ($(build-crypt),no)
-CFLAGS-tst-linkall-static.c += -DUSE_CRYPT=0
-else
-ifeq ($(nss-crypt),no)
-CFLAGS-tst-linkall-static.c += -DUSE_CRYPT=1
-else
-ifeq ($(static-nss-crypt),no)
-CFLAGS-tst-linkall-static.c += -DUSE_CRYPT=0
-else
-CFLAGS-tst-linkall-static.c += -DUSE_CRYPT=1
-endif
-endif
-endif
-
 include ../Rules
 
 ifeq (yes,$(build-shared))
@@ -1951,9 +1934,6 @@ endif
 ifeq ($(have-thread-library),yes)
 localplt-built-dso += $(filter-out %_nonshared.a, $(shared-thread-library))
 endif
-ifeq ($(build-crypt),yes)
-localplt-built-dso += $(addprefix $(common-objpfx), crypt/libcrypt.so)
-endif
 ifneq ($(pthread-in-libc),yes)
 localplt-built-dso += $(addprefix $(common-objpfx), rt/librt.so)
 endif
@@ -2438,24 +2418,6 @@ $(objpfx)tst-linkall-static: \
   $(common-objpfx)rt/librt.a \
   $(static-thread-library)
 
-ifeq ($(build-crypt),yes)
-# If we are using NSS crypto and we have the ability to link statically
-# then we include libcrypt.a, otherwise we leave out libcrypt.a and
-# link as much as we can into the tst-linkall-static test.  This assumes
-# that linking with libcrypt.a does everything required to include the
-# static NSS crypto library.
-ifeq (yesyes,$(nss-crypt)$(static-nss-crypt))
-$(objpfx)tst-linkall-static: \
-  $(common-objpfx)crypt/libcrypt.a
-endif
-# If we are not using NSS crypto then we always have the ability to link
-# with libcrypt.a.
-ifeq (no,$(nss-crypt))
-$(objpfx)tst-linkall-static: \
-  $(common-objpfx)crypt/libcrypt.a
-endif
-endif
-
 LDFLAGS-nextmod3.so = -Wl,--version-script=nextmod3.map
 
 # The application depends on the DSO, and the DSO loads the plugin.
diff --git a/elf/tst-linkall-static.c b/elf/tst-linkall-static.c
index d9943aa753..ccb6000d86 100644
--- a/elf/tst-linkall-static.c
+++ b/elf/tst-linkall-static.c
@@ -18,9 +18,6 @@
 
 #include <math.h>
 #include <pthread.h>
-#if USE_CRYPT
-# include <crypt.h>
-#endif
 #include <resolv.h>
 #include <dlfcn.h>
 #include <utmp.h>
@@ -34,9 +31,6 @@ void *references[] =
   {
     &pow,                       /* libm */
     &pthread_create,            /* libpthread */
-#if USE_CRYPT
-    &crypt,                     /* libcrypt */
-#endif
     &res_send,                  /* libresolv */
     &dlopen,                    /* libdl */
     &login,                     /* libutil */
diff --git a/manual/install.texi b/manual/install.texi
index a81139780c..ac5310731b 100644
--- a/manual/install.texi
+++ b/manual/install.texi
@@ -256,19 +256,6 @@ configure with @option{--disable-werror}.
 By default for x86_64, @theglibc{} is built with the vector math library.
 Use this option to disable the vector math library.
 
-@item --enable-crypt
-Install the legacy passphrase-hashing library @file{libcrypt} and the
-header file @file{crypt.h}.  @file{unistd.h} will declare the function
-@code{crypt} regardless of this option.  Using this option does not
-change the set of programs that may need to be linked with
-@option{-lcrypt}; it only means that @theglibc{} will provide that
-library.
-
-This option is for hackers and distributions who may not yet be able to
-use libcrypt alternatives such as libxcrypt and need this legacy
-implementation as a temporary workaround.  Note that libcrypt may be
-removed in a future release.
-
 @item --disable-scv
 Disable using @code{scv} instruction for syscalls. All syscalls will use
 @code{sc} instead, even if the kernel supports @code{scv}. PowerPC only.
diff --git a/posix/unistd.h b/posix/unistd.h
index 0477527a60..1f9cd8cbf0 100644
--- a/posix/unistd.h
+++ b/posix/unistd.h
@@ -1150,16 +1150,6 @@ ssize_t copy_file_range (int __infd, __off64_t *__pinoff,
 extern int fdatasync (int __fildes);
 #endif /* Use POSIX199309 */
 
-#ifdef __USE_MISC
-/* One-way hash PHRASE, returning a string suitable for storage in the
-   user database.  SALT selects the one-way function to use, and
-   ensures that no two users' hashes are the same, even if they use
-   the same passphrase.  The return value points to static storage
-   which will be overwritten by the next call to crypt.  */
-extern char *crypt (const char *__key, const char *__salt)
-     __THROW __nonnull ((1, 2));
-#endif
-
 #ifdef	__USE_XOPEN
 /* Swab pairs bytes in the first N bytes of the area pointed to by
    FROM and copy the result to TO.  The value of TO must not be in the
diff --git a/scripts/build-many-glibcs.py b/scripts/build-many-glibcs.py
index 57a5c48b16..1c1c4e5ae2 100755
--- a/scripts/build-many-glibcs.py
+++ b/scripts/build-many-glibcs.py
@@ -431,9 +431,7 @@ class Context(object):
                                       {'variant': 'disable-multi-arch',
                                        'arch': 'sparcv9',
                                        'ccopts': '-m32 -mlong-double-128 -mcpu=v9',
-                                       'cfg': ['--disable-multi-arch']},
-                                      {'variant': 'enable-crypt',
-                                       'cfg': ['--enable-crypt']}])
+                                       'cfg': ['--disable-multi-arch']}])
         self.add_config(arch='x86_64',
                         os_name='linux-gnu',
                         gcc_cfg=['--with-multilib-list=m64,m32,mx32'],
@@ -447,7 +445,6 @@ class Context(object):
                                                '--disable-profile',
                                                '--disable-timezone-tools',
                                                '--disable-mathvec',
-                                               '--disable-crypt',
                                                '--disable-build-nscd',
                                                '--disable-nscd']},
                                       {'variant': 'no-pie',
@@ -468,9 +465,7 @@ class Context(object):
                                       {'arch': 'i586',
                                        'ccopts': '-m32 -march=i586'},
                                       {'variant': 'enable-fortify-source',
-                                       'cfg': ['--enable-fortify-source']},
-                                      {'variant': 'enable-crypt',
-                                       'cfg': ['--enable-crypt']}])
+                                       'cfg': ['--enable-fortify-source']}])
         self.add_config(arch='x86_64',
                         os_name='gnu',
                         gcc_cfg=['--disable-multilib'])
diff --git a/scripts/documented.sh b/scripts/documented.sh
index 7d1ffd4a92..24bb7b3e54 100644
--- a/scripts/documented.sh
+++ b/scripts/documented.sh
@@ -14,7 +14,7 @@ sed -e '/^__fpending$/d' -e '/^__flbf$/d' -e '/^__fbufsize$/d' |
 sed -e '/^alloca$/d' |
 sort -u > DOCUMENTED
 
-nm --extern --define $bindir/libc.so $bindir/math/libm.so $bindir/rt/librt.so $bindir/linuxthreads/libpthread.so $bindir/dlfcn/libdl.so $bindir/crypt/libcrypt.so $bindir/login/libutil.so |
+nm --extern --define $bindir/libc.so $bindir/math/libm.so $bindir/rt/librt.so $bindir/linuxthreads/libpthread.so $bindir/dlfcn/libdl.so $bindir/login/libutil.so |
 grep -E " [TW] ([[:alpha:]]|_[[:alpha:]])" |
 sed 's/\(@.*\)//' |
 cut -b 12- |
diff --git a/shlib-versions b/shlib-versions
index b87ab50c59..b1fd0a5eab 100644
--- a/shlib-versions
+++ b/shlib-versions
@@ -50,9 +50,6 @@ libnss_db=2
 # Version for libnsl with YP and NIS+ functions.
 libnsl=1
 
-# This defines the shared library version numbers we will install.
-libcrypt=1
-
 # The gross patch for programs assuming broken locale implementations.
 libBrokenLocale=1
 
diff --git a/stdio-common/Versions b/stdio-common/Versions
index 4bcfc3fb41..fc6e71ac14 100644
--- a/stdio-common/Versions
+++ b/stdio-common/Versions
@@ -74,7 +74,7 @@ libc {
   GLIBC_PRIVATE {
     # global variables
     _itoa_lower_digits;
-    # Used in libcrypt.
+    # Formerly used in libcrypt.
     __snprintf;
   }
 }
diff --git a/sysdeps/mach/Makefile b/sysdeps/mach/Makefile
index 820c6b849d..a9d4aa04ce 100644
--- a/sysdeps/mach/Makefile
+++ b/sysdeps/mach/Makefile
@@ -50,9 +50,7 @@ mach-before-compile:
 before-compile += $(mach-before-compile)
 endif
 
-ifeq (crypt,$(subdir))
-  LDLIBS-crypt.so += $(objdir)/mach/libmachuser.so
-else ifeq (dlfcn,$(subdir))
+ifeq (dlfcn,$(subdir))
   LDLIBS-dl.so += $(objdir)/mach/libmachuser.so
 else ifeq (nis,$(subdir))
   LDLIBS-nsl.so += $(objdir)/mach/libmachuser.so
diff --git a/sysdeps/sparc/sparc32/sparcv9/multiarch/Makefile b/sysdeps/sparc/sparc32/sparcv9/multiarch/Makefile
index a6d08f3a00..d35f95e8e2 100644
--- a/sysdeps/sparc/sparc32/sparcv9/multiarch/Makefile
+++ b/sysdeps/sparc/sparc32/sparcv9/multiarch/Makefile
@@ -1,11 +1,3 @@
-ifeq ($(subdir),crypt)
-libcrypt-sysdep_routines += md5-crop sha256-crop sha512-crop
-endif
-
-ifeq ($(subdir),locale)
-localedef-aux += md5-crop
-endif
-
 ifeq ($(subdir),string)
 sysdep_routines += memcpy-ultra3 memcpy-niagara1 memcpy-niagara2 \
 		   memset-niagara1 memcpy-niagara4 memset-niagara4 \
diff --git a/sysdeps/sparc/sparc64/multiarch/Makefile b/sysdeps/sparc/sparc64/multiarch/Makefile
index eaf758e7aa..5dcd7bbb0e 100644
--- a/sysdeps/sparc/sparc64/multiarch/Makefile
+++ b/sysdeps/sparc/sparc64/multiarch/Makefile
@@ -1,11 +1,3 @@
-ifeq ($(subdir),crypt)
-libcrypt-sysdep_routines += md5-crop sha256-crop sha512-crop
-endif
-
-ifeq ($(subdir),locale)
-localedef-aux += md5-crop
-endif
-
 ifeq ($(subdir),string)
 sysdep_routines += memcpy-ultra3 memcpy-niagara1 memcpy-niagara2 \
 		   memset-niagara1 memcpy-niagara4 memset-niagara4 \
diff --git a/sysdeps/unix/sysv/linux/alpha/shlib-versions b/sysdeps/unix/sysv/linux/alpha/shlib-versions
index cd913c257c..bcbbc5454b 100644
--- a/sysdeps/unix/sysv/linux/alpha/shlib-versions
+++ b/sysdeps/unix/sysv/linux/alpha/shlib-versions
@@ -10,5 +10,4 @@ libutil=1.1
 libresolv=2.1
 
 libnsl=1.1
-libcrypt=1.1
 libBrokenLocale=1.1
diff --git a/sysdeps/unix/sysv/linux/arm/Makefile b/sysdeps/unix/sysv/linux/arm/Makefile
index 32db854cbd..e2b5a0eab3 100644
--- a/sysdeps/unix/sysv/linux/arm/Makefile
+++ b/sysdeps/unix/sysv/linux/arm/Makefile
@@ -17,10 +17,6 @@ endif
 
 # Add a syscall function to each library that needs one.
 
-ifeq ($(subdir),crypt)
-libcrypt-sysdep_routines += libc-do-syscall
-endif
-
 ifeq ($(subdir),rt)
 librt-sysdep_routines += libc-do-syscall
 librt-shared-only-routines += libc-do-syscall