--- old/usr/src/cmd/cmd-inet/usr.lib/wanboot/Makefile.com	2014-05-21 04:03:13.035204507 +0400
+++ new/usr/src/cmd/cmd-inet/usr.lib/wanboot/Makefile.com	2014-05-21 04:03:13.085663720 +0400
@@ -31,4 +31,9 @@
 
 CERRWARN += -_gcc=-Wno-uninitialized
 
+# OpenSSLs API includes some macro expansions that are incompatible with lint,
+# depending on the version of OpenSSL used
+LINTFLAGS   +=    -erroff=E_SUPPRESSION_DIRECTIVE_UNUSED
+LINTFLAGS64 +=    -erroff=E_SUPPRESSION_DIRECTIVE_UNUSED
+
 .KEEP_STATE:
--- old/usr/src/cmd/cmd-inet/usr.lib/wanboot/p12split/Makefile	2014-05-21 04:03:14.534804842 +0400
+++ new/usr/src/cmd/cmd-inet/usr.lib/wanboot/p12split/Makefile	2014-05-21 04:03:15.016540354 +0400
@@ -25,9 +25,14 @@
 include ../Makefile.com
 
 PROG=		p12split
-LDLIBS +=	-lwanboot -linetutil -lwanbootutil -lcrypto
+LDLIBS +=	-lwanboot -linetutil -lwanbootutil
 CPPFLAGS +=	-I$(CMNCRYPTDIR)
 
+# libcrypto has no lint library, so we can only include this while building
+$(PROG) := LDLIBS += -lcrypto
+
+LINTFLAGS +=	-erroff=E_NAME_USED_NOT_DEF2
+
 all:		$(PROG)
 
 install:	all $(ROOTCMD)
--- old/usr/src/cmd/cmd-inet/usr.lib/wanboot/wanboot-cgi/Makefile	2014-05-21 04:03:16.284061960 +0400
+++ new/usr/src/cmd/cmd-inet/usr.lib/wanboot/wanboot-cgi/Makefile	2014-05-21 04:03:16.318603224 +0400
@@ -25,9 +25,12 @@
 include ../Makefile.com
 
 PROG =		wanboot-cgi
-LDLIBS +=	-lgen -lnsl -lwanbootutil -lnvpair -lwanboot -lcrypto
+LDLIBS +=	-lgen -lnsl -lwanbootutil -lnvpair -lwanboot
 CPPFLAGS +=	-I$(CMNCRYPTDIR)
 
+# libcrypto has no lint library, so we can only include this while building
+$(PROG) := LDLIBS += -lcrypto
+
 all:		$(PROG)
 
 install:	all $(ROOTCMD)
--- old/usr/src/cmd/ssh/libssh/Makefile.com	2014-05-21 04:03:17.360486478 +0400
+++ new/usr/src/cmd/ssh/libssh/Makefile.com	2014-05-21 04:03:17.379794013 +0400
@@ -94,7 +94,7 @@
 # Define LDLIBS conditionally for lintcheck, rather than in general, since
 # we're building an archive library which itself links to nothing, we just
 # want lint to know about these libraries.
-lintcheck  :=	LDLIBS += -lcrypto -lz -lsocket -lnsl -lc
+lintcheck  :=	LDLIBS += -lz -lsocket -lnsl -lc
 $(LINTLIB) :=	SRCS = $(SRCDIR)/$(LINTSRC)
 
 POFILE_DIR =	../..
--- old/usr/src/cmd/ssh/sftp-server/Makefile	2014-05-21 04:03:18.868773206 +0400
+++ new/usr/src/cmd/ssh/sftp-server/Makefile	2014-05-21 04:03:18.941769528 +0400
@@ -31,7 +31,10 @@
 include ../../Makefile.cmd
 include ../Makefile.ssh-common
 
-LDLIBS +=	$(SSH_COMMON_LDLIBS) -lsocket -lcrypto
+LDLIBS +=	$(SSH_COMMON_LDLIBS) -lsocket
+
+# libcrypto has no lint library, so we can only use it when building
+$(PROG) := 	LDLIBS += -lcrypto
 
 POFILE_DIR =	..
 
--- old/usr/src/cmd/ssh/sftp/Makefile	2014-05-21 04:03:19.886550717 +0400
+++ new/usr/src/cmd/ssh/sftp/Makefile	2014-05-21 04:03:19.901032698 +0400
@@ -35,7 +35,10 @@
 include ../../Makefile.cmd
 include ../Makefile.ssh-common
 
-LDLIBS +=	$(SSH_COMMON_LDLIBS) -lsocket -lcrypto -ltecla
+LDLIBS +=	$(SSH_COMMON_LDLIBS) -lsocket -ltecla
+
+# libcrypto has no lint library, so we can only use it when building
+$(PROG) := LDLIBS += -lcrypto
 
 POFILE_DIR =	..
 
--- old/usr/src/cmd/ssh/ssh-add/Makefile	2014-05-21 04:03:21.064415857 +0400
+++ new/usr/src/cmd/ssh/ssh-add/Makefile	2014-05-21 04:03:21.137106956 +0400
@@ -32,7 +32,10 @@
 include ../../Makefile.cmd
 include ../Makefile.ssh-common
 
-LDLIBS += $(SSH_COMMON_LDLIBS) -lsocket -lcrypto
+LDLIBS += $(SSH_COMMON_LDLIBS) -lsocket
+
+# libcrypto has no lint library, so we can only use it when building
+$(PROG) := LDLIBS += -lcrypto
 
 POFILE_DIR= ..
 
--- old/usr/src/cmd/ssh/ssh-agent/Makefile	2014-05-21 04:03:21.693880055 +0400
+++ new/usr/src/cmd/ssh/ssh-agent/Makefile	2014-05-21 04:03:21.749252787 +0400
@@ -32,7 +32,10 @@
 include ../../Makefile.cmd
 include ../Makefile.ssh-common
 
-LDLIBS += $(SSH_COMMON_LDLIBS) -lsocket -lcrypto
+LDLIBS += $(SSH_COMMON_LDLIBS) -lsocket
+
+# libcrypto has no lint library, so we can only use it when building
+$(PROG) := LDLIBS += -lcrypto
 
 POFILE_DIR= ..
 
--- old/usr/src/cmd/ssh/ssh-keygen/Makefile	2014-05-21 04:03:23.387029944 +0400
+++ new/usr/src/cmd/ssh/ssh-keygen/Makefile	2014-05-21 04:03:23.436519023 +0400
@@ -32,7 +32,10 @@
 include ../../Makefile.cmd
 include ../Makefile.ssh-common
 
-LDLIBS += $(SSH_COMMON_LDLIBS) -lcrypto -lsocket
+LDLIBS += $(SSH_COMMON_LDLIBS) -lsocket
+
+# libcrypto has no lint library, so we can only use it when building
+$(PROG) := LDLIBS += -lcrypto
 
 POFILE_DIR= ..
 
--- old/usr/src/cmd/ssh/ssh-keyscan/Makefile	2014-05-21 04:03:25.893742275 +0400
+++ new/usr/src/cmd/ssh/ssh-keyscan/Makefile	2014-05-21 04:03:25.995077369 +0400
@@ -32,7 +32,10 @@
 include ../../Makefile.cmd
 include ../Makefile.ssh-common
 
-LDLIBS += $(SSH_COMMON_LDLIBS) -lsocket -lnsl -lz -lcrypto
+LDLIBS += $(SSH_COMMON_LDLIBS) -lsocket -lnsl -lz
+
+# libcrypto has no lint library, so we can only use it when building
+$(PROG) := LDLIBS += -lcrypto
 
 POFILE_DIR= ..
 
--- old/usr/src/cmd/ssh/ssh-keysign/Makefile	2014-05-21 04:03:27.228151365 +0400
+++ new/usr/src/cmd/ssh/ssh-keysign/Makefile	2014-05-21 04:03:27.260655188 +0400
@@ -36,7 +36,10 @@
 
 FILEMODE= 04555
 
-LDLIBS += $(SSH_COMMON_LDLIBS) -lsocket -lnsl -lz -lcrypto
+LDLIBS += $(SSH_COMMON_LDLIBS) -lsocket -lnsl -lz
+
+# libcrypto has no lint library, so we can only use it when building
+$(PROG) := LDLIBS += -lcrypto
 
 POFILE_DIR= ..
 
--- old/usr/src/cmd/ssh/ssh/Makefile	2014-05-21 04:03:27.921404322 +0400
+++ new/usr/src/cmd/ssh/ssh/Makefile	2014-05-21 04:03:27.953677350 +0400
@@ -40,9 +40,11 @@
 LDLIBS += $(SSH_COMMON_LDLIBS) -lsocket \
 	-lnsl \
 	-lz \
-	-lcrypto \
 	-lgss
 
+# libcrypto has no lint library, so we can only use it when building
+$(PROG) := LDLIBS += -lcrypto
+
 POFILE_DIR= ..
 
 .KEEP_STATE:
--- old/usr/src/cmd/ssh/sshd/Makefile	2014-05-21 04:03:28.997580822 +0400
+++ new/usr/src/cmd/ssh/sshd/Makefile	2014-05-21 04:03:29.078868712 +0400
@@ -75,12 +75,14 @@
 	-lpam \
 	-lbsm \
 	-lwrap \
-	-lcrypto \
 	-lgss \
 	-lcontract
 MAPFILES = $(MAPFILE.INT) $(MAPFILE.NGB)
 LDFLAGS += $(MAPFILES:%=-M%)
 
+# libcrypto has no lint library, so we can only use it when building
+$(PROG) := LDLIBS += -lcrypto
+
 POFILE_DIR= ..
 
 .KEEP_STATE:
--- old/usr/src/common/net/wanboot/boot_http.c	2014-05-21 04:03:29.747639048 +0400
+++ new/usr/src/common/net/wanboot/boot_http.c	2014-05-21 04:03:29.773421243 +0400
@@ -2254,7 +2254,6 @@
 		return;
 
 	for (i = 0; i < sk_SSL_CIPHER_num(sk); i++) {
-		/* LINTED */
 		c = sk_SSL_CIPHER_value(sk, i);
 		libbootlog(BOOTLOG_VERBOSE, "%08lx %s", c->id, c->name);
 	}
--- old/usr/src/lib/libkmf/plugins/kmf_openssl/Makefile.com	2014-05-21 04:03:30.366635436 +0400
+++ new/usr/src/lib/libkmf/plugins/kmf_openssl/Makefile.com	2014-05-21 04:03:30.403441201 +0400
@@ -40,8 +40,13 @@
 OPENSSLLIBS=	$(BERLIB) -lcrypto -lcryptoutil -lc
 OPENSSLLIBS64=	$(BERLIB64) -lcrypto -lcryptoutil -lc
 
-LINTSSLLIBS	= $(BERLIB) -lcrypto -lcryptoutil -lc
-LINTSSLLIBS64	= $(BERLIB64) -lcrypto -lcryptoutil -lc
+LINTSSLLIBS	= $(BERLIB) -lcryptoutil -lc
+LINTSSLLIBS64	= $(BERLIB64) -lcryptoutil -lc
+
+# OpenSSLs API includes some macro expansions that are incompatible with lint,
+# depending on the version of OpenSSL used
+LINTFLAGS   +=    -erroff=E_SUPPRESSION_DIRECTIVE_UNUSED
+LINTFLAGS64 +=    -erroff=E_SUPPRESSION_DIRECTIVE_UNUSED
 
 SRCDIR=		../common
 INCDIR=		../../include
--- old/usr/src/lib/libkmf/plugins/kmf_openssl/common/openssl_spi.c	2014-05-21 04:03:30.800343250 +0400
+++ new/usr/src/lib/libkmf/plugins/kmf_openssl/common/openssl_spi.c	2014-05-21 04:03:30.918047725 +0400
@@ -2033,7 +2033,7 @@
 #if OPENSSL_VERSION_NUMBER < 0x10000000L
 	STACK *emlst = NULL;
 #else
-        STACK_OF(OPENSSL_STRING) *emlst = NULL;
+	STACK_OF(OPENSSL_STRING) *emlst = NULL;
 #endif
 	X509_EXTENSION *ex;
 	X509_CINF *ci;
@@ -2153,7 +2153,7 @@
 #else
 		for (j = 0; j < sk_OPENSSL_STRING_num(emlst); j++)
 			(void) BIO_printf(mem, "%s\n",
-                            sk_OPENSSL_STRING_value(emlst, j));
+			    sk_OPENSSL_STRING_value(emlst, j));
 #endif
 
 		len = BIO_gets(mem, resultStr, KMF_CERT_PRINTABLE_LEN);
@@ -3778,7 +3778,7 @@
 			if (OBJ_obj2nid(a->object) == nid) {
 				X509_ATTRIBUTE_free(a);
 				/* LINTED E_BAD_PTR_CAST_ALIGN */
-				sk_X509_ATTRIBUTE_set(pkey->attributes,
+				(void) sk_X509_ATTRIBUTE_set(pkey->attributes,
 				    i, attr);
 				return (KMF_OK);
 			}
--- old/usr/src/lib/libpkg/Makefile.com	2014-05-21 04:03:31.760570490 +0400
+++ new/usr/src/lib/libpkg/Makefile.com	2014-05-21 04:03:31.781415233 +0400
@@ -57,14 +57,18 @@
 # openssl forces us to ignore dubious pointer casts, thanks to its clever
 # use of macros for stack management.
 LINTFLAGS=      -umx -errtags \
-		-erroff=E_BAD_PTR_CAST_ALIGN,E_BAD_PTR_CAST
+		-erroff=E_BAD_PTR_CAST_ALIGN,E_BAD_PTR_CAST,E_SUPPRESSION_DIRECTIVE_UNUSED
 $(LINTLIB):=	SRCS = $(SRCDIR)/$(LINTSRC)
 
 
 LIBS = $(DYNLIB) $(LINTLIB)
 
 
-LDLIBS +=	-lc -lssl -lwanboot -lcrypto -lscf -ladm
+LDLIBS +=	-lc -lwanboot -lscf -ladm
+
+# libcrypto and libssl have no lint library, and so can only be used when
+# building
+$(DYNLIB) := LDLIBS += -lcrypto -lssl
 
 CFLAGS +=	$(CCVERBOSE)
 CERRWARN +=	-_gcc=-Wno-unused-label
--- old/usr/src/lib/libpkg/common/security.c	2014-05-21 04:03:32.390354805 +0400
+++ new/usr/src/lib/libpkg/common/security.c	2014-05-21 04:03:32.418305587 +0400
@@ -110,7 +110,6 @@
 
 	/* add all ca certs into the store */
 	for (i = 0; i < sk_X509_num(cas); i++) {
-		/* LINTED pointer cast may result in improper alignment */
 		ca_cert = sk_X509_value(cas, i);
 		if (X509_STORE_add_cert(ca_store, ca_cert) == 0) {
 			pkgerr_add(err, PKGERR_NOMEM, gettext(ERR_MEM));
@@ -174,8 +173,7 @@
 	    NID_commonName, sname,
 	    ATTR_MAX) <= 0) {
 		(void) strncpy(sname,
-		    X509_NAME_oneline(xname,
-			NULL, 0), ATTR_MAX);
+		    X509_NAME_oneline(xname, NULL, 0), ATTR_MAX);
 		sname[ATTR_MAX - 1] = '\0';
 	}
 	return (sname);
@@ -205,8 +203,7 @@
 	    NID_commonName, sname,
 	    ATTR_MAX) <= 0) {
 		(void) strncpy(sname,
-		    X509_NAME_oneline(xname,
-			NULL, 0), ATTR_MAX);
+		    X509_NAME_oneline(xname, NULL, 0), ATTR_MAX);
 		sname[ATTR_MAX - 1] = '\0';
 	}
 	return (sname);
--- old/usr/src/lib/libwanboot/Makefile.com	2014-05-21 04:03:32.694956078 +0400
+++ new/usr/src/lib/libwanboot/Makefile.com	2014-05-21 04:03:32.703692331 +0400
@@ -60,7 +60,12 @@
 
 LIBS +=		$(LINTLIB)
 LDLIBS +=	-lnvpair -lresolv -lnsl -lsocket -ldevinfo -ldhcputil \
-		-linetutil -lc -lcrypto -lssl
+		-linetutil -lc
+
+# libcrypto and libssl have no lint library, so we can only use it when
+# building
+$(DYNLIB) := LDLIBS += -lcrypto -lssl
+
 CPPFLAGS =	-I$(SRC)/common/net/wanboot/crypt $(CPPFLAGS.master)
 CERRWARN +=	-_gcc=-Wno-switch
 CERRWARN +=	-_gcc=-Wno-parentheses
@@ -79,6 +84,11 @@
 LINTFLAGS   +=    -erroff=E_BAD_PTR_CAST_ALIGN
 LINTFLAGS64 +=    -erroff=E_BAD_PTR_CAST_ALIGN
 
+# OpenSSLs API includes some macro expansions that are incompatible with lint,
+# depending on the version of OpenSSL used
+LINTFLAGS   +=    -erroff=E_SUPPRESSION_DIRECTIVE_UNUSED
+LINTFLAGS64 +=    -erroff=E_SUPPRESSION_DIRECTIVE_UNUSED
+
 CFLAGS +=	$(CCVERBOSE)
 CPPFLAGS +=	-I$(LOC_DIR) -I$(COM_DIR) -I$(DHCP_DIR)
 
--- old/usr/src/lib/pkcs11/pkcs11_tpm/Makefile.com	2014-05-21 04:03:32.962945946 +0400
+++ new/usr/src/lib/pkcs11/pkcs11_tpm/Makefile.com	2014-05-21 04:03:32.974013077 +0400
@@ -73,7 +73,12 @@
 TSSLIB64=-L$(TSPILIBDIR)/$(MACH64)
 TSSINC=-I$(TSPIINCDIR)
 
-LDLIBS += $(TSSLIB) -L$(ADJUNCT_PROTO)/lib -lc -luuid -lmd -ltspi -lcrypto
+LDLIBS += $(TSSLIB) -L$(ADJUNCT_PROTO)/lib -lc -luuid -lmd -ltspi
+
+# libcrypto has no lint library, so we can only use it when
+# building
+$(LIBS) := LDLIBS += -lcrypto
+
 CPPFLAGS += -xCC -D_POSIX_PTHREAD_SEMANTICS $(TSSINC)
 CPPFLAGS64 += $(CPPFLAGS)
 C99MODE=        $(C99_ENABLE)
