diff --git a/.gitignore b/.gitignore
index 4464cb3c6c..9bff03fe0a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,321 +1,321 @@
 # Common conventions for files that should be ignored
 *~
 *.bz2
 *.diff
 *.orig
 *.patch
 *.rej
 *.sed
 *.swp
 *.tar.gz
 *.tgz
 \#*
 .\#*
 logs
 
 # libtool artifacts
 *.la
 *.lo
 .libs
 libltdl
 libtool
 libtool.m4
 ltdl.m4
 /m4/argz.m4
 /m4/ltargz.m4
 /m4/ltoptions.m4
 /m4/ltsugar.m4
 /m4/ltversion.m4
 /m4/lt~obsolete.m4
 
 # autotools artifacts
 .deps
 .dirstamp
 Makefile
 Makefile.in
 aclocal.m4
 autoconf
 autoheader
 autom4te.cache/
 automake
 /confdefs.h
 config.log
 config.status
 configure
 /conftest*
 
 # gettext artifacts
 /ABOUT-NLS
 /m4/codeset.m4
 /m4/fcntl-o.m4
 /m4/gettext.m4
 /m4/glibc2.m4
 /m4/glibc21.m4
 /m4/iconv.m4
 /m4/intdiv0.m4
 /m4/intl.m4
 /m4/intldir.m4
 /m4/intlmacosx.m4
 /m4/intmax.m4
 /m4/inttypes-pri.m4
 /m4/inttypes_h.m4
 /m4/lcmessage.m4
 /m4/lib-ld.m4
 /m4/lib-link.m4
 /m4/lib-prefix.m4
 /m4/lock.m4
 /m4/longlong.m4
 /m4/nls.m4
 /m4/po.m4
 /m4/printf-posix.m4
 /m4/progtest.m4
 /m4/size_max.m4
 /m4/stdint_h.m4
 /m4/threadlib.m4
 /m4/uintmax_t.m4
 /m4/visibility.m4
 /m4/wchar_t.m4
 /m4/wint_t.m4
 /m4/xsize.m4
 /po/*.gmo
 /po/*.header
 /po/*.pot
 /po/*.sin
 /po/Makefile.in.in
 /po/Makevars.template
 /po/POTFILES
 /po/Rules-quot
 /po/stamp-po
 
 # configure targets
 /cts/benchmark/clubench
 /cts/cts-cli
 /cts/cts-coverage
 /cts/cts-exec
 /cts/cts-fencing
 /cts/cts-regression
 /cts/cts-scheduler
 /cts/lab/CTS.py
 /cts/lab/CTSlab.py
 /cts/lab/CTSvars.py
 /cts/lab/OCFIPraTest.py
 /cts/lab/cluster_test
 /cts/lab/cts
 /cts/lab/cts-log-watcher
 /cts/lxc_autogen.sh
 /cts/support/LSBDummy
 /cts/support/cts-support
 /cts/support/fence_dummy
 /cts/support/pacemaker-cts-dummyd
 /cts/support/pacemaker-cts-dummyd@.service
 /daemons/execd/pacemaker_remote
 /daemons/execd/pacemaker_remote.service
 /daemons/fenced/fence_legacy
 /daemons/fenced/fence_watchdog
 /daemons/pacemakerd/pacemaker.combined.upstart
 /daemons/pacemakerd/pacemaker.service
 /daemons/pacemakerd/pacemaker.upstart
 /doc/Doxyfile
 /etc/init.d/pacemaker
 /etc/logrotate.d/pacemaker
 /extra/resources/ClusterMon
 /extra/resources/HealthSMART
 /extra/resources/SysInfo
 /extra/resources/ifspeed
 /extra/resources/o2cb
 /include/config.h
 /include/config.h.in
 /include/crm_config.h
 /maint/bumplibs
 /tools/cibsecret
 /tools/crm_error
 /tools/crm_failcount
 /tools/crm_master
 /tools/crm_mon.service
 /tools/crm_mon.upstart
 /tools/crm_report
 /tools/crm_rule
 /tools/crm_standby
 /tools/pcmk_simtimes
 /tools/report.collector
 /tools/report.common
 
 # Compiled targets and intermediary files
 *.o
 *.pc
 *.pyc
 /daemons/attrd/pacemaker-attrd
 /daemons/based/pacemaker-based
 /daemons/controld/pacemaker-controld
 /daemons/execd/cts-exec-helper
 /daemons/execd/pacemaker-execd
 /daemons/execd/pacemaker-remoted
 /daemons/fenced/cts-fence-helper
 /daemons/fenced/pacemaker-fenced
 /daemons/pacemakerd/pacemakerd
 /daemons/schedulerd/pacemaker-schedulerd
 /devel/scratch
-/lib/common/md5.c
-/lib/gnu/libgnu.a
 /lib/gnu/stdalign.h
 /tools/attrd_updater
 /tools/cibadmin
 /tools/crmadmin
 /tools/crm_attribute
 /tools/crm_diff
 /tools/crm_mon
 /tools/crm_node
 /tools/crm_resource
 /tools/crm_shadow
 /tools/crm_simulate
 /tools/crm_ticket
 /tools/crm_verify
 /tools/iso8601
 /tools/stonith_admin
 
 # Generated XML schema files
 /xml/crm_mon.rng
 /xml/pacemaker*.rng
 /xml/versions.rng
 /xml/api/api-result*.rng
 
 # Working directories for make dist and make export
 /pacemaker-[a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9]
 
 # Documentation build targets and intermediary files
 *.7
 *.7.xml
 *.7.html
 *.8
 *.8.xml
 *.8.html
 GPATH
 GRTAGS
 GTAGS
 TAGS
 /daemons/fenced/pacemaker-fenced.xml
 /daemons/schedulerd/pacemaker-schedulerd.xml
 /doc/.ABI-build
 /doc/HTML
 /doc/abi_dumps
 /doc/abi-check
 /doc/api/
 /doc/compat_reports
 /doc/crm_fencing.html
 /doc/sphinx/*/_build
 /doc/sphinx/*/conf.py
 /doc/sphinx/build-2.1.txt
 /doc/sphinx/shared/images/*.png
 
 # Test artifacts (from unit tests, regression tests, static analysis, etc.)
 *.coverity
 *.gcda
 *.gcno
 coverity-*
 pacemaker_*.info
 /coverage
 /cts/scheduler/*.ref
 /cts/scheduler/*.up
 /cts/scheduler/*.up.err
 /cts/scheduler/bug-rh-1097457.log
 /cts/scheduler/bug-rh-1097457.trs
 /cts/scheduler/shadow.*
 /cts/test-suite.log
 /lib/*/tests/*/*.log
 /lib/*/tests/*/*_test
 /lib/*/tests/*/*.trs
 /xml/test-*/*.up
 /xml/test-*/*.up.err
 /xml/assets/*.rng
 /xml/assets/diffview.js
 /xml/assets/xmlcatalog
 /test/_test_file.c
 
 # Packaging artifacts
 *.rpm
 /pacemaker.spec
 /rpm/[A-LN-Z]*
 /rpm/build.counter
 /rpm/mock
 
 # Project maintainer artifacts
 /maint/gnulib
 /maint/mocked/based
 /maint/testcc_helper.cc
 /maint/testcc_*_h
 
 # Formerly built files (helps when jumping back and forth in checkout)
 /.ABI-build
 /Doxyfile
 /HTML
 /abi_dumps
 /abi-check
 /build.counter
 /compat_reports
 /compile
 /cts/.regression.failed.diff
 /attrd
 /cib
 /config.guess
 /config.sub
 /coverage.sh
 /crmd
 /cts/CTS.py
 /cts/CTSlab.py
 /cts/CTSvars.py
 /cts/HBDummy
 /cts/LSBDummy
 /cts/OCFIPraTest.py
 /cts/cluster_test
 /cts/cts
 /cts/cts-log-watcher
 /cts/cts-support
 /cts/fence_dummy
 /cts/pacemaker-cts-dummyd
 /cts/pacemaker-cts-dummyd@.service
 /daemons/based/cibmon
 /daemons/pacemakerd/pacemaker
 /depcomp
 /doc/*.build
 /doc/*/en-US/Ap-*.xml
 /doc/*/en-US/Ch-*.xml
 /doc/*/publican.cfg
 /doc/*/publish
 /doc/*/tmp/**
 /doc/Clusters_from_Scratch.txt
 /doc/Pacemaker_Explained.txt
 /doc/acls.html
 /doc/publican-catalog*
 /doc/shared/en-US/*.xml
 /doc/shared/en-US/images/pcmk-*.png
 /doc/shared/en-US/images/Policy-Engine-*.png
 /extra/logrotate/pacemaker
 /fencing
 /include/stamp-*
 /install-sh
+/lib/common/md5.c
 /lib/common/tests/flags/pcmk__clear_flags_as
 /lib/common/tests/flags/pcmk__set_flags_as
 /lib/common/tests/flags/pcmk_all_flags_set
 /lib/common/tests/flags/pcmk_any_flags_set
 /lib/common/tests/operations/parse_op_key
 /lib/common/tests/strings/pcmk__btoa
 /lib/common/tests/strings/pcmk__parse_ll_range
 /lib/common/tests/strings/pcmk__scan_double
 /lib/common/tests/strings/pcmk__str_any_of
 /lib/common/tests/strings/pcmk__strcmp
 /lib/common/tests/strings/pcmk__char_in_any_str
 /lib/common/tests/utils/pcmk_str_is_infinity
 /lib/common/tests/utils/pcmk_str_is_minus_infinity
+/lib/gnu/libgnu.a
 /lib/pengine/tests/rules/pe_cron_range_satisfied
 /lrmd
 /ltmain.sh
 /mcp
 /missing
 /mock
 /pacemaker-*.spec
 /pengine
 /py-compile
 /scratch
 /test-driver
 /xml/crm.dtd
 ylwrap
diff --git a/GNUmakefile b/GNUmakefile
index 6375378821..c90ff2e845 100644
--- a/GNUmakefile
+++ b/GNUmakefile
@@ -1,270 +1,273 @@
 #
 # Copyright 2008-2021 the Pacemaker project contributors
 #
 # The version control history for this file may have further details.
 #
 # This source code is licensed under the GNU General Public License version 2
 # or later (GPLv2+) WITHOUT ANY WARRANTY.
 #
 
 default: build
 .PHONY: default
 
 # The toplevel "clean" targets are generated from Makefile.am, not this file.
 # We can't use autotools' CLEANFILES, clean-local, etc. here. Instead, we
 # define this target, which Makefile.am can use as a dependency of clean-local.
 EXTRA_CLEAN_TARGETS	= ancillary-clean
 
 -include Makefile
 
 # The main purpose of this GNUmakefile is that its targets can be invoked
 # without having to call autogen.sh and configure first. That means automake
 # variables may or may not be defined. Here, we use the current working
 # directory if a relevant variable hasn't been defined.
 #
 # The idea is to keep generated artifacts in the build tree, in case a VPATH
 # build is in use, but in practice it would be difficult to make the targets
 # here usable from a different location than the source tree.
 abs_srcdir	?= $(shell pwd)
 abs_builddir	?= $(shell pwd)
 
 # Define release-related variables
 include $(abs_srcdir)/mk/release.mk
 
 GLIB_CFLAGS	?= $(pkg-config --cflags glib-2.0)
 
 PACKAGE		?= pacemaker
 
 # indent target: Limit indent to these directories
 INDENT_DIRS	?= .
 
 # indent target: Extra options to pass to indent
 INDENT_OPTS	?=
 
 .PHONY: init
 init:
 	test -e $(top_srcdir)/configure || ./autogen.sh
 	test -e $(abs_builddir)/Makefile || $(abs_builddir)/configure
 
 .PHONY: build
 build: init
 	$(MAKE) $(AM_MAKEFLAGS) core
 
 ## RPM-related targets (deprecated; use targets in rpm subdirectory instead)
 
 # Pass option depending on whether automake has been run or not
 USE_FILE	= $(shell test -z "$(srcdir)" && echo "-f Makefile.am")
 
 .PHONY: $(PACKAGE).spec chroot dirty export mock rc release rpm rpmlint srpm
 $(PACKAGE).spec chroot dirty export mock rc release rpm rpmlint srpm:
 	$(MAKE) $(AM_MAKEFLAGS) -C rpm $(USE_FILE) "$@"
 
 .PHONY: mock-% rpm-% spec-% srpm-%
 mock-% rpm-% spec-% srpm-%:
 	$(MAKE) $(AM_MAKEFLAGS) -C rpm $(USE_FILE) "$@"
 
 ## Static analysis via coverity
 
 # Aggressiveness (low, medium, or high)
 COVLEVEL	?= low
 
 # Generated outputs
 COVERITY_DIR	= $(abs_builddir)/coverity-$(TAG)
 COVTAR		= $(abs_builddir)/$(PACKAGE)-coverity-$(TAG).tgz
 COVEMACS	= $(abs_builddir)/$(TAG).coverity
 COVHTML		= $(COVERITY_DIR)/output/errors
 
 # Coverity outputs are phony so they get rebuilt every invocation
 
 .PHONY: $(COVERITY_DIR)
 $(COVERITY_DIR): init core-clean coverity-clean
 	$(AM_V_GEN)cov-build --dir "$@" $(MAKE) $(AM_MAKEFLAGS) core
 
 # Public coverity instance
 
 .PHONY: $(COVTAR)
 $(COVTAR): $(COVERITY_DIR)
 	$(AM_V_GEN)tar czf "$@" --transform="s@.*$(TAG)@cov-int@" "$<"
 
 .PHONY: coverity
 coverity: $(COVTAR)
 	@echo "Now go to https://scan.coverity.com/users/sign_in and upload:"
 	@echo "  $(COVTAR)"
 	@echo "then make core-clean coverity-clean"
 
 # Licensed coverity instance
 #
 # The prerequisites are a little hacky; rather than actually required, some
 # of them are designed so that things execute in the proper order (which is
 # not the same as GNU make's order-only prerequisites).
 
 .PHONY: coverity-analyze
 coverity-analyze: $(COVERITY_DIR)
 	@echo ""
 	@echo "Analyzing (waiting for coverity license if necessary) ..."
 	cov-analyze --dir "$<" --wait-for-license --security		\
 		--aggressiveness-level "$(COVLEVEL)"
 
 .PHONY: $(COVEMACS)
 $(COVEMACS): coverity-analyze
 	$(AM_V_GEN)cov-format-errors --dir "$(COVERITY_DIR)" --emacs-style > "$@"
 
 .PHONY: $(COVHTML)
 $(COVHTML): $(COVEMACS)
 	$(AM_V_GEN)cov-format-errors --dir "$(COVERITY_DIR)" --html-output "$@"
 
 .PHONY: coverity-corp
 coverity-corp: $(COVHTML)
 	$(MAKE) $(AM_MAKEFLAGS) core-clean
 	@echo "Done. See:"
 	@echo "  file://$(COVHTML)/index.html"
 	@echo "When no longer needed, make coverity-clean"
 
 # Remove all outputs regardless of tag
 .PHONY: coverity-clean
 coverity-clean:
 	-rm -rf "$(abs_builddir)"/coverity-*			\
 		"$(abs_builddir)"/$(PACKAGE)-coverity-*.tgz	\
 		"$(abs_builddir)"/*.coverity
 
 
 ## Change log generation
 
 summary:
 	@printf "\n* `date +"%a %b %d %Y"` `git config user.name` <`git config user.email`> $(NEXT_RELEASE)"
 	@printf "\n- Changesets: `git log --pretty=oneline --no-merges $(LAST_RELEASE)..HEAD | wc -l`"
 	@printf "\n- Diff:\n"
 	@git diff $(LAST_RELEASE)..HEAD --shortstat include lib daemons tools xml
 
 rc-changes:
 	@$(MAKE) $(AM_MAKEFLAGS) NEXT_RELEASE=$(shell echo $(LAST_RC) | sed s:-rc.*::) LAST_RELEASE=$(LAST_RC) changes
 
 changes: summary
 	@printf "\n- Features added since $(LAST_RELEASE)\n"
 	@git log --pretty=format:'%s' --no-merges --abbrev-commit $(LAST_RELEASE)..HEAD \
 		| sed -n -e 's/^ *Feature: */  + /p' | sort -uf
 	@printf "\n- Fixes since $(LAST_RELEASE)\n"
 	@git log --pretty=format:'%s' --no-merges --abbrev-commit $(LAST_RELEASE)..HEAD \
 		| sed -n -e 's/^ *\(Fix\|High\|Bug\): */  + /p' | sed			\
 			-e 's@\(cib\|pacemaker-based\|based\):@CIB:@' \
 			-e 's@\(crmd\|pacemaker-controld\|controld\):@controller:@' \
 			-e 's@\(lrmd\|pacemaker-execd\|execd\):@executor:@' \
 			-e 's@\(Fencing\|stonithd\|stonith\|pacemaker-fenced\|fenced\):@fencing:@' \
 			-e 's@\(PE\|pengine\|pacemaker-schedulerd\|schedulerd\):@scheduler:@' \
 		| sort -uf
 	@printf "\n- Public API changes since $(LAST_RELEASE)\n"
 	@git log --pretty=format:'%s' --no-merges --abbrev-commit $(LAST_RELEASE)..HEAD \
 		| sed -n -e 's/^ *API: */  + /p' | sort -uf
 
 authors:
 	git log $(LAST_RELEASE)..$(COMMIT) --format='%an' | sort -u
 
 changelog:
 	@$(MAKE) $(AM_MAKEFLAGS) changes > ChangeLog
 	@printf "\n">> ChangeLog
 	git show $(LAST_RELEASE):ChangeLog >> ChangeLog
 
 INDENT_IGNORE_PATHS	= daemons/controld/controld_fsa.h	\
 			  lib/gnu/*
 INDENT_PACEMAKER_STYLE	= --blank-lines-after-declarations		\
 			  --blank-lines-after-procedures		\
 			  --braces-after-func-def-line			\
 			  --braces-on-if-line				\
 			  --braces-on-struct-decl-line			\
 			  --break-before-boolean-operator		\
 			  --case-brace-indentation4			\
 			  --case-indentation4				\
 			  --comment-indentation0			\
 			  --continuation-indentation4			\
 			  --continue-at-parentheses			\
 			  --cuddle-do-while				\
 			  --cuddle-else					\
 			  --declaration-comment-column0			\
 			  --declaration-indentation1			\
 			  --else-endif-column0				\
 			  --honour-newlines				\
 			  --indent-label0				\
 			  --indent-level4				\
 			  --line-comments-indentation0			\
 			  --line-length80				\
 			  --no-blank-lines-after-commas			\
 			  --no-comment-delimiters-on-blank-lines	\
 			  --no-space-after-function-call-names		\
 			  --no-space-after-parentheses			\
 			  --no-tabs					\
 			  --preprocessor-indentation2			\
 			  --procnames-start-lines			\
 			  --space-after-cast				\
 			  --start-left-side-of-comments			\
 			  --swallow-optional-blank-lines		\
 			  --tab-size8
 
 indent:
 	VERSION_CONTROL=none					\
 		find $(INDENT_DIRS) -type f -name "*.[ch]"	\
 		$(INDENT_IGNORE_PATHS:%= ! -path '%')		\
 		-exec indent $(INDENT_PACEMAKER_STYLE) $(INDENT_OPTS) \{\} \;
 
 rel-tags: tags
 	find . -name TAGS -exec sed -i 's:\(.*\)/\(.*\)/TAGS:\2/TAGS:g' \{\} \;
 
 CLANG_checkers = 
 
 # Use CPPCHECK_ARGS to pass extra cppcheck options, e.g.:
 # --enable={warning,style,performance,portability,information,all}
 # --inconclusive --std=posix
 CPPCHECK_ARGS ?=
 BASE_CPPCHECK_ARGS = -I include --max-configs=30 --library=posix --library=gnu \
 					 --library=gtk $(GLIB_CFLAGS) -D__GNUC__ --inline-suppr -q
 cppcheck-all:
 	cppcheck $(CPPCHECK_ARGS) $(BASE_CPPCHECK_ARGS) -DBUILD_PUBLIC_LIBPACEMAKER \
 		-DDEFAULT_CONCURRENT_FENCING_TRUE replace lib daemons tools
 
 cppcheck:
 	cppcheck $(CPPCHECK_ARGS) $(BASE_CPPCHECK_ARGS) replace lib daemons tools
 
 clang:
 	OUT=$$(scan-build $(CLANG_checkers:%=-enable-checker %)		\
 		$(MAKE) $(AM_MAKEFLAGS) CFLAGS="-std=c99 $(CFLAGS)"	\
 		clean all 2>&1);					\
 	REPORT=$$(echo "$$OUT"						\
 		| sed -n -e "s/.*'scan-view \(.*\)'.*/\1/p");		\
 	[ -z "$$REPORT" ] && echo "$$OUT" || scan-view "$$REPORT"
 
 # V3	= scandir unsetenv alphasort xalloc
 # V2	= setenv strerror strchrnul strndup
 # https://www.gnu.org/software/gnulib/manual/html_node/Initial-import.html#Initial-import
 # previously, this was crypto/md5, but got spoiled with streams/kernel crypto
 GNU_MODS	= crypto/md5-buffer
 # stdint appears to be surrogate only for C99-lacking environments
 GNU_MODS_AVOID	= stdint
 # only for plain crypto/md5: we make do without kernel-assisted crypto
 # GNU_MODS_AVOID	+= crypto/af_alg
+.PHONY: gnulib-update
 gnulib-update:
 	-test -e maint/gnulib \
 	  || git clone https://git.savannah.gnu.org/git/gnulib.git maint/gnulib
 	cd maint/gnulib && git pull
-	maint/gnulib/gnulib-tool \
+	maint/gnulib/gnulib-tool --libtool \
 	  --source-base=lib/gnu --lgpl=2 --no-vc-files --no-conditional-dependencies \
 	  $(GNU_MODS_AVOID:%=--avoid %) --import $(GNU_MODS)
 	sed -i -e "s/bundled(gnulib).*/bundled(gnulib) = $(date +'%Y%m%d')/"	\
 		rpm/pacemaker.spec.in
+	sed -i -e "s/_GL_EXTERN_INLINE/_GL_INLINE/" \
+		lib/gnu/md5.c
 
 ## Coverage/profiling
 
 .PHONY: coverage
 coverage: core
 	-find . -name "*.gcda" -exec rm -f \{\} \;
 	lcov --no-external --exclude='*_test.c' -c -i -d . -o pacemaker_base.info
 	$(MAKE) $(AM_MAKEFLAGS) check
 	lcov --no-external --exclude='*_test.c' -c -d . -o pacemaker_test.info
 	lcov -a pacemaker_base.info -a pacemaker_test.info -o pacemaker_total.info
 	genhtml pacemaker_total.info -o coverage -s
 
 .PHONY: coverage-clean
 coverage-clean:
 	-rm -f pacemaker_*.info
 	-rm -rf coverage
 	-find . \( -name "*.gcno" -o -name "*.gcda" \) -exec rm -f \{\} \;
 
 ancillary-clean: mock-clean coverity-clean coverage-clean
diff --git a/lib/common/Makefile.am b/lib/common/Makefile.am
index b052fa4562..3537dabd62 100644
--- a/lib/common/Makefile.am
+++ b/lib/common/Makefile.am
@@ -1,117 +1,107 @@
 #
 # Copyright 2004-2022 the Pacemaker project contributors
 #
 # The version control history for this file may have further details.
 #
 # This source code is licensed under the GNU General Public License version 2
 # or later (GPLv2+) WITHOUT ANY WARRANTY.
 #
 include $(top_srcdir)/mk/common.mk
 
 AM_CPPFLAGS		+= -I$(top_builddir)/lib/gnu -I$(top_srcdir)/lib/gnu
 
-MOSTLYCLEANFILES	= md5.c
-
 ## libraries
 lib_LTLIBRARIES	= libcrmcommon.la
 check_LTLIBRARIES = libcrmcommon_test.la
 
 # Disable -Wcast-qual if used, because we do some hacky casting,
 # and because libxml2 has some signatures that should be const but aren't
 # for backward compatibility reasons.
 
 # s390 needs -fPIC 
 # s390-suse-linux/bin/ld: .libs/ipc.o: relocation R_390_PC32DBL against `__stack_chk_fail@@GLIBC_2.4' can not be used when making a shared object; recompile with -fPIC
 
 CFLAGS		= $(CFLAGS_COPY:-Wcast-qual=) -fPIC
 
 # Without "." here, check-recursive will run through the subdirectories first
 # and then run "make check" here.  This will fail, because there's things in
 # the subdirectories that need check_LTLIBRARIES built first.  Adding "." here
 # changes the order so the subdirectories are processed afterwards.
 SUBDIRS = . tests
 
 noinst_HEADERS		= crmcommon_private.h mock_private.h
 
 libcrmcommon_la_LDFLAGS	= -version-info 42:0:8
 
 libcrmcommon_la_CFLAGS	= $(CFLAGS_HARDENED_LIB)
 libcrmcommon_la_LDFLAGS	+= $(LDFLAGS_HARDENED_LIB)
 
-libcrmcommon_la_LIBADD	= @LIBADD_DL@
+libcrmcommon_la_LIBADD	= @LIBADD_DL@ $(top_builddir)/lib/gnu/libgnu.la
 
 # If configured with --with-profiling or --with-coverage, BUILD_PROFILING will
 # be set and -fno-builtin will be added to the CFLAGS.  However, libcrmcommon
 # uses the fabs() function which is normally supplied by gcc as one of its
 # builtins.  Therefore we need to explicitly link against libm here or the
 # tests won't link.
 if BUILD_PROFILING
 libcrmcommon_la_LIBADD	+= -lm
 endif
 
 # Use += rather than backlashed continuation lines for parsing by bumplibs
 libcrmcommon_la_SOURCES	=
 libcrmcommon_la_SOURCES	+= acl.c
 libcrmcommon_la_SOURCES	+= agents.c
 libcrmcommon_la_SOURCES	+= alerts.c
 libcrmcommon_la_SOURCES	+= attrd_client.c
 libcrmcommon_la_SOURCES	+= cib.c
 if BUILD_CIBSECRETS
 libcrmcommon_la_SOURCES	+= cib_secrets.c
 endif
 libcrmcommon_la_SOURCES	+= cmdline.c
 libcrmcommon_la_SOURCES	+= digest.c
 libcrmcommon_la_SOURCES	+= io.c
 libcrmcommon_la_SOURCES	+= ipc_client.c
 libcrmcommon_la_SOURCES	+= ipc_common.c
 libcrmcommon_la_SOURCES	+= ipc_controld.c
 libcrmcommon_la_SOURCES	+= ipc_pacemakerd.c
 libcrmcommon_la_SOURCES 	+= ipc_schedulerd.c
 libcrmcommon_la_SOURCES	+= ipc_server.c
 libcrmcommon_la_SOURCES	+= iso8601.c
 libcrmcommon_la_SOURCES	+= lists.c
 libcrmcommon_la_SOURCES	+= logging.c
 libcrmcommon_la_SOURCES	+= mainloop.c
 libcrmcommon_la_SOURCES	+= messages.c
 libcrmcommon_la_SOURCES	+= nvpair.c
 libcrmcommon_la_SOURCES	+= operations.c
 libcrmcommon_la_SOURCES	+= options.c
 libcrmcommon_la_SOURCES	+= output.c
 libcrmcommon_la_SOURCES	+= output_html.c
 libcrmcommon_la_SOURCES	+= output_log.c
 libcrmcommon_la_SOURCES	+= output_none.c
 libcrmcommon_la_SOURCES	+= output_text.c
 libcrmcommon_la_SOURCES	+= output_xml.c
 libcrmcommon_la_SOURCES	+= patchset.c
 libcrmcommon_la_SOURCES	+= pid.c
 libcrmcommon_la_SOURCES	+= procfs.c
 libcrmcommon_la_SOURCES	+= remote.c
 libcrmcommon_la_SOURCES	+= results.c
 libcrmcommon_la_SOURCES	+= schemas.c
 libcrmcommon_la_SOURCES	+= scores.c
 libcrmcommon_la_SOURCES	+= strings.c
 libcrmcommon_la_SOURCES	+= utils.c
 libcrmcommon_la_SOURCES	+= watchdog.c
 libcrmcommon_la_SOURCES	+= xml.c
 libcrmcommon_la_SOURCES	+= xpath.c
 
-# It's possible to build the library adding ../gnu/md5.c directly to SOURCES,
-# but distclean chokes on that because it tries to include the source's .Plo
-# file, which may have already been cleaned.
-nodist_libcrmcommon_la_SOURCES	= md5.c
-
 WRAPPED = calloc getenv getpwnam_r uname
 WRAPPED_FLAGS = $(foreach fn,$(WRAPPED),-Wl,--wrap=$(fn))
 
 libcrmcommon_test_la_SOURCES	= $(libcrmcommon_la_SOURCES)
 libcrmcommon_test_la_SOURCES	+= mock.c
 libcrmcommon_test_la_LDFLAGS	= $(LDFLAGS_HARDENED_LIB) $(WRAPPED_FLAGS)
 libcrmcommon_test_la_CFLAGS	= $(libcrmcommon_la_CFLAGS)
 libcrmcommon_test_la_LIBADD	= $(libcrmcommon_la_LIBADD)
 nodist_libcrmcommon_test_la_SOURCES = $(nodist_libcrmcommon_la_SOURCES)
 
-md5.c: ../gnu/md5.c
-	cp "$<" "$@"
-
 clean-generic:
 	rm -f *.log *.debug *.xml *~
diff --git a/lib/gnu/Makefile.am b/lib/gnu/Makefile.am
index 28112adb1e..d835bd4621 100644
--- a/lib/gnu/Makefile.am
+++ b/lib/gnu/Makefile.am
@@ -1,127 +1,130 @@
 ## DO NOT EDIT! GENERATED AUTOMATICALLY!
 ## Process this file with automake to produce Makefile.in.
 # Copyright (C) 2002-2020 Free Software Foundation, Inc.
 #
 # This file is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
 # the Free Software Foundation; either version 3 of the License, or
 # (at your option) any later version.
 #
 # This file is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
 # along with this file.  If not, see <https://www.gnu.org/licenses/>.
 #
 # As a special exception to the GNU General Public License,
 # this file may be distributed as part of a program that
 # contains a configuration script generated by Autoconf, under
 # the same distribution terms as the rest of that program.
 #
 # Generated by gnulib-tool.
 # Reproduce by:
 # gnulib-tool --import \
 #  --lib=libgnu \
 #  --source-base=lib/gnu \
 #  --m4-base=m4 \
 #  --doc-base=doc \
 #  --tests-base=tests \
 #  --aux-dir=. \
 #  --lgpl=2 \
 #  --no-conditional-dependencies \
-#  --no-libtool \
+#  --libtool \
 #  --macro-prefix=gl \
 #  --no-vc-files \
 #  --avoid=stdint \
 #  crypto/md5-buffer
 
 AUTOMAKE_OPTIONS = 1.11 gnits
 
 SUBDIRS =
 noinst_HEADERS =
 noinst_LIBRARIES =
 noinst_LTLIBRARIES =
 EXTRA_DIST =
 BUILT_SOURCES =
 SUFFIXES =
 MOSTLYCLEANFILES = core *.stackdump
 MOSTLYCLEANDIRS =
 CLEANFILES =
 DISTCLEANFILES =
 MAINTAINERCLEANFILES =
 # No GNU Make output.
 
 AM_CPPFLAGS =
 AM_CFLAGS =
 
-noinst_LIBRARIES += libgnu.a
+noinst_LTLIBRARIES += libgnu.la
 
-libgnu_a_SOURCES =
-libgnu_a_LIBADD = $(gl_LIBOBJS)
-libgnu_a_DEPENDENCIES = $(gl_LIBOBJS)
-EXTRA_libgnu_a_SOURCES =
+libgnu_la_SOURCES =
+libgnu_la_LIBADD = $(gl_LTLIBOBJS)
+libgnu_la_DEPENDENCIES = $(gl_LTLIBOBJS)
+EXTRA_libgnu_la_SOURCES =
+libgnu_la_LDFLAGS = $(AM_LDFLAGS)
+libgnu_la_LDFLAGS += -no-undefined
+libgnu_la_LDFLAGS += $(LIB_CRYPTO)
 
 ## begin gnulib module byteswap
 
 BUILT_SOURCES += $(BYTESWAP_H)
 
 # We need the following in order to create <byteswap.h> when the system
 # doesn't have one.
 if GL_GENERATE_BYTESWAP_H
 byteswap.h: byteswap.in.h $(top_builddir)/config.status
 	$(AM_V_GEN)rm -f $@-t $@ && \
 	{ echo '/* DO NOT EDIT! GENERATED AUTOMATICALLY! */'; \
 	  cat $(srcdir)/byteswap.in.h; \
 	} > $@-t && \
 	mv -f $@-t $@
 else
 byteswap.h: $(top_builddir)/config.status
 	rm -f $@
 endif
 MOSTLYCLEANFILES += byteswap.h byteswap.h-t
 
 EXTRA_DIST += byteswap.in.h
 
 ## end   gnulib module byteswap
 
 ## begin gnulib module crypto/md5-buffer
 
-libgnu_a_SOURCES += md5.c
+libgnu_la_SOURCES += md5.c
 
 EXTRA_DIST += gl_openssl.h md5.h
 
 ## end   gnulib module crypto/md5-buffer
 
 ## begin gnulib module stdalign
 
 BUILT_SOURCES += $(STDALIGN_H)
 
 # We need the following in order to create <stdalign.h> when the system
 # doesn't have one that works.
 if GL_GENERATE_STDALIGN_H
 stdalign.h: stdalign.in.h $(top_builddir)/config.status
 	$(AM_V_GEN)rm -f $@-t $@ && \
 	{ echo '/* DO NOT EDIT! GENERATED AUTOMATICALLY! */'; \
 	  cat $(srcdir)/stdalign.in.h; \
 	} > $@-t && \
 	mv $@-t $@
 else
 stdalign.h: $(top_builddir)/config.status
 	rm -f $@
 endif
 MOSTLYCLEANFILES += stdalign.h stdalign.h-t
 
 EXTRA_DIST += stdalign.in.h
 
 ## end   gnulib module stdalign
 
 
 mostlyclean-local: mostlyclean-generic
 	@for dir in '' $(MOSTLYCLEANDIRS); do \
 	  if test -n "$$dir" && test -d $$dir; then \
 	    echo "rmdir $$dir"; rmdir $$dir; \
 	  fi; \
 	done; \
 	:
diff --git a/lib/gnu/md5.c b/lib/gnu/md5.c
index 44d4913c7b..9cb1900fd2 100644
--- a/lib/gnu/md5.c
+++ b/lib/gnu/md5.c
@@ -1,492 +1,492 @@
 /* Functions to compute MD5 message digest of files or memory blocks.
    according to the definition of MD5 in RFC 1321 from April 1992.
    Copyright (C) 1995-1997, 1999-2001, 2005-2006, 2008-2020 Free Software
    Foundation, Inc.
    This file is part of the GNU C Library.
 
    This program is free software; you can redistribute it and/or modify it
    under the terms of the GNU Lesser General Public License as published by the
    Free Software Foundation; either version 2.1, or (at your option) any
    later version.
 
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU Lesser General Public License for more details.
 
    You should have received a copy of the GNU Lesser General Public License
    along with this program; if not, see <https://www.gnu.org/licenses/>.  */
 
 /* Written by Ulrich Drepper <drepper@gnu.ai.mit.edu>, 1995.  */
 
 #include <config.h>
 
 #if HAVE_OPENSSL_MD5
-# define GL_OPENSSL_INLINE _GL_EXTERN_INLINE
+# define GL_OPENSSL_INLINE _GL_INLINE
 #endif
 #include "md5.h"
 
 #include <stdalign.h>
 #include <stdint.h>
 #include <stdlib.h>
 #include <string.h>
 #include <sys/types.h>
 
 #if USE_UNLOCKED_IO
 # include "unlocked-io.h"
 #endif
 
 #ifdef _LIBC
 # include <endian.h>
 # if __BYTE_ORDER == __BIG_ENDIAN
 #  define WORDS_BIGENDIAN 1
 # endif
 /* We need to keep the namespace clean so define the MD5 function
    protected using leading __ .  */
 # define md5_init_ctx __md5_init_ctx
 # define md5_process_block __md5_process_block
 # define md5_process_bytes __md5_process_bytes
 # define md5_finish_ctx __md5_finish_ctx
 # define md5_read_ctx __md5_read_ctx
 # define md5_stream __md5_stream
 # define md5_buffer __md5_buffer
 #endif
 
 #include <byteswap.h>
 #ifdef WORDS_BIGENDIAN
 # define SWAP(n) bswap_32 (n)
 #else
 # define SWAP(n) (n)
 #endif
 
 #define BLOCKSIZE 32768
 #if BLOCKSIZE % 64 != 0
 # error "invalid BLOCKSIZE"
 #endif
 
 #if ! HAVE_OPENSSL_MD5
 /* This array contains the bytes used to pad the buffer to the next
    64-byte boundary.  (RFC 1321, 3.1: Step 1)  */
 static const unsigned char fillbuf[64] = { 0x80, 0 /* , 0, 0, ...  */ };
 
 
 /* Initialize structure containing state of computation.
    (RFC 1321, 3.3: Step 3)  */
 void
 md5_init_ctx (struct md5_ctx *ctx)
 {
   ctx->A = 0x67452301;
   ctx->B = 0xefcdab89;
   ctx->C = 0x98badcfe;
   ctx->D = 0x10325476;
 
   ctx->total[0] = ctx->total[1] = 0;
   ctx->buflen = 0;
 }
 
 /* Copy the 4 byte value from v into the memory location pointed to by *cp,
    If your architecture allows unaligned access this is equivalent to
    * (uint32_t *) cp = v  */
 static void
 set_uint32 (char *cp, uint32_t v)
 {
   memcpy (cp, &v, sizeof v);
 }
 
 /* Put result from CTX in first 16 bytes following RESBUF.  The result
    must be in little endian byte order.  */
 void *
 md5_read_ctx (const struct md5_ctx *ctx, void *resbuf)
 {
   char *r = resbuf;
   set_uint32 (r + 0 * sizeof ctx->A, SWAP (ctx->A));
   set_uint32 (r + 1 * sizeof ctx->B, SWAP (ctx->B));
   set_uint32 (r + 2 * sizeof ctx->C, SWAP (ctx->C));
   set_uint32 (r + 3 * sizeof ctx->D, SWAP (ctx->D));
 
   return resbuf;
 }
 
 /* Process the remaining bytes in the internal buffer and the usual
    prolog according to the standard and write the result to RESBUF.  */
 void *
 md5_finish_ctx (struct md5_ctx *ctx, void *resbuf)
 {
   /* Take yet unprocessed bytes into account.  */
   uint32_t bytes = ctx->buflen;
   size_t size = (bytes < 56) ? 64 / 4 : 64 * 2 / 4;
 
   /* Now count remaining bytes.  */
   ctx->total[0] += bytes;
   if (ctx->total[0] < bytes)
     ++ctx->total[1];
 
   /* Put the 64-bit file length in *bits* at the end of the buffer.  */
   ctx->buffer[size - 2] = SWAP (ctx->total[0] << 3);
   ctx->buffer[size - 1] = SWAP ((ctx->total[1] << 3) | (ctx->total[0] >> 29));
 
   memcpy (&((char *) ctx->buffer)[bytes], fillbuf, (size - 2) * 4 - bytes);
 
   /* Process last bytes.  */
   md5_process_block (ctx->buffer, size * 4, ctx);
 
   return md5_read_ctx (ctx, resbuf);
 }
 #endif
 
 #if defined _LIBC || defined GL_COMPILE_CRYPTO_STREAM
 
 #include "af_alg.h"
 
 /* Compute MD5 message digest for bytes read from STREAM.  The
    resulting message digest number will be written into the 16 bytes
    beginning at RESBLOCK.  */
 int
 md5_stream (FILE *stream, void *resblock)
 {
   switch (afalg_stream (stream, "md5", resblock, MD5_DIGEST_SIZE))
     {
     case 0: return 0;
     case -EIO: return 1;
     }
 
   char *buffer = malloc (BLOCKSIZE + 72);
   if (!buffer)
     return 1;
 
   struct md5_ctx ctx;
   md5_init_ctx (&ctx);
   size_t sum;
 
   /* Iterate over full file contents.  */
   while (1)
     {
       /* We read the file in blocks of BLOCKSIZE bytes.  One call of the
          computation function processes the whole buffer so that with the
          next round of the loop another block can be read.  */
       size_t n;
       sum = 0;
 
       /* Read block.  Take care for partial reads.  */
       while (1)
         {
           /* Either process a partial fread() from this loop,
              or the fread() in afalg_stream may have gotten EOF.
              We need to avoid a subsequent fread() as EOF may
              not be sticky.  For details of such systems, see:
              https://sourceware.org/bugzilla/show_bug.cgi?id=1190  */
           if (feof (stream))
             goto process_partial_block;
 
           n = fread (buffer + sum, 1, BLOCKSIZE - sum, stream);
 
           sum += n;
 
           if (sum == BLOCKSIZE)
             break;
 
           if (n == 0)
             {
               /* Check for the error flag IFF N == 0, so that we don't
                  exit the loop after a partial read due to e.g., EAGAIN
                  or EWOULDBLOCK.  */
               if (ferror (stream))
                 {
                   free (buffer);
                   return 1;
                 }
               goto process_partial_block;
             }
         }
 
       /* Process buffer with BLOCKSIZE bytes.  Note that
          BLOCKSIZE % 64 == 0
        */
       md5_process_block (buffer, BLOCKSIZE, &ctx);
     }
 
 process_partial_block:
 
   /* Process any remaining bytes.  */
   if (sum > 0)
     md5_process_bytes (buffer, sum, &ctx);
 
   /* Construct result in desired memory.  */
   md5_finish_ctx (&ctx, resblock);
   free (buffer);
   return 0;
 }
 #endif
 
 #if ! HAVE_OPENSSL_MD5
 /* Compute MD5 message digest for LEN bytes beginning at BUFFER.  The
    result is always in little endian byte order, so that a byte-wise
    output yields to the wanted ASCII representation of the message
    digest.  */
 void *
 md5_buffer (const char *buffer, size_t len, void *resblock)
 {
   struct md5_ctx ctx;
 
   /* Initialize the computation context.  */
   md5_init_ctx (&ctx);
 
   /* Process whole buffer but last len % 64 bytes.  */
   md5_process_bytes (buffer, len, &ctx);
 
   /* Put result in desired memory area.  */
   return md5_finish_ctx (&ctx, resblock);
 }
 
 
 void
 md5_process_bytes (const void *buffer, size_t len, struct md5_ctx *ctx)
 {
   /* When we already have some bits in our internal buffer concatenate
      both inputs first.  */
   if (ctx->buflen != 0)
     {
       size_t left_over = ctx->buflen;
       size_t add = 128 - left_over > len ? len : 128 - left_over;
 
       memcpy (&((char *) ctx->buffer)[left_over], buffer, add);
       ctx->buflen += add;
 
       if (ctx->buflen > 64)
         {
           md5_process_block (ctx->buffer, ctx->buflen & ~63, ctx);
 
           ctx->buflen &= 63;
           /* The regions in the following copy operation cannot overlap,
              because ctx->buflen < 64 ≤ (left_over + add) & ~63.  */
           memcpy (ctx->buffer,
                   &((char *) ctx->buffer)[(left_over + add) & ~63],
                   ctx->buflen);
         }
 
       buffer = (const char *) buffer + add;
       len -= add;
     }
 
   /* Process available complete blocks.  */
   if (len >= 64)
     {
 #if !(_STRING_ARCH_unaligned || _STRING_INLINE_unaligned)
 # define UNALIGNED_P(p) ((uintptr_t) (p) % alignof (uint32_t) != 0)
       if (UNALIGNED_P (buffer))
         while (len > 64)
           {
             md5_process_block (memcpy (ctx->buffer, buffer, 64), 64, ctx);
             buffer = (const char *) buffer + 64;
             len -= 64;
           }
       else
 #endif
         {
           md5_process_block (buffer, len & ~63, ctx);
           buffer = (const char *) buffer + (len & ~63);
           len &= 63;
         }
     }
 
   /* Move remaining bytes in internal buffer.  */
   if (len > 0)
     {
       size_t left_over = ctx->buflen;
 
       memcpy (&((char *) ctx->buffer)[left_over], buffer, len);
       left_over += len;
       if (left_over >= 64)
         {
           md5_process_block (ctx->buffer, 64, ctx);
           left_over &= 63; /* same as -= 64 but easier to understand
                               for static analysis
                             */
           /* The regions in the following copy operation cannot overlap,
              because left_over ≤ 64.  */
           memcpy (ctx->buffer, &(((char *) ctx->buffer)[64]), left_over);
           /* cast to char * as hint for static analysis */
         }
       ctx->buflen = left_over;
     }
 }
 
 
 /* These are the four functions used in the four steps of the MD5 algorithm
    and defined in the RFC 1321.  The first function is a little bit optimized
    (as found in Colin Plumbs public domain implementation).  */
 /* #define FF(b, c, d) ((b & c) | (~b & d)) */
 #define FF(b, c, d) (d ^ (b & (c ^ d)))
 #define FG(b, c, d) FF (d, b, c)
 #define FH(b, c, d) (b ^ c ^ d)
 #define FI(b, c, d) (c ^ (b | ~d))
 
 /* Process LEN bytes of BUFFER, accumulating context into CTX.
    It is assumed that LEN % 64 == 0.  */
 
 void
 md5_process_block (const void *buffer, size_t len, struct md5_ctx *ctx)
 {
   uint32_t correct_words[16];
   const uint32_t *words = buffer;
   size_t nwords = len / sizeof (uint32_t);
   const uint32_t *endp = words + nwords;
   uint32_t A = ctx->A;
   uint32_t B = ctx->B;
   uint32_t C = ctx->C;
   uint32_t D = ctx->D;
   uint32_t lolen = len;
 
   /* First increment the byte count.  RFC 1321 specifies the possible
      length of the file up to 2^64 bits.  Here we only compute the
      number of bytes.  Do a double word increment.  */
   ctx->total[0] += lolen;
   ctx->total[1] += (len >> 31 >> 1) + (ctx->total[0] < lolen);
 
   /* Process all bytes in the buffer with 64 bytes in each round of
      the loop.  */
   while (words < endp)
     {
       uint32_t *cwp = correct_words;
       uint32_t A_save = A;
       uint32_t B_save = B;
       uint32_t C_save = C;
       uint32_t D_save = D;
 
       /* First round: using the given function, the context and a constant
          the next context is computed.  Because the algorithms processing
          unit is a 32-bit word and it is determined to work on words in
          little endian byte order we perhaps have to change the byte order
          before the computation.  To reduce the work for the next steps
          we store the swapped words in the array CORRECT_WORDS.  */
 
 #define OP(a, b, c, d, s, T)                                            \
       do                                                                \
         {                                                               \
           a += FF (b, c, d) + (*cwp++ = SWAP (*words)) + T;             \
           ++words;                                                      \
           CYCLIC (a, s);                                                \
           a += b;                                                       \
         }                                                               \
       while (0)
 
       /* It is unfortunate that C does not provide an operator for
          cyclic rotation.  Hope the C compiler is smart enough.  */
 #define CYCLIC(w, s) (w = (w << s) | (w >> (32 - s)))
 
       /* Before we start, one word to the strange constants.
          They are defined in RFC 1321 as
 
          T[i] = (int) (4294967296.0 * fabs (sin (i))), i=1..64
 
          Here is an equivalent invocation using Perl:
 
          perl -e 'foreach(1..64){printf "0x%08x\n", int (4294967296 * abs (sin $_))}'
        */
 
       /* Round 1.  */
       OP (A, B, C, D, 7, 0xd76aa478);
       OP (D, A, B, C, 12, 0xe8c7b756);
       OP (C, D, A, B, 17, 0x242070db);
       OP (B, C, D, A, 22, 0xc1bdceee);
       OP (A, B, C, D, 7, 0xf57c0faf);
       OP (D, A, B, C, 12, 0x4787c62a);
       OP (C, D, A, B, 17, 0xa8304613);
       OP (B, C, D, A, 22, 0xfd469501);
       OP (A, B, C, D, 7, 0x698098d8);
       OP (D, A, B, C, 12, 0x8b44f7af);
       OP (C, D, A, B, 17, 0xffff5bb1);
       OP (B, C, D, A, 22, 0x895cd7be);
       OP (A, B, C, D, 7, 0x6b901122);
       OP (D, A, B, C, 12, 0xfd987193);
       OP (C, D, A, B, 17, 0xa679438e);
       OP (B, C, D, A, 22, 0x49b40821);
 
       /* For the second to fourth round we have the possibly swapped words
          in CORRECT_WORDS.  Redefine the macro to take an additional first
          argument specifying the function to use.  */
 #undef OP
 #define OP(f, a, b, c, d, k, s, T)                                      \
       do                                                                \
         {                                                               \
           a += f (b, c, d) + correct_words[k] + T;                      \
           CYCLIC (a, s);                                                \
           a += b;                                                       \
         }                                                               \
       while (0)
 
       /* Round 2.  */
       OP (FG, A, B, C, D, 1, 5, 0xf61e2562);
       OP (FG, D, A, B, C, 6, 9, 0xc040b340);
       OP (FG, C, D, A, B, 11, 14, 0x265e5a51);
       OP (FG, B, C, D, A, 0, 20, 0xe9b6c7aa);
       OP (FG, A, B, C, D, 5, 5, 0xd62f105d);
       OP (FG, D, A, B, C, 10, 9, 0x02441453);
       OP (FG, C, D, A, B, 15, 14, 0xd8a1e681);
       OP (FG, B, C, D, A, 4, 20, 0xe7d3fbc8);
       OP (FG, A, B, C, D, 9, 5, 0x21e1cde6);
       OP (FG, D, A, B, C, 14, 9, 0xc33707d6);
       OP (FG, C, D, A, B, 3, 14, 0xf4d50d87);
       OP (FG, B, C, D, A, 8, 20, 0x455a14ed);
       OP (FG, A, B, C, D, 13, 5, 0xa9e3e905);
       OP (FG, D, A, B, C, 2, 9, 0xfcefa3f8);
       OP (FG, C, D, A, B, 7, 14, 0x676f02d9);
       OP (FG, B, C, D, A, 12, 20, 0x8d2a4c8a);
 
       /* Round 3.  */
       OP (FH, A, B, C, D, 5, 4, 0xfffa3942);
       OP (FH, D, A, B, C, 8, 11, 0x8771f681);
       OP (FH, C, D, A, B, 11, 16, 0x6d9d6122);
       OP (FH, B, C, D, A, 14, 23, 0xfde5380c);
       OP (FH, A, B, C, D, 1, 4, 0xa4beea44);
       OP (FH, D, A, B, C, 4, 11, 0x4bdecfa9);
       OP (FH, C, D, A, B, 7, 16, 0xf6bb4b60);
       OP (FH, B, C, D, A, 10, 23, 0xbebfbc70);
       OP (FH, A, B, C, D, 13, 4, 0x289b7ec6);
       OP (FH, D, A, B, C, 0, 11, 0xeaa127fa);
       OP (FH, C, D, A, B, 3, 16, 0xd4ef3085);
       OP (FH, B, C, D, A, 6, 23, 0x04881d05);
       OP (FH, A, B, C, D, 9, 4, 0xd9d4d039);
       OP (FH, D, A, B, C, 12, 11, 0xe6db99e5);
       OP (FH, C, D, A, B, 15, 16, 0x1fa27cf8);
       OP (FH, B, C, D, A, 2, 23, 0xc4ac5665);
 
       /* Round 4.  */
       OP (FI, A, B, C, D, 0, 6, 0xf4292244);
       OP (FI, D, A, B, C, 7, 10, 0x432aff97);
       OP (FI, C, D, A, B, 14, 15, 0xab9423a7);
       OP (FI, B, C, D, A, 5, 21, 0xfc93a039);
       OP (FI, A, B, C, D, 12, 6, 0x655b59c3);
       OP (FI, D, A, B, C, 3, 10, 0x8f0ccc92);
       OP (FI, C, D, A, B, 10, 15, 0xffeff47d);
       OP (FI, B, C, D, A, 1, 21, 0x85845dd1);
       OP (FI, A, B, C, D, 8, 6, 0x6fa87e4f);
       OP (FI, D, A, B, C, 15, 10, 0xfe2ce6e0);
       OP (FI, C, D, A, B, 6, 15, 0xa3014314);
       OP (FI, B, C, D, A, 13, 21, 0x4e0811a1);
       OP (FI, A, B, C, D, 4, 6, 0xf7537e82);
       OP (FI, D, A, B, C, 11, 10, 0xbd3af235);
       OP (FI, C, D, A, B, 2, 15, 0x2ad7d2bb);
       OP (FI, B, C, D, A, 9, 21, 0xeb86d391);
 
       /* Add the starting values of the context.  */
       A += A_save;
       B += B_save;
       C += C_save;
       D += D_save;
     }
 
   /* Put checksum in context given as argument.  */
   ctx->A = A;
   ctx->B = B;
   ctx->C = C;
   ctx->D = D;
 }
 #endif
 
 /*
  * Hey Emacs!
  * Local Variables:
  * coding: utf-8
  * End:
  */
diff --git a/m4/gnulib-cache.m4 b/m4/gnulib-cache.m4
index f9c24d22ef..56cc36b76e 100644
--- a/m4/gnulib-cache.m4
+++ b/m4/gnulib-cache.m4
@@ -1,62 +1,63 @@
 # Copyright (C) 2002-2020 Free Software Foundation, Inc.
 #
 # This file is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
 # the Free Software Foundation; either version 3 of the License, or
 # (at your option) any later version.
 #
 # This file is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
 # along with this file.  If not, see <https://www.gnu.org/licenses/>.
 #
 # As a special exception to the GNU General Public License,
 # this file may be distributed as part of a program that
 # contains a configuration script generated by Autoconf, under
 # the same distribution terms as the rest of that program.
 #
 # Generated by gnulib-tool.
 #
 # This file represents the specification of how gnulib-tool is used.
 # It acts as a cache: It is written and read by gnulib-tool.
 # In projects that use version control, this file is meant to be put under
 # version control, like the configure.ac and various Makefile.am files.
 
 
 # Specification in the form of a command-line invocation:
 # gnulib-tool --import \
 #  --lib=libgnu \
 #  --source-base=lib/gnu \
 #  --m4-base=m4 \
 #  --doc-base=doc \
 #  --tests-base=tests \
 #  --aux-dir=. \
 #  --lgpl=2 \
 #  --no-conditional-dependencies \
-#  --no-libtool \
+#  --libtool \
 #  --macro-prefix=gl \
 #  --no-vc-files \
 #  --avoid=stdint \
 #  crypto/md5-buffer
 
 # Specification in the form of a few gnulib-tool.m4 macro invocations:
 gl_LOCAL_DIR([])
 gl_MODULES([
   crypto/md5-buffer
 ])
 gl_AVOID([ stdint])
 gl_SOURCE_BASE([lib/gnu])
 gl_M4_BASE([m4])
 gl_PO_BASE([])
 gl_DOC_BASE([doc])
 gl_TESTS_BASE([tests])
 gl_LIB([libgnu])
 gl_LGPL([2])
 gl_MAKEFILE_NAME([])
+gl_LIBTOOL
 gl_MACRO_PREFIX([gl])
 gl_PO_DOMAIN([])
 gl_WITNESS_C_MACRO([])
 gl_VC_FILES([false])
diff --git a/m4/gnulib-comp.m4 b/m4/gnulib-comp.m4
index 44f1ec9439..4d1ae740b4 100644
--- a/m4/gnulib-comp.m4
+++ b/m4/gnulib-comp.m4
@@ -1,227 +1,221 @@
 # DO NOT EDIT! GENERATED AUTOMATICALLY!
 # Copyright (C) 2002-2020 Free Software Foundation, Inc.
 #
 # This file is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
 # the Free Software Foundation; either version 3 of the License, or
 # (at your option) any later version.
 #
 # This file is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
 # along with this file.  If not, see <https://www.gnu.org/licenses/>.
 #
 # As a special exception to the GNU General Public License,
 # this file may be distributed as part of a program that
 # contains a configuration script generated by Autoconf, under
 # the same distribution terms as the rest of that program.
 #
 # Generated by gnulib-tool.
 #
 # This file represents the compiled summary of the specification in
 # gnulib-cache.m4. It lists the computed macro invocations that need
 # to be invoked from configure.ac.
 # In projects that use version control, this file can be treated like
 # other built files.
 
 
 # This macro should be invoked from ./configure.ac, in the section
 # "Checks for programs", right after AC_PROG_CC, and certainly before
 # any checks for libraries, header files, types and library functions.
 AC_DEFUN([gl_EARLY],
 [
   m4_pattern_forbid([^gl_[A-Z]])dnl the gnulib macro namespace
   m4_pattern_allow([^gl_ES$])dnl a valid locale name
   m4_pattern_allow([^gl_LIBOBJS$])dnl a variable
   m4_pattern_allow([^gl_LTLIBOBJS$])dnl a variable
 
   # Pre-early section.
   AC_REQUIRE([gl_PROG_AR_RANLIB])
 
   # Code from module byteswap:
   # Code from module c99:
   # Code from module crypto/md5-buffer:
   # Code from module extern-inline:
   # Code from module std-gnu11:
   # Code from module stdalign:
 ])
 
 # This macro should be invoked from ./configure.ac, in the section
 # "Check for header files, types and library functions".
 AC_DEFUN([gl_INIT],
 [
-  AM_CONDITIONAL([GL_COND_LIBTOOL], [false])
-  gl_cond_libtool=false
-  gl_libdeps=
-  gl_ltlibdeps=
+  AM_CONDITIONAL([GL_COND_LIBTOOL], [true])
+  gl_cond_libtool=true
   gl_m4_base='m4'
   m4_pushdef([AC_LIBOBJ], m4_defn([gl_LIBOBJ]))
   m4_pushdef([AC_REPLACE_FUNCS], m4_defn([gl_REPLACE_FUNCS]))
   m4_pushdef([AC_LIBSOURCES], m4_defn([gl_LIBSOURCES]))
   m4_pushdef([gl_LIBSOURCES_LIST], [])
   m4_pushdef([gl_LIBSOURCES_DIR], [])
   gl_COMMON
   gl_source_base='lib/gnu'
   gl_BYTESWAP
   AC_REQUIRE([AC_C_RESTRICT])
   gl_MD5
   AC_REQUIRE([gl_EXTERN_INLINE])
   gl_STDALIGN_H
   # End of code from modules
   m4_ifval(gl_LIBSOURCES_LIST, [
     m4_syscmd([test ! -d ]m4_defn([gl_LIBSOURCES_DIR])[ ||
       for gl_file in ]gl_LIBSOURCES_LIST[ ; do
         if test ! -r ]m4_defn([gl_LIBSOURCES_DIR])[/$gl_file ; then
           echo "missing file ]m4_defn([gl_LIBSOURCES_DIR])[/$gl_file" >&2
           exit 1
         fi
       done])dnl
       m4_if(m4_sysval, [0], [],
         [AC_FATAL([expected source file, required through AC_LIBSOURCES, not found])])
   ])
   m4_popdef([gl_LIBSOURCES_DIR])
   m4_popdef([gl_LIBSOURCES_LIST])
   m4_popdef([AC_LIBSOURCES])
   m4_popdef([AC_REPLACE_FUNCS])
   m4_popdef([AC_LIBOBJ])
   AC_CONFIG_COMMANDS_PRE([
     gl_libobjs=
     gl_ltlibobjs=
     if test -n "$gl_LIBOBJS"; then
       # Remove the extension.
       sed_drop_objext='s/\.o$//;s/\.obj$//'
       for i in `for i in $gl_LIBOBJS; do echo "$i"; done | sed -e "$sed_drop_objext" | sort | uniq`; do
         gl_libobjs="$gl_libobjs $i.$ac_objext"
         gl_ltlibobjs="$gl_ltlibobjs $i.lo"
       done
     fi
     AC_SUBST([gl_LIBOBJS], [$gl_libobjs])
     AC_SUBST([gl_LTLIBOBJS], [$gl_ltlibobjs])
   ])
   gltests_libdeps=
   gltests_ltlibdeps=
   m4_pushdef([AC_LIBOBJ], m4_defn([gltests_LIBOBJ]))
   m4_pushdef([AC_REPLACE_FUNCS], m4_defn([gltests_REPLACE_FUNCS]))
   m4_pushdef([AC_LIBSOURCES], m4_defn([gltests_LIBSOURCES]))
   m4_pushdef([gltests_LIBSOURCES_LIST], [])
   m4_pushdef([gltests_LIBSOURCES_DIR], [])
   gl_COMMON
   gl_source_base='tests'
 changequote(,)dnl
   gltests_WITNESS=IN_`echo "${PACKAGE-$PACKAGE_TARNAME}" | LC_ALL=C tr abcdefghijklmnopqrstuvwxyz ABCDEFGHIJKLMNOPQRSTUVWXYZ | LC_ALL=C sed -e 's/[^A-Z0-9_]/_/g'`_GNULIB_TESTS
 changequote([, ])dnl
   AC_SUBST([gltests_WITNESS])
   gl_module_indicator_condition=$gltests_WITNESS
   m4_pushdef([gl_MODULE_INDICATOR_CONDITION], [$gl_module_indicator_condition])
   m4_popdef([gl_MODULE_INDICATOR_CONDITION])
   m4_ifval(gltests_LIBSOURCES_LIST, [
     m4_syscmd([test ! -d ]m4_defn([gltests_LIBSOURCES_DIR])[ ||
       for gl_file in ]gltests_LIBSOURCES_LIST[ ; do
         if test ! -r ]m4_defn([gltests_LIBSOURCES_DIR])[/$gl_file ; then
           echo "missing file ]m4_defn([gltests_LIBSOURCES_DIR])[/$gl_file" >&2
           exit 1
         fi
       done])dnl
       m4_if(m4_sysval, [0], [],
         [AC_FATAL([expected source file, required through AC_LIBSOURCES, not found])])
   ])
   m4_popdef([gltests_LIBSOURCES_DIR])
   m4_popdef([gltests_LIBSOURCES_LIST])
   m4_popdef([AC_LIBSOURCES])
   m4_popdef([AC_REPLACE_FUNCS])
   m4_popdef([AC_LIBOBJ])
   AC_CONFIG_COMMANDS_PRE([
     gltests_libobjs=
     gltests_ltlibobjs=
     if test -n "$gltests_LIBOBJS"; then
       # Remove the extension.
       sed_drop_objext='s/\.o$//;s/\.obj$//'
       for i in `for i in $gltests_LIBOBJS; do echo "$i"; done | sed -e "$sed_drop_objext" | sort | uniq`; do
         gltests_libobjs="$gltests_libobjs $i.$ac_objext"
         gltests_ltlibobjs="$gltests_ltlibobjs $i.lo"
       done
     fi
     AC_SUBST([gltests_LIBOBJS], [$gltests_libobjs])
     AC_SUBST([gltests_LTLIBOBJS], [$gltests_ltlibobjs])
   ])
-  LIBGNU_LIBDEPS="$gl_libdeps"
-  AC_SUBST([LIBGNU_LIBDEPS])
-  LIBGNU_LTLIBDEPS="$gl_ltlibdeps"
-  AC_SUBST([LIBGNU_LTLIBDEPS])
 ])
 
 # Like AC_LIBOBJ, except that the module name goes
 # into gl_LIBOBJS instead of into LIBOBJS.
 AC_DEFUN([gl_LIBOBJ], [
   AS_LITERAL_IF([$1], [gl_LIBSOURCES([$1.c])])dnl
   gl_LIBOBJS="$gl_LIBOBJS $1.$ac_objext"
 ])
 
 # Like AC_REPLACE_FUNCS, except that the module name goes
 # into gl_LIBOBJS instead of into LIBOBJS.
 AC_DEFUN([gl_REPLACE_FUNCS], [
   m4_foreach_w([gl_NAME], [$1], [AC_LIBSOURCES(gl_NAME[.c])])dnl
   AC_CHECK_FUNCS([$1], , [gl_LIBOBJ($ac_func)])
 ])
 
 # Like AC_LIBSOURCES, except the directory where the source file is
 # expected is derived from the gnulib-tool parameterization,
 # and alloca is special cased (for the alloca-opt module).
 # We could also entirely rely on EXTRA_lib..._SOURCES.
 AC_DEFUN([gl_LIBSOURCES], [
   m4_foreach([_gl_NAME], [$1], [
     m4_if(_gl_NAME, [alloca.c], [], [
       m4_define([gl_LIBSOURCES_DIR], [lib/gnu])
       m4_append([gl_LIBSOURCES_LIST], _gl_NAME, [ ])
     ])
   ])
 ])
 
 # Like AC_LIBOBJ, except that the module name goes
 # into gltests_LIBOBJS instead of into LIBOBJS.
 AC_DEFUN([gltests_LIBOBJ], [
   AS_LITERAL_IF([$1], [gltests_LIBSOURCES([$1.c])])dnl
   gltests_LIBOBJS="$gltests_LIBOBJS $1.$ac_objext"
 ])
 
 # Like AC_REPLACE_FUNCS, except that the module name goes
 # into gltests_LIBOBJS instead of into LIBOBJS.
 AC_DEFUN([gltests_REPLACE_FUNCS], [
   m4_foreach_w([gl_NAME], [$1], [AC_LIBSOURCES(gl_NAME[.c])])dnl
   AC_CHECK_FUNCS([$1], , [gltests_LIBOBJ($ac_func)])
 ])
 
 # Like AC_LIBSOURCES, except the directory where the source file is
 # expected is derived from the gnulib-tool parameterization,
 # and alloca is special cased (for the alloca-opt module).
 # We could also entirely rely on EXTRA_lib..._SOURCES.
 AC_DEFUN([gltests_LIBSOURCES], [
   m4_foreach([_gl_NAME], [$1], [
     m4_if(_gl_NAME, [alloca.c], [], [
       m4_define([gltests_LIBSOURCES_DIR], [tests])
       m4_append([gltests_LIBSOURCES_LIST], _gl_NAME, [ ])
     ])
   ])
 ])
 
 # This macro records the list of files which have been installed by
 # gnulib-tool and may be removed by future gnulib-tool invocations.
 AC_DEFUN([gl_FILE_LIST], [
   lib/byteswap.in.h
   lib/gl_openssl.h
   lib/md5.c
   lib/md5.h
   lib/stdalign.in.h
   m4/00gnulib.m4
   m4/byteswap.m4
   m4/extern-inline.m4
   m4/gl-openssl.m4
   m4/gnulib-common.m4
   m4/md5.m4
   m4/std-gnu11.m4
   m4/stdalign.m4
   m4/zzgnulib.m4
 ])