pkg/39766: security/mhash installs <mhash.h> that cooperates badly with autoconf

[Taylor R Campbell <campbell%mumble.net@localhost>]

>Number:         39766
>Category:       pkg
>Synopsis:       security/mhash installs <mhash.h> that cooperates badly with 
>autoconf
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    pkg-manager
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Oct 19 03:45:00 +0000 2008
>Originator:     Taylor R Campbell <campbell%mumble.net@localhost>
>Release:        NetBSD 4.0_STABLE
>Organization:
>Environment:
System: NetBSD slate.localdomain 4.0_STABLE NetBSD 4.0_STABLE (RIABWI) #11: Mon 
Sep 22 15:53:59 UTC 2008 
riastradh%slate.localdomain@localhost:/home/riastradh/netbsd/4/obj/sys/arch/macppc/compile/RIABWI
 macppc
Architecture: powerpc
Machine: macppc
>Description:

        The package security/mhash installs a file in
        /usr/pkg/include/mhash.h that has the effect of including
        mhash's config.h generated by autoconf, which is intended for
        use internal to the program of which config.h is a part.  Any
        other program that uses autoconf will have trouble reconciling
        mhash's config.h with its own config.h, since they define many
        macros in common, such as PACKAGE_NAME and PACKAGE_VERSION.

>How-To-Repeat:

        Install security/mhash and try to build a C program that uses
        autoconf and includes <mhash.h>.

>Fix:

        Patch /usr/pkg/include/mhash.h to strike out the line
        
                #define MUTILS_USE_MHASH_CONFIG
        
        which has no useful effects of which I am aware for programs
        outside of mhash.  It may be possible to patch the source file
        mhash-0.9.9/include/mhash.h -- other C source files in mhash
        already define MUTILS_USE_MHASH_CONFIG before including it.

        This should probably also be reported upstream, but mhash looks
        awfully defunct upstream.  <http://mhash.sf.net/> is rather
        outdated, and the version one finds in CVS is older than the
        version one finds in the distribution tarballs.