diff --git a/dirmngr/Makefile.am b/dirmngr/Makefile.am
index 098e711e9..2bf0cb75b 100644
--- a/dirmngr/Makefile.am
+++ b/dirmngr/Makefile.am
@@ -1,178 +1,178 @@
 # Makefile.am - dirmngr
 # Copyright (C) 2002 Klarälvdalens Datakonsult AB
 # Copyright (C) 2004, 2007, 2010 g10 Code GmbH
 #
 # This file is part of GnuPG.
 #
 # GnuPG is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
 # the Free Software Foundation; either version 3 of the License, or
 # (at your option) any later version.
 #
 # GnuPG is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
 # along with this program; if not, see <https://www.gnu.org/licenses/>.
 #
 # SPDX-License-Identifier: GPL-3.0+
 
 ## Process this file with automake to produce Makefile.in
 
 EXTRA_DIST = OAUTHORS ONEWS ChangeLog-2011 tls-ca.pem
 dist_pkgdata_DATA = sks-keyservers.netCA.pem
 
 bin_PROGRAMS = dirmngr dirmngr-client
 
 if USE_LDAPWRAPPER
 libexec_PROGRAMS = dirmngr_ldap
 endif
 
 noinst_PROGRAMS = $(module_tests) $(module_net_tests) $(module_maint_tests)
 TESTS = $(module_tests) $(module_net_tests)
 
 AM_CPPFLAGS =
 
 include $(top_srcdir)/am/cmacros.am
 
 AM_CFLAGS = $(USE_C99_CFLAGS) \
             $(LIBGCRYPT_CFLAGS) $(KSBA_CFLAGS) $(LIBASSUAN_CFLAGS)	\
             $(GPG_ERROR_CFLAGS) $(NPTH_CFLAGS) $(NTBTLS_CFLAGS)		\
             $(LIBGNUTLS_CFLAGS)
 
 
 if HAVE_W32_SYSTEM
 ldap_url = ldap-url.h ldap-url.c
 else
 ldap_url =
 endif
 
 if USE_LDAPWRAPPER
 extraldap_src = ldap-wrapper.c
 else
 extraldap_src = ldap-wrapper-ce.c  dirmngr_ldap.c
 endif
 
 noinst_HEADERS = dirmngr.h crlcache.h crlfetch.h misc.h
 
 dirmngr_SOURCES = dirmngr.c dirmngr.h server.c crlcache.c crlfetch.c	\
 	certcache.c certcache.h \
 	domaininfo.c \
 	workqueue.c \
 	loadswdb.c \
 	cdb.h cdblib.c misc.c dirmngr-err.h dirmngr-status.h \
 	ocsp.c ocsp.h validate.c validate.h  \
 	dns-stuff.c dns-stuff.h \
 	http.c http.h http-common.c http-common.h http-ntbtls.c \
 	ks-action.c ks-action.h ks-engine.h \
 	ks-engine-hkp.c ks-engine-http.c ks-engine-finger.c ks-engine-kdns.c
 
 if USE_LIBDNS
 dirmngr_SOURCES += dns.c dns.h
 endif
 
 if USE_LDAP
 dirmngr_SOURCES += ldapserver.h ldapserver.c ldap.c w32-ldap-help.h \
                    ldap-wrapper.h ldap-parse-uri.c ldap-parse-uri.h \
                    ks-engine-ldap.c $(ldap_url) $(extraldap_src)
 ldaplibs = $(LDAPLIBS)
 else
 ldaplibs =
 endif
 
 
 dirmngr_LDADD = $(libcommonpth) \
         $(DNSLIBS) $(LIBASSUAN_LIBS) \
 	$(LIBGCRYPT_LIBS) $(KSBA_LIBS) $(NPTH_LIBS) \
-	$(NTBTLS_LIBS) $(LIBGNUTLS_LIBS) $(LIBINTL) $(LIBICONV)
+	$(NTBTLS_LIBS) $(LIBGNUTLS_LIBS) $(LIBINTL) $(LIBICONV) $(NETLIBS)
 if USE_LDAP
 dirmngr_LDADD += $(ldaplibs)
 endif
 if !USE_LDAPWRAPPER
 dirmngr_LDADD += $(ldaplibs)
 endif
 dirmngr_LDFLAGS = $(extra_bin_ldflags)
 
 if USE_LDAPWRAPPER
 dirmngr_ldap_SOURCES = dirmngr_ldap.c $(ldap_url)
 dirmngr_ldap_CFLAGS = $(GPG_ERROR_CFLAGS) $(LIBGCRYPT_CFLAGS)
 dirmngr_ldap_LDFLAGS =
 dirmngr_ldap_LDADD = $(libcommon) \
 		     $(GPG_ERROR_LIBS) $(LIBGCRYPT_LIBS) $(LDAPLIBS) \
 		     $(LBER_LIBS) $(LIBINTL) $(LIBICONV) $(NETLIBS)
 endif
 
 dirmngr_client_SOURCES = dirmngr-client.c
 dirmngr_client_LDADD = $(libcommon) \
                        $(LIBASSUAN_LIBS) $(GPG_ERROR_LIBS) \
                        $(LIBGCRYPT_LIBS) $(NETLIBS) $(LIBINTL) $(LIBICONV)
 dirmngr_client_LDFLAGS = $(extra_bin_ldflags)
 
 
 t_common_src = t-support.h t-support.c
 if USE_LIBDNS
 t_common_src += dns.c dns.h
 endif
 t_common_ldadd = $(libcommon) $(LIBASSUAN_LIBS) $(LIBGCRYPT_LIBS) \
                  $(GPG_ERROR_LIBS) $(NETLIBS) \
                  $(NTBTLS_LIBS) $(LIBGNUTLS_LIBS) \
                  $(DNSLIBS) $(LIBINTL) $(LIBICONV)
 
 module_tests = t-http-basic
 
 if USE_LDAP
 module_tests += t-ldap-parse-uri
 endif
 
 # Test which need a network connections are only used in maintainer mode.
 if MAINTAINER_MODE
 module_net_tests = t-dns-stuff
 else
 module_net_tests =
 endif
 
 # Tests which are only for manually testing are only build in maintainer-mode.
 if MAINTAINER_MODE
 module_maint_tests = t-http
 else
 module_maint_tests =
 endif
 
 
 # http tests
 # We need to add the KSBA flags in case we are building against GNUTLS.
 # In that case NTBTLS flags are empty, but we need ksba anyway.
 t_http_SOURCES = $(t_common_src) t-http.c http.c dns-stuff.c http-common.c
 t_http_CFLAGS  = -DWITHOUT_NPTH=1  $(USE_C99_CFLAGS) \
 	         $(LIBGCRYPT_CFLAGS) $(NTBTLS_CFLAGS) $(LIBGNUTLS_CFLAGS) \
                  $(LIBASSUAN_CFLAGS) $(GPG_ERROR_CFLAGS) $(KSBA_CFLAGS)
 t_http_LDADD   = $(t_common_ldadd) \
 	         $(NTBTLS_LIBS) $(KSBA_LIBS) $(LIBGNUTLS_LIBS) $(DNSLIBS)
 
 t_http_basic_SOURCES = $(t_common_src) t-http-basic.c http.c \
 	               dns-stuff.c http-common.c
 t_http_basic_CFLAGS  = -DWITHOUT_NPTH=1  $(USE_C99_CFLAGS) \
 	         $(LIBGCRYPT_CFLAGS) $(NTBTLS_CFLAGS) $(LIBGNUTLS_CFLAGS) \
                  $(LIBASSUAN_CFLAGS) $(GPG_ERROR_CFLAGS) $(KSBA_CFLAGS)
 t_http_basic_LDADD   = $(t_common_ldadd) \
 	         $(NTBTLS_LIBS) $(KSBA_LIBS) $(LIBGNUTLS_LIBS) $(DNSLIBS)
 
 
 t_ldap_parse_uri_SOURCES = \
 	t-ldap-parse-uri.c ldap-parse-uri.c ldap-parse-uri.h \
         http.c http-common.c dns-stuff.c \
         $(ldap_url) $(t_common_src)
 t_ldap_parse_uri_CFLAGS = -DWITHOUT_NPTH=1  $(USE_C99_CFLAGS) \
 			  $(LIBGCRYPT_CFLAGS) \
                           $(LIBASSUAN_CFLAGS) $(GPG_ERROR_CFLAGS)
 t_ldap_parse_uri_LDADD = $(ldaplibs) $(t_common_ldadd) $(DNSLIBS)
 
 t_dns_stuff_CFLAGS = -DWITHOUT_NPTH=1  $(USE_C99_CFLAGS) \
 		     $(LIBGCRYPT_CFLAGS) \
 	             $(LIBASSUAN_CFLAGS) $(GPG_ERROR_CFLAGS)
 t_dns_stuff_SOURCES = $(t_common_src) t-dns-stuff.c dns-stuff.c
 t_dns_stuff_LDADD   = $(t_common_ldadd) $(DNSLIBS)
 
 $(PROGRAMS) : $(libcommon) $(libcommonpth)
diff --git a/sm/Makefile.am b/sm/Makefile.am
index ddc2e225f..475924a01 100644
--- a/sm/Makefile.am
+++ b/sm/Makefile.am
@@ -1,70 +1,70 @@
 # Copyright (C) 2001, 2002, 2003 Free Software Foundation, Inc.
 #
 # This file is part of GnuPG.
 #
 # GnuPG is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
 # the Free Software Foundation; either version 3 of the License, or
 # (at your option) any later version.
 #
 # GnuPG is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
 # along with this program; if not, see <https://www.gnu.org/licenses/>.
 
 ## Process this file with automake to produce Makefile.in
 
 EXTRA_DIST = ChangeLog-2011 gpgsm-w32info.rc
 
 bin_PROGRAMS = gpgsm
 
 AM_CFLAGS = $(LIBGCRYPT_CFLAGS) $(KSBA_CFLAGS) $(LIBASSUAN_CFLAGS)
 
 AM_CPPFLAGS = -DKEYBOX_WITH_X509=1
 include $(top_srcdir)/am/cmacros.am
 
 if HAVE_W32_SYSTEM
 resource_objs += gpgsm-w32info.o
 endif
 
 gpgsm_SOURCES = \
 	gpgsm.c	gpgsm.h \
 	misc.c \
 	keydb.c keydb.h \
 	server.c \
 	call-agent.c \
 	call-dirmngr.c \
 	fingerprint.c \
 	certlist.c \
 	certdump.c \
 	certcheck.c \
 	certchain.c \
 	keylist.c \
 	verify.c \
 	sign.c \
 	encrypt.c \
 	decrypt.c \
 	import.c \
 	export.c \
 	delete.c \
 	certreqgen.c \
 	certreqgen-ui.c \
 	minip12.c minip12.h \
 	qualified.c \
 	passphrase.c passphrase.h
 
 
 common_libs = ../kbx/libkeybox509.a $(libcommon)
 
 gpgsm_LDADD = $(common_libs) ../common/libgpgrl.a \
               $(LIBGCRYPT_LIBS) $(KSBA_LIBS) $(LIBASSUAN_LIBS) \
               $(GPG_ERROR_LIBS) $(LIBREADLINE) $(LIBINTL) \
-	      $(LIBICONV) $(resource_objs) $(extra_sys_libs)
+	      $(LIBICONV) $(resource_objs) $(extra_sys_libs) $(NETLIBS)
 gpgsm_LDFLAGS = $(extra_bin_ldflags)
 
 # Make sure that all libs are build before we use them.  This is
 # important for things like make -j2.
 $(PROGRAMS): $(common_libs)
diff --git a/tools/Makefile.am b/tools/Makefile.am
index 579c4141c..e9e5564e9 100644
--- a/tools/Makefile.am
+++ b/tools/Makefile.am
@@ -1,179 +1,179 @@
 # Makefile.am - Tools directory
 #     	Copyright (C) 2003, 2007 Free Software Foundation, Inc.
 #
 # This file is part of GnuPG.
 #
 # GnuPG is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
 # the Free Software Foundation; either version 3 of the License, or
 # (at your option) any later version.
 #
 # GnuPG is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
 # along with this program; if not, see <https://www.gnu.org/licenses/>.
 
 EXTRA_DIST = \
 	Manifest watchgnupg.c no-libgcrypt.c \
 	addgnupghome applygnupgdefaults \
 	lspgpot mail-signed-keys convert-from-106 sockprox.c \
 	ccidmon.c ChangeLog-2011 gpg-connect-agent-w32info.rc
 
 
 AM_CPPFLAGS =
 include $(top_srcdir)/am/cmacros.am
 
 if HAVE_W32_SYSTEM
 resource_objs += gpg-connect-agent-w32info.o
 endif
 
 AM_CFLAGS = $(LIBGCRYPT_CFLAGS) $(GPG_ERROR_CFLAGS) $(LIBASSUAN_CFLAGS)
 
 sbin_SCRIPTS = addgnupghome applygnupgdefaults
 
 if HAVE_USTAR
 # bin_SCRIPTS += gpg-zip
 noinst_SCRIPTS = gpg-zip
 endif
 
 if BUILD_SYMCRYPTRUN
   symcryptrun = symcryptrun
 else
   symcryptrun =
 endif
 
 if BUILD_WKS_TOOLS
   gpg_wks_server = gpg-wks-server
 else
   gpg_wks_server =
 endif
 
 libexec_PROGRAMS = gpg-wks-client
 
 bin_PROGRAMS = gpgconf gpg-connect-agent ${symcryptrun}
 if !HAVE_W32_SYSTEM
 bin_PROGRAMS += watchgnupg gpgparsemail ${gpg_wks_server}
 endif
 
 libexec_PROGRAMS += gpg-check-pattern
 
 if !HAVE_W32CE_SYSTEM
 noinst_PROGRAMS = clean-sat make-dns-cert gpgsplit
 endif
 
 if !HAVE_W32CE_SYSTEM
 if BUILD_GPGTAR
   bin_PROGRAMS += gpgtar
 else
   noinst_PROGRAMS += gpgtar
 endif
 endif
 
 common_libs = $(libcommon)
 commonpth_libs = $(libcommonpth)
 
 # Some modules require PTH under W32CE.
 if HAVE_W32CE_SYSTEM
 maybe_commonpth_libs = $(commonpth_libs)
 else
 maybe_commonpth_libs = $(common_libs)
 endif
 
 if HAVE_W32CE_SYSTEM
 pwquery_libs =
 else
 pwquery_libs = ../common/libsimple-pwquery.a
 endif
 
 if HAVE_W32CE_SYSTEM
 opt_libassuan_libs = $(LIBASSUAN_LIBS)
 endif
 
 regexp_libs = ../regexp/libregexp.a
 
 
 gpgsplit_LDADD = $(common_libs) \
 	         $(LIBGCRYPT_LIBS) $(GPG_ERROR_LIBS) \
 		 $(ZLIBS) $(LIBINTL) $(NETLIBS) $(LIBICONV)
 
 gpgconf_SOURCES = gpgconf.c gpgconf.h gpgconf-comp.c
 
 # common sucks in gpg-error, will they, nil they (some compilers
 # do not eliminate the supposed-to-be-unused-inline-functions).
 gpgconf_LDADD = $(maybe_commonpth_libs) $(opt_libassuan_libs) \
                 $(LIBINTL) $(LIBGCRYPT_LIBS) $(GPG_ERROR_LIBS) $(NETLIBS) \
 	        $(LIBICONV) $(W32SOCKLIBS)
 gpgconf_LDFLAGS = $(extra_bin_ldflags)
 
 gpgparsemail_SOURCES = gpgparsemail.c rfc822parse.c rfc822parse.h
 gpgparsemail_LDADD =
 
 symcryptrun_SOURCES = symcryptrun.c
 symcryptrun_LDADD = $(LIBUTIL_LIBS) $(common_libs) $(pwquery_libs) \
                     $(LIBGCRYPT_LIBS) $(GPG_ERROR_LIBS) $(LIBINTL) \
                     $(LIBICONV) $(NETLIBS) $(W32SOCKLIBS) $(LIBASSUAN_LIBS)
 
 watchgnupg_SOURCES = watchgnupg.c
 watchgnupg_LDADD = $(NETLIBS)
 
 gpg_connect_agent_SOURCES = gpg-connect-agent.c
 gpg_connect_agent_LDADD = ../common/libgpgrl.a $(common_libs) \
 	                  $(LIBASSUAN_LIBS) $(LIBGCRYPT_LIBS) \
                           $(GPG_ERROR_LIBS) \
                           $(LIBREADLINE) $(LIBINTL) $(NETLIBS) $(LIBICONV) \
                           $(resource_objs)
 
 
 gpg_check_pattern_SOURCES = gpg-check-pattern.c
 gpg_check_pattern_CFLAGS = $(LIBGCRYPT_CFLAGS) $(GPG_ERROR_CFLAGS) $(INCICONV)
 gpg_check_pattern_LDADD = $(common_libs) $(regexp_libs) $(LIBGCRYPT_LIBS) \
 			  $(GPG_ERROR_LIBS) \
 			  $(LIBINTL) $(NETLIBS) $(LIBICONV) $(W32SOCKLIBS) \
 			  $(LIBICONV)
 
 gpgtar_SOURCES = \
 	gpgtar.c gpgtar.h \
 	gpgtar-create.c \
 	gpgtar-extract.c \
 	gpgtar-list.c
 gpgtar_CFLAGS = $(GPG_ERROR_CFLAGS)
 gpgtar_LDADD = $(libcommon) $(LIBGCRYPT_LIBS) $(GPG_ERROR_LIBS) \
                $(LIBINTL) $(NETLIBS) $(LIBICONV) $(W32SOCKLIBS)
 
 gpg_wks_server_SOURCES = \
 	gpg-wks-server.c \
 	gpg-wks.h \
 	wks-util.c \
 	wks-receive.c \
 	rfc822parse.c rfc822parse.h \
 	mime-parser.c mime-parser.h \
 	mime-maker.c  mime-maker.h  \
 	send-mail.c   send-mail.h
 
 gpg_wks_server_CFLAGS = $(GPG_ERROR_CFLAGS) $(INCICONV)
 gpg_wks_server_LDADD = $(libcommon) $(LIBGCRYPT_LIBS) $(GPG_ERROR_LIBS) \
 		       $(LIBINTL) $(LIBICONV)
 
 gpg_wks_client_SOURCES = \
 	gpg-wks-client.c \
 	gpg-wks.h  \
 	wks-util.c \
 	wks-receive.c \
 	rfc822parse.c rfc822parse.h \
 	mime-parser.c mime-parser.h \
 	mime-maker.h  mime-maker.c  \
 	send-mail.c   send-mail.h   \
 	call-dirmngr.c call-dirmngr.h
 
 gpg_wks_client_CFLAGS = $(LIBASSUAN_CFLAGS) $(GPG_ERROR_CFLAGS) $(INCICONV)
 gpg_wks_client_LDADD = $(libcommon) \
 		       $(LIBASSUAN_LIBS) $(LIBGCRYPT_LIBS) $(GPG_ERROR_LIBS) \
-		       $(LIBINTL) $(LIBICONV)
+		       $(LIBINTL) $(LIBICONV) $(NETLIBS)
 
 
 # Make sure that all libs are build before we use them.  This is
 # important for things like make -j2.
 $(PROGRAMS): $(common_libs) $(pwquery_libs) ../common/libgpgrl.a