diff --git a/autotools.spec b/autotools.spec
index cb7feaf79ed..956f0ffde0c 100644
--- a/autotools.spec
+++ b/autotools.spec
@@ -6,7 +6,7 @@
 %define automake_maj %(echo %{automake_version} | cut -f1,2 -d.)
 %define libtool_version 2.4.6
 %define m4_version 1.4.18
-%define gettext_version 0.19.8.1
+%define gettext_version 0.20.1
 %define pkgconfig_version 0.29.2
 Source0: http://ftp.gnu.org/gnu/autoconf/autoconf-%{autoconf_version}.tar.gz
 Source1: http://ftp.gnu.org/gnu/automake/automake-%{automake_version}.tar.gz
diff --git a/bazel-0.29.1-patches.patch b/bazel-0.29.1-patches.patch
deleted file mode 100644
index 599ededa81e..00000000000
--- a/bazel-0.29.1-patches.patch
+++ /dev/null
@@ -1,55 +0,0 @@
-diff --git a/src/main/java/com/google/devtools/build/lib/exec/local/LocalSpawnRunner.java b/src/main/java/com/google/devtools/build/lib/exec/local/LocalSpawnRunner.java
-index 4426ad4c5a..7c64f42381 100644
---- a/src/main/java/com/google/devtools/build/lib/exec/local/LocalSpawnRunner.java
-+++ b/src/main/java/com/google/devtools/build/lib/exec/local/LocalSpawnRunner.java
-@@ -112,7 +112,7 @@ public class LocalSpawnRunner implements SpawnRunner {
-     this.localExecutionOptions = Preconditions.checkNotNull(localExecutionOptions);
-     this.hostName = NetUtil.getCachedShortHostName();
-     this.resourceManager = resourceManager;
--    this.useProcessWrapper = useProcessWrapper;
-+    this.useProcessWrapper = false;
-     this.localEnvProvider = localEnvProvider;
-     this.binTools = binTools;
-   }
-diff --git a/tools/cpp/unix_cc_configure.bzl b/tools/cpp/unix_cc_configure.bzl
-index ccb18a431a..1858574756 100644
---- a/tools/cpp/unix_cc_configure.bzl
-+++ b/tools/cpp/unix_cc_configure.bzl
-@@ -200,6 +200,8 @@ def _find_gold_linker_path(repository_ctx, cc):
-         for flag in line.split(" "):
-             if flag.find("gold") == -1:
-                 continue
-+            if flag.find("enable-gold") > -1 or flag.find("with-plugin-ld") > -1:
-+                continue
- 
-             # flag is '-fuse-ld=gold' for GCC or "/usr/lib/ld.gold" for Clang
-             # strip space, single quote, and double quotes
-diff --git a/src/conditions/BUILD b/src/conditions/BUILD
-index 2b28e28..faa41a4 100644
---- a/src/conditions/BUILD
-+++ b/src/conditions/BUILD
-@@ -11,6 +11,12 @@ filegroup(
- )
- 
- config_setting(
-+    name = "linux_ppc",
-+    values = {"cpu": "ppc"},
-+    visibility = ["//visibility:public"],
-+)
-+
-+config_setting(
-     name = "linux_x86_64",
-     values = {"cpu": "k8"},
-     visibility = ["//visibility:public"],
-diff --git a/third_party/BUILD b/third_party/BUILD
-index 159006d..b2c0163 100644
---- a/third_party/BUILD
-+++ b/third_party/BUILD
-@@ -526,6 +526,7 @@ UNNECESSARY_DYNAMIC_LIBRARIES = select({
-     # The .so file is an x86 one, so we can just remove it if the CPU is not x86
-     "//src/conditions:arm": "*.so *.jnilib *.dll",
-     "//src/conditions:linux_aarch64": "*.so *.jnilib *.dll",
-+    "//src/conditions:linux_ppc": "*.so *.jnilib *.dll",
-     # Play it safe -- better have a big binary than a slow binary
-     # zip -d does require an argument. Supply something bogus.
-     "//conditions:default": "*.bogusextension",
diff --git a/blackhat.spec b/blackhat.spec
index d02cbbfec2c..ad97de5ea72 100644
--- a/blackhat.spec
+++ b/blackhat.spec
@@ -3,7 +3,7 @@
 %define branch cms/v%{realversion}
 %define github_user cms-externals
 Source: git+https://github.com/%{github_user}/%{n}.git?obj=%{branch}/%{tag}&export=%{n}-%{realversion}&output=/%{n}-%{realversion}-%{tag}.tgz
-Requires: qd python openssl
+Requires: qd python
 
 %prep
 %setup -n %{n}-%{realversion}
@@ -16,7 +16,7 @@ rm -f ./config.{sub,guess}
 %get_config_guess ./config.guess
 chmod +x ./config.{sub,guess}
 
-./configure --prefix=%i --with-QDpath=$QD_ROOT CXXFLAGS="-Wno-deprecated -I$OPENSSL_ROOT/include" LDFLAGS="-L$OPENSSL_ROOT/lib"
+./configure --prefix=%i --with-QDpath=$QD_ROOT CXXFLAGS="-Wno-deprecated"
 # The following hack insures that the bins with the library linked explicitly
 # rather than indirectly, as required by the gold linker
 %build
diff --git a/cmssw-tool-conf.spec b/cmssw-tool-conf.spec
index fb3747d38ab..a2eef281cb4 100644
--- a/cmssw-tool-conf.spec
+++ b/cmssw-tool-conf.spec
@@ -21,7 +21,6 @@ Requires: cppunit-toolfile
 Requires: curl-toolfile
 Requires: das_client-toolfile
 Requires: db6-toolfile
-Requires: dpm-toolfile
 Requires: davix-toolfile
 Requires: evtgen-toolfile
 Requires: expat-toolfile
@@ -59,7 +58,6 @@ Requires: libungif-toolfile
 Requires: libxml2-toolfile
 Requires: lwtnn-toolfile
 Requires: meschach-toolfile
-Requires: openssl-toolfile
 Requires: pcre-toolfile
 Requires: photos-toolfile
 Requires: photospp-toolfile
@@ -121,7 +119,6 @@ Requires: mctester-toolfile
 Requires: vdt-toolfile
 Requires: icc-gcc-toolfile
 Requires: ccache-gcc-toolfile
-Requires: distcc-gcc-toolfile
 Requires: gnuplot-toolfile
 Requires: sloccount-toolfile
 Requires: millepede-toolfile
@@ -186,7 +183,6 @@ Requires: dmtcp-toolfile
 Requires: tkonlinesw-toolfile
 Requires: oracle-toolfile
 Requires: intel-vtune
-Requires: glibc-toolfile
 Requires: cmsmon-tools
 Requires: dip-toolfile
 %else
diff --git a/coral-tool-conf.spec b/coral-tool-conf.spec
index 7c2623cbfe6..a1164f5db60 100644
--- a/coral-tool-conf.spec
+++ b/coral-tool-conf.spec
@@ -7,7 +7,6 @@ Requires: expat-toolfile
 Requires: boost-toolfile
 Requires: frontier_client-toolfile
 Requires: gcc-toolfile
-Requires: openssl-toolfile
 
 Requires: sqlite-toolfile
 Requires: libuuid-toolfile
diff --git a/curl.spec b/curl.spec
index 98ca096a384..9ca2b26ab3b 100644
--- a/curl.spec
+++ b/curl.spec
@@ -1,6 +1,5 @@
 ### RPM external curl 7.70.0
 Source: http://curl.haxx.se/download/%{n}-%{realversion}.tar.gz
-Requires: openssl
 Requires: zlib
 
 %prep
@@ -19,7 +18,6 @@ esac
   --without-libidn \
   --disable-ldap \
   --with-zlib=${ZLIB_ROOT} \
-  --with-ssl=${OPENSSL_ROOT} \
   --without-nss \
   --without-libssh2 \
   --with-gssapi=${KERBEROS_ROOT}
diff --git a/davix-toolfile.spec b/davix-toolfile.spec
index dafbd35c6ea..fe5deb93f78 100644
--- a/davix-toolfile.spec
+++ b/davix-toolfile.spec
@@ -16,7 +16,6 @@ cat << \EOF_TOOLFILE > %i/etc/scram.d/davix.xml
     </client>
     <runtime name="PATH" value="$DAVIX_BASE/bin" type="path"/>
     <use name="boost_system"/>
-    <use name="openssl"/>
     <use name="libxml2"/>
   </tool>
 EOF_TOOLFILE
diff --git a/davix.spec b/davix.spec
index a582e3f2b54..107ca0c9f8e 100644
--- a/davix.spec
+++ b/davix.spec
@@ -11,7 +11,7 @@ Source0: git+https://github.com/%{github_user}/%{n}.git?obj=%{branch}/%{tag}&exp
 %endif
 
 BuildRequires: cmake gmake git
-Requires: openssl libxml2 libuuid
+Requires: libxml2 libuuid
 %prep
 %setup -n %{n}-%{realversion}
 
@@ -27,7 +27,6 @@ cmake -DCMAKE_INSTALL_PREFIX="%{i}" \
  -DLIBXML2_LIBRARY="${LIBXML2_ROOT}/lib/libxml2.%{soext}" \
  -DUUID_INCLUDE_DIR="${LIBUUID_ROOT}/include" \
  -DUUID_LIBRARY="${LIBUUID_ROOT}/lib64/libuuid.%{soext}" \
- -DOPENSSL_ROOT_DIR="${OPENSSL_ROOT}" \
  ../
 
 make VERBOSE=1 %{makeprocesses}
diff --git a/frontier_client-toolfile.spec b/frontier_client-toolfile.spec
index 44fc22270da..dc8175159c0 100644
--- a/frontier_client-toolfile.spec
+++ b/frontier_client-toolfile.spec
@@ -19,7 +19,6 @@ cat << \EOF_TOOLFILE >%i/etc/scram.d/frontier_client.xml
   <runtime name="ROOT_INCLUDE_PATH" value="$INCLUDE" type="path"/>
   <use name="root_cxxdefaults"/>
   <use name="zlib"/>
-  <use name="openssl"/>
   <use name="expat"/>
   <use name="python"/>
 </tool>
diff --git a/frontier_client.spec b/frontier_client.spec
index 490b9d11452..d61468bde9b 100644
--- a/frontier_client.spec
+++ b/frontier_client.spec
@@ -6,17 +6,17 @@
 %define branch cms/%{realversion}
 %define github_user cms-externals
 Source: git+https://github.com/%{github_user}/%{n}.git?obj=%{branch}/%{tag}&export=%{n}-%{realversion}&output=/%{n}-%{realversion}-%{tag}.tgz
-Requires: expat openssl pacparser python zlib
+Requires: expat pacparser python zlib
 
 %prep
 %setup -n %{n}-%{realversion}
 
-%define makeargs "EXPAT_DIR=${EXPAT_ROOT} PACPARSER_DIR=${PACPARSER_ROOT} COMPILER_TAG=gcc_$(gcc -dumpversion) ZLIB_DIR=${ZLIB_ROOT}  OPENSSL_DIR=${OPENSSL_ROOT}"
+%define makeargs "EXPAT_DIR=${EXPAT_ROOT} PACPARSER_DIR=${PACPARSER_ROOT} COMPILER_TAG=gcc_$(gcc -dumpversion) ZLIB_DIR=${ZLIB_ROOT}"
 
 %build
 
 export MAKE_ARGS=%{makeargs}
-make $MAKE_ARGS CXXFLAGS="-ldl" CFLAGS="-I${OPENSSL_ROOT}/include"
+make $MAKE_ARGS CXXFLAGS="-ldl" CFLAGS=""
 
 %install
 mkdir -p %i/lib
diff --git a/fwlite-tool-conf.spec b/fwlite-tool-conf.spec
index d038c156cf4..3579bd2e9cf 100644
--- a/fwlite-tool-conf.spec
+++ b/fwlite-tool-conf.spec
@@ -25,7 +25,6 @@ Requires: libjpeg-turbo-toolfile
 Requires: libpng-toolfile
 Requires: libtiff-toolfile
 Requires: libungif-toolfile
-Requires: openssl-toolfile
 Requires: pcre-toolfile
 Requires: python-toolfile
 Requires: root-toolfile
@@ -49,12 +48,6 @@ Requires: py2-pybind11-toolfile
 Requires: fwlite_python_tools
 Requires: zstd-toolfile
 
-%ifarch x86_64
-%ifos linux
-Requires: glibc-toolfile
-%endif
-%endif
-
 # Only for Darwin platform.
 %ifarch darwin
 Requires: freetype-toolfile
diff --git a/git.spec b/git.spec
index 84d88281505..ec79bca404e 100644
--- a/git.spec
+++ b/git.spec
@@ -9,7 +9,7 @@ Source0: https://github.com/git/git/archive/v%{realversion}.tar.gz
 Source1: https://raw.github.com/bagder/curl/curl-7_59_0/lib/mk-ca-bundle.pl
 Patch1: git-2.19.0-runtime
 
-Requires: curl expat openssl zlib pcre
+Requires: curl expat zlib pcre
 BuildRequires: autotools
 
 # Fake provides for git add --interactive
@@ -33,12 +33,11 @@ Provides: perl(Scalar::Util)
 %patch1 -p1
 
 %build
-export LDFLAGS="-L${OPENSSL_ROOT}/lib"
+export LDFLAGS=""
 export NO_LIBPCRE1_JIT=1
 make %{makeprocesses} configure
 ./configure prefix=%{i} \
    --with-curl=${CURL_ROOT} \
-   --with-openssl=${OPENSSL_ROOT} \
    --with-expat=${EXPAT_ROOT} \
    --with-libpcre=${PCRE_ROOT} \
    --without-python \
diff --git a/glibc-toolfile.spec b/glibc-toolfile.spec
deleted file mode 100644
index a810256a455..00000000000
--- a/glibc-toolfile.spec
+++ /dev/null
@@ -1,16 +0,0 @@
-### RPM external glibc-toolfile 1.0
-Requires: glibc
-
-%prep
-%build
-%install
-mkdir -p %{i}/etc/scram.d
-cat << \EOF_TOOLFILE > %{i}/etc/scram.d/glibc.xml
-  <tool name="glibc" version="@TOOL_VERSION@">
-    <info url="http://www.gnu.org/software/libc/libc.html"/>
-    <client>
-      <environment name="GLIBC_BASE" default="@TOOL_ROOT@"/>
-    </client>
-  </tool>
-EOF_TOOLFILE
-## IMPORT scram-tools-post
diff --git a/glibc.spec b/glibc.spec
deleted file mode 100644
index 00e57dfed07..00000000000
--- a/glibc.spec
+++ /dev/null
@@ -1,60 +0,0 @@
-### RPM external glibc 2.17-78.el7_2.12-1.166.el6_7.3
-## NOCOMPILER
-
-%define isslc6 %(case %{cmsplatf} in (slc6*) echo 1 ;; (*) echo 0 ;; esac)
-%define isslc7 %(case %{cmsplatf} in (slc7*) echo 1 ;; (*) echo 0 ;; esac)
-
-%if %isslc7
-%define realversion 2.17-78.el7
-%define tag ffca09a735586cbe44d9e330dc4c94ce18fa6aa3
-%endif
-
-%if %isslc6
-%define realversion 2.12-1.166.el6_7.3
-%define tag 2c052e03acb1795ac2c47f803b252ae85918e5ea
-%endif
-
-%global official_version %(echo "%{realversion}" | cut -d'-' -f1)
-
-%define branch cms/%{realversion}
-%define github_user cms-externals
-Source: git+https://github.com/%{github_user}/glibc.git?obj=%{branch}/%{tag}&export=%{n}-%{realversion}&output=/%{n}-%{realversion}.tgz
-
-%prep
-%setup -n %{n}-%{realversion}
-
-%build
-
-rm -rf ../%{n}-build
-mkdir ../%{n}-build
-cd ../%{n}-build
-../%{n}-%{realversion}/configure \
-  CC=gcc \
-  CXX=g++ \
-  CFLAGS='-mtune=generic -fasynchronous-unwind-tables -DNDEBUG -g -O3' \
-  --prefix=/usr \
-  --enable-add-ons=nptl,c_stubs,libidn \
-  --without-cvs \
-  --enable-kernel=2.6.18 \
-  --with-headers=/usr/include \
-  --enable-bind-now \
-  --with-tls \
-  --with-__thread \
-  --build=x86_64-redhat-linux \
-  --host=x86_64-redhat-linux \
-  --enable-multi-arch \
-  --disable-profile \
-  --enable-experimental-malloc
-
-make %{makeprocesses}
-
-%install
-cd ../%{n}-build
-make install install_root=%{i}
-
-# Remove everything except dynamic loader. All changes are contained
-# within the loader.
-find %{i} ! -type d | grep -Z -v 'ld-%{official_version}' | xargs rm -f
-find %{i} -empty -type d -delete
-
-mv %{i}/lib64/ld-%{official_version}.so %{i}/lib64/ld.so
diff --git a/openldap-toolfile.spec b/openldap-toolfile.spec
index f4d5b16a4b9..1bdeb55afc5 100644
--- a/openldap-toolfile.spec
+++ b/openldap-toolfile.spec
@@ -13,7 +13,6 @@ cat << \EOF_TOOLFILE >%i/etc/scram.d/openldap.xml
     <environment name="OPENLDAP_BASE" default="@TOOL_ROOT@"/>
     <environment name="LIBDIR" default="$OPENLDAP_BASE/lib"/>
   </client>
-  <use name="openssl"/>
   <use name="db6"/>
 </tool>
 EOF_TOOLFILE
diff --git a/openldap.spec b/openldap.spec
index d91f31f3c6e..140fadb59cf 100644
--- a/openldap.spec
+++ b/openldap.spec
@@ -1,7 +1,7 @@
 ### RPM external openldap 2.4.45
 ## INITENV +PATH LD_LIBRARY_PATH %i/lib
 Source: ftp://ftp.openldap.org/pub/OpenLDAP/%{n}-release/%{n}-%{realversion}.tgz
-Requires: openssl db6
+Requires: db6
 
 %prep
 %setup -q -n %{n}-%{realversion}
@@ -19,8 +19,8 @@ chmod +x ./build/config.{sub,guess}
   --with-tls=openssl \
   --disable-static \
   --disable-slapd \
-  CPPFLAGS="-I${OPENSSL_ROOT}/include -I${DB6_ROOT}/include" \
-  LDFLAGS="-L${OPENSSL_ROOT}/lib -L${DB6_ROOT}/lib"
+  CPPFLAGS="-I${DB6_ROOT}/include" \
+  LDFLAGS="-L${DB6_ROOT}/lib"
 make depend
 make
 
diff --git a/openssl-1.0.2d-disable-install-openssldir.patch b/openssl-1.0.2d-disable-install-openssldir.patch
deleted file mode 100644
index 28a98e5e0c0..00000000000
--- a/openssl-1.0.2d-disable-install-openssldir.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-diff --git a/apps/Makefile b/apps/Makefile
-index cafe554..547fc41 100644
---- a/apps/Makefile
-+++ b/apps/Makefile
-@@ -109,16 +109,6 @@ install:
- 	 chmod 755 $(INSTALL_PREFIX)$(INSTALLTOP)/bin/$$i.new; \
- 	 mv -f $(INSTALL_PREFIX)$(INSTALLTOP)/bin/$$i.new $(INSTALL_PREFIX)$(INSTALLTOP)/bin/$$i ); \
- 	 done;
--	@set -e; for i in $(SCRIPTS); \
--	do  \
--	(echo installing $$i; \
--	 cp $$i $(INSTALL_PREFIX)$(OPENSSLDIR)/misc/$$i.new; \
--	 chmod 755 $(INSTALL_PREFIX)$(OPENSSLDIR)/misc/$$i.new; \
--	 mv -f $(INSTALL_PREFIX)$(OPENSSLDIR)/misc/$$i.new $(INSTALL_PREFIX)$(OPENSSLDIR)/misc/$$i ); \
--	 done
--	@cp openssl.cnf $(INSTALL_PREFIX)$(OPENSSLDIR)/openssl.cnf.new; \
--	chmod 644 $(INSTALL_PREFIX)$(OPENSSLDIR)/openssl.cnf.new; \
--	mv -f  $(INSTALL_PREFIX)$(OPENSSLDIR)/openssl.cnf.new $(INSTALL_PREFIX)$(OPENSSLDIR)/openssl.cnf
- 
- tags:
- 	ctags $(SRC)
-diff --git a/tools/Makefile b/tools/Makefile
-index c1a2f6b..6e7c104 100644
---- a/tools/Makefile
-+++ b/tools/Makefile
-@@ -26,12 +26,6 @@ install:
- 	chmod 755 $(INSTALL_PREFIX)$(INSTALLTOP)/bin/$$i.new; \
- 	mv -f $(INSTALL_PREFIX)$(INSTALLTOP)/bin/$$i.new $(INSTALL_PREFIX)$(INSTALLTOP)/bin/$$i ); \
- 	done;
--	@for i in $(MISC_APPS) ; \
--	do  \
--	(cp $$i $(INSTALL_PREFIX)$(OPENSSLDIR)/misc/$$i.new; \
--	chmod 755 $(INSTALL_PREFIX)$(OPENSSLDIR)/misc/$$i.new; \
--	mv -f $(INSTALL_PREFIX)$(OPENSSLDIR)/misc/$$i.new $(INSTALL_PREFIX)$(OPENSSLDIR)/misc/$$i ); \
--	done;
- 
- files:
- 	$(PERL) $(TOP)/util/files.pl Makefile >> $(TOP)/MINFO
diff --git a/openssl-1.0.2d-pr3979.patch b/openssl-1.0.2d-pr3979.patch
deleted file mode 100644
index 7c313645157..00000000000
--- a/openssl-1.0.2d-pr3979.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-diff --git a/crypto/x509v3/v3_purp.c b/crypto/x509v3/v3_purp.c
-index 36b0d87..845be67 100644
---- a/crypto/x509v3/v3_purp.c
-+++ b/crypto/x509v3/v3_purp.c
-@@ -380,6 +380,14 @@ static void setup_crldp(X509 *x)
-         setup_dp(x, sk_DIST_POINT_value(x->crldp, i));
- }
- 
-+#define V1_ROOT (EXFLAG_V1|EXFLAG_SS)
-+#define ku_reject(x, usage) \
-+        (((x)->ex_flags & EXFLAG_KUSAGE) && !((x)->ex_kusage & (usage)))
-+#define xku_reject(x, usage) \
-+        (((x)->ex_flags & EXFLAG_XKUSAGE) && !((x)->ex_xkusage & (usage)))
-+#define ns_reject(x, usage) \
-+        (((x)->ex_flags & EXFLAG_NSCERT) && !((x)->ex_nscert & (usage)))
-+
- static void x509v3_cache_extensions(X509 *x)
- {
-     BASIC_CONSTRAINTS *bs;
-@@ -499,7 +507,8 @@ static void x509v3_cache_extensions(X509 *x)
-     if (!X509_NAME_cmp(X509_get_subject_name(x), X509_get_issuer_name(x))) {
-         x->ex_flags |= EXFLAG_SI;
-         /* If SKID matches AKID also indicate self signed */
--        if (X509_check_akid(x, x->akid) == X509_V_OK)
-+        if (X509_check_akid(x, x->akid) == X509_V_OK &&
-+            !ku_reject(x, KU_KEY_CERT_SIGN))
-             x->ex_flags |= EXFLAG_SS;
-     }
-     x->altname = X509_get_ext_d2i(x, NID_subject_alt_name, NULL, NULL);
-@@ -538,14 +547,6 @@ static void x509v3_cache_extensions(X509 *x)
-  * 4 basicConstraints absent but keyUsage present and keyCertSign asserted.
-  */
- 
--#define V1_ROOT (EXFLAG_V1|EXFLAG_SS)
--#define ku_reject(x, usage) \
--        (((x)->ex_flags & EXFLAG_KUSAGE) && !((x)->ex_kusage & (usage)))
--#define xku_reject(x, usage) \
--        (((x)->ex_flags & EXFLAG_XKUSAGE) && !((x)->ex_xkusage & (usage)))
--#define ns_reject(x, usage) \
--        (((x)->ex_flags & EXFLAG_NSCERT) && !((x)->ex_nscert & (usage)))
--
- static int check_ca(const X509 *x)
- {
-     /* keyUsage if present should allow cert signing */
diff --git a/openssl-toolfile.spec b/openssl-toolfile.spec
deleted file mode 100644
index f0a78ba8a49..00000000000
--- a/openssl-toolfile.spec
+++ /dev/null
@@ -1,24 +0,0 @@
-### RPM external openssl-toolfile 1.0
-Requires: openssl
-%prep
-
-%build
-
-%install
-
-mkdir -p %i/etc/scram.d
-cat << \EOF_TOOLFILE >%i/etc/scram.d/openssl.xml
-  <tool name="openssl" version="@TOOL_VERSION@">
-    <lib name="ssl"/>
-    <lib name="crypto"/>
-    <client>
-      <environment name="OPENSSL_BASE" default="@TOOL_ROOT@"/>
-      <environment name="INCLUDE" default="$OPENSSL_BASE/include"/>
-      <environment name="LIBDIR" default="$OPENSSL_BASE/lib"/>
-    </client>
-    <runtime name="ROOT_INCLUDE_PATH" value="$INCLUDE" type="path"/>
-    <use name="root_cxxdefaults"/>
-  </tool>
-EOF_TOOLFILE
-
-## IMPORT scram-tools-post
diff --git a/openssl.spec b/openssl.spec
deleted file mode 100644
index 5822408bdbc..00000000000
--- a/openssl.spec
+++ /dev/null
@@ -1,96 +0,0 @@
-### RPM external openssl 1.0.2d
-Source0: http://davidlt.web.cern.ch/davidlt/vault/openssl-1.0.2d-5675d07a144aa1a6c85f488a95aeea7854e86059.tar.bz2
-
-# https://rt.openssl.org/Ticket/Display.html?id=3979&user=guest&pass=guest
-Patch0: openssl-1.0.2d-pr3979
-# We want to pick CA certificates from /etc/pki/tls (openssldir), but we
-# cannot install to a standard system location
-Patch1: openssl-1.0.2d-disable-install-openssldir
-
-%prep
-%setup -b 0 -n openssl-%{realversion}
-%patch0 -p1
-%patch1 -p1
-
-# Disable documenation
-sed -ibak 's/install: all install_docs install_sw/install: all install_sw/g' Makefile.org Makefile
-
-case "%{cmsplatf}" in
-  slc6*)
-    # https://sourceware.org/glibc/wiki/Tips_and_Tricks/secure_getenv
-    grep -H -R 'secure_getenv(' * | cut -d':' -f1 | sort -u | xargs -t -n 1 sed -ibak 's;secure_getenv;__secure_getenv;g'
-    ;;
-esac
-
-%build
-
-case "%{cmsplatf}" in
-  slc6_amd64_*)
-    RPM_OPT_FLAGS="-O2 -fPIC -g -pipe -Wall -Wa,--noexecstack -fno-strict-aliasing \
-                   -Wp,-DOPENSSL_USE_NEW_FUNCTIONS -Wp,-D_FORTIFY_SOURCE=2 -fexceptions \
-                   -fstack-protector --param=ssp-buffer-size=4 -mtune=generic"
-    ;;
-  *_aarch64_*|fc*)
-    RPM_OPT_FLAGS="$RPM_OPT_FLAGS -Wa,--noexecstack -DPURIFY"
-    ;;
-esac
-
-case "%{cmsplatf}" in
-  osx*)         target=darwin64-x86_64-cc ;;
-  *_aarch64_*)  target=linux-aarch64 ;;
-  *_ppc64le_*)  target=linux-ppc64le ;;
-  *_ppc64_*)    target=linux-ppc64 ;;
-  *_amd64_*)    target=linux-x86_64 ;;
-  *)            target=linux-generic64 ;;
-esac
-
-case "%{cmsplatf}" in
-  osx*)
-    cfg_args="-DOPENSSL_USE_NEW_FUNCTIONS"
-    ;;
-    *)
-    cfg_args="--with-krb5-flavor=MIT --with-krb5-dir=/usr enable-krb5 no-zlib --openssldir=/etc/pki/tls fips no-ec2m no-gost no-srp"
-    ;;
-esac
-
-export RPM_OPT_FLAGS
-
-perl ./Configure ${target} ${cfg_args} enable-seed enable-tlsext enable-rfc3779 no-asm \
-                 no-idea no-mdc2 no-rc5 shared --prefix=%{i}
-
-case "%{cmsplatf}" in
-  *_aarch64_*|fc*|osx*)
-    make depend
-    ;;
-esac
-
-make all
-
-%install
-case "%{cmsplatf}" in
-  slc*_amd64_*)
-    RPM_OPT_FLAGS="-O2 -fPIC -g -pipe -Wall -Wa,--noexecstack -fno-strict-aliasing \
-                   -Wp,-DOPENSSL_USE_NEW_FUNCTIONS -Wp,-D_FORTIFY_SOURCE=2 -fexceptions \
-                   -fstack-protector --param=ssp-buffer-size=4 -mtune=generic"
-    ;;
-  *_aarch64_*|fc*)
-    RPM_OPT_FLAGS="$RPM_OPT_FLAGS -Wa,--noexecstack -DPURIFY"
-    ;;
-esac
-
-export RPM_OPT_FLAGS
-
-make install
-
-rm -rf %{i}/lib/pkgconfig
-# We remove archive libraries because otherwise we need to propagate everywhere
-# their dependency on kerberos.
-rm -rf %{i}/lib/*.a
-
-sed -ideleteme -e 's;^#!.*perl;#!/usr/bin/env perl;' \
-  %{i}/bin/c_rehash
-find %{i} -name '*deleteme' -type f -print0 | xargs -0 rm -f
-
-%post
-%{relocateConfig}bin/c_rehash
-%{relocateConfig}include/openssl/opensslconf.h
diff --git a/pip/cryptography.file b/pip/cryptography.file
index bc07aa4a769..3787b55b337 100644
--- a/pip/cryptography.file
+++ b/pip/cryptography.file
@@ -1,3 +1 @@
-Requires: openssl py2-cffi py2-asn1crypto py2-enum34 py2-idna py2-ipaddress py2-six py2-wheel
-%define PipPreBuild export LDFLAGS="-L${OPENSSL_ROOT}/lib"; \
-                    export CFLAGS="-I${OPENSSL_ROOT}/include"
+Requires: py2-cffi py2-asn1crypto py2-enum34 py2-idna py2-ipaddress py2-six py2-wheel
diff --git a/pip/pycurl.file b/pip/pycurl.file
index d5f0bd67d79..e9a0cb6b729 100644
--- a/pip/pycurl.file
+++ b/pip/pycurl.file
@@ -1,5 +1,4 @@
-%define PipBuildOptions --global-option="--with-openssl" --global-option="--openssl-dir=${OPENSSL_ROOT}" 
 %define pip_name pycurl
 %define PipPreBuild export PYCURL_SSL_LIBRARY=openssl
 
-Requires: curl openssl
+Requires: curl
diff --git a/pip/python-ldap.file b/pip/python-ldap.file
index fec850ea94e..3fc6cda8d3e 100644
--- a/pip/python-ldap.file
+++ b/pip/python-ldap.file
@@ -1,2 +1,2 @@
-Requires: python openssl openldap py2-pyasn1-modules
-%define PipBuildOptions --global-option=build_ext --global-option="-L${OPENSSL_ROOT}/lib" --global-option="-L${PYTHON_ROOT}/lib" --global-option="-L${OPENLDAP_ROOT}/lib"  --global-option="-I${OPENSSL_ROOT}/include" --global-option="-I${PYTHON_ROOT}/include" --global-option="-I${OPENLDAP_ROOT}/include"  --global-option="-UHAVE_SASL"
+Requires: python openldap py2-pyasn1-modules
+%define PipBuildOptions --global-option=build_ext --global-option="-L${PYTHON_ROOT}/lib" --global-option="-L${OPENLDAP_ROOT}/lib" --global-option="-I${PYTHON_ROOT}/include" --global-option="-I${OPENLDAP_ROOT}/include"  --global-option="-UHAVE_SASL"
diff --git a/python.spec b/python.spec
index d7769065b8b..1ff1f61e7db 100644
--- a/python.spec
+++ b/python.spec
@@ -5,8 +5,7 @@
 ## INITENV SETV PYTHONHASHSEED random
 # OS X patches and build fudging stolen from fink
 %{expand:%%define python_major_version %(echo %realversion | cut -d. -f1,2)}
-
-Requires: expat bz2lib db6 gdbm openssl libffi
+Requires: expat bz2lib db6 gdbm libffi
 Requires: zlib sqlite
 
 # FIXME: readline, crypt 
@@ -50,7 +49,7 @@ done
 
 mkdir -p %{i}/{include,lib,bin}
 
-dirs="${EXPAT_ROOT} ${BZ2LIB_ROOT} ${DB6_ROOT} ${GDBM_ROOT} ${OPENSSL_ROOT} ${LIBFFI_ROOT} ${ZLIB_ROOT} ${SQLITE_ROOT}"
+dirs="${EXPAT_ROOT} ${BZ2LIB_ROOT} ${DB6_ROOT} ${GDBM_ROOT} ${LIBFFI_ROOT} ${ZLIB_ROOT} ${SQLITE_ROOT}"
 
 # We need to export it because setup.py now uses it to determine the actual
 # location of DB4, this was needed to avoid having it picked up from the system.
diff --git a/python3.spec b/python3.spec
index 25d335dda56..76496ec02d0 100644
--- a/python3.spec
+++ b/python3.spec
@@ -6,8 +6,7 @@
 # OS X patches and build fudging stolen from fink
 %define pythonv %(echo %realversion | cut -d. -f 1,2)
 %define python_major %(echo %realversion | cut -d. -f 1)
-
-Requires: expat bz2lib db6 gdbm openssl libffi zlib sqlite xz libuuid
+Requires: expat bz2lib db6 gdbm libffi zlib sqlite xz libuuid
 
 Source: https://www.python.org/ftp/python/%realversion/Python-%realversion.tgz
 
@@ -25,7 +24,7 @@ export LIBFFI_ROOT
 # Python's configure parses LDFLAGS and CPPFLAGS to look for aditional library and include directories
 LDFLAGS=""
 CPPFLAGS=""
-for d in ${EXPAT_ROOT} ${BZ2LIB_ROOT} ${DB6_ROOT} ${GDBM_ROOT} ${OPENSSL_ROOT} ${LIBFFI_ROOT} ${ZLIB_ROOT} ${SQLITE_ROOT} ${XZ_ROOT} ${LIBUUID_ROOT}; do
+for d in ${EXPAT_ROOT} ${BZ2LIB_ROOT} ${DB6_ROOT} ${GDBM_ROOT} ${LIBFFI_ROOT} ${ZLIB_ROOT} ${SQLITE_ROOT} ${LIBUUID_ROOT} ${XZ_ROOT}; do
   [ -e $d/lib ]     && LDFLAGS="$LDFLAGS -L$d/lib"
   [ -e $d/lib64 ]   && LDFLAGS="$LDFLAGS -L$d/lib64"
   [ -e $d/include ] && CPPFLAGS="$CPPFLAGS -I$d/include"
@@ -35,7 +34,6 @@ done
   --prefix=%{i} \
   --enable-shared \
   --enable-ipv6 \
-  --with-openssl=${OPENSSL_ROOT} \
   --with-system-ffi \
   --without-ensurepip \
   --with-system-expat \
diff --git a/root.spec b/root.spec
index 956d0b5ceae..3b4886a291f 100644
--- a/root.spec
+++ b/root.spec
@@ -9,19 +9,16 @@
 %define github_user cms-sw
 Source: git+https://github.com/%{github_user}/root.git?obj=%{branch}/%{tag}&export=%{n}-%{realversion}&output=/%{n}-%{realversion}-%{tag}.tgz
 
-%define islinux %(case %{cmsos} in (slc*|fc*) echo 1 ;; (*) echo 0 ;; esac)
-%define isdarwin %(case %{cmsos} in (osx*) echo 1 ;; (*) echo 0 ;; esac)
-
 BuildRequires: cmake ninja
 
-Requires: gsl libjpeg-turbo libpng libtiff giflib pcre python python3 fftw3 xz xrootd libxml2 openssl zlib davix tbb OpenBLAS py2-numpy py3-numpy lz4 freetype zstd
+Requires: gsl libjpeg-turbo libpng libtiff giflib pcre python python3 fftw3 xz xrootd libxml2 zlib davix tbb OpenBLAS py2-numpy py3-numpy lz4 freetype zstd
 
-%if %islinux
+%ifos linux
 Requires: dcap
 %endif
 
 %define soext so
-%if %isdarwin
+%ifarch darwin
 %define soext dylib
 %endif
 
@@ -91,14 +88,12 @@ cmake ../%{n}-%{realversion} \
   -DGSL_CBLAS_LIBRARY_DEBUG="${OPENBLAS_ROOT}/lib/libopenblas.%{soext}" \
   -DCMAKE_CXX_STANDARD=17 \
   -Dssl=ON \
-  -DOPENSSL_ROOT_DIR="${OPENSSL_ROOT}" \
-  -DOPENSSL_INCLUDE_DIR="${OPENSSL_ROOT}/include" \
   -Dpyroot=ON \
   -Dxrootd=ON \
   -Dbuiltin_xrootd=OFF \
   -DXROOTD_INCLUDE_DIR="${XROOTD_ROOT}/include/xrootd" \
   -DXROOTD_ROOT_DIR="${XROOTD_ROOT}" \
-%if %islinux
+%ifos linux
   -Drfio=OFF \
   -Dcastor=OFF \
   -Ddcache=ON \
@@ -121,7 +116,8 @@ cmake ../%{n}-%{realversion} \
   -Dsapdb=OFF \
   -Dalien=OFF \
   -Dmonalisa=OFF \
-%if %isdarwin
+%ifarch darwin
+  -Dbuiltin_afterimage=OFF \
   -Dcocoa=OFF \
   -Dx11=ON \
   -Dcastor=OFF \
@@ -142,7 +138,7 @@ cmake ../%{n}-%{realversion} \
   -DZLIB_ROOT="${ZLIB_ROOT}" \
   -DZLIB_INCLUDE_DIR="${ZLIB_ROOT}/include" \
   -DZSTD_ROOT="${ZSTD_ROOT}" \
-  -DCMAKE_PREFIX_PATH="${LZ4_ROOT};${GSL_ROOT};${XZ_ROOT};${OPENSSL_ROOT};${GIFLIB_ROOT};${FREETYPE_ROOT};${PYTHON_ROOT};${PYTHON3_ROOT};${LIBPNG_ROOT};${PCRE_ROOT};${TBB_ROOT};${OPENBLAS_ROOT};${DAVIX_ROOT};${LIBXML2_ROOT};${ZSTD_ROOT}"
+  -DCMAKE_PREFIX_PATH="${LZ4_ROOT};${GSL_ROOT};${XZ_ROOT};${GIFLIB_ROOT};${FREETYPE_ROOT};${PYTHON_ROOT};${PYTHON3_ROOT};${LIBPNG_ROOT};${PCRE_ROOT};${TBB_ROOT};${OPENBLAS_ROOT};${DAVIX_ROOT};${LIBXML2_ROOT};${ZSTD_ROOT}"
 
 # For CMake cache variables: http://www.cmake.org/cmake/help/v3.2/manual/cmake-language.7.html#lists
 # For environment variables it's OS specific: http://www.cmake.org/Wiki/CMake_Useful_Variables
diff --git a/scram-project-build.file b/scram-project-build.file
index d0dae55152c..02bb4ea1bdb 100644
--- a/scram-project-build.file
+++ b/scram-project-build.file
@@ -2,10 +2,7 @@
 ## NO_AUTO_DEPENDENCY
 # FIXME: support building all platforms together like scram does?
 # FIXME: automatic sub-packages for "doc" etc?
-%define mic %(case %cmsplatf in (*_mic_*) echo true;; (*) echo false;; esac)
 %define cmssw_libs biglib/%{cmsplatf} lib/%{cmsplatf}
-%define islinux %(case $(uname -s) in (Linux) echo 1 ;; (*) echo 0 ;; esac)
-%define isslc6_amd64 %(case %{cmsplatf} in (slc6_amd64_*) echo 1 ;; (*) echo 0 ;; esac)
 %define scram_home_suffix %(echo %{directpkgreqs} | grep -q /SCRAMV1/V2_ && echo /src || true)
 %define scram_script_prefix %(echo %{directpkgreqs} | grep -q /SCRAMV1/V2_ && echo .pl || echo .py)
 %if "%{?pkgname}" != "coral"
@@ -19,19 +16,12 @@ BuildRequires: gcc
 
 # For non-linux archs disable subpackageDebug otherwise add dwz.file build dependencies.
 %if "%{?subpackageDebug:set}" == "set"
-%if %islinux
+%ifos linux
 BuildRequires: dwz
 %else
 %undefine subpackageDebug
-%endif # islinux
-%endif # subpackageDebug
-
-%if %isslc6_amd64
-%if "%{?pkgname}" != "coral"
-Requires: patchelf
-Requires: glibc
-%endif # coral
-%endif # isslc6_amd64
+%endif
+%endif
 
 %define initenv	        %initenv_direct
 %define scramcmd        $SCRAMV1_ROOT/bin/scram --arch %cmsplatf
@@ -46,12 +36,8 @@ Requires: glibc
 %endif
 
 %if "%{?scram_compiler:set}" != "set"
-%if "%mic" == "true"
-%define scram_compiler          icc
-%else
 %define scram_compiler          gcc
 %endif
-%endif
 
 %define bootstrapfile   config/bootsrc.xml
 
@@ -343,19 +329,6 @@ done
 %{?PartialReleaseFilesRelocate:%PartialReleaseFilesRelocate}
 [ -f $RPM_INSTALL_PREFIX/etc/scramrc/%{pkgname}.map ] || (mkdir -p $RPM_INSTALL_PREFIX/etc/scramrc && echo '%{ucprojtype}=$SCRAM_ARCH/%{pkgcategory}/%{pkgname}/%{ucprojtype}_*' > $RPM_INSTALL_PREFIX/etc/scramrc/%{pkgname}.map)
 
-%if "%{?pkgname}" != "coral"
-case %cmsplatf in
-  slc6_amd64_*)
-    PATCHELF_PKG=$(echo "%{directpkgreqs}" | tr ' ' '\n' | grep 'external/patchelf/')
-    PATCHELF_PATH=$RPM_INSTALL_PREFIX/%cmsplatf/$PATCHELF_PKG
-    CMSSW_BIN_PATH="$RPM_INSTALL_PREFIX/%pkgrel/bin/%cmsplatf $RPM_INSTALL_PREFIX/%pkgrel/test/%cmsplatf"
-    CMSSW_ELF_BIN=$(find $CMSSW_BIN_PATH -type f -exec file {} \; | grep ELF | cut -d':' -f1)
-    GLIBC_PKG=$(echo "%{directpkgreqs}" | tr ' ' '\n' | grep 'external/glibc/')
-    GLIBC_PATH=$CMS_INSTALL_PREFIX/%cmsplatf/$GLIBC_PKG
-    echo "$CMSSW_ELF_BIN" | xargs -t -n 1 -I% -P $(getconf _NPROCESSORS_ONLN) sh -c "strings % 2>&1 | grep '%{cmsplatf}/external/glibc' 2>&1 >/dev/null && $PATCHELF_PATH/bin/patchelf --set-interpreter $GLIBC_PATH/lib64/ld.so % || true"
-esac
-%endif # coral
-
 %if "%{?runGlimpse:set}" == "set"
   %{relocateConfig}.glimpse_full/.glimpse_filenames
 %endif
diff --git a/sherpa.spec b/sherpa.spec
index 71bc23af7a7..63754c02b36 100644
--- a/sherpa.spec
+++ b/sherpa.spec
@@ -3,7 +3,7 @@
 %define branch cms/v%realversion
 %define github_user cms-externals
 Source: http://www.hepforge.org/archive/sherpa/SHERPA-MC-%{realversion}.tar.gz
-Requires: hepmc lhapdf blackhat sqlite fastjet openssl scons python openmpi rivet
+Requires: hepmc lhapdf blackhat sqlite fastjet scons python openmpi rivet
 BuildRequires: mcfm swig autotools
 Patch0: sherpa-2.2.10-hepmcshort
 
@@ -50,8 +50,8 @@ esac
             CXX="mpicxx" \
             MPICXX="mpicxx" \
             FC="mpifort" \
-            CXXFLAGS="-fuse-cxa-atexit $ARCH_CMSPLATF -O2 -std=c++0x -I$LHAPDF_ROOT/include -I$BLACKHAT_ROOT/include -I$OPENSSL_ROOT/include -I$RIVET_ROOT/include" \
-            LDFLAGS="-ldl -L$BLACKHAT_ROOT/lib/blackhat -L$QD_ROOT/lib -L$OPENSSL_ROOT/lib"
+            CXXFLAGS="-fuse-cxa-atexit $ARCH_CMSPLATF -O2 -std=c++0x -I$LHAPDF_ROOT/include -I$BLACKHAT_ROOT/include -I$RIVET_ROOT/include" \
+            LDFLAGS="-ldl -L$BLACKHAT_ROOT/lib/blackhat -L$QD_ROOT/lib"
 
 make %{makeprocesses}
 
diff --git a/systemtools.spec b/systemtools.spec
index f48d583d718..a213d6ddcb8 100644
--- a/systemtools.spec
+++ b/systemtools.spec
@@ -24,6 +24,14 @@ Source: none
 %install
 # SCRAM ToolBox toolfile
 mkdir -p %i/etc/scram.d
+#OpenSSL
+cat << \EOF_TOOLFILE >%i/etc/scram.d/openssl.xml
+  <tool name="openssl" version="system">
+    <lib name="ssl"/>
+    <lib name="crypto"/>
+  </tool>
+EOF_TOOLFILE
+
 # Sockets
 cat << \EOF_TOOLFILE >%i/etc/scram.d/sockets.xml
   <tool name="sockets" version="%sockets_version">
diff --git a/triton-inference-server.spec b/triton-inference-server.spec
index cbb13dcb714..74b5d99b5b8 100644
--- a/triton-inference-server.spec
+++ b/triton-inference-server.spec
@@ -4,7 +4,7 @@
 
 Source: git+https://github.com/%{github_user}/server.git?obj=%{branch}/v%{realversion}&export=%{n}-%{realversion}&output=/%{n}-%{realversion}.tgz
 BuildRequires: cmake
-Requires: openssl opencv protobuf grpc curl python py2-wheel py2-setuptools py2-grpcio-tools python3
+Requires: opencv protobuf grpc curl python py2-wheel py2-setuptools py2-grpcio-tools python3
 
 %prep
 
@@ -44,7 +44,6 @@ cmake ../%{n}-%{realversion}/build/client \
     -DTRITON_ENABLE_GRPC=ON \
     -DTRITON_VERSION=%{realversion} \
     -DZLIB_ROOT=${ZLIB_ROOT} \
-    -DOPENSSL_ROOT_DIR=${OPENSSL_ROOT} \
     -DCMAKE_CXX_FLAGS="-Wno-error" \
     -DCMAKE_PREFIX_PATH="${ZLIB_ROOT}"
 
diff --git a/xrootd.spec b/xrootd.spec
index 984ebb22bb8..6a8cd468333 100644
--- a/xrootd.spec
+++ b/xrootd.spec
@@ -10,7 +10,6 @@ Source: git+https://github.com/%github_user/xrootd.git?obj=%{branch}/%{tag}&expo
 
 BuildRequires: cmake
 Requires: zlib
-Requires: openssl
 Requires: python python3
 Requires: libxml2
 
@@ -31,7 +30,6 @@ perl -p -i -e 's|^#!.*perl(.*)|#!/usr/bin/env perl$1|' src/XrdMon/xrdmonPrepareS
 
 CMAKE_ARGS="-DCMAKE_INSTALL_PREFIX=%{i} \
   -DCMAKE_BUILD_TYPE=Release \
-  -DOPENSSL_ROOT_DIR:PATH=${OPENSSL_ROOT} \
   -DZLIB_ROOT:PATH=${ZLIB_ROOT} \
   -DENABLE_PYTHON=FALSE \
   -DENABLE_FUSE=FALSE \