Index: Makefile.in
==================================================================
--- Makefile.in
+++ Makefile.in
@@ -53,11 +53,11 @@
 	rm -f cackey.o cackey_g.o
 	rm -f test
 	rm -f splint-cackey.txt
 
 distclean: clean
-	rm -f config.log config.status config.h Makefile
+	rm -f config.log config.status config.h Makefile libcackey.syms
 
 mrproper: distclean
 	rm -f configure config.h.in aclocal.m4 *~
 
 .PHONY: all clean distclean mrproper install

Index: aclocal/dc_versionscript.m4
==================================================================
--- aclocal/dc_versionscript.m4
+++ aclocal/dc_versionscript.m4
@@ -1,20 +1,32 @@
 AC_DEFUN(DC_SETVERSIONSCRIPT, [
 	VERSIONSCRIPT="$1"
+	SYMFILE="$2"
+
+	delete_symfile='0'
+	if test ! -f "${SYMFILE}"; then
+		delete_symfile='1'
+
+		echo '' > "${SYMFILE}"
+	fi
 
 	SAVE_LDFLAGS="${LDFLAGS}"
 
 	AC_MSG_CHECKING([for how to set version script])
 
-	for tryaddldflags in "-Wl,--version-script -Wl,${VERSIONSCRIPT}"; do
+	for tryaddldflags in "-Wl,--version-script -Wl,${VERSIONSCRIPT}" "-Wl,-exported_symbols_list -Wl,${SYMFILE}"; do
 		LDFLAGS="${SAVE_LDFLAGS} ${tryaddldflags}"
 		AC_TRY_LINK([], [], [
 			addldflags="${tryaddldflags}"
 
 			break
 		])
 	done
+
+	if test "${delete_symfile}" = "1"; then
+		rm -f "${SYMFILE}"
+	fi
 
 	if test -n "${addldflags}"; then
 		LDFLAGS="${SAVE_LDFLAGS} ${addldflags}"
 		AC_MSG_RESULT($addldflags)
 	else
@@ -34,14 +46,16 @@
 		STRIP="${OBJCOPY}"
 	fi
 
 	WEAKENSYMS='true'
 	REMOVESYMS='true'
+	SYMPREFIX=''
 
 	case $host_os in
 		darwin*)
-			REMOVESYMS="${STRIP} -s ${SYMFILE}"
+			REMOVESYMS="${STRIP} -i -u -s ${SYMFILE}"
+			SYMPREFIX="_"
 			;;
 		*)
 			if test "x${OBJCOPY}" != "xfalse"; then
 				WEAKENSYMS="${OBJCOPY} --keep-global-symbols=${SYMFILE}"
 				REMOVESYMS="${OBJCOPY} --discard-all"
@@ -51,6 +65,7 @@
 			;;
 	esac
 
 	AC_SUBST(WEAKENSYMS)
 	AC_SUBST(REMOVESYMS)
+	AC_SUBST(SYMPREFIX)
 ])

Index: configure.ac
==================================================================
--- configure.ac
+++ configure.ac
@@ -141,15 +141,15 @@
 		AC_MSG_FAILURE([simple PC/SC program failed])
 	]
 )
 
 dnl Set version script, to limit the scope of symbols
-DC_SETVERSIONSCRIPT(libcackey.vers)
+DC_SETVERSIONSCRIPT(libcackey.vers, libcackey.syms)
 
 dnl Upate LDFLAGS to include setting the run-time linker path to the same as our compile-time linker
 DC_SYNC_RPATH
 
 dnl If we updated LIBOBJS, update SHLIBOBJS -- must be last.
 DC_SYNC_SHLIBOBJS
 
 dnl Produce Makefile
-AC_OUTPUT(Makefile)
+AC_OUTPUT(Makefile libcackey.syms)

DELETED libcackey.syms
Index: libcackey.syms
==================================================================
--- libcackey.syms
+++ /dev/null
@@ -1,68 +0,0 @@
-C_CancelFunction
-C_CloseAllSessions
-C_CloseSession
-C_CopyObject
-C_CreateObject
-C_Decrypt
-C_DecryptDigestUpdate
-C_DecryptFinal
-C_DecryptInit
-C_DecryptUpdate
-C_DecryptVerifyUpdate
-C_DeriveKey
-C_DestroyObject
-C_Digest
-C_DigestEncryptUpdate
-C_DigestFinal
-C_DigestInit
-C_DigestKey
-C_DigestUpdate
-C_Encrypt
-C_EncryptFinal
-C_EncryptInit
-C_EncryptUpdate
-C_Finalize
-C_FindObjects
-C_FindObjectsFinal
-C_FindObjectsInit
-C_GenerateKey
-C_GenerateKeyPair
-C_GenerateRandom
-C_GetAttributeValue
-C_GetFunctionList
-C_GetFunctionStatus
-C_GetInfo
-C_GetMechanismInfo
-C_GetMechanismList
-C_GetObjectSize
-C_GetOperationState
-C_GetSessionInfo
-C_GetSlotInfo
-C_GetSlotList
-C_GetTokenInfo
-C_InitPIN
-C_InitToken
-C_Initialize
-C_Login
-C_Logout
-C_OpenSession
-C_SeedRandom
-C_SetAttributeValue
-C_SetOperationState
-C_SetPIN
-C_Sign
-C_SignEncryptUpdate
-C_SignFinal
-C_SignInit
-C_SignRecover
-C_SignRecoverInit
-C_SignUpdate
-C_UnwrapKey
-C_Verify
-C_VerifyFinal
-C_VerifyInit
-C_VerifyRecover
-C_VerifyRecoverInit
-C_VerifyUpdate
-C_WaitForSlotEvent
-C_WrapKey

ADDED   libcackey.syms.in
Index: libcackey.syms.in
==================================================================
--- /dev/null
+++ libcackey.syms.in
@@ -0,0 +1,68 @@
+@SYMPREFIX@C_CancelFunction
+@SYMPREFIX@C_CloseAllSessions
+@SYMPREFIX@C_CloseSession
+@SYMPREFIX@C_CopyObject
+@SYMPREFIX@C_CreateObject
+@SYMPREFIX@C_Decrypt
+@SYMPREFIX@C_DecryptDigestUpdate
+@SYMPREFIX@C_DecryptFinal
+@SYMPREFIX@C_DecryptInit
+@SYMPREFIX@C_DecryptUpdate
+@SYMPREFIX@C_DecryptVerifyUpdate
+@SYMPREFIX@C_DeriveKey
+@SYMPREFIX@C_DestroyObject
+@SYMPREFIX@C_Digest
+@SYMPREFIX@C_DigestEncryptUpdate
+@SYMPREFIX@C_DigestFinal
+@SYMPREFIX@C_DigestInit
+@SYMPREFIX@C_DigestKey
+@SYMPREFIX@C_DigestUpdate
+@SYMPREFIX@C_Encrypt
+@SYMPREFIX@C_EncryptFinal
+@SYMPREFIX@C_EncryptInit
+@SYMPREFIX@C_EncryptUpdate
+@SYMPREFIX@C_Finalize
+@SYMPREFIX@C_FindObjects
+@SYMPREFIX@C_FindObjectsFinal
+@SYMPREFIX@C_FindObjectsInit
+@SYMPREFIX@C_GenerateKey
+@SYMPREFIX@C_GenerateKeyPair
+@SYMPREFIX@C_GenerateRandom
+@SYMPREFIX@C_GetAttributeValue
+@SYMPREFIX@C_GetFunctionList
+@SYMPREFIX@C_GetFunctionStatus
+@SYMPREFIX@C_GetInfo
+@SYMPREFIX@C_GetMechanismInfo
+@SYMPREFIX@C_GetMechanismList
+@SYMPREFIX@C_GetObjectSize
+@SYMPREFIX@C_GetOperationState
+@SYMPREFIX@C_GetSessionInfo
+@SYMPREFIX@C_GetSlotInfo
+@SYMPREFIX@C_GetSlotList
+@SYMPREFIX@C_GetTokenInfo
+@SYMPREFIX@C_InitPIN
+@SYMPREFIX@C_InitToken
+@SYMPREFIX@C_Initialize
+@SYMPREFIX@C_Login
+@SYMPREFIX@C_Logout
+@SYMPREFIX@C_OpenSession
+@SYMPREFIX@C_SeedRandom
+@SYMPREFIX@C_SetAttributeValue
+@SYMPREFIX@C_SetOperationState
+@SYMPREFIX@C_SetPIN
+@SYMPREFIX@C_Sign
+@SYMPREFIX@C_SignEncryptUpdate
+@SYMPREFIX@C_SignFinal
+@SYMPREFIX@C_SignInit
+@SYMPREFIX@C_SignRecover
+@SYMPREFIX@C_SignRecoverInit
+@SYMPREFIX@C_SignUpdate
+@SYMPREFIX@C_UnwrapKey
+@SYMPREFIX@C_Verify
+@SYMPREFIX@C_VerifyFinal
+@SYMPREFIX@C_VerifyInit
+@SYMPREFIX@C_VerifyRecover
+@SYMPREFIX@C_VerifyRecoverInit
+@SYMPREFIX@C_VerifyUpdate
+@SYMPREFIX@C_WaitForSlotEvent
+@SYMPREFIX@C_WrapKey