Complete the final annotation changes

20 files changed, 106 insertions, 98 deletions

diff --git a/src/lib/codec/base64/base64.h b/src/lib/codec/base64/base64.h
index aefed4ba5..70e05828d 100644
--- a/src/lib/codec/base64/base64.h
+++ b/src/lib/codec/base64/base64.h
@@ -127,14 +127,14 @@ secure_vector<uint8_t> BOTAN_PUBLIC_API(2,0) base64_decode(const std::string& in
 * @param input_length the length of input in bytes
 * @return the size of output buffer in bytes
 */
-size_t BOTAN_DLL base64_encode_max_output(size_t input_length);
+size_t BOTAN_PUBLIC_API(2,1) base64_encode_max_output(size_t input_length);
 
 /**
 * Calculate the size of output buffer for base64_decode
 * @param input_length the length of input in bytes
 * @return the size of output buffer in bytes
 */
-size_t BOTAN_DLL base64_decode_max_output(size_t input_length);
+size_t BOTAN_PUBLIC_API(2,1) base64_decode_max_output(size_t input_length);
 
 }
 
diff --git a/src/lib/ffi/ffi.h b/src/lib/ffi/ffi.h
index 1b846a5a4..3c9c0627c 100644
--- a/src/lib/ffi/ffi.h
+++ b/src/lib/ffi/ffi.h
@@ -517,38 +517,38 @@ typedef struct botan_block_cipher_struct* botan_block_cipher_t;
 /**
 * Initialize a block cipher object
 */
-BOTAN_PUBLIC_API(2,2) int botan_block_cipher_init(botan_block_cipher_t* bc,
+BOTAN_PUBLIC_API(2,1) int botan_block_cipher_init(botan_block_cipher_t* bc,
                                       const char* cipher_name);
 
 /**
 * Destroy a block cipher object
 */
-BOTAN_PUBLIC_API(2,2) int botan_block_cipher_destroy(botan_block_cipher_t bc);
+BOTAN_PUBLIC_API(2,1) int botan_block_cipher_destroy(botan_block_cipher_t bc);
 
 /**
 * Reinitializes the block cipher
 * @return 0 on success, a negative value on failure
 */
-BOTAN_PUBLIC_API(2,2) int botan_block_cipher_clear(botan_block_cipher_t bc);
+BOTAN_PUBLIC_API(2,1) int botan_block_cipher_clear(botan_block_cipher_t bc);
 
 /**
 * Set the key for a block cipher instance
 */
-BOTAN_PUBLIC_API(2,2) int botan_block_cipher_set_key(botan_block_cipher_t bc,
+BOTAN_PUBLIC_API(2,1) int botan_block_cipher_set_key(botan_block_cipher_t bc,
                                          const uint8_t key[], size_t len);
 
 /**
 * Return the positive block size of this block cipher, or negative to
 * indicate an error
 */
-BOTAN_PUBLIC_API(2,2) int botan_block_cipher_block_size(botan_block_cipher_t bc);
+BOTAN_PUBLIC_API(2,1) int botan_block_cipher_block_size(botan_block_cipher_t bc);
 
-BOTAN_PUBLIC_API(2,2) int botan_block_cipher_encrypt_blocks(botan_block_cipher_t bc,
+BOTAN_PUBLIC_API(2,1) int botan_block_cipher_encrypt_blocks(botan_block_cipher_t bc,
                                                 const uint8_t in[],
                                                 uint8_t out[],
                                                 size_t blocks);
 
-BOTAN_PUBLIC_API(2,2) int botan_block_cipher_decrypt_blocks(botan_block_cipher_t bc,
+BOTAN_PUBLIC_API(2,1) int botan_block_cipher_decrypt_blocks(botan_block_cipher_t bc,
                                                 const uint8_t in[],
                                                 uint8_t out[],
                                                 size_t blocks);
@@ -559,57 +559,57 @@ BOTAN_PUBLIC_API(2,2) int botan_block_cipher_decrypt_blocks(botan_block_cipher_t
 */
 typedef struct botan_mp_struct* botan_mp_t;
 
-BOTAN_PUBLIC_API(2,2) int botan_mp_init(botan_mp_t* mp);
-BOTAN_PUBLIC_API(2,2) int botan_mp_destroy(botan_mp_t mp);
+BOTAN_PUBLIC_API(2,1) int botan_mp_init(botan_mp_t* mp);
+BOTAN_PUBLIC_API(2,1) int botan_mp_destroy(botan_mp_t mp);
 
 // writes botan_mp_num_bytes(mp)*2 + 1 bytes to out[]
-BOTAN_PUBLIC_API(2,2) int botan_mp_to_hex(const botan_mp_t mp, char* out);
-BOTAN_PUBLIC_API(2,2) int botan_mp_to_str(const botan_mp_t mp, uint8_t base, char* out, size_t* out_len);
+BOTAN_PUBLIC_API(2,1) int botan_mp_to_hex(const botan_mp_t mp, char* out);
+BOTAN_PUBLIC_API(2,1) int botan_mp_to_str(const botan_mp_t mp, uint8_t base, char* out, size_t* out_len);
 
-BOTAN_PUBLIC_API(2,2) int botan_mp_clear(botan_mp_t mp);
+BOTAN_PUBLIC_API(2,1) int botan_mp_clear(botan_mp_t mp);
 
-BOTAN_PUBLIC_API(2,2) int botan_mp_set_from_int(botan_mp_t mp, int initial_value);
-BOTAN_PUBLIC_API(2,2) int botan_mp_set_from_mp(botan_mp_t dest, const botan_mp_t source);
-BOTAN_PUBLIC_API(2,2) int botan_mp_set_from_str(botan_mp_t dest, const char* str);
-BOTAN_PUBLIC_API(2,2) int botan_mp_set_from_radix_str(botan_mp_t dest, const char* str, size_t radix);
+BOTAN_PUBLIC_API(2,1) int botan_mp_set_from_int(botan_mp_t mp, int initial_value);
+BOTAN_PUBLIC_API(2,1) int botan_mp_set_from_mp(botan_mp_t dest, const botan_mp_t source);
+BOTAN_PUBLIC_API(2,1) int botan_mp_set_from_str(botan_mp_t dest, const char* str);
+BOTAN_PUBLIC_API(2,1) int botan_mp_set_from_radix_str(botan_mp_t dest, const char* str, size_t radix);
 
-BOTAN_PUBLIC_API(2,2) int botan_mp_num_bits(const botan_mp_t n, size_t* bits);
-BOTAN_PUBLIC_API(2,2) int botan_mp_num_bytes(const botan_mp_t n, size_t* bytes);
+BOTAN_PUBLIC_API(2,1) int botan_mp_num_bits(const botan_mp_t n, size_t* bits);
+BOTAN_PUBLIC_API(2,1) int botan_mp_num_bytes(const botan_mp_t n, size_t* bytes);
 
 // Writes botan_mp_num_bytes(mp) to vec
-BOTAN_PUBLIC_API(2,2) int botan_mp_to_bin(const botan_mp_t mp, uint8_t vec[]);
-BOTAN_PUBLIC_API(2,2) int botan_mp_from_bin(const botan_mp_t mp, const uint8_t vec[], size_t vec_len);
+BOTAN_PUBLIC_API(2,1) int botan_mp_to_bin(const botan_mp_t mp, uint8_t vec[]);
+BOTAN_PUBLIC_API(2,1) int botan_mp_from_bin(const botan_mp_t mp, const uint8_t vec[], size_t vec_len);
 
-BOTAN_PUBLIC_API(2,2) int botan_mp_to_uint32(const botan_mp_t mp, uint32_t* val);
+BOTAN_PUBLIC_API(2,1) int botan_mp_to_uint32(const botan_mp_t mp, uint32_t* val);
 
 /**
 * This function is not well named. Returns 1 iff mp is greater than
 * *or equal to* zero. Use botan_mp_is_negative to detect negative
 * numbers, botan_mp_is_zero to check for zero.
 */
-BOTAN_PUBLIC_API(2,2) int botan_mp_is_positive(const botan_mp_t mp);
+BOTAN_PUBLIC_API(2,1) int botan_mp_is_positive(const botan_mp_t mp);
 
 /**
 * Return 1 iff mp is less than 0
 */
-BOTAN_PUBLIC_API(2,2) int botan_mp_is_negative(const botan_mp_t mp);
+BOTAN_PUBLIC_API(2,1) int botan_mp_is_negative(const botan_mp_t mp);
 
-BOTAN_PUBLIC_API(2,2) int botan_mp_flip_sign(botan_mp_t mp);
-//BOTAN_PUBLIC_API(2,2) int botan_mp_set_negative(botan_mp_t mp);
+BOTAN_PUBLIC_API(2,1) int botan_mp_flip_sign(botan_mp_t mp);
+//BOTAN_PUBLIC_API(2,1) int botan_mp_set_negative(botan_mp_t mp);
 
-BOTAN_PUBLIC_API(2,2) int botan_mp_is_zero(const botan_mp_t mp);
-BOTAN_PUBLIC_API(2,2) int botan_mp_is_odd(const botan_mp_t mp);
-BOTAN_PUBLIC_API(2,2) int botan_mp_is_even(const botan_mp_t mp);
+BOTAN_PUBLIC_API(2,1) int botan_mp_is_zero(const botan_mp_t mp);
+BOTAN_PUBLIC_API(2,1) int botan_mp_is_odd(const botan_mp_t mp);
+BOTAN_PUBLIC_API(2,1) int botan_mp_is_even(const botan_mp_t mp);
 
-BOTAN_PUBLIC_API(2,2) int botan_mp_add(botan_mp_t result, const botan_mp_t x, const botan_mp_t y);
-BOTAN_PUBLIC_API(2,2) int botan_mp_sub(botan_mp_t result, const botan_mp_t x, const botan_mp_t y);
-BOTAN_PUBLIC_API(2,2) int botan_mp_mul(botan_mp_t result, const botan_mp_t x, const botan_mp_t y);
+BOTAN_PUBLIC_API(2,1) int botan_mp_add(botan_mp_t result, const botan_mp_t x, const botan_mp_t y);
+BOTAN_PUBLIC_API(2,1) int botan_mp_sub(botan_mp_t result, const botan_mp_t x, const botan_mp_t y);
+BOTAN_PUBLIC_API(2,1) int botan_mp_mul(botan_mp_t result, const botan_mp_t x, const botan_mp_t y);
 
-BOTAN_PUBLIC_API(2,2) int botan_mp_div(botan_mp_t quotient,
+BOTAN_PUBLIC_API(2,1) int botan_mp_div(botan_mp_t quotient,
                            botan_mp_t remainder,
                            const botan_mp_t x, const botan_mp_t y);
 
-BOTAN_PUBLIC_API(2,2) int botan_mp_mod_mul(botan_mp_t result, const botan_mp_t x,
+BOTAN_PUBLIC_API(2,1) int botan_mp_mod_mul(botan_mp_t result, const botan_mp_t x,
                                const botan_mp_t y, const botan_mp_t mod);
 
 /*
@@ -617,58 +617,58 @@ BOTAN_PUBLIC_API(2,2) int botan_mp_mod_mul(botan_mp_t result, const botan_mp_t x
 * Returns 1 if x == y
 * Returns negative number on error
 */
-BOTAN_PUBLIC_API(2,2) int botan_mp_equal(const botan_mp_t x, const botan_mp_t y);
+BOTAN_PUBLIC_API(2,1) int botan_mp_equal(const botan_mp_t x, const botan_mp_t y);
 
 /*
 * Sets *result to comparison result:
 * -1 if x < y, 0 if x == y, 1 if x > y
 * Returns negative number on error or zero on success
 */
-BOTAN_PUBLIC_API(2,2) int botan_mp_cmp(int* result, const botan_mp_t x, const botan_mp_t y);
+BOTAN_PUBLIC_API(2,1) int botan_mp_cmp(int* result, const botan_mp_t x, const botan_mp_t y);
 
 /*
 * Swap two botan_mp_t
 */
-BOTAN_PUBLIC_API(2,2) int botan_mp_swap(botan_mp_t x, botan_mp_t y);
+BOTAN_PUBLIC_API(2,1) int botan_mp_swap(botan_mp_t x, botan_mp_t y);
 
 // Return (base^exponent) % modulus
-BOTAN_PUBLIC_API(2,2) int botan_mp_powmod(botan_mp_t out, const botan_mp_t base, const botan_mp_t exponent, const botan_mp_t modulus);
+BOTAN_PUBLIC_API(2,1) int botan_mp_powmod(botan_mp_t out, const botan_mp_t base, const botan_mp_t exponent, const botan_mp_t modulus);
 
-BOTAN_PUBLIC_API(2,2) int botan_mp_lshift(botan_mp_t out, const botan_mp_t in, size_t shift);
-BOTAN_PUBLIC_API(2,2) int botan_mp_rshift(botan_mp_t out, const botan_mp_t in, size_t shift);
+BOTAN_PUBLIC_API(2,1) int botan_mp_lshift(botan_mp_t out, const botan_mp_t in, size_t shift);
+BOTAN_PUBLIC_API(2,1) int botan_mp_rshift(botan_mp_t out, const botan_mp_t in, size_t shift);
 
-BOTAN_PUBLIC_API(2,2) int botan_mp_mod_inverse(botan_mp_t out, const botan_mp_t in, const botan_mp_t modulus);
+BOTAN_PUBLIC_API(2,1) int botan_mp_mod_inverse(botan_mp_t out, const botan_mp_t in, const botan_mp_t modulus);
 
-BOTAN_PUBLIC_API(2,2) int botan_mp_rand_bits(botan_mp_t rand_out, botan_rng_t rng, size_t bits);
+BOTAN_PUBLIC_API(2,1) int botan_mp_rand_bits(botan_mp_t rand_out, botan_rng_t rng, size_t bits);
 
-BOTAN_PUBLIC_API(2,2) int botan_mp_rand_range(botan_mp_t rand_out, botan_rng_t rng,
+BOTAN_PUBLIC_API(2,1) int botan_mp_rand_range(botan_mp_t rand_out, botan_rng_t rng,
                                   const botan_mp_t lower_bound, const botan_mp_t upper_bound);
 
-BOTAN_PUBLIC_API(2,2) int botan_mp_gcd(botan_mp_t out, const botan_mp_t x, const botan_mp_t y);
+BOTAN_PUBLIC_API(2,1) int botan_mp_gcd(botan_mp_t out, const botan_mp_t x, const botan_mp_t y);
 
 /**
 * Returns 0 if n is not prime
 * Returns 1 if n is prime
 * Returns negative number on error
 */
-BOTAN_PUBLIC_API(2,2) int botan_mp_is_prime(const botan_mp_t n, botan_rng_t rng, size_t test_prob);
+BOTAN_PUBLIC_API(2,1) int botan_mp_is_prime(const botan_mp_t n, botan_rng_t rng, size_t test_prob);
 
 /**
 * Returns 0 if specified bit of n is not set
 * Returns 1 if specified bit of n is set
 * Returns negative number on error
 */
-BOTAN_PUBLIC_API(2,2) int botan_mp_get_bit(const botan_mp_t n, size_t bit);
+BOTAN_PUBLIC_API(2,1) int botan_mp_get_bit(const botan_mp_t n, size_t bit);
 
 /**
 * Set the specified bit
 */
-BOTAN_PUBLIC_API(2,2) int botan_mp_set_bit(botan_mp_t n, size_t bit);
+BOTAN_PUBLIC_API(2,1) int botan_mp_set_bit(botan_mp_t n, size_t bit);
 
 /**
 * Clear the specified bit
 */
-BOTAN_PUBLIC_API(2,2) int botan_mp_clear_bit(botan_mp_t n, size_t bit);
+BOTAN_PUBLIC_API(2,1) int botan_mp_clear_bit(botan_mp_t n, size_t bit);
 
 /* Bcrypt password hashing */
 
diff --git a/src/lib/kdf/sp800_56a/sp800_56a.h b/src/lib/kdf/sp800_56a/sp800_56a.h
index 68257fcd3..7e517679c 100644
--- a/src/lib/kdf/sp800_56a/sp800_56a.h
+++ b/src/lib/kdf/sp800_56a/sp800_56a.h
@@ -19,7 +19,7 @@ namespace Botan {
  * NIST SP 800-56A KDF using hash function
  * @warning This KDF ignores the provided salt value
  */
-class BOTAN_DLL SP800_56A_Hash final : public KDF
+class BOTAN_PUBLIC_API(2,2) SP800_56A_Hash final : public KDF
    {
    public:
       std::string name() const override { return "SP800-56A(" + m_hash->name() + ")"; }
@@ -59,7 +59,7 @@ class BOTAN_DLL SP800_56A_Hash final : public KDF
 /**
  * NIST SP 800-56A KDF using HMAC
  */
-class BOTAN_DLL SP800_56A_HMAC final : public KDF
+class BOTAN_PUBLIC_API(2,2) SP800_56A_HMAC final : public KDF
    {
    public:
       std::string name() const override { return "SP800-56A(" + m_mac->name() + ")"; }
diff --git a/src/lib/misc/hotp/hotp.h b/src/lib/misc/hotp/hotp.h
index cc222e5c0..1b6d91c94 100644
--- a/src/lib/misc/hotp/hotp.h
+++ b/src/lib/misc/hotp/hotp.h
@@ -15,7 +15,7 @@ namespace Botan {
 /**
 * HOTP one time passwords (RFC 4226)
 */
-class BOTAN_DLL HOTP
+class BOTAN_PUBLIC_API(2,2) HOTP
    {
    public:
       /**
diff --git a/src/lib/misc/hotp/totp.h b/src/lib/misc/hotp/totp.h
index 767c7cc5a..ff65c07e9 100644
--- a/src/lib/misc/hotp/totp.h
+++ b/src/lib/misc/hotp/totp.h
@@ -15,7 +15,7 @@ namespace Botan {
 /**
 * TOTP (time based) one time passwords (RFC 6238)
 */
-class BOTAN_DLL TOTP
+class BOTAN_PUBLIC_API(2,2) TOTP
    {
    public:
       /**
diff --git a/src/lib/modes/cipher_mode.h b/src/lib/modes/cipher_mode.h
index bf1821256..80b77d5f8 100644
--- a/src/lib/modes/cipher_mode.h
+++ b/src/lib/modes/cipher_mode.h
@@ -20,7 +20,7 @@ namespace Botan {
 /**
 * Interface for cipher modes
 */
-class BOTAN_DLL Cipher_Mode
+class BOTAN_PUBLIC_API(2,0) Cipher_Mode
    {
    public:
       virtual ~Cipher_Mode() = default;
@@ -223,9 +223,10 @@ enum Cipher_Dir : int { ENCRYPTION, DECRYPTION };
 * @param direction ENCRYPTION or DECRYPTION
 * @param provider provider implementation to choose
 */
-BOTAN_DLL Cipher_Mode* get_cipher_mode(const std::string& algo_spec,
-                                       Cipher_Dir direction,
-                                       const std::string& provider = "");
+BOTAN_PUBLIC_API(2,2)
+Cipher_Mode* get_cipher_mode(const std::string& algo_spec,
+                             Cipher_Dir direction,
+                             const std::string& provider = "");
 
 }
 
diff --git a/src/lib/passhash/passhash9/passhash9.h b/src/lib/passhash/passhash9/passhash9.h
index a10a6b665..e6d5335de 100644
--- a/src/lib/passhash/passhash9/passhash9.h
+++ b/src/lib/passhash/passhash9/passhash9.h
@@ -42,7 +42,7 @@ bool BOTAN_PUBLIC_API(2,0) check_passhash9(const std::string& password,
 * Check if the PRF used with PBKDF2 is supported
 * @param alg_id alg_id used in generate_passhash9()
 */
-bool BOTAN_DLL is_passhash9_alg_supported(uint8_t alg_id);
+bool BOTAN_PUBLIC_API(2,3) is_passhash9_alg_supported(uint8_t alg_id);
 
 }
 
diff --git a/src/lib/pbkdf/pgp_s2k/pgp_s2k.h b/src/lib/pbkdf/pgp_s2k/pgp_s2k.h
index 9e9afc10c..93b0e74b9 100644
--- a/src/lib/pbkdf/pgp_s2k/pgp_s2k.h
+++ b/src/lib/pbkdf/pgp_s2k/pgp_s2k.h
@@ -30,7 +30,7 @@ namespace Botan {
 * Note that unlike PBKDF2, OpenPGP S2K's "iterations" are defined as
 * the number of bytes hashed.
 */
-class BOTAN_DLL OpenPGP_S2K final : public PBKDF
+class BOTAN_PUBLIC_API(2,2) OpenPGP_S2K final : public PBKDF
    {
    public:
       /**
diff --git a/src/lib/pubkey/ed25519/ed25519.h b/src/lib/pubkey/ed25519/ed25519.h
index 360d92c16..d372936c9 100644
--- a/src/lib/pubkey/ed25519/ed25519.h
+++ b/src/lib/pubkey/ed25519/ed25519.h
@@ -15,7 +15,7 @@
 
 namespace Botan {
 
-class BOTAN_DLL Ed25519_PublicKey : public virtual Public_Key
+class BOTAN_PUBLIC_API(2,2) Ed25519_PublicKey : public virtual Public_Key
    {
    public:
       std::string algo_name() const override { return "Ed25519"; }
@@ -62,7 +62,7 @@ class BOTAN_DLL Ed25519_PublicKey : public virtual Public_Key
       std::vector<uint8_t> m_public;
    };
 
-class BOTAN_DLL Ed25519_PrivateKey : public Ed25519_PublicKey,
+class BOTAN_PUBLIC_API(2,2) Ed25519_PrivateKey : public Ed25519_PublicKey,
                                      public virtual Private_Key
    {
    public:
diff --git a/src/lib/pubkey/newhope/newhope.h b/src/lib/pubkey/newhope/newhope.h
index 221ead01a..141f8e263 100644
--- a/src/lib/pubkey/newhope/newhope.h
+++ b/src/lib/pubkey/newhope/newhope.h
@@ -60,20 +60,20 @@ enum class Newhope_Mode
    };
 
 // offer
-void BOTAN_DLL newhope_keygen(uint8_t send[NEWHOPE_SENDABYTES],
+void BOTAN_PUBLIC_API(2,0) newhope_keygen(uint8_t send[NEWHOPE_SENDABYTES],
                               newhope_poly* sk,
                               RandomNumberGenerator& rng,
                               Newhope_Mode = Newhope_Mode::SHA3);
 
 // accept
-void BOTAN_DLL newhope_sharedb(uint8_t sharedkey[NEWHOPE_SHARED_KEY_BYTES],
+void BOTAN_PUBLIC_API(2,0) newhope_sharedb(uint8_t sharedkey[NEWHOPE_SHARED_KEY_BYTES],
                                uint8_t send[],
                                const uint8_t* received,
                                RandomNumberGenerator& rng,
                                Newhope_Mode mode = Newhope_Mode::SHA3);
 
 // finish
-void BOTAN_DLL newhope_shareda(uint8_t sharedkey[NEWHOPE_SHARED_KEY_BYTES],
+void BOTAN_PUBLIC_API(2,0) newhope_shareda(uint8_t sharedkey[NEWHOPE_SHARED_KEY_BYTES],
                                const newhope_poly* ska,
                                const uint8_t* received,
                                Newhope_Mode mode = Newhope_Mode::SHA3);
diff --git a/src/lib/pubkey/pbes2/pbes2.h b/src/lib/pubkey/pbes2/pbes2.h
index 0eaa6e2cf..edd46f7eb 100644
--- a/src/lib/pubkey/pbes2/pbes2.h
+++ b/src/lib/pubkey/pbes2/pbes2.h
@@ -43,7 +43,7 @@ BOTAN_PUBLIC_API(2,0) pbes2_encrypt(const secure_vector<uint8_t>& key_bits,
 * @param rng a random number generator
 */
 std::pair<AlgorithmIdentifier, std::vector<uint8_t>>
-BOTAN_DLL pbes2_encrypt_msec(const secure_vector<uint8_t>& key_bits,
+BOTAN_PUBLIC_API(2,1) pbes2_encrypt_msec(const secure_vector<uint8_t>& key_bits,
                              const std::string& passphrase,
                              std::chrono::milliseconds msec,
                              size_t* out_iterations_if_nonnull,
@@ -61,7 +61,7 @@ BOTAN_DLL pbes2_encrypt_msec(const secure_vector<uint8_t>& key_bits,
 * @param rng a random number generator
 */
 std::pair<AlgorithmIdentifier, std::vector<uint8_t>>
-BOTAN_DLL pbes2_encrypt_iter(const secure_vector<uint8_t>& key_bits,
+BOTAN_PUBLIC_API(2,1) pbes2_encrypt_iter(const secure_vector<uint8_t>& key_bits,
                              const std::string& passphrase,
                              size_t iterations,
                              const std::string& cipher,
diff --git a/src/lib/pubkey/pk_algs.h b/src/lib/pubkey/pk_algs.h
index b215914c1..d5ef9d6ec 100644
--- a/src/lib/pubkey/pk_algs.h
+++ b/src/lib/pubkey/pk_algs.h
@@ -36,7 +36,8 @@ create_private_key(const std::string& algo_name,
                    const std::string& algo_params = "",
                    const std::string& provider = "");
 
-BOTAN_DLL std::vector<std::string>
+BOTAN_PUBLIC_API(2,2)
+std::vector<std::string>
 probe_provider_private_key(const std::string& algo_name,
                            const std::vector<std::string> possible);
 
diff --git a/src/lib/pubkey/pkcs8.h b/src/lib/pubkey/pkcs8.h
index e7799ebe0..7d9b7ea49 100644
--- a/src/lib/pubkey/pkcs8.h
+++ b/src/lib/pubkey/pkcs8.h
@@ -92,7 +92,7 @@ PEM_encode(const Private_Key& key,
 *   For example "SHA-256" or "SHA-384". If empty a suitable default is chosen.
 * @return encrypted key in binary BER form
 */
-BOTAN_DLL std::vector<uint8_t>
+BOTAN_PUBLIC_API(2,1) std::vector<uint8_t>
 BER_encode_encrypted_pbkdf_iter(const Private_Key& key,
                                 RandomNumberGenerator& rng,
                                 const std::string& pass,
@@ -114,7 +114,7 @@ BER_encode_encrypted_pbkdf_iter(const Private_Key& key,
 *   For example "SHA-256" or "SHA-384". If empty a suitable default is chosen.
 * @return encrypted key in PEM form
 */
-BOTAN_DLL std::string
+BOTAN_PUBLIC_API(2,1) std::string
 PEM_encode_encrypted_pbkdf_iter(const Private_Key& key,
                                 RandomNumberGenerator& rng,
                                 const std::string& pass,
@@ -136,7 +136,7 @@ PEM_encode_encrypted_pbkdf_iter(const Private_Key& key,
 *   For example "SHA-256" or "SHA-384". If empty a suitable default is chosen.
 * @return encrypted key in binary BER form
 */
-BOTAN_DLL std::vector<uint8_t>
+BOTAN_PUBLIC_API(2,1) std::vector<uint8_t>
 BER_encode_encrypted_pbkdf_msec(const Private_Key& key,
                                 RandomNumberGenerator& rng,
                                 const std::string& pass,
@@ -161,7 +161,7 @@ BER_encode_encrypted_pbkdf_msec(const Private_Key& key,
 *   For example "SHA-256" or "SHA-384". If empty a suitable default is chosen.
 * @return encrypted key in PEM form
 */
-BOTAN_DLL std::string
+BOTAN_PUBLIC_API(2,1) std::string
 PEM_encode_encrypted_pbkdf_msec(const Private_Key& key,
                                 RandomNumberGenerator& rng,
                                 const std::string& pass,
diff --git a/src/lib/pubkey/sm2/sm2.h b/src/lib/pubkey/sm2/sm2.h
index 879e0b95d..20310f041 100644
--- a/src/lib/pubkey/sm2/sm2.h
+++ b/src/lib/pubkey/sm2/sm2.h
@@ -15,7 +15,7 @@ namespace Botan {
 /**
 * This class represents SM2 Signature public keys
 */
-class BOTAN_DLL SM2_Signature_PublicKey : public virtual EC_PublicKey
+class BOTAN_PUBLIC_API(2,2) SM2_Signature_PublicKey : public virtual EC_PublicKey
    {
    public:
 
@@ -58,7 +58,7 @@ class BOTAN_DLL SM2_Signature_PublicKey : public virtual EC_PublicKey
 /**
 * This class represents SM2 Signature private keys
 */
-class BOTAN_DLL SM2_Signature_PrivateKey : public SM2_Signature_PublicKey,
+class BOTAN_PUBLIC_API(2,2) SM2_Signature_PrivateKey : public SM2_Signature_PublicKey,
                                            public EC_PrivateKey
    {
    public:
diff --git a/src/lib/pubkey/sm2/sm2_enc.h b/src/lib/pubkey/sm2/sm2_enc.h
index f8da6a27f..2f4945804 100644
--- a/src/lib/pubkey/sm2/sm2_enc.h
+++ b/src/lib/pubkey/sm2/sm2_enc.h
@@ -15,7 +15,7 @@ namespace Botan {
 /**
 * This class represents a public key used for SM2 encryption
 */
-class BOTAN_DLL SM2_Encryption_PublicKey : public virtual EC_PublicKey
+class BOTAN_PUBLIC_API(2,2) SM2_Encryption_PublicKey : public virtual EC_PublicKey
    {
    public:
 
@@ -54,7 +54,7 @@ class BOTAN_DLL SM2_Encryption_PublicKey : public virtual EC_PublicKey
 /**
 * This class represents a private key used for SM2 encryption
 */
-class BOTAN_DLL SM2_Encryption_PrivateKey : public SM2_Encryption_PublicKey,
+class BOTAN_PUBLIC_API(2,2) SM2_Encryption_PrivateKey : public SM2_Encryption_PublicKey,
                                             public EC_PrivateKey
    {
    public:
diff --git a/src/lib/utils/mem_ops.h b/src/lib/utils/mem_ops.h
index 58b87b8c7..4bc57316b 100644
--- a/src/lib/utils/mem_ops.h
+++ b/src/lib/utils/mem_ops.h
@@ -38,7 +38,7 @@ BOTAN_PUBLIC_API(2,0) void secure_scrub_memory(void* ptr, size_t n);
 * @param len the number of Ts in x and y
 * @return true iff x[i] == y[i] forall i in [0...n)
 */
-BOTAN_DLL bool constant_time_compare(const uint8_t x[],
+BOTAN_PUBLIC_API(2,3) bool constant_time_compare(const uint8_t x[],
                                      const uint8_t y[],
                                      size_t len);
 
@@ -122,7 +122,7 @@ template<typename T> inline bool same_mem(const T* p1, const T* p2, size_t n)
 * @param in the read-only input buffer
 * @param length the length of the buffers
 */
-BOTAN_DLL void xor_buf(uint8_t out[],
+BOTAN_PUBLIC_API(2,3) void xor_buf(uint8_t out[],
                        const uint8_t in[],
                        size_t length);
 
@@ -133,7 +133,7 @@ BOTAN_DLL void xor_buf(uint8_t out[],
 * @param in2 the second output buffer
 * @param length the length of the three buffers
 */
-BOTAN_DLL void xor_buf(uint8_t out[],
+BOTAN_PUBLIC_API(2,3) void xor_buf(uint8_t out[],
                        const uint8_t in[],
                        const uint8_t in2[],
                        size_t length);
diff --git a/src/lib/utils/parsing.h b/src/lib/utils/parsing.h
index 32236236e..fa340f410 100644
--- a/src/lib/utils/parsing.h
+++ b/src/lib/utils/parsing.h
@@ -57,9 +57,10 @@ BOTAN_PUBLIC_API(2,0) std::string erase_chars(const std::string& str, const std:
 * @param to_char the character to replace it with
 * @return str with all instances of from_char replaced by to_char
 */
-BOTAN_PUBLIC_API(2,0) std::string replace_char(const std::string& str,
-                                   char from_char,
-                                   char to_char);
+BOTAN_PUBLIC_API(2,0)
+std::string replace_char(const std::string& str,
+                         char from_char,
+                         char to_char);
 
 /**
 * Replace a character in a string
@@ -68,9 +69,10 @@ BOTAN_PUBLIC_API(2,0) std::string replace_char(const std::string& str,
 * @param to_char the character to replace it with
 * @return str with all instances of from_chars replaced by to_char
 */
-BOTAN_PUBLIC_API(2,0) std::string replace_chars(const std::string& str,
-                                    const std::set<char>& from_chars,
-                                    char to_char);
+BOTAN_PUBLIC_API(2,0)
+std::string replace_chars(const std::string& str,
+                          const std::set<char>& from_chars,
+                          char to_char);
 
 /**
 * Join a string
@@ -78,8 +80,9 @@ BOTAN_PUBLIC_API(2,0) std::string replace_chars(const std::string& str,
 * @param delim the delimitor
 * @return string joined by delim
 */
-BOTAN_PUBLIC_API(2,0) std::string string_join(const std::vector<std::string>& strs,
-                                  char delim);
+BOTAN_PUBLIC_API(2,0)
+std::string string_join(const std::vector<std::string>& strs,
+                        char delim);
 
 /**
 * Parse an ASN.1 OID
@@ -94,8 +97,9 @@ BOTAN_PUBLIC_API(2,0) std::vector<uint32_t> parse_asn1_oid(const std::string& oi
 * @param name2 the second name
 * @return true if name1 is the same as name2 by the X.509 comparison rules
 */
-BOTAN_PUBLIC_API(2,0) bool x500_name_cmp(const std::string& name1,
-                             const std::string& name2);
+BOTAN_PUBLIC_API(2,0)
+bool x500_name_cmp(const std::string& name1,
+                   const std::string& name2);
 
 /**
 * Convert a string to a number
@@ -109,7 +113,7 @@ BOTAN_PUBLIC_API(2,0) uint32_t to_u32bit(const std::string& str);
 * @param str the string to convert
 * @return number value of the string
 */
-BOTAN_DLL uint16_t to_uint16(const std::string& str);
+BOTAN_PUBLIC_API(2,3) uint16_t to_uint16(const std::string& str);
 
 /**
 * Convert a time specification to a number
diff --git a/src/lib/utils/poly_dbl.h b/src/lib/utils/poly_dbl.h
index c79af3ada..ce62731c2 100644
--- a/src/lib/utils/poly_dbl.h
+++ b/src/lib/utils/poly_dbl.h
@@ -14,7 +14,7 @@ namespace Botan {
 /**
 * Polynomial doubling in GF(2^n)
 */
-void BOTAN_DLL poly_double_n(uint8_t out[], const uint8_t in[], size_t n);
+void BOTAN_PUBLIC_API(2,3) poly_double_n(uint8_t out[], const uint8_t in[], size_t n);
 
 inline void poly_double_n(uint8_t buf[], size_t n)
    {
diff --git a/src/lib/x509/ocsp.h b/src/lib/x509/ocsp.h
index 550fd09e2..dc3532247 100644
--- a/src/lib/x509/ocsp.h
+++ b/src/lib/x509/ocsp.h
@@ -163,10 +163,11 @@ class BOTAN_PUBLIC_API(2,0) Response
 
 #if defined(BOTAN_HAS_HTTP_UTIL)
 
-BOTAN_DLL Response online_check(const X509_Certificate& issuer,
-                                const BigInt& subject_serial,
-                                const std::string& ocsp_responder,
-                                Certificate_Store* trusted_roots);
+BOTAN_PUBLIC_API(2,1)
+Response online_check(const X509_Certificate& issuer,
+                      const BigInt& subject_serial,
+                      const std::string& ocsp_responder,
+                      Certificate_Store* trusted_roots);
 
 /**
 * Makes an online OCSP request via HTTP and returns the OCSP response.
@@ -175,9 +176,10 @@ BOTAN_DLL Response online_check(const X509_Certificate& issuer,
 * @param trusted_roots trusted roots for the OCSP response
 * @return OCSP response
 */
-BOTAN_PUBLIC_API(2,0) Response online_check(const X509_Certificate& issuer,
-                                const X509_Certificate& subject,
-                                Certificate_Store* trusted_roots);
+BOTAN_PUBLIC_API(2,0)
+Response online_check(const X509_Certificate& issuer,
+                      const X509_Certificate& subject,
+                      Certificate_Store* trusted_roots);
 
 #endif
 
diff --git a/src/lib/x509/x509_ext.h b/src/lib/x509/x509_ext.h
index 22598d41a..a77edc194 100644
--- a/src/lib/x509/x509_ext.h
+++ b/src/lib/x509/x509_ext.h
@@ -83,7 +83,7 @@ class BOTAN_PUBLIC_API(2,0) Certificate_Extension
 /**
 * X.509 Certificate Extension List
 */
-class BOTAN_UNSTABLE_API Extensions : public ASN1_Object
+class BOTAN_PUBLIC_API(2,0) Extensions : public ASN1_Object
    {
    public:
       void encode_into(class DER_Encoder&) const override;