Add OpenSSL

.github/workflows/release.yml

@@ -10,6 +10,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v2
+      - name: Install nasm for OpenSSL generator
+        run: sudo apt-get install --no-install-recommends nasm
       - name: Upload release assets
         run: |
           git fetch --unshallow --tags

.github/workflows/sanity_checks.yml

@@ -11,9 +11,9 @@ jobs:
       - name: Fetch tags and unshallow
         run: git fetch --unshallow --tags
 
-      - name: Install package
+      - name: Install packages
         run: |
-          sudo apt-get -y install build-essential python3-pip ninja-build
+          sudo apt-get -y install build-essential python3-pip ninja-build nasm
           pip install meson
 
       - name: Sanity Checks

.gitignore

@@ -1,2 +1,6 @@
 __pycache__
+.idea
 .vscode
+
+subprojects/packagecache
+subprojects/packagefiles/openssl/generated-config

releases.json

@@ -748,6 +748,16 @@
       "1.7.0-1"
     ]
   },
+  "openssl": {
+    "dependency_names": [
+      "libcrypto",
+      "libssl",
+      "openssl"
+    ],
+    "versions": [
+      "1.1.1k-1"
+    ]
+  },
   "pcg": {
     "versions": [
       "0.98.1-2",

subprojects/openssl.wrap

@@ -0,0 +1,11 @@
+[wrap-file]
+directory = openssl-1.1.1k
+source_url = https://www.openssl.org/source/openssl-1.1.1k.tar.gz
+source_filename = openssl-1.1.1k.tar.gz
+source_hash = 892a0875b9872acd04a9fde79b1f943075d5ea162415de3047c327df33fbaee5
+patch_directory = openssl
+
+[provide]
+libcrypto = libcrypto_dep
+libssl = libssl_dep
+openssl = openssl_dep

subprojects/packagefiles/openssl/LICENSE.build

@@ -0,0 +1,19 @@
+Copyright (c) 2021 The Meson development team
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

subprojects/packagefiles/openssl/README.md

@@ -0,0 +1,23 @@
+# OpenSSL for Meson
+
+## How this works?
+TL;DR: this wrap abuses OpenSSL build system within Node.js.
+
+Node.js has OpenSSL built-in with additional scripting around it to generate configs for GYP build system and thus bypass OpenSSL's native build system.
+
+This wrap abuses that feature by replacing bundled OpenSSL with upstream version, patching mentioned mechanism to also generate a bunch of `meson.build` files for different platforms and uses top-level `meson.build` to wire everything together.
+
+During installation unmodified Node.js tarball will be downloaded, its bundled OpenSSL will be replaced with upstream version and patched with `meson.build` files, enabling ability to build OpenSSL with Meson 🎉.
+
+## How to update to newer release
+Unless Node.js changes the mechanism we abuse above (unlikely, but possible, please check the diff between corresponding versions), `generator.sh` file can be used.
+
+Just update OpenSSL version in wrap file, update Node.js version in `generator.sh` file to such that contains matching OpenSSL version bundled with it and run `generator.sh` from the root of the repository:
+```
+subprojects/packagefiles/openssl/generator.sh
+```
+
+Generated files in `generated-config` directory, after which you can try to build it. `create_release.py` will run it as part of the release process, so it doesn't need to be included in Git.
+
+## Acknowledgement
+This OpenSSL port wouldn't be possible without [Node.js project](https://github.com/nodejs/node) under [MIT license](https://github.com/nodejs/node/blob/master/LICENSE), whose OpenSSL build system was decomposed and heavily refactored.

subprojects/packagefiles/openssl/generate_gypi.pl.patch

@@ -0,0 +1,39 @@
+diff --git a/openssl/config/generate_gypi.pl b/openssl/config/generate_gypi.pl
+--- a/openssl/config/generate_gypi.pl
++++ b/openssl/config/generate_gypi.pl
+@@ -171,7 +171,34 @@
+ print CLGYPI "$clgypi";
+ close(CLGYPI);
+
++# Create meson.build
++my $mtemplate =
++    Text::Template->new(TYPE => 'FILE',
++                        SOURCE => 'meson.build.tmpl',
++                        DELIMITERS => [ "%%-", "-%%" ]
++                        );
++
++my $meson = $mtemplate->fill_in(
++    HASH => {
++        libssl_srcs => \@libssl_srcs,
++        libcrypto_srcs => \@libcrypto_srcs,
++        generated_srcs => \@generated_srcs,
++        apps_openssl_srcs => \@apps_openssl_srcs,
++        libapps_srcs => \@libapps_srcs,
++        config => \%config,
++        target => \%target,
++        cflags => \@cflags,
++        asm => \$asm,
++        arch => \$arch,
++        lib_cppflags => \@lib_cppflags,
++        is_win => \$is_win,
++    });
++
++open(MESON, "> ./archs/$arch/$asm/meson.build");
++print MESON "$meson";
++close(MESON);
++
+ # Clean Up
+ my $cmd2 ="cd $src_dir; make -f $makefile clean; make -f $makefile distclean;" .
+-    "git clean -f $src_dir/crypto";
++    "git clean -f crypto";
+ system($cmd2) == 0 or die "Error in system($cmd2)";

subprojects/packagefiles/openssl/generator.sh

@@ -0,0 +1,45 @@
+#!/bin/bash
+set -e
+
+cd "$(dirname "${BASH_SOURCE[0]}")"
+
+# Node.js version should bundle OpenSSL of matching version to one specified in wrap file
+node_version=v16.5.0
+openssl_version="$OPENSSL_VERSION"
+
+if [ -z "$openssl_version" ]; then
+  openssl_version=$(grep 'directory = ' ../../openssl.wrap | grep -oE '[0-9]+\.[0-9]+\.[0-9]+[a-z]')
+fi
+
+rm -rf node
+git clone --depth 1 --branch $node_version https://github.com/nodejs/node.git
+
+rm -rf generated-config
+
+pushd node/deps/openssl
+
+# Apply patch that will allow us generate `meson.build` for different targets
+patch -u config/generate_gypi.pl -i ../../../generate_gypi.pl.patch
+# Copy `meson.build` template file
+cp ../../../meson.build.tmpl config/
+
+# Swap bundled OpenSSL in Node.js with upstream
+rm -rf openssl
+git clone --depth 1 --branch "OpenSSL_$(echo $openssl_version | tr . _)" https://github.com/openssl/openssl.git
+
+rm -rf config/archs
+LANG=C make -C config
+
+# Copy generated files back into correct place
+find config/archs -name 'meson.build' | xargs -I % sh -c 'mkdir -p ../../../generated-$(dirname %); cp % ../../../generated-%'
+find config/archs -name '*.h' | xargs -I % sh -c 'mkdir -p ../../../generated-$(dirname %); cp % ../../../generated-%'
+find config/archs -name '*.s' | xargs -I % sh -c 'mkdir -p ../../../generated-$(dirname %); cp % ../../../generated-%'
+
+# AIX is not supported by Meson
+rm -rf ../../../generated-config/archs/aix*
+# Remove build info files, we use hardcoded deterministic one instead
+rm -rf ../../../generated-config/archs/*/*/crypto/buildinf.h
+
+popd
+
+rm -rf node

subprojects/packagefiles/openssl/include/buildinf.h

@@ -0,0 +1,12 @@
+#define PLATFORM "platform: (see uname)"
+#define DATE "built on: the date it was built on, see https://reproducible-builds.org for why this doesn't matter"
+
+/*
+ * Generate compiler_flags as an array of individual characters. This is a
+ * workaround for the situation where CFLAGS gets too long for a C90 string
+ * literal
+ */
+static const char compiler_flags[] = {
+    'c','o','m','p','i','l','e','r',':',' ','a','n','o','n','y','m',
+    'o','u','s','\0'
+};

subprojects/packagefiles/openssl/include/crypto/bn_conf.h

@@ -0,0 +1 @@
+#include "crypto/include/internal/bn_conf.h"

subprojects/packagefiles/openssl/include/crypto/dso_conf.h

@@ -0,0 +1 @@
+#include "crypto/include/internal/dso_conf.h"