Update so Ruby 1.9.3 thru 2.3, and rbx can be built with OpenSSL 1.0.2u

[MSP-Greg]

1. Change all share/ruby-build/2.3.x files to use OpenSSL 1.0.2u
2. Update cert code for Ubuntu & macOS

This is for use in generating Rubies for use on GitHub Actions. A build run is here:

https://github.com/MSP-Greg/ruby-install-builder/runs/384299585

[eregon]

This logic needs more tweaks, it needs to support other OS, and have some kind of fallback.
We probably want to rename build_package_mac_openssl to just build_package_openssl or so.
In general I think it would be better to have 2 PRs:

• One updating OpenSSL and no other changes.
• One building OpenSSL on Linux for Ruby <= 2.3 (since it's hard to get OpenSSL 1.0.2 from Linux distributions).

[hsbt]

@MSP-Greg Can you separate the pull-request to update versions of OpenSSL and change the certificate logic at least?

[mislav]

Hi @MSP-Greg, I think your heart is in the right place, but there are multiple things risky with this proposed change.

It looks like you are suggesting that we change Ruby 2.3 build definitions so that they always install an isolated OpenSSL 1.0 instance unconditionally. Before, we only did this on macOS— on other OS, we never try to set up OpenSSL on behalf of the user.

With this change:

1. Ruby 2.3 definitions will behave very differently than Ruby 2.4+ definitions, which might be surprising to our users;
2. We would need to handle setting up system certs for the OpenSSL installation, which we so far handle only for macOS and I don't think we would want to maintain this logic for more OSs, as it would be too complicated and potentially controversial;
3. When OpenSSL install fails on various platforms, we would need to debug it when users open issues in this repo, and we don't want to go down that road.

I think users on non-macOS platforms should be responsible for setting up an appropriate OpenSSL instance on their machine and linking to that using build flags.

[MSP-Greg]

Thanks all.

I'm revised the PR, removing the cert logic, leaving the --if has_broken_mac_openssl logic, and splitting it into Ruby, rbx 2 & rbx 3.

As is, it does work on Ubuntu, but as mentioned, leaving it OS specific is probably best.

[eregon]

There are instructions in the wiki how to workaround on Linux for old OpenSSL: https://github.com/rbenv/ruby-build/wiki#openssl-usrincludeopensslasn1_mach102-error-error-this-file-is-obsolete-please-update-your-software (last paragraph)
I think it would still be useful for ruby-build to have a way to install old OpenSSL 1.0.x automatically, since it's becoming increasingly difficult to install packages for it on Linux.
That's a topic for another PR though, I agree.

[MSP-Greg]

The previous commit that updated to 1.0.2q had quite a few files. 1.0.2u should be compatible with 1.0.1, but I thought I'd split the commits up in case there are issues and some need to be reverted.

[eregon]

This looks good to me.

[MSP-Greg]

Fixed commit subject typo 'OpeSSL' => 'OpenSSL'

[mislav]

Thank you; this looks good to me!