Update Python 3.11+ to OpenSSL 3.0.15 (#95)

* add openssl 3.0.15 checksum

* update openssl for non-windows

* Windows openssl 3.0.15

* Url fix

* Allow LICENSE.txt

* Find license file

* copy applink.c

* disable atomics for i386

* link against openssl in lib64

* use same dir convention as before

* fix lib dir for cmake?

checksums/openssl-3.0.15.tar.gz.sha256

@@ -0,0 +1 @@
+23c666d0edf20f14249b3d8f0368acaee9ab585b09e1de82107c66e1f3ec9533  openssl-3.0.15.tar.gz

scripts/build_cosmo.sh

@@ -51,7 +51,11 @@ echo "::endgroup::"
 echo "::group::OpenSSL"
 cd ${BUILDDIR}
 
-download_verify_extract openssl-1.1.1w.tar.gz
+if (( ${PYTHON_MINOR} < 11 )); then
+  download_verify_extract openssl-1.1.1w.tar.gz
+else
+  download_verify_extract openssl-3.0.15.tar.gz
+fi
 cd openssl*
 ./Configure linux-generic64 no-asm no-shared no-dso no-engine --prefix=${DEPSDIR} --openssldir=${DEPSDIR}
 make -j4

scripts/build_freebsd.sh

@@ -31,7 +31,11 @@ echo "::endgroup::"
 echo "::group::OpenSSL"
 cd ${BUILDDIR}
 
-download_verify_extract openssl-1.1.1w.tar.gz
+if (( ${PYTHON_MINOR} < 11 )); then
+  download_verify_extract openssl-1.1.1w.tar.gz
+else
+  download_verify_extract openssl-3.0.15.tar.gz
+fi
 cd openssl*
 ./Configure BSD-${ARCH} --prefix=${DEPSDIR} --openssldir=${DEPSDIR}
 gmake -j4

scripts/build_linux_zig.sh

@@ -126,12 +126,16 @@ echo "::endgroup::"
 echo "::group::OpenSSL"
 cd ${BUILDDIR}
 
-download_verify_extract openssl-1.1.1w.tar.gz
+if (( ${PYTHON_MINOR} < 11 )); then
+  download_verify_extract openssl-1.1.1w.tar.gz
+else
+  download_verify_extract openssl-3.0.15.tar.gz
+fi
 cd openssl*
 if [[ "${ARCH}" == "arm" ]]; then
   ./Configure linux-generic32 no-shared --prefix=${DEPSDIR} --openssldir=${DEPSDIR}
 elif [[ "${ARCH}" == "i386" ]]; then
-  ./Configure linux-x86 no-shared --prefix=${DEPSDIR} --openssldir=${DEPSDIR}
+  CFLAGS="${CFLAGS} -fgnuc-version=0 -D__STDC_NO_ATOMICS__" ./Configure linux-x86 no-shared --prefix=${DEPSDIR} --openssldir=${DEPSDIR}
 elif [[ "${ARCH}" == "riscv64" ]]; then
   CFLAGS="${CFLAGS} -fgnuc-version=0 -D__STDC_NO_ATOMICS__" ./Configure linux-generic64 no-shared --prefix=${DEPSDIR} --openssldir=${DEPSDIR}
 else
@@ -508,6 +512,18 @@ if [[ "${DISTRIBUTION}" != "headless" ]]; then
   )
 fi
 
+opensslparams=(-DOPENSSL_INCLUDE_DIR:PATH=${DEPSDIR}/include)
+if [[ "${ARCH}" == "x86_64" && ${PYTHON_MINOR} -ge 11 ]]; then
+  # openssl 3 appears to install to lib64
+  opensslparams+=(
+    -DOPENSSL_LIBRARIES="${DEPSDIR}/lib64/libssl.a;${DEPSDIR}/lib64/libcrypto.a"
+  )
+else
+  opensslparams+=(
+    -DOPENSSL_LIBRARIES="${DEPSDIR}/lib/libssl.a;${DEPSDIR}/lib/libcrypto.a"
+  )
+fi
+
 wget --no-verbose -O portable-python-cmake-buildsystem.tar.gz https://github.com/bjia56/portable-python-cmake-buildsystem/tarball/${CMAKE_BUILDSYSTEM_BRANCH}
 tar -xf portable-python-cmake-buildsystem.tar.gz
 rm *.tar.gz
@@ -531,8 +547,7 @@ LDFLAGS="${LDFLAGS} -lfontconfig -lfreetype" cmake \
   -DINSTALL_TEST=${INSTALL_TEST} \
   -DINSTALL_MANUAL=OFF \
   "${additionalparams[@]}" \
-  -DOPENSSL_INCLUDE_DIR:PATH=${DEPSDIR}/include \
-  -DOPENSSL_LIBRARIES="${DEPSDIR}/lib/libssl.a;${DEPSDIR}/lib/libcrypto.a" \
+  "${opensslparams[@]}" \
   -DSQLite3_INCLUDE_DIR:PATH=${DEPSDIR}/include \
   -DSQLite3_LIBRARY:FILEPATH=${DEPSDIR}/lib/libsqlite3.a \
   -DZLIB_INCLUDE_DIR:PATH=${DEPSDIR}/include \

scripts/build_macos.sh

@@ -92,8 +92,13 @@ fi
 echo "::group::OpenSSL"
 cd ${BUILDDIR}
 
-download_verify_extract openssl-1.1.1w.tar.gz
-cd openssl-1.1.1w
+if (( ${PYTHON_MINOR} < 11 )); then
+  download_verify_extract openssl-1.1.1w.tar.gz
+  cd openssl-1.1.1w
+else
+  download_verify_extract openssl-3.0.15.tar.gz
+  cd openssl-3.0.15
+fi
 CC=${WORKDIR}/scripts/cc ./Configure enable-rc5 zlib no-asm no-shared darwin64-x86_64-cc --prefix=${DEPSDIR}
 make -j${NPROC}
 make install_sw

scripts/build_windows.sh

@@ -19,13 +19,34 @@ echo "::endgroup::"
 echo "::group::OpenSSL"
 cd ${BUILDDIR}
 
-curl -L https://github.com/Slicer/Slicer-OpenSSL/releases/download/1.1.1g/OpenSSL_1_1_1g-install-msvc1900-64-Release.tar.gz --output openssl.tar.gz
-tar -xf openssl.tar.gz
-mv OpenSSL_1_1_1g-install-msvc1900-64-Release ${DEPSDIR}/openssl
-mkdir openssl-1.1.1g
-cd openssl-1.1.1g
-curl -L https://www.openssl.org/source/license-openssl-ssleay.txt --output LICENSE
-install_license
+if (( ${PYTHON_MINOR} < 11 )); then
+  curl -L https://github.com/Slicer/Slicer-OpenSSL/releases/download/1.1.1g/OpenSSL_1_1_1g-install-msvc1900-64-Release.tar.gz --output openssl.tar.gz
+  tar -xf openssl.tar.gz
+  mv OpenSSL_1_1_1g-install-msvc1900-64-Release ${DEPSDIR}/openssl
+  mkdir openssl-1.1.1g
+  cd openssl-1.1.1g
+  curl -L https://www.openssl.org/source/license-openssl-ssleay.txt --output LICENSE
+  install_license
+else
+  curl -L https://github.com/python/cpython-bin-deps/archive/refs/tags/openssl-bin-3.0.15.tar.gz --output cpython-bin-deps-openssl-bin-3.0.15.tar.gz
+  tar -xf cpython-bin-deps-openssl-bin-3.0.15.tar.gz
+  cd cpython-bin-deps-openssl-bin-3.0.15
+  mkdir ${DEPSDIR}/openssl
+  cp -r amd64/include ${DEPSDIR}/openssl/include
+  # cmake apparently wants this here?
+  cp ${DEPSDIR}/openssl/include/applink.c ${DEPSDIR}/openssl/include/openssl/applink.c
+
+  # required by cmake
+  mkdir ${DEPSDIR}/openssl/lib
+  cp amd64/lib* ${DEPSDIR}/openssl/lib/
+
+  # for compatibility with old openssl so we don't need to conditionally copy
+  mkdir ${DEPSDIR}/openssl/bin
+  cp amd64/lib* ${DEPSDIR}/openssl/bin/
+
+  cd amd64
+  install_license LICENSE.txt openssl-3.0.15
+fi
 
 echo "::endgroup::"
 #########

scripts/utils.sh

@@ -41,6 +41,8 @@ ARCH=$1
 PYTHON_FULL_VER=$2
 DISTRIBUTION=$3
 PYTHON_VER=$(echo ${PYTHON_FULL_VER} | cut -d "." -f 1-2)
+PYTHON_MAJOR=$(echo ${PYTHON_VER} | cut -d "." -f 1)
+PYTHON_MINOR=$(echo ${PYTHON_VER} | cut -d "." -f 2)
 export PORTABLE_PYTHON_PY_VER=${PYTHON_VER}
 
 WORKDIR=$(pwd)
@@ -50,6 +52,7 @@ LICENSEDIR=${WORKDIR}/licenses
 
 license_files=$(cat <<-END
 LICENSE
+LICENSE.txt
 COPYING
 END
 )