Name:               openresty-openssl111
Version:            1.1.1h
Release:            5
Summary:            OpenSSL library for OpenResty

Group:              Development/Libraries

# https://www.openssl.org/source/license.html
License:            OpenSSL
URL:                https://www.openssl.org/
Source0:            https://www.openssl.org/source/openssl-%{version}.tar.gz

Patch0:             openssl-1.1.1f-sess_set_get_cb_yield.patch
Patch99:            0099-copy-dir.sh.patch
Patch100:           CVE-2021-23841.patch
Patch101:           backport-CVE-2022-4450.patch
Patch102:           backport-CVE-2022-4304-Fix-Timing-Oracle-in-RSA-decryption.patch

BuildRoot:          %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)

BuildRequires:      gcc, make, perl, libtool
BuildRequires:      openresty-zlib-devel >= 1.2.11
Requires:           openresty-zlib >= 1.2.11

AutoReqProv:        no

%define openssl_prefix          /usr/local/openresty/openssl111
%define zlib_prefix             /usr/local/openresty/zlib
%define openssl_prefix_asan     /usr/local/openresty-asan/openssl111
%define zlib_prefix_asan        /usr/local/openresty-asan/zlib
%define openssl_prefix_debug    /usr/local/openresty-debug/openssl111
%define zlib_prefix_debug       /usr/local/openresty/zlib

%global _default_patch_fuzz 1
%global debug_package %{nil}

# Remove source code from debuginfo package.
%define __debug_install_post \
  %{_rpmconfigdir}/find-debuginfo.sh %{?_missing_build_ids_terminate_build:--strict-build-id} %{?_find_debuginfo_opts} "%{_builddir}/%{?buildsubdir}"; \
  rm -rf "${RPM_BUILD_ROOT}/usr/src/debug"; \
  mkdir -p "${RPM_BUILD_ROOT}/usr/src/debug/openssl-%{version}"; \
  mkdir -p "${RPM_BUILD_ROOT}/usr/src/debug/tmp"; \
  mkdir -p "${RPM_BUILD_ROOT}/usr/src/debug/builddir"; \
%{nil}

%if 0%{?fedora} >= 27
%undefine _debugsource_packages
%undefine _debuginfo_subpackages
%endif

%if 0%{?rhel} >= 8
%undefine _debugsource_packages
%undefine _debuginfo_subpackages
%endif

%if 0%{?openEuler} >= 2
%undefine _debugsource_packages
%undefine _debuginfo_subpackages
%endif

%description
This OpenSSL library build is specifically for OpenResty uses. It may contain
custom patches from OpenResty.


%package devel

Summary:            Development files for OpenResty's OpenSSL library
Group:              Development/Libraries
Requires:           %{name} = %{version}-%{release}

%description devel
Provides C header and static library for OpenResty's OpenSSL library.


%package asan

Summary:            Clang AddressSanitizer Debug version of the OpenSSL library for OpenResty
Group:              Development/Libraries
BuildRequires:      ccache, gcc, make, perl, clang, compiler-rt, libasan

BuildRequires:      openresty-zlib-asan-devel >= 1.2.11-6
Requires:           openresty-zlib-asan >= 1.2.11-6

%description asan
This is the clang AddressSanitizer version of the OpenSSL library build for OpenResty uses.

%package asan-devel

Summary:            Clang AddressSanitizer version of development files for OpenResty's OpenSSL library
Group:              Development/Libraries
Requires:           openresty-openssl111-asan = %{version}-%{release}

%description asan-devel
Provides C header and static library for the clang AddressSanitizer version of OpenResty's OpenSSL library. This is the clang AddressSanitizer version.

%package debug 
Summary:            Debug version of the OpenSSL library for OpenResty
Group:              Development/Libraries

Requires:           openresty-zlib >= 1.2.11
AutoReqProv:        no

%description debug
This is the debug version of the OpenSSL library build for OpenResty uses.

%package debug-devel

Summary:            Debug version of development files for OpenResty's OpenSSL library
Group:              Development/Libraries
Requires:           openresty-openssl111-debug = %{version}-%{release}

%description debug-devel
Provides C header and static library for the debug version of OpenResty's OpenSSL library. This is the debug version.

%prep
%setup -q -n openssl-%{version}

%patch0 -p1
%patch99 -p1
%patch100 -p1
%patch101 -p1
%patch102 -p1

%build
bash ./copy-dir.sh
./config \
    shared zlib -g3 \
    enable-camellia enable-seed enable-rfc3779 \
    enable-cms enable-md2 enable-rc5 \
    enable-weak-ssl-ciphers \
    enable-ssl3 enable-ssl3-method \
    --prefix=%{openssl_prefix} \
    --libdir=lib \
    -I%{zlib_prefix}/include \
    -L%{zlib_prefix}/lib \
    -Wl,-rpath,%{zlib_prefix}/lib:%{openssl_prefix}/lib

make CC='ccache gcc -fdiagnostics-color=always' %{?_smp_mflags}

cd asan
export ASAN_OPTIONS=detect_leaks=0

./config \
    no-asm \
    enable-camellia enable-seed enable-rfc3779 \
    enable-cms enable-md2 enable-rc5 \
    enable-weak-ssl-ciphers \
    enable-ssl3 enable-ssl3-method \
    shared zlib -g3 -O1 -DPURIFY \
    --prefix=%{openssl_prefix_asan} \
    --libdir=lib \
    -I%{zlib_prefix_asan}/include \
    -L%{zlib_prefix_asan}/lib \
    -Wl,-rpath,%{zlib_prefix_asan}/lib:%{openssl_prefix_asan}/lib

#sed -i 's/ -O3 / -O1 -fno-omit-frame-pointer /g' Makefile
#sed -r -i 's/^([ \t]*)LD_LIBRARY_PATH=[^\\ \t]*/\1LD_LIBRARY_PATH=/g' Makefile.shared

make %{?_smp_mflags} \
    LD_LIBRARY_PATH= \
    CC="ccache clang -fsanitize=address -fcolor-diagnostics -Qunused-arguments"
cd -

cd debug
./config \
    no-asm \
    enable-camellia enable-seed enable-rfc3779 \
    enable-cms enable-md2 enable-rc5 \
    enable-weak-ssl-ciphers \
    enable-ssl3 enable-ssl3-method \
    shared zlib -g3 -O0 -DPURIFY \
    --prefix=%{openssl_prefix_debug} \
    --libdir=lib \
    -I%{zlib_prefix_debug}/include \
    -L%{zlib_prefix_debug}/lib \
    -Wl,-rpath,%{zlib_prefix_debug}/lib:%{openssl_prefix_debug}/lib

sed -i 's/ -O3 / -O0 /g' Makefile

make CC='ccache gcc -fdiagnostics-color=always' %{?_smp_mflags}
cd -

%install
make install_sw DESTDIR=%{buildroot}

chmod 0755 %{buildroot}%{openssl_prefix}/lib/*.so*
chmod 0755 %{buildroot}%{openssl_prefix}/lib/*/*.so*

rm -rf %{buildroot}%{openssl_prefix}/bin/c_rehash
rm -rf %{buildroot}%{openssl_prefix}/lib/pkgconfig
rm -rf %{buildroot}%{openssl_prefix}/misc

# to silence the check-rpath error
export QA_RPATHS=$[ 0x0002 ]

cd asan 
make install_sw DESTDIR=%{buildroot}

chmod +w %{buildroot}%{openssl_prefix_asan}/lib/*.so
chmod +w %{buildroot}%{openssl_prefix_asan}/lib/*/*.so

rm -rf %{buildroot}%{openssl_prefix_asan}/bin/c_rehash
rm -rf %{buildroot}%{openssl_prefix_asan}/lib/pkgconfig
rm -rf %{buildroot}%{openssl_prefix_asan}/misc
cd -

cd debug 
make install_sw DESTDIR=%{buildroot}

chmod +w %{buildroot}%{openssl_prefix_debug}/lib/*.so
chmod +w %{buildroot}%{openssl_prefix_debug}/lib/*/*.so

rm -rf %{buildroot}%{openssl_prefix_debug}/bin/c_rehash
rm -rf %{buildroot}%{openssl_prefix_debug}/lib/pkgconfig
rm -rf %{buildroot}%{openssl_prefix_debug}/misc
cd -

%clean
rm -rf %{buildroot}


%files
%defattr(-,root,root,-)

%attr(0755,root,root) %{openssl_prefix}/bin/openssl
%attr(0755,root,root) %{openssl_prefix}/lib/*.so*
%attr(0755,root,root) %{openssl_prefix}/lib/*/*.so*


%files devel
%defattr(-,root,root,-)

%{openssl_prefix}/include/*
%{openssl_prefix}/lib/*.a

%files asan
%defattr(-,root,root,-)

%attr(0755,root,root) %{openssl_prefix_asan}/bin/openssl
%attr(0755,root,root) %{openssl_prefix_asan}/lib/*.so*
%attr(0755,root,root) %{openssl_prefix_asan}/lib/*/*.so*


%files asan-devel
%defattr(-,root,root,-)

%{openssl_prefix_asan}/include/*
%attr(0755,root,root) %{openssl_prefix_asan}/lib/*.a

%files debug
%defattr(-,root,root,-)

%attr(0755,root,root) %{openssl_prefix_debug}/bin/openssl
%attr(0755,root,root) %{openssl_prefix_debug}/lib/*.so*
%attr(0755,root,root) %{openssl_prefix_debug}/lib/*/*.so*


%files debug-devel
%defattr(-,root,root,-)

%{openssl_prefix_debug}/include/*
%attr(0755,root,root) %{openssl_prefix_debug}/lib/*.a

%changelog
* Wed Dec 27 2023 liningjie <liningjie@xfusion.com> - 1.1.1h-5
- Fix CVE-2022-4304

* Sat Dec 23 2023 liningjie <liningjie@xfusion.com> - 1.1.1h-4
- Fix CVE-2022-4450

* Fri Dec 22 2023 wangxinjian <wangxinjian@xfusion.com> - 1.1.1h-3
- fix CVE-2021-23841

* Thu Mar 24 2022 wulei <wulei80@huawei.com> - 1.1.1h-2
- Delete {?dist}

* Fri Jul 23 2021 Fu Changjie <fu_changjie@qq.com> 1.1.1h-1
- Package init with openresty-openssl 1.1.1h