1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69

#
# This file and its contents are supplied under the terms of the
# Common Development and Distribution License ("CDDL"), version 1.0.
# You may only use this file in accordance with the terms of version
# 1.0 of the CDDL.
#
# A full copy of the text of the CDDL should have accompanied this
# source.  A copy of the CDDL is also available via the Internet at
# http://www.illumos.org/license/CDDL.
#

#
# Copyright 2026 Zygaena Project
#
# Hammerhead: OpenSSL 3.5 wrapper
#
# Wraps OpenSSL's own Configure/make build. Builds and installs libcrypto,
# libssl, the openssl(1) app, and the provider modules (default + legacy)
# into the proto area as shared objects. No static archives are shipped.
#
# Out-of-source build in $(BUILDDIR) — the vendored source under
# $(CONTRIB)/openssl stays pristine. Uses the toolchain gcc directly
# ($(GNUC_ROOT)/bin/gcc); $(CC) can't be used because it expands to the
# full LD_ALTEXEC command with all flags. The stock solaris64-x86_64-gcc
# target links cleanly through gnu-ld-wrapper (validated 2026-07-06).
#
# --libdir=lib forces the provider module dir to /usr/lib/ossl-modules;
# OpenSSL otherwise defaults to /usr/lib/64/ossl-modules, which violates
# Hammerhead's flat /usr/lib layout.
#
# install_sw installs libs/headers/apps/modules; install_ssldirs installs
# the /etc/ssl tree (certs) — the large man-page install is skipped. Our own
# openssl.cnf (default + legacy providers activated; legacy provides the
# MD4/RC4/DES that Kerberos RC4-HMAC and NTLM/SMB-to-AD need) is then copied
# over the stock one.
#

include ../../Makefile.master

CONTRIBDIR =	$(CONTRIB)/openssl
BUILDDIR =	$(CURDIR)/build

CONFIGURE_FLAGS = \
	solaris64-x86_64-gcc \
	--prefix=/usr \
	--openssldir=/etc/ssl \
	--libdir=lib \
	shared \
	CC=$(GNUC_ROOT)/bin/gcc

all: $(BUILDDIR)/Makefile
	$(MAKE) -C $(BUILDDIR)

$(BUILDDIR)/Makefile: $(CONTRIBDIR)/Configure
	mkdir -p $(BUILDDIR)
	cd $(BUILDDIR) && perl $(CONTRIBDIR)/Configure $(CONFIGURE_FLAGS)

install: all
	cd $(BUILDDIR) && $(MAKE) install_sw install_ssldirs DESTDIR=$(ROOT)
	cp -f $(CURDIR)/openssl.cnf $(ROOT)/etc/ssl/openssl.cnf
	# OpenSSL ships no CA bundle; provide one at OPENSSLDIR/cert.pem (also what
	# curl was built to use, --with-ca-bundle=/etc/ssl/cert.pem). Without it,
	# HTTPS clients fail (curl exit 77 CACERT_BADFILE).
	cp -f $(CURDIR)/cert.pem $(ROOT)/etc/ssl/cert.pem

clean:
	$(RM) -r $(BUILDDIR)

clobber: clean