# Contributor: Ariadne Conill <ariadne@dereferenced.org>
# Contributor: Timo Teras <timo.teras@iki.fi>
# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
pkgname=openssl
pkgver=3.3.7
_abiver=${pkgver%.*.*}
pkgrel=2
pkgdesc="Toolkit for Transport Layer Security (TLS)"
url="https://www.openssl.org/"
arch="all"
license="Apache-2.0"
provider_priority=100  # highest
replaces="openssl"
makedepends_build="perl"
makedepends_host="linux-headers"
makedepends="$makedepends_host $makedepends_build"
subpackages="$pkgname-dbg $pkgname-libs-static $pkgname-dev $pkgname-doc
	$pkgname-misc::noarch libcrypto$_abiver:_libcrypto libssl$_abiver:_libssl"
source="https://github.com/openssl/openssl/releases/download/openssl-$pkgver/openssl-$pkgver.tar.gz
	auxv.patch
	man-section.patch
	CVE-2026-34182.patch
	CVE-2026-34183.patch
	CVE-2026-42766.patch
	CVE-2026-42768.patch
	CVE-2026-42770.patch
	CVE-2026-45445.patch
	CVE-2026-45446.patch
	CVE-2026-45447.patch
	CVE-2026-63072.patch
	CVE-2026-63073.patch
	CVE-2026-63076.patch
	CVE-2026-75803.patch
	CVE-2026-9076.patch
	CVE-2026-35189.patch
	CVE-2026-54872.patch
	CVE-2026-54875.patch
	CVE-2026-72897.patch
	CVE-2026-75804.patch
	CVE-2026-75805.patch
	CVE-2026-75806.patch
	CVE-2026-77696.patch
	CVE-2026-84782.patch
	CVE-2026-84784.patch
	"
builddir="$srcdir/openssl-$pkgver"

# secfixes:
#   3.3.7-r2:
#     - CVE-2026-35189
#     - CVE-2026-54872
#     - CVE-2026-54875
#     - CVE-2026-72897
#     - CVE-2026-75804
#     - CVE-2026-75805
#     - CVE-2026-75806
#     - CVE-2026-77696
#     - CVE-2026-84782
#     - CVE-2026-84784
#   3.3.7-r1:
#     - CVE-2026-34182
#     - CVE-2026-34183
#     - CVE-2026-42766
#     - CVE-2026-42768
#     - CVE-2026-42770
#     - CVE-2026-45445
#     - CVE-2026-45446
#     - CVE-2026-45447
#     - CVE-2026-63072
#     - CVE-2026-63073
#     - CVE-2026-63076
#     - CVE-2026-75803
#     - CVE-2026-9076
#   3.3.7-r0:
#     - CVE-2026-28387
#     - CVE-2026-28388
#     - CVE-2026-28389
#     - CVE-2026-28390
#     - CVE-2026-31789
#     - CVE-2026-31790
#   3.3.6-r0:
#     - CVE-2025-15467
#     - CVE-2025-15468
#     - CVE-2025-66199
#     - CVE-2025-68160
#     - CVE-2025-69418
#     - CVE-2025-69419
#     - CVE-2025-69420
#     - CVE-2025-69421
#     - CVE-2026-22795
#     - CVE-2026-22796
#   3.3.5-r0:
#     - CVE-2025-9230
#     - CVE-2025-9231
#     - CVE-2025-9232
#   3.3.3-r0:
#     - CVE-2024-12797
#   3.3.2-r5:
#     - CVE-2024-13176
#   3.3.2-r3:
#     - CVE-2024-9143
#   3.3.2-r0:
#     - CVE-2024-6119
#   3.3.1-r1:
#     - CVE-2024-5535
#   3.3.0-r3:
#     - CVE-2024-4741
#   3.3.0-r2:
#     - CVE-2024-4603
#   3.2.1-r2:
#     - CVE-2024-2511
#   3.1.4-r5:
#     - CVE-2024-0727
#   3.1.4-r4:
#     - CVE-2023-6237
#   3.1.4-r3:
#     - CVE-2023-6129
#   3.1.4-r1:
#     - CVE-2023-5678
#   3.1.4-r0:
#     - CVE-2023-5363
#   3.1.2-r0:
#     - CVE-2023-3817
#   3.1.1-r3:
#     - CVE-2023-3446
#   3.1.1-r2:
#     - CVE-2023-2975
#   3.1.1-r0:
#     - CVE-2023-2650
#   3.1.0-r4:
#     - CVE-2023-1255
#   3.1.0-r2:
#     - CVE-2023-0465
#   3.1.0-r1:
#     - CVE-2023-0464
#   3.0.8-r0:
#     - CVE-2022-4203
#     - CVE-2022-4304
#     - CVE-2022-4450
#     - CVE-2023-0215
#     - CVE-2023-0216
#     - CVE-2023-0217
#     - CVE-2023-0286
#     - CVE-2023-0401
#   3.0.7-r2:
#     - CVE-2022-3996
#   3.0.7-r0:
#     - CVE-2022-3786
#     - CVE-2022-3602
#   3.0.6-r0:
#     - CVE-2022-3358
#   3.0.5-r0:
#     - CVE-2022-2097
#   3.0.3-r0:
#     - CVE-2022-1343
#     - CVE-2022-1434
#     - CVE-2022-1473
#   3.0.2-r0:
#     - CVE-2022-0778
#   3.0.1-r0:
#     - CVE-2021-4044
#   1.1.1l-r0:
#     - CVE-2021-3711
#     - CVE-2021-3712
#   1.1.1k-r0:
#     - CVE-2021-3449
#     - CVE-2021-3450
#   1.1.1j-r0:
#     - CVE-2021-23841
#     - CVE-2021-23840
#     - CVE-2021-23839
#   1.1.1i-r0:
#     - CVE-2020-1971
#   1.1.1g-r0:
#     - CVE-2020-1967
#   1.1.1d-r3:
#     - CVE-2019-1551
#   1.1.1d-r1:
#     - CVE-2019-1547
#     - CVE-2019-1549
#     - CVE-2019-1563
#   1.1.1b-r1:
#     - CVE-2019-1543
#   1.1.1a-r0:
#     - CVE-2018-0734
#     - CVE-2018-0735
#   0:
#     - CVE-2022-1292
#     - CVE-2022-2068
#     - CVE-2022-2274
#     - CVE-2023-0466
#     - CVE-2023-4807

build() {
	local _target _optflags

	# openssl will prepend crosscompile always core CC et al
	CC=${CC#"$CROSS_COMPILE"}
	CXX=${CXX#"$CROSS_COMPILE"}
	CPP=${CPP#"$CROSS_COMPILE"}

	# determine target OS for openssl
	case "$CARCH" in
		aarch64*)	_target="linux-aarch64" ;;
		arm*)		_target="linux-armv4" ;;
		mips64*)	_target="linux64-mips64" ;;
		# explicit _optflags is needed to prevent automatic -mips3 addition
		mips*)		_target="linux-mips32"; _optflags="-mips32" ;;
		ppc)		_target="linux-ppc" ;;
		ppc64)		_target="linux-ppc64" ;;
		ppc64le)	_target="linux-ppc64le" ;;
		x86)		_target="linux-elf" ;;
		x86_64)		_target="linux-x86_64"; _optflags="enable-ec_nistp_64_gcc_128" ;;
		s390x)		_target="linux64-s390x";;
		riscv64)	_target="linux64-riscv64";;
		loongarch64)	_target="linux64-loongarch64";;
		*)		msg "Unable to determine architecture from (CARCH=$CARCH)" ; return 1 ;;
	esac

	# Configure assumes --options are for it, so can't use
	# gcc's --sysroot fake this by overriding CC
	[ -n "$CBUILDROOT" ] && CC="$CC --sysroot=$CBUILDROOT"

	# when cross building do not enable threads as libatomic is not avaiable
	if [ "$CBUILD" != "$CHOST" ]; then
		_optflags="$_optflags no-threads"
	fi

	perl ./Configure \
		$_target \
		--prefix=/usr \
		--libdir=lib \
		--openssldir=/etc/ssl \
		enable-ktls \
		shared \
		no-zlib \
		no-async \
		no-comp \
		no-idea \
		no-mdc2 \
		no-rc5 \
		no-ec2m \
		no-ssl3 \
		no-seed \
		no-weak-ssl-ciphers \
		$_optflags \
		$CPPFLAGS \
		$CFLAGS \
		$LDFLAGS -Wa,--noexecstack

	# dump configuration into logs
	perl configdata.pm --dump

	make
}

check() {
	# AFALG tests have a sporadic test failure, just delete the broken
	# test for now.
	rm -f test/recipes/30-test_afalg.t

	make test
}

package() {
	depends="libssl$_abiver=$pkgver-r$pkgrel libcrypto$_abiver=$pkgver-r$pkgrel"
	provides="openssl3=$pkgver-r$pkgrel"
	replaces="openssl3"

	make DESTDIR="$pkgdir" install
	# remove the script c_rehash
	rm "$pkgdir"/usr/bin/c_rehash
}

dev() {
	provides="openssl3-dev=$pkgver-r$pkgrel"
	replaces="openssl3-dev"

	default_dev
}

misc() {
	depends="$pkgname=$pkgver-r$pkgrel perl"
	pkgdesc="Various perl scripts from $pkgname"

	amove etc/ssl/misc
}

_libcrypto() {
	pkgdesc="Crypto library from openssl"
	replaces="libcrypto1.1"

	amove etc
	amove usr/lib/libcrypto*
	amove usr/lib/engines-$_abiver
	amove usr/lib/ossl-modules
}

_libssl() {
	pkgdesc="SSL shared libraries"
	depends="libcrypto$_abiver=$pkgver-r$pkgrel"

	amove usr/lib/libssl*
}

sha512sums="
ff7976bfc5549f7f0d80cc55b4e1e9abaeb0f931028e47660e9738168b399d838354b2ca67338e2fd5443f3eb06912ea64cb1de0ab98bd04cfe3cc252d7b7f8d  openssl-3.3.7.tar.gz
b2541075148fd5af4552d34158deb1a325f5adced90626dc03fd126f47323cde949b15b2657523c34b26530b322312a43bd42ada7295b4f2dd1d3b5d11892c62  auxv.patch
81b6d323948049469a115cc80812ef69876b7af841dbee70b5e1af321401cf4a14fda3214f74b0f0ad2d531c4aa2b9a8b5eea502abf139ce83bcc03954e1197c  man-section.patch
f98ceea6e9625b40df12f2515bc63128f0ee4a742f12b6291fe93f329087b83efe0350bfaffb8853919d6aa2aff7480a9ff70da955a51962b4e439e5fbea2651  CVE-2026-34182.patch
e330e47ab00ea778d9fd1f460d916a58a3283e1d7d0c5b45ba45e79318b2e093147adeb6189e20c44c7973bb58bf86639e2b5211f8c5f80458a9d66a82a10048  CVE-2026-34183.patch
e8494e35bd03544e4c2c8525c5fcf17cab81b4046be4c675f913b427b5ad8bbb6d902f6a75b0f5305159b85a7a48ade789bc39e5dbcc38afdcd7338bfcfe728d  CVE-2026-42766.patch
299a0c8a77a7a8ff67b9035dd62e44052efad6a666634d417b92d00cf8fc58ef2fe133bdece5ed2d4597095bcd76004f9fdede9c8989f5f6ba64b4c8294bc64b  CVE-2026-42768.patch
e1e51fdc2c405b698001e8b28c524ac1668613d7d15941c085f82b145f0c81e456ba2fad00dddbcdcf1956ec7ef6b70bdb1c3081b25f76844894fda717b5ae00  CVE-2026-42770.patch
ea339f34911aaef0a1d012f6402bf17e8d168323131f57b1d2e08a9eaa18c3c0764eb13f9275be027e1c551789790bf2d1247afd53055684a4095ea37e27e21e  CVE-2026-45445.patch
47a1eeca4bb1e52e9b2ab7e3ebd6361551d2957cfa1aa63d0efcf4ea5d0b631858e1e4cefb831e1c88fdc5633dc6f85c0f07ed3dc2d25e57eae751636f9549cd  CVE-2026-45446.patch
abd8bc34d492950c6a48114979726fa2cadb9b1ab771af4c9d36acf6909e1163f16c79006b1035fbd9656138afea99119ffa1cfa62b2a3c82510c9e736dc2b8d  CVE-2026-45447.patch
930b3ff28d532932c7ff4e071c4efffe2ff49de2416bc0c635f938397f84f361f78a0512b51fb3b9b4f78e714b6b98d2846f30f441e3a9f87bf50d347559ddd3  CVE-2026-63072.patch
34458c89d1ed48ef0a43455f185c7352e4dc0adaf2862255fbc398d261cf84a83380aea44d02a1e4b0ad4c8be19aae2f0435a6f880d16f98ef90a5d1836db476  CVE-2026-63073.patch
4bb138f82328a7bdf0f0e44037134576217fe24b1d7f48fbd203a0d070db45968c74fa996365cada469e2dd6f0f4b0365ad5c6ed656721c03d6a6d6c77b30aa8  CVE-2026-63076.patch
1bf1a2be2440b9cb212a30cc8aed1df61d2622f1c22940cafec7ce5e5b2b557da0cc3e326b7ec453c1c34141edf05812dd928d321444e49370c715c2f7dc8b85  CVE-2026-75803.patch
e45b1d375abb9a86f9525ab301df73a51c77de8fa27f6d7b303fb7cd0a28b6dd3894c29754e7219f8600495705db0dc17842ca8bbc2a7fb6da990834a83fb5f7  CVE-2026-9076.patch
4b338ff69b47c6a606e79e4848613fb5095ea8f3c001606a085889c74f9fcd62e95591e121ae4bfac52c91909889809806e21b335e2f9f1548cfb3d978fafc55  CVE-2026-35189.patch
4b78bd4f2d0c9afac7f4a6cdabf7f5039927930b5fe6b095e31258569f5811369b28077eef836bd6e2007eb6c198db2212335ae20e1386d44a25519684c05d1d  CVE-2026-54872.patch
ca49ebd79af492688eaae334042e8d1dd838f2e06c1301c961c4265cecec63566ceecb1ba10a732b701d032a4a2428d09346a5d1215be655904c6dd58f05b02f  CVE-2026-54875.patch
241d11fe1548f2b720d7cb5a1172bb8d14876db6ce99edf23f5f1a384f64569d57d65780f5af1ec40dd4f758854a266f637ad5b1b5966e5fd27327ccff2fa4bd  CVE-2026-72897.patch
25e1ba27c83642d6aa33808a9fc2527c2a7053f469e1436c733c6cc83cfe5b19fcbe046dd7c57869a1bc9df077aedda4c50933cffa82601238b90643eec0b6bf  CVE-2026-75804.patch
6efa52c5890fef3ebb82816ab968ec3be2b39d4284212b2a07b464202466b8ad3de92df4cba3ee0cbe30b519574a95bf4f6ff2941e73da7c947957612c4991bf  CVE-2026-75805.patch
005da2ed92529188e022cf428e6de8645fb8f4d2ff41a75cf06e50622ce41747e7a3fe93097033db74083e09dbf1a3408e61b2fdf0a24e81e29444593cf3f6b4  CVE-2026-75806.patch
ad0933895ad2ea4e545b1e76e65ac929cfdba9a68d5cfa1408b70fc32f804f5fbf822e141b119eef3f1cdf142f8427615591632a3d572d331c8db2591fdfe07c  CVE-2026-77696.patch
47cf2468691d5a4b612f9d036a3745a051328228e88a26e86fcdb6dda835e021965800817cbb7feb5ec359f7eefa3d628077c0372e1e1f8285fc48c7c4ffc7e7  CVE-2026-84782.patch
79ebd48d9bc458100d7c932222f4b42fe0e846f4b86db11cfebb6cc126c65643b2478342074a9cdc8b8b18e7e8357cccd7c16c0c0d5f09d6bc39d49e322ec1a5  CVE-2026-84784.patch
"
