python · ghost · Nov 13, 2019 · Nov 15, 2019
diff --git a/Makefile.pre.in b/Makefile.pre.in
@@ -195,6 +195,7 @@ ENSUREPIP=      @ENSUREPIP@
 OPENSSL_INCLUDES=@OPENSSL_INCLUDES@
 OPENSSL_LIBS=@OPENSSL_LIBS@
 OPENSSL_LDFLAGS=@OPENSSL_LDFLAGS@
+OPENSSL_STATIC_ROOT=@OPENSSL_STATIC_ROOT@
 
 # Modes for directories, executables and data files created by the
 # install process.  Default to user-only-writable for all file types.

diff --git a/Misc/NEWS.d/next/Build/2019-11-15-16-00-14.bpo-38794.Kc1Wmy.rst b/Misc/NEWS.d/next/Build/2019-11-15-16-00-14.bpo-38794.Kc1Wmy.rst
@@ -0,0 +1,2 @@
+Support linking OpenSSL statically with a new ``--with-openssl-static``
+configure option.
diff --git a/aclocal.m4 b/aclocal.m4
@@ -12,9 +12,9 @@
 # PARTICULAR PURPOSE.
 
 m4_ifndef([AC_CONFIG_MACRO_DIRS], [m4_defun([_AM_CONFIG_MACRO_DIRS], [])m4_defun([AC_CONFIG_MACRO_DIRS], [_AM_CONFIG_MACRO_DIRS($@)])])
-dnl pkg.m4 - Macros to locate and utilise pkg-config.   -*- Autoconf -*-
-dnl serial 11 (pkg-config-0.29.1)
-dnl
+# pkg.m4 - Macros to locate and utilise pkg-config.   -*- Autoconf -*-
+# serial 11 (pkg-config-0.29.1)
+
 dnl Copyright © 2004 Scott James Remnant <[email protected]>.
 dnl Copyright © 2012-2015 Dan Nicholson <[email protected]>
 dnl
@@ -288,5 +288,74 @@ AS_VAR_COPY([$1], [pkg_cv_][$1])
 AS_VAR_IF([$1], [""], [$5], [$4])dnl
 ])dnl PKG_CHECK_VAR
 
+dnl PKG_WITH_MODULES(VARIABLE-PREFIX, MODULES,
+dnl   [ACTION-IF-FOUND],[ACTION-IF-NOT-FOUND],
+dnl   [DESCRIPTION], [DEFAULT])
+dnl ------------------------------------------
+dnl
+dnl Prepare a "--with-" configure option using the lowercase
+dnl [VARIABLE-PREFIX] name, merging the behaviour of AC_ARG_WITH and
+dnl PKG_CHECK_MODULES in a single macro.
+AC_DEFUN([PKG_WITH_MODULES],
+[
+m4_pushdef([with_arg], m4_tolower([$1]))
+
+m4_pushdef([description],
+           [m4_default([$5], [build with ]with_arg[ support])])
+
+m4_pushdef([def_arg], [m4_default([$6], [auto])])
+m4_pushdef([def_action_if_found], [AS_TR_SH([with_]with_arg)=yes])
+m4_pushdef([def_action_if_not_found], [AS_TR_SH([with_]with_arg)=no])
+
+m4_case(def_arg,
+            [yes],[m4_pushdef([with_without], [--without-]with_arg)],
+            [m4_pushdef([with_without],[--with-]with_arg)])
+
+AC_ARG_WITH(with_arg,
+     AS_HELP_STRING(with_without, description[ @<:@default=]def_arg[@:>@]),,
+    [AS_TR_SH([with_]with_arg)=def_arg])
+
+AS_CASE([$AS_TR_SH([with_]with_arg)],
+            [yes],[PKG_CHECK_MODULES([$1],[$2],$3,$4)],
+            [auto],[PKG_CHECK_MODULES([$1],[$2],
+                                        [m4_n([def_action_if_found]) $3],
+                                        [m4_n([def_action_if_not_found]) $4])])
+
+m4_popdef([with_arg])
+m4_popdef([description])
+m4_popdef([def_arg])
+
+])dnl PKG_WITH_MODULES
+
+dnl PKG_HAVE_WITH_MODULES(VARIABLE-PREFIX, MODULES,
+dnl   [DESCRIPTION], [DEFAULT])
+dnl -----------------------------------------------
+dnl
+dnl Convenience macro to trigger AM_CONDITIONAL after PKG_WITH_MODULES
+dnl check._[VARIABLE-PREFIX] is exported as make variable.
+AC_DEFUN([PKG_HAVE_WITH_MODULES],
+[
+PKG_WITH_MODULES([$1],[$2],,,[$3],[$4])
+
+AM_CONDITIONAL([HAVE_][$1],
+               [test "$AS_TR_SH([with_]m4_tolower([$1]))" = "yes"])
+])dnl PKG_HAVE_WITH_MODULES
+
+dnl PKG_HAVE_DEFINE_WITH_MODULES(VARIABLE-PREFIX, MODULES,
+dnl   [DESCRIPTION], [DEFAULT])
+dnl ------------------------------------------------------
+dnl
+dnl Convenience macro to run AM_CONDITIONAL and AC_DEFINE after
+dnl PKG_WITH_MODULES check. HAVE_[VARIABLE-PREFIX] is exported as make
+dnl and preprocessor variable.
+AC_DEFUN([PKG_HAVE_DEFINE_WITH_MODULES],
+[
+PKG_HAVE_WITH_MODULES([$1],[$2],[$3],[$4])
+
+AS_IF([test "$AS_TR_SH([with_]m4_tolower([$1]))" = "yes"],
+        [AC_DEFINE([HAVE_][$1], 1, [Enable ]m4_tolower([$1])[ support])])
+])dnl PKG_HAVE_DEFINE_WITH_MODULES
+
 m4_include([m4/ax_c_float_words_bigendian.m4])
 m4_include([m4/ax_check_openssl.m4])
+m4_include([m4/ax_check_static_openssl.m4])
diff --git a/configure b/configure
@@ -625,6 +625,7 @@ ac_includes_default="\
 ac_subst_vars='LTLIBOBJS
 OPENSSL_LDFLAGS
 OPENSSL_LIBS
+OPENSSL_STATIC_ROOT
 OPENSSL_INCLUDES
 ENSUREPIP
 SRCDIRS
@@ -841,6 +842,7 @@ with_libc
 enable_big_digits
 with_computed_gotos
 with_ensurepip
+with_openssl_static
 with_openssl
 with_ssl_default_suites
 '
@@ -1551,6 +1553,9 @@ Optional Packages:
                           default on supported compilers)
   --with(out)-ensurepip=[=upgrade]
                           "install" or "upgrade" using bundled pip
+  --with-openssl-static=DIR
+                          root of the OpenSSL directory if you want to link
+                          OpenSSL statically.
   --with-openssl=DIR      root of the OpenSSL directory
   --with-ssl-default-suites=[python|openssl|STRING]
                           Override default cipher suites string, python: use
@@ -17071,6 +17076,148 @@ ac_includes_default="$save_includes_default"
 
 # Check for usable OpenSSL
 
+# if --with-openssl-static specified by user, set WITH_OPENSSL_STATIC,
+# OPENSSL_STATIC_ROOT and OPENSSL_INCLUDES
+WITH_OPENSSL_STATIC=false
+
+
+# Check whether --with-openssl-static was given.
+if test "${with_openssl_static+set}" = set; then :
+  withval=$with_openssl_static;
+            case "$withval" in
+            "" | y | ye | yes | n | no)
+            as_fn_error $? "Invalid --with-openssl-static value" "$LINENO" 5
+              ;;
+            *) ssldir="$withval"
+              ;;
+            esac
+
+            WITH_OPENSSL_STATIC=true
+            { $as_echo "$as_me:${as_lineno-$LINENO}: checking for openssl/ssl.h in $ssldir" >&5
+$as_echo_n "checking for openssl/ssl.h in $ssldir... " >&6; }
+            if test -f "$ssldir/include/openssl/ssl.h"; then
+                OPENSSL_INCLUDES="-I$ssldir/include"
+                { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+$as_echo "yes" >&6; }
+            else
+                { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+                as_fn_error $? "Invalid --with-openssl-static value - $ssldir/include/openssl/ssl.h does not exist" "$LINENO" 5
+            fi
+
+            { $as_echo "$as_me:${as_lineno-$LINENO}: checking for libssl.a and libcrypto.a in $ssldir" >&5
+$as_echo_n "checking for libssl.a and libcrypto.a in $ssldir... " >&6; }
+            if test -e "$ssldir/libssl.a" -a -e "$ssldir/libcrypto.a"; then
+                OPENSSL_STATIC_ROOT="$ssldir"
+                { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+$as_echo "yes" >&6; }
+            else
+                { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+                { $as_echo "$as_me:${as_lineno-$LINENO}: checking for libssl.a and libcrypto.a in $ssldir/lib" >&5
+$as_echo_n "checking for libssl.a and libcrypto.a in $ssldir/lib... " >&6; }
+                if test -e "$ssldir/lib/libssl.a" -a -e "$ssldir/lib/libcrypto.a"; then
+                    { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+$as_echo "yes" >&6; }
+                    OPENSSL_STATIC_ROOT="$ssldir/lib"
+                else
+                    { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+                    as_fn_error $? "Invalid --with-openssl-static value - libssl.a and/or libcrypto.a not found" "$LINENO" 5
+                fi
+            fi
+
+            # try the preprocessor and linker with our new flags,
+            # being careful not to pollute the global LIBS, LDFLAGS, and CPPFLAGS
+
+            save_LIBS="$LIBS"
+            save_LDFLAGS="$LDFLAGS"
+            save_CPPFLAGS="$CPPFLAGS"
+
+            echo "Trying link statically with;" \
+                "OPENSSL_LIBS=$OPENSSL_STATIC_ROOT/libssl.a $OPENSSL_STATIC_ROOT/libcrypto.a; " \
+                "OPENSSL_INCLUDES=$OPENSSL_INCLUDES" >&5
+
+            LIBS="$OPENSSL_STATIC_ROOT/libssl.a $OPENSSL_STATIC_ROOT/libcrypto.a $LIBS"
+            CPPFLAGS="$OPENSSL_INCLUDES $CPPFLAGS"
+
+            { $as_echo "$as_me:${as_lineno-$LINENO}: checking if compiling and linking against OpenSSL works" >&5
+$as_echo_n "checking if compiling and linking against OpenSSL works... " >&6; }
+            cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+#include <openssl/ssl.h>
+int
+main ()
+{
+SSL_new(NULL)
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_link "$LINENO"; then :
+
+                    { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+$as_echo "yes" >&6; }
+
+else
+
+                    { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+                    as_fn_error $? "Can't link against OpenSSL in $OPENSSL_STATIC_ROOT" "$LINENO" 5
+
+
+fi
+rm -f core conftest.err conftest.$ac_objext \
+    conftest$ac_exeext conftest.$ac_ext
+
+            { $as_echo "$as_me:${as_lineno-$LINENO}: checking if OpenSSL is compiled with -fPIC" >&5
+$as_echo_n "checking if OpenSSL is compiled with -fPIC... " >&6; }
+
+            LDFLAGS="-shared -fPIC $LDFLAGS"
+            cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+#include <openssl/ssl.h>
+                void test() {
+                    SSL_new(NULL);
+                }
+_ACEOF
+if ac_fn_c_try_link "$LINENO"; then :
+
+                    { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+$as_echo "yes" >&6; }
+
+else
+
+                    { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+                    as_fn_error $? "Can't link shared objects against OpenSSL in $OPENSSL_STATIC_ROOT. Is OpenSSL compiled with -fPIC ?" "$LINENO" 5
+
+fi
+rm -f core conftest.err conftest.$ac_objext \
+    conftest$ac_exeext conftest.$ac_ext
+
+            CPPFLAGS="$save_CPPFLAGS"
+            LDFLAGS="$save_LDFLAGS"
+            LIBS="$save_LIBS"
+
+
+
+
+else
+
+            WITH_OPENSSL_STATIC=false
+
+fi
+
+
+if $WITH_OPENSSL_STATIC; then
+    have_openssl=yes  # AX_CHECK_OPENSSL_STATIC errors out if ssl library not found
+    OPENSSL_LIBS=""
+    OPENSSL_LDFLAGS=""
+
+
+else
+
     found=false
 
 # Check whether --with-openssl was given.
@@ -17273,6 +17420,9 @@ rm -f core conftest.err conftest.$ac_objext \
 
 
 
+    OPENSSL_STATIC_ROOT=""
+
+fi
 
 if test "$have_openssl" = yes; then
     { $as_echo "$as_me:${as_lineno-$LINENO}: checking for X509_VERIFY_PARAM_set1_host in libssl" >&5
@@ -17281,8 +17431,13 @@ $as_echo_n "checking for X509_VERIFY_PARAM_set1_host in libssl... " >&6; }
     save_LIBS="$LIBS"
     save_LDFLAGS="$LDFLAGS"
     save_CPPFLAGS="$CPPFLAGS"
-    LDFLAGS="$LDFLAGS $OPENSSL_LDFLAGS"
-    LIBS="$OPENSSL_LIBS $LIBS"
+
+    if $WITH_OPENSSL_STATIC; then
+        LIBS="$OPENSSL_STATIC_ROOT/libssl.a $OPENSSL_STATIC_ROOT/libcrypto.a $LIBS"
+    else
+        LDFLAGS="$LDFLAGS $OPENSSL_LDFLAGS"
+        LIBS="$OPENSSL_LIBS $LIBS"
+    fi
     CPPFLAGS="$OPENSSL_INCLUDES $CPPFLAGS"
 
     cat confdefs.h - <<_ACEOF >conftest.$ac_ext

diff --git a/configure.ac b/configure.ac
@@ -5562,16 +5562,36 @@ LIBS="$save_LIBS"
 ac_includes_default="$save_includes_default"
 
 # Check for usable OpenSSL
-AX_CHECK_OPENSSL([have_openssl=yes],[have_openssl=no])
+
+# if --with-openssl-static specified by user, set WITH_OPENSSL_STATIC,
+# OPENSSL_STATIC_ROOT and OPENSSL_INCLUDES
+WITH_OPENSSL_STATIC=false
+AX_CHECK_OPENSSL_STATIC()
+if $WITH_OPENSSL_STATIC; then
+    have_openssl=yes  # AX_CHECK_OPENSSL_STATIC errors out if ssl library not found
+    OPENSSL_LIBS=""
+    OPENSSL_LDFLAGS=""
+    AC_SUBST([OPENSSL_LIBS])
+    AC_SUBST([OPENSSL_LDFLAGS])
+else
+    AX_CHECK_OPENSSL([have_openssl=yes],[have_openssl=no])
+    OPENSSL_STATIC_ROOT=""
+    AC_SUBST([OPENSSL_STATIC_ROOT])
+fi
 
 if test "$have_openssl" = yes; then
     AC_MSG_CHECKING([for X509_VERIFY_PARAM_set1_host in libssl])
 
     save_LIBS="$LIBS"
     save_LDFLAGS="$LDFLAGS"
     save_CPPFLAGS="$CPPFLAGS"
-    LDFLAGS="$LDFLAGS $OPENSSL_LDFLAGS"
-    LIBS="$OPENSSL_LIBS $LIBS"
+
+    if $WITH_OPENSSL_STATIC; then
+        LIBS="$OPENSSL_STATIC_ROOT/libssl.a $OPENSSL_STATIC_ROOT/libcrypto.a $LIBS"
+    else
+        LDFLAGS="$LDFLAGS $OPENSSL_LDFLAGS"
+        LIBS="$OPENSSL_LIBS $LIBS"
+    fi
     CPPFLAGS="$OPENSSL_INCLUDES $CPPFLAGS"
 
     AC_LINK_IFELSE([AC_LANG_PROGRAM([
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		Support linking OpenSSL statically with a new ``--with-openssl-static``
		configure option.