init repo.

2024-12-19 13:14:37 +08:00
commit 7d7845acb5
1412 changed files with 596214 additions and 0 deletions
--- a/third_party/openssl-cmake/CMakeLists.txt
+++ b/third_party/openssl-cmake/CMakeLists.txt
@ -0,0 +1,103 @@
+# MIT License
+#
+# Copyright (c) 2015-2023 The ViaDuck Project
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in all
+# copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+#
+
+# cmake_minimum_required(VERSION 3.2...3.27)
+cmake_minimum_required(VERSION 3.1...3.27)
+project(openssl-cmake)
+
+set(BUILD_OPENSSL ON CACHE BOOL "Automated OpenSSL building")
+set(OPENSSL_BUILD_VERSION "1.1.1u" CACHE STRING "OpenSSL version to build")
+set(OPENSSL_USE_STATIC_LIBS ON CACHE STRING "OpenSSL static libs are preferred over shared libs")
+set(OPENSSL_INSTALL_MAN OFF CACHE STRING "Install man pages?")
+set(OPENSSL_MODULES "no-cast no-md2 no-md4 no-mdc2 no-rc4 no-rc5 no-engine no-idea no-mdc2 no-rc5 no-camellia no-ssl3 no-heartbeats no-gost no-deprecated no-capieng no-comp no-dtls no-psk no-srp no-dso no-dsa no-rc2 no-des" CACHE STRING "OpenSSL configure options")
+set(OPENSSL_RPATH "" CACHE STRING "RPath to set during build")
+set(CROSS_ANDROID OFF CACHE BOOL "Cross-compiling for Android?")
+if (CMAKE_CROSSCOMPILING)
+    set(CROSS ON CACHE BOOL "Cross-compiling?")
+else()
+    set(CROSS OFF CACHE BOOL "Cross-compiling?")
+endif()
+set(CROSS_TARGET OFF CACHE STRING "Cross-compilation target")
+set(SYSTEM_OPENSSL OFF CACHE STRING "Use system-provided openssl libraries (instead of prebuilts or building)")
+
+# allow including our modules
+list(APPEND CMAKE_MODULE_PATH "${CMAKE_CURRENT_LIST_DIR}/cmake")
+
+# mimic system ssl and crypto targets
+add_library(ssl INTERFACE)
+add_library(crypto INTERFACE)
+
+if (SYSTEM_OPENSSL)
+    # use system provided openssl
+    find_package(OpenSSL REQUIRED)
+
+    # link fake targets
+    target_link_libraries(ssl INTERFACE OpenSSL::SSL)
+    target_link_libraries(crypto INTERFACE OpenSSL::Crypto)
+    add_custom_target(openssl)
+else()
+    # build our own or use prebuilts
+    
+    # set up prefix
+    if (BUILD_OPENSSL)
+        set(OPENSSL_PREFIX ${CMAKE_CURRENT_BINARY_DIR}/openssl-build/)
+    else()
+        set(OPENSSL_PREFIX ${CMAKE_CURRENT_BINARY_DIR}/openssl-prefix/src/openssl)
+    endif()
+    
+    # predict byproduct names and include directory
+    include(ByproductsOpenSSL)
+    GetOpenSSLByproducts(${OPENSSL_PREFIX} OPENSSL_BYPRODUCTS OPENSSL_INCLUDE_DIR)
+    
+    # set up openssl target
+    if (BUILD_OPENSSL)
+        include(BuildOpenSSL)
+    else()
+        include(PrebuiltOpenSSL)
+    endif()
+    
+    # add imported targets to common target
+    add_dependencies(ssl_static_lib openssl)
+    add_dependencies(ssl_shared_lib openssl)
+    add_dependencies(crypto_static_lib openssl)
+    add_dependencies(crypto_shared_lib openssl)
+    
+    if (OPENSSL_USE_STATIC_LIBS)
+        target_link_libraries(ssl INTERFACE ssl_static_lib)
+        target_link_libraries(crypto INTERFACE crypto_static_lib)
+    else()
+        target_link_libraries(ssl INTERFACE ssl_shared_lib)
+        target_link_libraries(crypto INTERFACE crypto_shared_lib)
+    endif()
+
+    # set include locations
+    target_include_directories(ssl BEFORE INTERFACE $<BUILD_INTERFACE:${OPENSSL_INCLUDE_DIR}>)
+    target_include_directories(crypto BEFORE INTERFACE $<BUILD_INTERFACE:${OPENSSL_INCLUDE_DIR}>)
+
+    install(DIRECTORY ${OPENSSL_PREFIX}/usr/local/bin/ TYPE BIN)
+    install(DIRECTORY ${OPENSSL_PREFIX}/usr/local/include/ TYPE INCLUDE)
+    install(DIRECTORY ${OPENSSL_PREFIX}/usr/local/lib/ TYPE LIB)
+    if (OPENSSL_INSTALL_MAN)
+        install(DIRECTORY ${OPENSSL_PREFIX}/usr/local/share/ TYPE DATA)
+    endif()
+endif()
--- a/third_party/openssl-cmake/LICENSE
+++ b/third_party/openssl-cmake/LICENSE
@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2015-2018 The ViaDuck Project
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
--- a/third_party/openssl-cmake/README.md
+++ b/third_party/openssl-cmake/README.md
@ -0,0 +1,43 @@
+# OpenSSL-CMake
+CMake script supplying `OpenSSL` libraries conveniently, encapsulating the
+`OpenSSL` build system on various platforms.
+
+## Features
+* Allows usage of system OpenSSL
+* Allows trivial and complex building of OpenSSL
+* Allows cross compilation, especially for Android
+* Defaults to prebuilt binaries
+
+## System OpenSSL
+To use the system OpenSSL, simply set `SYSTEM_OPENSSL=ON`.
+
+## Prebuilt OpenSSL
+Default behaviour is the download of a prebuilt binary. This is only intended
+as a convenience for debugging purposes and NOT for production use. 
+Available prebuilt binaries can be viewed [here](https://builds.viaduck.org/prebuilts/openssl/).
+
+## Build OpenSSL
+In order to build `OpenSSL`, set `BUILD_OPENSSL=ON` along with the branch or 
+tag name, for example `OPENSSL_BRANCH=OpenSSL_1_1_0g`. 
+
+### General Cross Compile
+Cross compilation is enabled using `CROSS=ON` and the target is specified using
+`CROSS_TARGET=mingw` along with the optional `CROSS_PREFIX=mingw32-`. 
+
+### Android Cross Compile
+Android requires a special `CROSS_ANDROID=ON`. Using `OpenSSL-CMake` from 
+Gradle's native build does not require additional settings. Otherwise, it is 
+required to set the general NDK variables `ANDROID_NDK_ROOT`, `ANDROID_EABI`, 
+`ANDROID_ARCH`, `ANDROID_API`, `ANDROID_MACHINE`.  
+Cross compile was tested with NDK r18b, r19c and r20.
+
+## Usage
+1. Add `OpenSSL-CMake` as a submodule to your Git project using `git submodule 
+add <URL> external/openssl-cmake`
+2. Initialize the submodule using `git submodule update --init`
+3. In your `CMakeLists.txt` include the directory using 
+`add_subdirectory(external/openssl-cmake)`
+4. Link against `ssl` and `crypto` targets, which will also include the headers
+
+## Licensing
+These scripts, unless otherwise stated, are subject to the MIT license.
--- a/third_party/openssl-cmake/cmake/BuildOpenSSL.cmake
+++ b/third_party/openssl-cmake/cmake/BuildOpenSSL.cmake
@ -0,0 +1,259 @@
+# MIT License
+#
+# Copyright (c) 2015-2023 The ViaDuck Project
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in all
+# copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+#
+
+# build openssl locally
+
+# includes
+include(ProcessorCount)
+include(ExternalProject)
+
+# find packages
+find_package(Git REQUIRED)
+find_package (Python3 COMPONENTS Interpreter REQUIRED)
+# find_package(PythonInterp 3 REQUIRED)
+
+# # used to apply various patches to OpenSSL
+find_program(PATCH_PROGRAM patch)
+if (NOT PATCH_PROGRAM)
+    message(FATAL_ERROR "Cannot find patch utility. This is only required for Android cross-compilation but due to script complexity "
+                        "the requirement is always enforced")
+endif()
+
+# set variables
+ProcessorCount(NUM_JOBS)
+set(OS "UNIX")
+
+if (OPENSSL_BUILD_HASH)
+    set(OPENSSL_CHECK_HASH URL_HASH SHA256=${OPENSSL_BUILD_HASH})
+endif()
+
+# if already built, do not build again
+if (EXISTS ${OPENSSL_PREFIX})
+    message(WARNING "Not building OpenSSL again. Remove ${OPENSSL_PREFIX} for rebuild")
+else()
+    if (NOT OPENSSL_BUILD_VERSION)
+        message(FATAL_ERROR "You must specify OPENSSL_BUILD_VERSION!")
+    endif()
+
+    if (WIN32 AND NOT CROSS)
+        # yep, windows needs special treatment, but neither cygwin nor msys, since they provide an UNIX-like environment
+        
+        if (MINGW)
+            set(OS "WIN32")
+            message(WARNING "Building on windows is experimental")
+            
+            find_program(MSYS_BASH "bash.exe" PATHS "C:/Msys/" "C:/MinGW/msys/" PATH_SUFFIXES "/1.0/bin/" "/bin/"
+                    DOC "Path to MSYS installation")
+            if (NOT MSYS_BASH)
+                message(FATAL_ERROR "Specify MSYS installation path")
+            endif(NOT MSYS_BASH)
+            
+            set(MINGW_MAKE ${CMAKE_MAKE_PROGRAM})
+            message(WARNING "Assuming your make program is a sibling of your compiler (resides in same directory)")
+        elseif(NOT (CYGWIN OR MSYS))
+            message(FATAL_ERROR "Unsupported compiler infrastructure")
+        endif(MINGW)
+        
+        set(MAKE_PROGRAM ${CMAKE_MAKE_PROGRAM})
+    elseif(NOT UNIX)
+        message(FATAL_ERROR "Unsupported platform")
+    else()
+        # for OpenSSL we can only use GNU make, no exotic things like Ninja (MSYS always uses GNU make)
+        find_program(MAKE_PROGRAM make)
+    endif()
+
+    # save old git values for core.autocrlf and core.eol
+    execute_process(COMMAND ${GIT_EXECUTABLE} config --global --get core.autocrlf OUTPUT_VARIABLE GIT_CORE_AUTOCRLF OUTPUT_STRIP_TRAILING_WHITESPACE)
+    execute_process(COMMAND ${GIT_EXECUTABLE} config --global --get core.eol OUTPUT_VARIABLE GIT_CORE_EOL OUTPUT_STRIP_TRAILING_WHITESPACE)
+
+    # on windows we need to replace path to perl since CreateProcess(..) cannot handle unix paths
+    if (WIN32 AND NOT CROSS)
+        set(PERL_PATH_FIX_INSTALL sed -i -- 's/\\/usr\\/bin\\/perl/perl/g' Makefile)
+    else()
+        set(PERL_PATH_FIX_INSTALL true)
+    endif()
+
+    # CROSS and CROSS_ANDROID cannot both be set (because of internal reasons)
+    if (CROSS AND CROSS_ANDROID)
+        # if user set CROSS_ANDROID and CROSS we assume he wants CROSS_ANDROID, so set CROSS to OFF
+        set(CROSS OFF)
+    endif()
+
+    if (CROSS_ANDROID)
+        set(OS "LINUX_CROSS_ANDROID")
+    endif()
+
+    # python helper script for corrent building environment
+    set(BUILD_ENV_TOOL ${PYTHON_EXECUTABLE} ${CMAKE_CURRENT_SOURCE_DIR}/scripts/building_env.py
+        --bash "${MSYS_BASH}" --make "${MINGW_MAKE}" --envfile "${CMAKE_CURRENT_BINARY_DIR}/buildenv.txt" ${OS})
+
+    # user-specified modules
+    set(CONFIGURE_OPENSSL_MODULES ${OPENSSL_MODULES})
+
+    # additional configure script parameters
+    set(CONFIGURE_OPENSSL_PARAMS --libdir=lib)
+    if (OPENSSL_DEBUG_BUILD)
+        set(CONFIGURE_OPENSSL_PARAMS "${CONFIGURE_OPENSSL_PARAMS} no-asm -g3 -O0 -fno-omit-frame-pointer -fno-inline-functions")
+    endif()
+    if (OPENSSL_RPATH)
+        # ridiculous escaping required to pass through cmake, one shell, one makefile and another shell.
+        # \\\\ in shell, \\ in makefile
+        string(REPLACE "\\" "\\\\\\\\" OPENSSL_RPATH_ESCAPED ${OPENSSL_RPATH})
+        # \\$\$ in shell, \$$ in makefile
+        string(REPLACE "\$" "\\\\\$\\\$" OPENSSL_RPATH_ESCAPED ${OPENSSL_RPATH_ESCAPED}) # \$$ in makefile
+        set(CONFIGURE_OPENSSL_PARAMS "${CONFIGURE_OPENSSL_PARAMS} -Wl,-rpath=${OPENSSL_RPATH_ESCAPED}")
+    endif()
+    
+    # set install command depending of choice on man page generation
+    if (OPENSSL_INSTALL_MAN)
+        set(INSTALL_OPENSSL_MAN "install_docs")
+    endif()
+    
+    # disable building tests
+    if (NOT OPENSSL_ENABLE_TESTS)
+        set(CONFIGURE_OPENSSL_MODULES ${CONFIGURE_OPENSSL_MODULES} no-tests)
+        set(COMMAND_TEST "true")
+    endif()
+
+    # cross-compiling
+    if (CROSS)
+        set(COMMAND_CONFIGURE ./Configure ${CONFIGURE_OPENSSL_PARAMS} --cross-compile-prefix=${CROSS_PREFIX} ${CROSS_TARGET} 
+            ${CONFIGURE_OPENSSL_MODULES} --prefix=/usr/local/)
+        set(COMMAND_TEST "true")
+    elseif(CROSS_ANDROID)
+        # required environment configuration is already set (by e.g. ndk) so no need to fiddle around with all the OpenSSL options ...
+        if (NOT ANDROID)
+            message(FATAL_ERROR "Use NDK cmake toolchain or cmake android autoconfig")
+        endif()
+        
+        # arch options
+        if (ARMEABI_V7A)
+            set(OPENSSL_PLATFORM "arm")
+            set(CONFIGURE_OPENSSL_PARAMS ${CONFIGURE_OPENSSL_PARAMS} "-march=armv7-a")
+        else()
+            if (CMAKE_ANDROID_ARCH_ABI MATCHES "arm64-v8a")
+                set(OPENSSL_PLATFORM "arm64")
+            else()
+                set(OPENSSL_PLATFORM ${CMAKE_ANDROID_ARCH_ABI})
+            endif()
+        endif()
+        
+        # collect options to pass via ENV to openssl configure
+        set(FORWARD_ANDROID_NDK "${ANDROID_NDK}")
+        # silence warnings about unused arguments (Clang specific)
+        set(FORWARD_CFLAGS "${CMAKE_C_FLAGS} -Qunused-arguments")
+        set(FORWARD_CXXFLAGS "${CMAKE_CXX_FLAGS} -Qunused-arguments")
+        set(FORWARD_LDFLAGS "${CMAKE_MODULE_LINKER_FLAGS}")
+        set(FORWARD_PATH "${ANDROID_TOOLCHAIN_ROOT}/bin/:${ANDROID_TOOLCHAIN_ROOT}/${ANDROID_TOOLCHAIN_NAME}/bin/")
+        
+        # Android specific configuration options
+        set(CONFIGURE_OPENSSL_MODULES ${CONFIGURE_OPENSSL_MODULES} no-hw)
+        
+        set(COMMAND_CONFIGURE ./Configure android-${OPENSSL_PLATFORM} ${CONFIGURE_OPENSSL_PARAMS} ${CONFIGURE_OPENSSL_MODULES})
+        set(COMMAND_TEST "true")
+    else()                   # detect host system automatically
+        set(COMMAND_CONFIGURE ./config ${CONFIGURE_OPENSSL_PARAMS} ${CONFIGURE_OPENSSL_MODULES})
+        
+        if (NOT COMMAND_TEST)
+            set(COMMAND_TEST ${BUILD_ENV_TOOL} <SOURCE_DIR> -- ${MAKE_PROGRAM} test)
+        endif()
+    endif()
+
+    # build OPENSSL_PATCH_COMMAND
+    include(PatchOpenSSL)
+
+    # file(ARCHIVE_EXTRACT INPUT ${CMAKE_CURRENT_SOURCE_DIR}/openssl-1.1.1u.tar.gz DESTINATION ${CMAKE_CURRENT_BINARY_DIR}/openssl-prefix/)
+
+    # add openssl target
+    ExternalProject_Add(openssl
+        #URL https://mirror.viaduck.org/openssl/openssl-${OPENSSL_BUILD_VERSION}.tar.gz
+        #URL http://127.0.0.1:7788/openssl-${OPENSSL_BUILD_VERSION}.tar.gz
+        URL ${CMAKE_CURRENT_SOURCE_DIR}/openssl-1.1.1u.tar.gz
+        ${OPENSSL_CHECK_HASH}
+        UPDATE_COMMAND ""
+
+        CONFIGURE_COMMAND ${BUILD_ENV_TOOL} <SOURCE_DIR> -- ${COMMAND_CONFIGURE}
+        ${OPENSSL_PATCH_COMMAND}
+
+        BUILD_COMMAND ${BUILD_ENV_TOOL} <SOURCE_DIR> -- ${MAKE_PROGRAM} -j ${NUM_JOBS}
+        BUILD_BYPRODUCTS ${OPENSSL_BYPRODUCTS}
+
+        TEST_BEFORE_INSTALL 1
+        TEST_COMMAND ${COMMAND_TEST}
+
+        INSTALL_COMMAND ${BUILD_ENV_TOOL} <SOURCE_DIR> -- ${PERL_PATH_FIX_INSTALL}
+        COMMAND ${BUILD_ENV_TOOL} <SOURCE_DIR> -- ${MAKE_PROGRAM} DESTDIR=${OPENSSL_PREFIX} install_sw ${INSTALL_OPENSSL_MAN}
+        COMMAND ${CMAKE_COMMAND} -G ${CMAKE_GENERATOR} ${CMAKE_BINARY_DIR}                    # force CMake-reload
+
+        LOG_INSTALL 1
+    )
+
+    # set git config values to openssl requirements (no impact on linux though)
+    ExternalProject_Add_Step(openssl setGitConfig
+        COMMAND ${GIT_EXECUTABLE} config --global core.autocrlf false
+        COMMAND ${GIT_EXECUTABLE} config --global core.eol lf
+        DEPENDEES
+        DEPENDERS download
+        ALWAYS ON
+        INDEPENDENT TRUE
+    )
+
+    # set, don't abort if it fails (due to variables being empty). To realize this we must only call git if the configs
+    # are set globally, otherwise do a no-op command ("echo 1", since "true" is not available everywhere)
+    if (GIT_CORE_AUTOCRLF)
+        set (GIT_CORE_AUTOCRLF_CMD ${GIT_EXECUTABLE} config --global core.autocrlf ${GIT_CORE_AUTOCRLF})
+    else()
+        set (GIT_CORE_AUTOCRLF_CMD echo)
+    endif()
+    if (GIT_CORE_EOL)
+        set (GIT_CORE_EOL_CMD ${GIT_EXECUTABLE} config --global core.eol ${GIT_CORE_EOL})
+    else()
+        set (GIT_CORE_EOL_CMD echo)
+    endif()
+    ##
+
+    # set git config values to previous values
+    ExternalProject_Add_Step(openssl restoreGitConfig
+    # unset first (is required, since old value could be omitted, which wouldn't take any effect in "set"
+        COMMAND ${GIT_EXECUTABLE} config --global --unset core.autocrlf
+        COMMAND ${GIT_EXECUTABLE} config --global --unset core.eol
+
+        COMMAND ${GIT_CORE_AUTOCRLF_CMD}
+        COMMAND ${GIT_CORE_EOL_CMD}
+
+        DEPENDEES download
+        DEPENDERS configure
+        ALWAYS ON
+    )
+
+    # write all "FORWARD_" variables with escaped quotes to file, is picked up by python script
+    get_cmake_property(_variableNames VARIABLES)
+    foreach (_variableName ${_variableNames})
+        if (_variableName MATCHES "^FORWARD_")
+            string(REPLACE "FORWARD_" "" _envName ${_variableName})
+            string(REPLACE "\"" "\\\"" _envValue "${${_variableName}}")
+            set(OUT_FILE "${OUT_FILE}${_envName}=\"${_envValue}\"\n")
+        endif()
+    endforeach()
+    file(WRITE ${CMAKE_CURRENT_BINARY_DIR}/buildenv.txt ${OUT_FILE})
+endif()
--- a/third_party/openssl-cmake/cmake/ByproductsOpenSSL.cmake
+++ b/third_party/openssl-cmake/cmake/ByproductsOpenSSL.cmake
@ -0,0 +1,63 @@
+# MIT License
+#
+# Copyright (c) 2023 The ViaDuck Project
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in all
+# copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+#
+
+# precompute future OpenSSL library paths from prefix dir
+function(GetOpenSSLByproducts OPENSSL_PREFIX_PATH OPENSSL_BYPRODUCTS_VAR OPENSSL_INCLUDE_VAR)
+    # include directory
+    set(${OPENSSL_INCLUDE_VAR} "${OPENSSL_PREFIX_PATH}/usr/local/include" PARENT_SCOPE)
+    
+    if (WIN32)
+        # windows pre/suffixes
+        
+        set(OPENSSL_SHARED_PREFIX "lib")
+        set(OPENSSL_STATIC_PREFIX "lib")
+        set(OPENSSL_SHARED_SUFFIX ".dll.a")
+        set(OPENSSL_STATIC_SUFFIX ".a")
+    else()
+        # unix pre/suffixes
+        
+        set(OPENSSL_SHARED_PREFIX ${CMAKE_SHARED_LIBRARY_PREFIX})
+        set(OPENSSL_STATIC_PREFIX ${CMAKE_STATIC_LIBRARY_PREFIX})
+        set(OPENSSL_SHARED_SUFFIX ${CMAKE_SHARED_LIBRARY_SUFFIX})
+        set(OPENSSL_STATIC_SUFFIX ${CMAKE_STATIC_LIBRARY_SUFFIX})
+    endif()
+    
+    set(OPENSSL_BASE_NAMES crypto ssl)
+    foreach(OPENSSL_BASE_NAME ${OPENSSL_BASE_NAMES})
+        set(OPENSSL_STATIC_LIB ${OPENSSL_PREFIX_PATH}/usr/local/lib/${OPENSSL_STATIC_PREFIX}${OPENSSL_BASE_NAME}${OPENSSL_STATIC_SUFFIX})
+
+        add_library(${OPENSSL_BASE_NAME}_static_lib STATIC IMPORTED GLOBAL)
+        set_property(TARGET ${OPENSSL_BASE_NAME}_static_lib PROPERTY IMPORTED_LOCATION ${OPENSSL_STATIC_LIB})
+        
+        set(OPENSSL_SHARED_LIB ${OPENSSL_PREFIX_PATH}/usr/local/lib/${OPENSSL_SHARED_PREFIX}${OPENSSL_BASE_NAME}${OPENSSL_SHARED_SUFFIX})
+        
+        # windows .dll.a requires unknown import library type
+        add_library(${OPENSSL_BASE_NAME}_shared_lib UNKNOWN IMPORTED GLOBAL)
+        set_property(TARGET ${OPENSSL_BASE_NAME}_shared_lib PROPERTY IMPORTED_LOCATION ${OPENSSL_SHARED_LIB})
+        
+        list(APPEND ${OPENSSL_BYPRODUCTS_VAR} ${OPENSSL_STATIC_LIB} ${OPENSSL_SHARED_LIB})
+    endforeach()
+    
+    # returns
+    set(${OPENSSL_BYPRODUCTS_VAR} ${${OPENSSL_BYPRODUCTS_VAR}} PARENT_SCOPE)
+endfunction()
--- a/third_party/openssl-cmake/cmake/PatchOpenSSL.cmake
+++ b/third_party/openssl-cmake/cmake/PatchOpenSSL.cmake
@ -0,0 +1,59 @@
+# MIT License
+#
+# Copyright (c) 2023 The ViaDuck Project
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in all
+# copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+#
+
+set(OPENSSL_PATCH_N 2)
+
+# fix a failing test, see https://github.com/openssl/openssl/issues/20249
+set(OPENSSL_PATCH_1_FILE ${CMAKE_CURRENT_SOURCE_DIR}/patches/0001-Fix-failing-cms-test-when-no-des-is-used.patch)
+set(OPENSSL_PATCH_1_VERS "3.0.8..3.1.0")
+
+# fix a failing test, see https://github.com/openssl/openssl/pull/22150
+set(OPENSSL_PATCH_2_FILE ${CMAKE_CURRENT_SOURCE_DIR}/patches/0002-Fix-test_cms-if-DSA-is-not-supported.patch)
+set(OPENSSL_PATCH_2_VERS "3.1.3..")
+
+# process patches
+
+set(OPENSSL_PATCH_COMMAND PATCH_COMMAND echo)
+foreach(PATCH_INDEX RANGE 1 ${OPENSSL_PATCH_N})
+    set(PATCH_FILE ${OPENSSL_PATCH_${PATCH_INDEX}_FILE})
+    set(PATCH_VERS ${OPENSSL_PATCH_${PATCH_INDEX}_VERS})
+
+    set(PATCH_APPLY OFF)
+    string(FIND ${PATCH_VERS} ".." PATCH_HAS_RANGE)
+    if (PATCH_HAS_RANGE)
+        string(REGEX MATCH "^([a-zA-Z0-9\\.]*)\\.\\.([a-zA-Z0-9\\.]*)$" PATCH_RANGE_FOUND ${PATCH_VERS})
+
+        if (("${CMAKE_MATCH_1}" STREQUAL "" OR ${OPENSSL_BUILD_VERSION} VERSION_GREATER_EQUAL "${CMAKE_MATCH_1}")
+                AND ("${CMAKE_MATCH_2}" STREQUAL "" OR ${OPENSSL_BUILD_VERSION} VERSION_LESS "${CMAKE_MATCH_2}"))
+            set(PATCH_APPLY ON)
+        endif()
+    else()
+        if (${OPENSSL_BUILD_VERSION} VERSION_EQUAL ${PATCH_VERS})
+            set(PATCH_APPLY ON)
+        endif()
+    endif()
+
+    if (PATCH_APPLY)
+        set(OPENSSL_PATCH_COMMAND ${OPENSSL_PATCH_COMMAND} COMMAND ${PATCH_PROGRAM} -p1 --forward -r - < ${PATCH_FILE} || echo)
+    endif()
+endforeach()
--- a/third_party/openssl-cmake/cmake/PrebuiltOpenSSL.cmake
+++ b/third_party/openssl-cmake/cmake/PrebuiltOpenSSL.cmake
@ -0,0 +1,66 @@
+# MIT License
+#
+# Copyright (c) 2015-2018 The ViaDuck Project
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in all
+# copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+#
+
+# check out prebuilts for the current system
+
+# includes
+include(ExternalProject)
+include(TargetArch)
+
+# autodetect PREBUILT_BRANCH
+if (NOT PREBUILT_BRANCH)
+    target_architecture(ARCH)
+    if (${ARCH} STREQUAL "unknown")
+        message(FATAL_ERROR "Architecture detection failed. Please specify manually.")
+    endif()
+    
+    if (WIN32)
+        # prebuilts on windows use mingw-w64 for building
+        set(ARCH_SYSTEM ${ARCH}-w64-mingw32)
+    elseif(ANDROID)
+        set(ARCH_SYSTEM ${ARCH}-android)
+    elseif(UNIX AND NOT APPLE)
+        set(ARCH_SYSTEM ${ARCH}-linux)
+    else()
+        message(FATAL_ERROR "Prebuilts for this system are not available (yet)!")
+    endif()
+    message(STATUS "Using ${ARCH_SYSTEM} prebuilts")
+endif()
+set(PREBUILT_BRANCH ${ARCH_SYSTEM} CACHE STRING "Branch in OpenSSL-Prebuilts to checkout from")
+
+# auto version
+if (NOT OPENSSL_PREBUILT_VERSION)
+    set(OPENSSL_PREBUILT_VERSION "3.1.5")
+endif()
+
+# add openssl target
+ExternalProject_Add(openssl
+        URL https://builds.viaduck.org/prebuilts/openssl/${OPENSSL_PREBUILT_VERSION}/${PREBUILT_BRANCH}.tar.gz
+
+        UPDATE_COMMAND ""
+        CONFIGURE_COMMAND ""
+        BUILD_COMMAND ""
+        BUILD_BYPRODUCTS ${OPENSSL_BYPRODUCTS}
+        INSTALL_COMMAND ""
+        TEST_COMMAND ""
+)
--- a/third_party/openssl-cmake/cmake/TargetArch.cmake
+++ b/third_party/openssl-cmake/cmake/TargetArch.cmake
@ -0,0 +1,165 @@
+#[[
+Copyright (c) 2012 Petroules Corporation. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the
+following conditions are met:
+
+  1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following
+     disclaimer.
+  2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following
+     disclaimer in the documentation and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
+INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+--
+See https://github.com/axr/solar-cmake
+]]
+
+# Based on the Qt 5 processor detection code, so should be very accurate
+# https://qt.gitorious.org/qt/qtbase/blobs/master/src/corelib/global/qprocessordetection.h
+# Currently handles arm (v5, v6, v7), x86 (32/64), ia64, and ppc (32/64)
+
+# Regarding POWER/PowerPC, just as is noted in the Qt source,
+# "There are many more known variants/revisions that we do not handle/detect."
+
+set(archdetect_c_code "
+#if defined(__arm__) || defined(__TARGET_ARCH_ARM) || defined(_M_ARM) || defined(__aarch64__) || defined(__ARM64__)
+    #if defined(__ARM64_ARCH_8__) \\
+        || defined(__aarch64__) \\
+        || defined(__ARMv8__) \\
+        || defined(__ARMv8_A__)
+        #error cmake_ARCH arm64-v8a
+    #elif defined(__ARM_ARCH_7__) \\
+        || defined(__ARM_ARCH_7A__) \\
+        || defined(__ARM_ARCH_7R__) \\
+        || defined(__ARM_ARCH_7M__) \\
+        || defined(__ARM_ARCH_7S__) \\
+        || defined(_ARM_ARCH_7) \\
+        || defined(__CORE_CORTEXA__) \\
+        || (defined(__TARGET_ARCH_ARM) && __TARGET_ARCH_ARM-0 >= 7)
+        #error cmake_ARCH armeabi-v7a
+    #elif defined(__ARM_ARCH_6__) \\
+        || defined(__ARM_ARCH_6J__) \\
+        || defined(__ARM_ARCH_6T2__) \\
+        || defined(__ARM_ARCH_6Z__) \\
+        || defined(__ARM_ARCH_6K__) \\
+        || defined(__ARM_ARCH_6ZK__) \\
+        || defined(__ARM_ARCH_6M__) \\
+        || (defined(__TARGET_ARCH_ARM) && __TARGET_ARCH_ARM-0 >= 6)
+        #error cmake_ARCH armv6
+    #elif defined(__ARM_ARCH_5TEJ__) \\
+        || (defined(__TARGET_ARCH_ARM) && __TARGET_ARCH_ARM-0 >= 5)
+        #error cmake_ARCH armv5
+    #else
+        #error cmake_ARCH arm
+    #endif
+#elif defined(__i386) || defined(__i386__) || defined(_M_IX86)
+    #error cmake_ARCH i686
+#elif defined(__x86_64) || defined(__x86_64__) || defined(__amd64) || defined(_M_X64)
+    #error cmake_ARCH x86_64
+#elif defined(__ia64) || defined(__ia64__) || defined(_M_IA64)
+    #error cmake_ARCH ia64
+#elif defined(__ppc__) || defined(__ppc) || defined(__powerpc__) \\
+      || defined(_ARCH_COM) || defined(_ARCH_PWR) || defined(_ARCH_PPC)  \\
+      || defined(_M_MPPC) || defined(_M_PPC)
+    #if defined(__ppc64__) || defined(__powerpc64__) || defined(__64BIT__)
+        #error cmake_ARCH ppc64
+    #else
+        #error cmake_ARCH ppc
+    #endif
+#else
+    #error cmake_ARCH unknown
+#endif
+")
+
+# Set ppc_support to TRUE before including this file or ppc and ppc64
+# will be treated as invalid architectures since they are no longer supported by Apple
+
+function(target_architecture output_var)
+    if(APPLE AND CMAKE_OSX_ARCHITECTURES)
+        # On OS X we use CMAKE_OSX_ARCHITECTURES *if* it was set
+        # First let's normalize the order of the values
+
+        # Note that it's not possible to compile PowerPC applications if you are using
+        # the OS X SDK version 10.6 or later - you'll need 10.4/10.5 for that, so we
+        # disable it by default
+        # See this page for more information:
+        # http://stackoverflow.com/questions/5333490/how-can-we-restore-ppc-ppc64-as-well-as-full-10-4-10-5-sdk-support-to-xcode-4
+
+        # Architecture defaults to i386 or ppc on OS X 10.5 and earlier, depending on the CPU type detected at runtime.
+        # On OS X 10.6+ the default is x86_64 if the CPU supports it, i386 otherwise.
+
+        foreach(osx_arch ${CMAKE_OSX_ARCHITECTURES})
+            if("${osx_arch}" STREQUAL "ppc" AND ppc_support)
+                set(osx_arch_ppc TRUE)
+            elseif("${osx_arch}" STREQUAL "i386")
+                set(osx_arch_i386 TRUE)
+            elseif("${osx_arch}" STREQUAL "x86_64")
+                set(osx_arch_x86_64 TRUE)
+            elseif("${osx_arch}" STREQUAL "ppc64" AND ppc_support)
+                set(osx_arch_ppc64 TRUE)
+            else()
+                message(FATAL_ERROR "Invalid OS X arch name: ${osx_arch}")
+            endif()
+        endforeach()
+
+        # Now add all the architectures in our normalized order
+        if(osx_arch_ppc)
+            list(APPEND ARCH ppc)
+        endif()
+
+        if(osx_arch_i386)
+            list(APPEND ARCH i386)
+        endif()
+
+        if(osx_arch_x86_64)
+            list(APPEND ARCH x86_64)
+        endif()
+
+        if(osx_arch_ppc64)
+            list(APPEND ARCH ppc64)
+        endif()
+    else()
+        file(WRITE "${CMAKE_BINARY_DIR}/arch.c" "${archdetect_c_code}")
+
+        enable_language(C)
+
+        # Detect the architecture in a rather creative way...
+        # This compiles a small C program which is a series of ifdefs that selects a
+        # particular #error preprocessor directive whose message string contains the
+        # target architecture. The program will always fail to compile (both because
+        # file is not a valid C program, and obviously because of the presence of the
+        # #error preprocessor directives... but by exploiting the preprocessor in this
+        # way, we can detect the correct target architecture even when cross-compiling,
+        # since the program itself never needs to be run (only the compiler/preprocessor)
+        try_run(
+                run_result_unused
+                compile_result_unused
+                "${CMAKE_BINARY_DIR}"
+                "${CMAKE_BINARY_DIR}/arch.c"
+                COMPILE_OUTPUT_VARIABLE ARCH
+                CMAKE_FLAGS CMAKE_OSX_ARCHITECTURES=${CMAKE_OSX_ARCHITECTURES}
+        )
+
+        # Parse the architecture name from the compiler output
+        string(REGEX MATCH "cmake_ARCH ([a-zA-Z0-9_\-]+)" ARCH "${ARCH}")
+
+        # Get rid of the value marker leaving just the architecture name
+        string(REPLACE "cmake_ARCH " "" ARCH "${ARCH}")
+
+        # If we are compiling with an unknown architecture this variable should
+        # already be set to "unknown" but in the case that it's empty (i.e. due
+        # to a typo in the code), then set it to unknown
+        if (NOT ARCH)
+            set(ARCH unknown)
+        endif()
+    endif()
+
+    set(${output_var} "${ARCH}" PARENT_SCOPE)
+endfunction()
--- a/third_party/openssl-cmake/openssl-1.1.1u.tar.gz
+++ b/third_party/openssl-cmake/openssl-1.1.1u.tar.gz
--- a/third_party/openssl-cmake/patches/.gitkeep
+++ b/third_party/openssl-cmake/patches/.gitkeep
--- a/third_party/openssl-cmake/patches/0001-Fix-failing-cms-test-when-no-des-is-used.patch
+++ b/third_party/openssl-cmake/patches/0001-Fix-failing-cms-test-when-no-des-is-used.patch
@ -0,0 +1,36 @@
+From 87da6db1773f7741e7f92f40907e3282586da28a Mon Sep 17 00:00:00 2001
+From: Bernd Edlinger <bernd.edlinger@hotmail.de>
+Date: Mon, 13 Feb 2023 12:58:33 +0100
+Subject: [PATCH] Fix failing cms test when no-des is used
+
+The test tries to use DES but that may not be available.
+But for the purpose of regression testing CVE-2023-0215
+the cipher is not relevant, so we use AES-128 instead.
+
+Fixes #20249
+
+Reviewed-by: Matt Caswell <matt@openssl.org>
+Reviewed-by: Todd Short <todd.short@me.com>
+(Merged from https://github.com/openssl/openssl/pull/20276)
+
+(cherry picked from commit c400a1fe477b44a5eacbad2be8d50f2eaa92925c)
+---
+ test/recipes/80-test_cms.t | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/test/recipes/80-test_cms.t b/test/recipes/80-test_cms.t
+index abe299b6a2..cabbe3ecdf 100644
+--- a/test/recipes/80-test_cms.t
+++ b/test/recipes/80-test_cms.t
+@@ -989,7 +989,7 @@ with({ exit_checker => sub { return shift == 6; } },
+     sub {
+         ok(run(app(['openssl', 'cms', '-encrypt',
+                     '-in', srctop_file("test", "smcont.txt"),
+-                    '-stream', '-recip',
+                    '-aes128', '-stream', '-recip',
+                     srctop_file("test/smime-certs", "badrsa.pem"),
+                    ])),
+             "Check failure during BIO setup with -stream is handled correctly");
+-- 
+2.35.3
+
--- a/third_party/openssl-cmake/patches/0002-Fix-test_cms-if-DSA-is-not-supported.patch
+++ b/third_party/openssl-cmake/patches/0002-Fix-test_cms-if-DSA-is-not-supported.patch
@ -0,0 +1,36 @@
+From 48685e37684258085532a2a62fefd08098f9a62f Mon Sep 17 00:00:00 2001
+From: Steffen Klee <steffen.klee@gmail.com>
+Date: Wed, 20 Sep 2023 00:04:18 +0200
+Subject: [PATCH] Fix test_cms if DSA is not supported
+
+CLA: trivial
+---
+ test/recipes/80-test_cms.t | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/test/recipes/80-test_cms.t b/test/recipes/80-test_cms.t
+index 21c683c404..3857916105 100644
+--- a/test/recipes/80-test_cms.t
+++ b/test/recipes/80-test_cms.t
+@@ -1144,9 +1144,13 @@ with({ exit_checker => sub { return shift == 6; } },
+ # Test case for return value mis-check reported in #21986
+ with({ exit_checker => sub { return shift == 3; } },
+     sub {
+-        ok(run(app(['openssl', 'cms', '-sign',
+-                    '-in', srctop_file("test", "smcont.txt"),
+-                    '-signer', srctop_file("test/smime-certs", "smdsa1.pem"),
+-                    '-md', 'SHAKE256'])),
+-           "issue#21986");
+        SKIP: {
+          skip "DSA is not supported in this build", 1 if $no_dsa;
+
+          ok(run(app(['openssl', 'cms', '-sign',
+                      '-in', srctop_file("test", "smcont.txt"),
+                      '-signer', srctop_file("test/smime-certs", "smdsa1.pem"),
+                      '-md', 'SHAKE256'])),
+            "issue#21986");
+        }
+     });
+-- 
+2.42.0
+
--- a/third_party/openssl-cmake/scripts/building_env.py
+++ b/third_party/openssl-cmake/scripts/building_env.py
@ -0,0 +1,101 @@
+#!/usr/bin/env python3
+# MIT License
+#
+# Copyright (c) 2015-2023 The ViaDuck Project
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in all
+# copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+#
+
+# creates a building environment for openssl
+# - working directory
+# - on windows: uses msys' bash for command execution (openssl's scripts need an UNIX-like environment with perl)
+
+import argparse
+import os, re
+import sys
+import subprocess
+# from subprocess import PIPE, Popen
+# from sys import exit
+
+parser = argparse.ArgumentParser()
+parser.add_argument('-v', '--verbose', action='store_true')
+parser.add_argument('--bash', nargs='?')
+parser.add_argument('--make', nargs='?')
+parser.add_argument('--envfile')
+parser.add_argument('os')
+parser.add_argument('cwd')
+parser.add_argument('args', nargs='+')
+args = parser.parse_args()
+
+if args.verbose:
+    print(args)
+
+env = os.environ
+env_sep = ';' if args.os == 'WIN32' else ':'
+
+def add_env(k, v):
+    global env
+
+    if k == 'PATH':
+        env[k] = v + ('' if v.endswith(env_sep) else env_sep) + env[k]
+    else:
+        env[k] = v
+
+    if args.verbose:
+        print(f'Updated env[{k}] to "{v}"')
+
+# add bash and make directories to path if specified
+if args.bash is not None and len(args.bash) > 0:
+    add_env('PATH', os.path.dirname(args.bash))
+if args.make is not None and len(args.make) > 0:
+    add_env('PATH', os.path.dirname(args.make))
+
+# os-specifics
+if args.os == 'WIN32':
+    # otherwise: internal error: invalid --jobserver-fds string `gmake_semaphore_1824'
+    add_env('MAKEFLAGS', '')
+elif args.os == 'LINUX_CROSS_ANDROID':
+    # parse A="B" where B has all quotes escaped
+    pattern = re.compile(r'^(.*?)="((?:\\.|[^"\\])*)"', re.MULTILINE | re.DOTALL)
+
+    # parse env vars from file
+    with open(args.envfile, 'r') as f:
+        content = f.read()
+
+    # unescape and save all env vars
+    for k, v in pattern.findall(content):
+        add_env(k, v.replace("\\\"", "\""))
+
+# build command-line
+cmd_exec, cmd_args = args.args[0], ' '.join(args.args[1:])
+cmd_line = f'"{cmd_exec}" {cmd_args} || exit $?'
+
+if args.verbose:
+    print(f'Built cmd_line = "{cmd_line}"')
+
+proc = None
+if args.os == 'WIN32':
+    # we must emulate a UNIX environment to build openssl using mingw
+    proc = subprocess.Popen(bash, env=env, cwd=args.cwd, stdin=subprocess.PIPE, universal_newlines=True)
+    proc.communicate(input=cmd_line)
+else:
+    proc = subprocess.Popen(cmd_line, env=env, cwd=args.cwd, shell=True)
+    proc.communicate()
+
+sys.exit(proc.returncode)
--- a/third_party/openssl-cmake/scripts/update_version.sh
+++ b/third_party/openssl-cmake/scripts/update_version.sh
@ -0,0 +1,4 @@
+#!/bin/bash
+sed -i "s/OPENSSL_BUILD_VERSION: \".*\"/OPENSSL_BUILD_VERSION: \"$1\"/g" .gitlab-ci.yml
+sed -i "s/OPENSSL_BUILD_HASH: \".*\"/OPENSSL_BUILD_HASH: \"$2\"/g" .gitlab-ci.yml
+sed -i "s/set(OPENSSL_PREBUILT_VERSION \".*\"/set(OPENSSL_PREBUILT_VERSION \"$1\"/g" cmake/PrebuiltOpenSSL.cmake
--- a/third_party/openssl-cmake/scripts/upload_result.sh
+++ b/third_party/openssl-cmake/scripts/upload_result.sh
@ -0,0 +1,45 @@
+#!/bin/bash
+# MIT License
+#
+# Copyright (c) 2018-2019 The ViaDuck Project
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in all
+# copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+#
+# usage: <architecture> <directory>
+
+# early exit when no secrets are set
+if [[ $PREBUILT_AUTH = ":" ]]; then
+    echo "No secrets to upload result."
+    exit 0
+fi
+
+# rename dir as arch for tarring
+mkdir -p $1
+mv $2 $1/$2
+tar czf $1.tar.gz $1
+
+# capture the code while printing the page
+{ code=$(curl -u $PREBUILT_AUTH -F "file=@$1.tar.gz" -F "dir=prebuilts/openssl/$OPENSSL_BUILD_VERSION" -F 'checksum=yes' -o /dev/stderr -w '%{http_code}' https://mirror.viaduck.org/scripts/upload.py); } 2>&1
+
+# check for 200
+if [ "$code" -ne 200 ]; then
+    echo "cURL error"
+    exit 1
+fi
+