From 2aabdaca408d22ce2b6aa078ba58a115f5bd7fe4 Mon Sep 17 00:00:00 2001
From: Remo <remo>
Date: Fri, 15 May 2020 10:13:43 +0200
Subject: [PATCH] openssl: split runtime dependencies of static builds into a
 separate output

---
 .../development/libraries/openssl/default.nix | 38 ++++++++++++++++---
 1 file changed, 32 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index 43170f25d38..6336a060911 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -34,9 +34,22 @@ let
       substituteInPlace crypto/async/arch/async_posix.h \
         --replace '!defined(__ANDROID__) && !defined(__OpenBSD__)' \
                   '!defined(__ANDROID__) && !defined(__OpenBSD__) && 0'
+    '' + optionalString static
+    # On static builds, the ENGINESDIR will be empty, but its path will be
+    # compiled into the library. In order to minimize the runtime dependencies
+    # of packages that statically link openssl, we move it into the OPENSSLDIR,
+    # which will be separated into the 'etc' output.
+    ''
+      substituteInPlace Configurations/unix-Makefile.tmpl \
+        --replace 'ENGINESDIR=$(libdir)/engines-{- $sover_dirname -}' \
+                  'ENGINESDIR=$(OPENSSLDIR)/engines-{- $sover_dirname -}'
     '';
 
-    outputs = [ "bin" "dev" "out" "man" ] ++ optional withDocs "doc";
+    outputs =
+      [ "bin" "dev" "out" "man" ]
+      ++ optional withDocs "doc"
+      # Separate output for the runtime dependencies of the static build.
+      ++ optional static "etc";
     setOutputFlags = false;
     separateDebugInfo = !(stdenv.hostPlatform.useLLVM or false) && stdenv.cc.isGNU;
 
@@ -72,7 +85,17 @@ let
     configureFlags = [
       "shared" # "shared" builds both shared and static libraries
       "--libdir=lib"
-      "--openssldir=etc/ssl"
+      (if !static then
+         "--openssldir=etc/ssl"
+       else
+         # Separate the OPENSSLDIR into its own output, as its path will be
+         # compiled into 'libcrypto.a'. This makes it a runtime dependency of
+         # any package that statically links openssl, so we want to keep that
+         # output minimal. We need to prepend '/.' to the path in order to make
+         # it appear absolute before variable expansion, the 'prefix' would be
+         # prepended to it otherwise.
+         "--openssldir=/.$(etc)/etc/ssl"
+      )
     ] ++ stdenv.lib.optionals withCryptodev [
       "-DHAVE_CRYPTODEV"
       "-DUSE_CRYPTODEV_DIGESTS"
@@ -103,6 +126,8 @@ let
           rm "$out/lib/"*.a
       fi
 
+      # 'etc' is a separate output on static builds only.
+      etc=$out
     '' +
     ''
       mkdir -p $bin
@@ -117,14 +142,15 @@ let
       mv $out/include $dev/
 
       # remove dependency on Perl at runtime
-      rm -r $out/etc/ssl/misc
+      rm -r $etc/etc/ssl/misc
 
-      rmdir $out/etc/ssl/{certs,private}
+      rmdir $etc/etc/ssl/{certs,private}
     '';
 
     postFixup = stdenv.lib.optionalString (!stdenv.hostPlatform.isWindows) ''
-      # Check to make sure the main output doesn't depend on perl
-      if grep -r '${buildPackages.perl}' $out; then
+      # Check to make sure the main output and the static runtime dependencies
+      # don't depend on perl
+      if grep -r '${buildPackages.perl}' $out $etc; then
         echo "Found an erroneous dependency on perl ^^^" >&2
         exit 1
       fi
-- 
2.25.1