v2-0001-meson-Refactor-SSL-option.patch

From 09e4c80b3d325e739bdbe6ac02b46df24c9d0c29 Mon Sep 17 00:00:00 2001
From: Nazir Bilal Yavuz <byavuz81@gmail.com>
Date: Fri, 24 Feb 2023 15:35:32 +0300
Subject: [PATCH v2] meson: Refactor SSL option

---
 .cirrus.yml                      |   7 +-
 meson.build                      | 153 ++++++++++++++++++-------------
 meson_options.txt                |   4 +-
 src/interfaces/libpq/meson.build |   2 +-
 src/makefiles/meson.build        |   2 +-
 src/test/ssl/meson.build         |   2 +-
 6 files changed, 97 insertions(+), 73 deletions(-)

diff --git a/.cirrus.yml b/.cirrus.yml
index f212978752..aaf4066366 100644
--- a/.cirrus.yml
+++ b/.cirrus.yml
@@ -181,7 +181,7 @@ task:
     su postgres <<-EOF
       meson setup \
         --buildtype=debug \
-        -Dcassert=true -Dssl=openssl -Duuid=bsd -Dtcl_version=tcl86 -Ddtrace=auto \
+        -Dcassert=true -Duuid=bsd -Dtcl_version=tcl86 -Ddtrace=auto \
         -DPG_TEST_EXTRA="$PG_TEST_EXTRA" \
         -Dextra_lib_dirs=/usr/local/lib -Dextra_include_dirs=/usr/local/include/ \
         build
@@ -243,7 +243,6 @@ LINUX_CONFIGURE_FEATURES: &LINUX_CONFIGURE_FEATURES >-
 
 LINUX_MESON_FEATURES: &LINUX_MESON_FEATURES >-
   -Dllvm=enabled
-  -Dssl=openssl
   -Duuid=e2fs
 
 
@@ -497,7 +496,7 @@ task:
       -Dextra_include_dirs=${brewpath}/include \
       -Dextra_lib_dirs=${brewpath}/lib \
       -Dcassert=true \
-      -Dssl=openssl -Duuid=e2fs -Ddtrace=auto \
+      -Duuid=e2fs -Ddtrace=auto \
       -Dsegsize_blocks=6 \
       -DPG_TEST_EXTRA="$PG_TEST_EXTRA" \
       build
@@ -568,7 +567,7 @@ task:
   # Use /DEBUG:FASTLINK to avoid high memory usage during linking
   configure_script: |
     vcvarsall x64
-    meson setup --backend ninja --buildtype debug -Dc_link_args=/DEBUG:FASTLINK -Dcassert=true -Db_pch=true -Dssl=openssl -Dextra_lib_dirs=c:\openssl\1.1\lib -Dextra_include_dirs=c:\openssl\1.1\include -DTAR=%TAR% -DPG_TEST_EXTRA="%PG_TEST_EXTRA%" build
+    meson setup --backend ninja --buildtype debug -Dc_link_args=/DEBUG:FASTLINK -Dcassert=true -Db_pch=true -Dextra_lib_dirs=c:\openssl\1.1\lib -Dextra_include_dirs=c:\openssl\1.1\include -DTAR=%TAR% -DPG_TEST_EXTRA="%PG_TEST_EXTRA%" build
 
   build_script: |
     vcvarsall x64
diff --git a/meson.build b/meson.build
index 656777820c..7fae0e1c49 100644
--- a/meson.build
+++ b/meson.build
@@ -43,6 +43,7 @@ cc = meson.get_compiler('c')
 
 not_found_dep = dependency('', required: false)
 thread_dep = dependency('threads')
+auto_features = get_option('auto_features')
 
 
 
@@ -1171,80 +1172,104 @@ cdata.set('USE_SYSTEMD', systemd.found() ? 1 : false)
 # Library: SSL
 ###############################################################
 
-if get_option('ssl') == 'openssl'
+ssl = not_found_dep
+ssl_library = 'none'
+sslopt = get_option('ssl')
 
-  # Try to find openssl via pkg-config et al, if that doesn't work
-  # (e.g. because it's provided as part of the OS, like on FreeBSD), look for
-  # the library names that we know about.
+if (sslopt == 'auto' and auto_features.disabled())
+  sslopt = 'none'
+endif
 
-  # via pkg-config et al
-  ssl = dependency('openssl', required: false)
+if sslopt != 'none'
 
-  # via library + headers
-  if not ssl.found()
-    ssl_lib = cc.find_library('ssl',
-      dirs: test_lib_d,
-      header_include_directories: postgres_inc,
-      has_headers: ['openssl/ssl.h', 'openssl/err.h'])
-    crypto_lib = cc.find_library('crypto',
-      dirs: test_lib_d,
-      header_include_directories: postgres_inc)
-    ssl_int = [ssl_lib, crypto_lib]
+  if not ssl.found() and sslopt in ['auto', 'openssl']
+    openssl_required = sslopt == 'openssl'
 
-    ssl = declare_dependency(dependencies: ssl_int,
-                             include_directories: postgres_inc)
-  else
-    cc.has_header('openssl/ssl.h', args: test_c_args, dependencies: ssl, required: true)
-    cc.has_header('openssl/err.h', args: test_c_args, dependencies: ssl, required: true)
+    # Try to find openssl via pkg-config et al, if that doesn't work
+    # (e.g. because it's provided as part of the OS, like on FreeBSD), look for
+    # the library names that we know about.
+
+    # via pkg-config et al
+    ssl = dependency('openssl', required: false)
 
+    # via library + headers
+    if not ssl.found()
+      ssl_lib = cc.find_library('ssl',
+        dirs: test_lib_d,
+        header_include_directories: postgres_inc,
+        has_headers: ['openssl/ssl.h', 'openssl/err.h'])
+      crypto_lib = cc.find_library('crypto',
+        dirs: test_lib_d,
+        header_include_directories: postgres_inc)
+      ssl_int = [ssl_lib, crypto_lib]
+
+      ssl = declare_dependency(dependencies: ssl_int,
+                              include_directories: postgres_inc)
+    elif cc.has_header('openssl/ssl.h', args: test_c_args, dependencies: ssl, required: openssl_required) and \
+         cc.has_header('openssl/err.h', args: test_c_args, dependencies: ssl, required: openssl_required)
     ssl_int = [ssl]
-  endif
+    endif
 
-  check_funcs = [
-    ['CRYPTO_new_ex_data', {'required': true}],
-    ['SSL_new', {'required': true}],
-
-    # Function introduced in OpenSSL 1.0.2.
-    ['X509_get_signature_nid'],
-
-    # Functions introduced in OpenSSL 1.1.0. We used to check for
-    # OPENSSL_VERSION_NUMBER, but that didn't work with 1.1.0, because LibreSSL
-    # defines OPENSSL_VERSION_NUMBER to claim version 2.0.0, even though it
-    # doesn't have these OpenSSL 1.1.0 functions. So check for individual
-    # functions.
-    ['OPENSSL_init_ssl'],
-    ['BIO_get_data'],
-    ['BIO_meth_new'],
-    ['ASN1_STRING_get0_data'],
-    ['HMAC_CTX_new'],
-    ['HMAC_CTX_free'],
-
-    # OpenSSL versions before 1.1.0 required setting callback functions, for
-    # thread-safety. In 1.1.0, it's no longer required, and CRYPTO_lock()
-    # function was removed.
-    ['CRYPTO_lock'],
-
-    # Function introduced in OpenSSL 1.1.1
-    ['X509_get_signature_info'],
-  ]
+    if ssl.found()
+      check_funcs = [
+        ['CRYPTO_new_ex_data', {'required': true}],
+        ['SSL_new', {'required': true}],
+
+        # Function introduced in OpenSSL 1.0.2.
+        ['X509_get_signature_nid'],
+
+        # Functions introduced in OpenSSL 1.1.0. We used to check for
+        # OPENSSL_VERSION_NUMBER, but that didn't work with 1.1.0, because LibreSSL
+        # defines OPENSSL_VERSION_NUMBER to claim version 2.0.0, even though it
+        # doesn't have these OpenSSL 1.1.0 functions. So check for individual
+        # functions.
+        ['OPENSSL_init_ssl'],
+        ['BIO_get_data'],
+        ['BIO_meth_new'],
+        ['ASN1_STRING_get0_data'],
+        ['HMAC_CTX_new'],
+        ['HMAC_CTX_free'],
+
+        # OpenSSL versions before 1.1.0 required setting callback functions, for
+        # thread-safety. In 1.1.0, it's no longer required, and CRYPTO_lock()
+        # function was removed.
+        ['CRYPTO_lock'],
+
+        # Function introduced in OpenSSL 1.1.1
+        ['X509_get_signature_info'],
+      ]
 
-  foreach c : check_funcs
-    func = c.get(0)
-    val = cc.has_function(func, args: test_c_args, dependencies: ssl_int)
-    required = c.get(1, {}).get('required', false)
-    if required and not val
-      error('openssl function @0@ is required'.format(func))
-    elif not required
-      cdata.set('HAVE_' + func.to_upper(), val ? 1 : false)
+      are_openssl_funcs_complete = true
+      foreach c : check_funcs
+        func = c.get(0)
+        val = cc.has_function(func, args: test_c_args, dependencies: ssl_int)
+        required = c.get(1, {}).get('required', false)
+        if required and not val
+          are_openssl_funcs_complete = false
+          openssl_required ? error('openssl function @0@ is required'.format(func)) : \
+                             message('openssl function @0@ is required'.format(func))
+          break
+        elif not required
+          cdata.set('HAVE_' + func.to_upper(), val ? 1 : false)
+        endif
+      endforeach
+
+      if are_openssl_funcs_complete
+        cdata.set('USE_OPENSSL', 1,
+                  description: 'Define to 1 to build with OpenSSL support. (-Dssl=openssl)')
+        cdata.set('OPENSSL_API_COMPAT', '0x10001000L',
+                  description: '''Define to the OpenSSL API version in use. This avoids deprecation warnings from newer OpenSSL versions.''')
+        ssl_library = 'openssl'
+      else
+        ssl = not_found_dep
+      endif
     endif
-  endforeach
+  endif
 
-  cdata.set('USE_OPENSSL', 1,
-            description: 'Define to 1 to build with OpenSSL support. (-Dssl=openssl)')
-  cdata.set('OPENSSL_API_COMPAT', '0x10001000L',
-            description: '''Define to the OpenSSL API version in use. This avoids deprecation warnings from newer OpenSSL versions.''')
-else
-  ssl = not_found_dep
+  # At least one SSL library must be found, otherwise throw an error
+  if sslopt == 'auto' and auto_features.enabled()
+    error('SSL Library could not be found')
+  endif
 endif
 
 
diff --git a/meson_options.txt b/meson_options.txt
index 9d3ef4aa20..3edd3e25df 100644
--- a/meson_options.txt
+++ b/meson_options.txt
@@ -127,8 +127,8 @@ option('readline', type : 'feature', value : 'auto',
 option('selinux', type : 'feature', value : 'disabled',
   description: 'build with SELinux support')
 
-option('ssl', type : 'combo', choices : ['none', 'openssl'],
-  value : 'none',
+option('ssl', type : 'combo', choices : ['auto', 'none', 'openssl'],
+  value : 'auto',
   description: 'use LIB for SSL/TLS support (openssl)')
 
 option('systemd', type : 'feature', value: 'auto',
diff --git a/src/interfaces/libpq/meson.build b/src/interfaces/libpq/meson.build
index 573fd9b6ea..3cd0ddb494 100644
--- a/src/interfaces/libpq/meson.build
+++ b/src/interfaces/libpq/meson.build
@@ -117,7 +117,7 @@ tests += {
       't/001_uri.pl',
       't/002_api.pl',
     ],
-    'env': {'with_ssl': get_option('ssl')},
+    'env': {'with_ssl': ssl_library},
   },
 }
 
diff --git a/src/makefiles/meson.build b/src/makefiles/meson.build
index bf7303dc99..98c2bf9ed1 100644
--- a/src/makefiles/meson.build
+++ b/src/makefiles/meson.build
@@ -66,7 +66,7 @@ pgxs_kv = {
   'SUN_STUDIO_CC': 'no', # not supported so far
 
   # want the chosen option, rather than the library
-  'with_ssl' : get_option('ssl'),
+  'with_ssl' : ssl_library,
   'with_uuid': uuidopt,
 
   'default_port': get_option('pgport'),
diff --git a/src/test/ssl/meson.build b/src/test/ssl/meson.build
index a8d9a5424d..4cda81f3bc 100644
--- a/src/test/ssl/meson.build
+++ b/src/test/ssl/meson.build
@@ -6,7 +6,7 @@ tests += {
   'bd': meson.current_build_dir(),
   'tap': {
     'env': {
-      'with_ssl': get_option('ssl'),
+      'with_ssl': ssl_library,
       'OPENSSL': openssl.path(),
     },
     'tests': [
-- 
2.25.1