Adding upstream version 1:7.0.4.upstream/1%7.0.4upstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

16 files changed, 555 insertions, 0 deletions

diff --git a/external/openssl/ExternalPackage_openssl.mk b/external/openssl/ExternalPackage_openssl.mk
new file mode 100644
index 000000000..695c7b711
--- /dev/null
+++ b/external/openssl/ExternalPackage_openssl.mk
@@ -0,0 +1,21 @@
+# -*- Mode: makefile-gmake; tab-width: 4; indent-tabs-mode: t -*-
+#
+# This file is part of the LibreOffice project.
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+#
+
+$(eval $(call gb_ExternalPackage_ExternalPackage,openssl,openssl))
+
+$(eval $(call gb_ExternalPackage_use_external_project,openssl,openssl))
+
+ifeq ($(COM),MSC)
+$(eval $(call gb_ExternalPackage_add_files,openssl,$(LIBO_LIB_FOLDER),\
+	out32dll/ssleay32.dll \
+	out32dll/libeay32.dll \
+))
+endif
+
+# vim: set noet sw=4 ts=4:
diff --git a/external/openssl/ExternalProject_openssl.mk b/external/openssl/ExternalProject_openssl.mk
new file mode 100644
index 000000000..9eaf2cbf6
--- /dev/null
+++ b/external/openssl/ExternalProject_openssl.mk
@@ -0,0 +1,97 @@
+# -*- Mode: makefile-gmake; tab-width: 4; indent-tabs-mode: t -*-
+#
+# This file is part of the LibreOffice project.
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+#
+
+$(eval $(call gb_ExternalProject_ExternalProject,openssl))
+
+$(eval $(call gb_ExternalProject_register_targets,openssl,\
+	build \
+))
+
+# For multi-line conditionals, align the $(if and the corresponding ),
+# putting the latter on a line of its own. Also put the "else" comma
+# on a line of its own. Hopefully should make the logic more clear.
+
+OPENSSL_PLATFORM := \
+  $(if $(filter LINUX FREEBSD ANDROID,$(OS)),\
+    $(if $(filter INTEL,$(CPUNAME)),\
+      $(if $(filter GNU/kFreeBSD,$(shell uname)),debian-kfreebsd-i386,linux-elf)\
+    ,\
+      $(if $(filter X86_64,$(CPUNAME)),\
+        $(if $(filter GNU/kFreeBSD,$(shell uname)),\
+          debian-kfreebsd-amd64\
+        ,\
+          $(if $(filter TRUE, $(ENABLE_DBGUTIL)), debug-linux-generic64, linux-generic64) no-asm\
+        )\
+      ,\
+        $(if $(filter TRUE, $(ENABLE_DBGUTIL)), debug-linux-generic32, linux-generic32)\
+      )\
+    )\
+  ,\
+    $(if $(filter SOLARIS,$(OS)),\
+      $(if $(filter INTEL,$(CPUNAME)),solaris-x86-cc,\
+        $(if $(filter X86_64,$(CPUNAME)),solaris64-x86_64-cc,solaris-sparcv9-cc)\
+      )\
+    ,\
+      $(if $(filter iOS,$(OS)),\
+        ios-armv7\
+      ,\
+        $(if $(filter WNT,$(OS)),\
+          $(if $(filter INTEL,$(CPUNAME)),VC-WIN32,VC-WIN64A)\
+        ,\
+          $(if $(filter MACOSX,$(OS)),\
+            $(if $(filter POWERPC,$(CPUNAME)),darwin-ppc-cc)\
+            $(if $(filter INTEL,$(CPUNAME)),darwin-i386-cc)\
+            $(if $(filter X86_64,$(CPUNAME)),darwin64-x86_64-cc)\
+            $(if $(filter AARCH64,$(CPUNAME)),darwin64-arm64-cc)\
+          )\
+        )\
+      )\
+    )\
+  )
+
+ifeq ($(COM),MSC)
+$(eval $(call gb_ExternalProject_use_nmake,openssl,build))
+
+$(call gb_ExternalProject_get_state_target,openssl,build):
+	$(call gb_Trace_StartRange,openssl,EXTERNAL)
+	$(call gb_ExternalProject_run,build,\
+		export PERL="$(shell cygpath -w $(PERL))" \
+		&& $(PERL) Configure $(OPENSSL_PLATFORM) no-idea \
+		&& cmd /c "ms\do_ms.bat $(PERL) $(OPENSSL_PLATFORM)" \
+		&& nmake -f "ms\ntdll.mak" \
+		&& mv inc32/* include/ \
+	)
+	$(call gb_Trace_EndRange,openssl,EXTERNAL)
+
+else
+$(call gb_ExternalProject_get_state_target,openssl,build):
+	$(call gb_Trace_StartRange,openssl,EXTERNAL)
+	$(call gb_ExternalProject_run,build,\
+		unset MAKEFLAGS && \
+		$(if $(filter LINUX MACOSX FREEBSD ANDROID SOLARIS iOS,$(OS)), \
+			./Configure, \
+		$(if $(filter WNT,$(OS)), \
+			$(PERL) Configure, \
+			./config)) \
+			$(OPENSSL_PLATFORM) no-dso no-shared \
+			$(if $(filter-out WNT,$(OS)),no-idea) \
+			$(if $(filter-out ANDROID iOS WNT,$(OS)), \
+				$(if $(SYSBASE),-I$(SYSBASE)/usr/include -L$(SYSBASE)/usr/lib)) \
+			$(if $(filter MACOSX,$(OS)),--prefix=/@.__________________________________________________OOO) \
+		&& $(MAKE) build_libs \
+			CC="$(CC) -fPIC \
+				$(if $(filter TRUE, $(ENABLE_DBGUTIL)), -DPURIFY,) \
+				$(if $(filter-out WNT MACOSX,$(OS)),-fvisibility=hidden)" \
+		&& ln -s . lib \
+	)
+	$(call gb_Trace_EndRange,openssl,EXTERNAL)
+# symlink lib dir for python3
+endif
+
+# vim: set noet sw=4 ts=4:
diff --git a/external/openssl/Makefile b/external/openssl/Makefile
new file mode 100644
index 000000000..e4968cf85
--- /dev/null
+++ b/external/openssl/Makefile
@@ -0,0 +1,7 @@
+# -*- Mode: makefile-gmake; tab-width: 4; indent-tabs-mode: t -*-
+
+module_directory:=$(dir $(realpath $(firstword $(MAKEFILE_LIST))))
+
+include $(module_directory)/../../solenv/gbuild/partial_build.mk
+
+# vim: set noet sw=4 ts=4:
diff --git a/external/openssl/Module_openssl.mk b/external/openssl/Module_openssl.mk
new file mode 100644
index 000000000..7a03fe536
--- /dev/null
+++ b/external/openssl/Module_openssl.mk
@@ -0,0 +1,18 @@
+# -*- Mode: makefile-gmake; tab-width: 4; indent-tabs-mode: t -*-
+#
+# This file is part of the LibreOffice project.
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+#
+
+$(eval $(call gb_Module_Module,openssl))
+
+$(eval $(call gb_Module_add_targets,openssl,\
+	UnpackedTarball_openssl \
+	ExternalPackage_openssl \
+	ExternalProject_openssl \
+))
+
+# vim: set noet sw=4 ts=4:
diff --git a/external/openssl/README b/external/openssl/README
new file mode 100644
index 000000000..399bdd56f
--- /dev/null
+++ b/external/openssl/README
@@ -0,0 +1,7 @@
+Open Source toolkit implementing SSL and TLS.
+
+From [http://www.openssl.org/].
+
+SSL = Secure Sockets Layer (SSL v2/v3) protocol.
+TLS = Transport Layer Security (TLS v1) protocol.
+
diff --git a/external/openssl/UnpackedTarball_openssl.mk b/external/openssl/UnpackedTarball_openssl.mk
new file mode 100644
index 000000000..f399a0417
--- /dev/null
+++ b/external/openssl/UnpackedTarball_openssl.mk
@@ -0,0 +1,27 @@
+# -*- Mode: makefile-gmake; tab-width: 4; indent-tabs-mode: t -*-
+#
+# This file is part of the LibreOffice project.
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+#
+
+$(eval $(call gb_UnpackedTarball_UnpackedTarball,openssl))
+
+$(eval $(call gb_UnpackedTarball_set_tarball,openssl,$(OPENSSL_TARBALL),,openssl))
+
+$(eval $(call gb_UnpackedTarball_add_patches,openssl,\
+	external/openssl/openssllnx.patch \
+	external/openssl/opensslwnt.patch \
+	$(if $(filter INTEL,$(CPUNAME)),external/openssl/opensslwnt_safeseh.patch) \
+	external/openssl/openssl-1.0.1h-win64.patch.1 \
+	external/openssl/opensslsol.patch \
+	external/openssl/opensslios.patch \
+	external/openssl/opensslosxppc.patch \
+	external/openssl/openssl-3650-masm.patch.1 \
+	external/openssl/openssl-fixbuild.patch.1 \
+	external/openssl/openssl-macos-arm64.patch.1 \
+))
+
+# vim: set noet sw=4 ts=4:
diff --git a/external/openssl/openssl-1.0.1h-win64.patch.1 b/external/openssl/openssl-1.0.1h-win64.patch.1
new file mode 100644
index 000000000..aea914633
--- /dev/null
+++ b/external/openssl/openssl-1.0.1h-win64.patch.1
@@ -0,0 +1,47 @@
+diff --git a/ms/do_win64a.bat b/ms/do_win64a.bat
+index 8768dc6..6772390 100755
+--- a/ms/do_win64a.bat
++++ b/ms/do_win64a.bat
+@@ -1,19 +1,19 @@
+-perl util\mkfiles.pl >MINFO
++perl util/mkfiles.pl >MINFO
+ 
+ cmd /c "nasm -f win64 -v" >NUL 2>&1
+ if %errorlevel% neq 0 goto ml64
+ 
+-perl ms\uplink-x86_64.pl nasm > ms\uptable.asm
+-nasm -f win64 -o ms\uptable.obj ms\uptable.asm
++perl ms/uplink-x86_64.pl nasm > ms/uptable.asm
++nasm -f win64 -o ms/uptable.obj ms/uptable.asm
+ goto proceed
+ 
+ :ml64
+-perl ms\uplink-x86_64.pl masm > ms\uptable.asm
+-ml64 -c -Foms\uptable.obj ms\uptable.asm
++perl ms/uplink-x86_64.pl masm > ms/uptable.asm
++ml64 -c -Foms/uptable.obj ms/uptable.asm
+ 
+ :proceed
+-perl util\mk1mf.pl VC-WIN64A >ms\nt.mak
+-perl util\mk1mf.pl dll VC-WIN64A >ms\ntdll.mak
++perl util/mk1mf.pl VC-WIN64A >ms/nt.mak
++perl util/mk1mf.pl dll VC-WIN64A >ms/ntdll.mak
+ 
+-perl util\mkdef.pl 32 libeay > ms\libeay32.def
+-perl util\mkdef.pl 32 ssleay > ms\ssleay32.def
++perl util/mkdef.pl 32 libeay > ms/libeay32.def
++perl util/mkdef.pl 32 ssleay > ms/ssleay32.def
+diff --git a/util/mk1mf.pl b/util/mk1mf.pl
+index 72fa089..d98def1 100755
+--- a/util/mk1mf.pl
++++ b/util/mk1mf.pl
+@@ -233,6 +233,9 @@ else
+ 	$cflags.=' -DTERMIO';
+ 	}
+ 
++# force unix style path separator
++${o} = "/";
++
+ $fipsdir =~ s/\//${o}/g;
+ 
+ $out_dir=(defined($VARS{'OUT'}))?$VARS{'OUT'}:$out_def.($debug?".dbg":"");
diff --git a/external/openssl/openssl-3650-masm.patch.1 b/external/openssl/openssl-3650-masm.patch.1
new file mode 100644
index 000000000..97f1eb644
--- /dev/null
+++ b/external/openssl/openssl-3650-masm.patch.1
@@ -0,0 +1,35 @@
+diff --git a/crypto/perlasm/x86masm.pl b/crypto/perlasm/x86masm.pl
+index 1741342..917d0f8 100644
+--- a/crypto/perlasm/x86masm.pl
++++ b/crypto/perlasm/x86masm.pl
+@@ -18,10 +18,10 @@ sub ::generic
+ 
+     if ($opcode =~ /lea/ && @arg[1] =~ s/.*PTR\s+(\(.*\))$/OFFSET $1/)	# no []
+     {	$opcode="mov";	}
+-    elsif ($opcode !~ /movq/)
++    elsif ($opcode !~ /mov[dq]$/)
+     {	# fix xmm references
+-	$arg[0] =~ s/\b[A-Z]+WORD\s+PTR/XMMWORD PTR/i if ($arg[1]=~/\bxmm[0-7]\b/i);
+-	$arg[1] =~ s/\b[A-Z]+WORD\s+PTR/XMMWORD PTR/i if ($arg[0]=~/\bxmm[0-7]\b/i);
++	$arg[0] =~ s/\b[A-Z]+WORD\s+PTR/XMMWORD PTR/i if ($arg[-1]=~/\bxmm[0-7]\b/i);
++	$arg[-1] =~ s/\b[A-Z]+WORD\s+PTR/XMMWORD PTR/i if ($arg[0]=~/\bxmm[0-7]\b/i);
+     }
+ 
+     &::emit($opcode,@arg);
+@@ -160,13 +160,13 @@ sub ::public_label
+ {   push(@out,"PUBLIC\t".&::LABEL($_[0],$nmdecor.$_[0])."\n");   }
+ 
+ sub ::data_byte
+-{   push(@out,("DB\t").join(',',@_)."\n");	}
++{   push(@out,("DB\t").join(',',splice(@_,0,16))."\n") while(@_);	}
+ 
+ sub ::data_short
+-{   push(@out,("DW\t").join(',',@_)."\n");	}
++{   push(@out,("DW\t").join(',',splice(@_,0,8))."\n") while(@_);	}
+ 
+ sub ::data_word
+-{   push(@out,("DD\t").join(',',@_)."\n");	}
++{   push(@out,("DD\t").join(',',splice(@_,0,4))."\n") while(@_);	}
+ 
+ sub ::align
+ {   push(@out,"ALIGN\t$_[0]\n");	}
diff --git a/external/openssl/openssl-fixbuild.patch.1 b/external/openssl/openssl-fixbuild.patch.1
new file mode 100644
index 000000000..5a986e872
--- /dev/null
+++ b/external/openssl/openssl-fixbuild.patch.1
@@ -0,0 +1,23 @@
+--- a/crypto/evp/Makefile
++++ b/crypto/evp/Makefile
+@@ -289,7 +289,7 @@
+ e_idea.o: ../../e_os.h ../../include/openssl/asn1.h ../../include/openssl/bio.h
+ e_idea.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
+ e_idea.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+-e_idea.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
++e_idea.o: ../../include/openssl/evp.h ../idea/idea.h
+ e_idea.o: ../../include/openssl/lhash.h ../../include/openssl/obj_mac.h
+ e_idea.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
+ e_idea.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
+--- a/util/mklink.pl
++++ b/util/mklink.pl
+@@ -50,8 +50,7 @@
+ my $to = join('/', @to_path);
+ 
+ my $file;
+-$symlink_exists=eval {symlink("",""); 1};
+-if ($^O eq "msys") { $symlink_exists=0 };
++$symlink_exists=0;
+ foreach $file (@files) {
+     my $err = "";
+     if ($symlink_exists) {
diff --git a/external/openssl/openssl-macos-arm64.patch.1 b/external/openssl/openssl-macos-arm64.patch.1
new file mode 100644
index 000000000..f0be9dbab
--- /dev/null
+++ b/external/openssl/openssl-macos-arm64.patch.1
@@ -0,0 +1,13 @@
+-*- Mode: diff -*-
+
+--- a/Configure
++++ b/Configure
+@@ -620,6 +620,8 @@
+ "debug-darwin-i386-cc","cc:-arch i386 -g3 -DL_ENDIAN::-D_REENTRANT:MACOSX:-Wl,-search_paths_first%:BN_LLONG RC4_INT RC4_CHUNK DES_UNROLL BF_PTR:${x86_asm}:macosx:dlfcn:darwin-shared:-fPIC -fno-common:-arch i386 -dynamiclib:.\$(SHLIB_MAJOR).\$(SHLIB_MINOR).dylib",
+ "darwin64-x86_64-cc","cc:-arch x86_64 -O3 -DL_ENDIAN -Wall::-D_REENTRANT:MACOSX:-Wl,-search_paths_first%:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_UNROLL:".eval{my $asm=$x86_64_asm;$asm=~s/rc4\-[^:]+//;$asm}.":macosx:dlfcn:darwin-shared:-fPIC -fno-common:-arch x86_64 -dynamiclib:.\$(SHLIB_MAJOR).\$(SHLIB_MINOR).dylib",
+ "debug-darwin64-x86_64-cc","cc:-arch x86_64 -ggdb -g2 -O0 -DL_ENDIAN -Wall::-D_REENTRANT:MACOSX:-Wl,-search_paths_first%:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_UNROLL:".eval{my $asm=$x86_64_asm;$asm=~s/rc4\-[^:]+//;$asm}.":macosx:dlfcn:darwin-shared:-fPIC -fno-common:-arch x86_64 -dynamiclib:.\$(SHLIB_MAJOR).\$(SHLIB_MINOR).dylib",
++"darwin64-arm64-cc","cc:-arch arm64 -O3 -DL_ENDIAN -Wall::-D_REENTRANT:MACOSX:-Wl,-search_paths_first%:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_UNROLL:${no_asm}:macosx:dlfcn:darwin-shared:-fPIC -fno-common:-arch x86_64 -dynamiclib:.\$(SHLIB_MAJOR).\$(SHLIB_MINOR).dylib",
++"debug-darwin64-arm64-cc","cc:-arch arm64 -ggdb -g2 -O0 -DL_ENDIAN -Wall::-D_REENTRANT:MACOSX:-Wl,-search_paths_first%:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_UNROLL:${no_asm}:macosx:dlfcn:darwin-shared:-fPIC -fno-common:-arch x86_64 -dynamiclib:.\$(SHLIB_MAJOR).\$(SHLIB_MINOR).dylib",
+ "debug-darwin-ppc-cc","cc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DCRYPTO_MDEBUG -DB_ENDIAN -g -Wall -O::-D_REENTRANT:MACOSX::BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:${ppc32_asm}:osx32:dlfcn:darwin-shared:-fPIC:-dynamiclib:.\$(SHLIB_MAJOR).\$(SHLIB_MINOR).dylib",
+ # iPhoneOS/iOS
+ "iphoneos-cross","llvm-gcc:-O3 -isysroot \$(CROSS_TOP)/SDKs/\$(CROSS_SDK) -fomit-frame-pointer -fno-common::-D_REENTRANT:iOS:-Wl,-search_paths_first%:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:${no_asm}:dlfcn:darwin-shared:-fPIC -fno-common:-dynamiclib:.\$(SHLIB_MAJOR).\$(SHLIB_MINOR).dylib",
diff --git a/external/openssl/opensslios.patch b/external/openssl/opensslios.patch
new file mode 100644
index 000000000..e3e1c2184
--- /dev/null
+++ b/external/openssl/opensslios.patch
@@ -0,0 +1,12 @@
+--- misc/openssl-0.9.8v/Configure
++++ build/openssl-0.9.8v/Configure
+@@ -530,6 +530,9 @@
+ # iPhoneOS/iOS
+ "iphoneos-cross","llvm-gcc:-O3 -isysroot \$(CROSS_TOP)/SDKs/\$(CROSS_SDK) -fomit-frame-pointer -fno-common::-D_REENTRANT:iOS:-Wl,-search_paths_first%:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:${no_asm}:dlfcn:darwin-shared:-fPIC -fno-common:-dynamiclib:.\$(SHLIB_MAJOR).\$(SHLIB_MINOR).dylib",
+ 
++##### iOS in the LibreOffice case
++"ios-armv7","gcc:-O3 -fomit-frame-pointer -DL_ENDIAN:::IOS::BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:${no_asm}:::::",
++
+ ##### A/UX
+ "aux3-gcc","gcc:-O2 -DTERMIO::(unknown):AUX:-lbsd:RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:::",
+ 
diff --git a/external/openssl/openssllnx.patch b/external/openssl/openssllnx.patch
new file mode 100644
index 000000000..224df8f87
--- /dev/null
+++ b/external/openssl/openssllnx.patch
@@ -0,0 +1,23 @@
+--- build/openssl-0.9.8v/Configure-old	2010-04-17 13:51:42.000000000 +0200
++++ build/openssl-0.9.8v/Configure	2010-04-17 13:52:03.000000000 +0200
+@@ -388,6 +388,9 @@
+ 
+ "bsdi-elf-gcc",     "gcc:-DPERL5 -DL_ENDIAN -fomit-frame-pointer -O3 -march=i486 -Wall::(unknown)::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+ 
++"debian-kfreebsd-amd64","gcc:-m64 -DL_ENDIAN -DTERMIOS -O3 -Wa,--noexecstack -Wall -DMD32_REG_T=int::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK BF_PTR2 DES_INT DES_UNROLL:${x86_64_asm}:dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
++"debian-kfreebsd-i386","gcc:-DL_ENDIAN -DTERMIOS -O3 -Wa,--noexecstack -g -march=i486 -Wall::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
++
+ "nextstep",	"cc:-O -Wall:<libc.h>:(unknown):::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:::",
+ "nextstep3.3",	"cc:-O3 -Wall:<libc.h>:(unknown):::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:::",
+ 
+--- build/openssl-0.9.8v/Makefile.org	2010-01-27 17:06:36.000000000 +0100
++++ build/openssl-0.9.8v/Makefile.org	2010-09-20 09:24:00.000000000 +0100
+@@ -206,7 +206,7 @@
+ # same language for uniform treatment.
+ BUILDENV=	LC_ALL=C PLATFORM='$(PLATFORM)' PROCESSOR='$(PROCESSOR)'\
+ 		CC='$(CC)' CFLAG='$(CFLAG)' 			\
+-		AS='$(CC)' ASFLAG='$(CFLAG) -c'			\
++		AS='$(CC)' ASFLAG='$(CFLAG) -c -Wa,--noexecstack'       \
+ 		AR='$(AR)' NM='$(NM)' RANLIB='$(RANLIB)'	\
+ 		RC='$(RC)'              			\
+ 		CROSS_COMPILE='$(CROSS_COMPILE)'	\
diff --git a/external/openssl/opensslosxppc.patch b/external/openssl/opensslosxppc.patch
new file mode 100644
index 000000000..2e9168e8b
--- /dev/null
+++ b/external/openssl/opensslosxppc.patch
@@ -0,0 +1,15 @@
+-*- Mode: diff -*-
+
+--- a/openssl/Configure
++++ b/openssl/Configure
+@@ -620,8 +620,8 @@
+ 
+ ##### MacOS X (a.k.a. Rhapsody or Darwin) setup
+ "rhapsody-ppc-cc","cc:-O3 -DB_ENDIAN::(unknown):MACOSX_RHAPSODY::BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:${no_asm}::",
+-"darwin-ppc-cc","cc:-arch ppc -O3 -DB_ENDIAN -Wa,-force_cpusubtype_ALL::-D_REENTRANT:MACOSX:-Wl,-search_paths_first%:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:${ppc32_asm}:osx32:dlfcn:darwin-shared:-fPIC -fno-common:-arch ppc -dynamiclib:.\$(SHLIB_MAJOR).\$(SHLIB_MINOR).dylib",
+-"darwin64-ppc-cc","cc:-arch ppc64 -O3 -DB_ENDIAN::-D_REENTRANT:MACOSX:-Wl,-search_paths_first%:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:${ppc64_asm}:osx64:dlfcn:darwin-shared:-fPIC -fno-common:-arch ppc64 -dynamiclib:.\$(SHLIB_MAJOR).\$(SHLIB_MINOR).dylib",
++"darwin-ppc-cc","cc:-m32 -O3 -DB_ENDIAN -Wa,-force_cpusubtype_ALL::-D_REENTRANT:MACOSX:-Wl,-search_paths_first%:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:${ppc32_asm}:osx32:dlfcn:darwin-shared:-fPIC -fno-common:-arch ppc -dynamiclib:.\$(SHLIB_MAJOR).\$(SHLIB_MINOR).dylib",
++"darwin64-ppc-cc","cc:-m64 -O3 -DB_ENDIAN::-D_REENTRANT:MACOSX:-Wl,-search_paths_first%:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:${ppc64_asm}:osx64:dlfcn:darwin-shared:-fPIC -fno-common:-arch ppc64 -dynamiclib:.\$(SHLIB_MAJOR).\$(SHLIB_MINOR).dylib",
+ "darwin-i386-cc","cc:-arch i386 -O3 -fomit-frame-pointer -DL_ENDIAN::-D_REENTRANT:MACOSX:-Wl,-search_paths_first%:BN_LLONG RC4_INT RC4_CHUNK DES_UNROLL BF_PTR:".eval{my $asm=$x86_asm;$asm=~s/cast\-586\.o//;$asm}.":macosx:dlfcn:darwin-shared:-fPIC -fno-common:-arch i386 -dynamiclib:.\$(SHLIB_MAJOR).\$(SHLIB_MINOR).dylib",
+ "debug-darwin-i386-cc","cc:-arch i386 -g3 -DL_ENDIAN::-D_REENTRANT:MACOSX:-Wl,-search_paths_first%:BN_LLONG RC4_INT RC4_CHUNK DES_UNROLL BF_PTR:${x86_asm}:macosx:dlfcn:darwin-shared:-fPIC -fno-common:-arch i386 -dynamiclib:.\$(SHLIB_MAJOR).\$(SHLIB_MINOR).dylib",
+ "darwin64-x86_64-cc","cc:-arch x86_64 -O3 -DL_ENDIAN -Wall::-D_REENTRANT:MACOSX:-Wl,-search_paths_first%:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_UNROLL:".eval{my $asm=$x86_64_asm;$asm=~s/rc4\-[^:]+//;$asm}.":macosx:dlfcn:darwin-shared:-fPIC -fno-common:-arch x86_64 -dynamiclib:.\$(SHLIB_MAJOR).\$(SHLIB_MINOR).dylib",
diff --git a/external/openssl/opensslsol.patch b/external/openssl/opensslsol.patch
new file mode 100644
index 000000000..6122b67c9
--- /dev/null
+++ b/external/openssl/opensslsol.patch
@@ -0,0 +1,20 @@
+--- misc/openssl-0.9.8v/Makefile.shared	Wed Sep 17 17:56:40 2008
++++ build/openssl-0.9.8v/Makefile.shared	Fri Mar 26 16:04:41 2010
+@@ -95,7 +95,7 @@
+     LDCMD="$${LDCMD:-$(CC)}"; LDFLAGS="$${LDFLAGS:-$(CFLAGS)}"; \
+     LIBPATH=`for x in $$LIBDEPS; do echo $$x; done | sed -e 's/^ *-L//;t' -e d | uniq`; \
+     LIBPATH=`echo $$LIBPATH | sed -e 's/ /:/g'`; \
+-    LD_LIBRARY_PATH=$$LIBPATH:$$LD_LIBRARY_PATH \
++    LD_LIBRARY_PATH=$$LD_LIBRARY_PATH \
+     $${LDCMD} $${LDFLAGS} -o $${APPNAME:=$(APPNAME)} $(OBJECTS) $${LIBDEPS} )
+ 
+ LINK_SO=	\
+@@ -105,7 +105,7 @@
+     SHAREDFLAGS="$${SHAREDFLAGS:-$(CFLAGS) $(SHARED_LDFLAGS)}"; \
+     LIBPATH=`for x in $$LIBDEPS; do echo $$x; done | sed -e 's/^ *-L//;t' -e d | uniq`; \
+     LIBPATH=`echo $$LIBPATH | sed -e 's/ /:/g'`; \
+-    LD_LIBRARY_PATH=$$LIBPATH:$$LD_LIBRARY_PATH \
++    LD_LIBRARY_PATH=$$LD_LIBRARY_PATH \
+     $${SHAREDCMD} $${SHAREDFLAGS} \
+ 	-o $$SHLIB$$SHLIB_SOVER$$SHLIB_SUFFIX \
+ 	$$ALLSYMSFLAGS $$SHOBJECTS $$NOALLSYMSFLAGS $$LIBDEPS \
diff --git a/external/openssl/opensslwnt.patch b/external/openssl/opensslwnt.patch
new file mode 100644
index 000000000..e22bea6f0
--- /dev/null
+++ b/external/openssl/opensslwnt.patch
@@ -0,0 +1,167 @@
+diff -ru openssl.orig/crypto/x509v3/v3_pci.c openssl/crypto/x509v3/v3_pci.c
+--- a/openssl.orig/crypto/x509v3/v3_pci.c	2016-03-01 14:35:05.000000000 +0100
++++ b/openssl/crypto/x509v3/v3_pci.c	2016-03-03 20:27:42.195914432 +0100
+@@ -3,7 +3,7 @@
+  * Contributed to the OpenSSL Project 2004 by Richard Levitte
+  * (richard@levitte.org)
+  */
+-/* Copyright (c) 2004 Kungliga Tekniska Högskolan
++/* Copyright (c) 2004 Kungliga Tekniska Hoegskolan
+  * (Royal Institute of Technology, Stockholm, Sweden).
+  * All rights reserved.
+  *
+diff -ru openssl.orig/crypto/x509v3/v3_pcia.c openssl/crypto/x509v3/v3_pcia.c
+--- a/openssl.orig/crypto/x509v3/v3_pcia.c	2016-03-01 14:35:05.000000000 +0100
++++ b/openssl/crypto/x509v3/v3_pcia.c	2016-03-03 20:27:56.495913984 +0100
+@@ -3,7 +3,7 @@
+  * Contributed to the OpenSSL Project 2004 by Richard Levitte
+  * (richard@levitte.org)
+  */
+-/* Copyright (c) 2004 Kungliga Tekniska Högskolan
++/* Copyright (c) 2004 Kungliga Tekniska Hoegskolan
+  * (Royal Institute of Technology, Stockholm, Sweden).
+  * All rights reserved.
+  *
+diff -ru openssl.orig/ms/do_ms.bat openssl/ms/do_ms.bat
+--- a/openssl.orig/ms/do_ms.bat	2015-01-15 15:43:14.000000000 +0100
++++ b/openssl/ms/do_ms.bat	2016-03-03 20:31:09.355907935 +0100
+@@ -1,11 +1,11 @@
+ 
+-perl util\mkfiles.pl >MINFO
+-perl util\mk1mf.pl no-asm VC-WIN32 >ms\nt.mak
+-perl util\mk1mf.pl dll no-asm VC-WIN32 >ms\ntdll.mak
+-if x%OSVERSION% == x goto skipce
+-perl util\mk1mf.pl no-asm VC-CE >ms\ce.mak
+-perl util\mk1mf.pl dll no-asm VC-CE >ms\cedll.mak
+-:skipce
++%1 util\mkfiles.pl >MINFO
++if %2 == VC-WIN32 goto not64a
++perl ms\uplink.pl win64a > ms\uptable.asm
++ml64 -c -Foms\uptable.obj ms\uptable.asm
++:not64a
++%1 util\mk1mf.pl no-asm %2 >ms\nt.mak
++%1 util\mk1mf.pl dll no-asm %2 >ms\ntdll.mak
+ 
+-perl util\mkdef.pl 32 libeay > ms\libeay32.def
+-perl util\mkdef.pl 32 ssleay > ms\ssleay32.def
++%1 util\mkdef.pl 32 libeay > ms\libeay32.def
++%1 util\mkdef.pl 32 ssleay > ms\ssleay32.def
+diff -ru openssl.orig/util/mk1mf.pl openssl/util/mk1mf.pl
+--- a/openssl.orig/util/mk1mf.pl	2016-03-03 20:22:21.043924505 +0100
++++ b/openssl/util/mk1mf.pl	2016-03-03 20:34:45.015901171 +0100
+@@ -163,7 +163,7 @@
+ $inc_def="outinc";
+ $tmp_def="tmp";
+ 
+-$perl="perl" unless defined $perl;
++$perl="$ENV{PERL}" unless defined $perl;
+ $mkdir="-mkdir" unless defined $mkdir;
+ 
+ ($ssl,$crypto)=("ssl","crypto");
+@@ -347,6 +347,11 @@
+ 	s/\s*$//; # was chop, didn't work in mixture of perls for Windows...
+ 
+ 	($key,$val)=/^([^=]+)=(.*)/;
++
++	# On some Windows machines, $val has linefeeds at the end, which confuses
++	# subsequent code in this file. So we strip all whitespace at the end.
++	$val =~ s/\s+$//;
++
+ 	if ($key eq "RELATIVE_DIRECTORY")
+ 		{
+ 		if ($lib ne "")
+@@ -473,7 +478,7 @@
+ # Set your compiler options
+ PLATFORM=$platform
+ CC=$bin_dir${cc}
+-CFLAG=$cflags
++CFLAG=$cflags \$(SOLARINC)
+ APP_CFLAG=$app_cflag
+ LIB_CFLAG=$lib_cflag
+ SHLIB_CFLAG=$shl_cflag
+@@ -488,7 +493,7 @@
+ 
+ LINK_CMD=$link
+ LFLAGS=$lflags
+-RSC=$rsc
++RSC=$rsc \$(SOLARINC)
+ 
+ # The output directory for everything interesting
+ OUT_D=$out_dir
+@@ -669,7 +674,7 @@
+ printf OUT <<EOF;
+ #ifdef $platform_cpp_symbol
+   /* auto-generated/updated by util/mk1mf.pl for crypto/cversion.c */
+-  #define CFLAGS "compiler: $cc $cflags"
++  #define CFLAGS "compiler: $cflags"
+   #define PLATFORM "$platform"
+ EOF
+ printf OUT "  #define DATE \"%s\"\n", scalar gmtime();
+diff -ru openssl.orig/util/pl/VC-32.pl openssl/util/pl/VC-32.pl
+--- a/openssl.orig/util/pl/VC-32.pl	2016-03-01 14:35:53.000000000 +0100
++++ b/openssl/util/pl/VC-32.pl	2016-03-03 21:15:14.083824986 +0100
+@@ -30,7 +30,7 @@
+ my $ff = "";
+ 
+ # C compiler stuff
+-$cc='cl';
++$cc=$ENV{'CC'};
+ if ($FLAVOR =~ /WIN64/)
+     {
+     # Note that we currently don't have /WX on Win64! There is a lot of
+@@ -114,7 +114,7 @@
+     }
+ 
+     $cc=($ENV{CC} or "cl");
+-    $base_cflags=' /W3 /WX /GF /Gy /nologo -DUNICODE -D_UNICODE -DOPENSSL_SYSNAME_WINCE -DWIN32_LEAN_AND_MEAN -DL_ENDIAN -DDSO_WIN32 -DNO_CHMOD -DOPENSSL_SMALL_FOOTPRINT';
++    $base_cflags=' -W3 -GF -Gy -nologo -DUNICODE -D_UNICODE -DOPENSSL_SYSNAME_WINCE -DWIN32_LEAN_AND_MEAN -DL_ENDIAN -DDSO_WIN32 -DNO_CHMOD -DOPENSSL_SMALL_FOOTPRINT';
+     $base_cflags.=" $wcecdefs";
+     $base_cflags.=' -I$(WCECOMPAT)/include'		if (defined($ENV{'WCECOMPAT'}));
+     $base_cflags.=' -I$(PORTSDK_LIBPATH)/../../include'	if (defined($ENV{'PORTSDK_LIBPATH'}));
+@@ -123,20 +123,21 @@
+     } else {
+ 	$base_cflags.=' /MC';
+     }
+-    $opt_cflags=' /O1i';	# optimize for space, but with intrinsics...
+-    $dbg_cflags=' /Od -DDEBUG -D_DEBUG';
++    $opt_cflags=' -O1i';   # optimize for space, but with intrinsics...
++    $dbg_cflags=' -Od -DDEBUG -D_DEBUG';
++
+     $lflags="/nologo /opt:ref $wcelflag";
+     }
+ else	# Win32
+     {
+     $base_cflags= " $mf_cflag";
+-    my $f = $shlib || $fips ?' /MD':' /MT';
++    my $f = $shlib || $fips ? (($ENV{MSVC_USE_DEBUG_RUNTIME} eq "TRUE") ? ' -MDd' : ' -MD' ):' -MT';
+     $ff = "/fixed";
+-    $opt_cflags=$f.' /Ox /O2 /Ob2';
+-    $dbg_cflags=$f.'d /Od -DDEBUG -D_DEBUG';
++    $opt_cflags=$f.' -Ox -O2 -Ob2';
++    $dbg_cflags=$f.'d -Od -DDEBUG -D_DEBUG';
+     $lflags="/nologo /subsystem:console /opt:ref";
+     }
+-$lib_cflag='/Zl' if (!$shlib);	# remove /DEFAULTLIBs from static lib
++$lib_cflag='-Zl' if (!$shlib);	# remove /DEFAULTLIBs from static lib
+ $mlflags='';
+ 
+ $out_def ="out32";	$out_def.="dll"			if ($shlib);
+@@ -161,7 +162,7 @@
+ 
+ $obj='.obj';
+ $asm_suffix='.asm';
+-$ofile="/Fo";
++$ofile="-Fo.\\";
+ 
+ # EXE linking stuff
+ $link="link";
+diff -ru openssl.orig/ms/uplink.c openssl/ms/uplink.c
+--- a/openssl.orig/ms/uplink.c	2015-03-19 15:02:02.000000000 +0100
++++ b/openssl/ms/uplink.c	2016-03-03 20:39:19.403892565 +0100
+@@ -1,5 +1,6 @@
+ #if (defined(_WIN64) || defined(_WIN32_WCE)) && !defined(UNICODE)
+ # define UNICODE
++# define _CRT_NON_CONFORMING_SWPRINTFS
+ #endif
+ #if defined(UNICODE) && !defined(_UNICODE)
+ # define _UNICODE
diff --git a/external/openssl/opensslwnt_safeseh.patch b/external/openssl/opensslwnt_safeseh.patch
new file mode 100644
index 000000000..f2eafab5b
--- /dev/null
+++ b/external/openssl/opensslwnt_safeseh.patch
@@ -0,0 +1,23 @@
+use /safeseh in 32-bit MSVC builds; this is not required for 64-bit
+
+diff -ru openssl.orig/util/mk1mf.pl openssl/util/mk1mf.pl
+--- a/openssl.orig/util/mk1mf.pl	2016-03-03 20:22:21.043924505 +0100
++++ b/openssl/util/mk1mf.pl	2016-03-03 20:34:45.015901171 +0100
+@@ -488,7 +493,7 @@
+ SRC_D=$src_dir
+ 
+ LINK_CMD=$link
+-LFLAGS=$lflags
++LFLAGS=$lflags /SAFESEH
+ RSC=$rsc \$(SOLARINC)
+ 
+ # The output directory for everything interesting
+@@ -511,7 +516,7 @@
+ MKDIR=$mkdir
+ MKLIB=$bin_dir$mklib
+ MLFLAGS=$mlflags
+-ASM=$bin_dir$asm
++ASM=$bin_dir$asm /safeseh
+ 
+ # FIPS validated module and support file locations
+