treewide: Default openssl version to 3.0

nixos/doc/manual/from_md/release-notes/rl-2211.section.xml

@@ -100,6 +100,11 @@
           Cinnamon has been updated to 5.4.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          OpenSSL now defaults to OpenSSL 3, updated from 1.1.1.
+        </para>
+      </listitem>
       <listitem>
         <para>
           <literal>hardware.nvidia</literal> has a new option

nixos/doc/manual/release-notes/rl-2211.section.md

@@ -48,6 +48,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - Cinnamon has been updated to 5.4.
 
+- OpenSSL now defaults to OpenSSL 3, updated from 1.1.1.
+
 - `hardware.nvidia` has a new option `open` that can be used to opt in the opensource version of NVIDIA kernel driver. Note that the driver's support for GeForce and Workstation GPUs is still alpha quality, see [NVIDIA Releases Open-Source GPU Kernel Modules](https://developer.nvidia.com/blog/nvidia-releases-open-source-gpu-kernel-modules/) for the official announcement.
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

pkgs/applications/radio/tqsl/default.nix

@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
     openssl
     zlib
     db
-    curl
+    (curl.override { inherit openssl; })
     wxGTK
   ];
 

pkgs/applications/version-management/git-and-tools/git-crypt/default.nix

@@ -37,6 +37,11 @@ stdenv.mkDerivation rec {
     "DOCBOOK_XSL=${docbook_xsl}/share/xml/docbook-xsl-nons/manpages/docbook.xsl"
   ];
 
+  # https://github.com/AGWA/git-crypt/issues/232
+  CXXFLAGS = [
+    "-DOPENSSL_API_COMPAT=0x30000000L"
+  ];
+
   postFixup = ''
     wrapProgram $out/bin/git-crypt \
       --suffix PATH : ${lib.makeBinPath [ git gnupg ]}

pkgs/development/compilers/dotnet/build-dotnet.nix

@@ -15,7 +15,7 @@ assert if type == "sdk" then packages != null else true;
 , autoPatchelfHook
 , makeWrapper
 , libunwind
-, openssl
+, openssl_1_1
 , libuuid
 , zlib
 , curl
@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
     icu
     libunwind
     libuuid
-    openssl
+    openssl_1_1
   ] ++ lib.optional stdenv.isLinux lttng-ust_2_12);
 
   nativeBuildInputs = [

pkgs/development/haskell-modules/configuration-common.nix

@@ -2393,6 +2393,9 @@ self: super: {
     '';
   }) super.linear-base;
 
+  # https://github.com/peti/hopenssl/issues/5
+  hopenssl = super.hopenssl.override { openssl = pkgs.openssl_1_1; };
+
   # Fixes compilation with GHC 9.0 and above
   # https://hub.darcs.net/shelarcy/regex-compat-tdfa/issue/3
   regex-compat-tdfa = appendPatches [

pkgs/development/interpreters/python/cpython/default.nix

@@ -7,6 +7,7 @@
 , mailcap, mimetypesSupport ? true
 , ncurses
 , openssl
+, openssl_1_1
 , readline
 , sqlite
 , tcl ? null, tk ? null, tix ? null, libX11 ? null, xorgproto ? null, x11Support ? false
@@ -75,6 +76,10 @@ assert lib.assertMsg (reproducibleBuild -> (!rebuildBytecode))
 with lib;
 
 let
+  # cpython does support/build with openssl 3.0, but some libraries using the ssl module seem to have issues with it
+  # null check for Minimal
+  openssl' = if openssl != null then openssl_1_1 else null;
+
   buildPackages = pkgsBuildHost;
   inherit (passthru) pythonForBuild;
 
@@ -115,7 +120,7 @@ let
   ];
 
   buildInputs = filter (p: p != null) ([
-    zlib bzip2 expat xz libffi gdbm sqlite readline ncurses openssl ]
+    zlib bzip2 expat xz libffi gdbm sqlite readline ncurses openssl' ]
     ++ optionals x11Support [ tcl tk libX11 xorgproto ]
     ++ optionals (bluezSupport && stdenv.isLinux) [ bluez ]
     ++ optionals stdenv.isDarwin [ configd ])
@@ -321,8 +326,8 @@ in with passthru; stdenv.mkDerivation {
     "--with-threads"
   ] ++ optionals (sqlite != null && isPy3k) [
     "--enable-loadable-sqlite-extensions"
-  ] ++ optionals (openssl != null) [
-    "--with-openssl=${openssl.dev}"
+  ] ++ optionals (openssl' != null) [
+    "--with-openssl=${openssl'.dev}"
   ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     "ac_cv_buggy_getaddrinfo=no"
     # Assume little-endian IEEE 754 floating point when cross compiling
@@ -484,7 +489,7 @@ in with passthru; stdenv.mkDerivation {
   # Enforce that we don't have references to the OpenSSL -dev package, which we
   # explicitly specify in our configure flags above.
   disallowedReferences =
-    lib.optionals (openssl != null && !static) [ openssl.dev ]
+    lib.optionals (openssl' != null && !static) [ openssl'.dev ]
     ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     # Ensure we don't have references to build-time packages.
     # These typically end up in shebangs.

pkgs/development/interpreters/ruby/default.nix

@@ -1,9 +1,10 @@
 { stdenv, buildPackages, lib
 , fetchurl, fetchpatch, fetchFromSavannah, fetchFromGitHub
-, zlib, openssl, gdbm, ncurses, readline, groff, libyaml, libffi, jemalloc, autoreconfHook, bison
+, zlib, gdbm, ncurses, readline, groff, libyaml, libffi, jemalloc, autoreconfHook, bison
 , autoconf, libiconv, libobjc, libunwind, Foundation
 , buildEnv, bundler, bundix
 , makeWrapper, buildRubyGem, defaultGemConfig, removeReferencesTo
+, openssl, openssl_1_1
 } @ args:
 
 let
@@ -26,7 +27,7 @@ let
       , useRailsExpress ? true
       , rubygemsSupport ? true
       , zlib, zlibSupport ? true
-      , openssl, opensslSupport ? true
+      , openssl, openssl_1_1, opensslSupport ? true
       , gdbm, gdbmSupport ? true
       , ncurses, readline, cursesSupport ? true
       , groff, docSupport ? true
@@ -75,7 +76,8 @@ let
           ++ (op fiddleSupport libffi)
           ++ (ops cursesSupport [ ncurses readline ])
           ++ (op zlibSupport zlib)
-          ++ (op opensslSupport openssl)
+          ++ (op (lib.versionOlder ver.majMin "3.0" && opensslSupport) openssl_1_1)
+          ++ (op (atLeast30 && opensslSupport) openssl_1_1)
           ++ (op gdbmSupport gdbm)
           ++ (op yamlSupport libyaml)
           # Looks like ruby fails to build on darwin without readline even if curses

pkgs/development/libraries/google-cloud-cpp/default.nix

@@ -61,7 +61,7 @@ stdenv.mkDerivation rec {
     abseil-cpp
     c-ares
     crc32c
-    curl
+    (curl.override { inherit openssl; })
     grpc
     nlohmann_json
     openssl

pkgs/development/libraries/libewf/default.nix

@@ -1,14 +1,22 @@
-{ fetchurl, lib, stdenv, zlib, openssl, libuuid, pkg-config, bzip2 }:
+{ fetchurl, fetchpatch, lib, stdenv, zlib, openssl, libuuid, pkg-config, bzip2 }:
 
 stdenv.mkDerivation rec {
   version = "20201230";
   pname = "libewf";
 
   src = fetchurl {
     url = "https://github.com/libyal/libewf/releases/download/${version}/libewf-experimental-${version}.tar.gz";
-    sha256 = "sha256-10r4jPzsA30nHQzjdg/VkwTG1PwOskwv8Bra34ZPMgc=";
+    hash = "sha256-10r4jPzsA30nHQzjdg/VkwTG1PwOskwv8Bra34ZPMgc=";
   };
 
+  patches = [
+    # fix build with OpenSSL 3.0
+    (fetchpatch {
+      url = "https://github.com/libyal/libewf/commit/033ea5b4e5f8f1248f74a2ec61fc1be183c6c46b.patch";
+      hash = "sha256-R4+NO/91kiZP48SJyVF9oYjKCg1h/9Kh8/0VOEmJXPQ=";
+    })
+  ];
+
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ zlib openssl libuuid ]
     ++ lib.optionals stdenv.isDarwin [ bzip2 ];

pkgs/development/libraries/libs3/default.nix

@@ -1,19 +1,26 @@
-{ lib, stdenv, fetchFromGitHub, curl, libxml2 }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, curl, libxml2 }:
 
 stdenv.mkDerivation {
   pname = "libs3";
-  version = "unstable-2018-12-03";
+  version = "unstable-2019-04-10";
 
   src = fetchFromGitHub {
     owner = "bji";
     repo = "libs3";
-    rev = "111dc30029f64bbf82031f3e160f253a0a63c119";
-    sha256 = "1ahf08hc7ql3fazfmlyj9vrhq7cvarsmgn2v8149y63zr1fl61hs";
+    rev = "287e4bee6fd430ffb52604049de80a27a77ff6b4";
+    hash = "sha256-xgiY8oJlRMiXB1fw5dhNidfaq18YVwaJ8aErKU11O6U=";
   };
 
+  patches = [
+    (fetchpatch { # Fix compilation with openssl 3.0
+      url = "https://github.com/bji/libs3/pull/112/commits/3c3a1cf915e62b730db854d8007ba835cb38677c.patch";
+      hash = "sha256-+rWRh8dOznHlamc/T9qbgN0E2Rww3Hn94UeErxNDccs=";
+    })
+  ];
+
   buildInputs = [ curl libxml2 ];
 
-  makeFlags = [ "DESTDIR=$(out)" ];
+  makeFlags = [ "DESTDIR=${placeholder "out"}" ];
 
   meta = with lib; {
     homepage = "https://github.com/bji/libs3";

pkgs/development/libraries/openssl/default.nix

@@ -30,7 +30,7 @@ let
 
     postPatch = ''
       patchShebangs Configure
-    '' + lib.optionalString (lib.versionOlder version "1.1.0") ''
+    '' + lib.optionalString (lib.versionOlder version "1.1.1") ''
       patchShebangs test/*
       for a in test/t* ; do
         substituteInPlace "$a" \
@@ -40,7 +40,7 @@ let
     # config is a configure script which is not installed.
     + lib.optionalString (lib.versionAtLeast version "1.1.1") ''
       substituteInPlace config --replace '/usr/bin/env' '${buildPackages.coreutils}/bin/env'
-    '' + lib.optionalString (lib.versionAtLeast version "1.1.0" && stdenv.hostPlatform.isMusl) ''
+    '' + lib.optionalString (lib.versionAtLeast version "1.1.1" && stdenv.hostPlatform.isMusl) ''
       substituteInPlace crypto/async/arch/async_posix.h \
         --replace '!defined(__ANDROID__) && !defined(__OpenBSD__)' \
                   '!defined(__ANDROID__) && !defined(__OpenBSD__) && 0'
@@ -130,11 +130,12 @@ let
     ] ++ lib.optional enableSSL2 "enable-ssl2"
       ++ lib.optional enableSSL3 "enable-ssl3"
       ++ lib.optional (lib.versionAtLeast version "3.0.0") "enable-ktls"
-      ++ lib.optional (lib.versionAtLeast version "1.1.0" && stdenv.hostPlatform.isAarch64) "no-afalgeng"
+      ++ lib.optional (lib.versionAtLeast version "1.1.1" && stdenv.hostPlatform.isAarch64) "no-afalgeng"
       # OpenSSL needs a specific `no-shared` configure flag.
       # See https://wiki.openssl.org/index.php/Compilation_and_Installation#Configure_Options
       # for a comprehensive list of configuration options.
-      ++ lib.optional (lib.versionAtLeast version "1.1.0" && static) "no-shared"
+      ++ lib.optional (lib.versionAtLeast version "1.1.1" && static) "no-shared"
+      ++ lib.optional (lib.versionAtLeast version "3.0.0" && static) "no-module"
       # This introduces a reference to the CTLOG_FILE which is undesired when
       # trying to build binaries statically.
       ++ lib.optional static "no-ct"

pkgs/development/lua-modules/overrides.nix

@@ -31,8 +31,8 @@ with prev;
 
   cqueues = (prev.lib.overrideLuarocks prev.cqueues (drv: {
     externalDeps = [
-      { name = "CRYPTO"; dep = pkgs.openssl; }
-      { name = "OPENSSL"; dep = pkgs.openssl; }
+      { name = "CRYPTO"; dep = pkgs.openssl_1_1; }
+      { name = "OPENSSL"; dep = pkgs.openssl_1_1; }
     ];
     disabled = luaOlder "5.1" || luaAtLeast "5.4";
   })).overrideAttrs(oa: rec {
@@ -271,14 +271,15 @@ with prev;
 
   luaossl = prev.lib.overrideLuarocks prev.luaossl (drv: {
     externalDeps = [
-      { name = "CRYPTO"; dep = pkgs.openssl; }
-      { name = "OPENSSL"; dep = pkgs.openssl; }
+      # https://github.com/wahern/luaossl/pull/199
+      { name = "CRYPTO"; dep = pkgs.openssl_1_1; }
+      { name = "OPENSSL"; dep = pkgs.openssl_1_1; }
     ];
   });
 
   luasec = prev.lib.overrideLuarocks prev.luasec (drv: {
     externalDeps = [
-      { name = "OPENSSL"; dep = pkgs.openssl; }
+      { name = "OPENSSL"; dep = pkgs.openssl_1_1; }
     ];
   });
 

pkgs/development/ruby-modules/gem-config/default.nix

@@ -20,7 +20,7 @@
 { lib, fetchurl, writeScript, ruby, libkrb5, libxml2, libxslt, python2, stdenv, which
 , libiconv, postgresql, v8, clang, sqlite, zlib, imagemagick, lasem
 , pkg-config , ncurses, xapian, gpgme, util-linux, tzdata, icu, libffi
-, cmake, libssh2, openssl, libmysqlclient, git, perl, pcre, gecode_3, curl
+, cmake, libssh2, openssl, openssl_1_1, libmysqlclient, git, perl, pcre, gecode_3, curl
 , msgpack, libsodium, snappy, libossp_uuid, lxc, libpcap, xorg, gtk2, buildRubyGem
 , cairo, re2, rake, gobject-introspection, gdk-pixbuf, zeromq, czmq, graphicsmagick, libcxx
 , file, libvirt, glib, vips, taglib, libopus, linux-pam, libidn, protobuf, fribidi, harfbuzz
@@ -478,7 +478,8 @@ in
   };
 
   openssl = attrs: {
-    buildInputs = [ openssl ];
+    # https://github.com/ruby/openssl/issues/369
+    buildInputs = [ openssl_1_1 ];
   };
 
   opus-ruby = attrs: {

pkgs/development/tools/rust/rustup/default.nix

@@ -6,6 +6,7 @@
 , rustPlatform
 , makeWrapper
 , pkg-config
+, openssl
 , curl
 , zlib
 , Security
@@ -36,7 +37,7 @@ rustPlatform.buildRustPackage rec {
   nativeBuildInputs = [ makeWrapper pkg-config ];
 
   buildInputs = [
-    curl
+    (curl.override { inherit openssl; })
     zlib
   ] ++ lib.optionals stdenv.isDarwin [ CoreServices Security libiconv xz ];
 

pkgs/development/web/nodejs/v14.nix

@@ -1,7 +1,8 @@
-{ callPackage, python3, lib, stdenv, enableNpm ? true }:
+{ callPackage, python3, lib, stdenv, openssl, enableNpm ? true }:
 
 let
   buildNodejs = callPackage ./nodejs.nix {
+    inherit openssl;
     python = python3;
   };
 in