openssl: update to 1.1.1g

The OpenSSL 1.1.1 release is currently the only supported version
and it already has the Windows Arm64 support I was looking for.

This change also explicitly enables thread support, which Python
depends on since release 3.7, which removed the --without-threads
build option. But the explicit OPENSSL_THREADS was just added in
3.8.4, so the old no-threads build fails now and was wrong since
probably much longer.

Reviewed-on: https://gerrit.libreoffice.org/c/core/+/98435
Tested-by: Jenkins
Reviewed-by: Jan-Marek Glogowski <glogow@fbihome.de>
(cherry picked from commit 0911b0a26356aa53bb94a1d2171f36e6c2e28749)

(cherry picked from commit f3e98f199de288f689bcca21251a4f8d3930a366)

Change-Id: I61d94f966bc59407f213f4a81f0a49d0c05f8948

17 files changed, 63 insertions, 388 deletions

diff --git a/RepositoryExternal.mk b/RepositoryExternal.mk
index 652a519b75b2..ac3fc9a5065a 100644
--- a/RepositoryExternal.mk
+++ b/RepositoryExternal.mk
@@ -1592,13 +1592,14 @@ define gb_LinkTarget__use_openssl
 $(call gb_LinkTarget_use_package,$(1),openssl)
 ifeq ($(OS),WNT)
 $(call gb_LinkTarget_add_libs,$(1),\
-	$(call gb_UnpackedTarball_get_dir,openssl)/out32dll/ssleay32.lib \
-	$(call gb_UnpackedTarball_get_dir,openssl)/out32dll/libeay32.lib \
+	$(call gb_UnpackedTarball_get_dir,openssl)/libcrypto.lib \
+	$(call gb_UnpackedTarball_get_dir,openssl)/libssl.lib \
 )
 else
 $(call gb_LinkTarget_add_libs,$(1),\
 	$(call gb_UnpackedTarball_get_dir,openssl)/libssl.a \
 	$(call gb_UnpackedTarball_get_dir,openssl)/libcrypto.a \
+	$(if $(filter $(OS),LINUX),-pthread) \
 )
 $(call gb_LinkTarget_use_external_project,$(1),openssl)
 ifeq ($(OS),SOLARIS)
diff --git a/download.lst b/download.lst
index d6abee3894f5..d8ef5f523f6b 100644
--- a/download.lst
+++ b/download.lst
@@ -192,8 +192,8 @@ export OFFICEOTRON_SHA256SUM := f2443f27561af52324eee03a1892d9f569adc8db9e7bca55
 export OFFICEOTRON_JAR := 8249374c274932a21846fa7629c2aa9b-officeotron-0.7.4-master.jar
 export OPENLDAP_SHA256SUM := 99f37d6747d88206c470067eda624d5e48c1011e943ec0ab217bae8712e22f34
 export OPENLDAP_TARBALL := openldap-2.4.59.tgz
-export OPENSSL_SHA256SUM := ae51d08bba8a83958e894946f15303ff894d75c2b8bbd44a852b64e3fe11d0d6
-export OPENSSL_TARBALL := openssl-1.0.2r.tar.gz
+export OPENSSL_SHA256SUM := ddb04774f1e32f0c49751e21b67216ac87852ceb056b75209af2443400636d46
+export OPENSSL_TARBALL := openssl-1.1.1g.tar.gz
 export ORCUS_SHA256SUM := bc01b1b3e9091416f498840d3c19a1aa2704b448100e7f6b80eefe88aab06d5b
 export ORCUS_TARBALL := liborcus-0.13.4.tar.gz
 export OWNCLOUD_ANDROID_LIB_SHA256SUM := b18b3e3ef7fae6a79b62f2bb43cc47a5346b6330f6a383dc4be34439aca5e9fb
diff --git a/external/openssl/ExternalPackage_openssl.mk b/external/openssl/ExternalPackage_openssl.mk
index 695c7b7119b6..de77f53f33b9 100644
--- a/external/openssl/ExternalPackage_openssl.mk
+++ b/external/openssl/ExternalPackage_openssl.mk
@@ -13,8 +13,8 @@ $(eval $(call gb_ExternalPackage_use_external_project,openssl,openssl))
 
 ifeq ($(COM),MSC)
 $(eval $(call gb_ExternalPackage_add_files,openssl,$(LIBO_LIB_FOLDER),\
-	out32dll/ssleay32.dll \
-	out32dll/libeay32.dll \
+    libcrypto-1_1.dll \
+    libssl-1_1.dll \
 ))
 endif
 
diff --git a/external/openssl/ExternalProject_openssl.mk b/external/openssl/ExternalProject_openssl.mk
index 8123c633fd8d..4bcd87b3ccd2 100644
--- a/external/openssl/ExternalProject_openssl.mk
+++ b/external/openssl/ExternalProject_openssl.mk
@@ -42,7 +42,9 @@ OPENSSL_PLATFORM := \
         ios-armv7\
       ,\
         $(if $(filter WNT,$(OS)),\
-          $(if $(filter INTEL,$(CPUNAME)),VC-WIN32,VC-WIN64A)\
+          $(if $(filter INTEL,$(CPUNAME)),VC-WIN32)\
+          $(if $(filter X86_64,$(CPUNAME)),VC-WIN64A)\
+          $(if $(filter ARM64,$(CPUNAME)),VC-WIN64-ARM)\
         ,\
           $(if $(filter MACOSX,$(OS)),\
             $(if $(filter POWERPC,$(CPUNAME)),darwin-ppc-cc)\
@@ -59,11 +61,9 @@ $(eval $(call gb_ExternalProject_use_nmake,openssl,build))
 
 $(call gb_ExternalProject_get_state_target,openssl,build):
 	$(call gb_ExternalProject_run,build,\
-		export PERL="$(shell cygpath -w $(PERL))" \
-		&& $(PERL) Configure $(OPENSSL_PLATFORM) no-idea \
-		&& cmd /c "ms\do_ms.bat $(PERL) $(OPENSSL_PLATFORM)" \
-		&& nmake -f "ms\ntdll.mak" \
-		&& mv inc32/* include/ \
+		CONFIGURE_INSIST=1 $(PERL) Configure $(OPENSSL_PLATFORM) no-tests no-multilib \
+		&& export PERL="$(shell cygpath -w $(PERL))" \
+		&& nmake -f makefile \
 	)
 
 else
@@ -75,8 +75,7 @@ $(call gb_ExternalProject_get_state_target,openssl,build):
 		$(if $(filter WNT,$(OS)), \
 			$(PERL) Configure, \
 			./config)) \
-			$(OPENSSL_PLATFORM) no-dso no-shared \
-			$(if $(filter-out WNT,$(OS)),no-idea) \
+			$(OPENSSL_PLATFORM) no-dso no-shared no-tests no-multilib threads \
 			$(if $(filter-out ANDROID IOS WNT,$(OS)), \
 				$(if $(SYSBASE),-I$(SYSBASE)/usr/include -L$(SYSBASE)/usr/lib)) \
 			$(if $(filter MACOSX,$(OS)),--prefix=/@.__________________________________________________OOO) \
diff --git a/external/openssl/UnpackedTarball_openssl.mk b/external/openssl/UnpackedTarball_openssl.mk
index e7fca1116545..6f00cf7f7e44 100644
--- a/external/openssl/UnpackedTarball_openssl.mk
+++ b/external/openssl/UnpackedTarball_openssl.mk
@@ -12,17 +12,7 @@ $(eval $(call gb_UnpackedTarball_UnpackedTarball,openssl))
 $(eval $(call gb_UnpackedTarball_set_tarball,openssl,$(OPENSSL_TARBALL),,openssl))
 
 $(eval $(call gb_UnpackedTarball_add_patches,openssl,\
-	external/openssl/openssllnx.patch \
-	external/openssl/opensslwnt.patch \
-	$(if $(filter INTEL,$(CPUNAME)),external/openssl/opensslwnt_safeseh.patch) \
-	external/openssl/openssl-1.0.1h-win64.patch.1 \
-	external/openssl/opensslsol.patch \
-	external/openssl/opensslios.patch \
-	external/openssl/opensslosxppc.patch \
-	external/openssl/openssl-3650-masm.patch.1 \
-	external/openssl/openssl-fixbuild.patch.1 \
-	external/openssl/openssl-1.0.2k-cve-2020-1971.patch.1 \
-	external/openssl/ccb0a11145ee72b042d10593a64eaf9e8a55ec12.patch.1 \
+	external/openssl/openssl-no-multilib.patch.0 \
 ))
 
 # vim: set noet sw=4 ts=4:
diff --git a/external/openssl/openssl-1.0.1h-win64.patch.1 b/external/openssl/openssl-1.0.1h-win64.patch.1
deleted file mode 100644
index aea914633ebb..000000000000
--- a/external/openssl/openssl-1.0.1h-win64.patch.1
+++ /dev/null
@@ -1,47 +0,0 @@
-diff --git a/ms/do_win64a.bat b/ms/do_win64a.bat
-index 8768dc6..6772390 100755
---- a/ms/do_win64a.bat
-+++ b/ms/do_win64a.bat
-@@ -1,19 +1,19 @@
--perl util\mkfiles.pl >MINFO
-+perl util/mkfiles.pl >MINFO
- 
- cmd /c "nasm -f win64 -v" >NUL 2>&1
- if %errorlevel% neq 0 goto ml64
- 
--perl ms\uplink-x86_64.pl nasm > ms\uptable.asm
--nasm -f win64 -o ms\uptable.obj ms\uptable.asm
-+perl ms/uplink-x86_64.pl nasm > ms/uptable.asm
-+nasm -f win64 -o ms/uptable.obj ms/uptable.asm
- goto proceed
- 
- :ml64
--perl ms\uplink-x86_64.pl masm > ms\uptable.asm
--ml64 -c -Foms\uptable.obj ms\uptable.asm
-+perl ms/uplink-x86_64.pl masm > ms/uptable.asm
-+ml64 -c -Foms/uptable.obj ms/uptable.asm
- 
- :proceed
--perl util\mk1mf.pl VC-WIN64A >ms\nt.mak
--perl util\mk1mf.pl dll VC-WIN64A >ms\ntdll.mak
-+perl util/mk1mf.pl VC-WIN64A >ms/nt.mak
-+perl util/mk1mf.pl dll VC-WIN64A >ms/ntdll.mak
- 
--perl util\mkdef.pl 32 libeay > ms\libeay32.def
--perl util\mkdef.pl 32 ssleay > ms\ssleay32.def
-+perl util/mkdef.pl 32 libeay > ms/libeay32.def
-+perl util/mkdef.pl 32 ssleay > ms/ssleay32.def
-diff --git a/util/mk1mf.pl b/util/mk1mf.pl
-index 72fa089..d98def1 100755
---- a/util/mk1mf.pl
-+++ b/util/mk1mf.pl
-@@ -233,6 +233,9 @@ else
- 	$cflags.=' -DTERMIO';
- 	}
- 
-+# force unix style path separator
-+${o} = "/";
-+
- $fipsdir =~ s/\//${o}/g;
- 
- $out_dir=(defined($VARS{'OUT'}))?$VARS{'OUT'}:$out_def.($debug?".dbg":"");
diff --git a/external/openssl/openssl-3650-masm.patch.1 b/external/openssl/openssl-3650-masm.patch.1
deleted file mode 100644
index 97f1eb6446c3..000000000000
--- a/external/openssl/openssl-3650-masm.patch.1
+++ /dev/null
@@ -1,35 +0,0 @@
-diff --git a/crypto/perlasm/x86masm.pl b/crypto/perlasm/x86masm.pl
-index 1741342..917d0f8 100644
---- a/crypto/perlasm/x86masm.pl
-+++ b/crypto/perlasm/x86masm.pl
-@@ -18,10 +18,10 @@ sub ::generic
- 
-     if ($opcode =~ /lea/ && @arg[1] =~ s/.*PTR\s+(\(.*\))$/OFFSET $1/)	# no []
-     {	$opcode="mov";	}
--    elsif ($opcode !~ /movq/)
-+    elsif ($opcode !~ /mov[dq]$/)
-     {	# fix xmm references
--	$arg[0] =~ s/\b[A-Z]+WORD\s+PTR/XMMWORD PTR/i if ($arg[1]=~/\bxmm[0-7]\b/i);
--	$arg[1] =~ s/\b[A-Z]+WORD\s+PTR/XMMWORD PTR/i if ($arg[0]=~/\bxmm[0-7]\b/i);
-+	$arg[0] =~ s/\b[A-Z]+WORD\s+PTR/XMMWORD PTR/i if ($arg[-1]=~/\bxmm[0-7]\b/i);
-+	$arg[-1] =~ s/\b[A-Z]+WORD\s+PTR/XMMWORD PTR/i if ($arg[0]=~/\bxmm[0-7]\b/i);
-     }
- 
-     &::emit($opcode,@arg);
-@@ -160,13 +160,13 @@ sub ::public_label
- {   push(@out,"PUBLIC\t".&::LABEL($_[0],$nmdecor.$_[0])."\n");   }
- 
- sub ::data_byte
--{   push(@out,("DB\t").join(',',@_)."\n");	}
-+{   push(@out,("DB\t").join(',',splice(@_,0,16))."\n") while(@_);	}
- 
- sub ::data_short
--{   push(@out,("DW\t").join(',',@_)."\n");	}
-+{   push(@out,("DW\t").join(',',splice(@_,0,8))."\n") while(@_);	}
- 
- sub ::data_word
--{   push(@out,("DD\t").join(',',@_)."\n");	}
-+{   push(@out,("DD\t").join(',',splice(@_,0,4))."\n") while(@_);	}
- 
- sub ::align
- {   push(@out,"ALIGN\t$_[0]\n");	}
diff --git a/external/openssl/openssl-fixbuild.patch.1 b/external/openssl/openssl-fixbuild.patch.1
deleted file mode 100644
index 5a986e87214b..000000000000
--- a/external/openssl/openssl-fixbuild.patch.1
+++ /dev/null
@@ -1,23 +0,0 @@
---- a/crypto/evp/Makefile
-+++ b/crypto/evp/Makefile
-@@ -289,7 +289,7 @@
- e_idea.o: ../../e_os.h ../../include/openssl/asn1.h ../../include/openssl/bio.h
- e_idea.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
- e_idea.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
--e_idea.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
-+e_idea.o: ../../include/openssl/evp.h ../idea/idea.h
- e_idea.o: ../../include/openssl/lhash.h ../../include/openssl/obj_mac.h
- e_idea.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
- e_idea.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
---- a/util/mklink.pl
-+++ b/util/mklink.pl
-@@ -50,8 +50,7 @@
- my $to = join('/', @to_path);
- 
- my $file;
--$symlink_exists=eval {symlink("",""); 1};
--if ($^O eq "msys") { $symlink_exists=0 };
-+$symlink_exists=0;
- foreach $file (@files) {
-     my $err = "";
-     if ($symlink_exists) {
diff --git a/external/openssl/openssl-no-multilib.patch.0 b/external/openssl/openssl-no-multilib.patch.0
new file mode 100644
index 000000000000..07c45318ac25
--- /dev/null
+++ b/external/openssl/openssl-no-multilib.patch.0
@@ -0,0 +1,38 @@
+--- Configure.orig	2020-04-21 14:22:39.000000000 +0200
++++ Configure	2020-07-07 17:25:19.256297500 +0200
+@@ -24,7 +24,7 @@
+ my $orig_death_handler = $SIG{__DIE__};
+ $SIG{__DIE__} = \&death_handler;
+ 
+-my $usage="Usage: Configure [no-<cipher> ...] [enable-<cipher> ...] [-Dxxx] [-lxxx] [-Lxxx] [-fxxx] [-Kxxx] [no-hw-xxx|no-hw] [[no-]threads] [[no-]shared] [[no-]zlib|zlib-dynamic] [no-asm] [no-egd] [sctp] [386] [--prefix=DIR] [--openssldir=OPENSSLDIR] [--with-xxx[=vvv]] [--config=FILE] os/compiler[:flags]\n";
++my $usage="Usage: Configure [no-<cipher> ...] [enable-<cipher> ...] [-Dxxx] [-lxxx] [-Lxxx] [-fxxx] [-Kxxx] [no-hw-xxx|no-hw] [[no-]threads] [[no-]shared] [[no-]zlib|zlib-dynamic] [no-asm] [no-egd] [no-multilib] [sctp] [386] [--prefix=DIR] [--openssldir=OPENSSLDIR] [--with-xxx[=vvv]] [--config=FILE] os/compiler[:flags]\n";
+ 
+ # Options:
+ #
+@@ -59,6 +59,7 @@
+ #               If disabled, it also disables shared and dynamic-engine.
+ # no-asm        do not use assembler
+ # no-egd        do not compile support for the entropy-gathering daemon APIs
++# no-multilib   exclude multilib identifier from library name
+ # [no-]zlib     [don't] compile support for zlib compression.
+ # zlib-dynamic  Like "zlib", but the zlib library is expected to be a shared
+ #               library and will be loaded in run-time by the OpenSSL library.
+@@ -383,6 +384,7 @@
+     "mdc2",
+     "msan",
+     "multiblock",
++    "multilib",
+     "nextprotoneg",
+     "pinshared",
+     "ocb",
+@@ -1754,6 +1756,10 @@
+             if (-f catfile($srcdir, "test", $_, "build.info"));
+     }
+ 
++    if ($disabled{"multilib"}) {
++        $target{"multilib"} = "";
++    }
++
+     $config{build_infos} = [ ];
+ 
+     my %ordinals = ();
diff --git a/external/openssl/openssllnx.patch b/external/openssl/openssllnx.patch
deleted file mode 100644
index 224df8f87b2e..000000000000
--- a/external/openssl/openssllnx.patch
+++ /dev/null
@@ -1,23 +0,0 @@
---- build/openssl-0.9.8v/Configure-old	2010-04-17 13:51:42.000000000 +0200
-+++ build/openssl-0.9.8v/Configure	2010-04-17 13:52:03.000000000 +0200
-@@ -388,6 +388,9 @@
- 
- "bsdi-elf-gcc",     "gcc:-DPERL5 -DL_ENDIAN -fomit-frame-pointer -O3 -march=i486 -Wall::(unknown)::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
- 
-+"debian-kfreebsd-amd64","gcc:-m64 -DL_ENDIAN -DTERMIOS -O3 -Wa,--noexecstack -Wall -DMD32_REG_T=int::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK BF_PTR2 DES_INT DES_UNROLL:${x86_64_asm}:dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-+"debian-kfreebsd-i386","gcc:-DL_ENDIAN -DTERMIOS -O3 -Wa,--noexecstack -g -march=i486 -Wall::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-+
- "nextstep",	"cc:-O -Wall:<libc.h>:(unknown):::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:::",
- "nextstep3.3",	"cc:-O3 -Wall:<libc.h>:(unknown):::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:::",
- 
---- build/openssl-0.9.8v/Makefile.org	2010-01-27 17:06:36.000000000 +0100
-+++ build/openssl-0.9.8v/Makefile.org	2010-09-20 09:24:00.000000000 +0100
-@@ -206,7 +206,7 @@
- # same language for uniform treatment.
- BUILDENV=	LC_ALL=C PLATFORM='$(PLATFORM)' PROCESSOR='$(PROCESSOR)'\
- 		CC='$(CC)' CFLAG='$(CFLAG)' 			\
--		AS='$(CC)' ASFLAG='$(CFLAG) -c'			\
-+		AS='$(CC)' ASFLAG='$(CFLAG) -c -Wa,--noexecstack'       \
- 		AR='$(AR)' NM='$(NM)' RANLIB='$(RANLIB)'	\
- 		RC='$(RC)'              			\
- 		CROSS_COMPILE='$(CROSS_COMPILE)'	\
diff --git a/external/openssl/opensslsol.patch b/external/openssl/opensslsol.patch
deleted file mode 100644
index 6122b67c930e..000000000000
--- a/external/openssl/opensslsol.patch
+++ /dev/null
@@ -1,20 +0,0 @@
---- misc/openssl-0.9.8v/Makefile.shared	Wed Sep 17 17:56:40 2008
-+++ build/openssl-0.9.8v/Makefile.shared	Fri Mar 26 16:04:41 2010
-@@ -95,7 +95,7 @@
-     LDCMD="$${LDCMD:-$(CC)}"; LDFLAGS="$${LDFLAGS:-$(CFLAGS)}"; \
-     LIBPATH=`for x in $$LIBDEPS; do echo $$x; done | sed -e 's/^ *-L//;t' -e d | uniq`; \
-     LIBPATH=`echo $$LIBPATH | sed -e 's/ /:/g'`; \
--    LD_LIBRARY_PATH=$$LIBPATH:$$LD_LIBRARY_PATH \
-+    LD_LIBRARY_PATH=$$LD_LIBRARY_PATH \
-     $${LDCMD} $${LDFLAGS} -o $${APPNAME:=$(APPNAME)} $(OBJECTS) $${LIBDEPS} )
- 
- LINK_SO=	\
-@@ -105,7 +105,7 @@
-     SHAREDFLAGS="$${SHAREDFLAGS:-$(CFLAGS) $(SHARED_LDFLAGS)}"; \
-     LIBPATH=`for x in $$LIBDEPS; do echo $$x; done | sed -e 's/^ *-L//;t' -e d | uniq`; \
-     LIBPATH=`echo $$LIBPATH | sed -e 's/ /:/g'`; \
--    LD_LIBRARY_PATH=$$LIBPATH:$$LD_LIBRARY_PATH \
-+    LD_LIBRARY_PATH=$$LD_LIBRARY_PATH \
-     $${SHAREDCMD} $${SHAREDFLAGS} \
- 	-o $$SHLIB$$SHLIB_SOVER$$SHLIB_SUFFIX \
- 	$$ALLSYMSFLAGS $$SHOBJECTS $$NOALLSYMSFLAGS $$LIBDEPS \
diff --git a/external/openssl/opensslwnt.patch b/external/openssl/opensslwnt.patch
deleted file mode 100644
index e22bea6f077b..000000000000
--- a/external/openssl/opensslwnt.patch
+++ /dev/null
@@ -1,167 +0,0 @@
-diff -ru openssl.orig/crypto/x509v3/v3_pci.c openssl/crypto/x509v3/v3_pci.c
---- a/openssl.orig/crypto/x509v3/v3_pci.c	2016-03-01 14:35:05.000000000 +0100
-+++ b/openssl/crypto/x509v3/v3_pci.c	2016-03-03 20:27:42.195914432 +0100
-@@ -3,7 +3,7 @@
-  * Contributed to the OpenSSL Project 2004 by Richard Levitte
-  * (richard@levitte.org)
-  */
--/* Copyright (c) 2004 Kungliga Tekniska Högskolan
-+/* Copyright (c) 2004 Kungliga Tekniska Hoegskolan
-  * (Royal Institute of Technology, Stockholm, Sweden).
-  * All rights reserved.
-  *
-diff -ru openssl.orig/crypto/x509v3/v3_pcia.c openssl/crypto/x509v3/v3_pcia.c
---- a/openssl.orig/crypto/x509v3/v3_pcia.c	2016-03-01 14:35:05.000000000 +0100
-+++ b/openssl/crypto/x509v3/v3_pcia.c	2016-03-03 20:27:56.495913984 +0100
-@@ -3,7 +3,7 @@
-  * Contributed to the OpenSSL Project 2004 by Richard Levitte
-  * (richard@levitte.org)
-  */
--/* Copyright (c) 2004 Kungliga Tekniska Högskolan
-+/* Copyright (c) 2004 Kungliga Tekniska Hoegskolan
-  * (Royal Institute of Technology, Stockholm, Sweden).
-  * All rights reserved.
-  *
-diff -ru openssl.orig/ms/do_ms.bat openssl/ms/do_ms.bat
---- a/openssl.orig/ms/do_ms.bat	2015-01-15 15:43:14.000000000 +0100
-+++ b/openssl/ms/do_ms.bat	2016-03-03 20:31:09.355907935 +0100
-@@ -1,11 +1,11 @@
- 
--perl util\mkfiles.pl >MINFO
--perl util\mk1mf.pl no-asm VC-WIN32 >ms\nt.mak
--perl util\mk1mf.pl dll no-asm VC-WIN32 >ms\ntdll.mak
--if x%OSVERSION% == x goto skipce
--perl util\mk1mf.pl no-asm VC-CE >ms\ce.mak
--perl util\mk1mf.pl dll no-asm VC-CE >ms\cedll.mak
--:skipce
-+%1 util\mkfiles.pl >MINFO
-+if %2 == VC-WIN32 goto not64a
-+perl ms\uplink.pl win64a > ms\uptable.asm
-+ml64 -c -Foms\uptable.obj ms\uptable.asm
-+:not64a
-+%1 util\mk1mf.pl no-asm %2 >ms\nt.mak
-+%1 util\mk1mf.pl dll no-asm %2 >ms\ntdll.mak
- 
--perl util\mkdef.pl 32 libeay > ms\libeay32.def
--perl util\mkdef.pl 32 ssleay > ms\ssleay32.def
-+%1 util\mkdef.pl 32 libeay > ms\libeay32.def
-+%1 util\mkdef.pl 32 ssleay > ms\ssleay32.def
-diff -ru openssl.orig/util/mk1mf.pl openssl/util/mk1mf.pl
---- a/openssl.orig/util/mk1mf.pl	2016-03-03 20:22:21.043924505 +0100
-+++ b/openssl/util/mk1mf.pl	2016-03-03 20:34:45.015901171 +0100
-@@ -163,7 +163,7 @@
- $inc_def="outinc";
- $tmp_def="tmp";
- 
--$perl="perl" unless defined $perl;
-+$perl="$ENV{PERL}" unless defined $perl;
- $mkdir="-mkdir" unless defined $mkdir;
- 
- ($ssl,$crypto)=("ssl","crypto");
-@@ -347,6 +347,11 @@
- 	s/\s*$//; # was chop, didn't work in mixture of perls for Windows...
- 
- 	($key,$val)=/^([^=]+)=(.*)/;
-+
-+	# On some Windows machines, $val has linefeeds at the end, which confuses
-+	# subsequent code in this file. So we strip all whitespace at the end.
-+	$val =~ s/\s+$//;
-+
- 	if ($key eq "RELATIVE_DIRECTORY")
- 		{
- 		if ($lib ne "")
-@@ -473,7 +478,7 @@
- # Set your compiler options
- PLATFORM=$platform
- CC=$bin_dir${cc}
--CFLAG=$cflags
-+CFLAG=$cflags \$(SOLARINC)
- APP_CFLAG=$app_cflag
- LIB_CFLAG=$lib_cflag
- SHLIB_CFLAG=$shl_cflag
-@@ -488,7 +493,7 @@
- 
- LINK_CMD=$link
- LFLAGS=$lflags
--RSC=$rsc
-+RSC=$rsc \$(SOLARINC)
- 
- # The output directory for everything interesting
- OUT_D=$out_dir
-@@ -669,7 +674,7 @@
- printf OUT <<EOF;
- #ifdef $platform_cpp_symbol
-   /* auto-generated/updated by util/mk1mf.pl for crypto/cversion.c */
--  #define CFLAGS "compiler: $cc $cflags"
-+  #define CFLAGS "compiler: $cflags"
-   #define PLATFORM "$platform"
- EOF
- printf OUT "  #define DATE \"%s\"\n", scalar gmtime();
-diff -ru openssl.orig/util/pl/VC-32.pl openssl/util/pl/VC-32.pl
---- a/openssl.orig/util/pl/VC-32.pl	2016-03-01 14:35:53.000000000 +0100
-+++ b/openssl/util/pl/VC-32.pl	2016-03-03 21:15:14.083824986 +0100
-@@ -30,7 +30,7 @@
- my $ff = "";
- 
- # C compiler stuff
--$cc='cl';
-+$cc=$ENV{'CC'};
- if ($FLAVOR =~ /WIN64/)
-     {
-     # Note that we currently don't have /WX on Win64! There is a lot of
-@@ -114,7 +114,7 @@
-     }
- 
-     $cc=($ENV{CC} or "cl");
--    $base_cflags=' /W3 /WX /GF /Gy /nologo -DUNICODE -D_UNICODE -DOPENSSL_SYSNAME_WINCE -DWIN32_LEAN_AND_MEAN -DL_ENDIAN -DDSO_WIN32 -DNO_CHMOD -DOPENSSL_SMALL_FOOTPRINT';
-+    $base_cflags=' -W3 -GF -Gy -nologo -DUNICODE -D_UNICODE -DOPENSSL_SYSNAME_WINCE -DWIN32_LEAN_AND_MEAN -DL_ENDIAN -DDSO_WIN32 -DNO_CHMOD -DOPENSSL_SMALL_FOOTPRINT';
-     $base_cflags.=" $wcecdefs";
-     $base_cflags.=' -I$(WCECOMPAT)/include'		if (defined($ENV{'WCECOMPAT'}));
-     $base_cflags.=' -I$(PORTSDK_LIBPATH)/../../include'	if (defined($ENV{'PORTSDK_LIBPATH'}));
-@@ -123,20 +123,21 @@
-     } else {
- 	$base_cflags.=' /MC';
-     }
--    $opt_cflags=' /O1i';	# optimize for space, but with intrinsics...
--    $dbg_cflags=' /Od -DDEBUG -D_DEBUG';
-+    $opt_cflags=' -O1i';   # optimize for space, but with intrinsics...
-+    $dbg_cflags=' -Od -DDEBUG -D_DEBUG';
-+
-     $lflags="/nologo /opt:ref $wcelflag";
-     }
- else	# Win32
-     {
-     $base_cflags= " $mf_cflag";
--    my $f = $shlib || $fips ?' /MD':' /MT';
-+    my $f = $shlib || $fips ? (($ENV{MSVC_USE_DEBUG_RUNTIME} eq "TRUE") ? ' -MDd' : ' -MD' ):' -MT';
-     $ff = "/fixed";
--    $opt_cflags=$f.' /Ox /O2 /Ob2';
--    $dbg_cflags=$f.'d /Od -DDEBUG -D_DEBUG';
-+    $opt_cflags=$f.' -Ox -O2 -Ob2';
-+    $dbg_cflags=$f.'d -Od -DDEBUG -D_DEBUG';
-     $lflags="/nologo /subsystem:console /opt:ref";
-     }
--$lib_cflag='/Zl' if (!$shlib);	# remove /DEFAULTLIBs from static lib
-+$lib_cflag='-Zl' if (!$shlib);	# remove /DEFAULTLIBs from static lib
- $mlflags='';
- 
- $out_def ="out32";	$out_def.="dll"			if ($shlib);
-@@ -161,7 +162,7 @@
- 
- $obj='.obj';
- $asm_suffix='.asm';
--$ofile="/Fo";
-+$ofile="-Fo.\\";
- 
- # EXE linking stuff
- $link="link";
-diff -ru openssl.orig/ms/uplink.c openssl/ms/uplink.c
---- a/openssl.orig/ms/uplink.c	2015-03-19 15:02:02.000000000 +0100
-+++ b/openssl/ms/uplink.c	2016-03-03 20:39:19.403892565 +0100
-@@ -1,5 +1,6 @@
- #if (defined(_WIN64) || defined(_WIN32_WCE)) && !defined(UNICODE)
- # define UNICODE
-+# define _CRT_NON_CONFORMING_SWPRINTFS
- #endif
- #if defined(UNICODE) && !defined(_UNICODE)
- # define _UNICODE
diff --git a/external/openssl/opensslwnt_safeseh.patch b/external/openssl/opensslwnt_safeseh.patch
deleted file mode 100644
index f2eafab5b9ed..000000000000
--- a/external/openssl/opensslwnt_safeseh.patch
+++ /dev/null
@@ -1,23 +0,0 @@
-use /safeseh in 32-bit MSVC builds; this is not required for 64-bit
-
-diff -ru openssl.orig/util/mk1mf.pl openssl/util/mk1mf.pl
---- a/openssl.orig/util/mk1mf.pl	2016-03-03 20:22:21.043924505 +0100
-+++ b/openssl/util/mk1mf.pl	2016-03-03 20:34:45.015901171 +0100
-@@ -488,7 +493,7 @@
- SRC_D=$src_dir
- 
- LINK_CMD=$link
--LFLAGS=$lflags
-+LFLAGS=$lflags /SAFESEH
- RSC=$rsc \$(SOLARINC)
- 
- # The output directory for everything interesting
-@@ -511,7 +516,7 @@
- MKDIR=$mkdir
- MKLIB=$bin_dir$mklib
- MLFLAGS=$mlflags
--ASM=$bin_dir$asm
-+ASM=$bin_dir$asm /safeseh
- 
- # FIPS validated module and support file locations
- 
diff --git a/external/postgresql/ExternalProject_postgresql.mk b/external/postgresql/ExternalProject_postgresql.mk
index 2d360134e6ba..e73a1c19f789 100644
--- a/external/postgresql/ExternalProject_postgresql.mk
+++ b/external/postgresql/ExternalProject_postgresql.mk
@@ -43,7 +43,7 @@ endif
 ifeq ($(DISABLE_OPENSSL),)
 ifeq ($(SYSTEM_OPENSSL),)
 postgresql_CPPFLAGS += -I$(call gb_UnpackedTarball_get_dir,openssl)/include
-postgresql_LDFLAGS  += -L$(call gb_UnpackedTarball_get_dir,openssl)/
+postgresql_LDFLAGS  += -L$(call gb_UnpackedTarball_get_dir,openssl)/ $(if $(filter $(OS),LINUX),-pthread)
 endif
 endif
 
diff --git a/external/postgresql/postgres-msvc-build.patch.1 b/external/postgresql/postgres-msvc-build.patch.1
index 4ccd82aa28fb..c217a755918b 100644
--- a/external/postgresql/postgres-msvc-build.patch.1
+++ b/external/postgresql/postgres-msvc-build.patch.1
@@ -80,7 +80,7 @@ Also Cygwin perl has $Config{osname} different from MSWin32, and why even check
  	# Quote the .exe name in case it has spaces
  	my $opensslcmd =
 -	  qq("$self->{options}->{openssl}\\bin\\openssl.exe" version 2>&1);
-+	  qq("$self->{options}->{openssl}\\out32dll\\openssl.exe" version 2>&1);
++	  qq("$self->{options}->{openssl}\\apps\\openssl.exe" version 2>&1);
 + print "$opensslcmd";
  	my $sslout = `$opensslcmd`;
  
@@ -101,10 +101,10 @@ Also Cygwin perl has $Config{osname} different from MSWin32, and why even check
  				# parameter.
  				$proj->AddLibrary(
 -					$self->{options}->{openssl} . '\lib\ssleay32.lib', 0);
-+					$self->{options}->{openssl} . '\out32dll\ssleay32.lib', 0);
++					$self->{options}->{openssl} . '\ssleay32.lib', 0);
  				$proj->AddLibrary(
 -					$self->{options}->{openssl} . '\lib\libeay32.lib', 0);
-+					$self->{options}->{openssl} . '\out32dll\libeay32.lib', 0);
++					$self->{options}->{openssl} . '\libeay32.lib', 0);
  			}
  		}
  	}
diff --git a/external/python3/ExternalProject_python3.mk b/external/python3/ExternalProject_python3.mk
index 075cc6f50d78..b248645f4260 100644
--- a/external/python3/ExternalProject_python3.mk
+++ b/external/python3/ExternalProject_python3.mk
@@ -37,7 +37,7 @@ $(call gb_ExternalProject_get_state_target,python3,build) :
 			/p:Configuration=$(if $(MSVC_USE_DEBUG_RUNTIME),Debug,Release) \
 			/p:Platform=$(if $(filter INTEL,$(CPUNAME)),Win32,x64) \
 			/p:opensslIncludeDir=$(call gb_UnpackedTarball_get_dir,openssl)/include \
-			/p:opensslOutDir=$(call gb_UnpackedTarball_get_dir,openssl)/out32dll \
+			/p:opensslOutDir=$(call gb_UnpackedTarball_get_dir,openssl) \
 			/p:zlibDir=$(call gb_UnpackedTarball_get_dir,zlib) \
 			/maxcpucount \
 			$(if $(filter 140,$(VCVER)),/p:PlatformToolset=v140 /p:VisualStudioVersion=14.0 /ToolsVersion:14.0) \
diff --git a/external/python3/python-3.7.6-msvc-ssl.patch.1 b/external/python3/python-3.7.6-msvc-ssl.patch.1
index e8e94f674c1f..7c4a6ebc0fb7 100644
--- a/external/python3/python-3.7.6-msvc-ssl.patch.1
+++ b/external/python3/python-3.7.6-msvc-ssl.patch.1
@@ -14,27 +14,12 @@ No use for applink.c OPENSSL_Applink, everything is compiled with the same MSVC
      <ResourceCompile Include="..\PC\python_nt.rc" />

 --- python3/PCbuild/openssl.props.orig	2019-12-23 16:20:34.588135900 +0100
 +++ python3/PCbuild/openssl.props	2019-12-23 16:20:51.074001300 +0100
-@@ -6,7 +6,7 @@
-     </ClCompile>

-     <Link>

-       <AdditionalLibraryDirectories>$(opensslOutDir);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>

--      <AdditionalDependencies>ws2_32.lib;libcrypto.lib;libssl.lib;%(AdditionalDependencies)</AdditionalDependencies>

-+      <AdditionalDependencies>ws2_32.lib;libeay32.lib;ssleay32.lib;%(AdditionalDependencies)</AdditionalDependencies>

-     </Link>

+@@ -6,8 +6,6 @@
    </ItemDefinitionGroup>

    <PropertyGroup>

-@@ -15,10 +15,10 @@
-     <_DLLSuffix Condition="$(Platform) == 'ARM64'">$(_DLLSuffix)-arm64</_DLLSuffix>

+     <_DLLSuffix>-1_1</_DLLSuffix>

+-    <_DLLSuffix Condition="$(Platform) == 'ARM'">$(_DLLSuffix)-arm</_DLLSuffix>

+-    <_DLLSuffix Condition="$(Platform) == 'ARM64'">$(_DLLSuffix)-arm64</_DLLSuffix>

    </PropertyGroup>

    <ItemGroup>

--    <_SSLDLL Include="$(opensslOutDir)\libcrypto$(_DLLSuffix).dll" />

--    <_SSLDLL Include="$(opensslOutDir)\libcrypto$(_DLLSuffix).pdb" />

--    <_SSLDLL Include="$(opensslOutDir)\libssl$(_DLLSuffix).dll" />

--    <_SSLDLL Include="$(opensslOutDir)\libssl$(_DLLSuffix).pdb" />

-+    <_SSLDLL Include="$(opensslOutDir)\libeay32.dll" />

-+    <_SSLDLL Include="$(opensslOutDir)\libeay32.pdb" />

-+    <_SSLDLL Include="$(opensslOutDir)\ssleay32.dll" />

-+    <_SSLDLL Include="$(opensslOutDir)\ssleay32.pdb" />

-   </ItemGroup>

-   <Target Name="_CopySSLDLL" Inputs="@(_SSLDLL)" Outputs="@(_SSLDLL->'$(OutDir)%(Filename)%(Extension)')" AfterTargets="Build">

-     <Copy SourceFiles="@(_SSLDLL)" DestinationFolder="$(OutDir)" />

+     <_SSLDLL Include="$(opensslOutDir)\libcrypto$(_DLLSuffix).dll" />