upgrade to openssl-3.0.5

patch out using IPC::Cmd instead of requiring adding it
to build-time dependencies

for mysterious:

The system cannot find the path specified.
NMAKE : fatal error U1077: '""C:\PROGRA~2\MIB055~1\2019\COMMUN~1\VC\Tools\MSVC\1429~1.301\bin\Hostx64\x86\cl.exe' : return code '0x1'
Stop.
NMAKE : fatal error U1077: '"C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\VC\Tools\MSVC\14.29.30133\bin\Hostx64\x86\nmake.exe"' : return code '0x2'
Stop.

include fix from https://github.com/openssl/openssl/issues/18823

and for

move /Y crypto/aes/aes-586.asm.i crypto/aes/aes-586.asm
The system cannot find the path specified.
NMAKE : fatal error U1077: 'move' : return code '0x1'

add own patch to use mv and rm for move and del

Change-Id: I071750e20efd0931ea1c5c3b49e7a5173c7283f8
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/139641
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>

10 files changed, 171 insertions, 25 deletions

diff --git a/bin/symstore.sh b/bin/symstore.sh
index 2734f1b22a58..332c9d817f56 100755
--- a/bin/symstore.sh
+++ b/bin/symstore.sh
@@ -16,8 +16,8 @@ EXCLUDE_LIST="python.exe"
 #
 # Same format as for EXCLUDE_LIST above
 MOREPDBS_OKLIST="libcurl.dll
-libcrypto-1_1.dll
-libssl-1_1.dll
+libcrypto-3.dll
+libssl-3.dll
 freebl3.dll
 libeay32.dll
 nspr4.dll
diff --git a/download.lst b/download.lst
index 6a86898646d8..c6f95a10d6a2 100644
--- a/download.lst
+++ b/download.lst
@@ -196,8 +196,8 @@ export OFFICEOTRON_SHA256SUM := f2443f27561af52324eee03a1892d9f569adc8db9e7bca55
 export OFFICEOTRON_JAR := 8249374c274932a21846fa7629c2aa9b-officeotron-0.7.4-master.jar
 export OPENLDAP_SHA256SUM := 99f37d6747d88206c470067eda624d5e48c1011e943ec0ab217bae8712e22f34
 export OPENLDAP_TARBALL := openldap-2.4.59.tgz
-export OPENSSL_SHA256SUM := d7939ce614029cdff0b6c20f0e2e5703158a489a72b2507b8bd51bf8c8fd10ca
-export OPENSSL_TARBALL := openssl-1.1.1q.tar.gz
+export OPENSSL_SHA256SUM := aa7d8d9bef71ad6525c55ba11e5f4397889ce49c2c9349dcea6d3e4f0b024a7a
+export OPENSSL_TARBALL := openssl-3.0.5.tar.gz
 export ORCUS_SHA256SUM := 2a86c405a5929f749b27637509596421d46805753364ab258b035fd01fbde143
 export ORCUS_TARBALL := liborcus-0.17.2.tar.bz2
 export PAGEMAKER_SHA256SUM := 66adacd705a7d19895e08eac46d1e851332adf2e736c566bef1164e7a442519d
diff --git a/external/openssl/0001-Inthe-VC-common-target-unquote-CC.patch.1 b/external/openssl/0001-Inthe-VC-common-target-unquote-CC.patch.1
new file mode 100644
index 000000000000..45ce5a9038e5
--- /dev/null
+++ b/external/openssl/0001-Inthe-VC-common-target-unquote-CC.patch.1
@@ -0,0 +1,54 @@
+From c04b8819161de007cee831dd9e58dde52268da18 Mon Sep 17 00:00:00 2001
+From: Richard Levitte <levitte@openssl.org>
+Date: Mon, 25 Jul 2022 08:07:33 +0200
+Subject: [PATCH] Configurations/10-main.conf: In the VC-common target, unquote
+ $(CC)
+
+Some of the VC-common attributes have values that use `$(CC)`, wrapped with
+quotes.  However, `Configurations/windows-makefile.tmpl` already quotes the
+`CC` value, like this:
+
+    CC="{- $config{CC} -}"
+
+The interaction between that makefile variable and the attributes using
+`$(CC)` wrapped with quotes is a command line with the quotes doubled.  For
+example, the value of `$(CPP)` becomes `""cl""`.
+
+Strangely enough, this appears to be tolerated, at least on some versions of
+Windows.  However, this has been reported not to be the case.
+
+This is fixed by removing the quotes in `Configurations/10-main.conf`,
+making `Configurations/windows-makefile.tmpl` responsible for proper
+quoting.
+
+Fixes #18823
+
+Reviewed-by: Hugo Landau <hlandau@openssl.org>
+Reviewed-by: Matt Caswell <matt@openssl.org>
+(Merged from https://github.com/openssl/openssl/pull/18861)
+---
+ Configurations/10-main.conf | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/Configurations/10-main.conf b/Configurations/10-main.conf
+index c824f4ed4a0..73ace78bc41 100644
+--- a/Configurations/10-main.conf
++++ b/Configurations/10-main.conf
+@@ -1309,7 +1309,7 @@ my %targets = (
+         inherit_from     => [ "BASE_Windows" ],
+         template         => 1,
+         CC               => "cl",
+-        CPP              => '"$(CC)" /EP /C',
++        CPP              => '$(CC) /EP /C',
+         CFLAGS           => "/W3 /wd4090 /nologo",
+         coutflag         => "/Fo",
+         LD               => "link",
+@@ -1318,7 +1318,7 @@ my %targets = (
+         ldpostoutflag    => "",
+         ld_resp_delim    => "\n",
+         bin_lflags       => "setargv.obj",
+-        makedepcmd       => '"$(CC)" /Zs /showIncludes',
++        makedepcmd       => '$(CC) /Zs /showIncludes',
+         makedep_scheme   => 'VC',
+         AR               => "lib",
+         ARFLAGS          => "/nologo",
diff --git a/external/openssl/ExternalPackage_openssl.mk b/external/openssl/ExternalPackage_openssl.mk
index d0c0dbaab975..7d02dfc6ed1c 100644
--- a/external/openssl/ExternalPackage_openssl.mk
+++ b/external/openssl/ExternalPackage_openssl.mk
@@ -13,14 +13,14 @@ $(eval $(call gb_ExternalPackage_use_external_project,openssl,openssl))
 
 ifeq ($(COM),MSC)
 $(eval $(call gb_ExternalPackage_add_files,openssl,$(LIBO_LIB_FOLDER),\
-    libcrypto-1_1.dll \
-    libssl-1_1.dll \
+    libcrypto-3.dll \
+    libssl-3.dll \
 ))
 ifneq ($(DISABLE_PYTHON),TRUE)
 ifneq ($(SYSTEM_PYTHON),TRUE)
 $(eval $(call gb_ExternalPackage_add_files,openssl,$(LIBO_LIB_FOLDER)/python-core-$(PYTHON_VERSION)/lib, \
-    libcrypto-1_1.dll \
-    libssl-1_1.dll \
+    libcrypto-3.dll \
+    libssl-3.dll \
 ))
 endif
 endif
diff --git a/external/openssl/UnpackedTarball_openssl.mk b/external/openssl/UnpackedTarball_openssl.mk
index c52b427a866e..18ed71850627 100644
--- a/external/openssl/UnpackedTarball_openssl.mk
+++ b/external/openssl/UnpackedTarball_openssl.mk
@@ -14,6 +14,9 @@ $(eval $(call gb_UnpackedTarball_set_tarball,openssl,$(OPENSSL_TARBALL),,openssl
 $(eval $(call gb_UnpackedTarball_add_patches,openssl,\
 	external/openssl/openssl-no-multilib.patch.0 \
 	external/openssl/configurable-z-option.patch.0 \
+	external/openssl/openssl-no-ipc-cmd.patch.0 \
+	external/openssl/0001-Inthe-VC-common-target-unquote-CC.patch.1 \
+	external/openssl/system-cannot-find-path-for-move.patch.0 \
 ))
 
 # vim: set noet sw=4 ts=4:
diff --git a/external/openssl/configurable-z-option.patch.0 b/external/openssl/configurable-z-option.patch.0
index 3dcf49dc81a6..9a4426edd5d2 100644
--- a/external/openssl/configurable-z-option.patch.0
+++ b/external/openssl/configurable-z-option.patch.0
@@ -18,7 +18,7 @@
                                 asflags   => "/Cp /coff /c /Cx",
                                 asoutflag => "/Fo",
                                 perlasm_scheme => "win32" };
-@@ -1231,10 +1231,10 @@
+@@ -1323,10 +1323,10 @@
                                  "UNICODE", "_UNICODE",
                                  "_CRT_SECURE_NO_DEPRECATE",
                                  "_WINSOCK_DEPRECATED_NO_WARNINGS"),
@@ -29,6 +29,6 @@
 -        bin_cflags       => "/Zi /Fdapp.pdb",
 +        dso_cflags       => "\$(DEBUG_FLAGS_VALUE)",
 +        bin_cflags       => "\$(DEBUG_FLAGS_VALUE)",
+         # def_flag made to empty string so a .def file gets generated
+         shared_defflag   => '',
          shared_ldflag    => "/dll",
-         shared_target    => "win-shared", # meaningless except it gives Configure a hint
-         thread_scheme    => "winthreads",
diff --git a/external/openssl/openssl-no-ipc-cmd.patch.0 b/external/openssl/openssl-no-ipc-cmd.patch.0
new file mode 100644
index 000000000000..f844831a34ae
--- /dev/null
+++ b/external/openssl/openssl-no-ipc-cmd.patch.0
@@ -0,0 +1,65 @@
+--- util/perl/OpenSSL/config.pm	2022-09-08 11:45:57.408532119 +0100
++++ util/perl/OpenSSL/config.pm	2022-09-08 11:47:46.877590711 +0100
+@@ -15,7 +15,7 @@
+ use warnings;
+ use Getopt::Std;
+ use File::Basename;
+-use IPC::Cmd;
++# use IPC::Cmd;
+ use POSIX;
+ use Carp;
+ 
+@@ -193,7 +193,8 @@
+ 
+ # Look for ISC/SCO with its unique uname program
+ sub is_sco_uname {
+-    return undef unless IPC::Cmd::can_run('uname');
++    return undef;
++#    return undef unless IPC::Cmd::can_run('uname');
+ 
+     open UNAME, "uname -X 2>/dev/null|" or return '';
+     my $line = "";
+@@ -291,13 +292,13 @@
+     $CCVENDOR = '';             # Dunno, don't care (unless found later)
+ 
+     # Find a compiler if we don't already have one
+-    if ( ! $cc ) {
+-        foreach (@c_compilers) {
+-            next unless IPC::Cmd::can_run("$CROSS_COMPILE$_");
+-            $CC = $_;
+-            last;
+-        }
+-    }
++#    if ( ! $cc ) {
++#        foreach (@c_compilers) {
++#            next unless IPC::Cmd::can_run("$CROSS_COMPILE$_");
++#            $CC = $_;
++#            last;
++#        }
++#    }
+ 
+     if ( $CC ) {
+         # Find the compiler vendor and version number for certain compilers
+@@ -352,14 +353,14 @@
+             }
+         }
+ 
+-        if ( ${SYSTEM} eq 'AIX' ) {
+-            # favor vendor cc over gcc
+-            if (IPC::Cmd::can_run('cc')) {
+-                $CC = 'cc';
+-                $CCVENDOR = ''; # Determine later
+-                $CCVER = 0;
+-            }
+-        }
++#        if ( ${SYSTEM} eq 'AIX' ) {
++#            # favor vendor cc over gcc
++#            if (IPC::Cmd::can_run('cc')) {
++#                $CC = 'cc';
++#                $CCVENDOR = ''; # Determine later
++#                $CCVER = 0;
++#            }
++#        }
+ 
+         if ( $SYSTEM eq "SunOS" ) {
+             # check for Oracle Developer Studio, expected output is "cc: blah-blah C x.x blah-blah"
diff --git a/external/openssl/openssl-no-multilib.patch.0 b/external/openssl/openssl-no-multilib.patch.0
index 07c45318ac25..83137fe5b712 100644
--- a/external/openssl/openssl-no-multilib.patch.0
+++ b/external/openssl/openssl-no-multilib.patch.0
@@ -1,15 +1,15 @@
 --- Configure.orig	2020-04-21 14:22:39.000000000 +0200
 +++ Configure	2020-07-07 17:25:19.256297500 +0200
-@@ -24,7 +24,7 @@
+@@ -28,7 +28,7 @@
  my $orig_death_handler = $SIG{__DIE__};
  $SIG{__DIE__} = \&death_handler;
  
 -my $usage="Usage: Configure [no-<cipher> ...] [enable-<cipher> ...] [-Dxxx] [-lxxx] [-Lxxx] [-fxxx] [-Kxxx] [no-hw-xxx|no-hw] [[no-]threads] [[no-]shared] [[no-]zlib|zlib-dynamic] [no-asm] [no-egd] [sctp] [386] [--prefix=DIR] [--openssldir=OPENSSLDIR] [--with-xxx[=vvv]] [--config=FILE] os/compiler[:flags]\n";
 +my $usage="Usage: Configure [no-<cipher> ...] [enable-<cipher> ...] [-Dxxx] [-lxxx] [-Lxxx] [-fxxx] [-Kxxx] [no-hw-xxx|no-hw] [[no-]threads] [[no-]shared] [[no-]zlib|zlib-dynamic] [no-asm] [no-egd] [no-multilib] [sctp] [386] [--prefix=DIR] [--openssldir=OPENSSLDIR] [--with-xxx[=vvv]] [--config=FILE] os/compiler[:flags]\n";
  
- # Options:
- #
-@@ -59,6 +59,7 @@
+ my $banner = <<"EOF";
+ 
+@@ -87,6 +87,7 @@
  #               If disabled, it also disables shared and dynamic-engine.
  # no-asm        do not use assembler
  # no-egd        do not compile support for the entropy-gathering daemon APIs
@@ -17,22 +17,22 @@
  # [no-]zlib     [don't] compile support for zlib compression.
  # zlib-dynamic  Like "zlib", but the zlib library is expected to be a shared
  #               library and will be loaded in run-time by the OpenSSL library.
-@@ -383,6 +384,7 @@
-     "mdc2",
+@@ -459,6 +460,7 @@
+     "module",
      "msan",
      "multiblock",
 +    "multilib",
      "nextprotoneg",
-     "pinshared",
      "ocb",
-@@ -1754,6 +1756,10 @@
-             if (-f catfile($srcdir, "test", $_, "build.info"));
-     }
+     "ocsp",
+@@ -1917,6 +1919,10 @@
+ 
+     my @build_dirs = ( [ ] );   # current directory
  
 +    if ($disabled{"multilib"}) {
 +        $target{"multilib"} = "";
 +    }
-+
++    
      $config{build_infos} = [ ];
  
-     my %ordinals = ();
+     # We want to detect configdata.pm in the source tree, so we
diff --git a/external/openssl/system-cannot-find-path-for-move.patch.0 b/external/openssl/system-cannot-find-path-for-move.patch.0
new file mode 100644
index 000000000000..7d08dd636730
--- /dev/null
+++ b/external/openssl/system-cannot-find-path-for-move.patch.0
@@ -0,0 +1,22 @@
+--- Configurations/windows-makefile.tmpl	2022-09-09 15:18:35.849924899 +0100
++++ Configurations/windows-makefile.tmpl	2022-09-09 15:20:28.895825331 +0100
+@@ -777,8 +777,8 @@
+ $target: "$gen0" $deps
+ 	cmd /C "set "ASM=\$(AS)" & $generator \$@.S"
+ 	\$(CPP) $incs $cppflags $defs \$@.S > \$@.i
+-	move /Y \$@.i \$@
+-        del /Q \$@.S
++	mv -f \$@.i \$@
++        rm -f \$@.S
+ EOF
+               }
+               # Otherwise....
+@@ -790,7 +790,7 @@
+           return <<"EOF";
+ $target: "$gen0" $deps
+ 	\$(CPP) $incs $cppflags $defs "$gen0" > \$@.i
+-	move /Y \$@.i \$@
++	mv -f \$@.i \$@
+ EOF
+       } elsif ($gen0 =~ m|^.*\.in$|) {
+           #
diff --git a/external/python3/python-3.7.6-msvc-ssl.patch.1 b/external/python3/python-3.7.6-msvc-ssl.patch.1
index 7c4a6ebc0fb7..610035d734c1 100644
--- a/external/python3/python-3.7.6-msvc-ssl.patch.1
+++ b/external/python3/python-3.7.6-msvc-ssl.patch.1
@@ -14,12 +14,14 @@ No use for applink.c OPENSSL_Applink, everything is compiled with the same MSVC
      <ResourceCompile Include="..\PC\python_nt.rc" />

 --- python3/PCbuild/openssl.props.orig	2019-12-23 16:20:34.588135900 +0100
 +++ python3/PCbuild/openssl.props	2019-12-23 16:20:51.074001300 +0100
-@@ -6,8 +6,6 @@
+@@ -10,9 +10,7 @@
+     </Link>

    </ItemDefinitionGroup>

    <PropertyGroup>

-     <_DLLSuffix>-1_1</_DLLSuffix>

+-    <_DLLSuffix>-1_1</_DLLSuffix>

 -    <_DLLSuffix Condition="$(Platform) == 'ARM'">$(_DLLSuffix)-arm</_DLLSuffix>

 -    <_DLLSuffix Condition="$(Platform) == 'ARM64'">$(_DLLSuffix)-arm64</_DLLSuffix>

++    <_DLLSuffix>-3</_DLLSuffix>

    </PropertyGroup>

    <ItemGroup>

      <_SSLDLL Include="$(opensslOutDir)\libcrypto$(_DLLSuffix).dll" />