[Security][3.4] bpo-29572: Update macOS installer build to OpenSSL 1.0.2k

Mac/BuildScript/build-installer.py

@@ -237,9 +237,9 @@ def library_recipes():
 
         result.extend([
           dict(
-              name="OpenSSL 1.0.2e",
-              url="https://www.openssl.org/source/openssl-1.0.2e.tar.gz",
-              checksum='5262bfa25b60ed9de9f28d5d52d77fc5',
+              name="OpenSSL 1.0.2k",
+              url="https://www.openssl.org/source/openssl-1.0.2k.tar.gz",
+              checksum='f965fc0bf01bf882b31314b61391ae65',
               patches=[
                   "openssl_sdk_makedepend.patch",
                    ],

Mac/BuildScript/openssl_sdk_makedepend.patch

@@ -1,18 +1,15 @@
 # HG changeset patch
-# Parent  ff8a7557607cffd626997e57ed31c1012a3018aa
-# openssl_sdk_makedepend.patch
 #
-# 	using openssl 1.0.2e
+# 	using openssl 1.0.2k
 #
 # - support building with an OS X SDK
-# - allow "make depend" to use compilers with names other than "gcc"
 
 diff Configure
 
 diff --git a/Configure b/Configure
 --- a/Configure
 +++ b/Configure
-@@ -635,12 +635,12 @@
+@@ -642,12 +642,12 @@
 
  ##### MacOS X (a.k.a. Rhapsody or Darwin) setup
  "rhapsody-ppc-cc","cc:-O3 -DB_ENDIAN::(unknown):MACOSX_RHAPSODY::BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:${no_asm}::",
@@ -31,26 +28,13 @@ diff --git a/Configure b/Configure
  "debug-darwin-ppc-cc","cc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DCRYPTO_MDEBUG -DB_ENDIAN -g -Wall -O::-D_REENTRANT:MACOSX::BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:${ppc32_asm}:osx32:dlfcn:darwin-shared:-fPIC:-dynamiclib:.\$(SHLIB_MAJOR).\$(SHLIB_MINOR).dylib",
  # iPhoneOS/iOS
  "iphoneos-cross","llvm-gcc:-O3 -isysroot \$(CROSS_TOP)/SDKs/\$(CROSS_SDK) -fomit-frame-pointer -fno-common::-D_REENTRANT:iOS:-Wl,-search_paths_first%:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:${no_asm}:dlfcn:darwin-shared:-fPIC -fno-common:-dynamiclib:.\$(SHLIB_MAJOR).\$(SHLIB_MINOR).dylib",
-@@ -1714,8 +1714,7 @@
- 		s/^CC=.*$/CC= $cc/;
+@@ -1728,8 +1728,7 @@
  		s/^AR=\s*ar/AR= $ar/;
  		s/^RANLIB=.*/RANLIB= $ranlib/;
+ 		s/^RC=.*/RC= $windres/;
 -		s/^MAKEDEPPROG=.*$/MAKEDEPPROG= $cc/ if $cc eq "gcc";
 -		s/^MAKEDEPPROG=.*$/MAKEDEPPROG= $cc/ if $ecc eq "gcc" || $ecc eq "clang";
-+		s/^MAKEDEPPROG=.*$/MAKEDEPPROG= $cc/
++		s/^MAKEDEPPROG=.*$/MAKEDEPPROG= $cc/;
  		}
  	s/^CFLAG=.*$/CFLAG= $cflags/;
  	s/^DEPFLAG=.*$/DEPFLAG=$depflags/;
-diff --git a/util/domd b/util/domd
---- a/util/domd
-+++ b/util/domd
-@@ -14,8 +14,7 @@
- cp Makefile Makefile.save
- # fake the presence of Kerberos
- touch $TOP/krb5.h
--if ${MAKEDEPEND} --version 2>&1 | grep -q "clang" ||
--   echo $MAKEDEPEND | grep -q "gcc"; then
-+if true ; then
-     args=""
-     while [ $# -gt 0 ]; do
- 	if [ "$1" != "--" ]; then args="$args $1"; fi

Misc/NEWS.d/next/Build/2017-09-07-19-26-26.bpo-26268.1Duz_M.rst

@@ -0,0 +1 @@
+Update OS X 10.5 installer to use OpenSSL 1.0.2f.

Misc/NEWS.d/next/Build/2017-09-07-19-30-45.bpo-26465.PhUgmq.rst

@@ -0,0 +1,2 @@
+Update OS X 10.5+ 32-bit-only installer to build and link with OpenSSL
+1.0.2g.

Misc/NEWS.d/next/Build/2017-09-07-19-31-38.bpo-26930.Z3eeRH.rst

@@ -0,0 +1,2 @@
+Update OS X 10.5+ 32-bit-only installer to build and link with OpenSSL
+1.0.2h.

Misc/NEWS.d/next/Build/2017-09-07-19-32-39.bpo-28248.KY_-en.rst

@@ -0,0 +1 @@
+Update Windows build and OS X installers to use OpenSSL 1.0.2j.