libressl 2.1.2

Changes:

* Version bump to 2.1.2
* Makes LibreSSL non-dependent on Brewed-OpenSSL being available for CA
creation and thus actual useful functionality. This steals the
bootstrapping method from OpenSSL and replicates it for the same
function here.

Closes #34740.

Signed-off-by: Mike McQuaid <mike@mikemcquaid.com>

1 files changed, 28 insertions, 21 deletions

diff --git a/Library/Formula/libressl.rb b/Library/Formula/libressl.rb
index df0039452..d85df873e 100644
--- a/Library/Formula/libressl.rb
+++ b/Library/Formula/libressl.rb
@@ -2,12 +2,13 @@ require "formula"
 
 class Libressl < Formula
   homepage "http://www.libressl.org/"
-  url "http://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.1.1.tar.gz"
-  mirror "https://raw.githubusercontent.com/DomT4/LibreMirror/master/LibreSSL/libressl-2.1.1.tar.gz"
-  sha256 "fb5ada41a75b31c8dd9ff013daca57b253047ad14e43f65d8b41879b7b8e3c17"
+  url "http://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.1.2.tar.gz"
+  mirror "https://raw.githubusercontent.com/DomT4/LibreMirror/master/LibreSSL/libressl-2.1.2.tar.gz"
+  sha256 "07c05f12e5d49dbfcf82dd23b6b4877b7cdb1c8e4c8dd27cb4d9e5758a6caf52"
+
+  option "without-libtls", "Build without libtls"
 
   bottle do
-    revision 2
     sha1 "a98059642ac02c864875c002a78a7dbae0fc783a" => :yosemite
     sha1 "f24b31201a7d85ae8b8b722e19224205daeda6c1" => :mavericks
     sha1 "c26900c1475e0c840c7a11801a01098dd0ce65be" => :mountain_lion
@@ -20,38 +21,44 @@ class Libressl < Formula
     depends_on "libtool" => :build
   end
 
-  keg_only "LibreSSL is not linked to prevent conflicts with the system OpenSSL."
+  keg_only "LibreSSL is not linked to prevent conflict with the system OpenSSL."
 
   def install
-    system "./autogen.sh" if build.head?
+    args = %W[
+      --disable-dependency-tracking
+      --disable-silent-rules
+      --prefix=#{prefix}
+      --with-openssldir=#{etc}/libressl
+      --sysconfdir=#{etc}/libressl
+      --with-enginesdir=#{lib}/engines
+    ]
 
-    system "./configure", "--disable-dependency-tracking",
-                          "--disable-silent-rules",
-                          "--prefix=#{prefix}",
-                          "--with-openssldir=#{etc}/libressl",
-                          "--sysconfdir=#{etc}/libressl",
-                          "--with-enginesdir=#{lib}/engines"
+    args << "--enable-libtls" if build.with? "libtls"
 
+    system "./autogen.sh" if build.head?
+    system "./configure", *args
     system "make"
     system "make", "check"
     system "make", "install"
 
+    # Install the dummy openssl.cnf file to stop runtime warnings.
     mkdir_p "#{etc}/libressl"
-    touch "#{etc}/libressl/openssl.cnf"
+    cp "apps/openssl.cnf", "#{etc}/libressl"
   end
 
   def post_install
-    if (etc/"openssl/cert.pem").exist?
-      cp "#{etc}/openssl/cert.pem", "#{etc}/libressl"
-    else
-      touch "#{etc}/libressl/cert.pem"
-    end
+    keychains = %w[
+      /Library/Keychains/System.keychain
+      /System/Library/Keychains/SystemRootCertificates.keychain
+    ]
+
+    # Bootstrap CAs from the system keychain.
+    (etc/"libressl/cert.pem").atomic_write `security find-certificate -a -p #{keychains.join(" ")}`
   end
 
   def caveats; <<-EOS.undent
-    If you have OpenSSL installed, the .pem file has been copied
-    from there. Otherwise, a blank .pem file has been touched.
-    To add additional certificates, place .pem files in
+    A CA file has been bootstrapped using certificates from the system
+    keychain. To add additional certificates, place .pem files in
       #{etc}/libressl
     EOS
   end