chore: add vendor dependencies for kauma build

vendor/openssl-sys/build/cfgs.rs

@@ -0,0 +1,125 @@
+#[allow(clippy::unusual_byte_groupings)]
+pub fn get(openssl_version: Option<u64>, libressl_version: Option<u64>) -> Vec<&'static str> {
+    let mut cfgs = vec![];
+
+    if let Some(libressl_version) = libressl_version {
+        cfgs.push("libressl");
+
+        if libressl_version >= 0x2_05_01_00_0 {
+            cfgs.push("libressl251");
+        }
+        if libressl_version >= 0x2_05_02_00_0 {
+            cfgs.push("libressl252");
+        }
+        if libressl_version >= 0x2_06_01_00_0 {
+            cfgs.push("libressl261");
+        }
+        if libressl_version >= 0x2_07_00_00_0 {
+            cfgs.push("libressl270");
+        }
+        if libressl_version >= 0x2_07_01_00_0 {
+            cfgs.push("libressl271");
+        }
+        if libressl_version >= 0x2_07_03_00_0 {
+            cfgs.push("libressl273");
+        }
+        if libressl_version >= 0x2_08_00_00_0 {
+            cfgs.push("libressl280");
+        }
+        if libressl_version >= 0x2_08_01_00_0 {
+            cfgs.push("libressl281");
+        }
+        if libressl_version >= 0x2_09_01_00_0 {
+            cfgs.push("libressl291");
+        }
+        if libressl_version >= 0x3_01_00_00_0 {
+            cfgs.push("libressl310");
+        }
+        if libressl_version >= 0x3_02_01_00_0 {
+            cfgs.push("libressl321");
+        }
+        if libressl_version >= 0x3_03_02_00_0 {
+            cfgs.push("libressl332");
+        }
+        if libressl_version >= 0x3_04_00_00_0 {
+            cfgs.push("libressl340");
+        }
+        if libressl_version >= 0x3_05_00_00_0 {
+            cfgs.push("libressl350");
+        }
+        if libressl_version >= 0x3_06_00_00_0 {
+            cfgs.push("libressl360");
+        }
+        if libressl_version >= 0x3_07_00_00_0 {
+            cfgs.push("libressl370");
+        }
+        if libressl_version >= 0x3_08_00_00_0 {
+            cfgs.push("libressl380");
+        }
+        if libressl_version >= 0x3_08_01_00_0 {
+            cfgs.push("libressl381");
+        }
+        if libressl_version >= 0x3_08_02_00_0 {
+            cfgs.push("libressl382");
+        }
+        if libressl_version >= 0x3_09_00_00_0 {
+            cfgs.push("libressl390");
+        }
+        if libressl_version >= 0x4_00_00_00_0 {
+            cfgs.push("libressl400");
+        }
+    } else {
+        let openssl_version = openssl_version.unwrap();
+
+        if openssl_version >= 0x3_04_00_00_0 {
+            cfgs.push("ossl340");
+        }
+        if openssl_version >= 0x3_03_00_00_0 {
+            cfgs.push("ossl330");
+        }
+        if openssl_version >= 0x3_02_00_00_0 {
+            cfgs.push("ossl320");
+        }
+        if openssl_version >= 0x3_00_00_00_0 {
+            cfgs.push("ossl300");
+        }
+        if openssl_version >= 0x1_00_01_00_0 {
+            cfgs.push("ossl101");
+        }
+        if openssl_version >= 0x1_00_02_00_0 {
+            cfgs.push("ossl102");
+        }
+        if openssl_version >= 0x1_00_02_06_0 {
+            cfgs.push("ossl102f");
+        }
+        if openssl_version >= 0x1_00_02_08_0 {
+            cfgs.push("ossl102h");
+        }
+        if openssl_version >= 0x1_01_00_00_0 {
+            cfgs.push("ossl110");
+        }
+        if openssl_version >= 0x1_01_00_06_0 {
+            cfgs.push("ossl110f");
+        }
+        if openssl_version >= 0x1_01_00_07_0 {
+            cfgs.push("ossl110g");
+        }
+        if openssl_version >= 0x1_01_00_08_0 {
+            cfgs.push("ossl110h");
+        }
+        if openssl_version >= 0x1_01_01_00_0 {
+            cfgs.push("ossl111");
+        }
+        if openssl_version >= 0x1_01_01_02_0 {
+            cfgs.push("ossl111b");
+        }
+        if openssl_version >= 0x1_01_01_03_0 {
+            cfgs.push("ossl111c");
+        }
+        if openssl_version >= 0x1_01_01_04_0 {
+            cfgs.push("ossl111d");
+        }
+    }
+
+    cfgs
+}

vendor/openssl-sys/build/expando.c

@@ -0,0 +1,140 @@
+#include <openssl/opensslv.h>
+#include <openssl/opensslconf.h>
+
+#define VERSION2(n, v) RUST_VERSION_##n##_##v
+#define VERSION(n, v) VERSION2(n, v)
+
+#define NEW_VERSION2(a, b, c) RUST_VERSION_NEW_OPENSSL_##a##_##b##_##c
+#define NEW_VERSION(a, b, c) NEW_VERSION2(a, b, c)
+
+#ifdef LIBRESSL_VERSION_NUMBER
+VERSION(LIBRESSL, LIBRESSL_VERSION_NUMBER)
+#elif defined OPENSSL_VERSION_MAJOR
+NEW_VERSION(OPENSSL_VERSION_MAJOR, OPENSSL_VERSION_MINOR, OPENSSL_VERSION_PATCH)
+#else
+VERSION(OPENSSL, OPENSSL_VERSION_NUMBER)
+#endif
+
+#ifdef OPENSSL_IS_BORINGSSL
+RUST_OPENSSL_IS_BORINGSSL
+#endif
+
+#ifdef OPENSSL_NO_BF
+RUST_CONF_OPENSSL_NO_BF
+#endif
+
+#ifdef OPENSSL_NO_BUF_FREELISTS
+RUST_CONF_OPENSSL_NO_BUF_FREELISTS
+#endif
+
+#ifdef OPENSSL_NO_CHACHA
+RUST_CONF_OPENSSL_NO_CHACHA
+#endif
+
+#ifdef OPENSSL_NO_IDEA
+RUST_CONF_OPENSSL_NO_IDEA
+#endif
+
+#ifdef OPENSSL_NO_CAMELLIA
+RUST_CONF_OPENSSL_NO_CAMELLIA
+#endif
+
+#ifdef OPENSSL_NO_CAST
+RUST_CONF_OPENSSL_NO_CAST
+#endif
+
+#ifdef OPENSSL_NO_CMS
+RUST_CONF_OPENSSL_NO_CMS
+#endif
+
+#ifdef OPENSSL_NO_COMP
+RUST_CONF_OPENSSL_NO_COMP
+#endif
+
+#ifdef OPENSSL_NO_EC
+RUST_CONF_OPENSSL_NO_EC
+#endif
+
+#ifdef OPENSSL_NO_EC2M
+RUST_CONF_OPENSSL_NO_EC2M
+#endif
+
+#ifdef OPENSSL_NO_ENGINE
+RUST_CONF_OPENSSL_NO_ENGINE
+#endif
+
+#ifdef OPENSSL_NO_KRB5
+RUST_CONF_OPENSSL_NO_KRB5
+#endif
+
+#ifdef OPENSSL_NO_NEXTPROTONEG
+RUST_CONF_OPENSSL_NO_NEXTPROTONEG
+#endif
+
+#ifdef OPENSSL_NO_OCSP
+RUST_CONF_OPENSSL_NO_OCSP
+#endif
+
+#ifdef OPENSSL_NO_OCB
+RUST_CONF_OPENSSL_NO_OCB
+#endif
+
+#ifdef OPENSSL_NO_PSK
+RUST_CONF_OPENSSL_NO_PSK
+#endif
+
+#ifdef OPENSSL_NO_RC4
+RUST_CONF_OPENSSL_NO_RC4
+#endif
+
+#ifdef OPENSSL_NO_RFC3779
+RUST_CONF_OPENSSL_NO_RFC3779
+#endif
+
+#ifdef OPENSSL_NO_RMD160
+RUST_CONF_OPENSSL_NO_RMD160
+#endif
+
+#ifdef OPENSSL_NO_SHA
+RUST_CONF_OPENSSL_NO_SHA
+#endif
+
+#ifdef OPENSSL_NO_SRP
+RUST_CONF_OPENSSL_NO_SRP
+#endif
+
+#ifdef OPENSSL_NO_SSL3_METHOD
+RUST_CONF_OPENSSL_NO_SSL3_METHOD
+#endif
+
+#ifdef OPENSSL_NO_TLSEXT
+RUST_CONF_OPENSSL_NO_TLSEXT
+#endif
+
+#ifdef OPENSSL_NO_SOCK
+RUST_CONF_OPENSSL_NO_SOCK
+#endif
+
+#ifdef OPENSSL_NO_STDIO
+RUST_CONF_OPENSSL_NO_STDIO
+#endif
+
+#ifdef OPENSSL_NO_SM3
+RUST_CONF_OPENSSL_NO_SM3
+#endif
+
+#ifdef OPENSSL_NO_SM4
+RUST_CONF_OPENSSL_NO_SM4
+#endif
+
+#ifdef OPENSSL_NO_DEPRECATED_3_0
+RUST_CONF_OPENSSL_NO_DEPRECATED_3_0
+#endif
+
+#ifdef OPENSSL_NO_SEED
+RUST_CONF_OPENSSL_NO_SEED
+#endif
+
+#ifdef OPENSSL_NO_SCRYPT
+RUST_CONF_OPENSSL_NO_SCRYPT
+#endif

vendor/openssl-sys/build/find_normal.rs

@@ -0,0 +1,284 @@
+use std::ffi::OsString;
+use std::path::{Path, PathBuf};
+use std::process::{self, Command};
+
+use super::env;
+
+pub fn get_openssl(target: &str) -> (Vec<PathBuf>, PathBuf) {
+    let lib_dir = env("OPENSSL_LIB_DIR").map(PathBuf::from);
+    let include_dir = env("OPENSSL_INCLUDE_DIR").map(PathBuf::from);
+
+    match (lib_dir, include_dir) {
+        (Some(lib_dir), Some(include_dir)) => (vec![lib_dir], include_dir),
+        (lib_dir, include_dir) => {
+            let openssl_dir = env("OPENSSL_DIR").unwrap_or_else(|| find_openssl_dir(target));
+            let openssl_dir = Path::new(&openssl_dir);
+            let lib_dir = lib_dir.map(|d| vec![d]).unwrap_or_else(|| {
+                let mut lib_dirs = vec![];
+                // OpenSSL 3.0 now puts it's libraries in lib64/ by default,
+                // check for both it and lib/.
+                if openssl_dir.join("lib64").exists() {
+                    lib_dirs.push(openssl_dir.join("lib64"));
+                }
+                if openssl_dir.join("lib").exists() {
+                    lib_dirs.push(openssl_dir.join("lib"));
+                }
+                lib_dirs
+            });
+            let include_dir = include_dir.unwrap_or_else(|| openssl_dir.join("include"));
+            (lib_dir, include_dir)
+        }
+    }
+}
+
+fn resolve_with_wellknown_homebrew_location(dir: &str) -> Option<PathBuf> {
+    let versions = ["openssl@3", "openssl@3.0", "openssl@1.1"];
+
+    // Check up default aarch 64 Homebrew installation location first
+    // for quick resolution if possible.
+    //  `pkg-config` on brew doesn't necessarily contain settings for openssl apparently.
+    for version in &versions {
+        let homebrew = Path::new(dir).join(format!("opt/{}", version));
+        if homebrew.exists() {
+            return Some(homebrew);
+        }
+    }
+
+    for version in &versions {
+        // Calling `brew --prefix <package>` command usually slow and
+        // takes seconds, and will be used only as a last resort.
+        let output = execute_command_and_get_output("brew", &["--prefix", version]);
+        if let Some(ref output) = output {
+            let homebrew = Path::new(&output);
+            if homebrew.exists() {
+                return Some(homebrew.to_path_buf());
+            }
+        }
+    }
+
+    None
+}
+
+fn resolve_with_wellknown_location(dir: &str) -> Option<PathBuf> {
+    let root_dir = Path::new(dir);
+    let include_openssl = root_dir.join("include/openssl");
+    if include_openssl.exists() {
+        Some(root_dir.to_path_buf())
+    } else {
+        None
+    }
+}
+
+fn find_openssl_dir(target: &str) -> OsString {
+    let host = env::var("HOST").unwrap();
+
+    if host == target && target.ends_with("-apple-darwin") {
+        let homebrew_dir = match target {
+            "aarch64-apple-darwin" => "/opt/homebrew",
+            _ => "/usr/local",
+        };
+
+        if let Some(dir) = resolve_with_wellknown_homebrew_location(homebrew_dir) {
+            return dir.into();
+        } else if let Some(dir) = resolve_with_wellknown_location("/opt/pkg") {
+            // pkgsrc
+            return dir.into();
+        } else if let Some(dir) = resolve_with_wellknown_location("/opt/local") {
+            // MacPorts
+            return dir.into();
+        }
+    }
+
+    try_pkg_config();
+    try_vcpkg();
+
+    // FreeBSD and OpenBSD ship with Libre|OpenSSL but don't include a pkg-config file
+    if host == target && (target.contains("freebsd") || target.contains("openbsd")) {
+        return OsString::from("/usr");
+    }
+
+    // DragonFly has libressl (or openssl) in ports, but this doesn't include a pkg-config file
+    if host == target && target.contains("dragonfly") {
+        return OsString::from("/usr/local");
+    }
+
+    let msg_header =
+        "Could not find directory of OpenSSL installation, and this `-sys` crate cannot
+proceed without this knowledge. If OpenSSL is installed and this crate had
+trouble finding it,  you can set the `OPENSSL_DIR` environment variable for the
+compilation process.";
+
+    println!(
+        "cargo:warning={} See stderr section below for further information.",
+        msg_header.replace('\n', " ")
+    );
+
+    let mut msg = format!(
+        "
+
+{}
+
+Make sure you also have the development packages of openssl installed.
+For example, `libssl-dev` on Ubuntu or `openssl-devel` on Fedora.
+
+If you're in a situation where you think the directory *should* be found
+automatically, please open a bug at https://github.com/sfackler/rust-openssl
+and include information about your system as well as this message.
+
+$HOST = {}
+$TARGET = {}
+openssl-sys = {}
+
+",
+        msg_header,
+        host,
+        target,
+        env!("CARGO_PKG_VERSION")
+    );
+
+    if host.contains("apple-darwin") && target.contains("apple-darwin") {
+        let system = Path::new("/usr/lib/libssl.0.9.8.dylib");
+        if system.exists() {
+            msg.push_str(
+                "
+
+openssl-sys crate build failed: no supported version of OpenSSL found.
+
+Ways to fix it:
+- Use the `vendored` feature of openssl-sys crate to build OpenSSL from source.
+- Use Homebrew to install the `openssl` package.
+
+",
+            );
+        }
+    }
+
+    if host.contains("unknown-linux")
+        && target.contains("unknown-linux-gnu")
+        && Command::new("pkg-config").output().is_err()
+    {
+        msg.push_str(
+            "
+It looks like you're compiling on Linux and also targeting Linux. Currently this
+requires the `pkg-config` utility to find OpenSSL but unfortunately `pkg-config`
+could not be found. If you have OpenSSL installed you can likely fix this by
+installing `pkg-config`.
+
+",
+        );
+    }
+
+    if host.contains("windows") && target.contains("windows-gnu") {
+        msg.push_str(
+            "
+It looks like you're compiling for MinGW but you may not have either OpenSSL or
+pkg-config installed. You can install these two dependencies with:
+
+pacman -S openssl-devel pkgconf
+
+and try building this crate again.
+
+",
+        );
+    }
+
+    if host.contains("windows") && target.contains("windows-msvc") {
+        msg.push_str(
+            "
+It looks like you're compiling for MSVC but we couldn't detect an OpenSSL
+installation. If there isn't one installed then you can try the rust-openssl
+README for more information about how to download precompiled binaries of
+OpenSSL:
+
+https://github.com/sfackler/rust-openssl#windows
+
+",
+        );
+    }
+
+    eprintln!("{}", msg);
+    std::process::exit(101); // same as panic previously
+}
+
+/// Attempt to find OpenSSL through pkg-config.
+///
+/// Note that if this succeeds then the function does not return as pkg-config
+/// typically tells us all the information that we need.
+fn try_pkg_config() {
+    let target = env::var("TARGET").unwrap();
+    let host = env::var("HOST").unwrap();
+
+    // FIXME we really shouldn't be automatically enabling this
+    if target.contains("windows-gnu") && host.contains("windows") {
+        env::set_var("PKG_CONFIG_ALLOW_CROSS", "1");
+    } else if target.contains("windows-msvc") {
+        // MSVC targets use vcpkg instead.
+        return;
+    }
+
+    let lib = match pkg_config::Config::new()
+        .print_system_libs(false)
+        .probe("openssl")
+    {
+        Ok(lib) => lib,
+        Err(e) => {
+            println!("\n\nCould not find openssl via pkg-config:\n{}\n", e);
+            return;
+        }
+    };
+
+    super::postprocess(&lib.include_paths);
+
+    for include in lib.include_paths.iter() {
+        println!("cargo:include={}", include.display());
+    }
+
+    process::exit(0);
+}
+
+/// Attempt to find OpenSSL through vcpkg.
+///
+/// Note that if this succeeds then the function does not return as vcpkg
+/// should emit all of the cargo metadata that we need.
+fn try_vcpkg() {
+    let target = env::var("TARGET").unwrap();
+    if !target.contains("windows") {
+        return;
+    }
+
+    // vcpkg will not emit any metadata if it can not find libraries
+    // appropriate for the target triple with the desired linkage.
+
+    let lib = match vcpkg::Config::new()
+        .emit_includes(true)
+        .find_package("openssl")
+    {
+        Ok(lib) => lib,
+        Err(e) => {
+            println!("note: vcpkg did not find openssl: {}", e);
+            return;
+        }
+    };
+
+    super::postprocess(&lib.include_paths);
+
+    println!("cargo:rustc-link-lib=user32");
+    println!("cargo:rustc-link-lib=gdi32");
+    println!("cargo:rustc-link-lib=crypt32");
+
+    process::exit(0);
+}
+
+fn execute_command_and_get_output(cmd: &str, args: &[&str]) -> Option<String> {
+    let out = Command::new(cmd).args(args).output();
+    if let Ok(ref r1) = out {
+        if r1.status.success() {
+            let r2 = String::from_utf8(r1.stdout.clone());
+            if let Ok(r3) = r2 {
+                return Some(r3.trim().to_string());
+            }
+        }
+    }
+
+    None
+}

vendor/openssl-sys/build/find_vendored.rs

@@ -0,0 +1,25 @@
+use openssl_src;
+use std::path::PathBuf;
+
+use super::env;
+
+pub fn get_openssl(_target: &str) -> (Vec<PathBuf>, PathBuf) {
+    let openssl_config_dir = env("OPENSSL_CONFIG_DIR");
+
+    let mut openssl_src_build = openssl_src::Build::new();
+    if let Some(value) = openssl_config_dir {
+        openssl_src_build.openssl_dir(PathBuf::from(value));
+    }
+
+    let artifacts = openssl_src_build.build();
+    println!("cargo:vendored=1");
+    println!(
+        "cargo:root={}",
+        artifacts.lib_dir().parent().unwrap().display()
+    );
+
+    (
+        vec![artifacts.lib_dir().to_path_buf()],
+        artifacts.include_dir().to_path_buf(),
+    )
+}

vendor/openssl-sys/build/main.rs

@@ -0,0 +1,508 @@
+#[cfg(feature = "bindgen")]
+extern crate bindgen;
+extern crate cc;
+#[cfg(feature = "vendored")]
+extern crate openssl_src;
+extern crate pkg_config;
+extern crate vcpkg;
+
+use std::collections::HashSet;
+use std::env;
+use std::ffi::OsString;
+use std::path::PathBuf;
+mod cfgs;
+
+mod find_normal;
+#[cfg(feature = "vendored")]
+mod find_vendored;
+mod run_bindgen;
+
+#[derive(PartialEq)]
+enum Version {
+    Openssl3xx,
+    Openssl11x,
+    Openssl10x,
+    Libressl,
+    Boringssl,
+}
+
+fn env_inner(name: &str) -> Option<OsString> {
+    let var = env::var_os(name);
+    println!("cargo:rerun-if-env-changed={}", name);
+
+    match var {
+        Some(ref v) => println!("{} = {}", name, v.to_string_lossy()),
+        None => println!("{} unset", name),
+    }
+
+    var
+}
+
+fn env(name: &str) -> Option<OsString> {
+    let prefix = env::var("TARGET").unwrap().to_uppercase().replace('-', "_");
+    let prefixed = format!("{}_{}", prefix, name);
+    env_inner(&prefixed).or_else(|| env_inner(name))
+}
+
+fn find_openssl(target: &str) -> (Vec<PathBuf>, PathBuf) {
+    #[cfg(feature = "vendored")]
+    {
+        // vendor if the feature is present, unless
+        // OPENSSL_NO_VENDOR exists and isn't `0`
+        if env("OPENSSL_NO_VENDOR").map_or(true, |s| s == "0") {
+            return find_vendored::get_openssl(target);
+        }
+    }
+    find_normal::get_openssl(target)
+}
+
+fn check_ssl_kind() {
+    if cfg!(feature = "unstable_boringssl") {
+        println!("cargo:rustc-cfg=boringssl");
+        println!("cargo:boringssl=true");
+
+        if let Ok(vars) = env::var("DEP_BSSL_CONF") {
+            for var in vars.split(',') {
+                println!("cargo:rustc-cfg=osslconf=\"{}\"", var);
+            }
+            println!("cargo:conf={}", vars);
+        }
+
+        // BoringSSL does not have any build logic, exit early
+        std::process::exit(0);
+    }
+}
+
+fn main() {
+    println!("cargo:rustc-check-cfg=cfg(osslconf, values(\"OPENSSL_NO_OCB\", \"OPENSSL_NO_SM4\", \"OPENSSL_NO_SEED\", \"OPENSSL_NO_CHACHA\", \"OPENSSL_NO_CAST\", \"OPENSSL_NO_IDEA\", \"OPENSSL_NO_CAMELLIA\", \"OPENSSL_NO_RC4\", \"OPENSSL_NO_BF\", \"OPENSSL_NO_PSK\", \"OPENSSL_NO_DEPRECATED_3_0\", \"OPENSSL_NO_SCRYPT\", \"OPENSSL_NO_SM3\", \"OPENSSL_NO_RMD160\", \"OPENSSL_NO_EC2M\", \"OPENSSL_NO_OCSP\", \"OPENSSL_NO_CMS\", \"OPENSSL_NO_COMP\", \"OPENSSL_NO_SOCK\", \"OPENSSL_NO_STDIO\", \"OPENSSL_NO_EC\", \"OPENSSL_NO_SSL3_METHOD\", \"OPENSSL_NO_KRB5\", \"OPENSSL_NO_TLSEXT\", \"OPENSSL_NO_SRP\", \"OPENSSL_NO_RFC3779\", \"OPENSSL_NO_SHA\", \"OPENSSL_NO_NEXTPROTONEG\", \"OPENSSL_NO_ENGINE\", \"OPENSSL_NO_BUF_FREELISTS\"))");
+
+    println!("cargo:rustc-check-cfg=cfg(openssl)");
+    println!("cargo:rustc-check-cfg=cfg(libressl)");
+    println!("cargo:rustc-check-cfg=cfg(boringssl)");
+
+    println!("cargo:rustc-check-cfg=cfg(libressl250)");
+    println!("cargo:rustc-check-cfg=cfg(libressl251)");
+    println!("cargo:rustc-check-cfg=cfg(libressl252)");
+    println!("cargo:rustc-check-cfg=cfg(libressl261)");
+    println!("cargo:rustc-check-cfg=cfg(libressl270)");
+    println!("cargo:rustc-check-cfg=cfg(libressl271)");
+    println!("cargo:rustc-check-cfg=cfg(libressl273)");
+    println!("cargo:rustc-check-cfg=cfg(libressl280)");
+    println!("cargo:rustc-check-cfg=cfg(libressl281)");
+    println!("cargo:rustc-check-cfg=cfg(libressl291)");
+    println!("cargo:rustc-check-cfg=cfg(libressl310)");
+    println!("cargo:rustc-check-cfg=cfg(libressl321)");
+    println!("cargo:rustc-check-cfg=cfg(libressl332)");
+    println!("cargo:rustc-check-cfg=cfg(libressl340)");
+    println!("cargo:rustc-check-cfg=cfg(libressl350)");
+    println!("cargo:rustc-check-cfg=cfg(libressl360)");
+    println!("cargo:rustc-check-cfg=cfg(libressl361)");
+    println!("cargo:rustc-check-cfg=cfg(libressl370)");
+    println!("cargo:rustc-check-cfg=cfg(libressl380)");
+    println!("cargo:rustc-check-cfg=cfg(libressl381)");
+    println!("cargo:rustc-check-cfg=cfg(libressl382)");
+    println!("cargo:rustc-check-cfg=cfg(libressl390)");
+    println!("cargo:rustc-check-cfg=cfg(libressl400)");
+
+    println!("cargo:rustc-check-cfg=cfg(ossl101)");
+    println!("cargo:rustc-check-cfg=cfg(ossl102)");
+    println!("cargo:rustc-check-cfg=cfg(ossl102f)");
+    println!("cargo:rustc-check-cfg=cfg(ossl102h)");
+    println!("cargo:rustc-check-cfg=cfg(ossl110)");
+    println!("cargo:rustc-check-cfg=cfg(ossl110f)");
+    println!("cargo:rustc-check-cfg=cfg(ossl110g)");
+    println!("cargo:rustc-check-cfg=cfg(ossl110h)");
+    println!("cargo:rustc-check-cfg=cfg(ossl111)");
+    println!("cargo:rustc-check-cfg=cfg(ossl111b)");
+    println!("cargo:rustc-check-cfg=cfg(ossl111c)");
+    println!("cargo:rustc-check-cfg=cfg(ossl111d)");
+    println!("cargo:rustc-check-cfg=cfg(ossl300)");
+    println!("cargo:rustc-check-cfg=cfg(ossl310)");
+    println!("cargo:rustc-check-cfg=cfg(ossl320)");
+    println!("cargo:rustc-check-cfg=cfg(ossl330)");
+    println!("cargo:rustc-check-cfg=cfg(ossl340)");
+
+    check_ssl_kind();
+
+    let target = env::var("TARGET").unwrap();
+
+    let (lib_dirs, include_dir) = find_openssl(&target);
+    // rerun-if-changed causes openssl-sys to rebuild if the openssl include
+    // dir has changed since the last build. However, this causes a rebuild
+    // every time when vendoring so we disable it.
+    let potential_path = include_dir.join("openssl");
+    if potential_path.exists() && !cfg!(feature = "vendored") {
+        if let Some(printable_include) = potential_path.to_str() {
+            println!("cargo:rerun-if-changed={}", printable_include);
+        }
+    }
+
+    if !lib_dirs.iter().all(|p| p.exists()) {
+        panic!("OpenSSL library directory does not exist: {:?}", lib_dirs);
+    }
+    if !include_dir.exists() {
+        panic!(
+            "OpenSSL include directory does not exist: {}",
+            include_dir.to_string_lossy()
+        );
+    }
+
+    for lib_dir in lib_dirs.iter() {
+        println!(
+            "cargo:rustc-link-search=native={}",
+            lib_dir.to_string_lossy()
+        );
+    }
+    println!("cargo:include={}", include_dir.to_string_lossy());
+
+    let version = postprocess(&[include_dir]);
+
+    let libs_env = env("OPENSSL_LIBS");
+    let libs = match libs_env.as_ref().and_then(|s| s.to_str()) {
+        Some(v) => {
+            if v.is_empty() {
+                vec![]
+            } else {
+                v.split(':').collect()
+            }
+        }
+        None => match version {
+            Version::Openssl10x if target.contains("windows") => vec!["ssleay32", "libeay32"],
+            Version::Openssl3xx | Version::Openssl11x if target.contains("windows-msvc") => {
+                vec!["libssl", "libcrypto"]
+            }
+            _ => vec!["ssl", "crypto"],
+        },
+    };
+
+    let kind = determine_mode(&lib_dirs, &libs);
+    for lib in libs.into_iter() {
+        println!("cargo:rustc-link-lib={}={}", kind, lib);
+    }
+
+    // libssl in BoringSSL requires the C++ runtime, and static libraries do
+    // not carry dependency information. On unix-like platforms, the C++
+    // runtime and standard library are typically picked up by default via the
+    // C++ compiler, which has a platform-specific default. (See implementations
+    // of `GetDefaultCXXStdlibType` in Clang.) Builds may also choose to
+    // override this and specify their own with `-nostdinc++` and `-nostdlib++`
+    // flags. Some compilers also provide options like `-stdlib=libc++`.
+    //
+    // Typically, such information is carried all the way up the build graph,
+    // but Cargo is not an integrated cross-language build system, so it cannot
+    // safely handle any of these situations. As a result, we need to make
+    // guesses. Getting this wrong may result in symbol conflicts and memory
+    // errors, but this unsafety is inherent to driving builds with
+    // externally-built libraries using Cargo.
+    //
+    // For now, we guess that the build was made with the defaults. This too is
+    // difficult because Rust does not expose this information from Clang, but
+    // try to match the behavior for common platforms. For a more robust option,
+    // this likely needs to be deferred to the caller with an environment
+    // variable.
+    if version == Version::Boringssl && kind == "static" && env::var("CARGO_CFG_UNIX").is_ok() {
+        let cpp_lib = match env::var("CARGO_CFG_TARGET_OS").unwrap().as_ref() {
+            "macos" => "c++",
+            _ => "stdc++",
+        };
+        println!("cargo:rustc-link-lib={}", cpp_lib);
+    }
+
+    // https://github.com/openssl/openssl/pull/15086
+    if version == Version::Openssl3xx
+        && kind == "static"
+        && (env::var("CARGO_CFG_TARGET_OS").unwrap() == "linux"
+            || env::var("CARGO_CFG_TARGET_OS").unwrap() == "android")
+        && env::var("CARGO_CFG_TARGET_POINTER_WIDTH").unwrap() == "32"
+    {
+        println!("cargo:rustc-link-lib=atomic");
+    }
+
+    if kind == "static" && target.contains("windows") {
+        println!("cargo:rustc-link-lib=dylib=gdi32");
+        println!("cargo:rustc-link-lib=dylib=user32");
+        println!("cargo:rustc-link-lib=dylib=crypt32");
+        println!("cargo:rustc-link-lib=dylib=ws2_32");
+        println!("cargo:rustc-link-lib=dylib=advapi32");
+    }
+}
+
+fn postprocess(include_dirs: &[PathBuf]) -> Version {
+    let version = validate_headers(include_dirs);
+
+    // Never run bindgen for BoringSSL, if it was needed we already ran it.
+    if version != Version::Boringssl {
+        #[cfg(feature = "bindgen")]
+        run_bindgen::run(&include_dirs);
+    }
+
+    version
+}
+
+/// Validates the header files found in `include_dir` and then returns the
+/// version string of OpenSSL.
+#[allow(clippy::unusual_byte_groupings)]
+fn validate_headers(include_dirs: &[PathBuf]) -> Version {
+    // This `*-sys` crate only works with OpenSSL 1.0.1, 1.0.2, 1.1.0, 1.1.1 and 3.0.0.
+    // To correctly expose the right API from this crate, take a look at
+    // `opensslv.h` to see what version OpenSSL claims to be.
+    //
+    // OpenSSL has a number of build-time configuration options which affect
+    // various structs and such. Since OpenSSL 1.1.0 this isn't really a problem
+    // as the library is much more FFI-friendly, but 1.0.{1,2} suffer this problem.
+    //
+    // To handle all this conditional compilation we slurp up the configuration
+    // file of OpenSSL, `opensslconf.h`, and then dump out everything it defines
+    // as our own #[cfg] directives. That way the `ossl10x.rs` bindings can
+    // account for compile differences and such.
+    println!("cargo:rerun-if-changed=build/expando.c");
+    let mut gcc = cc::Build::new();
+    gcc.includes(include_dirs);
+    let expanded = match gcc.file("build/expando.c").try_expand() {
+        Ok(expanded) => expanded,
+        Err(e) => {
+            panic!(
+                "
+Header expansion error:
+{:?}
+
+Failed to find OpenSSL development headers.
+
+You can try fixing this setting the `OPENSSL_DIR` environment variable
+pointing to your OpenSSL installation or installing OpenSSL headers package
+specific to your distribution:
+
+    # On Ubuntu
+    sudo apt-get install pkg-config libssl-dev
+    # On Arch Linux
+    sudo pacman -S pkgconf openssl
+    # On Fedora
+    sudo dnf install pkgconf perl-FindBin perl-IPC-Cmd openssl-devel
+    # On Alpine Linux
+    apk add pkgconf openssl-dev
+
+See rust-openssl documentation for more information:
+
+    https://docs.rs/openssl
+",
+                e
+            );
+        }
+    };
+    let expanded = String::from_utf8(expanded).unwrap();
+
+    let mut enabled = vec![];
+    let mut openssl_version = None;
+    let mut libressl_version = None;
+    let mut is_boringssl = false;
+    for line in expanded.lines() {
+        let line = line.trim();
+
+        let openssl_prefix = "RUST_VERSION_OPENSSL_";
+        let new_openssl_prefix = "RUST_VERSION_NEW_OPENSSL_";
+        let libressl_prefix = "RUST_VERSION_LIBRESSL_";
+        let boringsl_prefix = "RUST_OPENSSL_IS_BORINGSSL";
+        let conf_prefix = "RUST_CONF_";
+        if let Some(version) = line.strip_prefix(openssl_prefix) {
+            openssl_version = Some(parse_version(version));
+        } else if let Some(version) = line.strip_prefix(new_openssl_prefix) {
+            openssl_version = Some(parse_new_version(version));
+        } else if let Some(version) = line.strip_prefix(libressl_prefix) {
+            libressl_version = Some(parse_version(version));
+        } else if let Some(conf) = line.strip_prefix(conf_prefix) {
+            enabled.push(conf);
+        } else if line.starts_with(boringsl_prefix) {
+            is_boringssl = true;
+        }
+    }
+
+    for enabled in &enabled {
+        println!("cargo:rustc-cfg=osslconf=\"{}\"", enabled);
+    }
+    println!("cargo:conf={}", enabled.join(","));
+
+    if is_boringssl {
+        println!("cargo:rustc-cfg=boringssl");
+        println!("cargo:boringssl=true");
+        run_bindgen::run_boringssl(include_dirs);
+        return Version::Boringssl;
+    }
+
+    // We set this for any non-BoringSSL lib.
+    println!("cargo:rustc-cfg=openssl");
+
+    for cfg in cfgs::get(openssl_version, libressl_version) {
+        println!("cargo:rustc-cfg={}", cfg);
+    }
+
+    if let Some(libressl_version) = libressl_version {
+        println!("cargo:libressl_version_number={:x}", libressl_version);
+
+        let major = (libressl_version >> 28) as u8;
+        let minor = (libressl_version >> 20) as u8;
+        let fix = (libressl_version >> 12) as u8;
+        let (major, minor, fix) = match (major, minor, fix) {
+            (2, 5, 0) => ('2', '5', '0'),
+            (2, 5, 1) => ('2', '5', '1'),
+            (2, 5, 2) => ('2', '5', '2'),
+            (2, 5, _) => ('2', '5', 'x'),
+            (2, 6, 0) => ('2', '6', '0'),
+            (2, 6, 1) => ('2', '6', '1'),
+            (2, 6, 2) => ('2', '6', '2'),
+            (2, 6, _) => ('2', '6', 'x'),
+            (2, 7, _) => ('2', '7', 'x'),
+            (2, 8, 0) => ('2', '8', '0'),
+            (2, 8, 1) => ('2', '8', '1'),
+            (2, 8, _) => ('2', '8', 'x'),
+            (2, 9, 0) => ('2', '9', '0'),
+            (2, 9, _) => ('2', '9', 'x'),
+            (3, 0, 0) => ('3', '0', '0'),
+            (3, 0, 1) => ('3', '0', '1'),
+            (3, 0, _) => ('3', '0', 'x'),
+            (3, 1, 0) => ('3', '1', '0'),
+            (3, 1, _) => ('3', '1', 'x'),
+            (3, 2, 0) => ('3', '2', '0'),
+            (3, 2, 1) => ('3', '2', '1'),
+            (3, 2, _) => ('3', '2', 'x'),
+            (3, 3, 0) => ('3', '3', '0'),
+            (3, 3, 1) => ('3', '3', '1'),
+            (3, 3, _) => ('3', '3', 'x'),
+            (3, 4, 0) => ('3', '4', '0'),
+            (3, 4, _) => ('3', '4', 'x'),
+            (3, 5, _) => ('3', '5', 'x'),
+            (3, 6, 0) => ('3', '6', '0'),
+            (3, 6, _) => ('3', '6', 'x'),
+            (3, 7, 0) => ('3', '7', '0'),
+            (3, 7, 1) => ('3', '7', '1'),
+            (3, 7, _) => ('3', '7', 'x'),
+            (3, 8, 0) => ('3', '8', '0'),
+            (3, 8, 1) => ('3', '8', '1'),
+            (3, 8, _) => ('3', '8', 'x'),
+            (3, 9, 0) => ('3', '9', '0'),
+            (3, 9, _) => ('3', '9', 'x'),
+            (4, 0, 0) => ('4', '0', '0'),
+            (4, 0, _) => ('4', '0', 'x'),
+            _ => version_error(),
+        };
+
+        println!("cargo:libressl=true");
+        println!("cargo:libressl_version={}{}{}", major, minor, fix);
+        println!("cargo:version=101");
+        Version::Libressl
+    } else {
+        let openssl_version = openssl_version.unwrap();
+        println!("cargo:version_number={:x}", openssl_version);
+
+        if openssl_version >= 0x4_00_00_00_0 {
+            version_error()
+        } else if openssl_version >= 0x3_00_00_00_0 {
+            Version::Openssl3xx
+        } else if openssl_version >= 0x1_01_01_00_0 {
+            println!("cargo:version=111");
+            Version::Openssl11x
+        } else if openssl_version >= 0x1_01_00_06_0 {
+            println!("cargo:version=110");
+            println!("cargo:patch=f");
+            Version::Openssl11x
+        } else if openssl_version >= 0x1_01_00_00_0 {
+            println!("cargo:version=110");
+            Version::Openssl11x
+        } else if openssl_version >= 0x1_00_02_00_0 {
+            println!("cargo:version=102");
+            Version::Openssl10x
+        } else if openssl_version >= 0x1_00_01_00_0 {
+            println!("cargo:version=101");
+            Version::Openssl10x
+        } else {
+            version_error()
+        }
+    }
+}
+
+fn version_error() -> ! {
+    panic!(
+        "
+
+This crate is only compatible with OpenSSL (version 1.0.1 through 1.1.1, or 3), or LibreSSL 2.5
+through 4.0.x, but a different version of OpenSSL was found. The build is now aborting
+due to this version mismatch.
+
+"
+    );
+}
+
+// parses a string that looks like "0x100020cfL"
+fn parse_version(version: &str) -> u64 {
+    // cut off the 0x prefix
+    assert!(version.starts_with("0x"));
+    let version = &version[2..];
+
+    // and the type specifier suffix
+    let version = version.trim_end_matches(|c: char| !c.is_ascii_hexdigit());
+
+    u64::from_str_radix(version, 16).unwrap()
+}
+
+// parses a string that looks like 3_0_0
+fn parse_new_version(version: &str) -> u64 {
+    println!("version: {}", version);
+    let mut it = version.split('_');
+    let major = it.next().unwrap().parse::<u64>().unwrap();
+    let minor = it.next().unwrap().parse::<u64>().unwrap();
+    let patch = it.next().unwrap().parse::<u64>().unwrap();
+
+    (major << 28) | (minor << 20) | (patch << 4)
+}
+
+/// Given a libdir for OpenSSL (where artifacts are located) as well as the name
+/// of the libraries we're linking to, figure out whether we should link them
+/// statically or dynamically.
+fn determine_mode(libdirs: &[PathBuf], libs: &[&str]) -> &'static str {
+    // First see if a mode was explicitly requested
+    let kind = env("OPENSSL_STATIC");
+    match kind.as_ref().and_then(|s| s.to_str()) {
+        Some("0") => return "dylib",
+        Some(_) => return "static",
+        None => {}
+    }
+
+    // Next, see what files we actually have to link against, and see what our
+    // possibilities even are.
+    let mut files = HashSet::new();
+    for dir in libdirs {
+        for path in dir
+            .read_dir()
+            .unwrap()
+            .map(|e| e.unwrap())
+            .map(|e| e.file_name())
+            .filter_map(|e| e.into_string().ok())
+        {
+            files.insert(path);
+        }
+    }
+    let can_static = libs
+        .iter()
+        .all(|l| files.contains(&format!("lib{}.a", l)) || files.contains(&format!("{}.lib", l)));
+    let can_dylib = libs.iter().all(|l| {
+        files.contains(&format!("lib{}.so", l))
+            || files.contains(&format!("{}.dll", l))
+            || files.contains(&format!("lib{}.dylib", l))
+    });
+    match (can_static, can_dylib) {
+        (true, false) => return "static",
+        (false, true) => return "dylib",
+        (false, false) => {
+            panic!(
+                "OpenSSL libdir at `{:?}` does not contain the required files \
+                 to either statically or dynamically link OpenSSL",
+                libdirs
+            );
+        }
+        (true, true) => {}
+    }
+
+    // Ok, we've got not explicit preference and can *either* link statically or
+    // link dynamically. In the interest of "security upgrades" and/or "best
+    // practices with security libs", let's link dynamically.
+    "dylib"
+}

vendor/openssl-sys/build/run_bindgen.rs

@@ -0,0 +1,253 @@
+#[cfg(feature = "bindgen")]
+use bindgen::callbacks::{MacroParsingBehavior, ParseCallbacks};
+#[cfg(feature = "bindgen")]
+use bindgen::{MacroTypeVariation, RustTarget};
+use std::io::Write;
+use std::path::PathBuf;
+#[cfg(not(feature = "bindgen"))]
+use std::process;
+use std::{env, fs};
+
+const INCLUDES: &str = "
+#include <openssl/aes.h>
+#include <openssl/asn1.h>
+#include <openssl/bio.h>
+#include <openssl/cmac.h>
+#include <openssl/conf.h>
+#include <openssl/crypto.h>
+#include <openssl/dh.h>
+#include <openssl/dsa.h>
+#include <openssl/ec.h>
+#include <openssl/err.h>
+#include <openssl/evp.h>
+#include <openssl/hmac.h>
+#include <openssl/objects.h>
+#include <openssl/opensslv.h>
+#include <openssl/pem.h>
+#include <openssl/pkcs12.h>
+#include <openssl/pkcs7.h>
+#include <openssl/rand.h>
+#include <openssl/rsa.h>
+#include <openssl/safestack.h>
+#include <openssl/sha.h>
+#include <openssl/ssl.h>
+#include <openssl/stack.h>
+#include <openssl/x509.h>
+#include <openssl/x509_vfy.h>
+#include <openssl/x509v3.h>
+
+// this must be included after ssl.h for libressl!
+#include <openssl/srtp.h>
+
+#if !defined(LIBRESSL_VERSION_NUMBER) && !defined(OPENSSL_IS_BORINGSSL)
+#include <openssl/cms.h>
+#endif
+
+#if !defined(OPENSSL_IS_BORINGSSL)
+#include <openssl/comp.h>
+#include <openssl/ocsp.h>
+#endif
+
+#if !defined(LIBRESSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER >= 0x10100000
+#include <openssl/kdf.h>
+#endif
+
+#if OPENSSL_VERSION_NUMBER >= 0x30000000
+#include <openssl/provider.h>
+#endif
+
+#if OPENSSL_VERSION_NUMBER >= 0x30200000
+#include <openssl/quic.h>
+#endif
+
+#if defined(LIBRESSL_VERSION_NUMBER) || defined(OPENSSL_IS_BORINGSSL)
+#include <openssl/poly1305.h>
+#endif
+
+#if OPENSSL_VERSION_NUMBER >= 0x30200000
+#include <openssl/thread.h>
+#endif
+";
+
+#[cfg(feature = "bindgen")]
+pub fn run(include_dirs: &[PathBuf]) {
+    let out_dir = PathBuf::from(env::var_os("OUT_DIR").unwrap());
+
+    let mut builder = bindgen::builder()
+        .parse_callbacks(Box::new(OpensslCallbacks))
+        .rust_target(RustTarget::Stable_1_47)
+        .ctypes_prefix("::libc")
+        .raw_line("use libc::*;")
+        .raw_line("#[cfg(windows)] use std::os::windows::raw::HANDLE;")
+        .raw_line("type evp_pkey_st = EVP_PKEY;")
+        .allowlist_file(".*[/\\\\]openssl/[^/\\\\]+\\.h")
+        .allowlist_recursively(false)
+        // libc is missing pthread_once_t on macOS
+        .blocklist_type("CRYPTO_ONCE")
+        .blocklist_function("CRYPTO_THREAD_run_once")
+        // we don't want to mess with va_list
+        .blocklist_function("BIO_vprintf")
+        .blocklist_function("BIO_vsnprintf")
+        .blocklist_function("ERR_vset_error")
+        .blocklist_function("ERR_add_error_vdata")
+        .blocklist_function("EVP_KDF_vctrl")
+        .blocklist_type("OSSL_FUNC_core_vset_error_fn")
+        .blocklist_type("OSSL_FUNC_BIO_vprintf_fn")
+        .blocklist_type("OSSL_FUNC_BIO_vsnprintf_fn")
+        // struct hostent * does not exist on Windows
+        .blocklist_function("BIO_gethostbyname")
+        // Maintain compatibility for existing enum definitions
+        .rustified_enum("point_conversion_form_t")
+        // Maintain compatibility for pre-union definitions
+        .blocklist_type("GENERAL_NAME")
+        .blocklist_type("GENERAL_NAME_st")
+        .blocklist_type("EVP_PKEY")
+        .blocklist_type("evp_pkey_st")
+        .layout_tests(false)
+        .header_contents("includes.h", INCLUDES);
+
+    for include_dir in include_dirs {
+        builder = builder
+            .clang_arg("-I")
+            .clang_arg(include_dir.display().to_string());
+    }
+
+    builder
+        .generate()
+        .unwrap()
+        .write_to_file(out_dir.join("bindgen.rs"))
+        .unwrap();
+}
+
+#[cfg(feature = "bindgen")]
+pub fn run_boringssl(include_dirs: &[PathBuf]) {
+    let out_dir = PathBuf::from(env::var_os("OUT_DIR").unwrap());
+
+    fs::File::create(out_dir.join("boring_static_wrapper.h"))
+        .expect("Failed to create boring_static_wrapper.h")
+        .write_all(INCLUDES.as_bytes())
+        .expect("Failed to write contents to boring_static_wrapper.h");
+
+    let mut builder = bindgen::builder()
+        .rust_target(RustTarget::Stable_1_47)
+        .ctypes_prefix("::libc")
+        .raw_line("use libc::*;")
+        .derive_default(false)
+        .enable_function_attribute_detection()
+        .default_macro_constant_type(MacroTypeVariation::Signed)
+        .rustified_enum("point_conversion_form_t")
+        .allowlist_file(".*[/\\\\]openssl/[^/]+\\.h")
+        .allowlist_recursively(false)
+        .blocklist_function("BIO_vsnprintf")
+        .blocklist_function("OPENSSL_vasprintf")
+        .wrap_static_fns(true)
+        .wrap_static_fns_path(out_dir.join("boring_static_wrapper").display().to_string())
+        .layout_tests(false)
+        .header(
+            out_dir
+                .join("boring_static_wrapper.h")
+                .display()
+                .to_string(),
+        );
+
+    for include_dir in include_dirs {
+        builder = builder
+            .clang_arg("-I")
+            .clang_arg(include_dir.display().to_string());
+    }
+
+    builder
+        .generate()
+        .unwrap()
+        .write_to_file(out_dir.join("bindgen.rs"))
+        .unwrap();
+
+    cc::Build::new()
+        .file(out_dir.join("boring_static_wrapper.c"))
+        .includes(include_dirs)
+        .compile("boring_static_wrapper");
+}
+
+#[cfg(not(feature = "bindgen"))]
+pub fn run_boringssl(include_dirs: &[PathBuf]) {
+    let out_dir = PathBuf::from(env::var_os("OUT_DIR").unwrap());
+
+    fs::File::create(out_dir.join("boring_static_wrapper.h"))
+        .expect("Failed to create boring_static_wrapper.h")
+        .write_all(INCLUDES.as_bytes())
+        .expect("Failed to write contents to boring_static_wrapper.h");
+
+    let mut bindgen_cmd = process::Command::new("bindgen");
+    bindgen_cmd
+        .arg("-o")
+        .arg(out_dir.join("bindgen.rs"))
+        // Must be a valid version from
+        // https://docs.rs/bindgen/latest/bindgen/enum.RustTarget.html
+        .arg("--rust-target=1.47")
+        .arg("--ctypes-prefix=::libc")
+        .arg("--raw-line=use libc::*;")
+        .arg("--no-derive-default")
+        .arg("--enable-function-attribute-detection")
+        .arg("--default-macro-constant-type=signed")
+        .arg("--rustified-enum=point_conversion_form_t")
+        .arg("--allowlist-file=.*[/\\\\]openssl/[^/]+\\.h")
+        .arg("--no-recursive-allowlist")
+        .arg("--blocklist-function=BIO_vsnprintf")
+        .arg("--blocklist-function=OPENSSL_vasprintf")
+        .arg("--experimental")
+        .arg("--wrap-static-fns")
+        .arg("--wrap-static-fns-path")
+        .arg(out_dir.join("boring_static_wrapper").display().to_string())
+        .arg("--no-layout-tests")
+        .arg(out_dir.join("boring_static_wrapper.h"))
+        .arg("--")
+        .arg(format!("--target={}", env::var("TARGET").unwrap()));
+
+    for include_dir in include_dirs {
+        bindgen_cmd.arg("-I").arg(include_dir.display().to_string());
+    }
+
+    let result = bindgen_cmd.status().expect("bindgen failed to execute");
+    assert!(result.success());
+
+    cc::Build::new()
+        .file(out_dir.join("boring_static_wrapper.c"))
+        .includes(include_dirs)
+        .compile("boring_static_wrapper");
+}
+
+#[cfg(feature = "bindgen")]
+#[derive(Debug)]
+struct OpensslCallbacks;
+
+#[cfg(feature = "bindgen")]
+impl ParseCallbacks for OpensslCallbacks {
+    // for now we'll continue hand-writing constants
+    fn will_parse_macro(&self, _name: &str) -> MacroParsingBehavior {
+        MacroParsingBehavior::Ignore
+    }
+
+    fn item_name(&self, original_item_name: &str) -> Option<String> {
+        match original_item_name {
+            // Our original definitions of these are wrong, so rename to avoid breakage
+            "CRYPTO_EX_new"
+            | "CRYPTO_EX_dup"
+            | "CRYPTO_EX_free"
+            | "BIO_meth_set_write"
+            | "BIO_meth_set_read"
+            | "BIO_meth_set_puts"
+            | "BIO_meth_set_ctrl"
+            | "BIO_meth_set_create"
+            | "BIO_meth_set_destroy"
+            | "CRYPTO_set_locking_callback"
+            | "CRYPTO_set_id_callback"
+            | "SSL_CTX_set_tmp_dh_callback"
+            | "SSL_set_tmp_dh_callback"
+            | "SSL_CTX_set_tmp_ecdh_callback"
+            | "SSL_set_tmp_ecdh_callback"
+            | "SSL_CTX_callback_ctrl"
+            | "SSL_CTX_set_alpn_select_cb" => Some(format!("{}__fixed_rust", original_item_name)),
+            _ => None,
+        }
+    }
+}