From 89617471f89dabf14a9044b553535799c65af1fe Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Mislav=20Marohni=C4=87?= <git@mislav.net>
Date: Thu, 7 Dec 2023 15:52:10 +0100
Subject: [PATCH] Fix linking to older OpenSSL for Ruby < 2.7.7

Explicitly set PKG_CONFIG_PATH when `--with-openssl-dir` is used for older Rubies.
Otherwise, Ruby will attempt to link to the latest OpenSSL found by pkg-config,
which could be incompatible.
---
 bin/ruby-build                  |  15 +++++++++++++
 test/build.bats                 |  36 ++++++++++++++++++++++++++------
 test/fixtures/ruby-3.2.0.tar.gz | Bin 222 -> 246 bytes
 3 files changed, 45 insertions(+), 6 deletions(-)

diff --git a/bin/ruby-build b/bin/ruby-build
index 1da9d5c466..6565ab33fa 100755
--- a/bin/ruby-build
+++ b/bin/ruby-build
@@ -672,6 +672,21 @@ build_package_standard() {
         # use openssl installed from Ports Collection
         package_option ruby configure --with-openssl-dir="/usr/local"
       fi
+    elif [ "$(normalize_semver "${package_name#ruby-}")" -lt 200707 ]; then
+      local opt
+      for opt in $RUBY_CONFIGURE_OPTS "${RUBY_CONFIGURE_OPTS_ARRAY[@]}"; do
+        if [[ $opt == --with-openssl-dir=* ]]; then
+          # Ruby < 2.7.7 are known to prioritize the result of `pkg-config --libs openssl`
+          # over the directory explicitly supplied by "--with-openssl-dir". This can cause
+          # issues if an incompatible OpenSSL version is found in pkg-config search path.
+          # https://github.com/ruby/openssl/pull/486
+          #
+          # The workaround is to adjust the search path to prioritize the location supplied
+          # in "--with-openssl-dir".
+          export PKG_CONFIG_PATH="${opt#--with-openssl-dir=}/lib/pkgconfig${PKG_CONFIG_PATH:+:$PKG_CONFIG_PATH}"
+          break
+        fi
+      done
     fi
     if [[ "$RUBY_CONFIGURE_OPTS ${RUBY_CONFIGURE_OPTS_ARRAY[*]}" != *--with-ext* &&
           "$RUBY_CONFIGURE_OPTS ${RUBY_CONFIGURE_OPTS_ARRAY[*]}" != *--without-ext* &&
diff --git a/test/build.bats b/test/build.bats
index b712aa8562..90c412f3f3 100755
--- a/test/build.bats
+++ b/test/build.bats
@@ -6,6 +6,7 @@ export MAKE=make
 export MAKE_OPTS="-j 2"
 export CC=cc
 export -n RUBY_CONFIGURE_OPTS
+export -n PKG_CONFIG_PATH
 
 setup() {
   mkdir -p "$INSTALL_ROOT"
@@ -58,7 +59,7 @@ generate_tarball() {
       cat > "${path}/${file}" <<OUT
 #!$BASH
 IFS=,
-echo "$name: [\$*]" \${RUBYOPT:+RUBYOPT=\$RUBYOPT} >> build.log
+echo "$name: [\$*]" \${RUBYOPT:+RUBYOPT=\$RUBYOPT} \${PKG_CONFIG_PATH:+PKG_CONFIG_PATH=\$PKG_CONFIG_PATH} >> build.log
 OUT
       chmod +x "${path}/${file}"
       ;;
@@ -83,7 +84,7 @@ OUT
 stub_make_install() {
   local target="${1:-install}"
   stub "$MAKE" \
-    " : echo \"$MAKE \$(inspect_args \"\$@\")\" >> build.log" \
+    " : echo \"\${PKG_CONFIG_PATH:+PKG_CONFIG_PATH=\$PKG_CONFIG_PATH }$MAKE \$(inspect_args \"\$@\")\" >> build.log" \
     "$target : echo \"$MAKE \$(inspect_args \"\$@\")\" >> build.log && cat build.log >> '$INSTALL_ROOT/build.log'"
 }
 
@@ -372,11 +373,11 @@ DEF
   unstub make
 
   assert_build_log <<OUT
-openssl-1.1.1w: [--prefix=${INSTALL_ROOT}/openssl,--openssldir=${INSTALL_ROOT}/openssl/ssl,zlib-dynamic,no-ssl3,shared]
-make -j 2
+openssl-1.1.1w: [--prefix=${INSTALL_ROOT}/openssl,--openssldir=${INSTALL_ROOT}/openssl/ssl,zlib-dynamic,no-ssl3,shared] PKG_CONFIG_PATH=${TMP}/install/openssl/lib/pkgconfig
+PKG_CONFIG_PATH=${TMP}/install/openssl/lib/pkgconfig make -j 2
 make install_sw install_ssldirs
-ruby-3.2.0: [--prefix=$INSTALL_ROOT,--with-openssl-dir=$INSTALL_ROOT/openssl,--with-ext=openssl,psych,+]
-make -j 2
+ruby-3.2.0: [--prefix=$INSTALL_ROOT,--with-openssl-dir=$INSTALL_ROOT/openssl,--with-ext=openssl,psych,+] PKG_CONFIG_PATH=${TMP}/install/openssl/lib/pkgconfig
+PKG_CONFIG_PATH=${TMP}/install/openssl/lib/pkgconfig make -j 2
 make install
 OUT
 }
@@ -405,6 +406,29 @@ make install
 OUT
 }
 
+@test "explicit OpenSSL dir sets PKG_CONFIG_PATH for older Rubies" {
+  cached_tarball "ruby-2.7.3" configure
+
+  stub_repeated uname '-s : echo Darwin'
+  stub_repeated brew false
+  stub_make_install
+
+  PKG_CONFIG_PATH=/orig/searchpath RUBY_CONFIGURE_OPTS="--with-openssl-dir=/path/to/openssl" run_inline_definition <<DEF
+install_package "ruby-2.7.3" "http://ruby-lang.org/ruby/2.0/ruby-2.7.3.tar.gz"
+DEF
+  assert_success
+
+  unstub uname
+  unstub brew
+  unstub make
+
+  assert_build_log <<OUT
+ruby-2.7.3: [--prefix=$INSTALL_ROOT,--with-ext=openssl,psych,+,--with-openssl-dir=/path/to/openssl] PKG_CONFIG_PATH=/path/to/openssl/lib/pkgconfig:/orig/searchpath
+PKG_CONFIG_PATH=/path/to/openssl/lib/pkgconfig:/orig/searchpath make -j 2
+make install
+OUT
+}
+
 @test "link to Homebrew OpenSSL" {
   cached_tarball "ruby-3.2.0" configure
 
diff --git a/test/fixtures/ruby-3.2.0.tar.gz b/test/fixtures/ruby-3.2.0.tar.gz
index 7deb205b6637a13a592ff84050179451e5fc0a3e..c6d6c53b6388814ff06d6c16965ed4a648f4d2d0 100644
GIT binary patch
delta 157
zcmV;O0Al~%0rmk0ABzY8hu3kD2PjL4v8l0{fw_W#p)rulpkPWf7a@Vt;*!K7pi^=)
zi*pjoaH|6<OH0FJ4%8oTdWe7`MEob`=cQ$)mlmZ`+YUnUZ)9kQ7XPLOCT5X)K0X#G
z8Q|?6@9gjA=II_E;27dzrHv+FtAZv_t6*oRkW`wPlcJZCpUySV0Wk_j!6+C7BMbll
LFu*}m015yA*K$M$

delta 133
zcmV;00DAxS0p0-zABzY8rw(C}2PjN|k%769iMfJ-p|PQ{IfH^J&0K^8N{dSpi-1na
z%`DDIEW@o1s4OiFk2z3(!090ZiV*RioS&DLnO<6yN^Ls`#lIntgBt&)1}4UldOjsq
n!Ol)0sWdYuMK32mook@|Gzvz+C>RB!fG_|60e?=I015yAp@TH8