Add activation script to check for system-libs that override openssl install

.scripts/run_docker_build.sh

@@ -52,8 +52,10 @@ mkdir -p "$ARTIFACTS"
 DONE_CANARY="$ARTIFACTS/conda-forge-build-done-${CONFIG}"
 rm -f "$DONE_CANARY"
 
+# Allow people to specify extra default arguments to `docker run` (e.g. `--rm`)
+DOCKER_RUN_ARGS="${CONDA_FORGE_DOCKER_RUN_ARGS}"
 if [ -z "${CI}" ]; then
-    DOCKER_RUN_ARGS="-it "
+    DOCKER_RUN_ARGS="-it ${DOCKER_RUN_ARGS}"
 fi
 
 export UPLOAD_PACKAGES="${UPLOAD_PACKAGES:-True}"

recipe/activate.bat

@@ -0,0 +1,29 @@
+:: Check whether there are dlls for openssl on the system path that would gets
+:: picked up by the windows loader before those in the conda environment.
+:: If yes, warn that the environment is potentially vulnerable.
+
+@echo off
+
+set "LIBSSL_PATH=C:\Windows\System32\libssl-1_1-x64.dll"
+set "LIBCRYPTO_PATH=C:\Windows\System32\libcrypto-1_1-x64.dll"
+
+set "HAS_SYS_LIBS=F"
+set "HAS_SYS_SSL=F"
+set "HAS_SYS_CRYPTO=F"
+if exist %LIBSSL_PATH% (
+  set "HAS_SYS_LIBS=T"
+  set "HAS_SYS_SSL=T"
+)
+if exist %LIBCRYPTO_PATH% (
+  set "HAS_SYS_LIBS=T"
+  set "HAS_SYS_CRYPTO=T"
+)
+
+:: The carets are used for escaping brackets, which would otherwise be interpreted (and fail).
+if "%HAS_SYS_LIBS%"=="T" (
+                             ECHO WARNING: Your system contains ^(potentially^) outdated libraries under:
+  if "%HAS_SYS_SSL%"=="T"    ECHO WARNING: %LIBSSL_PATH%
+  if "%HAS_SYS_CRYPTO%"=="T" ECHO WARNING: %LIBCRYPTO_PATH%
+                             ECHO WARNING: These libraries will be linked before those in the conda
+                             ECHO WARNING: environment and might make your installation vulnerable!
+)

recipe/activate.sh

@@ -0,0 +1,29 @@
+#!/bin/bash
+
+# Check whether there are dlls for openssl on the system path that would gets
+# picked up by the windows loader before those in the conda environment.
+# If yes, warn that the environment is potentially vulnerable.
+
+LIBSSL_PATH=/c/Windows/System32/libssl-1_1-x64.dll
+LIBCRYPTO_PATH=/c/Windows/System32/libcrypto-1_1-x64.dll
+
+HAS_SYS_LIBS=F
+HAS_SYS_SSL=F
+HAS_SYS_CRYPTO=F
+if [ -f "$LIBSSL_PATH" ]; then
+  HAS_SYS_LIBS=T
+  HAS_SYS_SSL=T
+fi
+if [ -f "$LIBCRYPTO_PATH" ]; then
+  HAS_SYS_LIBS=T
+  HAS_SYS_CRYPTO=T
+fi
+
+# The carets are used for escaping brackets, which would otherwise be interpreted (and fail).
+if [ $HAS_SYS_LIBS == "T" ]; then
+                                      echo "WARNING: Your system contains (potentially) outdated libraries under:"
+  if [ $HAS_SYS_SSL == "T" ];    then echo "WARNING: $LIBSSL_PATH"; fi
+  if [ $HAS_SYS_CRYPTO == "T" ]; then echo "WARNING: $LIBCRYPTO_PATH"; fi
+                                      echo "WARNING: These libraries will be linked before those in the conda"
+                                      echo "WARNING: environment and might make your installation vulnerable!"
+fi

recipe/bld.bat

@@ -22,5 +22,18 @@ rem if errorlevel 1 exit 1
 rem nmake -f ms\ntdll.mak
 rem if errorlevel 1 exit 1
 
+:: take care of activation scripts;
+:: from https://conda-forge.org/docs/maintainer/adding_pkgs.html#activate-scripts
+setlocal EnableDelayedExpansion
+
+:: Copy the [de]activate scripts to %PREFIX%\etc\conda\[de]activate.d.
+:: This will allow them to be run on environment activation.
+for %%F in (activate deactivate) DO (
+    if not exist %PREFIX%\etc\conda\%%F.d mkdir %PREFIX%\etc\conda\%%F.d
+    copy %RECIPE_DIR%\%%F.bat %PREFIX%\etc\conda\%%F.d\%PKG_NAME%_%%F.bat
+    :: Copy unix shell activation scripts, needed by Windows Bash users
+    copy %RECIPE_DIR%\%%F.sh %PREFIX%\etc\conda\%%F.d\%PKG_NAME%_%%F.sh
+)
+
 nmake test
 if errorlevel 1 exit 1

recipe/build.sh

@@ -62,10 +62,6 @@ CC=${CC}" ${CPPFLAGS} ${CFLAGS}" \
 # make -j${CPU_COUNT} ${VERBOSE_AT}
 make -j${CPU_COUNT}
 
-# expected error: https://github.com/openssl/openssl/issues/6953
-#    OK to ignore: https://github.com/openssl/openssl/issues/6953#issuecomment-415428340
-rm test/recipes/04-test_err.t
-
 # When testing this via QEMU, even though it ends printing:
 # "ALL TESTS SUCCESSFUL."
 # .. it exits with a failure code.

recipe/meta.yaml

@@ -11,7 +11,7 @@ source:
     - 0001-Don-t-use-USE_BCRYPTGENRANDOM-for-VS-older-than-2015.patch
 
 build:
-  number: 0
+  number: 1
 
 requirements:
     build: