Update ponylang/ssl to 2.0.1 (#134)

SeanTAllen · web-flow · commit 6e251e703a15 · 2026-03-21T15:16:03.000-04:00
* Pick up bug fix in ponylang/ssl dependency

* Update CI to use ssl=libressl instead of ssl=0.9.0

Switch from the removed openssl_0.9.0 define to the libressl define.
Windows builds now download and build LibreSSL from source.

* Fix LibreSSL build for Windows arm64
diff --git a/.github/workflows/breakage-against-linux-ponyc-latest.yml b/.github/workflows/breakage-against-linux-ponyc-latest.yml
@@ -17,7 +17,7 @@ jobs:
     steps:
       - uses: actions/checkout@v6.0.2
       - name: Test
-        run: make test ssl=0.9.0 config=debug
+        run: make test ssl=libressl config=debug
       - name: Send alert on failure
         if: ${{ failure() }}
         uses: zulip/github-actions-zulip/send-message@e4c8f27c732ba9bd98ac6be0583096dea82feea5
@@ -39,7 +39,7 @@ jobs:
     steps:
       - uses: actions/checkout@v6.0.2
       - name: Test
-        run: make test ssl=0.9.0 config=debug
+        run: make test ssl=libressl config=debug
       - name: Send alert on failure
         if: ${{ failure() }}
         uses: zulip/github-actions-zulip/send-message@e4c8f27c732ba9bd98ac6be0583096dea82feea5
diff --git a/.github/workflows/breakage-against-windows-ponyc-latest.yml b/.github/workflows/breakage-against-windows-ponyc-latest.yml
@@ -20,6 +20,21 @@ jobs:
           Invoke-WebRequest https://dl.cloudsmith.io/public/ponylang/releases/raw/versions/latest/corral-x86-64-pc-windows-msvc.zip -OutFile C:\corral.zip;
           Expand-Archive -Force -Path C:\corral.zip -DestinationPath C:\ponyc;
           $env:PATH = 'C:\ponyc\bin;' + $env:PATH;
+      - name: cache SSL libs
+        id: restore-libs
+        uses: actions/cache@v5.0.3
+        with:
+          path: |
+            ssl.lib
+            crypto.lib
+            tls.lib
+          key: rootlibs-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('make.ps1') }}
+      - name: build SSL libs
+        if: steps.restore-libs.outputs.cache-hit != 'true'
+        run: .\make.ps1 -Command libs  2>&1;
+      - name: Test
+        run: |
+          $env:PATH = 'C:\ponyc\bin;' + $env:PATH;
           .\make.ps1 -Command test 2>&1;
       - name: Send alert on failure
         if: ${{ failure() }}
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
@@ -25,7 +25,7 @@ jobs:
     steps:
       - uses: actions/checkout@v6.0.2
       - name: Test
-        run: make test config=debug ssl=0.9.0
+        run: make test config=debug ssl=libressl
 
   libressl-4-vs-ponyc-release:
     name: LibreSSL 4.x with most recent ponyc release
@@ -35,7 +35,7 @@ jobs:
     steps:
       - uses: actions/checkout@v6.0.2
       - name: Test
-        run: make test config=debug ssl=0.9.0
+        run: make test config=debug ssl=libressl
 
   openssl-1-vs-ponyc-release:
     name: OpenSSL 1.x with most recent ponyc release
@@ -69,6 +69,21 @@ jobs:
           Invoke-WebRequest https://dl.cloudsmith.io/public/ponylang/releases/raw/versions/latest/corral-x86-64-pc-windows-msvc.zip -OutFile C:\corral.zip;
           Expand-Archive -Force -Path C:\corral.zip -DestinationPath C:\ponyc;
           $env:PATH = 'C:\ponyc\bin;' + $env:PATH;
+      - name: cache SSL libs
+        id: restore-libs
+        uses: actions/cache@v5.0.3
+        with:
+          path: |
+            ssl.lib
+            crypto.lib
+            tls.lib
+          key: rootlibs-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('make.ps1') }}
+      - name: build SSL libs
+        if: steps.restore-libs.outputs.cache-hit != 'true'
+        run: .\make.ps1 -Command libs  2>&1;
+      - name: Test
+        run: |
+          $env:PATH = 'C:\ponyc\bin;' + $env:PATH;
           .\make.ps1 -Command test 2>&1;
 
   windows-arm64-vs-ponyc-release:
@@ -83,4 +98,19 @@ jobs:
           Invoke-WebRequest https://dl.cloudsmith.io/public/ponylang/releases/raw/versions/latest/corral-arm64-pc-windows-msvc.zip -OutFile C:\corral.zip;
           Expand-Archive -Force -Path C:\corral.zip -DestinationPath C:\ponyc;
           $env:PATH = 'C:\ponyc\bin;' + $env:PATH;
+      - name: cache SSL libs
+        id: restore-libs
+        uses: actions/cache@v5.0.3
+        with:
+          path: |
+            ssl.lib
+            crypto.lib
+            tls.lib
+          key: rootlibs-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('make.ps1') }}
+      - name: build SSL libs
+        if: steps.restore-libs.outputs.cache-hit != 'true'
+        run: .\make.ps1 -Command libs  2>&1;
+      - name: Test
+        run: |
+          $env:PATH = 'C:\ponyc\bin;' + $env:PATH;
           .\make.ps1 -Command test 2>&1;
diff --git a/.release-notes/update-ssl-to-2.0.1.md b/.release-notes/update-ssl-to-2.0.1.md
@@ -0,0 +1,3 @@
+## Update ponylang/ssl to 2.0.1
+
+Updates the ponylang/ssl dependency to 2.0.1 to pick up a bug fix.
diff --git a/Makefile b/Makefile
@@ -31,8 +31,8 @@ ifeq (,$(filter $(MAKECMDGOALS),clean docs realclean TAGS))
 	  SSL = -Dopenssl_3.0.x
   else ifeq ($(ssl), 1.1.x)
 	  SSL = -Dopenssl_1.1.x
-  else ifeq ($(ssl), 0.9.0)
-	  SSL = -Dopenssl_0.9.0
+  else ifeq ($(ssl), libressl)
+	  SSL = -Dlibressl
   else
     $(error Unknown SSL version "$(ssl)". Must set using 'ssl=FOO')
   endif
diff --git a/corral.json b/corral.json
@@ -2,7 +2,7 @@
   "deps": [
     {
       "locator": "github.com/ponylang/ssl.git",
-      "version": "1.0.1"
+      "version": "2.0.1"
     }
   ],
   "packages": [
diff --git a/make.ps1 b/make.ps1
@@ -53,14 +53,14 @@ else
   throw "Invalid -Config path '$Config'; must be one of (Debug, Release)."
 }
 
-# $libsDir = Join-Path -Path $rootDir -ChildPath "build/libs"
+$libsDir = Join-Path -Path $rootDir -ChildPath "build/libs"
 
 if (($Version -eq "") -and (Test-Path -Path "$rootDir\VERSION"))
 {
   $Version = (Get-Content "$rootDir\VERSION") + "-" + (& git 'rev-parse' '--short' '--verify' 'HEAD^')
 }
 
-$ponyArgs = "--define openssl_0.9.0"
+$ponyArgs = "--define libressl  --path $rootDir"
 
 Write-Host "Configuration:    $Config"
 Write-Host "Version:          $Version"
@@ -88,6 +88,45 @@ if (($Command -ne "clean") -and (Test-Path -Path "$rootDir\VERSION"))
   }
 }
 
+function BuildLibs
+{
+  # When upgrading, change $libreSsl, $libreSslLib, and the copied libs below
+  $libreSsl = "libressl-3.9.1"
+
+  if (-not ((Test-Path "$rootDir/crypto.lib") -and (Test-Path "$rootDir/ssl.lib")))
+  {
+    $libreSslSrc = Join-Path -Path $libsDir -ChildPath $libreSsl
+
+    if (-not (Test-Path $libreSslSrc))
+    {
+      $libreSslTgz = "$libreSsl.tar.gz"
+      $libreSslTgzTgt = Join-Path -Path $libsDir -ChildPath $libreSslTgz
+      if (-not (Test-Path $libreSslTgzTgt)) { Invoke-WebRequest -TimeoutSec 300 -Uri "https://cdn.openbsd.org/pub/OpenBSD/LibreSSL/$libreSslTgz" -OutFile $libreSslTgzTgt }
+      tar -xvzf "$libreSslTgzTgt" -C "$libsDir"
+      if ($LastExitCode -ne 0) { throw "Error downloading and extracting $libreSslTgz" }
+    }
+
+    $libreSslLib = Join-Path -Path $libsDir -ChildPath "lib/ssl-53.lib"
+
+    if (-not (Test-Path $libreSslLib))
+    {
+      Push-Location $libreSslSrc
+      (Get-Content "$libreSslSrc\CMakeLists.txt").replace('add_definitions(-Dinline=__inline)', "add_definitions(-Dinline=__inline)`nadd_definitions(-DPATH_MAX=255)") | Set-Content "$libreSslSrc\CMakeLists.txt"
+      if ($Arch -ieq 'arm64') { $cmakeArch = 'ARM64' } else { $cmakeArch = 'x64' }
+      cmake.exe $libreSslSrc -Thost=x64 -A $cmakeArch -DCMAKE_INSTALL_PREFIX="$libsDir" -DCMAKE_BUILD_TYPE="Release"
+      if ($LastExitCode -ne 0) { Pop-Location; throw "Error configuring $libreSsl" }
+      cmake.exe --build . --target install --config Release
+      if ($LastExitCode -ne 0) { Pop-Location; throw "Error building $libreSsl" }
+      Pop-Location
+    }
+
+    # copy to the root dir (i.e. PONYPATH) for linking
+    Copy-Item -Force -Path "$libsDir/lib/ssl.lib" -Destination "$rootDir/ssl.lib"
+    Copy-Item -Force -Path "$libsDir/lib/crypto.lib" -Destination "$rootDir/crypto.lib"
+    Copy-Item -Force -Path "$libsDir/lib/tls.lib" -Destination "$rootDir/tls.lib"
+  }
+}
+
 function BuildTarget
 {
   $binaryFile = Join-Path -Path $buildDir -ChildPath "$target.exe"
@@ -239,6 +278,17 @@ switch ($Command.ToLower())
     break
   }
 
+  "libs"
+  {
+    if (-not (Test-Path $libsDir))
+    {
+      mkdir "$libsDir"
+    }
+
+    BuildLibs
+    break
+  }
+
   default
   {
     throw "Unknown command '$Command'; must be one of (libs, build, test, install, package, clean, distclean)."

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+## Update ponylang/ssl to 2.0.1`
	`2`	`+`
	`3`	`+Updates the ponylang/ssl dependency to 2.0.1 to pick up a bug fix.`
Original file line number	Diff line number	Diff line change
`@@ -2,7 +2,7 @@`
`2`	`2`	`"deps": [`
`3`	`3`	`{`
`4`	`4`	`"locator": "github.com/ponylang/ssl.git",`
`5`		`- "version": "1.0.1"`
	`5`	`+ "version": "2.0.1"`
`6`	`6`	`}`
`7`	`7`	`],`
`8`	`8`	`"packages": [`