depends: openssl 1.1.1w

[lyricidal]

Migrates the build from OpenSSL 1.0.2u to 1.1.1w. Three commits, one per area
— they are a set: each alone leaves the build broken, together CI is green on
all seven build-factory targets.

Motivation

• 1.0.2u is EOL since 2019 and carries years of unpatched CVEs. 1.1.1w is the
  final 1.1.1 release and the smallest step that compiles this codebase with
  minimal source changes (3.x is a larger source migration that can follow
  separately).
• The 1.0.2u tarball was removed from openssl.org's download path, so
  make -C depends download fails on stock master — depends cannot build at
  all until openssl.mk changes one way or another.

Changes

1. build: compile against OpenSSL 1.1.x (guard removed 1.0-only APIs)
   OpenSSL 1.1 removed the thread-locking callback API (CRYPTO_num_locks,
   CRYPTO_set_locking_callback) and RAND_screen(); the init code in
   util.cpp still used them. That block is now guarded to compile only for
   OpenSSL < 1.1 / LibreSSL (1.1 is internally thread-safe), so the tree
   builds against both. Also disables the vendored secp256k1/secp256k1-mw
   test suites in configure.ac (--enable-tests=no): their configure probes
   OpenSSL with the pre-1.1 EC API and won't run against 1.1+. The libraries
   themselves use no OpenSSL — compile-only change.

2. depends: bump vendored OpenSSL 1.0.2u -> 1.1.1w
   New version/sha256, download from the OpenSSL GitHub release. Config
   flags rewritten for 1.1's build system (many old no-* flags no longer
   exist); no-engine is required for the mingw build — with engines on,
   1.1's Windows CAPI engine pulls in -lcrypt32, which breaks curl's
   OpenSSL detection probe. Staging uses DESTDIR= (1.1 renamed it from
   INSTALL_PREFIX=).

3. depends: make Qt's OPENSSL_LIBS host-specific (fix Linux/macOS build)
   qt.mk set one OPENSSL_LIBS for every host, hardcoding the Windows-only
   -lws2_32 -lgdi32. Under 1.0.2u Qt's default probe (-lssl -lcrypto)
   still detected OpenSSL on Linux, but 1.1's static libcrypto additionally
   needs -lpthread/-ldl there, so every probe failed and configure
   aborted with "Feature 'openssl-linked' was enabled, but the pre-condition
   '!features.securetransport && libs.openssl' failed". Now per host: mingw
   keeps its existing (working) value, Linux uses
   -lssl -lcrypto -lpthread -ldl, macOS uses -lssl -lcrypto.

Compatibility

• Build-level change only: OpenSSL here backs RNG seeding, Qt network and
  curl TLS — no consensus code path depends on 1.0-specific behavior. No
  protocol or network impact.
• The source still builds against OpenSSL 1.0.x (the compat guards are
  version-conditional), so non-depends/system-lib builds are unaffected.
• Requires re-running ./autogen.sh after checkout (configure.ac changed).

Testing

• Full build factory green on all targets: source distribution, x86_64
  Linux, Win64, macOS (DMG deploy included), ARM64, ARM32, RISC-V.
• The intermediate red runs isolated each commit's necessity: without (3),
  the three glibc Linux targets fail at Qt configure exactly as described;
  macOS/Win64 passing through the full wallet compile exercises (1).

Note: this supersedes any interim fix that only repointed the 1.0.2u
download URL — both edit openssl.mk's download path and must not be merged
together.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 6eb685dc-9f2b-44be-83f3-77657d7a2671

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}