Re: [RFC] OS X El Capitan + Xcode ships without SSL header?!

[Lars Schneider <larsxschneider@gmail.com>]

On 29 Nov 2015, at 18:04, Torsten Bögershausen <tboegi@web.de> wrote:

> On 21/11/15 19:58, Lars Schneider wrote:
>> Hi,
>> 
>> I cannot build Git on a clean machine with OS X El Capitan 10.11, Xcode 7.1.1 and Xcode command line tools because of missing OpenSSL headers.
>> 
>> It looks like as there are no OpenSSL headers at all. I only found this weird non working version:
>> /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/swift-migrator/sdk/MacOSX.sdk/usr/include/openssl/ssl.h
>> 
>> I installed OpenSSL with brew, added the include path and it works.
>> 
>> Can anyone confirm?
>> 
>> Thanks,
>> Lars
>> 
> (Does it make sense that you send a patch which auto-detects brew similar to fink or mac ports?)
I think that would make sense. I'll look into it if I find some free cycles...

> 
> After some proper updating of one test machine I ran into the same problem.
> A possible patch may look like this:
> 
> 
> commit 5e7c16f3350e8e62bfdb181b0b5da7352945d046
> Author: Torsten Bögershausen <tboegi@web.de>
> Date:   Sun Nov 29 17:29:22 2015 +0100
> 
>    Mac OS X 10.11: set NO_OPENSSL
> 
>    There is no openssl/ directory any more in Mac OS X 10.11,
>    openssl is depracated since Mac OS X 10.7
> 
>    Set NO_OPENSSL to YesPlease as default under Mac OS X, and make it
>    possible to override this and use openssl by defining DARWIN_OPENSSL
> 
> diff --git a/config.mak.uname b/config.mak.uname
> index f34dcaa..a8a8b07 100644
> --- a/config.mak.uname
> +++ b/config.mak.uname
> @@ -105,6 +105,12 @@ ifeq ($(uname_S),Darwin)
>        ifeq ($(shell test "`expr "$(uname_R)" : '\([0-9][0-9]*\)\.'`" -ge 11 && echo 1),1)
>                HAVE_GETDELIM = YesPlease
>        endif
> +       # MacOS 10.11  and higher
> +       ifeq ($(shell test "`expr "$(uname_R)" : '\([0-9][0-9]*\)\.'`" -ge 15 && echo 1),1)
> +               ifndef DARWIN_OPENSSL
> +                       NO_OPENSSL = YesPlease
> +               endif
> +       endif

That would propably do it. However, what are the ramifications here? Does this affect `git clone` over HTTPS or even SSH? Sorry if this question sounds stupid but I am not too familiar with these systems. If there are indeed these severe ramifications then I would probably print a little tutorial how to install OpenSSL via brew.

Maybe one could use Apple's TLS implementation [1] on OS X alternatively. However, I don't know how different the APIs are and the resulting "ifdefs" are probably undesired.

Cheers,
Lars

[1] https://developer.apple.com/library/mac/documentation/Security/Reference/secureTransportRef/