From 7eaaa6ef228f22f681d3ee298bb7cd055486397c Mon Sep 17 00:00:00 2001
From: Adam Joseph <adam@westernsemico.com>
Date: Sat, 10 Jun 2023 13:00:00 -0700
Subject: [PATCH] openssl: prevent -march= flags from being added on mips

Openssl assumes that CFLAGS contains all of the flags that will be
passed to the compiler.  This assumption fails for nixpkgs due to
our cc-wrapper.

On mips platforms, openssl scans CFLAGS to see if the user passed a
-march flag; if not, it adds its own:

  if ($target =~ /linux.*-mips/ && !$disabled{asm}
        && !grep { $_ =~ /-m(ips|arch=)/ } (@{$config{CFLAGS}})) {
        # minimally required architecture flags for assembly modules
        my $value;
        $value = '-mips2' if ($target =~ /mips32/);
        $value = '-mips3' if ($target =~ /mips64/);
        unshift @{$config{cflags}}, $value;
        unshift @{$config{cxxflags}}, $value if $config{CXX};
  }

Unfortunately since nixpkgs adds `-march=` in the wrapper, rather
than the CFLAGS, openssl can't see it.  The result is two
conflicting `-march=` flags and a build failure when the user has
customized `hostPlatform.gcc.arch`:

  openssl-mips64el-unknown-linux-gnuabin32> mips64el-unknown-linux-gnuabin32-gcc  -I. -Iinclude -Iapps/include  -fPIC -pthread -mabi=n32 -mips3 -Wa,--noexecstack -Wall -O3 -DOPENSSL_USE_NODELETE -DOPENSSL_PIC -DOPENSSLDIR="\"/nix/store/8kwvrgwdk56ml6sz5swr71fv9mv4592w-openssl-mips64el-unknown-linux-gnuabin32-3.0.9/etc/ssl\"" -DENGINESDIR="\"/nix/store/8kwvrgwdk56ml6sz5swr71fv9mv4592w-openssl-mips64el-unknown-linux-gnuabin32-3.0.9/lib/engines-3\"" -DMODULESDIR="\"/nix/store/8kwvrgwdk56ml6sz5swr71fv9mv4592w-openssl-mips64el-unknown-linux-gnuabin32-3.0.9/lib/ossl-modules\"" -DOPENSSL_BUILDING_OPENSSL -DNDEBUG  -MMD -MF apps/lib/libapps-lib-engine.d.tmp -MT apps/lib/libapps-lib-engine.o -c -o apps/lib/libapps-lib-engine.o apps/lib/engine.c
  cc1: error: '-mips3' conflicts with the other architecture options, which specify a mips64r2 processor
  cc1: error: '-mips3' conflicts with the other architecture options, which specify a mips64r2 processor
  make[1]: *** [Makefile:4254: apps/lib/libapps-lib-app_libctx.o] Error 1
  make[1]: *** Waiting for unfinished jobs....
  make[1]: *** [Makefile:4262: apps/lib/libapps-lib-app_params.o] Error 1
  make[1]: *** [Makefile:4270: apps/lib/libapps-lib-app_provider.o] Error 1

This commit defeats the perl code above by passing `CFLAGS=-march`
to openssl's `./Configure` script.
---
 pkgs/development/libraries/openssl/default.nix | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index 548b5ee1f2c6a..b5ec7428f1e52 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -142,7 +142,19 @@ let
       # trying to build binaries statically.
       ++ lib.optional static "no-ct"
       ++ lib.optional withZlib "zlib"
-      ;
+      ++ lib.optionals (stdenv.hostPlatform.isMips && stdenv.hostPlatform ? gcc.arch) [
+      # This is necessary in order to avoid openssl adding -march
+      # flags which ultimately conflict with those added by
+      # cc-wrapper.  Openssl assumes that it can scan CFLAGS to
+      # detect any -march flags, using this perl code:
+      #
+      #   && !grep { $_ =~ /-m(ips|arch=)/ } (@{$config{CFLAGS}})
+      #
+      # The following bogus CFLAGS environment variable triggers the
+      # the code above, inhibiting `./Configure` from adding the
+      # conflicting flags.
+      "CFLAGS=-march=${stdenv.hostPlatform.gcc.arch}"
+    ];
 
     makeFlags = [
       "MANDIR=$(man)/share/man"