openssl-sys patch declares a full-featured OpenSSL: empty cargo:conf= mismatches the feature-reduced build #200

Summary

The vendored openssl-sys build-script patch (third_party/patches/openssl_sys_build_rs.patch) declares a full-featured OpenSSL to the Rust crate graph: it hardcodes the version cfgs up to ossl350 but emits an empty feature-exclusion list:

println!("cargo:conf=");

The S-CORE OpenSSL build (//third_party/openssl) is heavily feature-reduced (no-ocsp, no-sm4, no-idea, no-cms, no-srtp, ~25 no-* Configure flags). cargo:conf= is how openssl-sys tells the high-level openssl crate which OPENSSL_NO_* features to gate out (#[cfg(osslconf = "OPENSSL_NO_…")]). With the empty list, the openssl crate compiles bindings for OCSP, SM4, IDEA, CMS, … that reference symbols the linked library does not export.

Why it doesn't blow up today

Dead-stripping: the unused binding objects are discarded at link time, so the undefined references vanish. The mismatch is latent, not harmless:

• Calling any of these APIs from Rust compiles fine and fails only at link time with undefined symbol: OCSP_basic_verify-style errors, far from the offending code. With a correct conf, the same mistake fails at compile time ("no method named …") because the API genuinely doesn't exist — the right failure mode for a security library.
• Anything that defeats dead-stripping re-detonates it across every binary that links openssl. Discovered exactly that way in coverage: adopt the LLVM coverage pipeline from score_tooling 2.2.1 #198: the coverage configuration's -Clink-dead-code (standard in the S-CORE LLVM coverage pipeline) broke all 23 //score/cryptoki/tests links with undefined OCSP/SM4/IDEA symbols. That PR works around it by omitting the flag; this issue is the root cause.

Proposed fix

Change the patch to emit the real exclusion set:

println!("cargo:conf=OPENSSL_NO_ACVP_TESTS,OPENSSL_NO_AFALGENG,…,OPENSSL_NO_OCSP,…,OPENSSL_NO_SM4,…");

The authoritative source is the generated include/openssl/configuration.h in the openssl_make output (85 OPENSSL_NO_* defines for the current flags):

grep -oE "define OPENSSL_NO_[A-Z0-9_]+" bazel-bin/third_party/openssl/openssl_make/include/openssl/configuration.h \
  | sed 's/define //' | sort | paste -sd,

The list must be regenerated whenever the Configure flags in //third_party/openssl/BUILD change (worth a comment next to them, or a small check).

This was validated in the course of #198: with the conf emitted, the OCSP/SM4/IDEA bindings are correctly gated out and those links succeed even with -Clink-dead-code.

Known limitation

openssl 0.10.68's four SRTP bindings (SSL_CTX_set_tlsext_use_srtp etc.) carry no osslconf gate upstream, so the conf list cannot remove them — under -Clink-dead-code they still fail. Fixing that needs either an upstream gate or a second small patch on the openssl crate; until then, coverage keeps dead-stripping on (documented in tools/coverage/coverage.bazelrc).