git: 13e7b21901a5 - main - Makefile.inc1: Build openssl as a certctl dependency on old FreeBSD

The branch main has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=13e7b21901a5e246e4b42d28e930ec80fe6889d0

commit 13e7b21901a5e246e4b42d28e930ec80fe6889d0
Author:     Mark Johnston <markj@FreeBSD.org>
AuthorDate: 2025-09-03 16:14:37 +0000
Commit:     Mark Johnston <markj@FreeBSD.org>
CommitDate: 2025-09-03 16:14:37 +0000

    Makefile.inc1: Build openssl as a certctl dependency on old FreeBSD
    
    X509_NAME_hash_ex() is not available in OpenSSL 1.x.
    
    Reviewed by:    des
    Reported by:    syzbot+54c1e57e7184582a8f59@syzkaller.appspotmail.com
    Fixes:          c340ef28fd38 ("certctl: Reimplement in C")
    Differential Revision:  https://reviews.freebsd.org/D52291
---
 Makefile.inc1 | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/Makefile.inc1 b/Makefile.inc1
index 3bbc4afed3fd..01866f949e49 100644
--- a/Makefile.inc1
+++ b/Makefile.inc1
@@ -2714,9 +2714,10 @@ _basic_bootstrap_tools+=usr.sbin/tzsetup
 
 # certctl is needed as an install tool.  libcrypto is rather heavy, so we'll
 # build that alongside it only for platforms that don't expose headers for
-# OpenSSL, like macOS.
+# OpenSSL, like macOS, or when building on releases with OpenSSL 1.x.
 .if ${MK_CAROOT} != "no" && ${MK_OPENSSL} != "no"
-.if ${.MAKE.OS} == "Darwin"
+.if ${.MAKE.OS} == "Darwin" || \
+    (${.MAKE.OS} == "FreeBSD" && ${BOOTSTRAPPING} < 1400000)
 _bootstrap_libcrypto=secure/lib/libcrypto
 ${_bt}-usr.sbin/certctl: ${_bt}-secure/lib/libcrypto
 .endif