switch back to openssl on Mac (#641)

* switch back to openssl for Mac (fixes cross-compilation config)
* add openssl 3.6.0 and change make target to install_dev for quicker install
* disable LTO on Mac to reduce build time on openssl3
* add mbedTLS 3.6.5 (but this is not used anywhere right now)

6 files changed, 26 insertions, 11 deletions

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 976a7ab5d..9e50d1431 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,10 +2,11 @@
 - Include all changes from 5.7.7
 - Improvement: The build process no longer relies on vcpkg for external packages. Instead we now use xmake native packages, with package definitions in-tree (in `repo/`),
   along with some in-tree snapshots in `thirdparty/`
-  - Updates libcurl to 8.11.0 which contains a fix for an occasional error which manifested on MacOS
+  - Updates libcurl to 8.11.0
   - Bumps xmake version used in CI to 2.9.9 to fix some issues when building xmake packages for Windows
   - Enables use of ASAN on all platforms, TSAN/UBSAN/MSAN/LSAN on Linux/MacOS (see comments in xmake.lua)
   - Crashpad handler on MacOS is now supported also on arm64 as multi-architecture binary
+  - Updates openssl to 3.6.0
 - Feature: Added option to `zen oplog-download` to download attachments
   - `--attachments` use to provide a comma separated list of attachments in IoHash form to download
   - `--attachments-path` the output folder for the attachments to download
diff --git a/repo/packages/m/mbedtls/xmake.lua b/repo/packages/m/mbedtls/xmake.lua
index 540a88f48..a6c9e796e 100644
--- a/repo/packages/m/mbedtls/xmake.lua
+++ b/repo/packages/m/mbedtls/xmake.lua
@@ -15,6 +15,7 @@ package("mbedtls")
     end})
     add_urls("https://github.com/Mbed-TLS/mbedtls.git")
 
+    add_versions("v3.6.5", "4a11f1777bb95bf4ad96721cac945a26e04bf19f57d905f241fe77ebeddf46d8")
     add_versions("v3.6.1", "fc8bef0991b43629b7e5319de6f34f13359011105e08e3e16eed3a9fe6ffd3a3")
     add_versions("v3.6.0", "3ecf94fcfdaacafb757786a01b7538a61750ebd85c4b024f56ff8ba1490fcd38")
     add_versions("v3.5.1", "959a492721ba036afc21f04d1836d874f93ac124cf47cf62c9bcd3a753e49bdb")
diff --git a/repo/packages/o/openssl3/xmake.lua b/repo/packages/o/openssl3/xmake.lua
index 165162493..f8fb8ab63 100644
--- a/repo/packages/o/openssl3/xmake.lua
+++ b/repo/packages/o/openssl3/xmake.lua
@@ -5,6 +5,7 @@ package("openssl3")
 
     add_urls("https://github.com/openssl/openssl/archive/refs/tags/openssl-$(version).zip")
 
+    add_versions("3.6.0", "273d989d1157f0bd494054e1b799b6bdba39d4acaff6dfcb8db02656f1b454dd")
     add_versions("3.5.1", "9a1472b5e2a019f69da7527f381b873e3287348f3ad91783f83fff4e091ea4a8")
     add_versions("3.4.2", "d313ac2ee07ad0d9c6e9203c56a485b3ecacac61c18fe450fe3c1d4db540ad71")
     add_versions("3.3.4", "88c892a670df8924889f3bfd2f2dde822e1573a23dc4176556cb5170b40693ea")
@@ -175,6 +176,21 @@ package("openssl3")
             table.insert(configs, "--debug")
         end
 
+        local make_target = "install_sw"
+
+        if package:version():ge("3.6.0") then
+            -- this target avoids building tests/examples/docs in OpenSSL 3.6+
+            make_target = "install_dev"
+        end
+
+        if package:is_plat("macosx") then
+            if package:is_arch("arm64") then
+                table.insert(configs, "darwin64-arm64")
+            elseif package:is_arch("x86_64") then
+                table.insert(configs, "darwin64-x86_64")
+            end
+        end
+
         if package:config("md2") then
             table.insert(configs, "enable-md2")
         end
@@ -182,7 +198,7 @@ package("openssl3")
         os.vrunv("./config", configs, {envs = buildenvs})
         local makeconfigs = {CFLAGS = buildenvs.CFLAGS, ASFLAGS = buildenvs.ASFLAGS}
         import("package.tools.make").build(package, makeconfigs)
-        import("package.tools.make").make(package, {"install_sw"})
+        import("package.tools.make").make(package, {make_target})
         if package:config("shared") then
             os.tryrm(path.join(package:installdir("lib"), "*.a"), path.join(package:installdir("lib64"), "*.a"))
         end
diff --git a/repo/packages/s/sentry-native/xmake.lua b/repo/packages/s/sentry-native/xmake.lua
index 856318b41..7024a174d 100644
--- a/repo/packages/s/sentry-native/xmake.lua
+++ b/repo/packages/s/sentry-native/xmake.lua
@@ -48,7 +48,8 @@ package("sentry-native")
     elseif is_plat("android") then
         add_syslinks("dl", "log")
     elseif is_plat("macosx") then
-        add_deps("libcurl", {system = false, configs = {mbedtls = true}})
+        add_deps("libcurl", {system = false, configs = {openssl3 = true}})
+        --add_deps("libcurl", {system = false, configs = {mbedtls = true}})
         add_frameworks("CoreText", "CoreGraphics", "SystemConfiguration", "CoreFoundation", "Foundation")
         add_syslinks("bsm")
     end
diff --git a/scripts/bundle.lua b/scripts/bundle.lua
index 6e2994742..7f7828b41 100644
--- a/scripts/bundle.lua
+++ b/scripts/bundle.lua
@@ -193,8 +193,8 @@ end
 --------------------------------------------------------------------------------
 local function main_mac(signidentity)
     -- Build and universalify
-    _build("x86_64", false, "--target_minver=12.5")
     _build("arm64", false, "--target_minver=12.5")
+    _build("x86_64", false, "--target_minver=12.5")
 
     os.mkdir("build/macosx/universal/release/")
 	local ret = _exec(
diff --git a/xmake.lua b/xmake.lua
index 4c19a1b03..0e6f122b6 100644
--- a/xmake.lua
+++ b/xmake.lua
@@ -77,15 +77,10 @@ if is_plat("windows") then
     -- we use schannel on Windows
     add_defines("ZEN_USE_OPENSSL=0")
     add_requires("libcurl", {system = false})
-elseif is_plat("linux") then
+elseif is_plat("linux", "macosx") then
     add_requires("openssl3", {system = false})
     add_defines("ZEN_USE_OPENSSL=1")
     add_requires("libcurl", {system = false, configs = {openssl3 = true}})
-elseif is_plat("macosx") then
-    add_requires("mbedtls", {system = false})
-    add_defines("ZEN_USE_OPENSSL=0")
-    add_defines("ZEN_USE_MBEDTLS=1")
-    add_requires("libcurl", {system = false, configs = {mbedtls = true}})
 end
 
 --------------------------------------------------------------------------
@@ -124,7 +119,8 @@ if is_mode("release") then
     -- It's currently also temporarily disabled on Windows to investigate 
     -- build issues due to git apply not applying the necessary patches correctly
     -- in CI for some reason.
-    if not is_plat("linux", "windows") then
+    -- Also, disabled LTO on Mac to reduce time spent building openssl tests
+    if not is_plat("linux", "windows", "macosx") then
         set_policy("build.optimization.lto", true)
     end
     set_optimize("fastest")