From 9c2757ad8383ca5534aa347828ba1e530f531b80 Mon Sep 17 00:00:00 2001
From: Thomas Waldmann <tw@waldmann-edv.de>
Date: Thu, 14 Apr 2022 12:14:15 +0200
Subject: [PATCH] use openssl on openbsd, fixes #6474

---
 Vagrantfile           | 1 +
 docs/installation.rst | 2 +-
 setup.py              | 9 ++++++++-
 3 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/Vagrantfile b/Vagrantfile
index eea43d8c2dd..359ae6d6290 100644
--- a/Vagrantfile
+++ b/Vagrantfile
@@ -78,6 +78,7 @@ def packages_openbsd
     pkg_add lz4
     pkg_add zstd
     pkg_add git  # no fakeroot
+    pkg_add openssl%1.1
     pkg_add py3-pip
     pkg_add py3-virtualenv
   EOF
diff --git a/docs/installation.rst b/docs/installation.rst
index 2d01e7a8798..6c778d7831b 100644
--- a/docs/installation.rst
+++ b/docs/installation.rst
@@ -162,7 +162,7 @@ following dependencies first:
 * `Python 3`_ >= 3.9.0, plus development headers.
 * Libraries (library plus development headers):
 
-  - OpenSSL_ >= 1.1.1
+  - OpenSSL_ >= 1.1.1 (LibreSSL will not work)
   - libacl_ (which depends on libattr_)
   - liblz4_ >= 1.7.0 (r129)
   - libzstd_ >= 1.3.0
diff --git a/setup.py b/setup.py
index 9b1e884fd58..301370bb315 100644
--- a/setup.py
+++ b/setup.py
@@ -23,6 +23,7 @@
 import setup_docs
 
 is_win32 = sys.platform.startswith('win32')
+is_openbsd = sys.platform.startswith('openbsd')
 
 # Number of threads to use for cythonize, not used on windows
 cpu_threads = multiprocessing.cpu_count() if multiprocessing and multiprocessing.get_start_method() != 'spawn' else None
@@ -156,9 +157,15 @@ def lib_ext_kwargs(pc, prefix_env_var, lib_name, lib_pkg_name, pc_version, lib_s
             f"or ensure {lib_pkg_name}.pc is in PKG_CONFIG_PATH."
         )
 
+    crypto_cflags = list(cflags)  # copy the default cflags
     if is_win32:
         crypto_ext_lib = lib_ext_kwargs(
             pc, 'BORG_OPENSSL_PREFIX', 'libcrypto', 'libcrypto', '>=1.1.1', lib_subdir='')
+    elif is_openbsd:
+        # use openssl (not libressl) because we need AES-OCB and CHACHA20-POLY1305 via EVP api
+        crypto_ext_lib = lib_ext_kwargs(
+            pc, 'BORG_OPENSSL_PREFIX', 'crypto', 'libecrypto11', '>=1.1.1')
+        crypto_cflags += ['-Wl,-rpath,/usr/local/lib/eopenssl11']
     else:
         crypto_ext_lib = lib_ext_kwargs(
             pc, 'BORG_OPENSSL_PREFIX', 'crypto', 'libcrypto', '>=1.1.1')
@@ -166,7 +173,7 @@ def lib_ext_kwargs(pc, prefix_env_var, lib_name, lib_pkg_name, pc_version, lib_s
     crypto_ext_kwargs = members_appended(
         dict(sources=[crypto_ll_source, crypto_helpers]),
         crypto_ext_lib,
-        dict(extra_compile_args=cflags),
+        dict(extra_compile_args=crypto_cflags),
     )
 
     compress_ext_kwargs = members_appended(