[cmake] Allow building OpenSSL from source (#4032)

If YUZU_USE_BUNDLED_OPENSSL is off and OpenSSL is *not* installed to the
system, pulls in OpenSSL and Jimmy Park's CMake wrapper, then configures + builds from source.

Some patches were made on top of OpenSSL and openssl-cmake:
- USE_CCACHE is respected from UseCcache.cmake
- CXX/CFLAGS are passed from CMake to the configure script, which sends
  those to the compiler
- Uses a bundled cert.h akin to the bundled OpenSSL build

Closes #3614

~~Before merge: remove verbose stuff~~ actually useful so nvm

Signed-off-by: crueter <crueter@eden-emu.dev>
Reviewed-on: https://git.eden-emu.dev/eden-emu/eden/pulls/4032
Reviewed-by: MaranBr <maranbr@eden-emu.dev>
Reviewed-by: Lizzie <lizzie@eden-emu.dev>

3 files changed, 296 insertions, 0 deletions

diff --git a/.patch/openssl-cmake/0001-cpmutil-compat.patch b/.patch/openssl-cmake/0001-cpmutil-compat.patch
new file mode 100644
index 0000000000..41f51f4940
--- /dev/null
+++ b/.patch/openssl-cmake/0001-cpmutil-compat.patch
@@ -0,0 +1,214 @@
+From ec4c1fdf526cb9ad045abf59b29ee495bbf5023a Mon Sep 17 00:00:00 2001
+From: crueter <crueter@eden-emu.dev>
+Date: Sat, 30 May 2026 20:56:35 -0400
+Subject: [PATCH] cpmutil compat
+
+---
+ CMakeLists.txt           | 31 ++++++++-----------
+ cmake/FetchOpenSSL.cmake | 64 ----------------------------------------
+ cmake/GetCPM.cmake       |  5 ----
+ 3 files changed, 13 insertions(+), 87 deletions(-)
+ delete mode 100644 cmake/FetchOpenSSL.cmake
+ delete mode 100644 cmake/GetCPM.cmake
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 5420ecc..9ffd5a0 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -19,9 +19,7 @@ include(FetchContent)
+ include(ProcessorCount)
+ include(cmake/ConfigureOpenSSL.cmake)
+ include(cmake/DetectTargetPlatform.cmake)
+-include(cmake/FetchOpenSSL.cmake)
+ include(cmake/FindVcvarsall.cmake)
+-include(cmake/GetCPM.cmake)
+ 
+ # Custom options
+ option(OPENSSL_BUILD_VERBOSE "Enable verbose output from build" OFF)
+@@ -47,9 +45,6 @@ if("${OPENSSL_TARGET_PLATFORM}" STREQUAL "")
+     detect_target_platform(OPENSSL_TARGET_PLATFORM)
+ endif()
+ 
+-# Fetch OpenSSL source
+-fetch_openssl()
+-
+ # Apply patches
+ foreach(patch IN LISTS OPENSSL_PATCH)
+     if(EXISTS "${patch}" AND NOT IS_DIRECTORY "${patch}")
+@@ -59,13 +54,13 @@ foreach(patch IN LISTS OPENSSL_PATCH)
+ 
+         execute_process(
+             COMMAND git init
+-            WORKING_DIRECTORY ${openssl_SOURCE_DIR}
++            WORKING_DIRECTORY ${OpenSSL_SOURCE_DIR}
+             OUTPUT_QUIET
+             ERROR_QUIET
+         )
+         execute_process(
+             COMMAND git apply ${patch}
+-            WORKING_DIRECTORY ${openssl_SOURCE_DIR}
++            WORKING_DIRECTORY ${OpenSSL_SOURCE_DIR}
+             OUTPUT_QUIET
+             ERROR_QUIET
+         )
+@@ -161,8 +156,8 @@ list(PREPEND OPENSSL_CONFIGURE_OPTIONS ${OPENSSL_TARGET_PLATFORM})
+ # Configure OpenSSL
+ configure_openssl(
+     COMMAND ${VCVARSALL_COMMAND}
+-    FILE ${openssl_SOURCE_DIR}/Configure
+-    BUILD_DIR ${openssl_BINARY_DIR}
++    FILE ${OpenSSL_SOURCE_DIR}/Configure
++    BUILD_DIR ${OpenSSL_BINARY_DIR}
+     OPTIONS ${OPENSSL_CONFIGURE_OPTIONS}
+ )
+ 
+@@ -203,8 +198,8 @@ endif()
+ # Parse Makefile
+ parse_makefile(${OPENSSL_MAKEFILE} "INSTALL_LIBS" OPENSSL_STATIC_LIBS)
+ parse_makefile(${OPENSSL_MAKEFILE} "INSTALL_SHLIBS" OPENSSL_SHARED_LIBS)
+-list(TRANSFORM OPENSSL_STATIC_LIBS PREPEND "${openssl_BINARY_DIR}/")
+-list(TRANSFORM OPENSSL_SHARED_LIBS PREPEND "${openssl_BINARY_DIR}/")
++list(TRANSFORM OPENSSL_STATIC_LIBS PREPEND "${OpenSSL_BINARY_DIR}/")
++list(TRANSFORM OPENSSL_SHARED_LIBS PREPEND "${OpenSSL_BINARY_DIR}/")
+ 
+ foreach(LIBRARY IN LISTS OPENSSL_STATIC_LIBS)
+     if(LIBRARY MATCHES "crypto")
+@@ -239,14 +234,14 @@ endif()
+ 
+ # Provide same targets and variables as FindOpenSSL module
+ set(OPENSSL_FOUND ON CACHE BOOL "Override FindOpenSSL variables" FORCE)
+-set(OPENSSL_INCLUDE_DIR ${openssl_SOURCE_DIR}/include ${openssl_BINARY_DIR}/include CACHE STRING "Override FindOpenSSL variables" FORCE)
++set(OPENSSL_INCLUDE_DIR ${OpenSSL_SOURCE_DIR}/include ${OpenSSL_BINARY_DIR}/include CACHE STRING "Override FindOpenSSL variables" FORCE)
+ set(OPENSSL_CRYPTO_LIBRARY ${OPENSSL_${OPENSSL_LIBRARY_TYPE}_CRYPTO_LIBRARY} CACHE STRING "Override FindOpenSSL variables" FORCE)
+ set(OPENSSL_CRYPTO_LIBRARIES ${OPENSSL_CRYPTO_LIBRARY} ${OPENSSL_DEPENDENCIES} CACHE STRING "Override FindOpenSSL variables" FORCE)
+ set(OPENSSL_SSL_LIBRARY ${OPENSSL_${OPENSSL_LIBRARY_TYPE}_SSL_LIBRARY} CACHE STRING "Override FindOpenSSL variables" FORCE)
+ set(OPENSSL_SSL_LIBRARIES ${OPENSSL_SSL_LIBRARY} ${OPENSSL_DEPENDENCIES} CACHE STRING "Override FindOpenSSL variables" FORCE)
+ set(OPENSSL_LIBRARIES ${OPENSSL_CRYPTO_LIBRARY} ${OPENSSL_SSL_LIBRARY} ${OPENSSL_DEPENDENCIES} CACHE STRING "Override FindOpenSSL variables" FORCE)
+ set(OPENSSL_VERSION ${OPENSSL_CONFIGURED_VERSION} CACHE STRING "Override FindOpenSSL variables" FORCE)
+-set(OPENSSL_APPLINK_SOURCE ${openssl_SOURCE_DIR}/ms/applink.c CACHE STRING "Override FindOpenSSL variables" FORCE)
++set(OPENSSL_APPLINK_SOURCE ${OpenSSL_SOURCE_DIR}/ms/applink.c CACHE STRING "Override FindOpenSSL variables" FORCE)
+ 
+ add_library(OpenSSL::Crypto ${OPENSSL_LIBRARY_TYPE} IMPORTED GLOBAL)
+ add_library(OpenSSL::SSL ${OPENSSL_LIBRARY_TYPE} IMPORTED GLOBAL)
+@@ -308,8 +303,8 @@ if(ANDROID)
+ endif()
+ 
+ file(GLOB_RECURSE OPENSSL_SOURCES
+-    ${openssl_SOURCE_DIR}/*.[ch]
+-    ${openssl_SOURCE_DIR}/*.[ch].in
++    ${OpenSSL_SOURCE_DIR}/*.[ch]
++    ${OpenSSL_SOURCE_DIR}/*.[ch].in
+ )
+ 
+ set(OPENSSL_BUILD_OUTPUT
+@@ -322,7 +317,7 @@ add_custom_command(
+     OUTPUT ${OPENSSL_BUILD_OUTPUT}
+     COMMAND ${OPENSSL_BUILD_COMMAND}
+     DEPENDS ${OPENSSL_SOURCES}
+-    WORKING_DIRECTORY ${openssl_BINARY_DIR}
++    WORKING_DIRECTORY ${OpenSSL_BINARY_DIR}
+     VERBATIM
+ )
+ 
+@@ -341,7 +336,7 @@ if(OPENSSL_TEST AND NOT CMAKE_CROSSCOMPILING)
+     add_test(
+         NAME openssl-test
+         COMMAND ${OPENSSL_BUILD_TOOL} test VERBOSE_FAILURE=yes HARNESS_JOBS=${NUMBER_OF_THREADS}
+-        WORKING_DIRECTORY ${openssl_BINARY_DIR}
++        WORKING_DIRECTORY ${OpenSSL_BINARY_DIR}
+     )
+ endif()
+ 
+@@ -356,7 +351,7 @@ if(OPENSSL_INSTALL)
+     install(CODE
+         "execute_process(
+             COMMAND ${OPENSSL_INSTALL_COMMAND}
+-            WORKING_DIRECTORY \"${openssl_BINARY_DIR}\"
++            WORKING_DIRECTORY \"${OpenSSL_BINARY_DIR}\"
+         )"
+     )
+ endif()
+diff --git a/cmake/FetchOpenSSL.cmake b/cmake/FetchOpenSSL.cmake
+deleted file mode 100644
+index a43505d..0000000
+--- a/cmake/FetchOpenSSL.cmake
++++ /dev/null
+@@ -1,64 +0,0 @@
+-function(fetch_openssl)
+-    if(EXISTS "${OPENSSL_SOURCE}" AND IS_DIRECTORY "${OPENSSL_SOURCE}")
+-        # Fetch the local OpenSSL source
+-        if(NOT IS_ABSOLUTE "${OPENSSL_SOURCE}")
+-            string(PREPEND OPENSSL_SOURCE ${CMAKE_SOURCE_DIR}/)
+-        endif()
+-
+-        string(REPLACE "\\" "/" openssl-source_SOURCE_DIR "${OPENSSL_SOURCE}")
+-        set(openssl-source_BINARY_DIR ${CMAKE_CURRENT_BINARY_DIR}/openssl-source-build)
+-    else()
+-        set(CPM_OPTIONS
+-            NAME openssl-source
+-            DOWNLOAD_ONLY ON
+-        )
+-
+-        if(NOT OPENSSL_CONFIGURE_VERBOSE)
+-            list(APPEND CPM_OPTIONS QUIET)
+-        endif()
+-
+-        if("${OPENSSL_SOURCE}" MATCHES "^http")
+-            # Download OpenSSL source from the internet
+-            list(APPEND CPM_OPTIONS URL ${OPENSSL_SOURCE})
+-        else()
+-            # Download OpenSSL source from the official website
+-            if("${OPENSSL_TARGET_VERSION}" STREQUAL "")
+-                set(OPENSSL_TARGET_VERSION ${PROJECT_VERSION})
+-            endif()
+-
+-            if(OPENSSL_TARGET_VERSION VERSION_EQUAL PROJECT_VERSION)
+-                list(APPEND CPM_OPTIONS URL_HASH SHA256=aaf51a1fe064384f811daeaeb4ec4dce7340ec8bd893027eee676af31e83a04f)
+-            endif()
+-
+-            if(OPENSSL_TARGET_VERSION MATCHES "^1\.1\.1[a-w]$")
+-                string(REPLACE "." "_" OPENSSL_TAGGED_VERSION ${OPENSSL_TARGET_VERSION})
+-                list(APPEND CPM_OPTIONS URL https://github.com/openssl/openssl/releases/download/OpenSSL_${OPENSSL_TAGGED_VERSION}/openssl-${OPENSSL_TARGET_VERSION}.tar.gz)
+-            else()
+-                list(APPEND CPM_OPTIONS URL https://github.com/openssl/openssl/releases/download/openssl-${OPENSSL_TARGET_VERSION}/openssl-${OPENSSL_TARGET_VERSION}.tar.gz)
+-            endif()
+-        endif()
+-
+-        CPMAddPackage(${CPM_OPTIONS})
+-    endif()
+-
+-    # Clean build directory if source directory has changed
+-    if(DEFINED CACHE{openssl-source_SOURCE_DIR_OLD} AND NOT openssl-source_SOURCE_DIR STREQUAL openssl-source_SOURCE_DIR_OLD)
+-        set(openssl-source_SOURCE_DIR_OLD ${openssl-source_SOURCE_DIR} CACHE INTERNAL "Previously fetched OpenSSL source")
+-
+-        if(IS_DIRECTORY ${openssl-source_BINARY_DIR})
+-            file(REMOVE_RECURSE ${openssl-source_BINARY_DIR})
+-            file(MAKE_DIRECTORY ${openssl-source_BINARY_DIR})
+-        endif()
+-    endif()
+-
+-    # Override the FindOpenSSL module
+-    FetchContent_Declare(
+-        OpenSSL
+-        SOURCE_DIR ${openssl-source_SOURCE_DIR}
+-        BINARY_DIR ${openssl-source_BINARY_DIR}
+-        OVERRIDE_FIND_PACKAGE
+-    )
+-    FetchContent_MakeAvailable(OpenSSL)
+-
+-    return(PROPAGATE openssl_SOURCE_DIR openssl_BINARY_DIR)
+-endfunction()
+diff --git a/cmake/GetCPM.cmake b/cmake/GetCPM.cmake
+deleted file mode 100644
+index bfc50f5..0000000
+--- a/cmake/GetCPM.cmake
++++ /dev/null
+@@ -1,5 +0,0 @@
+-file(
+-    DOWNLOAD https://github.com/cpm-cmake/CPM.cmake/releases/latest/download/get_cpm.cmake
+-    ${CMAKE_CURRENT_BINARY_DIR}/get_cpm.cmake
+-)
+-include(${CMAKE_CURRENT_BINARY_DIR}/get_cpm.cmake)
+-- 
+2.54.0
+
diff --git a/.patch/openssl-cmake/0002-use-ccache.patch b/.patch/openssl-cmake/0002-use-ccache.patch
new file mode 100644
index 0000000000..a753d4b6f1
--- /dev/null
+++ b/.patch/openssl-cmake/0002-use-ccache.patch
@@ -0,0 +1,54 @@
+From d46675fbb61eb6d51e478023ce4075e545ad4cfd Mon Sep 17 00:00:00 2001
+From: crueter <crueter@eden-emu.dev>
+Date: Sat, 30 May 2026 21:11:55 -0400
+Subject: [PATCH] use ccache
+
+---
+ CMakeLists.txt               |  1 -
+ cmake/ConfigureOpenSSL.cmake | 12 +++---------
+ 2 files changed, 3 insertions(+), 10 deletions(-)
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 9ffd5a0..9ff14c8 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -28,7 +28,6 @@ option(OPENSSL_ENABLE_PARALLEL "Build and test in parallel if possible" ON)
+ option(OPENSSL_INSTALL "Install OpenSSL components to the <prefix> directory" OFF)
+ option(OPENSSL_INSTALL_CERT "Install cert.pem to the <openssldir> directory" OFF)
+ option(OPENSSL_TEST "Enable testing and build OpenSSL self tests" OFF)
+-option(OPENSSL_USE_CCACHE "Use ccache if available" ON)
+ 
+ if("${OPENSSL_BUILD_TARGET}" STREQUAL "")
+     # Makefile target for build
+diff --git a/cmake/ConfigureOpenSSL.cmake b/cmake/ConfigureOpenSSL.cmake
+index 211c18b..3d8cbed 100644
+--- a/cmake/ConfigureOpenSSL.cmake
++++ b/cmake/ConfigureOpenSSL.cmake
+@@ -69,15 +69,9 @@ function(apply_ccache FILE)
+         message(FATAL_ERROR "Couldn't find Makefile")
+     endif()
+ 
+-    if(OPENSSL_USE_CCACHE)
+-        find_program(CCACHE ccache)
+-
+-        if(NOT CCACHE)
+-            return()
+-        endif()
+-
++    if(USE_CCACHE)
+         file(READ ${FILE} MAKEFILE)
+-        string(REPLACE "\nCC=" "\nCC=ccache " MAKEFILE "${MAKEFILE}")
++        string(REPLACE "\nCC=" "\nCC=${CCACHE_BINARY} " MAKEFILE "${MAKEFILE}")
+ 
+         if(MSVC)
+             string(REPLACE "/Zi /Fdossl_static.pdb " "" MAKEFILE "${MAKEFILE}")
+@@ -171,4 +165,4 @@ function(configure_openssl)
+         string(REPLACE "/W3" "/W0" MAKEFILE "${MAKEFILE}")
+         file(WRITE ${OPENSSL_MAKEFILE} "${MAKEFILE}")
+     endif()
+-endfunction()
+\ No newline at end of file
++endfunction()
+-- 
+2.54.0
+
diff --git a/.patch/openssl-cmake/0003-use-cmake-compiler-flags.patch b/.patch/openssl-cmake/0003-use-cmake-compiler-flags.patch
new file mode 100644
index 0000000000..bbfa963743
--- /dev/null
+++ b/.patch/openssl-cmake/0003-use-cmake-compiler-flags.patch
@@ -0,0 +1,28 @@
+From 4a3cc92a7abad403529ed1cb4255ca63d9252de4 Mon Sep 17 00:00:00 2001
+From: crueter <crueter@eden-emu.dev>
+Date: Sat, 30 May 2026 21:48:42 -0400
+Subject: [PATCH 2/2] use cmake compiler flags
+
+---
+ cmake/ConfigureOpenSSL.cmake | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/cmake/ConfigureOpenSSL.cmake b/cmake/ConfigureOpenSSL.cmake
+index 3d8cbed..3012e05 100644
+--- a/cmake/ConfigureOpenSSL.cmake
++++ b/cmake/ConfigureOpenSSL.cmake
+@@ -135,7 +135,10 @@ function(configure_openssl)
+     endif()
+ 
+     execute_process(
+-        COMMAND ${CONFIGURE_COMMAND}
++        COMMAND ${CMAKE_COMMAND} -E env
++            "CFLAGS=${CMAKE_C_FLAGS}"
++            "CXXFLAGS=${CMAKE_CXX_FLAGS}"
++            ${CONFIGURE_COMMAND}
+         WORKING_DIRECTORY ${CONFIGURE_BUILD_DIR}
+         ${VERBOSE_OPTION}
+         COMMAND_ERROR_IS_FATAL ANY
+-- 
+2.54.0
+