www/serf: Fix build for OpenSSL 3

- Although this port perfectly builds fine with OpenSSL 3 however there
  are some routine calls which makes other ports dependent on this
  failing with errors. One such occurance is devel/py-subversion. This
  patch fixes this issue.
- Refresh patches
- Bump PORTREVISION as this needs to be rebuilt for 14

Approved by:	portmgr (blanket)
Sponsored by:	The FreeBSD Foundation

3 files changed, 129 insertions, 12 deletions

diff --git a/www/serf/Makefile b/www/serf/Makefile
index ab2b5c8414d7..fc67e4039df9 100644
--- a/www/serf/Makefile
+++ b/www/serf/Makefile
@@ -1,11 +1,11 @@
 PORTNAME=	serf
 PORTVERSION=	1.3.9
-PORTREVISION=	6
+PORTREVISION=	7
 CATEGORIES=	www
 MASTER_SITES=	APACHE/serf
 
-PATCHFILES=	py3-compat:-p1
 PATCH_SITES=	https://salsa.debian.org/jamessan/serf/-/raw/f6a5256b2de696c2527524d9b1a695ec5aaa17b0/debian/patches/
+PATCHFILES=	py3-compat:-p1
 
 MAINTAINER=	lev@FreeBSD.org
 COMMENT=	Serf HTTP client library
@@ -17,9 +17,11 @@ LICENSE_FILE=	${WRKSRC}/LICENSE
 LIB_DEPENDS+=	libapr-1.so:devel/apr1
 
 USES=		scons ssl tar:bzip2 cpe
+CPE_VENDOR=	serf_project
 USE_LDCONFIG=	yes
 
-CPE_VENDOR=	serf_project
+INSTALL_TARGET=	install --install-sandbox=${STAGEDIR}
+TEST_TARGET=	check  # some tests fail
 
 OPTIONS_DEFINE=		DOCS
 OPTIONS_RADIO=		KERBEROS
@@ -28,17 +30,15 @@ OPTIONS_RADIO_KERBEROS=	GSSAPI_BASE GSSAPI_HEIMDAL GSSAPI_MIT
 GSSAPI_BASE_DESC=		Heimdal Kerberos (base)
 GSSAPI_HEIMDAL_DESC=		Heimdal Kerberos (security/heimdal)
 GSSAPI_MIT_DESC=		MIT Kerberos (security/krb5)
+
 GSSAPI_HEIMDAL_LIB_DEPENDS=	libkrb5.so.26:security/heimdal
 GSSAPI_MIT_LIB_DEPENDS=		libkrb5.so.3:security/krb5
-
 SCONS_ARGS=	APR=${LOCALBASE}/bin/apr-1-config
 SCONS_ARGS+=	APU=${LOCALBASE}/bin/apu-1-config
 SCONS_ARGS+=	OPENSSL=${OPENSSLBASE}
 SCONS_ARGS+=	PREFIX=${PREFIX}
 SCONS_ARGS+=	CC=${CC}
 SCONS_ARGS+=	CFLAGS="${CFLAGS}"
-INSTALL_TARGET=	install --install-sandbox=${STAGEDIR}
-TEST_TARGET=	check  # some tests fail
 
 .include <bsd.port.options.mk>
 
diff --git a/www/serf/files/patch-SConstruct b/www/serf/files/patch-SConstruct
index 25cb7b7e51d1..4e355e282f7f 100644
--- a/www/serf/files/patch-SConstruct
+++ b/www/serf/files/patch-SConstruct
@@ -1,6 +1,6 @@
---- SConstruct.orig	2015-09-17 12:46:24 UTC
+--- SConstruct.orig	2023-08-18 19:57:03 UTC
 +++ SConstruct
-@@ -74,6 +74,9 @@ else:
+@@ -76,6 +76,9 @@ else:
  
  opts = Variables(files=[SAVED_CONFIG])
  opts.AddVariables(
@@ -10,7 +10,7 @@
    PathVariable('PREFIX',
                 'Directory to install under',
                 default_prefix,
-@@ -208,6 +211,7 @@ opts.Save(SAVED_CONFIG, env)
+@@ -210,6 +213,7 @@ opts.Save(SAVED_CONFIG, env)
  thisdir = os.getcwd()
  libdir = '$LIBDIR'
  incdir = '$PREFIX/include/serf-$MAJOR'
@@ -18,7 +18,7 @@
  
  # This version string is used in the dynamic library name, and for Mac OS X also
  # for the current_version and compatibility_version options in the .dylib
-@@ -364,8 +368,8 @@ else:
+@@ -366,8 +370,8 @@ else:
    ### there is probably a better way to run/capture output.
    ### env.ParseConfig() may be handy for getting this stuff into the build
    if CALLOUT_OKAY:
@@ -29,7 +29,7 @@
    else:
      apr_libs = ''
      apu_libs = ''
-@@ -406,6 +410,8 @@ pkgconfig = env.Textfile('serf-%d.pc' % 
+@@ -408,6 +412,8 @@ pkgconfig = env.Textfile('serf-%d.pc' % (MAJOR,),
  
  env.Default(lib_static, lib_shared, pkgconfig)
  
@@ -38,7 +38,7 @@
  if CALLOUT_OKAY:
    conf = Configure(env)
  
-@@ -437,7 +443,7 @@ if sys.platform == 'darwin':
+@@ -439,7 +445,7 @@ if sys.platform == 'darwin':
  env.Alias('install-lib', [install_static, install_shared,
                            ])
  env.Alias('install-inc', env.Install(incdir, HEADER_FILES))
diff --git a/www/serf/files/patch-buckets_ssl__buckets.c b/www/serf/files/patch-buckets_ssl__buckets.c
index b8bd6ad1c763..a8b76fb3e0ee 100644
--- a/www/serf/files/patch-buckets_ssl__buckets.c
+++ b/www/serf/files/patch-buckets_ssl__buckets.c
@@ -17,6 +17,86 @@
          break;
      case BIO_CTRL_PUSH:
      case BIO_CTRL_POP:
+@@ -555,7 +556,7 @@ get_subject_alt_names(apr_array_header_t **san_arr, X5
+         }
+         sk_GENERAL_NAME_pop_free(names, GENERAL_NAME_free);
+     }
+-    
++
+     return APR_SUCCESS;
+ }
+ 
+@@ -606,7 +607,7 @@ validate_server_certificate(int cert_valid, X509_STORE
+         err = X509_STORE_CTX_get_error(store_ctx);
+ 
+         switch(err) {
+-            case X509_V_ERR_CERT_NOT_YET_VALID: 
++            case X509_V_ERR_CERT_NOT_YET_VALID:
+                     failures |= SERF_SSL_CERT_NOTYETVALID;
+                     break;
+             case X509_V_ERR_CERT_HAS_EXPIRED:
+@@ -741,7 +742,7 @@ validate_server_certificate(int cert_valid, X509_STORE
+     {
+         ctx->pending_err = SERF_ERROR_SSL_CERT_FAILED;
+     }
+-        
++
+     return cert_valid;
+ }
+ 
+@@ -832,7 +833,7 @@ static apr_status_t ssl_decrypt(void *baton, apr_size_
+                 necessary mean the connection is closed, let's close
+                 it here anyway.
+                 We can optimize this later. */
+-                serf__log(SSL_VERBOSE, __FILE__, 
++                serf__log(SSL_VERBOSE, __FILE__,
+                           "ssl_decrypt: SSL read error: server"
+                           " shut down connection!\n");
+                 status = APR_EOF;
+@@ -842,14 +843,14 @@ static apr_status_t ssl_decrypt(void *baton, apr_size_
+             }
+         } else {
+             *len = ssl_len;
+-            serf__log(SSL_MSG_VERBOSE, __FILE__, 
++            serf__log(SSL_MSG_VERBOSE, __FILE__,
+                       "---\n%.*s\n-(%d)-\n", *len, buf, *len);
+         }
+     }
+     else {
+         *len = 0;
+     }
+-    serf__log(SSL_VERBOSE, __FILE__, 
++    serf__log(SSL_VERBOSE, __FILE__,
+               "ssl_decrypt: %d %d %d\n", status, *len,
+               BIO_get_retry_flags(ctx->bio));
+ 
+@@ -956,7 +957,7 @@ static apr_status_t ssl_encrypt(void *baton, apr_size_
+ 
+                 ssl_len = SSL_write(ctx->ssl, vecs_data, interim_len);
+ 
+-                serf__log(SSL_VERBOSE, __FILE__, 
++                serf__log(SSL_VERBOSE, __FILE__,
+                           "ssl_encrypt: SSL write: %d\n", ssl_len);
+ 
+                 /* If we failed to write... */
+@@ -975,7 +976,7 @@ static apr_status_t ssl_encrypt(void *baton, apr_size_
+ 
+                     ssl_err = SSL_get_error(ctx->ssl, ssl_len);
+ 
+-                    serf__log(SSL_VERBOSE, __FILE__, 
++                    serf__log(SSL_VERBOSE, __FILE__,
+                               "ssl_encrypt: SSL write error: %d\n", ssl_err);
+ 
+                     if (ssl_err == SSL_ERROR_SYSCALL) {
+@@ -997,7 +998,7 @@ static apr_status_t ssl_encrypt(void *baton, apr_size_
+                         }
+                     }
+ 
+-                    serf__log(SSL_VERBOSE, __FILE__, 
++                    serf__log(SSL_VERBOSE, __FILE__,
+                               "ssl_encrypt: SSL write error: %d %d\n",
+                               status, *len);
+                 } else {
 @@ -1156,7 +1157,7 @@ static void init_ssl_libraries(void)
          }
  #endif
@@ -26,3 +106,40 @@
          OPENSSL_malloc_init();
  #else
          CRYPTO_malloc_init();
+@@ -1196,10 +1197,10 @@ static void init_ssl_libraries(void)
+            thread has completed */
+         while (val != INIT_DONE) {
+             apr_sleep(APR_USEC_PER_SEC / 1000);
+-      
++
+             val = apr_atomic_cas32(&have_init_ssl,
+                                    INIT_UNINITIALIZED,
+-                                   INIT_UNINITIALIZED);            
++                                   INIT_UNINITIALIZED);
+         }
+     }
+ }
+@@ -1325,9 +1326,14 @@ static int ssl_need_client_cert(SSL *ssl, X509 **cert,
+                 return 0;
+             }
+             else {
++#if defined(OPENSSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER < 0x30000000L
+                 printf("OpenSSL cert error: %d %d %d\n", ERR_GET_LIB(err),
+                        ERR_GET_FUNC(err),
+                        ERR_GET_REASON(err));
++#else
++                printf("OpenSSL cert error: %d %d\n", ERR_GET_LIB(err),
++                       ERR_GET_REASON(err));
++#endif
+                 PKCS12_free(p12);
+                 bio_meth_free(biom);
+             }
+@@ -1850,7 +1856,7 @@ const char *serf_ssl_cert_export(
+ 
+     encoded_cert = apr_palloc(pool, apr_base64_encode_len(len));
+     apr_base64_encode(encoded_cert, binary_cert, len);
+-    
++
+     return encoded_cert;
+ }
+