nexedi / slapos

Because there's no way anymore to pass the install prefix via an environment
variable, a new `make-install-extra` option (empty by default) is added so
that `make install` command line can be extended with `DESTDIR=...`.

/reviewed-on !524

openssl 1.1.1 has unresloved incompatibilities with python2.7
(https://bugs.python.org/issue32947), where 1.1.0 seems to work
(https://bugs.python.org/issue26470)

Also disable parallel make.

/reviewed-on !459

…ad make OpenSSH uses OpenSSL 1.0.

This reverts commit 6ca7789a.

…nSSL 1.1 (FTBFS on erp5testnode).

This reverts commit 14d98aee.

Keep old version in openssl-1.0 for not yet compatible software.

  This is required when prefix/location is customize during the package generation

aspell-en-dictionary, groonga-normalizer-mysql, file-msooxml, apache-antiloris are not shareable, they write files in other parts.

…CVE-2016-0797, CVE-2016-0799, and CVE-2016-0702.

In slapos.package.git/obs, we need to build binaries for specific paths,
without changing where buildout actually install them.

…95 and CVE-2015-3196.

https://www.openssl.org/news/secadv/20151203.txt

There is a story for OpenSSL build to be broken for `make -j`. Gentoo-
and various other people proposed fixes, at least from 2008, but for
some reasons (patch does not work with BSD make, upstream forgot to
apply, etc) they are not applied to main codebase.

What we can do is to "cherry-pick" the patch from Gentoo to speed-up
OpenSSL build. On a typical 8-cores i7 node, with the following test
buildout:

    [buildout]
    extends =
      slapos/stack/slapos.cfg
      slapos/component/openssl/buildout.cfg

after full build

                    time (rm -rf parts/openssl && ./bin/buildout install openssl)

    MAKEFLAGS=-j1   1m48s
    MAKEFLAGS=-j8   0m53s

and the timing does not subtract time to e.g. download the package from
network, so the building speedup itself is even more.

/cc @kazuhiko

We'll soon need to apply/ship external patches for openssl with us, and
external patches and patches in general usually go in -p1 format.

Since patch-options is "global" - i.e. it affects all patches for
slapos.recipe.cmmi, this change is needed for us to keep
downloaded-from-somewhere patches as unmodified as possible.

/cc @kazuhiko

zc.buildout >= 1.6.0-dev-SlapOS-013 automatically rebuilds parts whose referring parts are modified.