From ac2cb10d3fb31f347a1c9de732eca3ebbf7287ff Mon Sep 17 00:00:00 2001
From: Tony Theodore <tonyt@logyst.com>
Date: Sat, 3 Mar 2018 17:08:26 +1100
Subject: dcmtk vmime: add example of enabling openssl v1.0.x support

---
 plugins/examples/openssl1.0/openssl-1-fixes.patch | 593 ++++++++++++++++++++++
 plugins/examples/openssl1.0/openssl.mk            |  49 ++
 plugins/examples/openssl1.0/openssl1.0-overlay.mk |   9 +
 src/dcmtk.mk                                      |   4 +-
 src/openssl.mk                                    |   6 +
 src/vmime.mk                                      |   6 +-
 6 files changed, 665 insertions(+), 2 deletions(-)
 create mode 100644 plugins/examples/openssl1.0/openssl-1-fixes.patch
 create mode 100644 plugins/examples/openssl1.0/openssl.mk
 create mode 100644 plugins/examples/openssl1.0/openssl1.0-overlay.mk

diff --git a/plugins/examples/openssl1.0/openssl-1-fixes.patch b/plugins/examples/openssl1.0/openssl-1-fixes.patch
new file mode 100644
index 0000000..132f1b4
--- /dev/null
+++ b/plugins/examples/openssl1.0/openssl-1-fixes.patch
@@ -0,0 +1,593 @@
+This file is part of MXE. See LICENSE.md for licensing information.
+
+Contains ad hoc patches for cross building.
+
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Mark Brand <mabrand@mabrand.nl>
+Date: Wed, 8 Jan 2014 02:19:10 +0100
+Subject: [PATCH 1/2] winsock2
+
+-This patch has been taken from:
+-http://rt.openssl.org/Ticket/Display.html?id=2285&user=guest&pass=guest
+
+diff --git a/ssl/dtls1.h b/ssl/dtls1.h
+index 1111111..2222222 100644
+--- a/ssl/dtls1.h
++++ b/ssl/dtls1.h
+@@ -68,7 +68,7 @@
+ # endif
+ # ifdef OPENSSL_SYS_WIN32
+ /* Needed for struct timeval */
+-#  include <winsock.h>
++#  include <winsock2.h>
+ # elif defined(OPENSSL_SYS_NETWARE) && !defined(_WINSOCK2API_)
+ #  include <sys/timeval.h>
+ # else
+diff --git a/ssl/ssltest.c b/ssl/ssltest.c
+index 1111111..2222222 100644
+--- a/ssl/ssltest.c
++++ b/ssl/ssltest.c
+@@ -198,7 +198,7 @@
+ #define _XOPEN_SOURCE_EXTENDED  1
+ 
+ #ifdef OPENSSL_SYS_WINDOWS
+-# include <winsock.h>
++# include <winsock2.h>
+ #else
+ # include OPENSSL_UNISTD
+ #endif
+
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Tom Molesworth <tom@entitymodel.com>
+Date: Wed, 8 Jan 2014 02:20:21 +0100
+Subject: [PATCH 2/2] Patch OpenSSL POD docs for perl-5.16+
+
+Stricter validation in recent Perl versions means the install
+stage fails without these applied.
+
+Should be harmless for earlier versions of perl.
+
+diff --git a/doc/apps/cms.pod b/doc/apps/cms.pod
+index 1111111..2222222 100644
+--- a/doc/apps/cms.pod
++++ b/doc/apps/cms.pod
+@@ -483,28 +483,28 @@ with caution. For a fuller description see L<CMS_decrypt(3)|CMS_decrypt(3)>).
+ 
+ =over 4
+ 
+-=item Z<>0
++=item * Z<>0
+ 
+ the operation was completely successfully.
+ 
+-=item Z<>1
++=item * Z<>1
+ 
+ an error occurred parsing the command options.
+ 
+-=item Z<>2
++=item * Z<>2
+ 
+ one of the input files could not be read.
+ 
+-=item Z<>3
++=item * Z<>3
+ 
+ an error occurred creating the CMS file or when reading the MIME
+ message.
+ 
+-=item Z<>4
++=item * Z<>4
+ 
+ an error occurred decrypting or verifying the message.
+ 
+-=item Z<>5
++=item * Z<>5
+ 
+ the message was verified correctly but an error occurred writing out
+ the signers certificates.
+diff --git a/doc/apps/smime.pod b/doc/apps/smime.pod
+index 1111111..2222222 100644
+--- a/doc/apps/smime.pod
++++ b/doc/apps/smime.pod
+@@ -313,28 +313,28 @@ remains DER.
+ 
+ =over 4
+ 
+-=item Z<>0
++=item * Z<>0
+ 
+ the operation was completely successfully.
+ 
+-=item Z<>1
++=item * Z<>1
+ 
+ an error occurred parsing the command options.
+ 
+-=item Z<>2
++=item * Z<>2
+ 
+ one of the input files could not be read.
+ 
+-=item Z<>3
++=item * Z<>3
+ 
+ an error occurred creating the PKCS#7 file or when reading the MIME
+ message.
+ 
+-=item Z<>4
++=item * Z<>4
+ 
+ an error occurred decrypting or verifying the message.
+ 
+-=item Z<>5
++=item * Z<>5
+ 
+ the message was verified correctly but an error occurred writing out
+ the signers certificates.
+diff --git a/doc/crypto/rand.pod b/doc/crypto/rand.pod
+index 1111111..2222222 100644
+--- a/doc/crypto/rand.pod
++++ b/doc/crypto/rand.pod
+@@ -74,16 +74,16 @@ First up I will state the things I believe I need for a good RNG.
+ 
+ =over 4
+ 
+-=item 1
++=item * 1
+ 
+ A good hashing algorithm to mix things up and to convert the RNG 'state'
+ to random numbers.
+ 
+-=item 2
++=item * 2
+ 
+ An initial source of random 'state'.
+ 
+-=item 3
++=item * 3
+ 
+ The state should be very large.  If the RNG is being used to generate
+ 4096 bit RSA keys, 2 2048 bit random strings are required (at a minimum).
+@@ -93,13 +93,13 @@ carried away on this last point but it does indicate that it may not be
+ a bad idea to keep quite a lot of RNG state.  It should be easier to
+ break a cipher than guess the RNG seed data.
+ 
+-=item 4
++=item * 4
+ 
+ Any RNG seed data should influence all subsequent random numbers
+ generated.  This implies that any random seed data entered will have
+ an influence on all subsequent random numbers generated.
+ 
+-=item 5
++=item * 5
+ 
+ When using data to seed the RNG state, the data used should not be
+ extractable from the RNG state.  I believe this should be a
+@@ -108,12 +108,12 @@ data would be a private key or a password.  This data must
+ not be disclosed by either subsequent random numbers or a
+ 'core' dump left by a program crash.
+ 
+-=item 6
++=item * 6
+ 
+ Given the same initial 'state', 2 systems should deviate in their RNG state
+ (and hence the random numbers generated) over time if at all possible.
+ 
+-=item 7
++=item * 7
+ 
+ Given the random number output stream, it should not be possible to determine
+ the RNG state or the next random number.
+diff --git a/doc/ssl/SSL_COMP_add_compression_method.pod b/doc/ssl/SSL_COMP_add_compression_method.pod
+index 1111111..2222222 100644
+--- a/doc/ssl/SSL_COMP_add_compression_method.pod
++++ b/doc/ssl/SSL_COMP_add_compression_method.pod
+@@ -59,11 +59,11 @@ SSL_COMP_add_compression_method() may return the following values:
+ 
+ =over 4
+ 
+-=item Z<>0
++=item * Z<>0
+ 
+ The operation succeeded.
+ 
+-=item Z<>1
++=item * Z<>1
+ 
+ The operation failed. Check the error queue to find out the reason.
+ 
+diff --git a/doc/ssl/SSL_CTX_add_session.pod b/doc/ssl/SSL_CTX_add_session.pod
+index 1111111..2222222 100644
+--- a/doc/ssl/SSL_CTX_add_session.pod
++++ b/doc/ssl/SSL_CTX_add_session.pod
+@@ -52,13 +52,13 @@ The following values are returned by all functions:
+ 
+ =over 4
+ 
+-=item Z<>0
++=item * Z<>0
+ 
+  The operation failed. In case of the add operation, it was tried to add
+  the same (identical) session twice. In case of the remove operation, the
+  session was not found in the cache.
+ 
+-=item Z<>1
++=item * Z<>1
+  
+  The operation succeeded.
+ 
+diff --git a/doc/ssl/SSL_CTX_load_verify_locations.pod b/doc/ssl/SSL_CTX_load_verify_locations.pod
+index 1111111..2222222 100644
+--- a/doc/ssl/SSL_CTX_load_verify_locations.pod
++++ b/doc/ssl/SSL_CTX_load_verify_locations.pod
+@@ -100,13 +100,13 @@ The following return values can occur:
+ 
+ =over 4
+ 
+-=item Z<>0
++=item * Z<>0
+ 
+ The operation failed because B<CAfile> and B<CApath> are NULL or the
+ processing at one of the locations specified failed. Check the error
+ stack to find out the reason.
+ 
+-=item Z<>1
++=item * Z<>1
+ 
+ The operation succeeded.
+ 
+diff --git a/doc/ssl/SSL_CTX_set_client_CA_list.pod b/doc/ssl/SSL_CTX_set_client_CA_list.pod
+index 1111111..2222222 100644
+--- a/doc/ssl/SSL_CTX_set_client_CA_list.pod
++++ b/doc/ssl/SSL_CTX_set_client_CA_list.pod
+@@ -66,13 +66,13 @@ values:
+ 
+ =over 4
+ 
+-=item Z<>0
++=item * Z<>0
+ 
+ A failure while manipulating the STACK_OF(X509_NAME) object occurred or
+ the X509_NAME could not be extracted from B<cacert>. Check the error stack
+ to find out the reason.
+ 
+-=item Z<>1
++=item * Z<>1
+ 
+ The operation succeeded.
+ 
+diff --git a/doc/ssl/SSL_CTX_set_session_id_context.pod b/doc/ssl/SSL_CTX_set_session_id_context.pod
+index 1111111..2222222 100644
+--- a/doc/ssl/SSL_CTX_set_session_id_context.pod
++++ b/doc/ssl/SSL_CTX_set_session_id_context.pod
+@@ -64,13 +64,13 @@ return the following values:
+ 
+ =over 4
+ 
+-=item Z<>0
++=item * Z<>0
+ 
+ The length B<sid_ctx_len> of the session id context B<sid_ctx> exceeded
+ the maximum allowed length of B<SSL_MAX_SSL_SESSION_ID_LENGTH>. The error
+ is logged to the error stack.
+ 
+-=item Z<>1
++=item * Z<>1
+ 
+ The operation succeeded.
+ 
+diff --git a/doc/ssl/SSL_CTX_set_ssl_version.pod b/doc/ssl/SSL_CTX_set_ssl_version.pod
+index 1111111..2222222 100644
+--- a/doc/ssl/SSL_CTX_set_ssl_version.pod
++++ b/doc/ssl/SSL_CTX_set_ssl_version.pod
+@@ -42,11 +42,11 @@ and SSL_set_ssl_method():
+ 
+ =over 4
+ 
+-=item Z<>0
++=item * Z<>0
+ 
+ The new choice failed, check the error stack to find out the reason.
+ 
+-=item Z<>1
++=item * Z<>1
+ 
+ The operation succeeded.
+ 
+diff --git a/doc/ssl/SSL_CTX_use_psk_identity_hint.pod b/doc/ssl/SSL_CTX_use_psk_identity_hint.pod
+index 1111111..2222222 100644
+--- a/doc/ssl/SSL_CTX_use_psk_identity_hint.pod
++++ b/doc/ssl/SSL_CTX_use_psk_identity_hint.pod
+@@ -83,7 +83,7 @@ Return values from the server callback are interpreted as follows:
+ 
+ =over 4
+ 
+-=item Z<>0
++=item * Z<>0
+ 
+ PSK identity was not found. An "unknown_psk_identity" alert message
+ will be sent and the connection setup fails.
+diff --git a/doc/ssl/SSL_accept.pod b/doc/ssl/SSL_accept.pod
+index 1111111..2222222 100644
+--- a/doc/ssl/SSL_accept.pod
++++ b/doc/ssl/SSL_accept.pod
+@@ -41,18 +41,18 @@ The following return values can occur:
+ 
+ =over 4
+ 
+-=item Z<>0
++=item * Z<>0
+ 
+ The TLS/SSL handshake was not successful but was shut down controlled and
+ by the specifications of the TLS/SSL protocol. Call SSL_get_error() with the
+ return value B<ret> to find out the reason.
+ 
+-=item Z<>1
++=item * Z<>1
+ 
+ The TLS/SSL handshake was successfully completed, a TLS/SSL connection has been
+ established.
+ 
+-=item E<lt>0
++=item * E<lt>0
+ 
+ The TLS/SSL handshake was not successful because a fatal error occurred either
+ at the protocol level or a connection failure occurred. The shutdown was
+diff --git a/doc/ssl/SSL_clear.pod b/doc/ssl/SSL_clear.pod
+index 1111111..2222222 100644
+--- a/doc/ssl/SSL_clear.pod
++++ b/doc/ssl/SSL_clear.pod
+@@ -56,12 +56,12 @@ The following return values can occur:
+ 
+ =over 4
+ 
+-=item Z<>0
++=item * Z<>0
+ 
+ The SSL_clear() operation could not be performed. Check the error stack to
+ find out the reason.
+ 
+-=item Z<>1
++=item * Z<>1
+ 
+ The SSL_clear() operation was successful.
+ 
+diff --git a/doc/ssl/SSL_connect.pod b/doc/ssl/SSL_connect.pod
+index 1111111..2222222 100644
+--- a/doc/ssl/SSL_connect.pod
++++ b/doc/ssl/SSL_connect.pod
+@@ -41,18 +41,18 @@ The following return values can occur:
+ 
+ =over 4
+ 
+-=item Z<>0
++=item * Z<>0
+ 
+ The TLS/SSL handshake was not successful but was shut down controlled and
+ by the specifications of the TLS/SSL protocol. Call SSL_get_error() with the
+ return value B<ret> to find out the reason.
+ 
+-=item Z<>1
++=item * Z<>1
+ 
+ The TLS/SSL handshake was successfully completed, a TLS/SSL connection has been
+ established.
+ 
+-=item E<lt>0
++=item * E<lt>0
+ 
+ The TLS/SSL handshake was not successful, because a fatal error occurred either
+ at the protocol level or a connection failure occurred. The shutdown was
+diff --git a/doc/ssl/SSL_do_handshake.pod b/doc/ssl/SSL_do_handshake.pod
+index 1111111..2222222 100644
+--- a/doc/ssl/SSL_do_handshake.pod
++++ b/doc/ssl/SSL_do_handshake.pod
+@@ -42,18 +42,18 @@ The following return values can occur:
+ 
+ =over 4
+ 
+-=item Z<>0
++=item * Z<>0
+ 
+ The TLS/SSL handshake was not successful but was shut down controlled and
+ by the specifications of the TLS/SSL protocol. Call SSL_get_error() with the
+ return value B<ret> to find out the reason.
+ 
+-=item Z<>1
++=item * Z<>1
+ 
+ The TLS/SSL handshake was successfully completed, a TLS/SSL connection has been
+ established.
+ 
+-=item E<lt>0
++=item * E<lt>0
+ 
+ The TLS/SSL handshake was not successful because a fatal error occurred either
+ at the protocol level or a connection failure occurred. The shutdown was
+diff --git a/doc/ssl/SSL_get_ex_data_X509_STORE_CTX_idx.pod b/doc/ssl/SSL_get_ex_data_X509_STORE_CTX_idx.pod
+index 1111111..2222222 100644
+--- a/doc/ssl/SSL_get_ex_data_X509_STORE_CTX_idx.pod
++++ b/doc/ssl/SSL_get_ex_data_X509_STORE_CTX_idx.pod
+@@ -36,11 +36,11 @@ before the SSL index is created.
+ 
+ =over 4
+ 
+-=item E<gt>=0
++=item * E<gt>=0
+ 
+ The index value to access the pointer.
+ 
+-=item E<lt>0
++=item * E<lt>0
+ 
+ An error occurred, check the error stack for a detailed error message.
+ 
+diff --git a/doc/ssl/SSL_get_fd.pod b/doc/ssl/SSL_get_fd.pod
+index 1111111..2222222 100644
+--- a/doc/ssl/SSL_get_fd.pod
++++ b/doc/ssl/SSL_get_fd.pod
+@@ -26,12 +26,12 @@ The following return values can occur:
+ 
+ =over 4
+ 
+-=item -1
++=item * -1
+ 
+ The operation failed, because the underlying BIO is not of the correct type
+ (suitable for file descriptors).
+ 
+-=item E<gt>=0
++=item * E<gt>=0
+ 
+ The file descriptor linked to B<ssl>.
+ 
+diff --git a/doc/ssl/SSL_read.pod b/doc/ssl/SSL_read.pod
+index 1111111..2222222 100644
+--- a/doc/ssl/SSL_read.pod
++++ b/doc/ssl/SSL_read.pod
+@@ -81,16 +81,16 @@ The following return values can occur:
+ 
+ =over 4
+ 
+-=item E<gt> 0
++=item * E<gt> 0
+ 
+ The read operation was successful.
+ The return value is the number of bytes actually read from the TLS/SSL
+ connection.
+ 
+-=item Z<><= 0
++=item * Z<><= 0
+ 
+ 
+-=item E<lt>0
++=item * E<lt>0
+ 
+ The read operation was not successful, because either the connection was closed,
+ an error occurred or action must be taken by the calling process.
+diff --git a/doc/ssl/SSL_session_reused.pod b/doc/ssl/SSL_session_reused.pod
+index 1111111..2222222 100644
+--- a/doc/ssl/SSL_session_reused.pod
++++ b/doc/ssl/SSL_session_reused.pod
+@@ -27,11 +27,11 @@ The following return values can occur:
+ 
+ =over 4
+ 
+-=item Z<>0
++=item * Z<>0
+ 
+ A new session was negotiated.
+ 
+-=item Z<>1
++=item * Z<>1
+ 
+ A session was reused.
+ 
+diff --git a/doc/ssl/SSL_set_fd.pod b/doc/ssl/SSL_set_fd.pod
+index 1111111..2222222 100644
+--- a/doc/ssl/SSL_set_fd.pod
++++ b/doc/ssl/SSL_set_fd.pod
+@@ -35,11 +35,11 @@ The following return values can occur:
+ 
+ =over 4
+ 
+-=item Z<>0
++=item * Z<>0
+ 
+ The operation failed. Check the error stack to find out why.
+ 
+-=item Z<>1
++=item * Z<>1
+ 
+ The operation succeeded.
+ 
+diff --git a/doc/ssl/SSL_set_session.pod b/doc/ssl/SSL_set_session.pod
+index 1111111..2222222 100644
+--- a/doc/ssl/SSL_set_session.pod
++++ b/doc/ssl/SSL_set_session.pod
+@@ -37,11 +37,11 @@ The following return values can occur:
+ 
+ =over 4
+ 
+-=item Z<>0
++=item * Z<>0
+ 
+ The operation failed; check the error stack to find out the reason.
+ 
+-=item Z<>1
++=item * Z<>1
+ 
+ The operation succeeded.
+ 
+diff --git a/doc/ssl/SSL_set_shutdown.pod b/doc/ssl/SSL_set_shutdown.pod
+index 1111111..2222222 100644
+--- a/doc/ssl/SSL_set_shutdown.pod
++++ b/doc/ssl/SSL_set_shutdown.pod
+@@ -24,16 +24,16 @@ The shutdown state of an ssl connection is a bitmask of:
+ 
+ =over 4
+ 
+-=item Z<>0
++=item * Z<>0
+ 
+ No shutdown setting, yet.
+ 
+-=item SSL_SENT_SHUTDOWN
++=item * SSL_SENT_SHUTDOWN
+ 
+ A "close notify" shutdown alert was sent to the peer, the connection is being
+ considered closed and the session is closed and correct.
+ 
+-=item SSL_RECEIVED_SHUTDOWN
++=item * SSL_RECEIVED_SHUTDOWN
+ 
+ A shutdown alert was received form the peer, either a normal "close notify"
+ or a fatal error.
+diff --git a/doc/ssl/SSL_shutdown.pod b/doc/ssl/SSL_shutdown.pod
+index 1111111..2222222 100644
+--- a/doc/ssl/SSL_shutdown.pod
++++ b/doc/ssl/SSL_shutdown.pod
+@@ -92,19 +92,19 @@ The following return values can occur:
+ 
+ =over 4
+ 
+-=item Z<>0
++=item * Z<>0
+ 
+ The shutdown is not yet finished. Call SSL_shutdown() for a second time,
+ if a bidirectional shutdown shall be performed.
+ The output of L<SSL_get_error(3)|SSL_get_error(3)> may be misleading, as an
+ erroneous SSL_ERROR_SYSCALL may be flagged even though no error occurred.
+ 
+-=item Z<>1
++=item * Z<>1
+ 
+ The shutdown was successfully completed. The "close notify" alert was sent
+ and the peer's "close notify" alert was received.
+ 
+-=item E<lt>0
++=item * E<lt>0
+ 
+ The shutdown was not successful because a fatal error occurred either
+ at the protocol level or a connection failure occurred. It can also occur if
+diff --git a/doc/ssl/SSL_write.pod b/doc/ssl/SSL_write.pod
+index 1111111..2222222 100644
+--- a/doc/ssl/SSL_write.pod
++++ b/doc/ssl/SSL_write.pod
+@@ -74,12 +74,12 @@ The following return values can occur:
+ 
+ =over 4
+ 
+-=item E<gt> 0
++=item * E<gt> 0
+ 
+ The write operation was successful, the return value is the number of
+ bytes actually written to the TLS/SSL connection.
+ 
+-=item Z<><= 0
++=item * Z<><= 0
+ 
+ The write operation was not successful, because either the connection was
+ closed, an error occurred or action must be taken by the calling process.
diff --git a/plugins/examples/openssl1.0/openssl.mk b/plugins/examples/openssl1.0/openssl.mk
new file mode 100644
index 0000000..13fd372
--- /dev/null
+++ b/plugins/examples/openssl1.0/openssl.mk
@@ -0,0 +1,49 @@
+# This file is part of MXE. See LICENSE.md for licensing information.
+
+PKG             := openssl
+$(PKG)_WEBSITE  := https://www.openssl.org/
+$(PKG)_IGNORE   :=
+$(PKG)_VERSION  := 1.0.2n
+$(PKG)_CHECKSUM := 370babb75f278c39e0c50e8c4e7493bc0f18db6867478341a832a982fd15a8fe
+$(PKG)_SUBDIR   := openssl-$($(PKG)_VERSION)
+$(PKG)_FILE     := openssl-$($(PKG)_VERSION).tar.gz
+$(PKG)_URL      := https://www.openssl.org/source/$($(PKG)_FILE)
+$(PKG)_URL_2    := https://www.openssl.org/source/old/$(call tr,$([a-z]),,$($(PKG)_VERSION))/$($(PKG)_FILE)
+$(PKG)_DEPS     := cc zlib
+
+$(PKG)_PATCHES  := $(basename $(lastword $(MAKEFILE_LIST)))-1-fixes.patch
+
+define $(PKG)_UPDATE
+    $(WGET) -q -O- 'https://www.openssl.org/source/' | \
+    $(SED) -n 's,.*openssl-\([0-9][0-9a-z.]*\)\.tar.*,\1,p' | \
+    $(SORT) -V | \
+    tail -1
+endef
+
+define $(PKG)_BUILD
+    # remove previous install
+    rm -rfv '$(PREFIX)/$(TARGET)/include/openssl'
+    rm -rfv '$(PREFIX)/$(TARGET)/bin/engines'
+    rm -fv '$(PREFIX)/$(TARGET)/'*/{libcrypto*,libssl*}
+    rm -fv '$(PREFIX)/$(TARGET)/lib/pkgconfig/'{libcrypto*,libssl*,openssl*}
+
+    cd '$(1)' && CC='$(TARGET)-gcc' RC='$(TARGET)-windres' ./Configure \
+        @openssl-target@ \
+        zlib \
+        $(if $(BUILD_STATIC),no-,)shared \
+        no-capieng \
+        --prefix='$(PREFIX)/$(TARGET)'
+    $(MAKE) -C '$(1)' all install_sw -j 1 \
+        CC='$(TARGET)-gcc' \
+        RANLIB='$(TARGET)-ranlib' \
+        AR='$(TARGET)-ar rcu' \
+        CROSS_COMPILE='$(TARGET)-'
+
+    # no way to configure engines subdir install
+    $(if $(BUILD_SHARED),
+        rm -rf '$(PREFIX)/$(TARGET)/bin/engines' && \
+        mv -vf '$(PREFIX)/$(TARGET)/lib/engines' '$(PREFIX)/$(TARGET)/bin/')
+endef
+
+$(PKG)_BUILD_i686-w64-mingw32   = $(subst @openssl-target@,mingw,$($(PKG)_BUILD))
+$(PKG)_BUILD_x86_64-w64-mingw32 = $(subst @openssl-target@,mingw64,$($(PKG)_BUILD))
diff --git a/plugins/examples/openssl1.0/openssl1.0-overlay.mk b/plugins/examples/openssl1.0/openssl1.0-overlay.mk
new file mode 100644
index 0000000..d1d2ea8
--- /dev/null
+++ b/plugins/examples/openssl1.0/openssl1.0-overlay.mk
@@ -0,0 +1,9 @@
+# This file is part of MXE. See LICENSE.md for licensing information.
+$(PLUGIN_HEADER)
+
+# override relevant variables to build against frozen v1.0.x series
+
+dcmtk_CONFIGURE_OPTS := --with-openssl
+
+vmime_DEPS    := $(filter-out gnutls,$(vmime_DEPS)) openssl
+vmime_TLS_LIB := openssl
diff --git a/src/dcmtk.mk b/src/dcmtk.mk
index 9578209..8bcd599 100644
--- a/src/dcmtk.mk
+++ b/src/dcmtk.mk
@@ -20,6 +20,7 @@ endef
 
 # openssl 1.1 breaks build and newer version switched to cmake with
 # build that requires wine - disable openssl for now
+# see plugins/examples/openssl1.0 for example of re-enabling support
 define $(PKG)_BUILD
     cd '$(1)'/config && autoconf -f
     cd '$(1)' && ./configure \
@@ -37,7 +38,8 @@ define $(PKG)_BUILD
         AR='$(TARGET)-ar' \
         ARFLAGS=cru \
         LIBTOOL=$(LIBTOOL) \
-        ac_cv_my_c_rightshift_unsigned=no
+        ac_cv_my_c_rightshift_unsigned=no \
+        $($(PKG)_CONFIGURE_OPTS)
     $(MAKE) -C '$(1)' -j '$(JOBS)' install-lib
 endef
 
diff --git a/src/openssl.mk b/src/openssl.mk
index 1a62e9f..8931432 100644
--- a/src/openssl.mk
+++ b/src/openssl.mk
@@ -19,6 +19,12 @@ define $(PKG)_UPDATE
 endef
 
 define $(PKG)_BUILD
+    # remove previous install
+    rm -rfv '$(PREFIX)/$(TARGET)/include/openssl'
+    rm -rfv '$(PREFIX)/$(TARGET)/bin/engines'
+    rm -fv '$(PREFIX)/$(TARGET)/'*/{libcrypto*,libssl*}
+    rm -fv '$(PREFIX)/$(TARGET)/lib/pkgconfig/'{libcrypto*,libssl*,openssl*}
+
     cd '$(1)' && CC='$(TARGET)-gcc' RC='$(TARGET)-windres' ./Configure \
         @openssl-target@ \
         zlib \
diff --git a/src/vmime.mk b/src/vmime.mk
index b75b38a..ad37156 100644
--- a/src/vmime.mk
+++ b/src/vmime.mk
@@ -9,6 +9,10 @@ $(PKG)_CHECKSUM := 9612e121f59db8aea3414583a050494a58cecc5dc754b114044d013170cf3
 $(PKG)_GH_CONF  := kisli/vmime/master
 $(PKG)_DEPS     := cc gnutls libgsasl libiconv pthreads zlib
 
+# see plugins/examples/openssl1.0 for example of enabling openssl 1.0.x
+# support (see https://github.com/kisli/vmime/issues/146 for v1.1.x)
+$(PKG)_TLS_LIB  := gnutls
+
 define $(PKG)_BUILD
     # The following hint is probably needed for ICU:
     # -DICU_LIBRARIES="`'$(TARGET)-pkg-config' --libs-only-l icu-i18n`"
@@ -25,7 +29,7 @@ define $(PKG)_BUILD
         -DVMIME_BUILD_DOCUMENTATION=OFF \
         -DCMAKE_MODULE_PATH='$(1)/cmake' \
         -DVMIME_CHARSETCONV_LIB=iconv \
-        -DVMIME_TLS_SUPPORT_LIB=gnutls \
+        -DVMIME_TLS_SUPPORT_LIB=$($(PKG)_TLS_LIB) \
         -DVMIME_SHARED_PTR_USE_CXX=ON \
         -DCXX11_COMPILER_FLAGS=ON \
         -C '$(PWD)/src/vmime-TryRunResults.cmake' \
-- 
cgit v0.12