Build system

OpenSSL's build is driven by a single Perl script (Configure) that consumes per-platform "configurations" and per-directory build.info files, runs them through templated generators, and emits a Makefile (Unix), descrip.mms (VMS), or makefile (Windows nmake).

Files

Path	Role
Configure	The top-level configurator. Reads target, options, and feature flags.
config	A shell wrapper that guesses the target and forwards to Configure.
Configurations/	Target descriptions (one Perl-data-file per family: unix-Makefile.tmpl, descrip.mms.tmpl, windows-makefile.tmpl, plus *.conf files describing compiler/asm options for each OS+arch).
build.info	Per-directory build manifest.
*.in files	Templates expanded into *.h / *.c / *.cnf / man pages by util/dofile.pl.
util/perl/	Perl helper modules used by Configure and templates.
crypto/perlasm/	The perlasm machinery used by every algorithm asm file.

Configuring

$ ./Configure --prefix=/opt/openssl --openssldir=/etc/ssl   \
              shared no-deprecated enable-fips enable-quic

Configure accepts:

• A target name (linux-x86_64, darwin64-arm64-cc, VC-WIN64A, BSD-aarch64, solaris64-x86_64-gcc, …). Discovered via ./config or specified explicitly.
• Standard ./configure-ish flags: --prefix=, --openssldir=, --libdir=, --release=, --debug=.
• Many feature flags: enable-<feature> / no-<feature>. The full list is in INSTALL.md. Examples:
  • enable-fips, enable-fips-jitter
  • enable-quic, no-quic
  • no-deprecated, no-shared, no-asm, no-threads
  • no-tls1, no-tls1_1, no-tls1_2, no-tls1_3, no-dtls, no-srtp
  • enable-trace, enable-fuzz-libfuzzer, enable-fuzz-afl
  • enable-asan, enable-msan, enable-ubsan, enable-ec_nistp_64_gcc_128
  • enable-pic (default), no-pic
  • enable-static-engine / dynamic-engine
  • no-zlib, no-zstd, no-brotli, no-cached-fetch, no-bf, no-cmac, … (per-algorithm)
  • Compiler flags pass-through: -DOPENSSL_NO_…, -O3, -fsanitize=address.

The output is a Makefile plus a configdata.pm (a Perl data dump of the configuration) and several generated headers.

Configurations directory

Configurations/
├── 00-base-templates.conf
├── 10-main.conf            -- the canonical mapping target -> {cc, cflags, asm files, OS hooks}
├── 11-android.conf
├── 15-ios.conf
├── 50-django.conf, 50-haiku.conf, 50-masm.conf, 50-vms.conf, 50-win-onecore.conf, 50-djgpp.conf, ...
├── 90-team.conf            -- developer-only test targets
├── 99-personal-*.conf      -- per-developer overrides
├── unix-Makefile.tmpl      -- Unix build-system template
├── descrip.mms.tmpl        -- VMS template
├── windows-makefile.tmpl   -- Windows nmake template
├── platform/               -- per-OS shell helpers
└── shared-info.pl, common.tmpl, common0.tmpl, common-asm.tmpl, common-android.tmpl, common-darwin.tmpl, ...

Adding a new target means adding (or extending) an entry in 10-main.conf (or one of the secondary .conf files). An entry has compiler, archiver, ranlib, ldflags, asm modules, BN size, threading flavour, etc.

build.info

Every directory has a build.info. Its grammar is described at the top of Configurations/README and the template files. Sample (crypto/build.info):

LIBS=../libcrypto

SOURCE[../libcrypto]=\
        cryptlib.c context.c init.c initthread.c \
        provider.c provider_core.c provider_predefined.c \
        provider_conf.c provider_child.c \
        ...

GENERATE[buildinf.h]=../util/mkbuildinf.pl "$(CC) $(CFLAGS_Q)" "$(PLATFORM)"
DEPEND[cversion.o]=buildinf.h

Directives that appear:

Directive	Meaning
SOURCE[<target>]	Source files contributing to the target.
LIBS=<paths>	Libraries declared in this directory.
MODULES=<paths>	Loadable modules (fips.so, legacy.so).
PROGRAMS=<paths>	Executables.
DEPEND[<file>]	Extra build-order dependencies.
GENERATE[<file>]	A code-generation step.
INCLUDE[<target>]	Per-target include paths.
IF[…] / ELSE / ENDIF	Conditional compilation gated on Configure flags.

Templates and *.in files

OpenSSL ships several files as templates expanded at configure time:

• include/openssl/<header>.h.in — public headers parameterised by feature flags or generated lists. Examples: include/openssl/configuration.h.in, include/openssl/ssl.h.in, core_names.h.in.
• apps/openssl.cnf.in — the default config file.
• *.pod.in — man pages whose content depends on configure flags.

Expansion is via util/dofile.pl, which substitutes Perl variables from configdata.pm. The convention is that any generated file is committed, so the source tarball builds without Perl. That means make update regenerates the artifacts and they must be checked in.

perlasm

OpenSSL writes hot inner loops (AES, SHA, ChaCha20, ML-KEM NTT, …) in assembly. To stay portable across assemblers, every asm file is a perlasm template: a Perl script that emits assembly text in the syntax appropriate for the target (GAS, NASM, MASM, AT&T, Apple, …).

crypto/perlasm/
├── x86_64-xlate.pl          -- the canonical AT&T -> dialect translator
├── arm-xlate.pl             -- ARM equivalent
├── arm64-xlate.pl           -- AArch64 equivalent
├── ppc-xlate.pl             -- PowerPC equivalent
├── s390x-xlate.pl           -- S/390x equivalent
├── riscv-xlate.pl, riscv64-xlate.pl, riscv128-xlate.pl
├── x86asm.pl, x86nasm.pl, x86masm.pl
├── x86gas.pl
├── x86_32-xlate.pl
├── cbc.pl, sparcv9_modes.pl
└── README.md

A typical algorithm file is crypto/<algo>/asm/<algo>-<arch>.pl:

require "x86_64-xlate.pl";
$flavour = shift; $output = shift;
open STDOUT, "| \"$^X\" \"$flavour\" \"$output\"";
# ... emit asm via print statements ...
close STDOUT;

The build invokes the perl script with the $flavour and $output arguments; the output is real .s / .asm consumed by the assembler.

Andy Polyakov authored almost the entire perlasm corpus (he's the credited author on most files).

Make targets

make                  -- build everything
make update           -- regenerate util/libcrypto.num, util/libssl.num, errors, mkdef, ASN.1 OID tables, MD/SH self-tests
make test             -- run the test suite
make TESTS=<name> test
make install          -- install to PREFIX
make install_sw       -- install only software, not docs
make build_libs       -- libcrypto + libssl only
make build_modules    -- fips.so / legacy.so only
make build_apps       -- the openssl CLI
make build_docs       -- man pages and HTML
make build_generated  -- run all GENERATE[] rules
make depend           -- update header deps in Makefile

make update is the most surprising: many committed files are mechanically generated, and it walks the tree regenerating them. Run it whenever you add a new public symbol, error code, or asm helper.

Cross-compilation

Specify the target explicitly to Configure. Many targets in 10-main.conf are cross-compile-aware:

./Configure linux-aarch64 --cross-compile-prefix=aarch64-linux-gnu-
make

Android, iOS, and watchOS have dedicated configs (Configurations/15-ios.conf, 11-android.conf, …) and small READMEs (NOTES-ANDROID.md).

Reproducible builds

The build embeds a __DATE__/__TIME__-derived line and the configure command line into cversion.o via util/mkbuildinf.pl. To make builds reproducible, set SOURCE_DATE_EPOCH per the standard convention; the build helpers honour it.

Documentation

• INSTALL.md — top-level user guide.
• Configurations/README — building a new target.
• Configurations/README-design — the build-system internals.
• crypto/perlasm/README.md — perlasm.
• doc/HOWTO/ — the per-task how-tos under doc/HOWTO/keys.txt, proxy_certificates.txt, etc.