feat(openssl): drop configure-project-installer, inline build

Switch fromsource:openssl from xim:configure-project-installer to its
own inline build, applying the cluster-A sandbox-fix template:

* paths derived from pkginfo.install_file()
* Configure + make + make install_sw chained in single sh -c (openssl
  Configure does not support out-of-tree build, run from srcdir)
* fixed -j8
* sysroot include dir wrapped in _sys_usr_includedir() helper
* shell cp -r replaces os.dirs / os.files glob (silent no-ops in 0.4.9)
* declare upstream url + sha256
* deps: add explicit xim:gcc + xim:make + xim:xpkg-helper (previously
  pulled in transitively via configure-project-installer)

Build flags:
  linux-x86_64 enable-shared enable-legacy no-asm

`no-asm` works around an openssl 3.1.5 perlasm/binutils bug:
crypto/modes/aes-gcm-avx512.s emits `%SCALAR(...)` register names
that binutils 2.42 (the assembler in our subos) rejects. C fallback
is slower but stable; future binutils version bumps can drop the flag.

`make install_sw` skips docs install (saves several minutes).

Verified end-to-end in xlings 0.4.9 iso:
  ✓ Configure linux-x86_64 enable-shared enable-legacy no-asm
  ✓ make -j8 (~3 min on 8-core)
  ✓ make install_sw
  ✓ produced libssl.so.3 / libcrypto.so.3 + .so / .a
  ✓ openssl + c_rehash binaries staged
  ✓ headers (include/openssl/) shell-copied to subos sysroot

Cluster B leaf 5/8.

Author: Sunrisepeak

pkgs/o/openssl.lua

@@ -1,3 +1,7 @@
+function __openssl_url(version)
+    return format("https://www.openssl.org/source/openssl-%s.tar.gz", version)
+end
+
 package = {
     spec = "1",
 
@@ -23,11 +27,16 @@ package = {
     xpm = {
         linux = {
             deps = {
-                "xim:configure-project-installer@0.0.1",
+                "xim:xpkg-helper@0.0.1",
+                "xim:gcc@15.1.0",
+                "xim:make@4.3",
                 "xim:glibc@2.39",
             },
             ["latest"] = { ref = "3.1.5" },
-            ["3.1.5"] = { },
+            ["3.1.5"] = {
+                url = __openssl_url("3.1.5"),
+                sha256 = nil,
+            },
         },
     },
 }
@@ -43,16 +52,35 @@ local libs = {
 }
 
 local xpkg_binding_tree = package.name .. "-binding-tree"
-local sys_usr_includedir = path.join(system.subos_sysrootdir(), "usr/include")
 
-function install()
-    local xpkg = package.name .. "@" .. pkginfo.version()
-    os.tryrm(pkginfo.install_dir())
+local function _sys_usr_includedir()
+    return path.join(system.subos_sysrootdir(), "usr/include")
+end
 
-    system.exec("configure-project-installer " .. pkginfo.install_dir()
-        .. " --xpkg-scode " .. xpkg
-        .. " --args " .. [[ "enable-shared enable-legacy" ]]
-    )
+function install()
+    -- Sandbox template (PR #49 bzip2): derive paths from pkginfo.install_file()
+    -- since path.absolute is nil; chain Configure + make + install in single
+    -- sh -c (os.cd doesn't propagate; openssl Configure does not support
+    -- out-of-tree build, run from srcdir).
+    local runtime_dir = path.directory(pkginfo.install_file())
+    local scode_dir = path.join(runtime_dir, "openssl-" .. pkginfo.version())
+    local prefix = pkginfo.install_dir()
+
+    log.info("Configuring + building + installing openssl...")
+    -- linux-x86_64:                explicit target (Configure auto-detect varies)
+    -- enable-shared enable-legacy: ship .so libs + legacy ciphers
+    -- no-asm:                      use C fallbacks for crypto routines.
+    --                              openssl 3.1.5's perlasm output for AVX-512
+    --                              (crypto/modes/aes-gcm-avx512.s) emits
+    --                              `%SCALAR(...))` register names that the
+    --                              binutils 2.42 assembler in our subos
+    --                              rejects. C fallback is slower but stable.
+    -- install_sw:                  skip docs install (saves several minutes)
+    system.exec(string.format(
+        "sh -c 'cd %s && ./Configure linux-x86_64 enable-shared enable-legacy no-asm --prefix=%s "
+        .. "&& make -j8 && make install_sw'",
+        scode_dir, prefix
+    ))
 
     return os.isdir(pkginfo.install_dir())
 end
@@ -64,6 +92,7 @@ function config()
     local bindir = path.join(pkginfo.install_dir(), "bin")
     local libdir = path.join(pkginfo.install_dir(), "lib64")
     local includedir = path.join(pkginfo.install_dir(), "include")
+    local sys_inc = _sys_usr_includedir()
 
     log.info("Registering CLI programs...")
     for _, prog in ipairs(package.programs) do
@@ -88,17 +117,14 @@ function config()
     end
 
     log.info("Installing headers to sysroot...")
+    if not os.isdir(sys_inc) then os.mkdir(sys_inc) end
     if os.isdir(includedir) then
-        local subdirs = os.dirs(path.join(includedir, "*"))
-        for _, subdir in ipairs(subdirs) do
-            local name = path.filename(subdir)
-            os.tryrm(path.join(sys_usr_includedir, name))
-            os.cp(subdir, path.join(sys_usr_includedir, name), { force = true })
-        end
-
-        for _, file in ipairs(os.files(path.join(includedir, "*.h"))) do
-            os.cp(file, sys_usr_includedir)
-        end
+        -- shell cp -r: os.dirs / os.files glob is unreliable in 0.4.9 sandbox.
+        -- openssl ships include/openssl/ subdir + ossl_typ.h-style flat files.
+        system.exec(string.format(
+            "sh -c 'cp -rf %s/* %s/'",
+            includedir, sys_inc
+        ))
     end
 
     xvm.add(package.name, { binding = binding_tree_version_tag })
@@ -116,18 +142,13 @@ function uninstall()
         xvm.remove(lib, package.name .. "-" .. pkginfo.version())
     end
 
-    local includedir = path.join(pkginfo.install_dir(), "include")
-    if os.isdir(includedir) then
-        local subdirs = os.dirs(path.join(includedir, "*"))
-        for _, subdir in ipairs(subdirs) do
-            os.tryrm(path.join(sys_usr_includedir, path.filename(subdir)))
-        end
-
-        for _, file in ipairs(os.files(path.join(includedir, "*.h"))) do
-            os.tryrm(path.join(sys_usr_includedir, path.filename(file)))
-        end
-    end
+    -- openssl headers live under include/openssl/. Sweep that subtree.
+    local sys_inc = _sys_usr_includedir()
+    system.exec(string.format(
+        "sh -c 'rm -rf %s/openssl 2>/dev/null || true'",
+        sys_inc
+    ))
 
     xvm.remove(xpkg_binding_tree)
     return true
-end
+end