Make OpenSSL engine support optional and disabled

openssl-devel-engine is now needed on rawhide to have engine header
present. Make it enabled by default, but possible to disable built
support for it easy way.

https://fedoraproject.org/wiki/Changes/OpensslDeprecateEngine

bind-9.18-openssl-no-engine.patch

@@ -1,28 +0,0 @@
-diff --git a/lib/isc/openssl_shim.c b/lib/isc/openssl_shim.c
-index b8dbfaa..d851857 100644
---- a/lib/isc/openssl_shim.c
-+++ b/lib/isc/openssl_shim.c
-@@ -16,7 +16,9 @@
- #include <string.h>
- 
- #include <openssl/crypto.h>
-+#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000
- #include <openssl/engine.h>
-+#endif
- #include <openssl/evp.h>
- #include <openssl/hmac.h>
- #include <openssl/opensslv.h>
-diff --git a/lib/isc/openssl_shim.h b/lib/isc/openssl_shim.h
-index c0abd14..ec16d2f 100644
---- a/lib/isc/openssl_shim.h
-+++ b/lib/isc/openssl_shim.h
-@@ -14,7 +14,9 @@
- #pragma once
- 
- #include <openssl/crypto.h>
-+#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000
- #include <openssl/engine.h>
-+#endif
- #include <openssl/evp.h>
- #include <openssl/hmac.h>
- #include <openssl/opensslv.h>

bind-9.20-openssl-no-engine.patch

@@ -0,0 +1,47 @@
+From b487bd340ae1b635ce5cffe76f748ddc97f301f7 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
+Date: Sat, 3 Aug 2024 01:28:36 +0200
+Subject: [PATCH] Remove unused <openssl/{hmac,engine}.h> headers from OpenSSL
+ shims
+
+The <openssl/{hmac,engine}.h> headers were unused and including the
+<openssl/engine.h> header might cause build failure when OpenSSL
+doesn't have Engines support enabled.
+
+See https://fedoraproject.org/wiki/Changes/OpensslDeprecateEngine
+---
+ lib/isc/openssl_shim.c | 2 --
+ lib/isc/openssl_shim.h | 2 --
+ 2 files changed, 4 deletions(-)
+
+diff --git a/lib/isc/openssl_shim.c b/lib/isc/openssl_shim.c
+index c39ba8c6827..02d0105eb9e 100644
+--- a/lib/isc/openssl_shim.c
++++ b/lib/isc/openssl_shim.c
+@@ -16,9 +16,7 @@
+ #include <string.h>
+ 
+ #include <openssl/crypto.h>
+-#include <openssl/engine.h>
+ #include <openssl/evp.h>
+-#include <openssl/hmac.h>
+ #include <openssl/opensslv.h>
+ #include <openssl/ssl.h>
+ 
+diff --git a/lib/isc/openssl_shim.h b/lib/isc/openssl_shim.h
+index b2916e20a90..95b2f08e231 100644
+--- a/lib/isc/openssl_shim.h
++++ b/lib/isc/openssl_shim.h
+@@ -14,9 +14,7 @@
+ #pragma once
+ 
+ #include <openssl/crypto.h>
+-#include <openssl/engine.h>
+ #include <openssl/evp.h>
+-#include <openssl/hmac.h>
+ #include <openssl/opensslv.h>
+ #include <openssl/ssl.h>
+ 
+-- 
+2.46.2
+

bind.spec

@@ -30,6 +30,10 @@
 %bcond_with    TSAN
 # Add experimental extra verbose logging of query processing
 %bcond_with    QUERYTRACE
+%if 0%{?fedora} >= 41 && ! 0%{?rhel}
+# Make this enabled on recent Fedora, but not in ELN or RHEL
+  %bcond_without OPENSSL_ENGINE
+%endif
 
 %{?!bind_uid:  %global bind_uid  25}
 %{?!bind_gid:  %global bind_gid  25}
@@ -121,7 +125,9 @@ Patch16: bind-9.16-redhat_doc.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=2122010
 Patch26: bind-9.18-unittest-netmgr-unstable.patch
 # https://fedoraproject.org/wiki/Changes/OpensslDeprecateEngine
-Patch27: bind-9.18-openssl-no-engine.patch
+# Correct support for building without openssl/engine.h header
+# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/9593
+Patch27: bind-9.20-openssl-no-engine.patch
 
 %{?systemd_ordering}
 Requires:       coreutils
@@ -136,7 +142,7 @@ Obsoletes:      %{name}-pkcs11 < 32:9.18.4-2
 
 BuildRequires:  gcc, make
 BuildRequires:  openssl-devel, libtool, autoconf, pkgconfig, libcap-devel
-%if 0%{?fedora} >= 41
+%if %{with OPENSSL_ENGINE}
 BuildRequires:  openssl-devel-engine
 %endif
 BuildRequires:  libidn2-devel, libxml2-devel
@@ -377,8 +383,11 @@ done
 %define systemtest_prepare_build() \
   cp -Tuav bin/tests "%{1}/bin/tests/" \
 
-CFLAGS="$CFLAGS $RPM_OPT_FLAGS"
+%if %{with OPENSSL_ENGINE}
 CPPFLAGS="$CPPFLAGS -DOPENSSL_API_COMPAT=10100"
+%else
+CPPFLAGS="$CPPFLAGS -DOPENSSL_NO_ENGINE=1"
+%endif
 %if %{with TSAN}
   CFLAGS+=" -O1 -fsanitize=thread -fPIE -pie"
 %endif