Windows: Install OpenSSL standalone

[sunjayBhatia]

Solves msys2 openssl fork/DLL base address issues in RBE

See: envoyproxy/envoy#13276

Downloads OpenSSL installer from here: https://slproweb.com/products/Win32OpenSSL.html

Should be same installer used by chocolatey (https://chocolatey.org/packages/openssl#files) and mentioned on OpenSSL site: https://wiki.openssl.org/index.php/Binaries

[sunjayBhatia]

cc @lizan when you get a chance, this will allow us to untag all the failing/flaky //test/extensions/transport_sockets/tls/... tests in Envoy

[lizan]

@sunjayBhatia why do we need openssl in those tests?

[sunjayBhatia]

@sunjayBhatia why do we need openssl in those tests?

There are a few scripts in these tests that generate test data on the fly, see this tree: https://github.com/envoyproxy/envoy/tree/master/test/extensions/transport_sockets/tls

specifically invocations show up here: https://github.com/envoyproxy/envoy/blob/db1a35213aa18399ba14ef545fc4894545cf68a2/test/extensions/transport_sockets/tls/ssl_certs_test.h

https://github.com/envoyproxy/envoy/blob/db1a35213aa18399ba14ef545fc4894545cf68a2/test/extensions/transport_sockets/tls/ocsp/gen_unittest_ocsp_data.sh

[sunjayBhatia]

@lizan do you prefer to have all the certs checked in? (imo its sorta nice to have things generated on the fly, makes sure we don't have to think about expiry dates and it keeps the tree cleaner, but its not a strong preference)

[lizan]

@sunjayBhatia yeah I think we had issue before with macOS so we checked in most of the certs. Or we can use the bssl binary from BoringSSL to accommodate those tests.

[sunjayBhatia]

@sunjayBhatia yeah I think we had issue before with macOS so we checked in most of the certs. Or we can use the bssl binary from BoringSSL to accommodate those tests.

From what I’ve looked at bssl doesn’t have all the functionality of openssl and doesn’t look like it can generate x509 certs?

[sunjayBhatia]

@lizan would you prefer a change to check in the certs rather than this one? it has an added benefit of ensuring the tests are runnable on macos if they arent already

[sunjayBhatia]

@envoyproxy/build-tools-maintainers PTAL, the alternative to this change to the build image is to check in all generated certs in the //test/extensions/transport_sockets/tls/... set of tests

cc @envoyproxy/dependency-shepherds

[sunjayBhatia]

/retest

[lizan]

OK if bssl doesn't work I don't have strong preference. In general I'd like to avoid openssl though.

[sunjayBhatia]

See envoyproxy/envoy#13702 as an alternative to updating OpenSSL @lizan

[moderation]

Definitely @lizan 's area so will defer to him

[sunjayBhatia]

superceded by envoyproxy/envoy#13702