build: remove certctl requirement for host OpenSSL libs

MK_OPENSSL is indicative of what we expect to build, not of what we have
available on the host.  Some platforms, like macOS, do not expose
headers for the system's libcrypto for public consumption.  libcrypto
isn't very heavy and won't persist past the host tools, so just add it
to our bootstrap set to fix the build on macOS.

Reported by:	jrtc27
Fixes:	81d8827 ("certctl: Reimplement in C")

Author: kevans91

Makefile.inc1

@@ -2708,8 +2708,16 @@ _basic_bootstrap_tools+=sbin/md5
 _basic_bootstrap_tools+=usr.sbin/tzsetup
 .endif
 
-# certctl is needed as an install tool
+# certctl is needed as an install tool.  libcrypto is rather light, so we'll
+# build that alongside it for platforms that don't expose headers for OpenSSL,
+# like macOS.
 .if ${MK_CAROOT} != "no" && ${MK_OPENSSL} != "no"
+.if ${.MAKE.OS} == "Darwin" || ${.MAKE.OS} == "FreeBSD"
+BSTOOL_ARGS+=	-DLIBCRYPTO_WITHOUT_SUBDIRS
+BSTOOL_ARGS+=	-DWITHOUT_AUTO_ASM
+_bootstrap_libcrypto=secure/lib/libcrypto
+${_bt}-usr.sbin/certctl: ${_bt}-secure/lib/libcrypto
+.endif
 _certctl=usr.sbin/certctl
 .endif
 
@@ -2776,6 +2784,7 @@ bootstrap-tools: ${_bt}-links .PHONY
     ${_strfile} \
     usr.bin/dtc \
     ${_cat} \
+    ${_bootstrap_libcrypto} \
     ${_certctl} \
     ${_kbdcontrol} \
     ${_elftoolchain_libs} \
@@ -2813,8 +2822,9 @@ ${_bt}-${_tool}: ${_bt}-links .PHONY .MAKE
 		if [ "${_tool}" = "usr.bin/lex" ]; then \
 			${MAKE} DIRPRFX=${_tool}/ bootstrap; \
 		fi; \
-		${MAKE} DIRPRFX=${_tool}/ all; \
-		${MAKE} DIRPRFX=${_tool}/ DESTDIR=${WORLDTMP}/legacy install
+		${MAKE} DIRPRFX=${_tool}/ ${BSTOOL_ARGS} all; \
+		${MAKE} DIRPRFX=${_tool}/ DESTDIR=${WORLDTMP}/legacy \
+		    ${BSTOOL_ARGS} install
 
 bootstrap-tools: ${_bt}-${_tool}
 .endfor

share/mk/bsd.endian.mk

@@ -20,10 +20,17 @@ LOCALEDEF_ENDIAN= -b
 #
 # During bootstrapping on !FreeBSD OSes, we need to define some value.  Short of
 # having an exhaustive list for all variants of Linux and MacOS we simply do not
-# set TARGET_ENDIANNESS and poison the other variables. They should be unused
-# during the bootstrap phases (apart from one place that's adequately protected
-# in bsd.compiler.mk) where we're building the bootstrap tools.
+# set TARGET_ENDIANNESS (on Linux) and poison the other variables. They should
+# be unused during the bootstrap phases (apart from one place that's adequately
+# protected in bsd.compiler.mk) where we're building the bootstrap tools.
 #
+.if ${.MAKE.OS} == "Darwin"
+# We do assume the endianness on macOS because Apple's modern hardware is all
+# little-endian.  This might need revisited in the far future, but for the time
+# being Apple Silicon's reign of terror continues.  We only set this one up
+# because libcrypto is now built in bootstrap.
+TARGET_ENDIANNESS= 1234
+.endif
 CAP_MKDB_ENDIAN= -B	# Poisoned value, invalid flags for both cap_mkdb
 LOCALEDEF_ENDIAN= -B	# and localedef.
 .endif

tools/build/Makefile

@@ -495,6 +495,7 @@ INSTALLDIR_LIST= \
 	bin \
 	lib/geom \
 	usr/include/casper \
+	usr/include/openssl \
 	usr/include/private/ucl \
 	usr/include/private/zstd \
 	usr/lib \