Notes on how Fossil deliverables are built and uploaded

All builds statically link against OpenSSL, which is a library that is often missing from systems on which Fossil might be installed. By statically linking with OpenSSL, the dependency on OpenSSL is omitted, making the precompiled binaries more portable.
As of 2023-05-31, OpenSSL 3.1.1 is used for all builds. Check that Fossil is not affected by known vulnerabilities of that version.

Pre-Release Checklist

If pikchr.c has been updated since the last release, be sure that its WASM build is up-to-date, as documented in build.wiki. The easiest approach is simply to see if both /finfo/extsrc/pikchr.c and /finfo/extsrc/pikchr.wasm have the same checkin time. If the WASM build is out of date, the /pikchrshow app will be using a different pikchr version than the rest of fossil.

Verify that all items on the Before-Release Checklist have been run
Update the version number and related links on the homepage.
fossil uv edit download.js
Edit the "releases" variable in the javascript to add the new release number and title and various hyperlinks. Perhaps also remove older releases.
Remove obsolete build products: fossil uv rm --glob $PATTERN
fossil uv edit latest-release.md
Update the latest result tarball link
fossil uv edit releases.md
Update the list of releases and move the "(latest)" suffix to new top-most entry.
fossil uv sync

Set up in-tree OpenSSL:
- Download the OpenSSL tarball and unpack it into compat/openssl
- cd into the compat/openssl directory
- ./config no-ssl3 no-weak-ssl-ciphers no-shared no-threads --openssldir=/usr/lib/ssl
- CFLAGS=-Os make -e
./configure --with-openssl=tree --disable-fusefs
If the Makefile contains a reference to -lpthread, remove it.
CFLAGS="-Os" make -e clean fossil
strip fossil
Verify dependencies using "ldd ./fossil"
tar czf fossil-linux-x64-$VERSION.tar.gz fossil
fossil uv add fossil-linux-x64-$VERSION.tar.gz
fossil uv sync

For x64 builds, use the circa 2010 Macbook Air running MacOS 10.13.6. For arm64 builds use the 2020 miniMac running MacOS 12.0.1.
Set up in-tree OpenSSL:
- Download the OpenSSL tarball and unpack it into compat/openssl
- cd into the compat/openssl directory
- ./config no-ssl3 no-weak-ssl-ciphers no-shared no-threads no-asm --openssldir=/etc/ssl
- CFLAGS=-Os make -e
./configure --with-openssl=tree
CFLAGS=-Os make -e clean fossil
Verify no shared library dependencies using: otool -L ./fossil
strip fossil
Optional: codesign -s drh@sqlite.org fossil then verify the signature using codesign -d -v fossil
tar czf fossil-mac-ARCH-VERSION.tar.gz fossil where ARCH is either x64 or arm64.
fossil uv add fossil-mac-ARCH-VERSION.tar.gz
fossil uv sync

Set up in-tree OpenSSL:
- Download the OpenSSL tarball and unpack it into compat/openssl
- cd into the compat/openssl directory
- ./Configure linux-generic32 no-ssl3 no-weak-ssl-ciphers no-shared no-threads no-asm --openssldir=/usr/lib/ssl
- CFLAGS=-Os make -e
./configure --with-openssl=tree --static
CFLAGS="-Os" make -e clean fossil && strip fossil
tar czf fossil-pi-$VERSION.tar.gz fossil
fossil uv add fossil-pi-$VERSION.tar.gz
fossil uv sync

Run all of the following from a "x32 Native Tools Command Prompt"
Set up in-tree OpenSSL:
- Install Strawberry-Perl if it is not already installed
- Download the OpenSSL tarball and unpack under compat/
- cd into the OpenSSL source directory
- C:/Strawberry/perl/bin/perl Configure VC-WIN32 no-asm no-ssl3 no-weak-ssl-ciphers no-shared /D_WIN32_WINNT=0x0501
  - The _WIN32_WINT definition on the perl Configure command, and the FOSSIL_ENABLE_WINXP=1 term on the second nmake command below, are necessary in order for this build to work on older WindowsXP machines. See forum thread 66f106195aaf289e.
- nmake /f makefile
cd into the win/ subfolder of the Fossil source tree.
nmake /f Makefile.msc FOSSIL_ENABLE_SSL=1 FOSSIL_ENABLE_WINXP=1 OPTIMIZATIONS=4 clean fossil.exe
Verify dependencies: dumpbin /dependents fossil.exe
zip fossil-w32-$VERSION.zip fossil.exe
fossil uv add fossil-w32-$VERSION.zip
fossil uv sync