Map OpenSSL only in a server that uses it

Linking OpenSSL cost every pure-serve 2.3 MiB of resident memory, 0.66
MiB of it the process's own (relocated data), though most servers never
reach an https receiver or seal a send. The code that uses OpenSSL (TLS
to https receivers, sealing) is now built as pure-crypto.so beside
pure-serve and exports one table; pure-serve maps it the first time a
wire to an https URL opens or a key is read or a seal wired
(serve/crypto.c), and a missing library is reported at startup. What
needs no OpenSSL, a key's hex and the suite this CPU seals with, stays in
pure-serve.

An idle server: RSS 4,496 -> 2,320 kB, PSS 1,639 -> 881 kB, private
dirty 1,296 -> 864 kB. A static OpenSSL was measured too and is worse
(RSS 3.8 MiB, but 2.3 MiB private: all of its tables relocated). The
checks, https webhooks and sealed sends included, pass unchanged.

1 files changed, 4 insertions, 1 deletions

diff --git a/serve/seal.h b/serve/seal.h
index 4ce3844..663d860 100644
--- a/serve/seal.h
+++ b/serve/seal.h
@@ -9,7 +9,8 @@
  * (RFC 9180) base mode: X25519, HKDF-SHA256, and AES-128-GCM where the CPU
  * has AES instructions, else ChaCha20-Poly1305. A private key lives in
  * OpenSSL's secure heap: locked in memory, out of core dumps, cleared when
- * freed. */
+ * freed. OpenSSL comes with pure-crypto.so (serve/crypto.c), mapped the
+ * first time a key is read or a send sealed. */
 enum { PURE_SEAL_KEY = 32, PURE_SEAL_OVERHEAD = 32 + 16 }; /* the encapsulated key, then the tag */
 
 typedef struct PureSealKey PureSealKey;
@@ -17,6 +18,8 @@ typedef struct PureSealKey PureSealKey;
  * is none; its public half in hex. NULL with why in error. */
 PureSealKey *pure_seal_key(const char *path, char public_hex[2 * PURE_SEAL_KEY + 1], char *error, size_t size);
 void pure_seal_key_free(PureSealKey *);
+/* Whether this machine can seal (pure-crypto.so maps), with why not in error. */
+bool pure_seal_ready(char *error, size_t size);
 /* A public key from its hex. */
 bool pure_seal_peer(const char *hex, unsigned char out[PURE_SEAL_KEY]);
 /* The suite this machine seals with, as the X-Pure-Seal header names it. */