Map OpenSSL only in a server that uses it

Linking OpenSSL cost every pure-serve 2.3 MiB of resident memory, 0.66
MiB of it the process's own (relocated data), though most servers never
reach an https receiver or seal a send. The code that uses OpenSSL (TLS
to https receivers, sealing) is now built as pure-crypto.so beside
pure-serve and exports one table; pure-serve maps it the first time a
wire to an https URL opens or a key is read or a seal wired
(serve/crypto.c), and a missing library is reported at startup. What
needs no OpenSSL, a key's hex and the suite this CPU seals with, stays in
pure-serve.

An idle server: RSS 4,496 -> 2,320 kB, PSS 1,639 -> 881 kB, private
dirty 1,296 -> 864 kB. A static OpenSSL was measured too and is worse
(RSS 3.8 MiB, but 2.3 MiB private: all of its tables relocated). The
checks, https webhooks and sealed sends included, pass unchanged.

1 files changed, 18 insertions, 0 deletions

diff --git a/serve/tls.h b/serve/tls.h
new file mode 100644
index 0000000..704924d
--- /dev/null
+++ b/serve/tls.h
@@ -0,0 +1,18 @@
+#ifndef PURE_TLS_H
+#define PURE_TLS_H
+#include <stdbool.h>
+#include <stddef.h>
+
+/* TLS to https receivers (serve/crypto.c): one client context, verifying a
+ * receiver's certificate against the system's CAs or ca_file, and its name. */
+typedef struct PureTls PureTls;
+/* The context, made once; false with why in error when it cannot be. */
+bool pure_tls_start(const char *ca_file, char *error, size_t size);
+/* A session over a connected socket to host (a DNS name, or an IP address
+ * written as one), its certificate verified; NULL when it fails. */
+PureTls *pure_tls_open(const char *host, int fd);
+/* As SSL_read and SSL_write: the bytes moved, or <= 0. */
+int pure_tls_read(PureTls *, void *bytes, int size);
+int pure_tls_write(PureTls *, const void *bytes, int size);
+void pure_tls_close(PureTls *);
+#endif