Repository: spack/spack

Issue:
Installation issue: nettle fails to build due to undocumented openssl dependency?
### Steps to reproduce the issue

```console
$ spack spec -I <spec>
Input spec
--------------------------------
 -   nettle

Concretized
--------------------------------
 -   nettle@3.9.1%gcc@9.2.0 build_system=autotools arch=linux-centos7-x86_64
[+]      ^gmake@4.4.1%gcc@9.2.0~guile build_system=generic arch=linux-centos7-x86_64
[+]      ^gmp@6.2.1%gcc@9.2.0+cxx build_system=autotools libs=shared,static patches=69ad2e2 arch=linux-centos7-x86_64
[+]          ^autoconf@2.69%gcc@9.2.0 build_system=autotools patches=35c4492,7793209,a49dd5b arch=linux-centos7-x86_64
[+]              ^perl@5.38.0%gcc@9.2.0+cpanm+opcode+open+shared+threads build_system=generic patches=714e4d1 arch=linux-centos7-x86_64
[+]                  ^berkeley-db@18.1.40%gcc@9.2.0+cxx~docs+stl build_system=autotools patches=26090f4,b231fcc arch=linux-centos7-x86_64
[+]                  ^bzip2@1.0.8%gcc@9.2.0~debug~pic+shared build_system=generic arch=linux-centos7-x86_64
[+]                  ^gdbm@1.23%gcc@9.2.0 build_system=autotools arch=linux-centos7-x86_64
[+]                      ^readline@8.2%gcc@9.2.0 build_system=autotools patches=bbf97f1 arch=linux-centos7-x86_64
[+]                          ^ncurses@6.4%gcc@9.2.0~symlinks+termlib abi=none build_system=autotools arch=linux-centos7-x86_64
[+]                              ^pkgconf@1.9.5%gcc@9.2.0 build_system=autotools arch=linux-centos7-x86_64
[+]                  ^zlib-ng@2.1.4%gcc@9.2.0+compat+opt build_system=autotools arch=linux-centos7-x86_64
[+]          ^automake@1.16.5%gcc@9.2.0 build_system=autotools arch=linux-centos7-x86_64
[+]          ^libtool@2.4.7%gcc@9.2.0 build_system=autotools arch=linux-centos7-x86_64
[+]      ^m4@1.4.19%gcc@9.2.0+sigsegv build_system=autotools patches=9dc5fbd,bfdffa7 arch=linux-centos7-x86_64
[+]          ^diffutils@3.9%gcc@9.2.0 build_system=autotools arch=linux-centos7-x86_64
[+]              ^libiconv@1.17%gcc@9.2.0 build_system=autotools libs=shared,static arch=linux-centos7-x86_64
[+]          ^libsigsegv@2.14%gcc@9.2.0 build_system=autotools arch=linux-centos7-x86_64
```


### Error message

<details><summary>Error message</summary>

<pre>
==> nettle: Executing phase: 'build'
==> Error: ProcessError: Command exited with status 2:
    'make' '-j16' 'V=1'
...
     1151    nettle-openssl.o: In function `openssl_md5_init':
  >> 1152    /localData/000scratch/rowanw/spack-stage/spack-stage-nettle-3.9.1-bv6yy4efn7x73ybk5at6bly7tplvvul
             5/spack-src/examples/nettle-openssl.c:408: undefined reference to `EVP_MD_CTX_new'
     1153    nettle-openssl.o: In function `openssl_sha1_init':
  >> 1154    /localData/000scratch/rowanw/spack-stage/spack-stage-nettle-3.9.1-bv6yy4efn7x73ybk5at6bly7tplvvul
             5/spack-src/examples/nettle-openssl.c:409: undefined reference to `EVP_MD_CTX_new'
  >> 1155    collect2: error: ld returned 1 exit status
  >> 1156    make[1]: *** [Makefile:100: nettle-benchmark] Error 1
</pre></details>


### Information on your system

* **Spack:** 0.21.0 (c35700db51bfc673798643697df3ef0e8a5177f1)
* **Python:** 3.8.18
* **Platform:** linux-centos7-ivybridge
* **Concretizer:** clingo

### Additional information

A [quick google](https://stackoverflow.com/questions/46768071/openssl-linking-undefined-reference-evp-md-ctx-new-and-fre) of the error message suggests this is due to linking against an old openssl version, which checks out as I'm running on centos 7 and the default system libcrypto does not include the missing symbol while a newer version does:

```
$ ls -al /lib64/libcrypto.so
lrwxrwxrwx 1 root root 19 Apr 11  2023 /lib64/libcrypto.so -> libcrypto.so.1.0.2k

$ nm --dynamic /lib64/libcrypto.so.1.0.2k |grep EVP_MD_CTX_new

$ nm --dynamic /lib64/libcrypto.so.1.1.1k |grep EVP_MD_CTX_new
000000000015be20 T EVP_MD_CTX_new
```

Obviously spack shouldn't be relying on the system library; the nettle package doesn't specify any kind of dependency on openssl so that seems like a bug.

### General information

- [X] I have run `spack debug report` and reported the version of Spack/Python/Platform
- [X] I have run `spack maintainers <name-of-the-package>` and **@mentioned** any maintainers
- [X] I have uploaded the build log and environment files
- [X] I have searched the issues of this repo and believe this is not a duplicate


Discussion:
Based on the stackoverflow question I made this patch to nettle's package.py, which resolved the build issue (using `openssl@3.1.3` previously installed in my spack environment):

```
diff --git a/var/spack/repos/builtin/packages/nettle/package.py b/var/spack/repos/builtin/packages/nettle/package.py
index b00ad89381..5230fae45d 100644
--- a/var/spack/repos/builtin/packages/nettle/package.py
+++ b/var/spack/repos/builtin/packages/nettle/package.py
@@ -24,6 +24,7 @@ class Nettle(AutotoolsPackage, GNUMirrorPackage):
 
     depends_on("gmp")
     depends_on("m4", type="build")
+    depends_on("openssl@1.1.0:")
 
     def configure_args(self):
         return ["CFLAGS={0}".format(self.compiler.c99_flag)]
```

Also tried `depends_on("openssl@1.1.0:", type="build")` but that was not sufficient. I didn't investigate whether nettle has configuration parameters which would make this dependency conditional.
From the configure script it looks like openssl can be disabled, but seems like it still compiles `nettle-openssl.c`.

Resolving patch:
diff --git a/var/spack/repos/builtin/packages/nettle/package.py b/var/spack/repos/builtin/packages/nettle/package.py
--- a/var/spack/repos/builtin/packages/nettle/package.py
+++ b/var/spack/repos/builtin/packages/nettle/package.py
@@ -26,7 +26,11 @@ class Nettle(AutotoolsPackage, GNUMirrorPackage):
 
     depends_on("gmp")
     depends_on("m4", type="build")
-    depends_on("openssl")
+
+    def flag_handler(self, name, flags):
+        if name == "cflags":
+            flags.append(self.compiler.c99_flag)
+        return (flags, None, None)
 
     def configure_args(self):
-        return ["CFLAGS={0}".format(self.compiler.c99_flag)]
+        return ["--disable-openssl"]


Test patch: