binaries: don't bundle libssl

ArchiverTestCaseBinary passes.

docs/internals/security.rst

@@ -355,11 +355,9 @@ updates.
 
 OpenSSL is a large and complex piece of software and has had its share of vulnerabilities,
 however, it is important to note that Borg links against ``libcrypto`` **not** ``libssl``.
-libcrypto is the low-level cryptography part of OpenSSL, while libssl implements TLS and related protocols.
-The latter is not used by Borg (cf. `Remote RPC protocol security`_, Borg does not implement
+libcrypto is the low-level cryptography part of OpenSSL,
+while libssl implements TLS and related protocols.
+
+The latter is not used by Borg (cf. `Remote RPC protocol security`_, Borg itself does not implement
 any network access) and historically contained most vulnerabilities, especially critical ones.
-
-Historic vulnerabilities affecting libcrypto in ways relevant to Borg were flaws in primtives
-enabling side-channel and similar attacks.
-
-Therefore, both using and bundling OpenSSL is considered unproblematic for Borg.
+The static binaries released by the project contain neither libssl nor the Python ssl/_ssl modules.

scripts/borg.exe.spec

@@ -16,7 +16,9 @@ a = Analysis([os.path.join(basepath, 'src/borg/__main__.py'), ],
              hiddenimports=['borg.platform.posix'],
              hookspath=[],
              runtime_hooks=[],
-             excludes=[],
+             excludes=[
+                '_ssl', 'ssl',
+             ],
              win_no_prefer_redirects=False,
              win_private_assemblies=False,
              cipher=block_cipher)
@@ -38,3 +40,16 @@ exe = EXE(pyz,
           strip=False,
           upx=True,
           console=True )
+
+if False:
+    # Enable this block to build a directory-based binary instead of
+    # a packed single file. This allows to easily look at all included
+    # files (e.g. without having to strace or halt the built binary
+    # and introspect /tmp).
+    coll = COLLECT(exe,
+                   a.binaries,
+                   a.zipfiles,
+                   a.datas,
+                   strip=False,
+                   upx=True,
+                   name='borg-dir')