Added LibreSSL as an alternative to OpenSSL. Needs more testing! (0.38.16)

docs/README.md

@@ -21,7 +21,7 @@ This file serves as an index of the documents in this directory. Links are relat
 
 ## New and supplemental guides
 
-- [build.md](./build.md) - How to build Fun with CMake, available targets, and build options (FUN_DEBUG, FUN_USE_MUSL, FUN_WITH_CPP, FUN_WITH_RUST, FUN_WITH_OPENSSL).
+- [build.md](./build.md) - How to build Fun with CMake, available targets, and build options (FUN_DEBUG, FUN_USE_MUSL, FUN_WITH_CPP, FUN_WITH_RUST, FUN_WITH_OPENSSL, FUN_WITH_LIBRESSL).
 - [cli.md](./cli.md) - Command-line usage of the `fun` executable: synopsis, options, exit codes, includes and library paths.
 - [contributing.md](./contributing.md) - How to contribute: project structure, coding style, running tests, and PR guidelines.
 - [style-guide.md](./style-guide.md) - Coding conventions for C and Fun (indentation, naming, idioms).
@@ -40,10 +40,12 @@ This file serves as an index of the documents in this directory. Links are relat
 Documentation for optional, build-time selectable integrations lives in [external/](./external/):
 
 - [Index of extensions](./external/README.md)
- - Highlights: [cURL](./external/curl.md), [INI](./external/ini.md), [JSON](./external/json.md), [XML (libxml2)](./external/xml2.md), [SQLite](./external/sqlite.md), [libSQL](./external/libsql.md), [PCRE2](./external/pcre2.md), [PC/SC](./external/pcsc.md), [Notcurses](./external/notcurses.md), [Tcl/Tk](./external/tcltk.md), [OpenSSL](./external/openssl.md)
+ - Highlights: [cURL](./external/curl.md), [INI](./external/ini.md), [JSON](./external/json.md), [XML (libxml2)](./external/xml2.md), [SQLite](./external/sqlite.md), [libSQL](./external/libsql.md), [PCRE2](./external/pcre2.md), [PC/SC](./external/pcsc.md), [Notcurses](./external/notcurses.md), [Tcl/Tk](./external/tcltk.md), [OpenSSL](./external/openssl.md), [LibreSSL](./external/libressl.md)
 
 ## Tips
 
 - When building from the repo without installing, set `FUN_LIB_DIR` to the local `./lib` directory so examples and the REPL can locate the stdlib.
 - For a broader project overview and quickstart, see the repository root [README.md](../README.md).
-- Crypto example: if built with `-DFUN_WITH_OPENSSL=ON`, try `examples/crypto/openssl_md5.fun` to compute MD5 using OpenSSL.
+- Crypto examples:
+  - If built with `-DFUN_WITH_OPENSSL=ON`, try `examples/crypto/openssl_md5.fun`.
+  - If built with `-DFUN_WITH_LIBRESSL=ON`, try `examples/crypto/libressl_md5.fun`.

docs/build.md

@@ -23,6 +23,7 @@ Fun exposes several options you can toggle at configure time:
 - `FUN_WITH_CPP` (ON/OFF) - Enable C++-based opcode/examples support
 - `FUN_WITH_RUST` (ON/OFF) - Build and link Rust staticlib from `src/rust/`
 - `FUN_WITH_OPENSSL` (ON/OFF) - Enable OpenSSL-backed helpers (MD5/SHA-256/SHA-512/RIPEMD-160)
+ - `FUN_WITH_LIBRESSL` (ON/OFF) - Enable LibreSSL-backed helpers (MD5/SHA-256/SHA-512/RIPEMD-160)
 
 When configuring, the build prints a summary like:
 
@@ -55,13 +56,13 @@ cmake --build build_release --target build
 ### Enabling optional extensions
 ```
 cmake -S . -B build_release -DCMAKE_BUILD_TYPE=Release \
-  -DFUN_WITH_CPP=ON -DFUN_WITH_RUST=ON -DFUN_WITH_OPENSSL=ON
+  -DFUN_WITH_CPP=ON -DFUN_WITH_RUST=ON -DFUN_WITH_OPENSSL=ON -DFUN_WITH_LIBRESSL=ON
 cmake --build build_release --target build
 ```
 
 If `FUN_WITH_RUST` is enabled, ensure `cargo` is available in PATH; the build will invoke it and link the produced static library.
 
-If `FUN_WITH_OPENSSL` is enabled, CMake must detect your system OpenSSL. Hash helpers use the EVP interface (OpenSSL 3-compatible). Note: RIPEMD-160 may require the legacy provider on OpenSSL 3.x; if unavailable, the helper returns an empty string.
+If `FUN_WITH_OPENSSL` is enabled, CMake must detect your system OpenSSL (libcrypto). If `FUN_WITH_LIBRESSL` is enabled, CMake detects LibreSSL directly (via pkg-config or standard include/lib locations) and links to LibreSSL’s `libcrypto` — no OpenSSL installation is required. Both extensions use the EVP interface. Note: On OpenSSL 3.x, RIPEMD-160 may require the legacy provider; if unavailable, the helper returns an empty string.
 
 ## Running
 - CLI: run the `fun` executable from your build directory.

docs/external/README.md

@@ -6,7 +6,7 @@ This section documents Fun’s optional, build‑time selectable extensions. Eac
 - Available opcodes and/or helper functions
 - Minimal usage examples and links to example scripts
 
-Extensions:
+## Extensions:
 
 - [cURL (libcurl)](./curl.md)
 - [INI (iniparser)](./ini.md)
@@ -19,7 +19,9 @@ Extensions:
 - [Notcurses (TUI)](./notcurses.md)
 - [Tcl/Tk (GUI)](./tcltk.md)
 - [OpenSSL](./openssl.md)
+- [LibreSSL](./libressl.md)
+
+## Notes:
 
-Notes:
 - These integrations are optional; the VM compiles without them.
 - When disabled, related builtins usually return empty strings/neutral values rather than fail hard, mirroring existing optionality patterns.

docs/external/curl.md

@@ -4,11 +4,13 @@
 - Purpose: HTTP helpers using libcurl.
 - Homepage: https://curl.se/libcurl/
 
-Opcodes:
+## Opcodes:
+
 - OP_CURL_GET: GET; pops url:string; pushes body:string (empty on error/disabled)
 - OP_CURL_POST: POST; pops body:string, url:string; pushes response:string
 - OP_CURL_DOWNLOAD: Download to file; pops path:string, url:string; pushes 1/0
 
-Notes:
+## Notes:
+
 - Requires libcurl development headers/libs.
 - When disabled, helpers return empty strings/0 to match optional behavior.

docs/external/ini.md

@@ -4,7 +4,8 @@
 - Purpose: Read/write simple INI configuration files.
 - Homepage: https://github.com/ndevilla/iniparser
 
-Opcodes:
+## Opcodes:
+
 - OP_INI_LOAD: pops path; pushes handle (>0) or 0
 - OP_INI_FREE: pops handle; pushes 1/0
 - OP_INI_GET_STRING: pops def, key, section, handle; pushes string
@@ -15,6 +16,7 @@ Opcodes:
 - OP_INI_UNSET: pops key, section, handle; pushes 1/0
 - OP_INI_SAVE: pops path, handle; pushes 1/0
 
-Notes:
+## Notes:
+
 - Requires iniparser development headers/libs.
 - When disabled, helpers return neutral values (0/empty strings) like other optional extensions.

docs/external/json.md

@@ -4,12 +4,14 @@
 - Purpose: JSON parse/stringify and file helpers via json-c.
 - Homepage: https://json-c.github.io/json-c/
 
-Opcodes:
+## Opcodes:
+
 - OP_JSON_PARSE: pops text; pushes value or Nil on error
 - OP_JSON_STRINGIFY: pops pretty:int(0/1), value; pushes string
 - OP_JSON_FROM_FILE: pops path; pushes value or Nil
 - OP_JSON_TO_FILE: pops pretty:int(0/1), value, path; pushes 1/0
 
-Notes:
+## Notes:
+
 - Requires json-c development headers/libs.
 - When disabled, functions push empty/neutral values similar to other optional modules.

docs/external/libressl.md

@@ -0,0 +1,45 @@
+# LibreSSL extension (optional)
+
+- CMake option: FUN_WITH_LIBRESSL=ON
+- Purpose: provide small crypto helpers backed by LibreSSL’s libcrypto. Includes md5, sha256, sha512, ripemd160 helpers under libressl_* names.
+- Homepage: https://www.libressl.org/
+
+## Build notes:
+
+- Requires system LibreSSL development headers and libcrypto. The build detects LibreSSL directly (via pkg-config or standard include/lib locations) and links to libcrypto from LibreSSL — it does not require OpenSSL to be installed.
+- When disabled, the builtins below evaluate to empty strings to mirror optionality behavior across extensions.
+
+## Provided helper functions/opcodes:
+
+- Function: libressl_md5(data:string) -> string (lowercase hex).
+- Function: libressl_sha256(data:string) -> string (lowercase hex).
+- Function: libressl_sha512(data:string) -> string (lowercase hex).
+- Function: libressl_ripemd160(data:string) -> string (lowercase hex).
+- Opcodes: OP_LIBRESSL_MD5, OP_LIBRESSL_SHA256, OP_LIBRESSL_SHA512, OP_LIBRESSL_RIPEMD160 (internal mappings for the functions above).
+
+## Quickstart:
+
+- Configure: `cmake -S . -B build -DFUN_WITH_LIBRESSL=ON`
+- Build: `cmake --build build --target fun`
+- Run examples:
+  - `./build/fun examples/crypto/libressl_md5.fun`
+  - `./build/fun examples/crypto/libressl_sha256.fun`
+  - `./build/fun examples/crypto/libressl_sha512.fun`
+  - `./build/fun examples/crypto/libressl_ripemd160.fun`
+
+## Example output:
+
+- md5(abc) = 900150983cd24fb0d6963f7d28e17f72
+- md5("") = d41d8cd98f00b204e9800998ecf8427e
+- sha256(abc) = ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad
+- sha256("") = e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
+- sha512(abc) = ddaf35a193617abacc417349ae20413112e6fa4e89a97ea20a9eeee64b55d39a2192992a274fc1a836ba3c23a3feebbd454d4423643ce80e2a9ac94fa54ca49f
+- sha512("") = cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
+- ripemd160(abc) = 8eb208f7e05d987a9b044a8e98c6b087f15a0bfc
+- ripemd160("") = 9c1185a5c5e9fc54612808977ee8f548b2258d31
+
+## Notes:
+
+- The functions accept any Fun value; non-strings are coerced via `to_string` semantics by the VM before hashing.
+- On some platforms, RIPEMD-160 may not be available; in that case the helper returns an empty string.
+- If your system installs LibreSSL headers under `/usr/include/libressl`, CMake will automatically add this directory to the include path so that `#include <libressl/openssl/...>` resolves correctly.

docs/external/libsql.md

@@ -4,12 +4,14 @@
 - Purpose: SQLite-compatible client using the libSQL (Turso) library.
 - Homepage: https://libsql.org/
 
-Opcodes:
+## Opcodes:
+
 - OP_LIBSQL_OPEN: pops url_or_path; pushes handle (>0) or 0
 - OP_LIBSQL_CLOSE: pops handle; pushes Nil
 - OP_LIBSQL_EXEC: pops sql, handle; pushes rc:int (0=OK)
 - OP_LIBSQL_QUERY: pops sql, handle; pushes array<map>
 
-Notes:
+## Notes:
+
 - Uses a SQLite-compatible C API provided by libSQL; behavior is similar to the SQLite backend.
 - This module is independent from the SQLite extension; you may enable either or both.

docs/external/notcurses.md

@@ -4,13 +4,15 @@
 - Purpose: Terminal UI capabilities via the Notcurses library.
 - Homepage: https://notcurses.com/
 
-Opcodes:
+## Opcodes:
+
 - OP_NC_INIT: initialize Notcurses; returns 1 on success, 0 on failure
 - OP_NC_SHUTDOWN: shutdown; returns 0
 - OP_NC_CLEAR: clear screen/plane; returns 0
 - OP_NC_DRAW_TEXT: pops text, x, y; draws; returns 0
 - OP_NC_GETCH: pops timeout_ms; returns codepoint or -1 on timeout/error
 
-Notes:
+## Notes:
+
 - Requires Notcurses development headers/libs.
 - Behavior may vary across terminals; see the implementation for details.

docs/external/openssl.md

@@ -4,18 +4,21 @@
 - Purpose: provide small crypto helpers backed by OpenSSL. Includes md5, sha256, sha512, ripemd160 helpers.
 - Homepage: https://www.openssl.org/
 
-Build notes:
+## Build notes:
+
 - Requires system OpenSSL development headers and libraries.
 - On OpenSSL 3.x, legacy MD5_* APIs are deprecated; you may see warnings during build.
 
-Provided helper/opcodes:
+## Provided helper/opcodes:
+
 - Function: openssl_md5(data:string) -> string (lowercase hex). Falls back to empty string when the extension is disabled, mirroring other optional modules.
 - Function: openssl_sha256(data:string) -> string (lowercase hex).
 - Function: openssl_sha512(data:string) -> string (lowercase hex).
 - Function: openssl_ripemd160(data:string) -> string (lowercase hex). Note: On OpenSSL 3.x this may require the legacy provider; if the digest is unavailable, the helper returns an empty string.
 - Opcodes: OP_OPENSSL_MD5, OP_OPENSSL_SHA256, OP_OPENSSL_SHA512, OP_OPENSSL_RIPEMD160 (internal mappings for the functions above).
 
-Quickstart:
+## Quickstart:
+
 - Configure: cmake -S . -B build -DFUN_WITH_OPENSSL=ON
 - Build: cmake --build build --target fun
 - Run examples:
@@ -24,15 +27,17 @@ Quickstart:
   - ./build/fun examples/crypto/openssl_sha512.fun
   - ./build/fun examples/crypto/openssl_ripemd160.fun
 
-Example output:
+## Example output:
+
 - md5(abc) = 900150983cd24fb0d6963f7d28e17f72
 - md5("") = d41d8cd98f00b204e9800998ecf8427e
 - sha256(abc) = ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad
 - sha256("") = e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
 - sha512(abc) = ddaf35a193617abacc417349ae20413112e6fa4e89a97ea20a9eeee64b55d39a2192992a274fc1a836ba3c23a3feebbd454d4423643ce80e2a9ac94fa54ca49f
 - sha512("") = cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
- - ripemd160(abc) = 8eb208f7e05d987a9b044a8e98c6b087f15a0bfc
- - ripemd160("") = 9c1185a5c5e9fc54612808977ee8f548b2258d31
+- ripemd160(abc) = 8eb208f7e05d987a9b044a8e98c6b087f15a0bfc
+- ripemd160("") = 9c1185a5c5e9fc54612808977ee8f548b2258d31
+
+## Notes:
 
-Notes:
 - The OpenSSL 3.x provider configuration on your system determines availability of RIPEMD‑160. If the legacy provider is not enabled, openssl_ripemd160() will return an empty string.

docs/external/pcre2.md

@@ -4,11 +4,13 @@
 - Purpose: Advanced regular expressions via PCRE2.
 - Homepage: https://www.pcre.org/
 
-Opcodes:
+## Opcodes:
+
 - OP_PCRE2_TEST: pops flags, text, pattern; pushes 1/0
 - OP_PCRE2_MATCH: pops flags, text, pattern; pushes match map or Nil
 - OP_PCRE2_FINDALL: pops flags, text, pattern; pushes array of match maps
 
-Notes:
+## Notes:
+
 - Requires PCRE2 development headers/libs.
 - Flags are backend-specific; see implementation for supported bits.

docs/external/pcsc.md

@@ -4,7 +4,8 @@
 - Purpose: Access smart card readers/cards via PC/SC (pcsclite).
 - Homepage: https://pcsclite.apdu.fr/
 
-Opcodes:
+## Opcodes:
+
 - OP_PCSC_ESTABLISH: returns context id (>0) or 0
 - OP_PCSC_RELEASE: pops ctx id; returns 1/0
 - OP_PCSC_LIST_READERS: pops ctx id; returns array of reader names
@@ -12,6 +13,7 @@ Opcodes:
 - OP_PCSC_DISCONNECT: pops handle id; returns 1/0
 - OP_PCSC_TRANSMIT: pops apdu, handle id; returns map with data/SW/rc
 
-Notes:
+## Notes:
+
 - Requires PC/SC lite development headers/libs.
 - Behavior and availability depend on platform and reader drivers.

docs/external/sqlite.md

@@ -4,12 +4,14 @@
 - Purpose: Access SQLite databases via the native C API.
 - Homepage: https://www.sqlite.org/
 
-Opcodes:
+## Opcodes:
+
 - OP_SQLITE_OPEN: pops path; pushes handle (>0) or 0
 - OP_SQLITE_CLOSE: pops handle; pushes Nil
 - OP_SQLITE_EXEC: pops sql, handle; pushes rc:int (0=OK)
 - OP_SQLITE_QUERY: pops sql, handle; pushes array<map>
 
-Notes:
+## Notes:
+
 - Requires SQLite development headers/libs.
 - See also: `libSQL` for a compatible alternative backend.

docs/external/tcltk.md

@@ -1,8 +1,11 @@
 # Tcl/Tk (GUI) extension (optional)
+
 - CMake option: FUN_WITH_TCLTK=ON
 - Purpose: Basic GUI functionality via Tcl/Tk.
 - Homepage: https://www.tcl.tk/
-Opcodes:
+
+## Opcodes:
+
 - OP_TK_EVAL: pops script string; pushes rc (0=OK)
 - OP_TK_RESULT: pushes last Tcl result string
 - OP_TK_LOOP: enters main event loop; pushes Nil when done
@@ -11,6 +14,8 @@ Opcodes:
 - OP_TK_BUTTON: pops text, id; creates/updates button .id; pushes rc
 - OP_TK_PACK: pops id; packs .id; pushes rc
 - OP_TK_BIND: pops command, event, id; binds; pushes rc
-Notes:
+
+## Notes:
+
 - Requires Tcl/Tk development headers/libs.
 - GUI behavior depends on your desktop environment/window manager.

docs/external/xml2.md

@@ -4,12 +4,14 @@
 - Purpose: Minimal XML parsing helpers using libxml2.
 - Homepage: http://xmlsoft.org/
 
-Opcodes:
+## Opcodes:
+
 - OP_XML_PARSE: pops text; pushes doc handle (>0) or 0
 - OP_XML_ROOT: pops doc handle; pushes node handle (>0) or 0
 - OP_XML_NAME: pops node handle; pushes string (node name)
 - OP_XML_TEXT: pops node handle; pushes string (concatenated text)
 
-Notes:
+## Notes:
+
 - Requires libxml2 development headers/libs.
 - On many systems, the include path is `/usr/include/libxml2`.

docs/internals.md

@@ -80,7 +80,7 @@ The interpreter loop lives in src/vm.c: vm_run. Opcodes are executed in a tight
 Opcode handlers organization:
 - To keep vm.c readable, most opcode implementations are factored into small .c files included directly into vm.c (e.g., vm/core/load_const.c, vm/logic/and.c, vm/arrays/push.c, vm/math/abs.c, vm/os/thread_spawn.c, etc.).
 - This is a deliberate “amalgamation” style: small single‑purpose C units compiled as part of vm.c.
-- Optional subsystems (JSON, PCRE2, CURL, SQLite, libSQL, PC/SC, XML2, Tcl/Tk, Notcurses, INI, sockets, serial, OS helpers) are grouped under src/external and src/vm/<domain>/.
+- Optional subsystems (JSON, PCRE2, CURL, SQLite, libSQL, PC/SC, XML2, Tcl/Tk, Notcurses, INI, OpenSSL/LibreSSL crypto helpers, sockets, serial, OS helpers) are grouped under src/external and src/vm/<domain>/.
 
 Dispatch naming and visibility:
 - Human‑readable names for opcodes live in vm.h: opcode_names[]. These are used in debug prints and error messages.
@@ -117,7 +117,7 @@ The VM is dynamically typed. Values carry a tag; operations check types at runti
 - Maps: OP_MAKE_MAP/KEYS/VALUES/HAS_KEY.
 - Conversions/reflection: OP_TO_NUMBER/TO_STRING/CAST/TYPEOF, OP_UCLAMP/SCLAMP.
 - I/O and OS: OP_READ_FILE/WRITE_FILE/INPUT_LINE/ENV/PROC_RUN/PROC_SYSTEM/TIME_NOW_MS/CLOCK_MONO_MS/DATE_FORMAT/OS_LIST_DIR/RANDOM_NUMBER, sockets, serial.
-- External integrations (optional): JSON, CURL, SQLite, libSQL, PC/SC, XML2, Tcl/Tk, Notcurses, INI.
+- External integrations (optional): JSON, CURL, SQLite, libSQL, PC/SC, XML2, Tcl/Tk, Notcurses, INI, OpenSSL/LibreSSL.
 
 Each handler enforces argument types and returns clear error messages via vm_raise_error on misuse.