Patch for Python 3.6.3 to use a custom static OpenSSL

python-3.6.3-custom-static-openssl.patch

diff -ruN Python-3.6.3.orig/setup.py Python-3.6.3.new/setup.py
--- Python-3.6.3.orig/setup.py	2017-10-02 22:52:02.000000000 -0700
+++ Python-3.6.3.new/setup.py	2017-11-16 13:35:45.000000000 -0800
@@ -811,10 +811,15 @@
         exts.append( Extension('_socket', ['socketmodule.c'],
                                depends = ['socketmodule.h']) )
         # Detect SSL support for the socket module (via _ssl)
+        openssl_root = os.getenv('OPENSSL_ROOT')
+
         search_for_ssl_incs_in = [
                               '/usr/local/ssl/include',
                               '/usr/contrib/ssl/include/'
                              ]
+        if openssl_root is not None:
+            search_for_ssl_incs_in.insert(0, os.path.join(openssl_root, 'include'))
+
         ssl_incs = find_file('openssl/ssl.h', inc_dirs,
                              search_for_ssl_incs_in
                              )
@@ -827,14 +832,25 @@
                                      ['/usr/local/ssl/lib',
                                       '/usr/contrib/ssl/lib/'
                                      ] )
+        if openssl_root is not None:
+            ssl_libs.insert(0, os.path.join(openssl_root, 'lib'))
 
         if (ssl_incs is not None and
             ssl_libs is not None):
-            exts.append( Extension('_ssl', ['_ssl.c'],
-                                   include_dirs = ssl_incs,
-                                   library_dirs = ssl_libs,
-                                   libraries = ['ssl', 'crypto'],
-                                   depends = ['socketmodule.h']), )
+            if openssl_root is not None:
+                exts.append( Extension('_ssl', ['_ssl.c'],
+                                       include_dirs = ssl_incs,
+                                       library_dirs = [],
+                                       libraries = [],
+                                       extra_link_args = [ os.path.join(openssl_root, 'lib/libssl.a'),
+                                                           os.path.join(openssl_root, 'lib/libcrypto.a'), '-ldl' ],
+                                       depends = ['socketmodule.h']))
+            else:
+                exts.append( Extension('_ssl', ['_ssl.c'],
+                                       include_dirs = ssl_incs,
+                                       library_dirs = ssl_libs,
+                                       libraries = ['ssl', 'crypto'],
+                                       depends = ['socketmodule.h']))
         else:
             missing.append('_ssl')
 
@@ -870,11 +886,18 @@
             if have_usable_openssl:
                 # The _hashlib module wraps optimized implementations
                 # of hash functions from the OpenSSL library.
-                exts.append( Extension('_hashlib', ['_hashopenssl.c'],
-                                       depends = ['hashlib.h'],
-                                       include_dirs = ssl_incs,
-                                       library_dirs = ssl_libs,
-                                       libraries = ['ssl', 'crypto']) )
+                if openssl_root is not None:
+                    exts.append( Extension('_hashlib', ['_hashopenssl.c'],
+                                           include_dirs = ssl_incs,
+                                           library_dirs = [],
+                                           libraries = [],
+                                           extra_link_args = [ os.path.join(openssl_root, 'lib/libssl.a'),
+                                                               os.path.join(openssl_root, 'lib/libcrypto.a'), '-ldl' ]))
+                else:
+                    exts.append( Extension('_hashlib', ['_hashopenssl.c'],
+                                           include_dirs = ssl_incs,
+                                           library_dirs = ssl_libs,
+                                           libraries = ['ssl', 'crypto']))
             else:
                 print("warning: openssl 0x%08x is too old for _hashlib" %
                       openssl_ver)

Patch for 3.6.8:

https://gist.github.com/4b85ca18babb03b05499787033d43eed.git