Excellent!

Building...

Okay, I built it and committed all the files: 5df864d. I note a couple of things (possibly worrisome?):

• it builds msys-ssl-1.0.0.dll, not msys-ssl-1.0.1.dll as I would have expected... is this so that linked programs will still find it even if they were linked against 1.0.0?
• it also builds msys-crypto-1.0.0.dll, does that matter with regards to the crypt issue you mentioned in Upgrade OpenSSH 5.4p1 #221?
• despite the fact that we have a 1.2MB msys-crypto-1.0.0.dll and a 300KB msys-ssl-1.0.0.dll file that we did not have before, the openssl.exe binary increased size from ~550KB to 1MB... (It does not matter all that much because we use a MinGW OpenSSL for everything except ssh.exe, but still...)

Thank you for the build.

it builds msys-ssl-1.0.0.dll, not msys-ssl-1.0.1.dll as I would have expected... is this so that linked programs will still find it even if they were linked against 1.0.0?

Yes. It links against 1.0.0. OpenSSL would keep the versions that are binary compatible.
https://github.com/msysgit/msysgit/blob/msys/include/openssl/opensslv.h#L86

it also builds msys-crypto-1.0.0.dll, does that matter with regards to the crypt issue you mentioned in #221?

I mentioned that the following msys-crypt-0.dll is not needed.
https://github.com/msysgit/msysgit/blob/msys/src/crypt/release.sh

msys-crypto-1.0.0.dll from openssl is required.

the openssl.exe binary increased size from ~550KB to 1MB

Maybe gcc option -s is different.
https://gcc.gnu.org/onlinedocs/gcc-2.95.3/gcc_2.html#SEC13

-s
Remove all symbol table and relocation information from the executable.

I don't add -s as other packages and use default options because CFLAGS environment variable didn't used when compiling.
-s looks link option so adding -s to LDFLAGS may work.

Yes. It links against 1.0.0. OpenSSL would keep the versions that are binary compatible.

Thanks for the clarification!

I mentioned that the following msys-crypt-0.dll is not needed.
https://github.com/msysgit/msysgit/blob/msys/src/crypt/release.sh

msys-crypto-1.0.0.dll from openssl is required.

Ah, right, you mentioned that, but I missed something: crypt vs crypto. Such confusing naming!

Maybe gcc option -s is different.

I suspected that. Actually, I think it is okay because we might get more detailed information from bug reports that way (AFAIR -s strips out debug information, rendering stack traces pretty useless). OTOH you already opened a PR addressing this...

Thank you so much for all your work, and especially for educating me!