Also, it seems the only thing libgit2 uses openssl for is for the SHA1 hash. But there's also a builtin SHA1 hash in libgit2 under src/hash/hash_generic.c which we could use instead - should we?
It seems that Apple already deprecated OpenSSL so the support for libgit2 without OpenSSL should be fine. There's a check in CMakeFiles.txt for SHA1_TYPE=builtin . I'm not well-versed in cmake, however, so no idea how to set that. Also, USE_OPENSSL defaults to ON. That's an externally-visible option. I would know how to set that to OFF.
