From b999edb3448793529aea8b29c01b3851bbc3b3eb Mon Sep 17 00:00:00 2001
From: Mike McQuaid <mike@mikemcquaid.com>
Date: Thu, 28 Jul 2016 16:49:08 -0600
Subject: [PATCH] link: don't link /usr/local openssl.

See https://langui.sh/2015/07/24/osx-clang-include-lib-search-paths/ for
an explanation and https://gist.github.com/tdsmith/4b502c5cc6e7d358acdf
for reproduction instructions.
---
 Library/Homebrew/cmd/link.rb | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/Library/Homebrew/cmd/link.rb b/Library/Homebrew/cmd/link.rb
index f4ef16e8ad..d7ea2427ca 100644
--- a/Library/Homebrew/cmd/link.rb
+++ b/Library/Homebrew/cmd/link.rb
@@ -24,7 +24,16 @@ module Homebrew
     mode.dry_run = true if ARGV.dry_run?
 
     ARGV.kegs.each do |keg|
-      if keg.linked?
+      if HOMEBREW_PREFIX.to_s == "/usr/local" && keg.name == "openssl"
+        opoo <<-EOS.undent
+          Refusing to link: openssl
+          Linking keg-only OpenSSL means you may end up linking against the insecure,
+          deprecated system version while using the headers from the Homebrew version.
+          Instead, pass the full include/library paths to your compiler e.g.:
+            -I#{HOMEBREW_PREFIX}/opt/openssl/include -L#{HOMEBREW_PREFIX}/opt/openssl/lib
+        EOS
+        next
+      elsif keg.linked?
         opoo "Already linked: #{keg}"
         puts "To relink: brew unlink #{keg.name} && brew link #{keg.name}"
         next