anchor.diff:      --with-http_v2_module \
       --with-http_gzip_static_module \
       --with-http_stub_status_module \
  -    --with-openssl=/tmp/libressl-${LIBRESSL_VERSION} \
  +    --with-openssl=/tmp/openssl-${OPENSSL_VERSION} \
  +    --with-openssl-opt='no-ssl2 no-ssl3 no-camellia no-dsa no-rc2 no-rc4 no-rc5 no-md2 no-md4 no-krb5 no-comp no-idea no-shared enable-ec_nistp_64_gcc_128 -DOPENSSL_NO_HEARTBEATS -fstack-protector-strong' \
       --with-cc-opt='-g -O2 -fstack-protector-strong -Wformat -Werror=format-security' \
  -    --with-ld-opt="-lrt" \
  +    --with-ld-opt='-lrt' \
       --with-file-aio \
       --with-threads \
       --without-http_ssi_module \
  
positive.code: FROM alpine:3.3
  MAINTAINER Wonderfall <wonderfall@mondedie.fr>
  
  ARG NGINX_VERSION=1.11.0
  ARG LIBRESSL_VERSION=2.3.4
  ARG SIGNATURE=secret
  ARG BUILD_CORES
  
  ARG GPG_brent="A1EB 079B 8D3E B92B 4EBD  3139 663A F51B D5E4 D8D5"
  ARG GPG_mdounin="B0F4 2533 73F8 F6F5 10D4  2178 520A 9993 A1C0 52F8"
  
  ENV UID=991 GID=991
  
negative.code:  && mkdir /tmp/ngx_brotli && cd /tmp/ngx_brotli \
   && wget -qO- https://github.com/google/ngx_brotli/archive/master.tar.gz | tar xz --strip 1 \
   && cd /tmp \
   && OPENSSL_TARBALL="openssl-${OPENSSL_VERSION}.tar.gz" \
   && wget -q https://www.openssl.org/source/${OPENSSL_TARBALL} \
   && echo "Verifying both integrity and authenticity of ${OPENSLL_TARBALL} using GPG..." \
   && wget -q https://www.openssl.org/source/${OPENSSL_TARBALL}.asc \
   && wget -q https://www.openssl.org/source/${OPENSSL_TARBALL}.sha256 \
   && echo "$(cat ${OPENSSL_TARBALL}.sha256)  ${OPENSSL_TARBALL}" > ${OPENSSL_TARBALL}.sha256 \
   && CHECKSUM_STATE=$(echo -n $(sha256sum -c ${OPENSSL_TARBALL}.sha256) | tail -c 2) \
   && if [ "${CHECKSUM_STATE}" != "OK" ]; then echo "Warning! Checksum does not match!" && exit 1; fi \
   && gpg --recv-keys 0E604491 \
   && FINGERPRINT="$(LANG=C gpg --verify ${OPENSSL_TARBALL}.asc ${OPENSSL_TARBALL} 2>&1 \
    | sed -n "s#Primary key fingerprint: \(.*\)#\1#p")" \
   && if [ -z "${FINGERPRINT}" ]; then echo "Warning! Invalid GPG signature!" && exit 1; fi \
   && if [ "${FINGERPRINT}" != "${GPG_matt}" ]; then echo "Warning! Wrong GPG fingerprint!" && exit 1; fi \
   && echo "All seems good, now unpacking ${OPENSSL_TARBALL}..." \
   && tar xzf ${OPENSSL_TARBALL} && cd openssl-${OPENSSL_VERSION} \
   && wget https://raw.githubusercontent.com/cloudflare/sslconfig/master/patches/openssl__chacha20_poly1305_draft_and_rfc_ossl102g.patch -O chacha.patch \
   && patch -p1 < chacha.patch \
   && ./config \
   && cd /tmp \
   && NGINX_TARBALL="nginx-${NGINX_VERSION}.tar.gz" \
   && wget -q http://nginx.org/download/${NGINX_TARBALL} \
  