BLD/RLS: ensure wheels are including GDAL built with openssl

[jorisvandenbossche]

I am running into the issue that pyogrio (or geopandas with the pyogrio engine) cannot read a file from Google Cloud Storage.
I get intermittently either a DataSourceError: CPLRSASHA256Sign() not implemented: GDAL must be built against libcrypto++ or libcrypto (openssl) or DataSourceError: HTTP response code: 403.
This is specifically with the wheels (with conda it works), and using fiona it also works. The first error message seems to indicate we don't properly built with openssl, although vcpkg does install openssl. For the Fiona wheels (and the conda libgdal), I can verify with ldd that the libgdal.so included in the wheel is linking against libcrypto (which comes from openssl). For our own wheel I can't check that the same way because we statically link the gdal dependencies into libgdal.so.

Now, based on the fact that sometimes the message indicates GDAL is not built against libcrypto, I am assuming this is indeed the case.
Looking a bit further into this, the logs of building GDAL with vcpkg on CI clearly shows that vcpkg is also installing openssl. However, the vcpkg port of GDAL has an explicit "feature" for openssl (https://github.com/microsoft/vcpkg/blob/14542c8ad9b6bcb9da755884ab823605c3300b68/ports/gdal/vcpkg.json#L227-L232), and that we are not explicitly enabling. And while GDAL's cmake default is to built against OpenSSL if it is found (docs), I am assuming that vcpkg might override this default to disable GDAL_USE_OPENSSL if you don't explicitly enable the feature through the vcpkg install of gdal (https://github.com/microsoft/vcpkg/blob/14542c8ad9b6bcb9da755884ab823605c3300b68/ports/gdal/portfile.cmake#L47C26-L47C42, not entirely sure how vcpkg_check_features works).

So testing this hypothesis here by explicitly adding "openssl" as a vcpkg feature for gdal. I should be able to test the generated wheel. Although not entirely sure if we also have a way we can test this on CI.

[jorisvandenbossche]

And to be clear, the curl that is included in our wheels that gdal uses for other cloud interaction is built with openssl (as far as I can see in the logs (example log), at least), it's only for a few other things (like google cloud authorization) that GDAL needs itself to be directly built with openssl

[jorisvandenbossche]

And based on my comment at #161 (comment), we did correctly build with libcrypto in the past, but I assume because of how vcpkg refactored the gdal port to allow better selection of individual features, we accidentally lost that (that also means we could now remove the recommended-features to not include png and jpeg)

[jorisvandenbossche]

Great, this passes, and can confirm locally that with the built wheel from CI my test data can be read from GCS!

[brendan-ward]

Good catch! Thanks @jorisvandenbossche