cmd/checkheader erroneously passes with OpenSSL 1.0.2 headers

[corhere]

The header openssl/kdf.h was first added in OpenSSL 1.1.0. It does not exist in OpenSSL 1.0.2. Despite shims.h referencing the aforementioned header, checkheader 1.0.2 passes in CI.

openssl/shims.h

Line 41 in e35c1eb

// #include <openssl/kdf.h>

Expected:

/var/folders/8p/tzn5bkn967vfgttpr2d2kpjm0000gq/T/go-crypto-openssl-4068040127.c:53:10: fatal error: 'openssl/kdf.h' file not found
#include <openssl/kdf.h>
         ^~~~~~~~~~~~~~~
1 error generated.
2023/08/03 19:29:24 exit status 1
exit status 1

I can reproduce the spurious passing check on an Ubuntu 20.04 box with the libssl-dev package (OpenSSL 1.1.1) installed. Presumably the GHA runner image is the same.

Inserting the ossl-include directory at the top of the include search path list is not sufficient to exclude the system OpenSSL headers from being resolved as a fallback.