openssl: Add static flag.

Its effect on `postInstall` is carefully written to not
cause recompilation in the default case.

pkgs/development/libraries/openssl/default.nix

@@ -3,6 +3,7 @@
 , fetchpatch
 , withCryptodev ? false, cryptodevHeaders
 , enableSSL2 ? false
+, static ? false
 }:
 
 with stdenv.lib;
@@ -62,7 +63,7 @@ let
     '';
 
     configureFlags = [
-      "shared"
+      "shared" # "shared" builds both shared and static libraries
       "--libdir=lib"
       "--openssldir=etc/ssl"
     ] ++ stdenv.lib.optionals withCryptodev [
@@ -75,13 +76,16 @@ let
 
     enableParallelBuilding = true;
 
-    postInstall = ''
+    postInstall =
+    stdenv.lib.optionalString (!static) ''
       # If we're building dynamic libraries, then don't install static
       # libraries.
       if [ -n "$(echo $out/lib/*.so $out/lib/*.dylib $out/lib/*.dll)" ]; then
           rm "$out/lib/"*.a
       fi
 
+    '' +
+    ''
       mkdir -p $bin
       mv $out/bin $bin/