Update to openssl-3.5.8

.github/workflows/backport.yml

@@ -0,0 +1,64 @@
+# Copyright 2021-2026 The OpenSSL Project Authors. All Rights Reserved.
+#
+# Licensed under the Apache License 2.0 (the "License"). You may not use
+# this file except in compliance with the License. You can obtain a copy
+# in the file LICENSE in the source distribution or at
+# https://www.openssl.org/source/license.html
+
+name: Backports CI
+
+on: [pull_request]
+
+permissions:
+ contents: read
+
+jobs:
+ check_backports:
+ strategy:
+ fail-fast: false
+ matrix:
+ release: [
+ {
+ branch: '4.0',
+ cppflags: ''
+ }, {
+ branch: '3.6',
+ cppflags: ''
+ }, {
+ branch: '3.5',
+ cppflags: 'CPPFLAGS=-ansi'
+ }, {
+ branch: '3.4',
+ cppflags: 'CPPFLAGS=-ansi'
+ }, {
+ branch: '3.0',
+ cppflags: 'CPPFLAGS=-ansi'
+ }
+ ]
+ runs-on: ubuntu-latest
+ steps:
+ - uses: actions/checkout@v6
+ if: ${{ contains(join(github.event.pull_request.labels.*.name,','),matrix.release.branch) }}
+ with:
+ ref: ${{ github.event.pull_request.head.sha }}
+ fetch-depth: 0
+ persist-credentials: false
+ - name: cherry-pick
+ if: ${{ contains(join(github.event.pull_request.labels.*.name,','),matrix.release.branch) }}
+ run: |
+ REFEND=$(git rev-parse HEAD)
+ REFSTART=$(git rev-parse $REFEND~${{ github.event.pull_request.commits }})
+ git checkout ${{ format('openssl-{0}', matrix.release.branch) }}
+ git config user.name "OpenSSL Machine"
+ git config user.email "openssl-machine@openssl.org"
+ echo Cherry-picking $REFSTART..$REFEND
+ git cherry-pick $REFSTART..$REFEND || { git diff | head -n1000; exit 1; }
+ - name: config
+ if: ${{ contains(join(github.event.pull_request.labels.*.name,','),matrix.release.branch) }}
+ run: ${{ matrix.release.cppflags }} ./config --strict-warnings --banner=Configured no-asm enable-fips --strict-warnings -D_DEFAULT_SOURCE && perl configdata.pm --dump
+ - name: make
+ if: ${{ contains(join(github.event.pull_request.labels.*.name,','),matrix.release.branch) }}
+ run: make -s -j4
+ - name: make test
+ if: ${{ contains(join(github.event.pull_request.labels.*.name,','),matrix.release.branch) }}
+ run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}

.github/workflows/ci.yml

@@ -714,9 +714,37 @@ jobs:
  ./util/opensslwrap.sh version -c
  - name: test external oqs-provider
  run: make test TESTS="test_external_oqsprovider"
- # Disabled temporarily: https://github.com/latchset/pkcs11-provider/pull/525#discussion_r1982805969
- # - name: test external pkcs11-provider
- # run: make test TESTS="test_external_pkcs11_provider" VERBOSE=1
+
+ external-tests-pkcs11-provider:
+ runs-on: ubuntu-latest
+ container: fedora:latest
+ steps:
+ - name: package installs
+ run: |
+ dnf install -y perl-FindBin perl-IPC-Cmd perl-File-Compare perl-File-Copy perl-Test-Simple perl-Test-Harness python3 make g++ perl git meson opensc expect kryoptic xxd
+ - uses: actions/checkout@v6
+ with:
+ persist-credentials: false
+ - name: checkout fuzz/corpora and pkcs11-provider submodule
+ run: |
+ git config --global --add safe.directory "$GITHUB_WORKSPACE"
+ git submodule update --init --depth 1 fuzz/corpora
+ git submodule update --init --depth 1 pkcs11-provider
+ - name: config
+ run: ./config --strict-warnings --banner=Configured --debug enable-external-tests no-fips && perl configdata.pm --dump
+ - name: make
+ run: make -s -j4
+ # Run all tests except external tests to make sure they work fine on Fedora because
+ # this is the only job running on Fedora, only then execute pkcs11-provider external
+ # test.
+ - name: test (except external tests)
+ run: make test TESTS="-test_external_*"
+ - name: test external pkcs11-provider
+ run: make test TESTS="test_external_pkcs11_provider" VERBOSE=1
+ - name: get cpu info
+ run: |
+ cat /proc/cpuinfo
+ ./util/opensslwrap.sh version -c
 
  external-tests-pyca:
  runs-on: ubuntu-latest

.github/workflows/coveralls.yml

@@ -51,15 +51,6 @@ jobs:
  },{
  "branch": "openssl-3.4",
  "extra_config": "no-afalgeng enable-fips enable-tfo"
- }, {
- "branch": "openssl-3.3",
- "extra_config": "no-afalgeng enable-fips enable-tfo"
- }, {
- "branch": "openssl-3.2",
- "extra_config": "no-afalgeng enable-fips enable-tfo"
- }, {
- "branch": "openssl-3.1",
- "extra_config": "no-afalgeng enable-fips"
  }, {
  "branch": "openssl-3.0",
  "extra_config": "no-afalgeng enable-fips"

.github/workflows/cross-compiles.yml

@@ -107,6 +107,10 @@ jobs:
  fips: no
  }, {
  arch: riscv64-linux-gnu,
+ # Pin the vector spec version, otherwise qemu-user emits a
+ # "vector version is not specified" warning on stderr at every
+ # process start, which upsets tests that parse or check stderr.
+ qemucpu: "rv64,v=true,vext_spec=v1.0",
  libs: libc6-dev-riscv64-cross,
  target: linux64-riscv64,
  fips: no

.github/workflows/os-zoo.yml

@@ -137,7 +137,7 @@ jobs:
  - os: windows-2022
  vcvars: C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars64.bat
  - os: windows-2025
- vcvars: C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars64.bat
+ vcvars: C:\Program Files\Microsoft Visual Studio\18\Enterprise\VC\Auxiliary\Build\vcvars64.bat
  runs-on: ${{ matrix.platform.os }}
  steps:
  - uses: actions/checkout@v6

.github/workflows/prov-compat-label.yml

@@ -16,7 +16,7 @@ permissions:
  contents: read
 
 env:
- opts: enable-rc5 enable-md2 enable-ssl3 enable-weak-ssl-ciphers enable-zlib
+ opts: enable-rc5 enable-md2 enable-weak-ssl-ciphers enable-zlib
 
 jobs:
  fips-releases:
@@ -113,10 +113,6 @@ jobs:
  name: openssl-3.0,
  dir: branch-3.0,
  tgz: branch-3.0.tar.gz,
- }, {
- name: openssl-3.3,
- dir: branch-3.3,
- tgz: branch-3.3.tar.gz,
  }, {
  name: openssl-3.4,
  dir: branch-3.4,
@@ -197,7 +193,7 @@ jobs:
  # Note that releases are not used as a test environment for
  # later providers. Problems in these situations ought to be
  # caught by cross branch testing before the release.
- tree_a: [ branch-3.6, branch-3.5, branch-3.4, branch-3.3, branch-3.0,
+ tree_a: [ branch-3.6, branch-3.5, branch-3.4, branch-3.0,
  openssl-3.0.0, openssl-3.0.8, openssl-3.0.9, openssl-3.1.2 ]
  tree_b: [ PR ]
  include:
@@ -209,8 +205,6 @@ jobs:
  tree_b: branch-3.5
  - tree_a: PR
  tree_b: branch-3.4
- - tree_a: PR
- tree_b: branch-3.3
  - tree_a: PR
  tree_b: branch-3.0
  steps:

.github/workflows/provider-compatibility.yml

@@ -117,11 +117,6 @@ jobs:
  dir: branch-3.0,
  tgz: branch-3.0.tar.gz,
  extra_config: "",
- }, {
- name: openssl-3.3,
- dir: branch-3.3,
- tgz: branch-3.3.tar.gz,
- extra_config: "",
  }, {
  name: openssl-3.4,
  dir: branch-3.4,
@@ -204,11 +199,9 @@ jobs:
  # Note that releases are not used as a test environment for
  # later providers. Problems in these situations ought to be
  # caught by cross branch testing before the release.
- tree_a: [ branch-master, branch-3.6, branch-3.5, branch-3.4, branch-3.3,
- branch-3.0,
+ tree_a: [ branch-master, branch-3.6, branch-3.5, branch-3.4, branch-3.0,
  openssl-3.0.0, openssl-3.0.8, openssl-3.0.9, openssl-3.1.2 ]
- tree_b: [ branch-master, branch-3.6, branch-3.5, branch-3.4, branch-3.3,
- branch-3.0 ]
+ tree_b: [ branch-master, branch-3.6, branch-3.5, branch-3.4, branch-3.0 ]
  steps:
  - name: early exit checks
  id: early_exit

.github/workflows/windows.yml

@@ -25,7 +25,7 @@ jobs:
  - arch: amd64
 os: windows-2025
 config: enable-fips no-thread-pool no-quic
-vcvars: C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars64.bat
+vcvars: C:\Program Files\Microsoft Visual Studio\18\Enterprise\VC\Auxiliary\Build\vcvars64.bat
  - arch: x86
 os: windows-2022
 config: no-fips

.github/workflows/windows_comp.yml

@@ -42,14 +42,14 @@ jobs:
  working-directory: _build
  shell: cmd
  run: |
- call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars64.bat"
+ call "C:\Program Files\Microsoft Visual Studio\18\Enterprise\VC\Auxiliary\Build\vcvars64.bat"
  perl ..\Configure enable-comp enable-zstd --with-zstd-include=C:\vcpkg\packages\zstd_x64-windows\include --with-zstd-lib=C:\vcpkg\packages\zstd_x64-windows\lib\zstd.lib no-makedepend -DOSSL_WINCTX=openssl VC-WIN64A
  perl configdata.pm --dump
  - name: build
  working-directory: _build
  shell: cmd
  run: |
- call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars64.bat"
+ call "C:\Program Files\Microsoft Visual Studio\18\Enterprise\VC\Auxiliary\Build\vcvars64.bat"
  nmake
  - name: Gather openssl version info
  working-directory: _build
@@ -81,7 +81,7 @@ jobs:
  working-directory: _build
  shell: cmd
  run: |
- call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars64.bat"
+ call "C:\Program Files\Microsoft Visual Studio\18\Enterprise\VC\Auxiliary\Build\vcvars64.bat"
  nmake test VERBOSE_FAILURE=yes TESTS="-test_fuzz* -test_fipsload" HARNESS_JOBS=4
 
  brotli:
@@ -106,14 +106,14 @@ jobs:
  working-directory: _build
  shell: cmd
  run: |
- call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars64.bat"
+ call "C:\Program Files\Microsoft Visual Studio\18\Enterprise\VC\Auxiliary\Build\vcvars64.bat"
  perl ..\Configure enable-comp enable-brotli --with-brotli-include=C:\vcpkg\packages\brotli_x64-windows\include --with-brotli-lib=C:\vcpkg\packages\brotli_x64-windows\lib no-makedepend -DOSSL_WINCTX=openssl VC-WIN64A
  perl configdata.pm --dump
  - name: build
  working-directory: _build
  shell: cmd
  run: |
- call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars64.bat"
+ call "C:\Program Files\Microsoft Visual Studio\18\Enterprise\VC\Auxiliary\Build\vcvars64.bat"
  nmake
  - name: Gather openssl version info
  working-directory: _build
@@ -145,5 +145,5 @@ jobs:
  working-directory: _build
  shell: cmd
  run: |
- call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars64.bat"
+ call "C:\Program Files\Microsoft Visual Studio\18\Enterprise\VC\Auxiliary\Build\vcvars64.bat"
  nmake test VERBOSE_FAILURE=yes TESTS="-test_fuzz* -test_fipsload" HARNESS_JOBS=4

.gitmodules

@@ -1,37 +0,0 @@
-[submodule "pyca.cryptography"]
-	path = pyca-cryptography
-	url = https://github.com/pyca/cryptography.git
-
-[submodule "krb5"]
-	path = krb5
-	url = https://github.com/krb5/krb5
-
-[submodule "gost-engine"]
-	path = gost-engine
-	url = https://github.com/gost-engine/engine
-	update = rebase
-[submodule "wycheproof"]
-	path = wycheproof
-	url = https://github.com/google/wycheproof
-[submodule "tlsfuzzer"]
-	path = tlsfuzzer
-	url = https://github.com/tlsfuzzer/tlsfuzzer
-[submodule "python-ecdsa"]
-	path = python-ecdsa
-	url = https://github.com/tlsfuzzer/python-ecdsa
-[submodule "tlslite-ng"]
-	path = tlslite-ng
-	url = https://github.com/tlsfuzzer/tlslite-ng
-[submodule "oqs-provider"]
-	path = oqs-provider
-	url = https://github.com/open-quantum-safe/oqs-provider.git
-[submodule "cloudflare-quiche"]
-	path = cloudflare-quiche
-	url = https://github.com/cloudflare/quiche
-[submodule "fuzz/corpora"]
-	path = fuzz/corpora
-	url = https://github.com/openssl/fuzz-corpora
-	branch = main
-[submodule "pkcs11-provider"]
-	path = pkcs11-provider
-	url = https://github.com/latchset/pkcs11-provider.git