From nobody Sat Aug 29 01:42:11 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hWyfr5j2Zz6q0kV for ; Sat, 29 Aug 2026 01:42:12 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hWyfr3f7tz3mPF for ; Sat, 29 Aug 2026 01:42:12 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1787967732; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=H2D1KZeGWlPCeGX2WX6NvqvdkEDLYaXzvc5YzbNIMfY=; b=fCoX4ZFU1PBJDGJyQoomyRYjPD9cnf4nHVQKCDfV6q03F04MBLR17Ag39y68Cn0oo09/9j hH1ffTxVbEBZeg3CHfuHDBm8zXQoPF3jh3DIp7kGvGjkh+qvlnwSo1HIEoukyB6FqQGm1s abrzfVMOY5d8v9eMexi7yKsiv2HT4DBumjAStMhSmAgpK2IHj9HpqqNebyrJRiDxKZiXl+ 5hynuFAzf4nnLQNFaGaDHQ3Gw7ab484w1zrWJaPZChsUi8CL/SwSsUxpAKhuSqc2K98aQi rdKR4evFP/fRiWXa2T1Xob2EjQ8PmpYLFjXgRBZ4qaIfxtW00+X6O3ewxG896g== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1787967732; a=rsa-sha256; cv=none; b=b2xEhw9ANYzttObMdd5U74vD99ZXmKfm11U/EtBNLi1ID6+7E4UeV2YUAxBSKfcCo9Cu1k 03E/VssHksK6n3ZJjdKNbw23Dsrqvso8+yGKt+MyeRpH6ydCxRy5cPY6Y69T8bB8KILaZ4 SY/juB8DYNRxTGvrDD5sAIeior6q1GcoxYUCi6oo+dn8cOW72Q4LvuAV3EMV09LADyXtk6 6vEoWS1CUz+iCbq21cnBgA2e7nzw2C8diI/KcLyfyVkS8r941xzXqoMBpqxTvjGAHPwp7W /rPEWimMZsMLVz29h7lB1s9JSzJ/3CmYovVLsFpBNWT5djqKTSyT018oVQbzQA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1787967732; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=H2D1KZeGWlPCeGX2WX6NvqvdkEDLYaXzvc5YzbNIMfY=; b=RSZv3k4zGKonzJcIkf/MDoszKNtSjXKEy5pzsftq5g/qAhn/jCLbdIjf1sH9HQ80O4KjNe WpaOWud4I0CQ4MusOO7M0larsJmFoKHDre596W5MRp2VyW/RyopEDAYqya8BW+OWqVdQDp j9pTuVAfZgF+L8TsjDJA4CuLqHi3kIxT9ajro4Lc4DfrSkekrRvnhHI89KjB6RxtunxyFJ 84g+H13pHAHdcevu4XltDMtoDPUVzHrMAa9g1exCa0eC0qV5ZB0HzKei7cljBTFnRSNIv8 KtawUnqakRCdxlNPNVUG55L6mkLYKYcvmggeCU4qRsyhdYk86+LUnRTcddLVIw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hWyfr2Rx7z4Qx for ; Sat, 29 Aug 2026 01:42:12 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 33f73 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Sat, 29 Aug 2026 01:42:11 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Enji Cooper Subject: git: 78e936b2d0b5 - main - crypto/openssl: update to 3.5.8 List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: ngie X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 78e936b2d0b5e6554425009199be31e76bc67c10 Auto-Submitted: auto-generated Date: Sat, 29 Aug 2026 01:42:11 +0000 Message-Id: <6a9238f3.33f73.11e8fff4@gitrepo.freebsd.org> The branch main has been updated by ngie: URL: https://cgit.FreeBSD.org/src/commit/?id=78e936b2d0b5e6554425009199be31e76bc67c10 commit 78e936b2d0b5e6554425009199be31e76bc67c10 Merge: 7dc428461549 248da023ae5e Author: Enji Cooper AuthorDate: 2026-08-29 01:28:12 +0000 Commit: Enji Cooper CommitDate: 2026-08-29 01:28:12 +0000 crypto/openssl: update to 3.5.8 This is a security bugfix release. Please see the related merge commit for more details. Maintainer note: `quic_ackm.h`'s conflict was resolved by taking the upstream version of the file verbatim. Conflicts: crypto/openssl/include/internal/quic_ackm.h MFC after: 3 days Merge commit '248da023ae5ea7292930ac5d715d88b87e2e6f46' crypto/openssl/CHANGES.md | 258 + crypto/openssl/CONTRIBUTING.md | 44 +- crypto/openssl/NEWS.md | 56 + crypto/openssl/README-FIPS.md | 12 +- crypto/openssl/VERSION.dat | 4 +- crypto/openssl/apps/lib/apps.c | 25 +- crypto/openssl/apps/lib/s_cb.c | 6 +- crypto/openssl/apps/lib/vms_term_sock.c | 4 +- crypto/openssl/apps/s_client.c | 55 +- crypto/openssl/crypto/aes/aes_x86core.c | 867 - crypto/openssl/crypto/aes/asm/aesni-mb-x86_64.pl | 9 +- crypto/openssl/crypto/aes/asm/aesni-sha1-x86_64.pl | 5 +- .../openssl/crypto/aes/asm/aesni-sha256-x86_64.pl | 9 +- crypto/openssl/crypto/aes/asm/aesni-xts-avx512.pl | 7 + crypto/openssl/crypto/armcap.c | 36 +- crypto/openssl/crypto/asn1/a_d2i_fp.c | 15 +- crypto/openssl/crypto/asn1/a_mbstr.c | 20 +- crypto/openssl/crypto/asn1/asn1_gen.c | 5 +- crypto/openssl/crypto/bio/bss_file.c | 8 +- crypto/openssl/crypto/bn/asm/rsaz-2k-avx512.pl | 9 +- crypto/openssl/crypto/bn/asm/rsaz-2k-avxifma.pl | 7 + crypto/openssl/crypto/bn/asm/rsaz-3k-avx512.pl | 9 +- crypto/openssl/crypto/bn/asm/rsaz-3k-avxifma.pl | 7 + crypto/openssl/crypto/bn/asm/rsaz-4k-avx512.pl | 9 +- crypto/openssl/crypto/bn/asm/rsaz-4k-avxifma.pl | 7 + crypto/openssl/crypto/bn/asm/rsaz-avx2.pl | 10 +- crypto/openssl/crypto/bn/asm/rsaz-x86_64.pl | 9 +- crypto/openssl/crypto/bn/asm/x86_64-mont.pl | 9 +- crypto/openssl/crypto/bn/asm/x86_64-mont5.pl | 9 +- crypto/openssl/crypto/bn/bn_add.c | 9 +- crypto/openssl/crypto/bn/bn_exp.c | 7 +- crypto/openssl/crypto/bn/bn_lib.c | 32 +- crypto/openssl/crypto/chacha/asm/chacha-x86.pl | 6 +- crypto/openssl/crypto/chacha/asm/chacha-x86_64.pl | 9 +- crypto/openssl/crypto/cmp/cmp_protect.c | 2 +- crypto/openssl/crypto/cmp/cmp_vfy.c | 22 +- crypto/openssl/crypto/cms/cms_asn1.c | 8 +- crypto/openssl/crypto/cms/cms_env.c | 46 +- crypto/openssl/crypto/cms/cms_kari.c | 8 +- crypto/openssl/crypto/cms/cms_local.h | 3 + crypto/openssl/crypto/cms/cms_pwri.c | 5 +- crypto/openssl/crypto/cms/cms_smime.c | 39 + crypto/openssl/crypto/ct/ct_b64.c | 8 +- crypto/openssl/crypto/ctype.c | 6 +- crypto/openssl/crypto/dh/dh_backend.c | 4 +- crypto/openssl/crypto/dh/dh_check.c | 24 +- crypto/openssl/crypto/dsa/dsa_key.c | 3 +- .../openssl/crypto/ec/asm/ecp_nistz256-x86_64.pl | 10 +- crypto/openssl/crypto/ec/asm/x25519-x86_64.pl | 9 +- crypto/openssl/crypto/ec/ec_key.c | 56 +- crypto/openssl/crypto/err/openssl.txt | 1 + crypto/openssl/crypto/evp/exchange.c | 4 +- crypto/openssl/crypto/ffc/ffc_params_generate.c | 9 +- crypto/openssl/crypto/hmac/hmac.c | 10 +- crypto/openssl/crypto/http/http_lib.c | 27 +- crypto/openssl/crypto/ml_dsa/ml_dsa_encoders.c | 5 +- crypto/openssl/crypto/ml_dsa/ml_dsa_key.c | 14 +- crypto/openssl/crypto/ml_dsa/ml_dsa_matrix.c | 8 +- crypto/openssl/crypto/ml_dsa/ml_dsa_sample.c | 47 +- crypto/openssl/crypto/ml_dsa/ml_dsa_sign.c | 19 +- crypto/openssl/crypto/ml_dsa/ml_dsa_vector.h | 4 +- crypto/openssl/crypto/ml_kem/ml_kem.c | 107 +- crypto/openssl/crypto/modes/asm/aes-gcm-avx512.pl | 9 +- .../openssl/crypto/modes/asm/aesni-gcm-x86_64.pl | 9 +- crypto/openssl/crypto/modes/asm/ghash-x86_64.pl | 9 +- crypto/openssl/crypto/pem/pvkfmt.c | 8 +- crypto/openssl/crypto/pkcs12/p12_add.c | 4 +- crypto/openssl/crypto/pkcs12/p12_decr.c | 5 +- crypto/openssl/crypto/pkcs12/p12_utl.c | 2 + crypto/openssl/crypto/pkcs7/pk7_doit.c | 2 +- crypto/openssl/crypto/pkcs7/pk7_lib.c | 18 +- crypto/openssl/crypto/poly1305/asm/poly1305-x86.pl | 9 +- .../openssl/crypto/poly1305/asm/poly1305-x86_64.pl | 9 +- crypto/openssl/crypto/rand/rand_lib.c | 17 +- crypto/openssl/crypto/rsa/rsa_gen.c | 3 +- crypto/openssl/crypto/rsa/rsa_ossl.c | 16 +- crypto/openssl/crypto/sha/asm/sha1-586.pl | 5 +- crypto/openssl/crypto/sha/asm/sha1-mb-x86_64.pl | 9 +- crypto/openssl/crypto/sha/asm/sha1-x86_64.pl | 9 +- crypto/openssl/crypto/sha/asm/sha256-586.pl | 9 +- crypto/openssl/crypto/sha/asm/sha256-mb-x86_64.pl | 9 +- crypto/openssl/crypto/sha/asm/sha512-x86_64.pl | 9 +- crypto/openssl/crypto/sha/sha_riscv.c | 10 +- crypto/openssl/crypto/slh_dsa/slh_dsa.c | 37 +- crypto/openssl/crypto/slh_dsa/slh_dsa_hash_ctx.c | 5 +- crypto/openssl/crypto/slh_dsa/slh_dsa_key.c | 6 + crypto/openssl/crypto/slh_dsa/slh_dsa_local.h | 14 +- crypto/openssl/crypto/slh_dsa/slh_fors.c | 52 +- crypto/openssl/crypto/slh_dsa/slh_hash.c | 38 +- crypto/openssl/crypto/slh_dsa/slh_hypertree.c | 23 +- crypto/openssl/crypto/slh_dsa/slh_wots.c | 6 +- crypto/openssl/crypto/slh_dsa/slh_xmss.c | 29 +- crypto/openssl/crypto/threads_win.c | 14 + crypto/openssl/crypto/x509/by_dir.c | 38 +- crypto/openssl/crypto/x509/pcy_cache.c | 7 +- crypto/openssl/crypto/x509/v3_akid.c | 6 +- crypto/openssl/crypto/x509/v3_ncons.c | 9 +- crypto/openssl/crypto/x509/x509_err.c | 4 +- crypto/openssl/crypto/x509/x509_lu.c | 9 +- crypto/openssl/crypto/x509/x509_vfy.c | 9 +- crypto/openssl/crypto/x509/x_crl.c | 6 +- crypto/openssl/crypto/x509/x_pubkey.c | 2 +- crypto/openssl/doc/build.info | 12 + .../openssl/doc/internal/man3/DEFINE_LIST_OF.pod | 13 +- crypto/openssl/doc/man1/openssl-pkeyutl.pod.in | 8 +- crypto/openssl/doc/man1/openssl.pod | 6 +- crypto/openssl/doc/man3/ASN1_INTEGER_get_int64.pod | 4 +- crypto/openssl/doc/man3/ASN1_aux_cb.pod | 62 +- crypto/openssl/doc/man3/ASN1_item_d2i_bio.pod | 18 +- crypto/openssl/doc/man3/BIO_s_datagram.pod | 4 +- crypto/openssl/doc/man3/BIO_s_file.pod | 9 +- crypto/openssl/doc/man3/BN_generate_prime.pod | 4 +- .../openssl/doc/man3/CMS_EncryptedData_decrypt.pod | 4 +- crypto/openssl/doc/man3/NAME_CONSTRAINTS_check.pod | 211 + crypto/openssl/doc/man3/OPENSSL_armcap.pod | 246 + crypto/openssl/doc/man3/OPENSSL_init_crypto.pod | 7 +- crypto/openssl/doc/man3/SSL_CTX_set1_curves.pod | 6 +- .../openssl/doc/man3/SSL_CTX_set_msg_callback.pod | 4 +- crypto/openssl/doc/man3/SSL_CTX_set_verify.pod | 6 +- crypto/openssl/doc/man3/SSL_get_value_uint.pod | 22 +- crypto/openssl/doc/man3/SSL_new.pod | 10 +- crypto/openssl/doc/man3/SSL_poll.pod | 20 +- .../doc/man3/X509_get_default_cert_file.pod | 4 +- crypto/openssl/doc/man3/X509_verify_cert.pod | 512 +- crypto/openssl/doc/man7/EVP_CIPHER-SM4.pod | 12 +- crypto/openssl/doc/man7/EVP_SIGNATURE-ECDSA.pod | 2 +- crypto/openssl/doc/man7/EVP_SIGNATURE-RSA.pod | 2 +- crypto/openssl/doc/man7/fips_module.pod | 11 +- .../openssl/doc/man7/openssl-core_dispatch.h.pod | 4 +- crypto/openssl/doc/man7/openssl-env.pod | 4 +- .../openssl/doc/man7/openssl-quic-concurrency.pod | 29 +- crypto/openssl/doc/man7/openssl-threads.pod | 30 +- crypto/openssl/doc/man7/provider-kem.pod | 19 +- crypto/openssl/doc/man7/provider-signature.pod | 2 +- crypto/openssl/fuzz/provider.c | 9 +- crypto/openssl/include/internal/hashtable.h | 4 +- crypto/openssl/include/internal/list.h | 31 +- crypto/openssl/include/internal/quic_ackm.h | 4 +- crypto/openssl/include/internal/quic_port.h | 6 +- crypto/openssl/include/internal/quic_record_rx.h | 2 +- crypto/openssl/include/internal/quic_ssl.h | 3 +- crypto/openssl/include/openssl/ssl.h.in | 19 +- crypto/openssl/include/openssl/x509err.h | 3 +- crypto/openssl/providers/baseprov.c | 10 +- crypto/openssl/providers/defltprov.c | 8 +- crypto/openssl/providers/fips-sources.checksums | 152 +- crypto/openssl/providers/fips.checksum | 2 +- crypto/openssl/providers/fips/fipsprov.c | 10 +- .../ciphers/cipher_aes_gcm_siv_hw.c | 14 +- .../implementations/ciphers/cipher_aes_ocb.c | 4 + .../ciphers/cipher_chacha20_poly1305.c | 27 +- .../ciphers/cipher_chacha20_poly1305_hw.c | 4 +- .../implementations/ciphers/ciphercommon_ccm.c | 17 +- .../implementations/encode_decode/encode_key2ms.c | 5 +- .../providers/implementations/kem/ml_kem_kem.c | 3 +- .../providers/implementations/kem/mlx_kem.c | 12 +- .../providers/implementations/kem/rsa_kem.c | 51 + .../providers/implementations/keymgmt/dh_kmgmt.c | 6 +- .../providers/implementations/keymgmt/ec_kmgmt.c | 20 +- .../providers/implementations/keymgmt/ecx_kmgmt.c | 2 - .../implementations/keymgmt/ml_dsa_kmgmt.c | 13 +- .../implementations/keymgmt/ml_kem_kmgmt.c | 35 +- .../providers/implementations/keymgmt/mlx_kmgmt.c | 26 +- .../implementations/keymgmt/slh_dsa_kmgmt.c | 20 +- .../providers/implementations/macs/cmac_prov.c | 4 +- .../providers/implementations/macs/poly1305_prov.c | 6 +- .../providers/implementations/rands/drbg_ctr.c | 57 +- .../providers/implementations/rands/drbg_hash.c | 38 +- .../providers/implementations/rands/drbg_hmac.c | 39 +- .../implementations/rands/seeding/rand_unix.c | 4 +- .../providers/implementations/rands/test_rng.c | 6 +- .../providers/implementations/signature/rsa_sig.c | 12 +- .../implementations/signature/slh_dsa_sig.c | 2 +- .../implementations/storemgmt/file_store_any2obj.c | 6 +- crypto/openssl/ssl/quic/quic_ackm.c | 17 +- crypto/openssl/ssl/quic/quic_impl.c | 56 + crypto/openssl/ssl/quic/quic_port.c | 16 + crypto/openssl/ssl/quic/quic_port_local.h | 3 +- crypto/openssl/ssl/quic/quic_rx_depack.c | 15 +- crypto/openssl/ssl/quic/quic_stream_map.c | 4 + crypto/openssl/ssl/record/methods/dtls_meth.c | 2 +- .../openssl/ssl/record/methods/recmethod_local.h | 2 +- crypto/openssl/ssl/record/methods/tls_common.c | 28 +- crypto/openssl/ssl/record/rec_layer_s3.c | 4 +- crypto/openssl/ssl/rio/poll_builder.c | 6 +- crypto/openssl/ssl/rio/poll_builder.h | 15 +- crypto/openssl/ssl/rio/poll_immediate.c | 31 +- crypto/openssl/ssl/rio/rio_notifier.c | 22 +- crypto/openssl/ssl/s3_lib.c | 5 +- crypto/openssl/ssl/ssl_cert.c | 8 +- crypto/openssl/ssl/ssl_lib.c | 25 + crypto/openssl/ssl/ssl_local.h | 7 +- crypto/openssl/ssl/ssl_rsa.c | 8 +- crypto/openssl/ssl/statem/extensions.c | 27 +- crypto/openssl/ssl/statem/statem_clnt.c | 8 + crypto/openssl/ssl/statem/statem_lib.c | 4 +- crypto/openssl/ssl/statem/statem_srvr.c | 6 +- crypto/openssl/ssl/t1_lib.c | 105 +- crypto/openssl/test/asn1_decode_test.c | 165 + crypto/openssl/test/build.info | 7 +- crypto/openssl/test/ca_internals_test.c | 6 +- .../test/certs/delta-crl-as-complete-ca.pem | 20 + .../certs/delta-crl-as-complete-delta-reasons.pem | 12 + .../test/certs/delta-crl-as-complete-delta.pem | 12 + .../test/certs/delta-crl-as-complete-leaf.pem | 20 + .../test/certs/server-ec-compressed-cert.pem | 12 + .../test/certs/server-ec-compressed-key.pem | 5 + crypto/openssl/test/cmp_client_test.c | 12 +- crypto/openssl/test/cmp_protect_test.c | 2 +- crypto/openssl/test/cmp_vfy_test.c | 2 +- crypto/openssl/test/cmsapitest.c | 103 +- crypto/openssl/test/crltest.c | 125 +- crypto/openssl/test/endecode_test.c | 508 +- crypto/openssl/test/evp_extra_test.c | 854 +- crypto/openssl/test/evp_extra_test2.c | 517 +- crypto/openssl/test/fipsidentity.cnf | 23 + crypto/openssl/test/helpers/quictestlib.c | 319 +- crypto/openssl/test/helpers/quictestlib.h | 6 +- crypto/openssl/test/helpers/ssltestlib.c | 63 +- crypto/openssl/test/helpers/ssltestlib.h | 5 +- crypto/openssl/test/hpke_test.c | 22 +- crypto/openssl/test/http_test.c | 28 +- crypto/openssl/test/list_test.c | 48 +- crypto/openssl/test/p_test.c | 6 +- crypto/openssl/test/pairwise_fail_test.c | 4 +- crypto/openssl/test/pkcs12_api_test.c | 4 +- crypto/openssl/test/pkcs7_test.c | 116 +- crypto/openssl/test/punycode_test.c | 4 +- crypto/openssl/test/quic_ackm_test.c | 68 +- crypto/openssl/test/quic_multistream_test.c | 11 +- crypto/openssl/test/quic_tserver_test.c | 38 +- crypto/openssl/test/quicapitest.c | 126 + crypto/openssl/test/radix/quic_bindings.c | 19 +- crypto/openssl/test/radix/quic_ops.c | 61 +- crypto/openssl/test/radix/quic_tests.c | 342 +- crypto/openssl/test/recipes/20-test_app_s_client.t | 110 + crypto/openssl/test/recipes/20-test_cli_fips.t | 42 +- crypto/openssl/test/recipes/25-test_verify.t | 34 +- .../test/recipes/30-test_evp_data/evprand.txt | 79844 ------------------- .../openssl/test/recipes/30-test_pairwise_fail.t | 12 +- crypto/openssl/test/recipes/65-test_cmp_msg.t | 2 +- .../test/recipes/70-test_rio_poll_builder.t | 19 + crypto/openssl/test/recipes/70-test_sslrecords.t | 12 +- crypto/openssl/test/recipes/80-test_cms.t | 64 +- .../80-test_cms_data/authenticated_attrs.pem | 8 + .../80-test_cms_data/authenveloped_attrs.pem | 7 + .../80-test_cms_data/bad_authenveloped_attrs.pem | 7 + crypto/openssl/test/recipes/80-test_cmsapi.t | 3 +- crypto/openssl/test/recipes/80-test_ssl_new.t | 6 +- crypto/openssl/test/rio_poll_builder_test.c | 45 + crypto/openssl/test/rpktest.c | 2 +- crypto/openssl/test/secmemtest.c | 4 +- .../openssl/test/ssl-tests/33-compressed-spki.cnf | 76 + .../test/ssl-tests/33-compressed-spki.cnf.in | 81 + crypto/openssl/test/sslapitest.c | 172 + crypto/openssl/test/x509_test.c | 98 + crypto/openssl/util/missingcrypto.txt | 2 - crypto/openssl/util/other.syms | 5 +- crypto/openssl/util/perl/TLSProxy/Proxy.pm | 10 +- 259 files changed, 7392 insertions(+), 81990 deletions(-) diff --cc crypto/openssl/CONTRIBUTING.md index 06dfbaeff1fe,000000000000..8a0d40524ddb mode 100644,000000..100644 --- a/crypto/openssl/CONTRIBUTING.md +++ b/crypto/openssl/CONTRIBUTING.md @@@ -1,124 -1,0 +1,154 @@@ +HOW TO CONTRIBUTE TO OpenSSL +============================ + +Please visit our [Getting Started] page for other ideas about how to contribute. + + [Getting Started]: + +Development is done on GitHub in the [openssl/openssl] repository. + + [openssl/openssl]: + +To request a new feature, ask a question, or report a bug, +please open an [issue on GitHub](https://github.com/openssl/openssl/issues). + +To submit a patch or implement a new feature, please open a +[pull request on GitHub](https://github.com/openssl/openssl/pulls). +If you are thinking of making a large contribution, +open an issue for it before starting work, to get comments from the community. +Someone may be already working on the same thing, +or there may be special reasons why a feature is not implemented. + +Similarly, if you plan to submit many pull requests, please start with +a representative sample (no more than 3 or 4) and open an issue +explaining your process. The OpenSSL project has limited resources, +especially when it comes to reviewers, so we appreciate advanced +communication before submitting many pull requests. In addition, +contributors should personally evaluate potential patches generated by +automated tools. + +Provide a clear description of the issue or feature being addressed, +including any relevant implementation details and, for performance +improvements, benchmark results. + +Pull requests and commits should be self-contained, enabling readers to +understand what changed and why without needing to reference related +issues or having prior knowledge. Commit messages should include all +relevant details to help future contributors follow the git history, +with clear explanations of what is changing and why. Long descriptions +are encouraged if they aid understanding. Commit message titles (their +first line) should be kept to 50-70 characters if possible. + +To make it easier to review and accept your pull request, please follow these +guidelines: + + 1. Anything other than a trivial contribution requires a [Contributor + License Agreement] (CLA), giving us permission to use your code. + If your contribution is too small to require a CLA (e.g., fixing a spelling + mistake), then place the text "`CLA: trivial`" on a line by itself below + the rest of your commit message separated by an empty line, like this: + + ``` + One-line summary of trivial change + + Optional main body of commit message. It might contain a sentence + or two explaining the trivial change. + + CLA: trivial + ``` + + It is not sufficient to only place the text "`CLA: trivial`" in the GitHub + pull request description. + + [Contributor License Agreement]: + + To amend a missing "`CLA: trivial`" line after submission, do the following: + + ``` + git commit --amend + # add the line, save and quit the editor + git push -f [ []] + ``` + - 2. All source files should start with the following text (with ++ 2. Similarly, if a non-trivial portion of a contribution was created ++ using an AI tool, you must declare which agent and model were used. ++ This is done by adding `Assisted-by: {agent}:{model}` below the commit ++ message: ++ ++ ``` ++ One-line summary of change with AI-generated portions ++ ++ Assisted-by: Claude:claude-sonnet-4-6 ++ ``` ++ ++ Multiple Assisted-by trailers can be included if multiple tools were used: ++ ++ ``` ++ Assisted-by: Claude:claude-sonnet-4-6 ++ Assisted-by: ChatGPT:gpt-4o ++ Assisted-by: GitHub Copilot:gpt-4.1 ++ ``` ++ ++ You will need to have signed a v1.1 or later CLA in order to ++ include AI-generated content in your contribution. CLAs signed ++ after June 2026 will have the requisite clauses. ++ ++ Consult the [OpenSSL AI Code and Documentation Contribution ++ Policy] if an AI model assisted with the creation of your ++ contribution. ++ ++ [OpenSSL AI Code and Documentation Contribution ++ Policy]: ++ ++ 3. All source files should start with the following text (with + appropriate comment characters at the start of each line and the + year(s) updated): + + ``` + Copyright 20xx-20yy The OpenSSL Project Authors. All Rights Reserved. + + Licensed under the Apache License 2.0 (the "License"). You may not use + this file except in compliance with the License. You can obtain a copy + in the file LICENSE in the source distribution or at + https://www.openssl.org/source/license.html + ``` + - 3. Patches should be as current as possible; expect to have to rebase ++ 4. Patches should be as current as possible; expect to have to rebase + often. We do not accept merge commits, you will have to remove them + (usually by rebasing) before it will be acceptable. + - 4. Code provided should follow our [coding style] and [documentation policy] ++ 5. Code provided should follow our [coding style] and [documentation policy] + and compile without warnings. + There is a [Perl tool](util/check-format.pl) that helps + finding code formatting mistakes and other coding style nits. + Where `gcc` or `clang` is available, you should use the + `--strict-warnings` `Configure` option. OpenSSL compiles on many varied + platforms: try to ensure you only use portable features. + Clean builds via GitHub Actions are required. They are started automatically + whenever a PR is created or updated by committers. + + [coding style]: https://openssl-library.org/policies/technical/coding-style/ + [documentation policy]: https://openssl-library.org/policies/technical/documentation-policy/ + - 5. When at all possible, code contributions should include tests. These can ++ 6. When at all possible, code contributions should include tests. These can + either be added to an existing test, or completely new. Please see + [test/README.md](test/README.md) for information on the test framework. + - 6. New features or changed functionality must include ++ 7. New features or changed functionality must include + documentation. Please look at the `.pod` files in `doc/man[1357]` for + examples of our style. Run `make doc-nits` to make sure that your + documentation changes are clean. + - 7. For user visible changes (API changes, behaviour changes, ...), ++ 8. For user visible changes (API changes, behaviour changes, ...), + consider adding a note in [CHANGES.md](CHANGES.md). + This could be a summarising description of the change, and could + explain the grander details. + Have a look through existing entries for inspiration. + Please note that this is NOT simply a copy of git-log one-liners. + Also note that security fixes get an entry in [CHANGES.md](CHANGES.md). + This file helps users get more in-depth information of what comes + with a specific release without having to sift through the higher + noise ratio in git-log. + - 8. Guidelines on how to integrate error output of new crypto library modules ++ 9. Guidelines on how to integrate error output of new crypto library modules + can be found in [crypto/err/README.md](crypto/err/README.md). diff --cc crypto/openssl/crypto/aes/asm/aesni-mb-x86_64.pl index dde15b1ef7ee,87ed95cdf33c..87ed95cdf33c mode 100755,100644..100755 --- a/crypto/openssl/crypto/aes/asm/aesni-mb-x86_64.pl +++ b/crypto/openssl/crypto/aes/asm/aesni-mb-x86_64.pl diff --cc crypto/openssl/crypto/aes/asm/aesni-sha1-x86_64.pl index 4e8fa1d753d7,bc08da946064..bc08da946064 mode 100755,100644..100755 --- a/crypto/openssl/crypto/aes/asm/aesni-sha1-x86_64.pl +++ b/crypto/openssl/crypto/aes/asm/aesni-sha1-x86_64.pl diff --cc crypto/openssl/crypto/aes/asm/aesni-sha256-x86_64.pl index 39d29ddbb022,6715ba2e11a7..6715ba2e11a7 mode 100755,100644..100755 --- a/crypto/openssl/crypto/aes/asm/aesni-sha256-x86_64.pl +++ b/crypto/openssl/crypto/aes/asm/aesni-sha256-x86_64.pl diff --cc crypto/openssl/crypto/modes/asm/aesni-gcm-x86_64.pl index c63570bae42f,202883dac35e..202883dac35e mode 100755,100644..100755 --- a/crypto/openssl/crypto/modes/asm/aesni-gcm-x86_64.pl +++ b/crypto/openssl/crypto/modes/asm/aesni-gcm-x86_64.pl diff --cc crypto/openssl/crypto/modes/asm/ghash-x86_64.pl index 6ef8e555d0a2,181793c5523c..181793c5523c mode 100755,100644..100755 --- a/crypto/openssl/crypto/modes/asm/ghash-x86_64.pl +++ b/crypto/openssl/crypto/modes/asm/ghash-x86_64.pl diff --cc crypto/openssl/crypto/sha/asm/sha1-586.pl index 00350324a117,81c3658b0adf..81c3658b0adf mode 100755,100644..100755 --- a/crypto/openssl/crypto/sha/asm/sha1-586.pl +++ b/crypto/openssl/crypto/sha/asm/sha1-586.pl diff --cc crypto/openssl/crypto/sha/asm/sha1-mb-x86_64.pl index d9d1630d16db,59042c90b2fe..59042c90b2fe mode 100755,100644..100755 --- a/crypto/openssl/crypto/sha/asm/sha1-mb-x86_64.pl +++ b/crypto/openssl/crypto/sha/asm/sha1-mb-x86_64.pl diff --cc crypto/openssl/crypto/sha/asm/sha256-586.pl index 8e19cd875e3f,3983e55ff9e8..3983e55ff9e8 mode 100755,100644..100755 --- a/crypto/openssl/crypto/sha/asm/sha256-586.pl +++ b/crypto/openssl/crypto/sha/asm/sha256-586.pl diff --cc crypto/openssl/crypto/sha/asm/sha256-mb-x86_64.pl index 9398b7954a7f,e53517d787f6..e53517d787f6 mode 100755,100644..100755 --- a/crypto/openssl/crypto/sha/asm/sha256-mb-x86_64.pl +++ b/crypto/openssl/crypto/sha/asm/sha256-mb-x86_64.pl diff --cc crypto/openssl/doc/man3/NAME_CONSTRAINTS_check.pod index 000000000000,3dfe39ea2942..3dfe39ea2942 mode 000000,100644..100644 --- a/crypto/openssl/doc/man3/NAME_CONSTRAINTS_check.pod +++ b/crypto/openssl/doc/man3/NAME_CONSTRAINTS_check.pod diff --cc crypto/openssl/doc/man3/OPENSSL_armcap.pod index 000000000000,78c8d3fbedc9..78c8d3fbedc9 mode 000000,100644..100644 --- a/crypto/openssl/doc/man3/OPENSSL_armcap.pod +++ b/crypto/openssl/doc/man3/OPENSSL_armcap.pod diff --cc crypto/openssl/test/certs/delta-crl-as-complete-ca.pem index 000000000000,c7bade031a63..c7bade031a63 mode 000000,100644..100644 --- a/crypto/openssl/test/certs/delta-crl-as-complete-ca.pem +++ b/crypto/openssl/test/certs/delta-crl-as-complete-ca.pem diff --cc crypto/openssl/test/certs/delta-crl-as-complete-delta-reasons.pem index 000000000000,d20bc63f53b5..d20bc63f53b5 mode 000000,100644..100644 --- a/crypto/openssl/test/certs/delta-crl-as-complete-delta-reasons.pem +++ b/crypto/openssl/test/certs/delta-crl-as-complete-delta-reasons.pem diff --cc crypto/openssl/test/certs/delta-crl-as-complete-delta.pem index 000000000000,301a6b009a86..301a6b009a86 mode 000000,100644..100644 --- a/crypto/openssl/test/certs/delta-crl-as-complete-delta.pem +++ b/crypto/openssl/test/certs/delta-crl-as-complete-delta.pem diff --cc crypto/openssl/test/certs/delta-crl-as-complete-leaf.pem index 000000000000,c8ffebdb646b..c8ffebdb646b mode 000000,100644..100644 --- a/crypto/openssl/test/certs/delta-crl-as-complete-leaf.pem +++ b/crypto/openssl/test/certs/delta-crl-as-complete-leaf.pem diff --cc crypto/openssl/test/certs/server-ec-compressed-cert.pem index 000000000000,4e97f49af250..4e97f49af250 mode 000000,100644..100644 --- a/crypto/openssl/test/certs/server-ec-compressed-cert.pem +++ b/crypto/openssl/test/certs/server-ec-compressed-cert.pem diff --cc crypto/openssl/test/certs/server-ec-compressed-key.pem index 000000000000,98218fcb3cde..98218fcb3cde mode 000000,100644..100644 --- a/crypto/openssl/test/certs/server-ec-compressed-key.pem +++ b/crypto/openssl/test/certs/server-ec-compressed-key.pem diff --cc crypto/openssl/test/fipsidentity.cnf index 000000000000,30b7775275d6..30b7775275d6 mode 000000,100644..100644 --- a/crypto/openssl/test/fipsidentity.cnf +++ b/crypto/openssl/test/fipsidentity.cnf diff --cc crypto/openssl/test/recipes/20-test_app_s_client.t index 000000000000,162fb710dac2..162fb710dac2 mode 000000,100644..100644 --- a/crypto/openssl/test/recipes/20-test_app_s_client.t +++ b/crypto/openssl/test/recipes/20-test_app_s_client.t diff --cc crypto/openssl/test/recipes/70-test_rio_poll_builder.t index 000000000000,e76c2f280a78..e76c2f280a78 mode 000000,100644..100644 --- a/crypto/openssl/test/recipes/70-test_rio_poll_builder.t +++ b/crypto/openssl/test/recipes/70-test_rio_poll_builder.t diff --cc crypto/openssl/test/recipes/80-test_cms_data/authenticated_attrs.pem index 000000000000,4f3d21269801..4f3d21269801 mode 000000,100644..100644 --- a/crypto/openssl/test/recipes/80-test_cms_data/authenticated_attrs.pem +++ b/crypto/openssl/test/recipes/80-test_cms_data/authenticated_attrs.pem diff --cc crypto/openssl/test/recipes/80-test_cms_data/authenveloped_attrs.pem index 000000000000,75c8eab00b88..75c8eab00b88 mode 000000,100644..100644 --- a/crypto/openssl/test/recipes/80-test_cms_data/authenveloped_attrs.pem +++ b/crypto/openssl/test/recipes/80-test_cms_data/authenveloped_attrs.pem diff --cc crypto/openssl/test/recipes/80-test_cms_data/bad_authenveloped_attrs.pem index 000000000000,e14946c96d88..e14946c96d88 mode 000000,100644..100644 --- a/crypto/openssl/test/recipes/80-test_cms_data/bad_authenveloped_attrs.pem +++ b/crypto/openssl/test/recipes/80-test_cms_data/bad_authenveloped_attrs.pem diff --cc crypto/openssl/test/rio_poll_builder_test.c index 000000000000,f4acb7b9c20b..f4acb7b9c20b mode 000000,100644..100644 --- a/crypto/openssl/test/rio_poll_builder_test.c +++ b/crypto/openssl/test/rio_poll_builder_test.c diff --cc crypto/openssl/test/ssl-tests/33-compressed-spki.cnf index 000000000000,fd9816a27ef5..fd9816a27ef5 mode 000000,100644..100644 --- a/crypto/openssl/test/ssl-tests/33-compressed-spki.cnf +++ b/crypto/openssl/test/ssl-tests/33-compressed-spki.cnf diff --cc crypto/openssl/test/ssl-tests/33-compressed-spki.cnf.in index 000000000000,06302a46a99e..06302a46a99e mode 000000,100644..100644 --- a/crypto/openssl/test/ssl-tests/33-compressed-spki.cnf.in +++ b/crypto/openssl/test/ssl-tests/33-compressed-spki.cnf.in