git: 78e936b2d0b5 - main - crypto/openssl: update to 3.5.8
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Sat, 29 Aug 2026 01:42:11 UTC
The branch main has been updated by ngie:
URL: https://cgit.FreeBSD.org/src/commit/?id=78e936b2d0b5e6554425009199be31e76bc67c10
commit 78e936b2d0b5e6554425009199be31e76bc67c10
Merge: 7dc428461549 248da023ae5e
Author: Enji Cooper <ngie@FreeBSD.org>
AuthorDate: 2026-08-29 01:28:12 +0000
Commit: Enji Cooper <ngie@FreeBSD.org>
CommitDate: 2026-08-29 01:28:12 +0000
crypto/openssl: update to 3.5.8
This is a security bugfix release. Please see the related merge commit
for more details.
Maintainer note: `quic_ackm.h`'s conflict was resolved by taking
the upstream version of the file verbatim.
Conflicts:
crypto/openssl/include/internal/quic_ackm.h
MFC after: 3 days
Merge commit '248da023ae5ea7292930ac5d715d88b87e2e6f46'
crypto/openssl/CHANGES.md | 258 +
crypto/openssl/CONTRIBUTING.md | 44 +-
crypto/openssl/NEWS.md | 56 +
crypto/openssl/README-FIPS.md | 12 +-
crypto/openssl/VERSION.dat | 4 +-
crypto/openssl/apps/lib/apps.c | 25 +-
crypto/openssl/apps/lib/s_cb.c | 6 +-
crypto/openssl/apps/lib/vms_term_sock.c | 4 +-
crypto/openssl/apps/s_client.c | 55 +-
crypto/openssl/crypto/aes/aes_x86core.c | 867 -
crypto/openssl/crypto/aes/asm/aesni-mb-x86_64.pl | 9 +-
crypto/openssl/crypto/aes/asm/aesni-sha1-x86_64.pl | 5 +-
.../openssl/crypto/aes/asm/aesni-sha256-x86_64.pl | 9 +-
crypto/openssl/crypto/aes/asm/aesni-xts-avx512.pl | 7 +
crypto/openssl/crypto/armcap.c | 36 +-
crypto/openssl/crypto/asn1/a_d2i_fp.c | 15 +-
crypto/openssl/crypto/asn1/a_mbstr.c | 20 +-
crypto/openssl/crypto/asn1/asn1_gen.c | 5 +-
crypto/openssl/crypto/bio/bss_file.c | 8 +-
crypto/openssl/crypto/bn/asm/rsaz-2k-avx512.pl | 9 +-
crypto/openssl/crypto/bn/asm/rsaz-2k-avxifma.pl | 7 +
crypto/openssl/crypto/bn/asm/rsaz-3k-avx512.pl | 9 +-
crypto/openssl/crypto/bn/asm/rsaz-3k-avxifma.pl | 7 +
crypto/openssl/crypto/bn/asm/rsaz-4k-avx512.pl | 9 +-
crypto/openssl/crypto/bn/asm/rsaz-4k-avxifma.pl | 7 +
crypto/openssl/crypto/bn/asm/rsaz-avx2.pl | 10 +-
crypto/openssl/crypto/bn/asm/rsaz-x86_64.pl | 9 +-
crypto/openssl/crypto/bn/asm/x86_64-mont.pl | 9 +-
crypto/openssl/crypto/bn/asm/x86_64-mont5.pl | 9 +-
crypto/openssl/crypto/bn/bn_add.c | 9 +-
crypto/openssl/crypto/bn/bn_exp.c | 7 +-
crypto/openssl/crypto/bn/bn_lib.c | 32 +-
crypto/openssl/crypto/chacha/asm/chacha-x86.pl | 6 +-
crypto/openssl/crypto/chacha/asm/chacha-x86_64.pl | 9 +-
crypto/openssl/crypto/cmp/cmp_protect.c | 2 +-
crypto/openssl/crypto/cmp/cmp_vfy.c | 22 +-
crypto/openssl/crypto/cms/cms_asn1.c | 8 +-
crypto/openssl/crypto/cms/cms_env.c | 46 +-
crypto/openssl/crypto/cms/cms_kari.c | 8 +-
crypto/openssl/crypto/cms/cms_local.h | 3 +
crypto/openssl/crypto/cms/cms_pwri.c | 5 +-
crypto/openssl/crypto/cms/cms_smime.c | 39 +
crypto/openssl/crypto/ct/ct_b64.c | 8 +-
crypto/openssl/crypto/ctype.c | 6 +-
crypto/openssl/crypto/dh/dh_backend.c | 4 +-
crypto/openssl/crypto/dh/dh_check.c | 24 +-
crypto/openssl/crypto/dsa/dsa_key.c | 3 +-
.../openssl/crypto/ec/asm/ecp_nistz256-x86_64.pl | 10 +-
crypto/openssl/crypto/ec/asm/x25519-x86_64.pl | 9 +-
crypto/openssl/crypto/ec/ec_key.c | 56 +-
crypto/openssl/crypto/err/openssl.txt | 1 +
crypto/openssl/crypto/evp/exchange.c | 4 +-
crypto/openssl/crypto/ffc/ffc_params_generate.c | 9 +-
crypto/openssl/crypto/hmac/hmac.c | 10 +-
crypto/openssl/crypto/http/http_lib.c | 27 +-
crypto/openssl/crypto/ml_dsa/ml_dsa_encoders.c | 5 +-
crypto/openssl/crypto/ml_dsa/ml_dsa_key.c | 14 +-
crypto/openssl/crypto/ml_dsa/ml_dsa_matrix.c | 8 +-
crypto/openssl/crypto/ml_dsa/ml_dsa_sample.c | 47 +-
crypto/openssl/crypto/ml_dsa/ml_dsa_sign.c | 19 +-
crypto/openssl/crypto/ml_dsa/ml_dsa_vector.h | 4 +-
crypto/openssl/crypto/ml_kem/ml_kem.c | 107 +-
crypto/openssl/crypto/modes/asm/aes-gcm-avx512.pl | 9 +-
.../openssl/crypto/modes/asm/aesni-gcm-x86_64.pl | 9 +-
crypto/openssl/crypto/modes/asm/ghash-x86_64.pl | 9 +-
crypto/openssl/crypto/pem/pvkfmt.c | 8 +-
crypto/openssl/crypto/pkcs12/p12_add.c | 4 +-
crypto/openssl/crypto/pkcs12/p12_decr.c | 5 +-
crypto/openssl/crypto/pkcs12/p12_utl.c | 2 +
crypto/openssl/crypto/pkcs7/pk7_doit.c | 2 +-
crypto/openssl/crypto/pkcs7/pk7_lib.c | 18 +-
crypto/openssl/crypto/poly1305/asm/poly1305-x86.pl | 9 +-
.../openssl/crypto/poly1305/asm/poly1305-x86_64.pl | 9 +-
crypto/openssl/crypto/rand/rand_lib.c | 17 +-
crypto/openssl/crypto/rsa/rsa_gen.c | 3 +-
crypto/openssl/crypto/rsa/rsa_ossl.c | 16 +-
crypto/openssl/crypto/sha/asm/sha1-586.pl | 5 +-
crypto/openssl/crypto/sha/asm/sha1-mb-x86_64.pl | 9 +-
crypto/openssl/crypto/sha/asm/sha1-x86_64.pl | 9 +-
crypto/openssl/crypto/sha/asm/sha256-586.pl | 9 +-
crypto/openssl/crypto/sha/asm/sha256-mb-x86_64.pl | 9 +-
crypto/openssl/crypto/sha/asm/sha512-x86_64.pl | 9 +-
crypto/openssl/crypto/sha/sha_riscv.c | 10 +-
crypto/openssl/crypto/slh_dsa/slh_dsa.c | 37 +-
crypto/openssl/crypto/slh_dsa/slh_dsa_hash_ctx.c | 5 +-
crypto/openssl/crypto/slh_dsa/slh_dsa_key.c | 6 +
crypto/openssl/crypto/slh_dsa/slh_dsa_local.h | 14 +-
crypto/openssl/crypto/slh_dsa/slh_fors.c | 52 +-
crypto/openssl/crypto/slh_dsa/slh_hash.c | 38 +-
crypto/openssl/crypto/slh_dsa/slh_hypertree.c | 23 +-
crypto/openssl/crypto/slh_dsa/slh_wots.c | 6 +-
crypto/openssl/crypto/slh_dsa/slh_xmss.c | 29 +-
crypto/openssl/crypto/threads_win.c | 14 +
crypto/openssl/crypto/x509/by_dir.c | 38 +-
crypto/openssl/crypto/x509/pcy_cache.c | 7 +-
crypto/openssl/crypto/x509/v3_akid.c | 6 +-
crypto/openssl/crypto/x509/v3_ncons.c | 9 +-
crypto/openssl/crypto/x509/x509_err.c | 4 +-
crypto/openssl/crypto/x509/x509_lu.c | 9 +-
crypto/openssl/crypto/x509/x509_vfy.c | 9 +-
crypto/openssl/crypto/x509/x_crl.c | 6 +-
crypto/openssl/crypto/x509/x_pubkey.c | 2 +-
crypto/openssl/doc/build.info | 12 +
.../openssl/doc/internal/man3/DEFINE_LIST_OF.pod | 13 +-
crypto/openssl/doc/man1/openssl-pkeyutl.pod.in | 8 +-
crypto/openssl/doc/man1/openssl.pod | 6 +-
crypto/openssl/doc/man3/ASN1_INTEGER_get_int64.pod | 4 +-
crypto/openssl/doc/man3/ASN1_aux_cb.pod | 62 +-
crypto/openssl/doc/man3/ASN1_item_d2i_bio.pod | 18 +-
crypto/openssl/doc/man3/BIO_s_datagram.pod | 4 +-
crypto/openssl/doc/man3/BIO_s_file.pod | 9 +-
crypto/openssl/doc/man3/BN_generate_prime.pod | 4 +-
.../openssl/doc/man3/CMS_EncryptedData_decrypt.pod | 4 +-
crypto/openssl/doc/man3/NAME_CONSTRAINTS_check.pod | 211 +
crypto/openssl/doc/man3/OPENSSL_armcap.pod | 246 +
crypto/openssl/doc/man3/OPENSSL_init_crypto.pod | 7 +-
crypto/openssl/doc/man3/SSL_CTX_set1_curves.pod | 6 +-
.../openssl/doc/man3/SSL_CTX_set_msg_callback.pod | 4 +-
crypto/openssl/doc/man3/SSL_CTX_set_verify.pod | 6 +-
crypto/openssl/doc/man3/SSL_get_value_uint.pod | 22 +-
crypto/openssl/doc/man3/SSL_new.pod | 10 +-
crypto/openssl/doc/man3/SSL_poll.pod | 20 +-
.../doc/man3/X509_get_default_cert_file.pod | 4 +-
crypto/openssl/doc/man3/X509_verify_cert.pod | 512 +-
crypto/openssl/doc/man7/EVP_CIPHER-SM4.pod | 12 +-
crypto/openssl/doc/man7/EVP_SIGNATURE-ECDSA.pod | 2 +-
crypto/openssl/doc/man7/EVP_SIGNATURE-RSA.pod | 2 +-
crypto/openssl/doc/man7/fips_module.pod | 11 +-
.../openssl/doc/man7/openssl-core_dispatch.h.pod | 4 +-
crypto/openssl/doc/man7/openssl-env.pod | 4 +-
.../openssl/doc/man7/openssl-quic-concurrency.pod | 29 +-
crypto/openssl/doc/man7/openssl-threads.pod | 30 +-
crypto/openssl/doc/man7/provider-kem.pod | 19 +-
crypto/openssl/doc/man7/provider-signature.pod | 2 +-
crypto/openssl/fuzz/provider.c | 9 +-
crypto/openssl/include/internal/hashtable.h | 4 +-
crypto/openssl/include/internal/list.h | 31 +-
crypto/openssl/include/internal/quic_ackm.h | 4 +-
crypto/openssl/include/internal/quic_port.h | 6 +-
crypto/openssl/include/internal/quic_record_rx.h | 2 +-
crypto/openssl/include/internal/quic_ssl.h | 3 +-
crypto/openssl/include/openssl/ssl.h.in | 19 +-
crypto/openssl/include/openssl/x509err.h | 3 +-
crypto/openssl/providers/baseprov.c | 10 +-
crypto/openssl/providers/defltprov.c | 8 +-
crypto/openssl/providers/fips-sources.checksums | 152 +-
crypto/openssl/providers/fips.checksum | 2 +-
crypto/openssl/providers/fips/fipsprov.c | 10 +-
.../ciphers/cipher_aes_gcm_siv_hw.c | 14 +-
.../implementations/ciphers/cipher_aes_ocb.c | 4 +
.../ciphers/cipher_chacha20_poly1305.c | 27 +-
.../ciphers/cipher_chacha20_poly1305_hw.c | 4 +-
.../implementations/ciphers/ciphercommon_ccm.c | 17 +-
.../implementations/encode_decode/encode_key2ms.c | 5 +-
.../providers/implementations/kem/ml_kem_kem.c | 3 +-
.../providers/implementations/kem/mlx_kem.c | 12 +-
.../providers/implementations/kem/rsa_kem.c | 51 +
.../providers/implementations/keymgmt/dh_kmgmt.c | 6 +-
.../providers/implementations/keymgmt/ec_kmgmt.c | 20 +-
.../providers/implementations/keymgmt/ecx_kmgmt.c | 2 -
.../implementations/keymgmt/ml_dsa_kmgmt.c | 13 +-
.../implementations/keymgmt/ml_kem_kmgmt.c | 35 +-
.../providers/implementations/keymgmt/mlx_kmgmt.c | 26 +-
.../implementations/keymgmt/slh_dsa_kmgmt.c | 20 +-
.../providers/implementations/macs/cmac_prov.c | 4 +-
.../providers/implementations/macs/poly1305_prov.c | 6 +-
.../providers/implementations/rands/drbg_ctr.c | 57 +-
.../providers/implementations/rands/drbg_hash.c | 38 +-
.../providers/implementations/rands/drbg_hmac.c | 39 +-
.../implementations/rands/seeding/rand_unix.c | 4 +-
.../providers/implementations/rands/test_rng.c | 6 +-
.../providers/implementations/signature/rsa_sig.c | 12 +-
.../implementations/signature/slh_dsa_sig.c | 2 +-
.../implementations/storemgmt/file_store_any2obj.c | 6 +-
crypto/openssl/ssl/quic/quic_ackm.c | 17 +-
crypto/openssl/ssl/quic/quic_impl.c | 56 +
crypto/openssl/ssl/quic/quic_port.c | 16 +
crypto/openssl/ssl/quic/quic_port_local.h | 3 +-
crypto/openssl/ssl/quic/quic_rx_depack.c | 15 +-
crypto/openssl/ssl/quic/quic_stream_map.c | 4 +
crypto/openssl/ssl/record/methods/dtls_meth.c | 2 +-
.../openssl/ssl/record/methods/recmethod_local.h | 2 +-
crypto/openssl/ssl/record/methods/tls_common.c | 28 +-
crypto/openssl/ssl/record/rec_layer_s3.c | 4 +-
crypto/openssl/ssl/rio/poll_builder.c | 6 +-
crypto/openssl/ssl/rio/poll_builder.h | 15 +-
crypto/openssl/ssl/rio/poll_immediate.c | 31 +-
crypto/openssl/ssl/rio/rio_notifier.c | 22 +-
crypto/openssl/ssl/s3_lib.c | 5 +-
crypto/openssl/ssl/ssl_cert.c | 8 +-
crypto/openssl/ssl/ssl_lib.c | 25 +
crypto/openssl/ssl/ssl_local.h | 7 +-
crypto/openssl/ssl/ssl_rsa.c | 8 +-
crypto/openssl/ssl/statem/extensions.c | 27 +-
crypto/openssl/ssl/statem/statem_clnt.c | 8 +
crypto/openssl/ssl/statem/statem_lib.c | 4 +-
crypto/openssl/ssl/statem/statem_srvr.c | 6 +-
crypto/openssl/ssl/t1_lib.c | 105 +-
crypto/openssl/test/asn1_decode_test.c | 165 +
crypto/openssl/test/build.info | 7 +-
crypto/openssl/test/ca_internals_test.c | 6 +-
.../test/certs/delta-crl-as-complete-ca.pem | 20 +
.../certs/delta-crl-as-complete-delta-reasons.pem | 12 +
.../test/certs/delta-crl-as-complete-delta.pem | 12 +
.../test/certs/delta-crl-as-complete-leaf.pem | 20 +
.../test/certs/server-ec-compressed-cert.pem | 12 +
.../test/certs/server-ec-compressed-key.pem | 5 +
crypto/openssl/test/cmp_client_test.c | 12 +-
crypto/openssl/test/cmp_protect_test.c | 2 +-
crypto/openssl/test/cmp_vfy_test.c | 2 +-
crypto/openssl/test/cmsapitest.c | 103 +-
crypto/openssl/test/crltest.c | 125 +-
crypto/openssl/test/endecode_test.c | 508 +-
crypto/openssl/test/evp_extra_test.c | 854 +-
crypto/openssl/test/evp_extra_test2.c | 517 +-
crypto/openssl/test/fipsidentity.cnf | 23 +
crypto/openssl/test/helpers/quictestlib.c | 319 +-
crypto/openssl/test/helpers/quictestlib.h | 6 +-
crypto/openssl/test/helpers/ssltestlib.c | 63 +-
crypto/openssl/test/helpers/ssltestlib.h | 5 +-
crypto/openssl/test/hpke_test.c | 22 +-
crypto/openssl/test/http_test.c | 28 +-
crypto/openssl/test/list_test.c | 48 +-
crypto/openssl/test/p_test.c | 6 +-
crypto/openssl/test/pairwise_fail_test.c | 4 +-
crypto/openssl/test/pkcs12_api_test.c | 4 +-
crypto/openssl/test/pkcs7_test.c | 116 +-
crypto/openssl/test/punycode_test.c | 4 +-
crypto/openssl/test/quic_ackm_test.c | 68 +-
crypto/openssl/test/quic_multistream_test.c | 11 +-
crypto/openssl/test/quic_tserver_test.c | 38 +-
crypto/openssl/test/quicapitest.c | 126 +
crypto/openssl/test/radix/quic_bindings.c | 19 +-
crypto/openssl/test/radix/quic_ops.c | 61 +-
crypto/openssl/test/radix/quic_tests.c | 342 +-
crypto/openssl/test/recipes/20-test_app_s_client.t | 110 +
crypto/openssl/test/recipes/20-test_cli_fips.t | 42 +-
crypto/openssl/test/recipes/25-test_verify.t | 34 +-
.../test/recipes/30-test_evp_data/evprand.txt | 79844 -------------------
.../openssl/test/recipes/30-test_pairwise_fail.t | 12 +-
crypto/openssl/test/recipes/65-test_cmp_msg.t | 2 +-
.../test/recipes/70-test_rio_poll_builder.t | 19 +
crypto/openssl/test/recipes/70-test_sslrecords.t | 12 +-
crypto/openssl/test/recipes/80-test_cms.t | 64 +-
.../80-test_cms_data/authenticated_attrs.pem | 8 +
.../80-test_cms_data/authenveloped_attrs.pem | 7 +
.../80-test_cms_data/bad_authenveloped_attrs.pem | 7 +
crypto/openssl/test/recipes/80-test_cmsapi.t | 3 +-
crypto/openssl/test/recipes/80-test_ssl_new.t | 6 +-
crypto/openssl/test/rio_poll_builder_test.c | 45 +
crypto/openssl/test/rpktest.c | 2 +-
crypto/openssl/test/secmemtest.c | 4 +-
.../openssl/test/ssl-tests/33-compressed-spki.cnf | 76 +
.../test/ssl-tests/33-compressed-spki.cnf.in | 81 +
crypto/openssl/test/sslapitest.c | 172 +
crypto/openssl/test/x509_test.c | 98 +
crypto/openssl/util/missingcrypto.txt | 2 -
crypto/openssl/util/other.syms | 5 +-
crypto/openssl/util/perl/TLSProxy/Proxy.pm | 10 +-
259 files changed, 7392 insertions(+), 81990 deletions(-)
diff --cc crypto/openssl/CONTRIBUTING.md
index 06dfbaeff1fe,000000000000..8a0d40524ddb
mode 100644,000000..100644
--- a/crypto/openssl/CONTRIBUTING.md
+++ b/crypto/openssl/CONTRIBUTING.md
@@@ -1,124 -1,0 +1,154 @@@
+HOW TO CONTRIBUTE TO OpenSSL
+============================
+
+Please visit our [Getting Started] page for other ideas about how to contribute.
+
+ [Getting Started]: <https://openssl-library.org/community/getting-started>
+
+Development is done on GitHub in the [openssl/openssl] repository.
+
+ [openssl/openssl]: <https://github.com/openssl/openssl>
+
+To request a new feature, ask a question, or report a bug,
+please open an [issue on GitHub](https://github.com/openssl/openssl/issues).
+
+To submit a patch or implement a new feature, please open a
+[pull request on GitHub](https://github.com/openssl/openssl/pulls).
+If you are thinking of making a large contribution,
+open an issue for it before starting work, to get comments from the community.
+Someone may be already working on the same thing,
+or there may be special reasons why a feature is not implemented.
+
+Similarly, if you plan to submit many pull requests, please start with
+a representative sample (no more than 3 or 4) and open an issue
+explaining your process. The OpenSSL project has limited resources,
+especially when it comes to reviewers, so we appreciate advanced
+communication before submitting many pull requests. In addition,
+contributors should personally evaluate potential patches generated by
+automated tools.
+
+Provide a clear description of the issue or feature being addressed,
+including any relevant implementation details and, for performance
+improvements, benchmark results.
+
+Pull requests and commits should be self-contained, enabling readers to
+understand what changed and why without needing to reference related
+issues or having prior knowledge. Commit messages should include all
+relevant details to help future contributors follow the git history,
+with clear explanations of what is changing and why. Long descriptions
+are encouraged if they aid understanding. Commit message titles (their
+first line) should be kept to 50-70 characters if possible.
+
+To make it easier to review and accept your pull request, please follow these
+guidelines:
+
+ 1. Anything other than a trivial contribution requires a [Contributor
+ License Agreement] (CLA), giving us permission to use your code.
+ If your contribution is too small to require a CLA (e.g., fixing a spelling
+ mistake), then place the text "`CLA: trivial`" on a line by itself below
+ the rest of your commit message separated by an empty line, like this:
+
+ ```
+ One-line summary of trivial change
+
+ Optional main body of commit message. It might contain a sentence
+ or two explaining the trivial change.
+
+ CLA: trivial
+ ```
+
+ It is not sufficient to only place the text "`CLA: trivial`" in the GitHub
+ pull request description.
+
+ [Contributor License Agreement]: <https://www.openssl.org/policies/cla.html>
+
+ To amend a missing "`CLA: trivial`" line after submission, do the following:
+
+ ```
+ git commit --amend
+ # add the line, save and quit the editor
+ git push -f [<repository> [<branch>]]
+ ```
+
- 2. All source files should start with the following text (with
++ 2. Similarly, if a non-trivial portion of a contribution was created
++ using an AI tool, you must declare which agent and model were used.
++ This is done by adding `Assisted-by: {agent}:{model}` below the commit
++ message:
++
++ ```
++ One-line summary of change with AI-generated portions
++
++ Assisted-by: Claude:claude-sonnet-4-6
++ ```
++
++ Multiple Assisted-by trailers can be included if multiple tools were used:
++
++ ```
++ Assisted-by: Claude:claude-sonnet-4-6
++ Assisted-by: ChatGPT:gpt-4o
++ Assisted-by: GitHub Copilot:gpt-4.1
++ ```
++
++ You will need to have signed a v1.1 or later CLA in order to
++ include AI-generated content in your contribution. CLAs signed
++ after June 2026 will have the requisite clauses.
++
++ Consult the [OpenSSL AI Code and Documentation Contribution
++ Policy] if an AI model assisted with the creation of your
++ contribution.
++
++ [OpenSSL AI Code and Documentation Contribution
++ Policy]: <https://openssl-library.org/policies/general/ai-policy/>
++
++ 3. All source files should start with the following text (with
+ appropriate comment characters at the start of each line and the
+ year(s) updated):
+
+ ```
+ Copyright 20xx-20yy The OpenSSL Project Authors. All Rights Reserved.
+
+ Licensed under the Apache License 2.0 (the "License"). You may not use
+ this file except in compliance with the License. You can obtain a copy
+ in the file LICENSE in the source distribution or at
+ https://www.openssl.org/source/license.html
+ ```
+
- 3. Patches should be as current as possible; expect to have to rebase
++ 4. Patches should be as current as possible; expect to have to rebase
+ often. We do not accept merge commits, you will have to remove them
+ (usually by rebasing) before it will be acceptable.
+
- 4. Code provided should follow our [coding style] and [documentation policy]
++ 5. Code provided should follow our [coding style] and [documentation policy]
+ and compile without warnings.
+ There is a [Perl tool](util/check-format.pl) that helps
+ finding code formatting mistakes and other coding style nits.
+ Where `gcc` or `clang` is available, you should use the
+ `--strict-warnings` `Configure` option. OpenSSL compiles on many varied
+ platforms: try to ensure you only use portable features.
+ Clean builds via GitHub Actions are required. They are started automatically
+ whenever a PR is created or updated by committers.
+
+ [coding style]: https://openssl-library.org/policies/technical/coding-style/
+ [documentation policy]: https://openssl-library.org/policies/technical/documentation-policy/
+
- 5. When at all possible, code contributions should include tests. These can
++ 6. When at all possible, code contributions should include tests. These can
+ either be added to an existing test, or completely new. Please see
+ [test/README.md](test/README.md) for information on the test framework.
+
- 6. New features or changed functionality must include
++ 7. New features or changed functionality must include
+ documentation. Please look at the `.pod` files in `doc/man[1357]` for
+ examples of our style. Run `make doc-nits` to make sure that your
+ documentation changes are clean.
+
- 7. For user visible changes (API changes, behaviour changes, ...),
++ 8. For user visible changes (API changes, behaviour changes, ...),
+ consider adding a note in [CHANGES.md](CHANGES.md).
+ This could be a summarising description of the change, and could
+ explain the grander details.
+ Have a look through existing entries for inspiration.
+ Please note that this is NOT simply a copy of git-log one-liners.
+ Also note that security fixes get an entry in [CHANGES.md](CHANGES.md).
+ This file helps users get more in-depth information of what comes
+ with a specific release without having to sift through the higher
+ noise ratio in git-log.
+
- 8. Guidelines on how to integrate error output of new crypto library modules
++ 9. Guidelines on how to integrate error output of new crypto library modules
+ can be found in [crypto/err/README.md](crypto/err/README.md).
diff --cc crypto/openssl/crypto/aes/asm/aesni-mb-x86_64.pl
index dde15b1ef7ee,87ed95cdf33c..87ed95cdf33c
mode 100755,100644..100755
--- a/crypto/openssl/crypto/aes/asm/aesni-mb-x86_64.pl
+++ b/crypto/openssl/crypto/aes/asm/aesni-mb-x86_64.pl
diff --cc crypto/openssl/crypto/aes/asm/aesni-sha1-x86_64.pl
index 4e8fa1d753d7,bc08da946064..bc08da946064
mode 100755,100644..100755
--- a/crypto/openssl/crypto/aes/asm/aesni-sha1-x86_64.pl
+++ b/crypto/openssl/crypto/aes/asm/aesni-sha1-x86_64.pl
diff --cc crypto/openssl/crypto/aes/asm/aesni-sha256-x86_64.pl
index 39d29ddbb022,6715ba2e11a7..6715ba2e11a7
mode 100755,100644..100755
--- a/crypto/openssl/crypto/aes/asm/aesni-sha256-x86_64.pl
+++ b/crypto/openssl/crypto/aes/asm/aesni-sha256-x86_64.pl
diff --cc crypto/openssl/crypto/modes/asm/aesni-gcm-x86_64.pl
index c63570bae42f,202883dac35e..202883dac35e
mode 100755,100644..100755
--- a/crypto/openssl/crypto/modes/asm/aesni-gcm-x86_64.pl
+++ b/crypto/openssl/crypto/modes/asm/aesni-gcm-x86_64.pl
diff --cc crypto/openssl/crypto/modes/asm/ghash-x86_64.pl
index 6ef8e555d0a2,181793c5523c..181793c5523c
mode 100755,100644..100755
--- a/crypto/openssl/crypto/modes/asm/ghash-x86_64.pl
+++ b/crypto/openssl/crypto/modes/asm/ghash-x86_64.pl
diff --cc crypto/openssl/crypto/sha/asm/sha1-586.pl
index 00350324a117,81c3658b0adf..81c3658b0adf
mode 100755,100644..100755
--- a/crypto/openssl/crypto/sha/asm/sha1-586.pl
+++ b/crypto/openssl/crypto/sha/asm/sha1-586.pl
diff --cc crypto/openssl/crypto/sha/asm/sha1-mb-x86_64.pl
index d9d1630d16db,59042c90b2fe..59042c90b2fe
mode 100755,100644..100755
--- a/crypto/openssl/crypto/sha/asm/sha1-mb-x86_64.pl
+++ b/crypto/openssl/crypto/sha/asm/sha1-mb-x86_64.pl
diff --cc crypto/openssl/crypto/sha/asm/sha256-586.pl
index 8e19cd875e3f,3983e55ff9e8..3983e55ff9e8
mode 100755,100644..100755
--- a/crypto/openssl/crypto/sha/asm/sha256-586.pl
+++ b/crypto/openssl/crypto/sha/asm/sha256-586.pl
diff --cc crypto/openssl/crypto/sha/asm/sha256-mb-x86_64.pl
index 9398b7954a7f,e53517d787f6..e53517d787f6
mode 100755,100644..100755
--- a/crypto/openssl/crypto/sha/asm/sha256-mb-x86_64.pl
+++ b/crypto/openssl/crypto/sha/asm/sha256-mb-x86_64.pl
diff --cc crypto/openssl/doc/man3/NAME_CONSTRAINTS_check.pod
index 000000000000,3dfe39ea2942..3dfe39ea2942
mode 000000,100644..100644
--- a/crypto/openssl/doc/man3/NAME_CONSTRAINTS_check.pod
+++ b/crypto/openssl/doc/man3/NAME_CONSTRAINTS_check.pod
diff --cc crypto/openssl/doc/man3/OPENSSL_armcap.pod
index 000000000000,78c8d3fbedc9..78c8d3fbedc9
mode 000000,100644..100644
--- a/crypto/openssl/doc/man3/OPENSSL_armcap.pod
+++ b/crypto/openssl/doc/man3/OPENSSL_armcap.pod
diff --cc crypto/openssl/test/certs/delta-crl-as-complete-ca.pem
index 000000000000,c7bade031a63..c7bade031a63
mode 000000,100644..100644
--- a/crypto/openssl/test/certs/delta-crl-as-complete-ca.pem
+++ b/crypto/openssl/test/certs/delta-crl-as-complete-ca.pem
diff --cc crypto/openssl/test/certs/delta-crl-as-complete-delta-reasons.pem
index 000000000000,d20bc63f53b5..d20bc63f53b5
mode 000000,100644..100644
--- a/crypto/openssl/test/certs/delta-crl-as-complete-delta-reasons.pem
+++ b/crypto/openssl/test/certs/delta-crl-as-complete-delta-reasons.pem
diff --cc crypto/openssl/test/certs/delta-crl-as-complete-delta.pem
index 000000000000,301a6b009a86..301a6b009a86
mode 000000,100644..100644
--- a/crypto/openssl/test/certs/delta-crl-as-complete-delta.pem
+++ b/crypto/openssl/test/certs/delta-crl-as-complete-delta.pem
diff --cc crypto/openssl/test/certs/delta-crl-as-complete-leaf.pem
index 000000000000,c8ffebdb646b..c8ffebdb646b
mode 000000,100644..100644
--- a/crypto/openssl/test/certs/delta-crl-as-complete-leaf.pem
+++ b/crypto/openssl/test/certs/delta-crl-as-complete-leaf.pem
diff --cc crypto/openssl/test/certs/server-ec-compressed-cert.pem
index 000000000000,4e97f49af250..4e97f49af250
mode 000000,100644..100644
--- a/crypto/openssl/test/certs/server-ec-compressed-cert.pem
+++ b/crypto/openssl/test/certs/server-ec-compressed-cert.pem
diff --cc crypto/openssl/test/certs/server-ec-compressed-key.pem
index 000000000000,98218fcb3cde..98218fcb3cde
mode 000000,100644..100644
--- a/crypto/openssl/test/certs/server-ec-compressed-key.pem
+++ b/crypto/openssl/test/certs/server-ec-compressed-key.pem
diff --cc crypto/openssl/test/fipsidentity.cnf
index 000000000000,30b7775275d6..30b7775275d6
mode 000000,100644..100644
--- a/crypto/openssl/test/fipsidentity.cnf
+++ b/crypto/openssl/test/fipsidentity.cnf
diff --cc crypto/openssl/test/recipes/20-test_app_s_client.t
index 000000000000,162fb710dac2..162fb710dac2
mode 000000,100644..100644
--- a/crypto/openssl/test/recipes/20-test_app_s_client.t
+++ b/crypto/openssl/test/recipes/20-test_app_s_client.t
diff --cc crypto/openssl/test/recipes/70-test_rio_poll_builder.t
index 000000000000,e76c2f280a78..e76c2f280a78
mode 000000,100644..100644
--- a/crypto/openssl/test/recipes/70-test_rio_poll_builder.t
+++ b/crypto/openssl/test/recipes/70-test_rio_poll_builder.t
diff --cc crypto/openssl/test/recipes/80-test_cms_data/authenticated_attrs.pem
index 000000000000,4f3d21269801..4f3d21269801
mode 000000,100644..100644
--- a/crypto/openssl/test/recipes/80-test_cms_data/authenticated_attrs.pem
+++ b/crypto/openssl/test/recipes/80-test_cms_data/authenticated_attrs.pem
diff --cc crypto/openssl/test/recipes/80-test_cms_data/authenveloped_attrs.pem
index 000000000000,75c8eab00b88..75c8eab00b88
mode 000000,100644..100644
--- a/crypto/openssl/test/recipes/80-test_cms_data/authenveloped_attrs.pem
+++ b/crypto/openssl/test/recipes/80-test_cms_data/authenveloped_attrs.pem
diff --cc crypto/openssl/test/recipes/80-test_cms_data/bad_authenveloped_attrs.pem
index 000000000000,e14946c96d88..e14946c96d88
mode 000000,100644..100644
--- a/crypto/openssl/test/recipes/80-test_cms_data/bad_authenveloped_attrs.pem
+++ b/crypto/openssl/test/recipes/80-test_cms_data/bad_authenveloped_attrs.pem
diff --cc crypto/openssl/test/rio_poll_builder_test.c
index 000000000000,f4acb7b9c20b..f4acb7b9c20b
mode 000000,100644..100644
--- a/crypto/openssl/test/rio_poll_builder_test.c
+++ b/crypto/openssl/test/rio_poll_builder_test.c
diff --cc crypto/openssl/test/ssl-tests/33-compressed-spki.cnf
index 000000000000,fd9816a27ef5..fd9816a27ef5
mode 000000,100644..100644
--- a/crypto/openssl/test/ssl-tests/33-compressed-spki.cnf
+++ b/crypto/openssl/test/ssl-tests/33-compressed-spki.cnf
diff --cc crypto/openssl/test/ssl-tests/33-compressed-spki.cnf.in
index 000000000000,06302a46a99e..06302a46a99e
mode 000000,100644..100644
--- a/crypto/openssl/test/ssl-tests/33-compressed-spki.cnf.in
+++ b/crypto/openssl/test/ssl-tests/33-compressed-spki.cnf.in