mbox series

[v2,0/4] Disable OpenSSL and Python3-cryptography legacy features by default

Message ID 20260213230130.757732-1-colinmca242@gmail.com
Headers show
Series Disable OpenSSL and Python3-cryptography legacy features by default | expand

Message

Colin Pinnell McAllister Feb. 13, 2026, 11:01 p.m. UTC 
TLS 1.0 and 1.1 have been deprecated by the IETF since 2021, and
OpenSSL's legacy module contains deprecated and unmaintained components.
This series disables legacy support by default in both OpenSSL and
python3-cryptography, requiring users to explicitly opt-in if needed.

The first two patches add packageconfig options to control legacy TLS
protocol support and the legacy OpenSSL module. The final patch aligns
python3-cryptography with the new OpenSSL defaults.

Note that the TLS 1.0/1.1 changes replace the existing "no-tls1" and
"no-tls1_1" packageconfig options with affirmative "tls1" and "tls1_1"
options that are disabled by default. While less disruptive to enable
the "no-*" options by default, using affirmative options provides
consistency with the new "legacy" option and is clearer than having
default-enabled "no-*" options.

V2 changes:
* Added a backport of the TLS test fix from GH-144790 to fix test
  failures with TLS 1.2 as the minimum version when TLS 1.0 and 1.1 are disabled.
* Updated TLS patch commit message to be more clear as "1.x" could also
  apply to TLS 1.2/1.3
* Removed conditional logic to add the legacy package based on the
  packageconfig setting
* Moved OpenSSL legacy package to an rrecommends for libcrypto and
  ptests

Testing:
* For OpenSSL legacy package:
  ptests ran: openssl and python3-cryptography
  * legacy enabled, legacy-openssl disabled: Builds and ptests pass
  * legacy enabled, legacy-openssl enabled: Builds and ptests pass
  * legacy disabled, legacy-openssl enabled: Build fails as expected,
    with "Nothing provides openssl-ossl-module-legacy"
  * legacy disabled, legacy-openssl disabled: Builds and ptests pass
* For TLS 1.0/1.1 changes:
  ptests ran: openssl and python3
  * tls1 disabled, tls1_1 disabled: Builds and ptests pass
  * tls1 disabled, tls1_1 enabled: Builds and ptests pass
  * tls1 enabled, tls1_1 disabled: Builds and ptests pass
  * tls1 enabled, tls1_1 enabled: Builds and ptests pass

Colin Pinnell McAllister (4):
  python3: Backport TLS test fix
  openssl: Disable TLS 1.0/1.1 by default
  openssl: Add legacy packageconfig option
  python3-cryptography: Disable legacy-openssl by default

 .../openssl/openssl_3.5.5.bb                  |  8 ++--
 .../python/python3-cryptography.bb            |  2 +-
 ...Allow-TLS-v1.2-to-be-minimum-version.patch | 39 +++++++++++++++++++
 .../recipes-devtools/python/python3_3.14.2.bb |  1 +
 4 files changed, 46 insertions(+), 4 deletions(-)
 create mode 100644 meta/recipes-devtools/python/python3/0001-gh-144787-tests-Allow-TLS-v1.2-to-be-minimum-version.patch