mbox series

[RFC,0/7] openssl: upgrade to 4.0.1 and fix dependent recipes

Message ID 20260814051829.35088-1-jaipaul.cheernam@est.tech
Headers show
Series openssl: upgrade to 4.0.1 and fix dependent recipes | expand

Message

Jaipaul Cheernam Aug. 14, 2026, 5:18 a.m. UTC 
This series upgrades OpenSSL from 3.5.7 to 4.0.1 and fixes all
dependent recipes that break due to API changes in OpenSSL 4.0.

OpenSSL 4.0 is a major release with several breaking changes:
- ENGINE API fully removed
- SSLv3 support removed
- Per-version TLS method functions (SSLv3_method etc.) removed
- ASN1_STRING made opaque
- const qualifiers added to X509 getter functions

Patches:
  1/7 openssl: upgrade 3.5.7 -> 4.0.1
  2/7 python3: backport OpenSSL 4.0 support (CPython commit 3364e7e62fa2)
  3/7 socat: fix ASN1_STRING opaque struct access
  4/7 rust: upgrade 1.96.1 -> 1.97.1 (openssl-sys 0.9.114 adds 4.0 support)
  5/7 serf: fix ASN1_STRING opaque struct access
  6/7 u-boot-tools: backport Provider API (replaces removed ENGINE API)
  7/7 kea: add const qualifiers to X509 pointers

Dependencies:
- wpa-supplicant 2.12 upgrade (already under review):
  https://patchwork.yoctoproject.org/project/oe-core/patch/20260811035602.3661581-1-ankur.tyagi85@gmail.com/

Testing:
- bitbake world: passes on qemux86-64, qemuarm64, qemuarm, qemuriscv64
- openssl ptest on qemux86-64: 362 files, 4310 tests, all passed
  (338 passed, 24 skipped - fips/lms/rc5/tfo/compression - all expected)

Notes on upstream status:
- python3: fix on CPython main, backport PR #146403 closed without merge
- socat: submitted to socat@dest-unreach.org
- rust: based on Deepesh's patchwork submission, fixed missing
  rust-source rename and dropped merged 0005-remap-OUT_DIR patch
- serf: fix in trunk (r1935023), no release yet
- u-boot-tools: PR #918 open since March 2026, under review
- kea: tracked as issue #4673, milestone kea3.3.2

This series depends on the following patches already on the list:
- Ankur Tyagi's wpa-supplicant 2.12 upgrade (under review)
- Deepesh Varatharajan's rust 1.97.1 upgrade (we resolved the
  remaining issues: missing rust-source rename and stale
  0005-remap-OUT_DIR patch that was already merged upstream)

Sharing this early to get feedback and see if there are other
recipes that break with OpenSSL 4.0 that we may have missed.
The wpa-supplicant and rust dependencies are not yet merged,
but the series is complete enough to build world on qemux86-64.

Deepesh Varatharajan (1):
  rust: Upgrade 1.96.1 -> 1.97.1

Jaipaul Cheernam (6):
  openssl: upgrade 3.5.7 -> 4.0.1
  python3: backport OpenSSL 4.0 support from upstream
  socat: fix build with OpenSSL 4.0
  serf: fix build with OpenSSL 4.0
  u-boot-tools: fix build with OpenSSL 4.0
  kea: fix build with OpenSSL 4.0

 .../classes-recipe/rust-target-config.bbclass |   5 +
 meta/conf/distro/include/tcmode-default.inc   |   2 +-
 meta/lib/oeqa/selftest/cases/rust.py          |   3 +-
 ...Add-support-for-OpenSSL-Provider-API.patch | 300 ++++++++++++++
 .../u-boot/u-boot-tools_2026.07.bb            |   4 +-
 ...-qualifiers-to-OpenSSL-X509-pointers.patch |  49 +++
 meta/recipes-connectivity/kea/kea_3.2.0.bb    |   1 +
 ...ke-history-reporting-when-test-fails.patch | 366 ------------------
 ...1-Configure-do-not-tweak-mips-cflags.patch |   6 +-
 ...sysroot-and-debug-prefix-map-from-co.patch |  11 +-
 .../0001-extend-check_cwm-test-timeout.patch  |   4 +-
 .../{openssl_3.5.7.bb => openssl_4.0.1.bb}    |  23 +-
 ...penSSL-4.0-use-ASN1_STRING-accessors.patch |  31 ++
 .../socat/socat_1.8.1.3.bb                    |   1 +
 ...146207-Add-support-for-OpenSSL-4.0.0.patch | 257 ++++++++++++
 .../recipes-devtools/python/python3_3.14.7.bb |   1 +
 .../rust/{cargo_1.96.1.bb => cargo_1.97.1.bb} |   0
 ...lain-syscalls-as-their-time64-varian.patch |  81 ----
 ...xplicit-tail-calls-disable-two-tests.patch |  39 --
 ...lls-ignore-tests-on-unsupported-llvm.patch |  96 -----
 ...ild-script-path-leakage-in-artifacts.patch |  28 --
 ...ibstd-rs_1.96.1.bb => libstd-rs_1.97.1.bb} |   0
 ....96.1.bb => rust-cross-canadian_1.97.1.bb} |   0
 meta/recipes-devtools/rust/rust-snapshot.inc  | 104 ++---
 meta/recipes-devtools/rust/rust-source.inc    |   6 +-
 ...source_1.96.1.bb => rust-source_1.97.1.bb} |   0
 .../rust/{rust_1.96.1.bb => rust_1.97.1.bb}   |   3 +
 ...penSSL-4.0-use-ASN1_STRING-accessors.patch |  35 ++
 meta/recipes-support/serf/serf_1.3.10.bb      |   1 +
 29 files changed, 759 insertions(+), 698 deletions(-)
 create mode 100644 meta/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API.patch
 create mode 100644 meta/recipes-connectivity/kea/files/0001-Add-const-qualifiers-to-OpenSSL-X509-pointers.patch
 delete mode 100644 meta/recipes-connectivity/openssl/openssl/0001-Added-handshake-history-reporting-when-test-fails.patch
 rename meta/recipes-connectivity/openssl/{openssl_3.5.7.bb => openssl_4.0.1.bb} (88%)
 create mode 100644 meta/recipes-connectivity/socat/files/0001-Fix-build-with-OpenSSL-4.0-use-ASN1_STRING-accessors.patch
 create mode 100644 meta/recipes-devtools/python/python3/0001-gh-146207-Add-support-for-OpenSSL-4.0.0.patch
 rename meta/recipes-devtools/rust/{cargo_1.96.1.bb => cargo_1.97.1.bb} (100%)
 delete mode 100644 meta/recipes-devtools/rust/files/0001-riscv32-Define-plain-syscalls-as-their-time64-varian.patch
 delete mode 100644 meta/recipes-devtools/rust/files/0003-explicit-tail-calls-disable-two-tests.patch
 delete mode 100644 meta/recipes-devtools/rust/files/0004-explicit-tail-calls-ignore-tests-on-unsupported-llvm.patch
 delete mode 100644 meta/recipes-devtools/rust/files/0005-remap-OUT_DIR-paths-to-fix-build-script-path-leakage-in-artifacts.patch
 rename meta/recipes-devtools/rust/{libstd-rs_1.96.1.bb => libstd-rs_1.97.1.bb} (100%)
 rename meta/recipes-devtools/rust/{rust-cross-canadian_1.96.1.bb => rust-cross-canadian_1.97.1.bb} (100%)
 rename meta/recipes-devtools/rust/{rust-source_1.96.1.bb => rust-source_1.97.1.bb} (100%)
 rename meta/recipes-devtools/rust/{rust_1.96.1.bb => rust_1.97.1.bb} (98%)
 create mode 100644 meta/recipes-support/serf/serf/0001-Fix-build-with-OpenSSL-4.0-use-ASN1_STRING-accessors.patch