mbox series

[RFC,v2,0/6] openssl: upgrade to 4.0.1 and fix dependent recipes

Message ID 20260820181022.44434-1-jaipaul.cheernam@est.tech
Headers show
Series openssl: upgrade to 4.0.1 and fix dependent recipes | expand

Message

Jaipaul Cheernam Aug. 20, 2026, 6:10 p.m. UTC 
This series upgrades OpenSSL from 3.5.7 to 4.0.1 and fixes all
dependent recipes that break due to API changes in OpenSSL 4.0.

Changes since v1:
- u-boot: moved patch from u-boot-tools_2026.07.bb to u-boot-common.inc
  so it applies to both u-boot and u-boot-tools (fixes riscv64 build
  failure reported from autobuilder)
- u-boot, kea: corrected Upstream-Status from Backport to Submitted
  (neither has been merged upstream yet)
- Dropped rust 1.97.1 from this series (now merged in master)
- No external dependencies — wpa-supplicant 2.12 and rust 1.97.1
  are both merged in master now

OpenSSL 4.0 is a major release with several breaking changes:
- ENGINE API fully removed
- SSLv3 support removed
- Per-version TLS method functions (SSLv3_method etc.) removed
- ASN1_STRING made opaque
- const qualifiers added to X509 getter functions

Patches:
  1/6 openssl: upgrade 3.5.7 -> 4.0.1
  2/6 python3: backport OpenSSL 4.0 support (CPython commit 3364e7e62fa2)
  3/6 socat: fix ASN1_STRING opaque struct access
  4/6 serf: fix ASN1_STRING opaque struct access
  5/6 u-boot: backport Provider API (replaces removed ENGINE API)
  6/6 kea: add const qualifiers to X509 pointers

Testing:
- bitbake world -k: passes on qemux86-64, qemuarm64, qemuarm, qemuriscv64
- openssl ptest on qemux86-64: 362 files, 4310 tests, all passed
  (338 passed, 24 skipped - fips/lms/rc5/tfo/compression - all expected)

Sharing this to get feedback and see if there are other recipes that
break with OpenSSL 4.0 that we may have missed.

Notes on upstream status:
- python3: fix on CPython main, backport PR #146403 closed without merge
- socat: submitted to socat@dest-unreach.org
- serf: fix in trunk (r1935023), no release yet
- u-boot: PR #918 open since March 2026, under review
- kea: tracked as issue #4673, milestone kea3.3.2

Jaipaul Cheernam (6):
  openssl: upgrade 3.5.7 -> 4.0.1
  python3: backport OpenSSL 4.0 support from upstream
  socat: fix build with OpenSSL 4.0
  serf: fix build with OpenSSL 4.0
  u-boot: fix build with OpenSSL 4.0
  kea: fix build with OpenSSL 4.0

 ...Add-support-for-OpenSSL-Provider-API.patch | 300 ++++++++++++++
 meta/recipes-bsp/u-boot/u-boot-common.inc     |   1 +
 ...-qualifiers-to-OpenSSL-X509-pointers.patch |  49 +++
 meta/recipes-connectivity/kea/kea_3.2.0.bb    |   1 +
 ...ke-history-reporting-when-test-fails.patch | 366 ------------------
 ...1-Configure-do-not-tweak-mips-cflags.patch |   6 +-
 ...sysroot-and-debug-prefix-map-from-co.patch |  11 +-
 .../0001-extend-check_cwm-test-timeout.patch  |   4 +-
 .../{openssl_3.5.7.bb => openssl_4.0.1.bb}    |  23 +-
 ...penSSL-4.0-use-ASN1_STRING-accessors.patch |  31 ++
 .../socat/socat_1.8.1.3.bb                    |   1 +
 ...146207-Add-support-for-OpenSSL-4.0.0.patch | 257 ++++++++++++
 .../recipes-devtools/python/python3_3.14.7.bb |   1 +
 ...penSSL-4.0-use-ASN1_STRING-accessors.patch |  35 ++
 meta/recipes-support/serf/serf_1.3.10.bb      |   1 +
 15 files changed, 693 insertions(+), 394 deletions(-)
 create mode 100644 meta/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API.patch
 create mode 100644 meta/recipes-connectivity/kea/files/0001-Add-const-qualifiers-to-OpenSSL-X509-pointers.patch
 delete mode 100644 meta/recipes-connectivity/openssl/openssl/0001-Added-handshake-history-reporting-when-test-fails.patch
 rename meta/recipes-connectivity/openssl/{openssl_3.5.7.bb => openssl_4.0.1.bb} (88%)
 create mode 100644 meta/recipes-connectivity/socat/files/0001-Fix-build-with-OpenSSL-4.0-use-ASN1_STRING-accessors.patch
 create mode 100644 meta/recipes-devtools/python/python3/0001-gh-146207-Add-support-for-OpenSSL-4.0.0.patch
 create mode 100644 meta/recipes-support/serf/serf/0001-Fix-build-with-OpenSSL-4.0-use-ASN1_STRING-accessors.patch