mbox series

[RFC,v4,0/6] openssl: upgrade 3.5.7 -> 4.0.1

Message ID 20260822175200.57534-1-jaipaul.cheernam@est.tech
Headers show
Series openssl: upgrade 3.5.7 -> 4.0.1 | expand

Message

Jaipaul Cheernam Aug. 22, 2026, 5:51 p.m. UTC 
Upgrade OpenSSL from 3.5.7 to 4.0.1 and fix all dependent recipe
breakages in oe-core.

OpenSSL 4.0 is a major version bump that removes the ENGINE API,
removes the c_rehash script, makes ASN1_STRING fully opaque, adds
const qualifiers to X509 accessor return types, and removes
per-version TLS method functions.

This series fixes python3, socat, serf, u-boot, and kea to build
against OpenSSL 4.0.

Changes since v3:
  - u-boot: fix malformed patch (hunk line count mismatch from pkcs11
    modification). Regenerated patch properly.

Changes since v2:
  - openssl: remove c_rehash from MULTILIB_SCRIPTS and FILES (fixes
    multilib do_package failure)
  - python3: add backports from CPython PR #149783 for the
    got_eof_error fix (fixes test_https/test_https_sni ptest failures
    caused by OpenSSL 4.0 changing EOF signaling behavior)
  - u-boot: update Upstream-Status to lore link per reviewer feedback,
    include doc/Dockerfile hunks from upstream v4, make pkcs11
    provider loading optional (fixes fitimage signing failure when
    pkcs11-provider is not installed)

Changes since v1:
  - u-boot: move patch from u-boot-tools to u-boot-common.inc (fixes
    riscv64 build failure)
  - serf/socat: fix Upstream-Status tags

Testing:
  - lib32-openssl do_package: passes (multilib fix verified)
  - python3 test_https/test_https_sni: passes locally
  - u-boot fitimage signing: passes locally
  - bitbake world -k with meta-oe/meta-networking/meta-python/meta-perl:
    oe-core recipes all build. meta-oe breakages are in their layer.

Known breakages in meta-openembedded (not addressed here):
  - freediameter: RDEPENDS on removed openssl-engines package
  - pkcs11-helper, krb5, libcoap, grpc, libnet-ssleay-perl, libesmtp,
    unbound, wvstreams: various OpenSSL 4.0 API incompatibilities

Notes on upstream status:
  - python3: CPython PR #149783 deferred until after Python 3.15.1
  - socat: submitted to socat@dest-unreach.org
  - serf: fix in trunk (r1935023), no release yet
  - u-boot: v4 on ML under review
  - kea: tracked as issue #4673

Jaipaul Cheernam (6):
  openssl: upgrade 3.5.7 -> 4.0.1
  python3: backport OpenSSL 4.0 support from upstream
  socat: fix build with OpenSSL 4.0
  serf: fix build with OpenSSL 4.0
  u-boot: fix build with OpenSSL 4.0
  kea: fix build with OpenSSL 4.0

 ...Add-support-for-OpenSSL-Provider-API.patch | 340 ++++++++++++++++
 meta/recipes-bsp/u-boot/u-boot-common.inc     |   1 +
 ...-qualifiers-to-OpenSSL-X509-pointers.patch |  49 +++
 meta/recipes-connectivity/kea/kea_3.2.0.bb    |   1 +
 ...ke-history-reporting-when-test-fails.patch | 366 ------------------
 ...1-Configure-do-not-tweak-mips-cflags.patch |   6 +-
 ...sysroot-and-debug-prefix-map-from-co.patch |  11 +-
 .../0001-extend-check_cwm-test-timeout.patch  |   4 +-
 .../{openssl_3.5.7.bb => openssl_4.0.1.bb}    |  28 +-
 ...penSSL-4.0-use-ASN1_STRING-accessors.patch |  31 ++
 .../socat/socat_1.8.1.3.bb                    |   1 +
 ...146207-Add-support-for-OpenSSL-4.0.0.patch | 257 ++++++++++++
 ...Update-_ssl._SSLSocket-for-OpenSSL-4.patch | 234 +++++++++++
 ...utdown-test-in-test_ssl.test_got_eof.patch |  41 ++
 .../recipes-devtools/python/python3_3.14.7.bb |   3 +
 ...penSSL-4.0-use-ASN1_STRING-accessors.patch |  35 ++
 meta/recipes-support/serf/serf_1.3.10.bb      |   1 +
 17 files changed, 1012 insertions(+), 397 deletions(-)
 create mode 100644 meta/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API.patch
 create mode 100644 meta/recipes-connectivity/kea/files/0001-Add-const-qualifiers-to-OpenSSL-X509-pointers.patch
 delete mode 100644 meta/recipes-connectivity/openssl/openssl/0001-Added-handshake-history-reporting-when-test-fails.patch
 rename meta/recipes-connectivity/openssl/{openssl_3.5.7.bb => openssl_4.0.1.bb} (87%)
 create mode 100644 meta/recipes-connectivity/socat/files/0001-Fix-build-with-OpenSSL-4.0-use-ASN1_STRING-accessors.patch
 create mode 100644 meta/recipes-devtools/python/python3/0001-gh-146207-Add-support-for-OpenSSL-4.0.0.patch
 create mode 100644 meta/recipes-devtools/python/python3/0002-gh-148292-Update-_ssl._SSLSocket-for-OpenSSL-4.patch
 create mode 100644 meta/recipes-devtools/python/python3/0003-gh-148292-Remove-shutdown-test-in-test_ssl.test_got_eof.patch
 create mode 100644 meta/recipes-support/serf/serf/0001-Fix-build-with-OpenSSL-4.0-use-ASN1_STRING-accessors.patch