mbox series

[meta-oe,RFC,00/20] Fix OpenSSL 4.0.1 build failures across meta-openembedded

Message ID 20260827185324.78997-1-jaipaul.cheernam@est.tech
Headers show
Series Fix OpenSSL 4.0.1 build failures across meta-openembedded | expand

Message

Jaipaul Cheernam Aug. 27, 2026, 6:53 p.m. UTC 
OpenSSL 4.0.1 upgrade in OE-Core (RFC v4 series on openembedded-core ML)
introduces several breaking API changes that affect recipes across
meta-openembedded:

- ENGINE API removed entirely
- ASN1_STRING, ASN1_TIME, ASN1_OCTET_STRING made opaque
- const qualifiers added to X509 getter return types
- Per-version TLS method functions removed
- ASN1_STRING_data() and ERR_remove_state() removed

This series fixes 20 recipes across meta-oe, meta-networking,
meta-python, meta-perl, and meta-multimedia. All patches have
upstream references — either backports from merged commits or
submitted PRs.

Tested with bitbake world -k on qemux86-64.

Known remaining failures (not addressed in this series):

ENGINE API dependent (needs Provider API rewrite):
- imx-cst: NXP proprietary, no public upstream
- extract-cert: needs Provider API migration

Dead/unmaintained upstream:
- wvstreams/wvdial: archived 2018
- ntp (classic): EOL 2023, recommend chrony
- loudmouth: last activity 2019

No upstream fix available:
- ldns: heavy deprecated API usage (issue #243 since 2024)
- unbound: upstream PR #1437 attempted, closed
- softhsm: upstream PR #882 in progress
- ipmiutil, synergy, spdm-emu: no upstream fix

Indirect:
- mercurial: Python 3.14 + OpenSSL 4.0 reports TLS 1.2 as
  unavailable (upstream CPython limitation, only Python 3.15
  officially supports OpenSSL 4.0)

3 upstream PRs submitted by us: ntopng (merged), thrift, snort3

Jaipaul Cheernam (20):
  freediameter: remove openssl-engines from RDEPENDS
  krb5: fix build with OpenSSL 4.0
  libnet-ssleay-perl: fix build with OpenSSL 4.0
  libtorrent-rasterbar: fix build with OpenSSL 4.0
  pkcs11-helper: fix build with OpenSSL 4.0
  opensc: fix build with OpenSSL 4.0
  grpc: fix build with OpenSSL 4.0
  python3-grpcio: fix build with OpenSSL 4.0
  thrift: fix build with OpenSSL 4.0
  boinc-client: fix build with OpenSSL 4.0
  imapfilter: fix build with OpenSSL 4.0
  lftp: fix build with OpenSSL 4.0
  civetweb: fix build with OpenSSL 4.0
  freeradius: fix build with OpenSSL 4.0
  snort3: fix build with OpenSSL 4.0
  znc: fix build with OpenSSL 4.0
  libesmtp: fix build with OpenSSL 4.0
  ntopng: fix build with OpenSSL 4.0
  libcoap: fix build with OpenSSL 4.0
  pjproject: fix build with OpenSSL 4.0

 ...k_ossl-fix-OpenSSL-4.0-compatibility.patch |  40 ++
 .../pjproject/pjproject_2.17.bb               |   4 +-
 .../0001-Fix-compilation-with-openssl-4.patch |  27 +
 .../civetweb/civetweb_1.16.bb                 |   1 +
 ...ING-functions-for-OpenSSL-4.0-compat.patch |  78 +++
 .../freeradius/freeradius_3.2.10.bb           |   1 +
 .../0001-allow-build-with-OpenSSL-4.x.patch   |  55 ++
 .../recipes-connectivity/lftp/lftp_4.9.3.bb   |   1 +
 ...fix-const-qualifiers-for-OpenSSL-4.0.patch |  53 ++
 .../snort/snort3_3.12.2.0.bb                  |   1 +
 ...OpenSSL-Support-4.0-and-later-builds.patch | 507 ++++++++++++++
 .../libcoap/libcoap_4.3.5b.bb                 |   1 +
 .../0001-Fix-build-error-with-OpenSSL-4.patch |  51 ++
 meta-networking/recipes-irc/znc/znc_1.10.2.bb |   4 +-
 .../freediameter/freediameter_1.6.0.bb        |   2 +-
 ...-with-OpenSSL-4.0-opaque-ASN1_STRING.patch |  31 +
 .../libesmtp/libesmtp_1.1.0.bb                |   4 +-
 .../0001-Fix-build-with-OpenSSL-4.0.patch     |  42 ++
 .../recipes-support/ntopng/ntopng_6.6.bb      |   1 +
 ...Improve-future-OpenSSL-compatibility.patch | 285 ++++++++
 .../0002-Remove-OpenSSL-1.0-support.patch     | 627 ++++++++++++++++++
 ...ing-const-qualifiers-for-OpenSSL-4.0.patch |  67 ++
 .../recipes-connectivity/krb5/krb5_1.22.2.bb  |   3 +
 .../0001-Add-support-for-OpenSSL-4.0.patch    |  61 ++
 .../libtorrent-rasterbar_2.0.12.bb            |   4 +-
 ...SSLSocket-fix-build-with-OpenSSL-4.0.patch | 113 ++++
 .../thrift/thrift_0.24.0.bb                   |   1 +
 ...1-crypto-openssl-use-ASN1_TIME_to_tm.patch |  45 ++
 .../pkcs11-helper/pkcs11-helper_1.31.0.bb     |   4 +-
 ...ls-Fix-OpenSSL-3.0-4.0-compatibility.patch |  85 +++
 ...L-4.0-const-and-opaque-compatibility.patch |  61 ++
 ...sport_security_utils-for-OpenSSL-4.0.patch |  63 ++
 ...ing-const-qualifiers-for-OpenSSL-4.0.patch |  49 ++
 meta-oe/recipes-devtools/grpc/grpc_1.83.0.bb  |   4 +
 .../0001-Fix-build-with-OpenSSL-4.0.patch     |  41 ++
 .../boinc/boinc-client_8.2.15.bb              |   1 +
 ...NG-accessors-for-opaque-ASN1_INTEGER.patch |  45 ++
 .../imapfilter/imapfilter_2.8.5.bb            |   1 +
 .../0001-Changes-for-OpenSSL-4.0.0.patch      | 331 +++++++++
 .../recipes-support/opensc/opensc_0.27.1.bb   |   4 +-
 .../0001-Fix-SSLv3-in-OpenSSL-4.0.0.patch     |  34 +
 ...emove-support-for-some-TLS-functions.patch | 192 ++++++
 ...SSLeay-to-support-opaque-ASN1_STRING.patch | 175 +++++
 .../libnet/libnet-ssleay-perl_1.96.bb         |   6 +-
 .../0001-Fix-OpenSSL-4.0-compatibility.patch  | 140 ++++
 .../python/python3-grpcio_1.78.0.bb           |   1 +
 46 files changed, 3339 insertions(+), 8 deletions(-)
 create mode 100644 meta-multimedia/recipes-multimedia/pjproject/pjproject/0001-ssl_sock_ossl-fix-OpenSSL-4.0-compatibility.patch
 create mode 100644 meta-networking/recipes-connectivity/civetweb/civetweb/0001-Fix-compilation-with-openssl-4.patch
 create mode 100644 meta-networking/recipes-connectivity/freeradius/freeradius/0001-Use-ASN1_STRING-functions-for-OpenSSL-4.0-compat.patch
 create mode 100644 meta-networking/recipes-connectivity/lftp/lftp/0001-allow-build-with-OpenSSL-4.x.patch
 create mode 100644 meta-networking/recipes-connectivity/snort/snort3/0001-ssl-fix-const-qualifiers-for-OpenSSL-4.0.patch
 create mode 100644 meta-networking/recipes-devtools/libcoap/libcoap/0001-OpenSSL-Support-4.0-and-later-builds.patch
 create mode 100644 meta-networking/recipes-irc/znc/znc/0001-Fix-build-error-with-OpenSSL-4.patch
 create mode 100644 meta-networking/recipes-support/libesmtp/libesmtp/0001-Fix-build-with-OpenSSL-4.0-opaque-ASN1_STRING.patch
 create mode 100644 meta-networking/recipes-support/ntopng/ntopng/0001-Fix-build-with-OpenSSL-4.0.patch
 create mode 100644 meta-oe/recipes-connectivity/krb5/krb5/0001-Improve-future-OpenSSL-compatibility.patch
 create mode 100644 meta-oe/recipes-connectivity/krb5/krb5/0002-Remove-OpenSSL-1.0-support.patch
 create mode 100644 meta-oe/recipes-connectivity/krb5/krb5/0003-k5tls-fix-remaining-const-qualifiers-for-OpenSSL-4.0.patch
 create mode 100644 meta-oe/recipes-connectivity/libtorrent-rasterbar/libtorrent-rasterbar/0001-Add-support-for-OpenSSL-4.0.patch
 create mode 100644 meta-oe/recipes-connectivity/thrift/thrift/0001-TSSLSocket-fix-build-with-OpenSSL-4.0.patch
 create mode 100644 meta-oe/recipes-crypto/pkcs11-helper/pkcs11-helper/0001-crypto-openssl-use-ASN1_TIME_to_tm.patch
 create mode 100644 meta-oe/recipes-devtools/grpc/grpc/0001-credentials-Fix-OpenSSL-3.0-4.0-compatibility.patch
 create mode 100644 meta-oe/recipes-devtools/grpc/grpc/0002-tsi-fix-OpenSSL-4.0-const-and-opaque-compatibility.patch
 create mode 100644 meta-oe/recipes-devtools/grpc/grpc/0003-tsi-fix-ssl_transport_security_utils-for-OpenSSL-4.0.patch
 create mode 100644 meta-oe/recipes-devtools/grpc/grpc/0004-tsi-fix-remaining-const-qualifiers-for-OpenSSL-4.0.patch
 create mode 100644 meta-oe/recipes-extended/boinc/boinc-client/0001-Fix-build-with-OpenSSL-4.0.patch
 create mode 100644 meta-oe/recipes-support/imapfilter/imapfilter/0001-Use-ASN1_STRING-accessors-for-opaque-ASN1_INTEGER.patch
 create mode 100644 meta-oe/recipes-support/opensc/opensc/0001-Changes-for-OpenSSL-4.0.0.patch
 create mode 100644 meta-perl/recipes-perl/libnet/libnet-ssleay-perl/0001-Fix-SSLv3-in-OpenSSL-4.0.0.patch
 create mode 100644 meta-perl/recipes-perl/libnet/libnet-ssleay-perl/0002-OpenSSL-4.0.0-remove-support-for-some-TLS-functions.patch
 create mode 100644 meta-perl/recipes-perl/libnet/libnet-ssleay-perl/0003-Fix-Net-SSLeay-to-support-opaque-ASN1_STRING.patch
 create mode 100644 meta-python/recipes-devtools/python/python3-grpcio/0001-Fix-OpenSSL-4.0-compatibility.patch