From patchwork Thu Aug 20 18:10:17 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jaipaul Cheernam X-Patchwork-Id: 95936 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4590DC5DF86 for ; Thu, 20 Aug 2026 18:10:39 +0000 (UTC) Received: from OSPPR02CU001.outbound.protection.outlook.com (OSPPR02CU001.outbound.protection.outlook.com [40.107.159.25]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.165.1787249429774855731 for ; Thu, 20 Aug 2026 11:10:31 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=tZg0VhT1; spf=pass (domain: est.tech, ip: 40.107.159.25, mailfrom: jaipaul.cheernam@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=AU9EPa5y5cQhEaW2TnhCN4o9M2p8hcA7kjOPFtXt0+Al9+5taszv5mUS5VjwRRNqiJ6RylqKpbBCY4k+62hTrqu7oMOtRoDkgC2N0xL/TU6I8KnF3ZeHRfEBGOdRSz6Wf8IrsrQF57fp45LoX5lUkAREpR2iMxhy2XJO1pcNRjlLnD1DjQj8eqm2EFcGOMYmJFvZSJQENTXUbWOOFgqyUrytWprYqwH6NnB4KadjihLZU466HcZ/W3DOI+hHR7tURUQaw9J8dZTomPEtM0S5WNwixb1ylEjTPVaNuAn5/u65hDa/0qkJBhF97M5rypIXYwV28U4gPNvTanxYD02kxg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=5Qo8/RD7RL5P5q8DsEKwlj9xZDgePlHnVrOKmcJN4/M=; b=x78P8/YRKTvh785x/df7l/au23wka3fTdVukeRskwWtSx9UuxoR5iKbclXQ1a1fZRjczxXgiePsmlCW1++NWg+vDcO+4sBO3bx+lE43VhYxJBe0eXKG7TTmp9kMYk0PZjh14e3ceU1oUDJSiltE+57KhjAwgMzPTnmI0AqQnH8cNjh/VsGf9+X0kfMmjrMGbyGyMyE/xV4jz3ranP7Mt1L4GNwCfUirtE4I+TduuEhqGnHsUU6crjwU8BjcyzgCKKvuFmegikCEUGfYoc5JEQaiXCwIsdjwW5RmUvQiT5Gx79ajQiITsF484kOFOYO2N87a14ldLu/Es81WYwfDR1Q== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=5Qo8/RD7RL5P5q8DsEKwlj9xZDgePlHnVrOKmcJN4/M=; b=tZg0VhT1/g7J4VrT9/nZ2czBbUJNL97g1ktjHN7B6mVldQ5h5gcc/RhmwOJFSpvTfi6XiqIu1RdufKHGmjG+p+vTk5Mm2rl/Vcvks5QrCt+TEWIuWjCDe5Cy32qQIXOisCNYetb/PGUJ1LndSe0u2KQ1CSXqFKG+STke+o6j3OUyPvmx0gIQSR22Z3Gi1U78ytkWgGw3wli1rBxRHFOisSHdiXyMcz5pQ95THAtBHIzCP161J/43Behs40esIJ4q8QPr+XDEub1Lvt/dGxUdIwTuT2SPeUnEXzxw+Z5ndiZ6fI9F3siVctydMKTP1Sd8c0erCgj++nG8lhKuL0/BDg== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from GV1P189MB2954.EURP189.PROD.OUTLOOK.COM (2603:10a6:150:263::18) by PA1P189MB2702.EURP189.PROD.OUTLOOK.COM (2603:10a6:102:452::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.339.8; Thu, 20 Aug 2026 18:10:27 +0000 Received: from GV1P189MB2954.EURP189.PROD.OUTLOOK.COM ([fe80::a7e4:7d5b:ab4a:4b96]) by GV1P189MB2954.EURP189.PROD.OUTLOOK.COM ([fe80::a7e4:7d5b:ab4a:4b96%4]) with mapi id 15.21.0360.003; Thu, 20 Aug 2026 18:10:27 +0000 From: Jaipaul Cheernam To: openembedded-core@lists.openembedded.org Subject: [RFC v2 1/6] openssl: upgrade 3.5.7 -> 4.0.1 Date: Thu, 20 Aug 2026 20:10:17 +0200 Message-ID: <20260820181022.44434-2-jaipaul.cheernam@est.tech> X-Mailer: git-send-email 2.39.5 (Apple Git-154) In-Reply-To: <20260820181022.44434-1-jaipaul.cheernam@est.tech> References: <20260814051829.35088-1-jaipaul.cheernam@est.tech> <20260820181022.44434-1-jaipaul.cheernam@est.tech> X-ClientProxiedBy: DU2PR04CA0168.eurprd04.prod.outlook.com (2603:10a6:10:2b0::23) To GV1P189MB2954.EURP189.PROD.OUTLOOK.COM (2603:10a6:150:263::18) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: GV1P189MB2954:EE_|PA1P189MB2702:EE_ X-MS-Office365-Filtering-Correlation-Id: 350586c8-51ab-4f7f-6345-08defee64ff3 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|366016|10070799003|23010399003|1800799024|376014|10067099003|56012099006|6133799003|12006099003|25016099003|3023799007|29003799003|11063799006|22082099003|18002099003|17002099007|4143699003; X-Microsoft-Antispam-Message-Info: +mVZsSyujye0cLdN+G5GRewUcmFYsdWaJ6b6pCKSxDS71UE/6zgiuhYFG4ucHrvpFC34ZfYJaZRstbSOyXc5uWF4iTljzFQABrB/16uj3eBe1DtPmLLNRfGoetT2BdkgG0vt6jUsIqjDjwwx8PZV6fHoyzwHxmoleqhAKXln/+KnYZ2v2ZLleyE5umO/GnbkXlUTEnUgJlPf7F6erKRJ105u1oEpGOeNAFCaDPTUh8H3xohsWO5pN924LJWd+/QkC2KN5uR7mWuZiEyfOgSGOmvKX/RU3jpjb3/f2zVr2ag/Rbq9d9NxheR/My+ik5eA8wXQ0gxN6NEbVI+1HHtN3gRDhiFq+wNutaOH9DwYTOIXY12rrib0S2RpLy5VDsGHrdG9GMnywJV5jbluvWKBmlMQk/v2FCA3Tb3O+JFOlx2NnvcBJeRKDnGKRrKOPoTnIsG46RnX3bhI03SAMwNUi40gjIfQZI4o6bxeNY9uLySRjmIA7bJdBGhi6sx5k04sBXYYxWQ05mEvQjJl/yVrcj//bZPjMAk3ipB9RHhPCBkEZkd/Zh0KyZFu46RQPGNz57ZNg/yUo45rODDnLo6dKd/7swKW2UJrCSIT/vwGlfSRezMxmxh+ZSqkCNFp9HYN X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:GV1P189MB2954.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(366016)(10070799003)(23010399003)(1800799024)(376014)(10067099003)(56012099006)(6133799003)(12006099003)(25016099003)(3023799007)(29003799003)(11063799006)(22082099003)(18002099003)(17002099007)(4143699003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 2 X-MS-Exchange-AntiSpam-MessageData-0: QMFCFO4j9870qVD6lKosvi8v9sr3jjSRyAnlmz4EHxT88jQUazbKrdIzEqLrClbSNsCDEQwTNZKrl8ajsM+G+bMKOXZy0hudBdTF+w53wRa+ICyKiViwtdNg7LY7PCImsso1Sru9FQXJJ0UTTD6+9wr27pmm/RrXySLOdRmgqi6RJuWv8BmKx2htRfNW8gpvrQ9tkS6i7LY/yOb+0KqScsI6vP5KBubIAsGLoHJtGoN3pjizNpPd32ow3O6/fnes0P8hESKkpCzijoVNs4Dey7e5QVIJfmqnz6TTz6syxsVr4QNhkjBxJv13APBwd701LVgLU4NJFCgz6GC95Zj7MLGxY7jdZI8bIR+orMBrwEY3DarxZMLvzQZlyxIeqxyZfoVr+JhD7JBHWhU88CFBc7rjZp9idf/QU8RicogiGXPsHv/jMU9oWPSBbzfhkUUnWjTJNKZosaqF+hMC86Yckaxg6aoF6N7WqWuYt2jJ+BchhnNsU/3F5P5djZ0kseSEy6DUYARuRXhol2D7QocZqL2T2wR90VQdWC33ks3IEXuuDV1dN0x8CQRJoc2YRV2u6JwZ+eNwoGgpdy9ILFwcA/Xf582gGq9f9BVWpotYZxm465HqNNlSRyckgqMlGzaFlEDCpaply0UMesQvmNpxgrKKU433MUg3ekBjW8ZKm9L2bwBygY6mvFsM+baM4cyHb7y4eCrE6AloHz/pbGO7/YKh1QJeZD5A5nJwRrjRDxpaCkxP1MbbKE+2ujlCKxgf9sVBvric2oqaTaAnbhld+tEnNv8Pkp7OjjilSiJKS7z70424QSAAMe5VH19A6YiXhHBvr2+Nq9cRX8mhodNqXxIQ0wOs95Bvjng2S48k8iacoQEhxbJq47qafGWSFUFVKVzbYpSoSJB5OJ+rrxGVsTrpFX2/PN+1mBNNy+fMnVeN1/HCixhlCZNLUkUB7j+v1wlluqljS2oHVZ3oU0HmQBCcWms+NyS7cfiicwjaPNQ5SmUMze84IHrt9okRyc6Nq5IHQiyNsNM+7Mqjx/PzzzvCbSJzXdqp17mH+Tjp5bcIq2XCbe+zbN4IHO3LCSI5ZbY4oEHH+3XzHApX554mNcbU5fYDiwn4IDLSQvQB4+P7a0KTEU0/OFxMHsw9RrUHgATxexhokNjgDAGkHkz9/oAmvWpNnXN/CbOWZEU5WysIYOT7osGDhkpdpu+ol+qNkiavmBHTvU9vhMiLam6hY7bH/5qiEd2SSmyuIZexop4kolEqlMG7JHjzTtWW851SXusrAzwMTMSLX7aCM5x3lBXabrQ5SSHWPfmlrSE9YsDFQ/cqf7fYUujxuBdLH00/yFXrlHgn5xgELl8l3Lu3RbSfsPXPc9eacvGOqIrNeSVRIn8jlIVGkErPlR+JygRCIym2OsrXXQ0UH3A+uNHH6LTgEdJyh3KsBTX2bBcMgshccZJ4rI8Ks6TeB3BU5Ed0KekNmh8IXThwc4OOKsvZElTqJq6tEdE2sj5mLx+L9qFKIk7Y2ogiql9cv0oOOVHkpy8LmyuimuMsUzucHV+i6boc6U94ujRjLA622gLRlQEy6ITzO6+hYCYFWONwA1NKw1BdxshKZI6QGjM/hdebGGphhC0M+TwdlmRomKiYT2B0b5ncfF14S5tTbDoej+tjolNZl+wJ57uuyCAO8G7LZJJ0lVoK3ZojhwsKiRZ/g7LOa1+GNoocnwg+9W7ZMsWIibSbqNYS2iTbUTWbIo/ajpv809xzBImDvgLMW/s1LCMiTorzHU1ZtsnNltwsQP4ZQzD/kt2U X-MS-Exchange-AntiSpam-MessageData-1: i8Q8asDrX/YqZDt6Y6YhTR66DBDxsEhgdts= X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: 350586c8-51ab-4f7f-6345-08defee64ff3 X-MS-Exchange-CrossTenant-AuthSource: GV1P189MB2954.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Aug 2026 18:10:27.2199 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 3a0Kzr0sl0YJjYc+kR2ZkiCZIdW37mMoPGeBmb3IR7v7LaJ3Mr00fCQicAp43+4cxK30UamIs4wV4GFz9UTxL0eZL0u2nYHJNUjZahkmONA= X-MS-Exchange-Transport-CrossTenantHeadersStamped: PA1P189MB2702 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 20 Aug 2026 18:10:39 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243875 Upgrade OpenSSL from 3.5.7 to 4.0.1. This is a major version upgrade. Changelog: https://github.com/openssl/openssl/blob/openssl-4.0.1/CHANGES.md New CVE fixes not already in 3.5.7: * CVE-2026-28386: Fixed OOB read in AES-CFB-128 on x86-64 with AVX-512 * CVE-2026-35188: Fixed double-free when checking OCSP stapled response * CVE-2026-42765: Fixed NULL deref in cert verification with OCSP * CVE-2026-42771: Fixed OOB read in X509_VERIFY_PARAM_set1_email() Major breaking changes in 4.0.0: * Removed support for engines. The ENGINE API is fully removed. * Removed support for SSLv3. SSLv3 has been deprecated since 2015. * Removed support for the SSLv2 Client Hello. * Removed per-version TLS method functions (SSLv3_method(), TLSv1_method(), TLSv1_1_method(), TLSv1_2_method()). * Removed c_rehash script tool. Use 'openssl rehash' instead. * ASN1_STRING has been made opaque. * Numerous API function signatures changed to include const qualifiers. * libcrypto no longer cleans up globally allocated data via atexit(). * Added AKID verification checks when X509_V_FLAG_X509_STRICT is set. * Support of deprecated elliptic curves in TLS disabled at compile-time by default. Recipe changes: * Drop 0001-Added-handshake-history-reporting-when-test-fails.patch (merged upstream via PR #22481). * Refresh remaining patches against the new version. * Remove ENGINE API artifacts: engines package, dasync.so/ossltest.so ptest installation, ENGINESDIR references, OPENSSL_ENGINES wrapper variable, and cryptodev-linux PACKAGECONFIG. Tested: ptest on qemux86-64: Files=362, Tests=4310, Result: PASS Passed: 338, Skipped: 24 (fips, lms, rc5, tfo, compression, sslversions, sslkeylogfile, external tests - all expected) Failed: 0 Signed-off-by: Jaipaul Cheernam --- ...ke-history-reporting-when-test-fails.patch | 366 ------------------ ...1-Configure-do-not-tweak-mips-cflags.patch | 6 +- ...sysroot-and-debug-prefix-map-from-co.patch | 11 +- .../0001-extend-check_cwm-test-timeout.patch | 4 +- .../{openssl_3.5.7.bb => openssl_4.0.1.bb} | 23 +- 5 files changed, 16 insertions(+), 394 deletions(-) delete mode 100644 meta/recipes-connectivity/openssl/openssl/0001-Added-handshake-history-reporting-when-test-fails.patch rename meta/recipes-connectivity/openssl/{openssl_3.5.7.bb => openssl_4.0.1.bb} (88%) diff --git a/meta/recipes-connectivity/openssl/openssl/0001-Added-handshake-history-reporting-when-test-fails.patch b/meta/recipes-connectivity/openssl/openssl/0001-Added-handshake-history-reporting-when-test-fails.patch deleted file mode 100644 index a74c79303f..0000000000 --- a/meta/recipes-connectivity/openssl/openssl/0001-Added-handshake-history-reporting-when-test-fails.patch +++ /dev/null @@ -1,366 +0,0 @@ -From 5ba65051fea0513db0d997f0ab7cafb9826ed74a Mon Sep 17 00:00:00 2001 -From: William Lyu -Date: Fri, 20 Oct 2023 16:22:37 -0400 -Subject: [PATCH] Added handshake history reporting when test fails - -Upstream-Status: Submitted [https://github.com/openssl/openssl/pull/22481] - -Signed-off-by: William Lyu ---- - test/helpers/handshake.c | 136 ++++++++++++++++++++++++++++++--------- - test/helpers/handshake.h | 70 +++++++++++++++++++- - test/ssl_test.c | 44 +++++++++++++ - 3 files changed, 217 insertions(+), 33 deletions(-) - -diff --git a/test/helpers/handshake.c b/test/helpers/handshake.c -index f611b3a..5703b48 100644 ---- a/test/helpers/handshake.c -+++ b/test/helpers/handshake.c -@@ -25,6 +25,102 @@ - #include - #endif - -+/* Shamelessly copied from test/helpers/ssl_test_ctx.c */ -+/* Maps string names to various enumeration type */ -+typedef struct { -+ const char *name; -+ int value; -+} enum_name_map; -+ -+static const enum_name_map connect_phase_names[] = { -+ {"Handshake", HANDSHAKE}, -+ {"RenegAppData", RENEG_APPLICATION_DATA}, -+ {"RenegSetup", RENEG_SETUP}, -+ {"RenegHandshake", RENEG_HANDSHAKE}, -+ {"AppData", APPLICATION_DATA}, -+ {"Shutdown", SHUTDOWN}, -+ {"ConnectionDone", CONNECTION_DONE} -+}; -+ -+static const enum_name_map peer_status_names[] = { -+ {"PeerSuccess", PEER_SUCCESS}, -+ {"PeerRetry", PEER_RETRY}, -+ {"PeerError", PEER_ERROR}, -+ {"PeerWaiting", PEER_WAITING}, -+ {"PeerTestFail", PEER_TEST_FAILURE} -+}; -+ -+static const enum_name_map handshake_status_names[] = { -+ {"HandshakeSuccess", HANDSHAKE_SUCCESS}, -+ {"ClientError", CLIENT_ERROR}, -+ {"ServerError", SERVER_ERROR}, -+ {"InternalError", INTERNAL_ERROR}, -+ {"HandshakeRetry", HANDSHAKE_RETRY} -+}; -+ -+/* Shamelessly copied from test/helpers/ssl_test_ctx.c */ -+static const char *enum_name(const enum_name_map *enums, size_t num_enums, -+ int value) -+{ -+ size_t i; -+ for (i = 0; i < num_enums; i++) { -+ if (enums[i].value == value) { -+ return enums[i].name; -+ } -+ } -+ return "InvalidValue"; -+} -+ -+const char *handshake_connect_phase_name(connect_phase_t phase) -+{ -+ return enum_name(connect_phase_names, OSSL_NELEM(connect_phase_names), -+ (int)phase); -+} -+ -+const char *handshake_status_name(handshake_status_t handshake_status) -+{ -+ return enum_name(handshake_status_names, OSSL_NELEM(handshake_status_names), -+ (int)handshake_status); -+} -+ -+const char *handshake_peer_status_name(peer_status_t peer_status) -+{ -+ return enum_name(peer_status_names, OSSL_NELEM(peer_status_names), -+ (int)peer_status); -+} -+ -+static void save_loop_history(HANDSHAKE_HISTORY *history, -+ connect_phase_t phase, -+ handshake_status_t handshake_status, -+ peer_status_t server_status, -+ peer_status_t client_status, -+ int client_turn_count, -+ int is_client_turn) -+{ -+ HANDSHAKE_HISTORY_ENTRY *new_entry = NULL; -+ -+ /* -+ * Create a new history entry for a handshake loop with statuses given in -+ * the arguments. Potentially evicting the oldest entry when the -+ * ring buffer is full. -+ */ -+ ++(history->last_idx); -+ history->last_idx &= MAX_HANDSHAKE_HISTORY_ENTRY_IDX_MASK; -+ -+ new_entry = &((history->entries)[history->last_idx]); -+ new_entry->phase = phase; -+ new_entry->handshake_status = handshake_status; -+ new_entry->server_status = server_status; -+ new_entry->client_status = client_status; -+ new_entry->client_turn_count = client_turn_count; -+ new_entry->is_client_turn = is_client_turn; -+ -+ /* Evict the oldest handshake loop entry when the ring buffer is full. */ -+ if (history->entry_count < MAX_HANDSHAKE_HISTORY_ENTRY) { -+ ++(history->entry_count); -+ } -+} -+ - HANDSHAKE_RESULT *HANDSHAKE_RESULT_new(void) - { - HANDSHAKE_RESULT *ret; -@@ -724,15 +820,6 @@ static void configure_handshake_ssl(SSL *server, SSL *client, - SSL_set_post_handshake_auth(client, 1); - } - --/* The status for each connection phase. */ --typedef enum { -- PEER_SUCCESS, -- PEER_RETRY, -- PEER_ERROR, -- PEER_WAITING, -- PEER_TEST_FAILURE --} peer_status_t; -- - /* An SSL object and associated read-write buffers. */ - typedef struct peer_st { - SSL *ssl; -@@ -1077,16 +1164,6 @@ static void do_shutdown_step(PEER *peer) - } - } - --typedef enum { -- HANDSHAKE, -- RENEG_APPLICATION_DATA, -- RENEG_SETUP, -- RENEG_HANDSHAKE, -- APPLICATION_DATA, -- SHUTDOWN, -- CONNECTION_DONE --} connect_phase_t; -- - static int renegotiate_op(const SSL_TEST_CTX *test_ctx) - { - switch (test_ctx->handshake_mode) { -@@ -1164,19 +1241,6 @@ static void do_connect_step(const SSL_TEST_CTX *test_ctx, PEER *peer, - } - } - --typedef enum { -- /* Both parties succeeded. */ -- HANDSHAKE_SUCCESS, -- /* Client errored. */ -- CLIENT_ERROR, -- /* Server errored. */ -- SERVER_ERROR, -- /* Peers are in inconsistent state. */ -- INTERNAL_ERROR, -- /* One or both peers not done. */ -- HANDSHAKE_RETRY --} handshake_status_t; -- - /* - * Determine the handshake outcome. - * last_status: the status of the peer to have acted last. -@@ -1541,6 +1605,10 @@ static HANDSHAKE_RESULT *do_handshake_internal( - - start = time(NULL); - -+ save_loop_history(&(ret->history), -+ phase, status, server.status, client.status, -+ client_turn_count, client_turn); -+ - /* - * Half-duplex handshake loop. - * Client and server speak to each other synchronously in the same process. -@@ -1562,6 +1630,10 @@ static HANDSHAKE_RESULT *do_handshake_internal( - 0 /* server went last */); - } - -+ save_loop_history(&(ret->history), -+ phase, status, server.status, client.status, -+ client_turn_count, client_turn); -+ - switch (status) { - case HANDSHAKE_SUCCESS: - client_turn_count = 0; -diff --git a/test/helpers/handshake.h b/test/helpers/handshake.h -index 78b03f9..b9967c2 100644 ---- a/test/helpers/handshake.h -+++ b/test/helpers/handshake.h -@@ -1,5 +1,5 @@ - /* -- * Copyright 2016-2021 The OpenSSL Project Authors. All Rights Reserved. -+ * Copyright 2016-2023 The OpenSSL Project Authors. All Rights Reserved. - * - * Licensed under the Apache License 2.0 (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy -@@ -12,6 +12,11 @@ - - #include "ssl_test_ctx.h" - -+#define MAX_HANDSHAKE_HISTORY_ENTRY_BIT 4 -+#define MAX_HANDSHAKE_HISTORY_ENTRY (1 << MAX_HANDSHAKE_HISTORY_ENTRY_BIT) -+#define MAX_HANDSHAKE_HISTORY_ENTRY_IDX_MASK \ -+ ((1 << MAX_HANDSHAKE_HISTORY_ENTRY_BIT) - 1) -+ - typedef struct ctx_data_st { - unsigned char *npn_protocols; - size_t npn_protocols_len; -@@ -22,6 +27,63 @@ typedef struct ctx_data_st { - char *session_ticket_app_data; - } CTX_DATA; - -+typedef enum { -+ HANDSHAKE, -+ RENEG_APPLICATION_DATA, -+ RENEG_SETUP, -+ RENEG_HANDSHAKE, -+ APPLICATION_DATA, -+ SHUTDOWN, -+ CONNECTION_DONE -+} connect_phase_t; -+ -+/* The status for each connection phase. */ -+typedef enum { -+ PEER_SUCCESS, -+ PEER_RETRY, -+ PEER_ERROR, -+ PEER_WAITING, -+ PEER_TEST_FAILURE -+} peer_status_t; -+ -+typedef enum { -+ /* Both parties succeeded. */ -+ HANDSHAKE_SUCCESS, -+ /* Client errored. */ -+ CLIENT_ERROR, -+ /* Server errored. */ -+ SERVER_ERROR, -+ /* Peers are in inconsistent state. */ -+ INTERNAL_ERROR, -+ /* One or both peers not done. */ -+ HANDSHAKE_RETRY -+} handshake_status_t; -+ -+/* Stores the various status information in a handshake loop. */ -+typedef struct handshake_history_entry_st { -+ connect_phase_t phase; -+ handshake_status_t handshake_status; -+ peer_status_t server_status; -+ peer_status_t client_status; -+ int client_turn_count; -+ int is_client_turn; -+} HANDSHAKE_HISTORY_ENTRY; -+ -+typedef struct handshake_history_st { -+ /* Implemented using ring buffer. */ -+ /* -+ * The valid entries are |entries[last_idx]|, |entries[last_idx-1]|, -+ * ..., etc., going up to |entry_count| number of entries. Note that when -+ * the index into the array |entries| becomes < 0, we wrap around to -+ * the end of |entries|. -+ */ -+ HANDSHAKE_HISTORY_ENTRY entries[MAX_HANDSHAKE_HISTORY_ENTRY]; -+ /* The number of valid entries in |entries| array. */ -+ size_t entry_count; -+ /* The index of the last valid entry in the |entries| array. */ -+ size_t last_idx; -+} HANDSHAKE_HISTORY; -+ - typedef struct handshake_result { - ssl_test_result_t result; - /* These alerts are in the 2-byte format returned by the info_callback. */ -@@ -77,6 +139,8 @@ typedef struct handshake_result { - char *cipher; - /* session ticket application data */ - char *result_session_ticket_app_data; -+ /* handshake loop history */ -+ HANDSHAKE_HISTORY history; - } HANDSHAKE_RESULT; - - HANDSHAKE_RESULT *HANDSHAKE_RESULT_new(void); -@@ -95,4 +159,8 @@ int configure_handshake_ctx_for_srp(SSL_CTX *server_ctx, SSL_CTX *server2_ctx, - CTX_DATA *server2_ctx_data, - CTX_DATA *client_ctx_data); - -+const char *handshake_connect_phase_name(connect_phase_t phase); -+const char *handshake_status_name(handshake_status_t handshake_status); -+const char *handshake_peer_status_name(peer_status_t peer_status); -+ - #endif /* OSSL_TEST_HANDSHAKE_HELPER_H */ -diff --git a/test/ssl_test.c b/test/ssl_test.c -index ea60851..9d6b093 100644 ---- a/test/ssl_test.c -+++ b/test/ssl_test.c -@@ -26,6 +26,44 @@ static OSSL_LIB_CTX *libctx = NULL; - /* Currently the section names are of the form test-, e.g. test-15. */ - #define MAX_TESTCASE_NAME_LENGTH 100 - -+static void print_handshake_history(const HANDSHAKE_HISTORY *history) -+{ -+ size_t first_idx; -+ size_t i; -+ size_t cur_idx; -+ const HANDSHAKE_HISTORY_ENTRY *cur_entry; -+ const char header_template[] = "|%14s|%16s|%16s|%16s|%17s|%14s|"; -+ const char body_template[] = "|%14s|%16s|%16s|%16s|%17d|%14s|"; -+ -+ TEST_info("The following is the server/client state " -+ "in the most recent %d handshake loops.", -+ MAX_HANDSHAKE_HISTORY_ENTRY); -+ -+ TEST_note("==================================================" -+ "=================================================="); -+ TEST_note(header_template, -+ "phase", "handshake status", "server status", -+ "client status", "client turn count", "is client turn"); -+ TEST_note("+--------------+----------------+----------------" -+ "+----------------+-----------------+--------------+"); -+ -+ first_idx = (history->last_idx - history->entry_count + 1) & -+ MAX_HANDSHAKE_HISTORY_ENTRY_IDX_MASK; -+ for (i = 0; i < history->entry_count; ++i) { -+ cur_idx = (first_idx + i) & MAX_HANDSHAKE_HISTORY_ENTRY_IDX_MASK; -+ cur_entry = &(history->entries)[cur_idx]; -+ TEST_note(body_template, -+ handshake_connect_phase_name(cur_entry->phase), -+ handshake_status_name(cur_entry->handshake_status), -+ handshake_peer_status_name(cur_entry->server_status), -+ handshake_peer_status_name(cur_entry->client_status), -+ cur_entry->client_turn_count, -+ cur_entry->is_client_turn ? "true" : "false"); -+ } -+ TEST_note("==================================================" -+ "=================================================="); -+} -+ - static const char *print_alert(int alert) - { - return alert ? SSL_alert_desc_string_long(alert) : "no alert"; -@@ -388,6 +426,12 @@ static int check_test(HANDSHAKE_RESULT *result, SSL_TEST_CTX *test_ctx) - ret &= check_client_sign_type(result, test_ctx); - ret &= check_client_ca_names(result, test_ctx); - } -+ -+ /* Print handshake loop history if any check fails. */ -+ if (!ret) { -+ print_handshake_history(&(result->history)); -+ } -+ - return ret; - } - --- -2.25.1 - diff --git a/meta/recipes-connectivity/openssl/openssl/0001-Configure-do-not-tweak-mips-cflags.patch b/meta/recipes-connectivity/openssl/openssl/0001-Configure-do-not-tweak-mips-cflags.patch index cd8906df67..77bfe4e4e5 100644 --- a/meta/recipes-connectivity/openssl/openssl/0001-Configure-do-not-tweak-mips-cflags.patch +++ b/meta/recipes-connectivity/openssl/openssl/0001-Configure-do-not-tweak-mips-cflags.patch @@ -1,4 +1,4 @@ -From 0377f0d5b5c1079e3b9a80881f4dcc891cbe9f9a Mon Sep 17 00:00:00 2001 +From b5cee0cb0f14a78056ef7722a34b361491f1fdda Mon Sep 17 00:00:00 2001 From: Alexander Kanavin Date: Tue, 30 May 2023 09:11:27 -0700 Subject: [PATCH] Configure: do not tweak mips cflags @@ -17,10 +17,10 @@ Signed-off-by: Tim Orling 1 file changed, 10 deletions(-) diff --git a/Configure b/Configure -index fff97bd..5ee54c1 100755 +index c05a30b..db8adee 100755 --- a/Configure +++ b/Configure -@@ -1557,16 +1557,6 @@ if ($target =~ /^mingw/ && `$config{CC} --target-help 2>&1` =~ m/-mno-cygwin/m) +@@ -1575,16 +1575,6 @@ if ($target =~ /^mingw/ && `$config{CC} --target-help 2>&1` =~ m/-mno-cygwin/m) push @{$config{shared_ldflag}}, "-mno-cygwin"; } diff --git a/meta/recipes-connectivity/openssl/openssl/0001-buildinfo-strip-sysroot-and-debug-prefix-map-from-co.patch b/meta/recipes-connectivity/openssl/openssl/0001-buildinfo-strip-sysroot-and-debug-prefix-map-from-co.patch index bfbfedbd67..1d9e7539f6 100644 --- a/meta/recipes-connectivity/openssl/openssl/0001-buildinfo-strip-sysroot-and-debug-prefix-map-from-co.patch +++ b/meta/recipes-connectivity/openssl/openssl/0001-buildinfo-strip-sysroot-and-debug-prefix-map-from-co.patch @@ -1,4 +1,4 @@ -From 5985253f2c9025d7c127443a3a9938946f80c2a1 Mon Sep 17 00:00:00 2001 +From 6df53bfebcf8ca65910a18220a6576fb110918a5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Martin=20Hundeb=C3=B8ll?= Date: Tue, 6 Nov 2018 14:50:47 +0100 Subject: [PATCH] buildinfo: strip sysroot and debug-prefix-map from compiler @@ -28,17 +28,16 @@ Signed-off-by: Kai Kang Update to fix buildpaths qa issue for '-ffile-prefix-map'. Signed-off-by: Khem Raj - --- Configurations/unix-Makefile.tmpl | 16 +++++++++++++++- crypto/build.info | 2 +- 2 files changed, 16 insertions(+), 2 deletions(-) diff --git a/Configurations/unix-Makefile.tmpl b/Configurations/unix-Makefile.tmpl -index 09303c4..011bda1 100644 +index eff66e5..bc48f51 100644 --- a/Configurations/unix-Makefile.tmpl +++ b/Configurations/unix-Makefile.tmpl -@@ -514,13 +514,27 @@ BIN_LDFLAGS={- join(' ', $target{bin_lflags} || (), +@@ -503,13 +503,27 @@ BIN_LDFLAGS={- join(' ', $target{bin_lflags} || (), '$(CNF_LDFLAGS)', '$(LDFLAGS)') -} BIN_EX_LIBS=$(CNF_EX_LIBS) $(EX_LIBS) @@ -68,10 +67,10 @@ index 09303c4..011bda1 100644 # For x86 assembler: Set PROCESSOR to 386 if you want to support diff --git a/crypto/build.info b/crypto/build.info -index aee5c46..95c9577 100644 +index 8e4a885..95b0902 100644 --- a/crypto/build.info +++ b/crypto/build.info -@@ -115,7 +115,7 @@ DEFINE[../libcrypto]=$UPLINKDEF +@@ -114,7 +114,7 @@ DEFINE[../libcrypto]=$UPLINKDEF DEPEND[info.o]=buildinf.h DEPEND[cversion.o]=buildinf.h diff --git a/meta/recipes-connectivity/openssl/openssl/0001-extend-check_cwm-test-timeout.patch b/meta/recipes-connectivity/openssl/openssl/0001-extend-check_cwm-test-timeout.patch index f6eb28069a..76bc05d5f9 100644 --- a/meta/recipes-connectivity/openssl/openssl/0001-extend-check_cwm-test-timeout.patch +++ b/meta/recipes-connectivity/openssl/openssl/0001-extend-check_cwm-test-timeout.patch @@ -1,4 +1,4 @@ -From c7000672296f4c367341aa3415f26c4d9f5e4749 Mon Sep 17 00:00:00 2001 +From 14856dbd767621ce6f162680c00557b54af0effb Mon Sep 17 00:00:00 2001 From: Gyorgy Sarvari Date: Thu, 23 Oct 2025 11:24:36 +0200 Subject: [PATCH] extend check_cwm test timeout @@ -15,7 +15,7 @@ Signed-off-by: Gyorgy Sarvari 1 file changed, 5 insertions(+) diff --git a/test/radix/main.c b/test/radix/main.c -index 4a1e886a71..39f8c61ef9 100644 +index 0f3dc11..d925639 100644 --- a/test/radix/main.c +++ b/test/radix/main.c @@ -25,6 +25,11 @@ static int test_script(int idx) diff --git a/meta/recipes-connectivity/openssl/openssl_3.5.7.bb b/meta/recipes-connectivity/openssl/openssl_4.0.1.bb similarity index 88% rename from meta/recipes-connectivity/openssl/openssl_3.5.7.bb rename to meta/recipes-connectivity/openssl/openssl_4.0.1.bb index b95c734f1d..45498ca5ec 100644 --- a/meta/recipes-connectivity/openssl/openssl_3.5.7.bb +++ b/meta/recipes-connectivity/openssl/openssl_4.0.1.bb @@ -11,7 +11,6 @@ SRC_URI = "http://www.openssl.org/source/openssl-${PV}.tar.gz \ file://run-ptest \ file://0001-buildinfo-strip-sysroot-and-debug-prefix-map-from-co.patch \ file://0001-Configure-do-not-tweak-mips-cflags.patch \ - file://0001-Added-handshake-history-reporting-when-test-fails.patch \ file://0001-extend-check_cwm-test-timeout.patch \ " @@ -19,7 +18,7 @@ SRC_URI:append:class-nativesdk = " \ file://environment.d-openssl.sh \ " -SRC_URI[sha256sum] = "a8c0d28a529ca480f9f36cf5792e2cd21984552a3c8e4aa11a24aa31aeac98e8" +SRC_URI[sha256sum] = "2db3f3a0d6ea4b59e1f094ace2c8cd536dffb87cdc39084c5afa1e6f7f37dd09" inherit lib_package multilib_header multilib_script ptest perlnative manpages MULTILIB_SCRIPTS = "${PN}-bin:${bindir}/c_rehash" @@ -33,7 +32,6 @@ PACKAGECONFIG ?= "" PACKAGECONFIG:class-native = "" PACKAGECONFIG:class-nativesdk = "" -PACKAGECONFIG[cryptodev-linux] = "enable-devcryptoeng,disable-devcryptoeng,cryptodev-linux,,cryptodev-module" PACKAGECONFIG[legacy] = ",no-legacy" PACKAGECONFIG[tls1] = ",no-tls1" PACKAGECONFIG[tls1_1] = ",no-tls1_1" @@ -57,8 +55,8 @@ EXTRA_OECONF:append:class-native = " --with-rand-seed=os,devrandom" EXTRA_OECONF:append:class-nativesdk = " --with-rand-seed=os,devrandom" # Relying on hardcoded built-in paths causes openssl-native to not be relocateable from sstate. -EXTRA_OEMAKE:append:task-compile:class-native = ' OPENSSLDIR="/not/builtin" ENGINESDIR="/not/builtin" MODULESDIR="/not/builtin"' -EXTRA_OEMAKE:append:task-compile:class-nativesdk = ' OPENSSLDIR="/not/builtin" ENGINESDIR="/not/builtin" MODULESDIR="/not/builtin"' +EXTRA_OEMAKE:append:task-compile:class-native = ' OPENSSLDIR="/not/builtin" MODULESDIR="/not/builtin"' +EXTRA_OEMAKE:append:task-compile:class-nativesdk = ' OPENSSLDIR="/not/builtin" MODULESDIR="/not/builtin"' #| threads_pthread.c:(.text+0x372): undefined reference to `__atomic_is_lock_free' EXTRA_OECONF:append:toolchain-clang:x86 = " -latomic" @@ -204,12 +202,10 @@ do_install:append:class-native () { OPENSSL_CONF=\${OPENSSL_CONF:-${libdir}/ssl-3/openssl.cnf} \ SSL_CERT_DIR=\${SSL_CERT_DIR:-${libdir}/ssl-3/certs} \ SSL_CERT_FILE=\${SSL_CERT_FILE:-${libdir}/ssl-3/cert.pem} \ - OPENSSL_ENGINES=\${OPENSSL_ENGINES:-${libdir}/engines-3} \ OPENSSL_MODULES=\${OPENSSL_MODULES:-${libdir}/ossl-modules} - # Setting ENGINESDIR and MODULESDIR to invalid paths prevents host contamination, + # Setting MODULESDIR to invalid paths prevents host contamination, # but also breaks the generated libcrypto.pc file. Post-Fix it manually here. - sed -i 's|^enginesdir=\($.libdir.\)/.*|enginesdir=\1/engines-3|' ${D}${libdir}/pkgconfig/libcrypto.pc sed -i 's|^modulesdir=\($.libdir.\)/.*|modulesdir=\1/ossl-modules|' ${D}${libdir}/pkgconfig/libcrypto.pc } @@ -252,10 +248,6 @@ do_install_ptest() { sed 's|${S}|${PTEST_PATH}|g' -i ${D}${PTEST_PATH}/configdata.pm ${D}${PTEST_PATH}/util/wrap.pl - install -d ${D}${PTEST_PATH}/engines - install -m755 ${B}/engines/dasync.so ${D}${PTEST_PATH}/engines/ - install -m755 ${B}/engines/ossltest.so ${D}${PTEST_PATH}/engines/ - ln -s ${libdir}/engines-3/loader_attic.so ${D}${PTEST_PATH}/engines/ ln -s ${libdir}/ossl-modules/ ${D}${PTEST_PATH}/providers } @@ -270,16 +262,13 @@ pkg_postinst_ontarget:${PN}-ossl-module-fips () { # file to be installed for both the openssl-bin package and the libcrypto # package since the openssl-bin package depends on the libcrypto package. -PACKAGES =+ "libcrypto libssl openssl-conf ${PN}-engines ${PN}-misc ${PN}-ossl-module-legacy ${PN}-ossl-module-fips" +PACKAGES =+ "libcrypto libssl openssl-conf ${PN}-misc ${PN}-ossl-module-legacy ${PN}-ossl-module-fips" FILES:libcrypto = "${libdir}/libcrypto${SOLIBS}" FILES:libssl = "${libdir}/libssl${SOLIBS}" FILES:openssl-conf = "${sysconfdir}/ssl/openssl.cnf* \ ${libdir}/ssl-3/openssl.cnf* \ " -FILES:${PN}-engines = "${libdir}/engines-3" -# ${prefix} comes from what we pass into --prefix at configure time (which is used for INSTALLTOP) -FILES:${PN}-engines:append:mingw32:class-nativesdk = " ${prefix}${libdir}/engines-3" FILES:${PN}-misc = "${libdir}/ssl-3/misc ${bindir}/c_rehash" FILES:${PN}-ossl-module-legacy = "${libdir}/ossl-modules/legacy.so" FILES:${PN}-ossl-module-fips = "${libdir}/ossl-modules/fips.so" @@ -290,7 +279,7 @@ CONFFILES:openssl-conf = "${sysconfdir}/ssl/openssl.cnf" RRECOMMENDS:libcrypto += "openssl-conf ${PN}-ossl-module-legacy" RDEPENDS:${PN}-misc = "perl" -RDEPENDS:${PN}-ptest += "openssl-bin perl perl-modules bash sed openssl-engines" +RDEPENDS:${PN}-ptest += "openssl-bin perl perl-modules bash sed" RRECOMMENDS:${PN}-ptest += "${PN}-ossl-module-legacy" RDEPENDS:${PN}-bin += "openssl-conf" From patchwork Thu Aug 20 18:10:18 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Jaipaul Cheernam X-Patchwork-Id: 95935 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9A1E7C5DF82 for ; Thu, 20 Aug 2026 18:10:38 +0000 (UTC) Received: from OSPPR02CU001.outbound.protection.outlook.com (OSPPR02CU001.outbound.protection.outlook.com [40.107.159.25]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.165.1787249429774855731 for ; Thu, 20 Aug 2026 11:10:32 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=nVp0aFV4; spf=pass (domain: est.tech, ip: 40.107.159.25, mailfrom: jaipaul.cheernam@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=clXDZpX4DgncBlxEf8OgB9j8otbzcKSyYFtMMV2oNrXfTUX+3WwrA/0lht0nzpv5y+mJ+0Pf1oQmzJqGTHq9CylS4Bo8icjY39af8hMRhjJuvp88cs9hC/QSLsD32uyaSyKsaWxyIy0vs0UGVxXG8HaHeslunVEa6yAy98y1n2ZPQ8FFa1zHADEiPhrFpml+OJkMOPKKRq9nYSljfWLCQnrRLIiqJf7HQQSSRC7OTW4uB+4lMHMdSuG/UaQmx5Kv2eM4kWTHgAlO+ApRa83tHSdqQyJNS+xZ4ClSHfGKaalXWLKncF7vEM4RRXMA7aG6oPdpfM2OOO1NDyC9gkoStA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=qpHYV8LMAixTf+bQhNGEcC8tGMvZSUqFZU7fquoUUbU=; b=R98FEt3kZczY4t1F6WoUyBZL9IRH75x7yO0VJQvAW0AUMHMduQ54lXkTU99kOpLYkgFonCVSVqIFkNAhr9Qg6IScsC5cyCbUIt1V5NQNznq2Ea5tdl0NKHSwC0SAIg3C1w8bIGFKonyeqclRxyCngd65HB2erP96ejl3QukfkkVbIKEIG3qqpNBmKNcV1SR0GIVjnV2Zb7hbt8TUQW2O0/peiSpBjPxpczX07jRz6ISSIMR1X6sifEWuqUJ2HpnRAPfANN+aR/zl+Cz2fZrKRajw9yxb1H2n835v0KoFXXAPvHaYwNw0zNTvR76fTaL0HWHiTWX0LDoiJuxPMwiDeA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=qpHYV8LMAixTf+bQhNGEcC8tGMvZSUqFZU7fquoUUbU=; b=nVp0aFV4X9TTtG4ZVSM0WvZiQ7NtJ5zawyleAL7tC38yD/jVCOwVpFo8ouCmUf4cwjiy1PixecgO2LsI3bS/n3qADm3HT2hiK7JMCX/XKn0Ki2gu1yE5hfzFHppSZoQLwvSMZ0MzWBNH5IMOYTT0mKGDTuYW+45xb6Yrdz29N4wvaRqTGe+oJvyF+WBx68vnJT3cDqgzSbI1FYEvb4RiCKKAkqDwXPOXyaHZTvvG7Mei+yrGXMQ4Ch+A7QR/j/NdXvWEL8RbQ/cZ9I2S4pHO3XBiTqOHQhSbQMI+aP+wt3ZrgRl6qOvpJJwNK/q4Gv8UzGF8osXySGD58tvR/IO4uA== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from GV1P189MB2954.EURP189.PROD.OUTLOOK.COM (2603:10a6:150:263::18) by PA1P189MB2702.EURP189.PROD.OUTLOOK.COM (2603:10a6:102:452::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.339.8; Thu, 20 Aug 2026 18:10:29 +0000 Received: from GV1P189MB2954.EURP189.PROD.OUTLOOK.COM ([fe80::a7e4:7d5b:ab4a:4b96]) by GV1P189MB2954.EURP189.PROD.OUTLOOK.COM ([fe80::a7e4:7d5b:ab4a:4b96%4]) with mapi id 15.21.0360.003; Thu, 20 Aug 2026 18:10:29 +0000 From: Jaipaul Cheernam To: openembedded-core@lists.openembedded.org Subject: [RFC v2 2/6] python3: backport OpenSSL 4.0 support from upstream Date: Thu, 20 Aug 2026 20:10:18 +0200 Message-ID: <20260820181022.44434-3-jaipaul.cheernam@est.tech> X-Mailer: git-send-email 2.39.5 (Apple Git-154) In-Reply-To: <20260820181022.44434-1-jaipaul.cheernam@est.tech> References: <20260814051829.35088-1-jaipaul.cheernam@est.tech> <20260820181022.44434-1-jaipaul.cheernam@est.tech> X-ClientProxiedBy: DUZPR01CA0206.eurprd01.prod.exchangelabs.com (2603:10a6:10:4b6::21) To GV1P189MB2954.EURP189.PROD.OUTLOOK.COM (2603:10a6:150:263::18) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: GV1P189MB2954:EE_|PA1P189MB2702:EE_ X-MS-Office365-Filtering-Correlation-Id: 963f1bed-1e8b-41f2-7d5c-08defee6514b X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|366016|10070799003|23010399003|1800799024|376014|10067099003|56012099006|6133799003|12006099003|3023799007|11063799006|22082099003|18002099003|13003099007|4143699003; X-Microsoft-Antispam-Message-Info: S4cDRudVTYc4/er/P44m6eslwBj2EZYWjIn7WBajomFkmunRn1pyhNEuhC5UXhYjSZcM3RkvRMfJRDSVdwPx6p6S0QNuRXWoqEdPBVlN4rY+FCrDZNvMi2t+c/hpttxWeW1PxDvMZVvZY2wuVhKHYddYOrMKxXUM2h0Xy1AiJcupsIZMBbt2vRXrqr8G3wuu6imoXmVjOqBacVUtpLVIiAU8F460Mf2WWwyHLawXAcN1ctk+DS9RLdrsJL/AlUxcRlFSsbvvPz5yMuT/Vm155FSBIt4WJUOeEEtwIYaXMK1wCfULFTa7CTOG4xlRdB6wqMgzcpj+RVhI0J/6fY6eW14qrriv34OVn0gUajDBcfKFO3m0PFkJz2PeSV9IHbLLNQmjjm1XDf9GujXOU2BcnxCWneFCfoZNYz1k5XmQh31eAmhQdSbpsX+i1IrLt/jxjmj7K6EdUfuEog0ric5OTUeBDZmkNpm+E5zJmw4dvZZtvq5zVJOm3IQesOZUNApG4x8UkpSBbv+jtXM/gYmLymtZ16W7C9/7cFDq5+B9JH1A+gcL5iR20JkVYCtbLnF4HbN6o4LdvRABZYjKNg20uosoFKqLRYAtdyvRMxWGfr0f7rFeDDvynoxJi9Dt+IyO1wXnPfIsElgyXsE4MSF7hnGgqEfBVrVm/jBWKp6AJ4Q= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:GV1P189MB2954.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(366016)(10070799003)(23010399003)(1800799024)(376014)(10067099003)(56012099006)(6133799003)(12006099003)(3023799007)(11063799006)(22082099003)(18002099003)(13003099007)(4143699003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 2 X-MS-Exchange-AntiSpam-MessageData-0: vpL64y9/kXSzBrGI/UOvz1O/+hqMWYwGkTKRw27kWuze29QMjfre+jGn1SzbfVfP18bfeL6SY6dw3jywlUFls5ZKjLYuziWoQEyHNmtFpfJZmgOzJvod4oP41y1i7XgQPBCVm1orBmENumFW1nWYBGPHyUwt3L2SMB4aSLnVUwVgRhL/5Z3KPof8EyIOixIIlxsMM4pwSoXT2t5ywDfufaouwfXd+2/hM6fSCKVS5Rt49G8z8iE8/FYINpUYJPWfSBU6+PFJplHNxBDgAvOVRSXWxL3mp09EzMSB2+L7Qg17UXYmlMXZlAGculuWxrTxeggK7zE5SyqEHGi8sSf1lqyd7r5qF/s8u/dlMJ1CVsHtpfNgzkbiF/ImJyyHXKrgx7n5V0BJEaKhSwCyS7GJGAOuCWSmnZTgB39zQNJ3hUaIzwtFTJn8ldr7wBMA6fdcwkiWUAOOaOtkebeiwNCqI+QVwSTKHzVuwyNrgyq434LPLrzAoA9/RMlvXVNt37egelxG7SAN/lT8Ca7HO0oHXJaJ51Qjo9ByJAqVZdCtb0hOsjI3WDtLMKao6G7WFigxngFrsx50eTvC9Z7qN2LMsbe8B3q0SmQdddrkSm2FlWDWyVaGAy6EMkpFfssBSt7hsHoS0bQW8ji9dc2vqdUVokPO7Nc+55FviiWGQfVBxQeD79paHFds/VXdeQg2GHHF+0Y3QiECoAYg74670fkEZPAWqE1F/Sb8x+xZ91GxCL88GFSz1Vl9U9zU6lf5eYxYaJ/Mx74j5b6PymEz8s2A5YsgewzPigVAZLkrvqmsw6ztHc3b4nrGECFA8X6tFSMHXtJyMOSpdNufvWaT8wUJNdbelmIp0ZuYVQ8xhxJwyMQV5Qt0ej62bxhtrNQsb6x2w9u24WJ3B46KLFe7kKkRThZLCfVHaSckUvbBKcHQXWEWySaZzBNRoxA5lBpyIdQ5o8KLnhvmBQn3lJTKW2KO0dV5wMoh6NNVPSPUYYErNJBOSrMP9NzqAlc0i7H5F6IEDZrJYzpm/VuF0eahQlD7ArLEgn9bGf9GmjVIWyTtGjG1kaVFWuyfMHKRPtlFVVqd9ayf5ymfwuC60uEicCyWR92/SCHswemB8CivWIRwCof+Acxwtxkw1078QDGSXxH+cWhNZz5XOatJdpl0vMJXJn18QGIyjejG52UxYBchPSAItlDHh5acgboZ+SKm9bIRxZ6X8YizuccE+quTVBt8Ne9aeNXhue/8nPl9vVIfvgOGreb8UnqkCLILMKBVcsMD8xneY3/AUID2bKTWskK4OxphpgE7m+MQgpgelgoDqjrCHIL5hCiBr+4/CKCR3dE7jpM5396HyN2fvAr1zHiv4ufnCQZ5CN45jV+6lgzDdp54c9mWctEtHfybibC2xvh8fhKbcYe2plD4ItSDgH4MKIOVZgmQpPt1hrPLVWvywNfgjDW9N98Y0inApKy3OR7drPoTftiyT5SuT+WZCx/GDgu1JQetEWVQUM7fINBtbtAj+w+KX95uBArXYR8PGy8QvqmwGydxM6Sx/znE3Z+hsmFXYC4c8ftSLXffLWnTMEEoZE/46OxxfJNyP+EoL3dGdm5UOM+VcNBeNNWHqj9oHH2cF9+m6LH/PhuAjcZVsEz2zr6/jujBiplyvdXUshpxj4/duy3Nq0SRG87X22jhFrID9ZxOsRHOCgFfmrsrRcJlv/ulT2sXXZzafDlnjxrDLLNVJbAlor1UldxJ86orVjZ0Ug41OmXFb1xjySR67FouUAj3a2LYyKF6lufKSH3mtGmaJq1a X-MS-Exchange-AntiSpam-MessageData-1: NT/M4Q7cvo+F0TmaBpa5UezWmh8+RoAX3z0= X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: 963f1bed-1e8b-41f2-7d5c-08defee6514b X-MS-Exchange-CrossTenant-AuthSource: GV1P189MB2954.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Aug 2026 18:10:29.4368 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: t1JQ/brsSg2uerHepbtnJWAMhdUiAc+2i6CgTHvabO+ZdRpZEBpfIH5h9tXjlKTTt6WNaRvEwb+sVCkAy0YXK5UNzlOll77n8+d+4IRaVQw= X-MS-Exchange-Transport-CrossTenantHeadersStamped: PA1P189MB2702 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 20 Aug 2026 18:10:38 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243876 Backport CPython commit 3364e7e62fa24d0e19133fb0f90b1c24ef1110c5: gh-146207: Add support for OpenSSL 4.0.0 alpha1 (#146217) OpenSSL 4.0.0 alpha1 removed these functions: * SSLv3_method() * TLSv1_method() * TLSv1_1_method() * TLSv1_2_method() Other changes: * Update test_openssl_version(). * Update multissltests.py for OpenSSL 4. * Add const qualifier to fix compiler warnings. Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com> Upstream-Status: Backport [https://github.com/python/cpython/commit/3364e7e62fa24d0e19133fb0f90b1c24ef1110c5] Signed-off-by: Jaipaul Cheernam --- ...146207-Add-support-for-OpenSSL-4.0.0.patch | 257 ++++++++++++++++++ .../recipes-devtools/python/python3_3.14.7.bb | 1 + 2 files changed, 258 insertions(+) create mode 100644 meta/recipes-devtools/python/python3/0001-gh-146207-Add-support-for-OpenSSL-4.0.0.patch diff --git a/meta/recipes-devtools/python/python3/0001-gh-146207-Add-support-for-OpenSSL-4.0.0.patch b/meta/recipes-devtools/python/python3/0001-gh-146207-Add-support-for-OpenSSL-4.0.0.patch new file mode 100644 index 0000000000..bef6044358 --- /dev/null +++ b/meta/recipes-devtools/python/python3/0001-gh-146207-Add-support-for-OpenSSL-4.0.0.patch @@ -0,0 +1,257 @@ +From 3364e7e62fa24d0e19133fb0f90b1c24ef1110c5 Mon Sep 17 00:00:00 2001 +From: Victor Stinner +Date: Wed, 25 Mar 2026 07:44:47 +0100 +Subject: [PATCH] gh-146207: Add support for OpenSSL 4.0.0 alpha1 (#146217) + +OpenSSL 4.0.0 alpha1 removed these functions: + +* SSLv3_method() +* TLSv1_method() +* TLSv1_1_method() +* TLSv1_2_method() + +Other changes: + +* Update test_openssl_version(). +* Update multissltests.py for OpenSSL 4. +* Add const qualifier to fix compiler warnings. + +Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com> +Signed-off-by: Victor Stinner + +Upstream-Status: Backport [https://github.com/python/cpython/commit/3364e7e62fa24d0e19133fb0f90b1c24ef1110c5] +Signed-off-by: Jaipaul Cheernam +--- + Lib/test/test_ssl.py | 52 ++++++++++++++++++++------------------ + Modules/_ssl.c | 27 ++++++++++++++++---- + Modules/_ssl/cert.c | 3 ++- + Tools/ssl/multissltests.py | 7 ++++- + 4 files changed, 58 insertions(+), 31 deletions(-) + +diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py +index dc795c6bd8a..61355927296 100644 +--- a/Lib/test/test_ssl.py ++++ b/Lib/test/test_ssl.py +@@ -395,7 +395,7 @@ def test_constants(self): + ssl.OP_NO_COMPRESSION + self.assertEqual(ssl.HAS_SNI, True) + self.assertEqual(ssl.HAS_ECDH, True) +- self.assertEqual(ssl.HAS_TLSv1_2, True) ++ self.assertIsInstance(ssl.HAS_TLSv1_2, bool) + self.assertEqual(ssl.HAS_TLSv1_3, True) + ssl.OP_NO_SSLv2 + ssl.OP_NO_SSLv3 +@@ -586,11 +586,11 @@ def test_openssl_version(self): + # Some sanity checks follow + # >= 1.1.1 + self.assertGreaterEqual(n, 0x10101000) +- # < 4.0 +- self.assertLess(n, 0x40000000) ++ # < 5.0 ++ self.assertLess(n, 0x50000000) + major, minor, fix, patch, status = t + self.assertGreaterEqual(major, 1) +- self.assertLess(major, 4) ++ self.assertLess(major, 5) + self.assertGreaterEqual(minor, 0) + self.assertLess(minor, 256) + self.assertGreaterEqual(fix, 0) +@@ -656,12 +656,14 @@ def test_openssl111_deprecations(self): + ssl.OP_NO_TLSv1_2, + ssl.OP_NO_TLSv1_3 + ] +- protocols = [ +- ssl.PROTOCOL_TLSv1, +- ssl.PROTOCOL_TLSv1_1, +- ssl.PROTOCOL_TLSv1_2, +- ssl.PROTOCOL_TLS +- ] ++ protocols = [] ++ if hasattr(ssl, 'PROTOCOL_TLSv1'): ++ protocols.append(ssl.PROTOCOL_TLSv1) ++ if hasattr(ssl, 'PROTOCOL_TLSv1_1'): ++ protocols.append(ssl.PROTOCOL_TLSv1_1) ++ if hasattr(ssl, 'PROTOCOL_TLSv1_2'): ++ protocols.append(ssl.PROTOCOL_TLSv1_2) ++ protocols.append(ssl.PROTOCOL_TLS) + versions = [ + ssl.TLSVersion.SSLv3, + ssl.TLSVersion.TLSv1, +@@ -1205,6 +1207,7 @@ def test_min_max_version(self): + ssl.TLSVersion.TLSv1, + ssl.TLSVersion.TLSv1_1, + ssl.TLSVersion.TLSv1_2, ++ ssl.TLSVersion.TLSv1_3, + ssl.TLSVersion.SSLv3, + } + ) +@@ -1218,7 +1221,7 @@ def test_min_max_version(self): + with self.assertRaises(ValueError): + ctx.minimum_version = 42 + +- if has_tls_protocol(ssl.PROTOCOL_TLSv1_1): ++ if has_tls_protocol('PROTOCOL_TLSv1_1'): + ctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1_1) + + self.assertIn( +@@ -1675,23 +1678,24 @@ def test__create_stdlib_context(self): + self.assertFalse(ctx.check_hostname) + self._assert_context_options(ctx) + +- if has_tls_protocol(ssl.PROTOCOL_TLSv1): ++ if has_tls_protocol('PROTOCOL_TLSv1'): + with warnings_helper.check_warnings(): + ctx = ssl._create_stdlib_context(ssl.PROTOCOL_TLSv1) + self.assertEqual(ctx.protocol, ssl.PROTOCOL_TLSv1) + self.assertEqual(ctx.verify_mode, ssl.CERT_NONE) + self._assert_context_options(ctx) + +- with warnings_helper.check_warnings(): +- ctx = ssl._create_stdlib_context( +- ssl.PROTOCOL_TLSv1_2, +- cert_reqs=ssl.CERT_REQUIRED, +- check_hostname=True +- ) +- self.assertEqual(ctx.protocol, ssl.PROTOCOL_TLSv1_2) +- self.assertEqual(ctx.verify_mode, ssl.CERT_REQUIRED) +- self.assertTrue(ctx.check_hostname) +- self._assert_context_options(ctx) ++ if has_tls_protocol('PROTOCOL_TLSv1_2'): ++ with warnings_helper.check_warnings(): ++ ctx = ssl._create_stdlib_context( ++ ssl.PROTOCOL_TLSv1_2, ++ cert_reqs=ssl.CERT_REQUIRED, ++ check_hostname=True ++ ) ++ self.assertEqual(ctx.protocol, ssl.PROTOCOL_TLSv1_2) ++ self.assertEqual(ctx.verify_mode, ssl.CERT_REQUIRED) ++ self.assertTrue(ctx.check_hostname) ++ self._assert_context_options(ctx) + + ctx = ssl._create_stdlib_context(purpose=ssl.Purpose.CLIENT_AUTH) + self.assertEqual(ctx.protocol, ssl.PROTOCOL_TLS_SERVER) +@@ -3654,10 +3658,10 @@ def test_protocol_tlsv1_2(self): + client_options=ssl.OP_NO_TLSv1_2) + + try_protocol_combo(ssl.PROTOCOL_TLS, ssl.PROTOCOL_TLSv1_2, 'TLSv1.2') +- if has_tls_protocol(ssl.PROTOCOL_TLSv1): ++ if has_tls_protocol('PROTOCOL_TLSv1'): + try_protocol_combo(ssl.PROTOCOL_TLSv1_2, ssl.PROTOCOL_TLSv1, False) + try_protocol_combo(ssl.PROTOCOL_TLSv1, ssl.PROTOCOL_TLSv1_2, False) +- if has_tls_protocol(ssl.PROTOCOL_TLSv1_1): ++ if has_tls_protocol('PROTOCOL_TLSv1_1'): + try_protocol_combo(ssl.PROTOCOL_TLSv1_2, ssl.PROTOCOL_TLSv1_1, False) + try_protocol_combo(ssl.PROTOCOL_TLSv1_1, ssl.PROTOCOL_TLSv1_2, False) + +diff --git a/Modules/_ssl.c b/Modules/_ssl.c +index b45295b4c0c..6f75af86113 100644 +--- a/Modules/_ssl.c ++++ b/Modules/_ssl.c +@@ -164,6 +164,17 @@ static void _PySSLFixErrno(void) { + #error Unsupported OpenSSL version + #endif + ++#if (OPENSSL_VERSION_NUMBER >= 0x40000000L) ++# define OPENSSL_NO_SSL3 ++# define OPENSSL_NO_TLS1 ++# define OPENSSL_NO_TLS1_1 ++# define OPENSSL_NO_TLS1_2 ++# define OPENSSL_NO_SSL3_METHOD ++# define OPENSSL_NO_TLS1_METHOD ++# define OPENSSL_NO_TLS1_1_METHOD ++# define OPENSSL_NO_TLS1_2_METHOD ++#endif ++ + /* OpenSSL API 1.1.0+ does not include version methods */ + #ifndef OPENSSL_NO_SSL3_METHOD + extern const SSL_METHOD *SSLv3_method(void); +@@ -1151,7 +1162,7 @@ _asn1obj2py(_sslmodulestate *state, const ASN1_OBJECT *name, int no_name) + + static PyObject * + _create_tuple_for_attribute(_sslmodulestate *state, +- ASN1_OBJECT *name, ASN1_STRING *value) ++ const ASN1_OBJECT *name, const ASN1_STRING *value) + { + Py_ssize_t buflen; + PyObject *pyattr; +@@ -1180,16 +1191,16 @@ _create_tuple_for_attribute(_sslmodulestate *state, + } + + static PyObject * +-_create_tuple_for_X509_NAME (_sslmodulestate *state, X509_NAME *xname) ++_create_tuple_for_X509_NAME(_sslmodulestate *state, const X509_NAME *xname) + { + PyObject *dn = NULL; /* tuple which represents the "distinguished name" */ + PyObject *rdn = NULL; /* tuple to hold a "relative distinguished name" */ + PyObject *rdnt; + PyObject *attr = NULL; /* tuple to hold an attribute */ + int entry_count = X509_NAME_entry_count(xname); +- X509_NAME_ENTRY *entry; +- ASN1_OBJECT *name; +- ASN1_STRING *value; ++ const X509_NAME_ENTRY *entry; ++ const ASN1_OBJECT *name; ++ const ASN1_STRING *value; + int index_counter; + int rdn_level = -1; + int retcode; +@@ -6967,9 +6978,15 @@ sslmodule_init_constants(PyObject *m) + ADD_INT_CONST("PROTOCOL_TLS", PY_SSL_VERSION_TLS); + ADD_INT_CONST("PROTOCOL_TLS_CLIENT", PY_SSL_VERSION_TLS_CLIENT); + ADD_INT_CONST("PROTOCOL_TLS_SERVER", PY_SSL_VERSION_TLS_SERVER); ++#ifndef OPENSSL_NO_TLS1 + ADD_INT_CONST("PROTOCOL_TLSv1", PY_SSL_VERSION_TLS1); ++#endif ++#ifndef OPENSSL_NO_TLS1_1 + ADD_INT_CONST("PROTOCOL_TLSv1_1", PY_SSL_VERSION_TLS1_1); ++#endif ++#ifndef OPENSSL_NO_TLS1_2 + ADD_INT_CONST("PROTOCOL_TLSv1_2", PY_SSL_VERSION_TLS1_2); ++#endif + + #define ADD_OPTION(NAME, VALUE) if (sslmodule_add_option(m, NAME, (VALUE)) < 0) return -1 + +diff --git a/Modules/_ssl/cert.c b/Modules/_ssl/cert.c +index f2e7be89668..061b0fb3171 100644 +--- a/Modules/_ssl/cert.c ++++ b/Modules/_ssl/cert.c +@@ -128,7 +128,8 @@ _ssl_Certificate_get_info_impl(PySSLCertificate *self) + } + + static PyObject* +-_x509name_print(_sslmodulestate *state, X509_NAME *name, int indent, unsigned long flags) ++_x509name_print(_sslmodulestate *state, const X509_NAME *name, ++ int indent, unsigned long flags) + { + PyObject *res; + BIO *biobuf; +diff --git a/Tools/ssl/multissltests.py b/Tools/ssl/multissltests.py +index 3b4507c6771..48207e5330f 100755 +--- a/Tools/ssl/multissltests.py ++++ b/Tools/ssl/multissltests.py +@@ -429,9 +429,11 @@ def _post_install(self): + def _post_install(self): + if self.version.startswith("3."): + self._post_install_3xx() ++ elif self.version.startswith("4."): ++ self._post_install_4xx() + + def _build_src(self, config_args=()): +- if self.version.startswith("3."): ++ if self.version.startswith(("3.", "4.")): + config_args += ("enable-fips",) + super()._build_src(config_args) + +@@ -447,6 +449,9 @@ def _post_install_3xx(self): + lib64 = self.lib_dir + "64" + os.symlink(lib64, self.lib_dir) + ++ def _post_install_4xx(self): ++ self._post_install_3xx() ++ + @property + def short_version(self): + """Short version for OpenSSL download URL""" +-- +2.25.1 + diff --git a/meta/recipes-devtools/python/python3_3.14.7.bb b/meta/recipes-devtools/python/python3_3.14.7.bb index 53a9ca59b5..18afbc3d2e 100644 --- a/meta/recipes-devtools/python/python3_3.14.7.bb +++ b/meta/recipes-devtools/python/python3_3.14.7.bb @@ -22,6 +22,7 @@ SRC_URI = "http://www.python.org/ftp/python/${PV}/Python-${PV}.tar.xz \ file://0001-Avoid-shebang-overflow-on-python-config.py.patch \ file://0001-Update-test_sysconfig-for-posix_user-purelib.patch \ file://0001-prefer-valid-entrypoints.patch \ + file://0001-gh-146207-Add-support-for-OpenSSL-4.0.0.patch \ " SRC_URI:append:class-native = " \ file://0001-Lib-sysconfig.py-use-prefix-value-from-build-configu.patch \ From patchwork Thu Aug 20 18:10:19 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jaipaul Cheernam X-Patchwork-Id: 95937 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 289EDC5DF8A for ; Thu, 20 Aug 2026 18:10:40 +0000 (UTC) Received: from OSPPR02CU001.outbound.protection.outlook.com (OSPPR02CU001.outbound.protection.outlook.com [40.107.159.25]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.165.1787249429774855731 for ; Thu, 20 Aug 2026 11:10:32 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=NkhVWfn9; spf=pass (domain: est.tech, ip: 40.107.159.25, mailfrom: jaipaul.cheernam@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=urh1y5pu9p52ayDpx+WZHqDKvSYMMLsE0pW0e5TXInshy3xEmqfIRbRDeSl5i82iLlRCnoFkusvU80SmyHo/cn3m7OyerjGt2iHdj5WGIQ/529gIe3eRA+a5O2be+ZBEupydMmxyzcaVjTlvRazLH7fXb6m8/QMyWb2oMxixG0Z7O5AlugG8t6M1OIlISDYblbKE8m5ZET3/E6rk4h71KM+20wIZSgASKLujVFwPVS/OO+K5TGrii51is81d/vELiA227CkU7p+oXt7acTcpCcl6xzH7uCoXJ1jJ6lZ9SjzVMGqtdGueAHfk6glZRckfq5hBoCWNk/TUvk9hpxMDjw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=Onvm+2HAwGnVCooubyR2xkNHb2NYahWb0ZNHGt/iZuo=; b=Ln9428jnF+NI+dGUYAhNnuoj7/B3Wd851YFbJnmzjE+dRDv0kKpgrgqxTPHo5j2mqJnctLkbiYioMDO+DbUzMc6785h1YP669xWSWC1eZ90akY1Yo63lTmmQC53DO6Fmt2RHKuY4v7PK4F5uyW4deHsewldlBeKtMtRybDu10sU8e+i9i6Bh1Bae7uBkQmv9Tvaji4O8Qu4fK4bDWk8Dz4Ac3kr6cNWn+NCGoNjEO9Dk7TMS2/xEQ+0TlaYXtkK8KZxez5aPzGpB+sS+/VhEu1yEcfXMeWmfqPgGSafzdIZNjsbNytcJaUOOpGBs9paO1nChPDemIloe7G0VjvbngA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Onvm+2HAwGnVCooubyR2xkNHb2NYahWb0ZNHGt/iZuo=; b=NkhVWfn9wWJ3K4rthAaT0pS7V0MjtFNk+TG/8a5BzZbZaGGW5hM9R6FuIqFxhGbl7YWl5yBXOKHk44ebcVVHbK+0DMEr4pjb1C1O7ZKgvHzaOgnUdyPqLbdmGIhAzeUWo/S68Jup+5cCMpUfIpbdC/UE8gj7VGa7PZvOi8Vn8DdtrmrnQUefvRMOqtz92q2TP+z1Zu7FCX6ooRtE+LMroZ3e2gYvRspK86Y1MMa8vZO+dxt16Zp2kR5loc7qoJmAdZlUZQWVe71RVizaMD/pZRdGk2KQa9XVDosgvhWU6sulExjdg4PHqEyqxnE2jYoW1Uv36wj9joZGHLEWWZ262A== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from GV1P189MB2954.EURP189.PROD.OUTLOOK.COM (2603:10a6:150:263::18) by PA1P189MB2702.EURP189.PROD.OUTLOOK.COM (2603:10a6:102:452::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.339.8; Thu, 20 Aug 2026 18:10:31 +0000 Received: from GV1P189MB2954.EURP189.PROD.OUTLOOK.COM ([fe80::a7e4:7d5b:ab4a:4b96]) by GV1P189MB2954.EURP189.PROD.OUTLOOK.COM ([fe80::a7e4:7d5b:ab4a:4b96%4]) with mapi id 15.21.0360.003; Thu, 20 Aug 2026 18:10:31 +0000 From: Jaipaul Cheernam To: openembedded-core@lists.openembedded.org Subject: [RFC v2 3/6] socat: fix build with OpenSSL 4.0 Date: Thu, 20 Aug 2026 20:10:19 +0200 Message-ID: <20260820181022.44434-4-jaipaul.cheernam@est.tech> X-Mailer: git-send-email 2.39.5 (Apple Git-154) In-Reply-To: <20260820181022.44434-1-jaipaul.cheernam@est.tech> References: <20260814051829.35088-1-jaipaul.cheernam@est.tech> <20260820181022.44434-1-jaipaul.cheernam@est.tech> X-ClientProxiedBy: DU7P189CA0005.EURP189.PROD.OUTLOOK.COM (2603:10a6:10:552::8) To GV1P189MB2954.EURP189.PROD.OUTLOOK.COM (2603:10a6:150:263::18) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: GV1P189MB2954:EE_|PA1P189MB2702:EE_ X-MS-Office365-Filtering-Correlation-Id: ef2415b9-10f2-494f-0840-08defee65243 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|366016|10070799003|23010399003|1800799024|376014|10067099003|56012099006|6133799003|12006099003|11063799006|22082099003|18002099003|4143699003; X-Microsoft-Antispam-Message-Info: s0uDpbBdcJZd8iz1pD4t9OMZMIPYAggDOYBfycmmkO/NMkvl4XiTfA7DkS/9C1imeR+Vm7Ys2rJkPVlg//NtmJhlLo49LS0DMpAYKsgqLwuHCYtemxLvnwulbfNuOWVtQKgaTXusOibLF6ebBwVLMyCuwAStXwLNE2EAx1efBIqg4cWhFt3p0sPtNpWRpPeWCZbQfg9RyCFTueLj5113JYdzzEEVZNqoPPsWjwKlcKCWngARqMIZsxOjrtPliJOIgEwNolbMCQGnSJiekjGj+WbS/zmaM5ivddvzCkFQOil+u4qz+ny60byrY1yG7Yzi4sqSeYiN/m0RVRgtG8B6EbuhcCwcymQvKG11LSZehiky8r5HcVXCJD0dN/frqxL3jyFQnUE8sLuCXQtCdeib0qpblYibCm3dhVQ6/VTWawhvWbSWmAb0jFCkbnCOyqiZpXPNvhiEnNJOVsMYdsX+m6xqbjFi0CnaxWwxZxXurG9BLIlHeNVIqPuS7oqTnYWjUO8uowYn84uvf3vnQH+LlnUD5Pb/+iSVnnvovFM21ukNOz6EKlaGh8dIPwDJiJdqWUt55RAjTwC73k/VhzRr9Pr7nqSVsDRzMvEpGQhc1s3WYCCJsAJux7eHb0chVWP+3VR61Vm+3X2arMSGPTtyJzNGBh5ib3CEicjugl6f41g= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:GV1P189MB2954.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(366016)(10070799003)(23010399003)(1800799024)(376014)(10067099003)(56012099006)(6133799003)(12006099003)(11063799006)(22082099003)(18002099003)(4143699003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 2 X-MS-Exchange-AntiSpam-MessageData-0: qrLplwprlvYErnSuVUjFVF/OqPFV/ye6icRHqoS83ZpdVi5hI2Ndj8iab1GZmLcs5XHWs/NWmfgSLLCpj0MnMPq/nQb+ybML03sn5CTJA+V3o1n4A3y4UakfrBBw1vJIV4W21iwzrkJc6H7vXkp1R3oyF3qlO+9/b0Kbou4eCMh0haE3Apup/QKOwjwifbIXJ1N3LaHhH/RWUfSOVgRk+ZJX0aUFXVxv63X1HxnLysQ742vBMgUlSBYWylGwlgW5PToRTUrsbLRv8oONhF33e9LjRX6TW7WJgCXJKpFu8Tl1+LdnALp+dQdf0Xbe0b+srSdmurMkt3l38uU/zB5ALN2Fo8vZ6oBexeHBNhgXQY7A1pmC6aonYNRzAcmDZcrTodS6D+PmNwPsTsFpoEWc1IEjL1HVoonQwvKXdR7soD/IZabavGOHWrUVeFYUDOL8faj9pNjZKZporuuYmpwWq/A3yzn7T5gmPWO7GsMHo0fQk54vk4T5YFEHMrXhWIV59UNRceVYgkB5zeqlC/Gy8+S8E6blUVvC1W6sPJQeszPY+9YTg6WtHxefAjbQ+w1c6xvzKBtlXm47+D7Wqef8+LE6jR/gQRH/7/sYcsIxSxRpRCibwHjD1zKGmC+ZffPY7dJqSAQC/hyFDhStJueqLCv6AlpTFtoIk4Lqn3XwG5hTDPjVxsbkyhwge892Wn89GNwwEwJohgn48fbVoYLP/oIfaGwKYD+Qb62dvL3tvSKXHE8O6PLjJghAFtuPRj+qZJnZSfIi/IvE8p/cY4Mrup6jkWDOhyF/955XpySFW6N8/9eZ2lQK6EjGi9IJDUxvA78fFOChKmK+LGoJ46+jgUCVapLWlR5Y911Ja+mXQbJk5qocD4zVd6vixM1ejxxFQjs2XA/KahAfcFc3+hjD/SMjidhGRNDaZvfKRZ3/cuda1F2mhAOx9CXicflvRMrTJZc4p4b4ORQMpWRTdNcCVpHRRdvxM6Z+tlRhFlrhanOVWsPI/FBE3j4Tc27xsJkbcHu5JXhjkQQFF5D0uDerlkC7Wfl4VMPTs0U1hNkh1AVwOrBv+AnX3XifsrY2kJFlouA9FK4I2hGzbcpa/KeLfVa56CERaGCcdSNFIX/Z4UYTeklXC0Qsin7ssDSee9AOyEeCjBLuaCumkF/CK269C8R59Rok5eoTDc6JnQIKGVBmGpUmIUbjNNPFMBqEXUsb4TiaW7cCUFevart6Q8kCuvnOaOKypGmy38XuXZYZMYAe2m0I0m0RG6b4+FtTlFymwpg3wG3zXhxNVcrNgGcmOOH5SmPyxw3OoxuLy3QFDcY3d4tb90EK7YFXNrf1sirLqEhPyHNjPH/8Apm3SwMD7/LTWsoCi1y6O00LgMvvl89PiUzvRzsRDVZZpG4Ze7NS72ssbFduJAKwUgerARv9GjQtLSjAODpaw4ljH4MmoIOT7W7ntPQ9EWxf3yFYDHfngb9handPiO81ealqG9Yf8q8yVQGEceezuK/EBZjhtiDzYElfKnLHnYdn0oR1x/A2ouNuTpPQisO5nieGl5ykeuFwPDqKV1AgeW+xYq5/1LcWq/k0V6mFmeoY4Wn1ANEbPoNyy42HxkN/huIRnaat4mRWaCK14NI/8IXBDfNbJb9iph3fI9+Lr8mg3IcsPL52PsKBf9rFoWiQFB5fk463mDFscYgEG3YyZYxim+hy/ebKkG0+UBWyn+xjQgdT/rZsjOZmsl+HOgIa+eym40JwHP0AZrl6Fue9km0qf9fbQqoNndXKwmAdDelYm54nsKWhvfX+u5ak X-MS-Exchange-AntiSpam-MessageData-1: 1+7Bmz1AFPpe5gXclxqtK27lz+xPD8Ig3sc= X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: ef2415b9-10f2-494f-0840-08defee65243 X-MS-Exchange-CrossTenant-AuthSource: GV1P189MB2954.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Aug 2026 18:10:31.0473 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: z5VWHVDgYsxPa3kiu6wXZp+XrTWkjbtpyr3FW82RImEo5kqEJziiYvrSa8egxAuBZKRwH6LFDO7r3Va9pDUczsWDcMHPs6hDl3YPsqNbbQE= X-MS-Exchange-Transport-CrossTenantHeadersStamped: PA1P189MB2702 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 20 Aug 2026 18:10:40 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243877 OpenSSL 4.0 made ASN1_STRING opaque. socat directly accesses pName->d.iPAddress->data and pName->d.iPAddress->length which is no longer allowed. Use ASN1_STRING_get0_data() and ASN1_STRING_length() accessor functions instead. These have been available since OpenSSL 1.1.0 so this is backward compatible. Upstream-Status: Submitted [socat@dest-unreach.org] Signed-off-by: Jaipaul Cheernam --- ...penSSL-4.0-use-ASN1_STRING-accessors.patch | 31 +++++++++++++++++++ .../socat/socat_1.8.1.3.bb | 1 + 2 files changed, 32 insertions(+) create mode 100644 meta/recipes-connectivity/socat/files/0001-Fix-build-with-OpenSSL-4.0-use-ASN1_STRING-accessors.patch diff --git a/meta/recipes-connectivity/socat/files/0001-Fix-build-with-OpenSSL-4.0-use-ASN1_STRING-accessors.patch b/meta/recipes-connectivity/socat/files/0001-Fix-build-with-OpenSSL-4.0-use-ASN1_STRING-accessors.patch new file mode 100644 index 0000000000..5e021d66c5 --- /dev/null +++ b/meta/recipes-connectivity/socat/files/0001-Fix-build-with-OpenSSL-4.0-use-ASN1_STRING-accessors.patch @@ -0,0 +1,31 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Jaipaul Cheernam +Date: Thu, 13 Aug 2026 07:00:00 +0000 +Subject: [PATCH] Fix build with OpenSSL 4.0: use ASN1_STRING accessors + +OpenSSL 4.0 made ASN1_STRING opaque. Direct access to struct members +(->data, ->length) is no longer possible. Use the accessor functions +ASN1_STRING_get0_data() and ASN1_STRING_length() instead. + +These accessors have been available since OpenSSL 1.1.0, so this change +is backward compatible. + +Upstream-Status: Submitted [socat@dest-unreach.org] +Signed-off-by: Jaipaul Cheernam +--- + xio-openssl.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/xio-openssl.c ++++ b/xio-openssl.c +@@ -1898,8 +1898,8 @@ + case GEN_IPADD: + { + /* binary address format */ +- const unsigned char *data = pName->d.iPAddress->data; +- size_t len = pName->d.iPAddress->length; ++ const unsigned char *data = ASN1_STRING_get0_data(pName->d.iPAddress); ++ size_t len = ASN1_STRING_length(pName->d.iPAddress); + char aBuffer[INET6_ADDRSTRLEN]; /* canonical peername */ + struct in6_addr ip6bin; + diff --git a/meta/recipes-connectivity/socat/socat_1.8.1.3.bb b/meta/recipes-connectivity/socat/socat_1.8.1.3.bb index e485c7d28d..025b478392 100644 --- a/meta/recipes-connectivity/socat/socat_1.8.1.3.bb +++ b/meta/recipes-connectivity/socat/socat_1.8.1.3.bb @@ -12,6 +12,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263 \ SRC_URI = "http://www.dest-unreach.org/socat/download/socat-${PV}.tar.bz2 \ file://0001-fix-compile-procan.c-failed.patch \ + file://0001-Fix-build-with-OpenSSL-4.0-use-ASN1_STRING-accessors.patch \ " SRC_URI[sha256sum] = "25bc6476292b2e614220989c77b0b6fca87bb2525d9747b31a6639b1fb602418" From patchwork Thu Aug 20 18:10:20 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jaipaul Cheernam X-Patchwork-Id: 95934 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0BDECC5DF81 for ; Thu, 20 Aug 2026 18:10:37 +0000 (UTC) Received: from OSPPR02CU001.outbound.protection.outlook.com (OSPPR02CU001.outbound.protection.outlook.com [40.107.159.15]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.156.1787249436068673416 for ; Thu, 20 Aug 2026 11:10:36 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=GNcgps+V; spf=pass (domain: est.tech, ip: 40.107.159.15, mailfrom: jaipaul.cheernam@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=XppmqcSI7bX1nb7YNrSI3mBp2RmAiSwRBN5VUCJdGG/NV5EN5WpKySdaHpqiOn0xmmGZ9HqsfIkLEts++xkjvuh2kSVLvG5r3I1rrdA2qJnm7jQ/niT8IqVLsrHN6HSvI2SfWQcY7CJCvxe4qmYWGspxMAU7TTzShyl9TejQc/j5GOXs2CWGmYkCWh/GciV0pE571kRZX4p9hBKbFC8+XLINmxjo2mXq4r+F1a+22f1uWGSQ3fuiKtKZQnFJ6uOSsuV+G/rKIYriXkGMUKfgmDvrUoQqvHRbkc31h7bCRbHevZpVfyxYhoRiqYLOy8/8ofYc7ZPVfGfKNTTx0sHGwg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=VnpQqhiTijQD2viIb0eklZ9CPeDOsOv5Wm0kLohqvzY=; b=LnevE/sxCnjcmsff9oSN0jBtIvuhkEvZNvdHRlv2oD1tYoRTxAPQeapp0Yryy1YRCyVoxhrnG39pv29naFG7yCJxE5Yb/Y1RVdyHQ10zZqEMmrN9+6jjvKoqM0Teu4QeqVaLIZBDoR1InRe+cA8zyl4U+Hbkid0ZD96UssZ8fCjPZMIHkwi68yrrppfLGpMTfeQAFG882loORErM1BPbiQoP33vTdPksTB9HGFAa6wP2MKzKnp1lnGVw8D0Z6Jd6n/tPFBF0NH22CP0vr5fk/DPt7ediosKUnWL3mwGrsbBy6+ZDGo3j7TQ5jEkzgjGNaSPD0XfseFJZ9tHjYOF6sw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=VnpQqhiTijQD2viIb0eklZ9CPeDOsOv5Wm0kLohqvzY=; b=GNcgps+V58zwWXug71+VJ9h+C6wVeIv/XVIv+72slfFXVLnxR2iHkx8UNLalGT+bX5VGWv1azOuJ9Wj1J1W6Tv6EbIEK5eJaIZwElxIg508Z42cjlwJjpwUbehM30hNteH6wZgTfeTrmiYjSdqoXLNTQGGy8OWnvka0vD0TW1r2uO0s6qEmbx5Lad9h8uQIFJG8EP/ncUrFkXJ2OKGRyu/a+osWMmAuyzJlTMP/bkTWkSqv8ABdWCAJun8EaUemEXSolSDjXIN56gDPZY2bfSAMrzDL0LwpGrH5As8bUuMI7uhf5CMryW8U2wOkdtAE1mwKCOM8SMY0O19KMPzuNvg== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from GV1P189MB2954.EURP189.PROD.OUTLOOK.COM (2603:10a6:150:263::18) by PA1P189MB2702.EURP189.PROD.OUTLOOK.COM (2603:10a6:102:452::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.339.8; Thu, 20 Aug 2026 18:10:33 +0000 Received: from GV1P189MB2954.EURP189.PROD.OUTLOOK.COM ([fe80::a7e4:7d5b:ab4a:4b96]) by GV1P189MB2954.EURP189.PROD.OUTLOOK.COM ([fe80::a7e4:7d5b:ab4a:4b96%4]) with mapi id 15.21.0360.003; Thu, 20 Aug 2026 18:10:33 +0000 From: Jaipaul Cheernam To: openembedded-core@lists.openembedded.org Subject: [RFC v2 4/6] serf: fix build with OpenSSL 4.0 Date: Thu, 20 Aug 2026 20:10:20 +0200 Message-ID: <20260820181022.44434-5-jaipaul.cheernam@est.tech> X-Mailer: git-send-email 2.39.5 (Apple Git-154) In-Reply-To: <20260820181022.44434-1-jaipaul.cheernam@est.tech> References: <20260814051829.35088-1-jaipaul.cheernam@est.tech> <20260820181022.44434-1-jaipaul.cheernam@est.tech> X-ClientProxiedBy: DU2PR04CA0019.eurprd04.prod.outlook.com (2603:10a6:10:3b::24) To GV1P189MB2954.EURP189.PROD.OUTLOOK.COM (2603:10a6:150:263::18) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: GV1P189MB2954:EE_|PA1P189MB2702:EE_ X-MS-Office365-Filtering-Correlation-Id: 2a150a20-f4df-496c-315b-08defee653c3 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|366016|10070799003|23010399003|1800799024|376014|10067099003|56012099006|6133799003|11063799006|22082099003|18002099003|13003099007|4143699003; X-Microsoft-Antispam-Message-Info: jPp9VjBaPX1b1ccm8mx0zKDauB6BeiiXlwgRRPZlOY3mhuK72KV6LDxXBRKLCP1zybaWWHXDoD+6rEy+6mIgV+qp0GI6cleO0tBpw/CwzdcafJMD6pRmibtDVWvN2v2h1xh1itsY9yJ56rrQuLgUNQ0VdCH4uvou9r0fEPvVOHK3wBFaD/X4JsZ21QqyE5eZsbR5YZJ0JrsEVlxjK7v+qfSWJtGY4y3Ou0ZcTIDQKCk5TZXGLyYjOR3590+RyOXCCJvG7CDC+EBp3U/yAfd8xWq10RzSgv6HBV0PmpzRUOQtKuGIEOJZwAwXelZu11jlVqvHnh5CpSSDOx4slBiQFKThbZUZ8dI20nhyNJLxrX65QSzYfI9K9ndGFNK5Yes823jCZfR00qlN8pKXx8D5q1NeM4KpsY5sVawy5Pd+XPhAUKaoUt6tLqob74Cx5l14lcQhFfbjsy5QJxIiqiw0WlmdRLziFvRcs3CvFSCHJRB1ufPup3QPHBxLDUMPrXC6aVOp5WBuFxHUkUxRBZVbFm9RDSoTWR1pNm7XRiXKV5+2cTEE6IkSxektZ9PrP5rjYS1kWWDtgdxHG62NwEvvAz8T6nzR0N9101e3WomG8ueudkfC3C6LfTYRPvqDnDB81RZ2D9VQNCcTxO3G+VN5qwo7N2eCDo2WUseJ+F5Ow7c= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:GV1P189MB2954.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(366016)(10070799003)(23010399003)(1800799024)(376014)(10067099003)(56012099006)(6133799003)(11063799006)(22082099003)(18002099003)(13003099007)(4143699003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 2 X-MS-Exchange-AntiSpam-MessageData-0: USljKbNMetNWpoAWUayBs+7hxVAc2xOV0ftLRvXVoypgUy6JazVAZY+yv3bdSXTWoD/RNQgmMzIEUwdfSXZoGBgJrLAFu8djMBq3oTWUS4XcY8VpdwOkg4DbPdvoBLAI4Sbua9YULt255i0BLCBXhNhsJpDuTo8CZzKLNt+tX2wjHYVtieiRGUP35aqo+nQyzjJIVe7jECbHueGeU4Qbd63AJI4s/PMzbonIOoU2SyeADnLbgvESrwZWyzUv4EMdOK1OBY5gr8J0htoZ+jkZhXrv6IRg53wIOuH1hJjGQbr5BF6x4kqGlgMJoC8a8cqkCWeKs32epPclTxZmrK6WcRwavbx24MmNbLWwOQzdKq6dxTZ1aZtYkQPH3NMJS3O+IyrV4EXbBEPuusRvyVpZwUJgBgcddD6BTC5xv8QqeySBDqAtUrUJr4vtVs/NmUu7hFCE8lmpILCuQnPXOOoGCZB8y14ecb5t45wu99rtSMUgn7WF1tOHedABOpSVTZ86e7nZgK1uEXaNs4GvgXv+ccRAvetVlp17lttJER2s0TJfMMbcLh5rE9mKezGPDH5ekISPIvcDxdoE1Dc/+I9PTJOlu1necfVReq9yrGVrMvbpcoIEwD9YJGoFK+ArbzcYSk6R/RqTQ07aevtGHu7f+wwtwBPIi2bIM+cEOUTaMQPTkyIojeW9FNsS3guOCnspKlm1pRFcoO8JD4AWBC6ZtT4TK/kJHjIQvqH5KLjXzptgTmkCujBS0gg4+vUOUrsF8ch2HT+Gmt6Q5FaEkN/Vas+XaEdky8XSBW0x82sP/JkcT9Dr5P1vewVfEY+BWJPo15hGbkMXAz2JHN5HwQPcVYIBR/ctSmE6iDqFBgko8wov9VklFfR0am47cupPtZ8izOZkZc5MmHNgvt34eYo2vJDAOtpx2cf0FD5S2YRXA0PVXmGOtWEsI8ulpVdJW1uYtfCvlJ0ytpKXsob0PaIL85M3WhljkxXnKm7Z6P47onS9/fnL7KSdrebOac0Lltw8vBpQ60woukjj26cTlqG8aS7t4wH/zZf5biD28D0uJHd5Ex7q2h/EIq7Gn9n3IZa4J24u8qg3REZfBKXu2GuL32XK8f+l7UxBJsSiu+qCbwxfrOt0hvDoIrUGWT+6ektiL77XxCknL5dRBI4EXc08V+Qtf5oEIF18jV+yDhjkT5ro7Ig2DGGswvC1pRgKRYkaYBf+DRintQLd2+JI8IWOJZ+v4aAH/myXLgGqSrl5NfOiCiQhHAe6d2zkL3uSUr0XyYb5UIdS8nZ7h3TW9clRum3wbiGmGdjFw60arqAB+PQ5jzU/K1ax6fLw5EmQDZiAXf932F0y9mpbktCx9vSX61EqgE3O9zVUo358ddrHpHET1OaYDkoBqGx0f930ttgNVfXySZW1DhRp5YellHPt1YB+aur9TaZOxKqNlAeNL+kpiOrdvtvBHLEi06qLv/B4VUunGf6ney2P0J8FrXSeYWpPgNBpAxIUUIhUeJwYnal/MJjmrj0KC/tDkdNF3N2gnuxlMt2HUCOqIO17NFqjIDxwaBMDF8zoqDnHPW7quzflDIZKlPSnnqss093FIGXiKGJYLShDjArji2GdR0SMzZ5n7xHdAFly2Wd38bfHJ+2+YA1Yf48HCXi7FwhmBDZnRgMMKimAXfVLspmKAtCyYLPjgXVpweY2kUqmHZRCh5rRhQSQBGz6EJuuDtqMdj+flAK95FvdX13y+RjYs/WTU/OVEMCEaZ7qWg8Sy47gfqFGlwuF9LAG/Epgb5tCKOTIDSexNS12 X-MS-Exchange-AntiSpam-MessageData-1: chXSuRbGWwObUOixzilITaorLvyP0GzHgVE= X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: 2a150a20-f4df-496c-315b-08defee653c3 X-MS-Exchange-CrossTenant-AuthSource: GV1P189MB2954.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Aug 2026 18:10:33.5792 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: iyAjQHUztvkkdWVH1XndXXTQrVwWd1z4XE0iavQR6bKKB44fqAMBB679g1wGfPRSQg4a/X09HPYf3/ItS0jbWGJDdM7ldlxu7rbJ6H+erfw= X-MS-Exchange-Transport-CrossTenantHeadersStamped: PA1P189MB2702 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 20 Aug 2026 18:10:37 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243878 OpenSSL 4.0 made ASN1_STRING opaque. serf directly accesses nm->d.ia5->data and nm->d.ia5->length which is no longer allowed. Use ASN1_STRING_get0_data() and ASN1_STRING_length() accessor functions instead. These have been available since OpenSSL 1.1.0 so this is backward compatible. The fix is already in serf trunk (r1935023) but no new release has been made. Upstream-Status: Backport [https://svn.apache.org/repos/asf/serf/trunk r1935023] Signed-off-by: Jaipaul Cheernam --- ...penSSL-4.0-use-ASN1_STRING-accessors.patch | 35 +++++++++++++++++++ meta/recipes-support/serf/serf_1.3.10.bb | 1 + 2 files changed, 36 insertions(+) create mode 100644 meta/recipes-support/serf/serf/0001-Fix-build-with-OpenSSL-4.0-use-ASN1_STRING-accessors.patch diff --git a/meta/recipes-support/serf/serf/0001-Fix-build-with-OpenSSL-4.0-use-ASN1_STRING-accessors.patch b/meta/recipes-support/serf/serf/0001-Fix-build-with-OpenSSL-4.0-use-ASN1_STRING-accessors.patch new file mode 100644 index 0000000000..2392cf1dca --- /dev/null +++ b/meta/recipes-support/serf/serf/0001-Fix-build-with-OpenSSL-4.0-use-ASN1_STRING-accessors.patch @@ -0,0 +1,35 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Jaipaul Cheernam +Date: Thu, 13 Aug 2026 11:52:00 +0000 +Subject: [PATCH] Fix build with OpenSSL 4.0: use ASN1_STRING accessors + +OpenSSL 4.0 made ASN1_STRING opaque. Direct access to struct members +(->data, ->length) is no longer possible. Use the accessor functions +ASN1_STRING_get0_data() and ASN1_STRING_length() instead. + +These accessors have been available since OpenSSL 1.1.0, so this change +is backward compatible. + +Upstream-Status: Backport [https://svn.apache.org/repos/asf/serf/trunk r1935023] +Signed-off-by: Jaipaul Cheernam +--- + buckets/ssl_buckets.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/buckets/ssl_buckets.c ++++ b/buckets/ssl_buckets.c +@@ -567,11 +567,11 @@ + switch (nm->type) { + case GEN_DNS: + if (copy_action == ErrorOnNul && +- strlen(nm->d.ia5->data) != nm->d.ia5->length) ++ strlen((const char *)ASN1_STRING_get0_data(nm->d.ia5)) != (size_t)ASN1_STRING_length(nm->d.ia5)) + return SERF_ERROR_SSL_CERT_FAILED; + if (san_arr && *san_arr) +- p = pstrdup_escape_nul_bytes((const char *)nm->d.ia5->data, +- nm->d.ia5->length, ++ p = pstrdup_escape_nul_bytes((const char *)ASN1_STRING_get0_data(nm->d.ia5), ++ ASN1_STRING_length(nm->d.ia5), + pool); + break; + default: diff --git a/meta/recipes-support/serf/serf_1.3.10.bb b/meta/recipes-support/serf/serf_1.3.10.bb index c6b51452aa..fd3560876b 100644 --- a/meta/recipes-support/serf/serf_1.3.10.bb +++ b/meta/recipes-support/serf/serf_1.3.10.bb @@ -10,6 +10,7 @@ SRC_URI = "${APACHE_MIRROR}/${BPN}/${BPN}-${PV}.tar.bz2 \ file://0002-SConstruct-Fix-path-quoting-for-.def-generator.patch \ file://0003-gen_def.patch \ file://SConstruct.stop.creating.directories.without.sandbox-install.prefix.patch \ + file://0001-Fix-build-with-OpenSSL-4.0-use-ASN1_STRING-accessors.patch \ " SRC_URI[sha256sum] = "be81ef08baa2516ecda76a77adf7def7bc3227eeb578b9a33b45f7b41dc064e6" From patchwork Thu Aug 20 18:10:21 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jaipaul Cheernam X-Patchwork-Id: 95939 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7DEE2C5DF81 for ; Thu, 20 Aug 2026 18:10:50 +0000 (UTC) Received: from OSPPR02CU001.outbound.protection.outlook.com (OSPPR02CU001.outbound.protection.outlook.com [40.107.159.51]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.157.1787249440652542094 for ; Thu, 20 Aug 2026 11:10:41 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=mtzSQtXa; spf=pass (domain: est.tech, ip: 40.107.159.51, mailfrom: jaipaul.cheernam@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=bgo8oJVKxbrYqE+zCmb/TI1y7hGlae9JCFrYtJdJl5hoUlGV7P/nDet2JIvIcObOIgFIjNf5jQ8v/ZurnyMbIS4D+ZofevrHEHxF10/wN3LyDEmG0trnPI2Kj3ge3eL1lo3ZwHdUnLjL0IYrps1G2HQw50zGSIYgm9HMoUW+FjsqMbI3hw3wRL8SzMxc0WzujKM1dlPfw0tIFoa1aSdI+QnZe4xNL+/xFvdzKMFdtBGW6JRMklVnK48jidcXu9jdDbt2U2KDlF5wkeUnUVe6zufERT5YMcE373Jpy6KIWwsFjDUNc95z+PUiq0vTsEvuoe6nss/DoclQQIvGossjGw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=UAvuJNl/dSn1WUGlZSB7ku2l3/9u6n2BjR+vEXwU4ME=; b=seuzcs7evqG7TTgZliuWxOf25/doo3CXt0sBGtBbs4pl6kxBYUV2uAZ+4ghrxqagcPAsAPCTKeIAMT/q5On8nHhSJqwUIa2zzEBCmzDs8lUqS2/Z2xWi9PQYClVw+KIA4I5qJQv5B+X9agnV6Y/RHSqHh2+wgxDs7XuK4239H7PpsWuyG4FOhlrtKzGAENn+PijwzFMZaabwnYbWhXdoQOKXtQlvYw//irBN81aZobwzs9EqVjX5Iq787NKmzIoOTtmQ8c4cf+LA3OaibgQejsm2N/ebbVgdnJBWT6R5QjonHX/WOQEQYmumcUR6hobbJo4I9604bpIUg2U43uSCcQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=UAvuJNl/dSn1WUGlZSB7ku2l3/9u6n2BjR+vEXwU4ME=; b=mtzSQtXa7DkeR/ITh7FMm+vwCaMDvIjZ9VgnhF28855pDcitcqZI6EOxiuCAFlnbemqLY6QUBXwNdaEPSzLNFquiMNKAZMDncVYF11RwW5GfNPweylyTcbDLDjPMzQlMEnkj680JJ2sG9iWDxMFaXljPwi/uiqJrTUO9ZD4bqCyH6I3cJSNSv9yi86cxKewOh/IMMFdX8zq3Rnq+JLjNwEDBLRyMLblulox/p1ZB04BIUbA3YcrWY7xZSlnN1KieOlp+TPPhB55O/GjKLc5xWimtESx3vLosplpvJbRLm/SGCio0VKTIUbd5kzd2ltsufRDNLuRaC3cklZhYF6Ek0w== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from GV1P189MB2954.EURP189.PROD.OUTLOOK.COM (2603:10a6:150:263::18) by PA1P189MB2702.EURP189.PROD.OUTLOOK.COM (2603:10a6:102:452::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.339.8; Thu, 20 Aug 2026 18:10:37 +0000 Received: from GV1P189MB2954.EURP189.PROD.OUTLOOK.COM ([fe80::a7e4:7d5b:ab4a:4b96]) by GV1P189MB2954.EURP189.PROD.OUTLOOK.COM ([fe80::a7e4:7d5b:ab4a:4b96%4]) with mapi id 15.21.0360.003; Thu, 20 Aug 2026 18:10:37 +0000 From: Jaipaul Cheernam To: openembedded-core@lists.openembedded.org Subject: [RFC v2 5/6] u-boot: fix build with OpenSSL 4.0 Date: Thu, 20 Aug 2026 20:10:21 +0200 Message-ID: <20260820181022.44434-6-jaipaul.cheernam@est.tech> X-Mailer: git-send-email 2.39.5 (Apple Git-154) In-Reply-To: <20260820181022.44434-1-jaipaul.cheernam@est.tech> References: <20260814051829.35088-1-jaipaul.cheernam@est.tech> <20260820181022.44434-1-jaipaul.cheernam@est.tech> X-ClientProxiedBy: DUZP191CA0031.EURP191.PROD.OUTLOOK.COM (2603:10a6:10:4f8::23) To GV1P189MB2954.EURP189.PROD.OUTLOOK.COM (2603:10a6:150:263::18) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: GV1P189MB2954:EE_|PA1P189MB2702:EE_ X-MS-Office365-Filtering-Correlation-Id: ee646da0-8a29-42ce-3936-08defee6561d X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|366016|10070799003|23010399003|1800799024|376014|10067099003|56012099006|6133799003|3023799007|11063799006|22082099003|18002099003|13003099007|4143699003; X-Microsoft-Antispam-Message-Info: AwFNwu/phsbLVFfX/Bbe5uo0FIjwfaz05OQHJQOgmRONoyICs3siUOIwenPNQsHbJkoErFRzDZ/zTWbyFDQpZ6Fbi5o8oCIMeUKSuHIeRAOWseYKF6aVs3mMtt6bleovcCLZcItBTu13vi+rLI3XvR3WfBvtG86nxk9uxbXVa12a7UhZGV33s94nEjglkqF6qh6MxCPASU5ODTEVrzQhpoHwEYpazp/nC92kUSf1dZ9mhxfOIO8O9qIX+gj64HGqQMCH/24bFyyNAHwgcqKu/yjxMUNaJtApk+ITuOZKCLX3fKxrjmTzU6fvq+LGwUlPSgBTpTLI6C+392hDYDVIoLKcR/1QGLH0oNnS8wGY9ZrAFxJRJnA+LFYsBuQBdFRmAHp/nZhmGpRSkMXBFFktZ7Jwo6qwD1WWbqC5MIrAi8FGRxLJ352hlMV0gqsxstxuNyG8L9amLKv5tVj6jQH9z/FMLDlzu5Bvwq13Aj+Dg57BR/yu0Q+0GfoSkycxdUKw48KVIIB7wEc/juyRXVFp6+Ay0ILMGKrs7pmpOA7s1d6RW6M5DeCOfvAndCE8Vw6b+imX7MOqdhBlO71qqkj+RhNKKwDUJXuzL2ElZVins7rUmFFVCPzkZz/8xfGgGSG5V4mTfOokMBJ1Q/3j6/gBG9slyrNyNO6qoPCXorVu8Do= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:GV1P189MB2954.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(366016)(10070799003)(23010399003)(1800799024)(376014)(10067099003)(56012099006)(6133799003)(3023799007)(11063799006)(22082099003)(18002099003)(13003099007)(4143699003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 2 X-MS-Exchange-AntiSpam-MessageData-0: /6PSR+jXwluEmYV/2mDfuHKUxedOct0QnQ5ovLsd4k2jFosJchT8j/cBBRIF153qWy5MhZHHYoFtPnCxNNQ1XmQ2ehJOEnnoUtfFCOpGC3mZGsJY7RHwYonrSdCZrFyp10zDeJ6hZ4cEgPnDOnrU8OcvDwSuNEJOGawFwRcxzWOGQmrp7DSXXPxIY2ws4lbDmkIirK10D+JSfYMpxt9MGVIx4xjYgPX50PorDUVjR9NBOD1TnqC6CpuaeVLVtQghVqAf7GvTpA8+fIS7/PVp/Zeq68LGgYlhmDc1tH7qsIcZcxEUXRJ9PXxg+Sj+e0H1AtBHrI9jUsRTWZbz1MbPAfTHvu09YM6X166F1kNl40JaScUXoCoXbIzx0iCtLgYVR+8l5fMo8uMBxStxHQu69AqNabJPC4lZDvKoL6GGkI7VWwVjjd9KE4lPxOSQYcrXf+C7GGi87k53QjXd8bnRKxUgOyMZLnwWMWXHYZ7jy80UucQ40AYsnqJlmBUuGuCHFZZOr8MtntM67XgQwntcYu84OJcLGEG4ty7arwzReYD0aQz24TZwx6qDUtX63cypTna3MNLPAkkl/0lkmc+Wg/3OABxNxKQgRviiue2Mq41CgytN5K3SJDTxQ6C+pQ6f9vIDYA1azGHI1sS2NQXs/QdqRLn7u5je8oPo2BPdA9UkQa7aT8xQIoJK2Q9KjBsZXz98m6/GOK5H1shNy12di9BkFtCke9Sbc/ZcAnKWZMpwbxWs2k6WdmSpAxU8TpYLw8ZdXGHuKRx1Ipm028kB9RgfNCOi5pIPutwGh2/qrHTV9aO1L/u1GxoKz8QcACGBC5Ztgr21Yox5NSV797Hfl+MGhDE8DJKE9+CFL65ZyQGH3gx8sQU3ouFi3viXVEWpXXAMEqZ7XpWeSjAGRRxCz84WshjjqbkyRevZU3csyn4c3Pa4YQRdf38p2VnE6DPct2BuREzXOp4zhDW8Khn8Y3J8xd5L0HlTJyQB8hj/np2emWnRddeimW3ucltFz93ODJI9v2pIOCexr/9ewEu6XdgzD1Zrl0tTAhLw8ew1pwae36YXcQJm8ay96wiilKLiPjPdFk2yET2mv0hJB9uLqCy0loUe0HhB2umnQ//5gEQSuJXrvu+wQjbQ8OVr6EPGHQSvtPetRjHLfQpWImaxulfBA9Mz3ORpzmUVBLOeY/2YLS7KV0IarO0vQ6qdwKgtK4claxIaHlVSTOCZF467lr5IGe9kDlV83rNNNNpI71v0o+TAA1/l3vencEYUrLqT6XmP3LlzIDIR26hhgBiGV1Mn4m8mHBNhSkoatAEXcGboJNiw2uo4EC0+u1DoucJlvlQUBn4dhJ3qIJtdBdiEq21/KyLMaee+42ddFCSHJdPfTSGOfAdnXmsAsAK6wPlkit7kjUnkgLtOTuDBgLdWdsbUUPa2P97s2VUq/5wrReau+iwBVDYgoUMtL5Vww5mT+rbUIqsvg1WSsfFaMwsH92zYQvChTcLFK7ZQqbfqZyx/rv8nWnHccO2g6Kz4CHf9GVJCI8ANt1aKoUioinfix2FUE5fa5yLrFycCh0R5rl9QYGGLy38Wn2sc06F1OC6VNTaAnfDLstRWYTEjpedmxd8KgnKYuU6f3n0QC0kp2dQsOhCB9sYDaDpxgRgkvHECzZnYYy95H/Fb2kXLS3zHPIZ8A0jbVuJZLw1sVf4fx0P7/0Cd9E7v0GXevtm5888Oc5r5FCoEmFIbQT9hoVGaQHqFvTxXkXy8BNqHLCAcI+YV+0ZRuV+nbv4pGsRAwfbFnOX1Vf7n X-MS-Exchange-AntiSpam-MessageData-1: LxEHHgod0kxZb/Y6Ip5AmRSy7fcvzQ8psjE= X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: ee646da0-8a29-42ce-3936-08defee6561d X-MS-Exchange-CrossTenant-AuthSource: GV1P189MB2954.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Aug 2026 18:10:37.5085 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: hKc6RCFO/Mhn2CqwGih2BGMag0Uxa0F4uI+c8yze/6dE7pmAAh14oX93183xKxG0o5OP4zs7ym5enQfWt3Ch7zvSeP8LTxYBzb2+G1+iMSQ= X-MS-Exchange-Transport-CrossTenantHeadersStamped: PA1P189MB2702 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 20 Aug 2026 18:10:50 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243879 OpenSSL 4.0 removed the ENGINE API entirely. u-boot uses ENGINE_get_id, ENGINE_load_public_key, ENGINE_finish, ENGINE_free in lib/rsa/rsa-sign.c which causes link failures on all platforms that build u-boot (including riscv64). Backport the Provider API support patch from upstream u-boot which adds OpenSSL Provider support while maintaining backward compatibility with older OpenSSL versions that still have ENGINE. Add the patch to u-boot-common.inc so it applies to both u-boot and u-boot-tools recipes. Upstream-Status: Submitted [https://github.com/u-boot/u-boot/pull/918] Signed-off-by: Jaipaul Cheernam --- ...Add-support-for-OpenSSL-Provider-API.patch | 300 ++++++++++++++++++ meta/recipes-bsp/u-boot/u-boot-common.inc | 1 + 2 files changed, 301 insertions(+) create mode 100644 meta/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API.patch diff --git a/meta/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API.patch b/meta/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API.patch new file mode 100644 index 0000000000..5012e3c33d --- /dev/null +++ b/meta/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API.patch @@ -0,0 +1,300 @@ +From a81cb0932dce109af44d7245d47489fe54ae390f Mon Sep 17 00:00:00 2001 +From: Eddie Kovsky +Date: Mon, 23 Feb 2026 09:43:22 -0700 +Subject: [PATCH] Add support for OpenSSL Provider API + +The Engine API has been deprecated since the release of OpenSSL 3.0. End +users have been advised to migrate to the new Provider interface. +Several distributions have already removed support for engines, which is +preventing U-Boot from being compiled in those environments. + +Add support for the Provider API while continuing to support the existing +Engine API on distros shipping older releases of OpenSSL. + +This is based on similar work contributed by Jan Stancek updating Linux +to use the Provider interface. + + commit 558bdc45dfb2669e1741384a0c80be9c82fa052c + Author: Jan Stancek + Date: Fri Sep 20 19:52:48 2024 +0300 + + sign-file,extract-cert: use pkcs11 provider for OPENSSL MAJOR >= 3 + +The changes have been tested with the FIT signature verification vboot +tests on Fedora 42 and Debian 13. All 30 tests pass with both the legacy +Engine library installed and with the Provider API. + +Signed-off-by: Eddie Kovsky + +Upstream-Status: Submitted [https://github.com/u-boot/u-boot/pull/918] +Signed-off-by: Jaipaul Cheernam +--- + lib/aes/aes-encrypt.c | 4 +- + lib/rsa/rsa-sign.c | 102 +++++++++++++++++++++++++++++++++++++++--- + 2 files changed, 100 insertions(+), 6 deletions(-) + +diff --git a/lib/aes/aes-encrypt.c b/lib/aes/aes-encrypt.c +index 90e1407b4f09..4fc4ce232478 100644 +--- a/lib/aes/aes-encrypt.c ++++ b/lib/aes/aes-encrypt.c +@@ -16,7 +16,9 @@ + #include + #include + #include +-#include ++#if !defined(OPENSSL_NO_ENGINE) && !defined(OPENSSL_NO_DEPRECATED_3_0) ++# include ++#endif + #include + + #if OPENSSL_VERSION_NUMBER >= 0x10000000L +diff --git a/lib/rsa/rsa-sign.c b/lib/rsa/rsa-sign.c +index 0e38c9e802fd..f456f3c58e65 100644 +--- a/lib/rsa/rsa-sign.c ++++ b/lib/rsa/rsa-sign.c +@@ -19,7 +19,47 @@ + #include + #include + #include +-#include ++#if OPENSSL_VERSION_MAJOR >= 3 ++# define USE_PKCS11_PROVIDER ++# include ++# include ++# include ++#else ++# if !defined(OPENSSL_NO_ENGINE) && !defined(OPENSSL_NO_DEPRECATED_3_0) ++# define USE_PKCS11_ENGINE ++# include ++# endif ++#endif ++ ++#ifdef USE_PKCS11_PROVIDER ++#define ERR(cond, fmt, ...) \ ++ do { \ ++ bool __cond = (cond); \ ++ drain_openssl_errors(__LINE__, 0); \ ++ if (__cond) { \ ++ errx(1, fmt, ## __VA_ARGS__); \ ++ } \ ++ } while (0) ++ ++static void drain_openssl_errors(int l, int silent) ++{ ++ const char *file; ++ char buf[120]; ++ int e, line; ++ ++ if (ERR_peek_error() == 0) ++ return; ++ if (!silent) ++ fprintf(stderr, "At main.c:%d:\n", l); ++ ++ while ((e = ERR_peek_error_line(&file, &line))) { ++ ERR_error_string(e, buf); ++ if (!silent) ++ fprintf(stderr, "- SSL %s: %s:%d\n", buf, file, line); ++ ERR_get_error(); ++ } ++} ++#endif + + static int rsa_err(const char *msg) + { +@@ -94,10 +134,11 @@ static int rsa_pem_get_pub_key(const char *keydir, const char *name, EVP_PKEY ** + * + * @keydir: Key prefix + * @name Name of key +- * @engine Engine to use ++ * @engine Engine to use or NULL when using pkcs11 provider + * @evpp Returns EVP_PKEY object, or NULL on failure + * Return: 0 if ok, -ve on error (in which case *evpp will be set to NULL) + */ ++#ifdef USE_PKCS11_ENGINE + static int rsa_engine_get_pub_key(const char *keydir, const char *name, + ENGINE *engine, EVP_PKEY **evpp) + { +@@ -157,21 +198,24 @@ static int rsa_engine_get_pub_key(const char *keydir, const char *name, + + return 0; + } ++#endif + + /** + * rsa_get_pub_key() - read a public key + * + * @keydir: Directory containing the key (PEM file) or key prefix (engine) + * @name Name of key file (will have a .crt extension) +- * @engine Engine to use ++ * @engine Engine to use or NULL when using pkcs11 provider + * @evpp Returns EVP_PKEY object, or NULL on failure + * Return: 0 if ok, -ve on error (in which case *evpp will be set to NULL) + */ + static int rsa_get_pub_key(const char *keydir, const char *name, + ENGINE *engine, EVP_PKEY **evpp) + { ++#ifdef USE_PKCS11_ENGINE + if (engine) + return rsa_engine_get_pub_key(keydir, name, engine, evpp); ++#endif + return rsa_pem_get_pub_key(keydir, name, evpp); + } + +@@ -207,13 +251,44 @@ static int rsa_pem_get_priv_key(const char *keydir, const char *name, + return -ENOENT; + } + ++#ifdef USE_PKCS11_PROVIDER ++ EVP_PKEY *private_key = NULL; ++ OSSL_STORE_CTX *store; ++ ++ if (!OSSL_PROVIDER_try_load(NULL, "pkcs11", true)) ++ ERR(1, "OSSL_PROVIDER_try_load(pkcs11)"); ++ if (!OSSL_PROVIDER_try_load(NULL, "default", true)) ++ ERR(1, "OSSL_PROVIDER_try_load(default)"); ++ ++ store = OSSL_STORE_open(path, NULL, NULL, NULL, NULL); ++ ERR(!store, "OSSL_STORE_open"); ++ ++ while (!OSSL_STORE_eof(store)) { ++ OSSL_STORE_INFO *info = OSSL_STORE_load(store); ++ ++ if (!info) { ++ drain_openssl_errors(__LINE__, 0); ++ continue; ++ } ++ if (OSSL_STORE_INFO_get_type(info) == OSSL_STORE_INFO_PKEY) { ++ private_key = OSSL_STORE_INFO_get1_PKEY(info); ++ ERR(!private_key, "OSSL_STORE_INFO_get1_PKEY"); ++ } ++ OSSL_STORE_INFO_free(info); ++ if (private_key) ++ break; ++ } ++ OSSL_STORE_close(store); ++ ++ *evpp = private_key; ++#else + if (!PEM_read_PrivateKey(f, evpp, NULL, path)) { + rsa_err("Failure reading private key"); + fclose(f); + return -EPROTO; + } + fclose(f); +- ++#endif + return 0; + } + +@@ -226,6 +301,7 @@ static int rsa_pem_get_priv_key(const char *keydir, const char *name, + * @evpp Returns EVP_PKEY object, or NULL on failure + * Return: 0 if ok, -ve on error (in which case *evpp will be set to NULL) + */ ++#ifdef USE_PKCS11_ENGINE + static int rsa_engine_get_priv_key(const char *keydir, const char *name, + const char *keyfile, + ENGINE *engine, EVP_PKEY **evpp) +@@ -293,22 +369,25 @@ static int rsa_engine_get_priv_key(const char *keydir, const char *name, + + return 0; + } ++#endif + + /** + * rsa_get_priv_key() - read a private key + * + * @keydir: Directory containing the key (PEM file) or key prefix (engine) + * @name Name of key +- * @engine Engine to use for signing ++ * @engine Engine to use or NULL when using pkcs11 provider + * @evpp Returns EVP_PKEY object, or NULL on failure + * Return: 0 if ok, -ve on error (in which case *evpp will be set to NULL) + */ + static int rsa_get_priv_key(const char *keydir, const char *name, + const char *keyfile, ENGINE *engine, EVP_PKEY **evpp) + { ++#ifdef USE_PKCS11_ENGINE + if (engine) + return rsa_engine_get_priv_key(keydir, name, keyfile, engine, + evpp); ++#endif + return rsa_pem_get_priv_key(keydir, name, keyfile, evpp); + } + +@@ -325,6 +404,7 @@ static int rsa_init(void) + return 0; + } + ++#ifdef USE_PKCS11_ENGINE + static int rsa_engine_init(const char *engine_id, ENGINE **pe) + { + const char *key_pass; +@@ -380,6 +460,7 @@ static void rsa_engine_remove(ENGINE *e) + ENGINE_free(e); + } + } ++#endif + + static int rsa_sign_with_key(EVP_PKEY *pkey, struct padding_algo *padding_algo, + struct checksum_algo *checksum_algo, +@@ -480,11 +561,13 @@ int rsa_sign(struct image_sign_info *info, + if (ret) + return ret; + ++#ifdef USE_PKCS11_ENGINE + if (info->engine_id) { + ret = rsa_engine_init(info->engine_id, &e); + if (ret) + return ret; + } ++#endif + + ret = rsa_get_priv_key(info->keydir, info->keyname, info->keyfile, + e, &pkey); +@@ -496,16 +579,21 @@ int rsa_sign(struct image_sign_info *info, + goto err_sign; + + EVP_PKEY_free(pkey); ++ ++#ifdef USE_PKCS11_ENGINE + if (info->engine_id) + rsa_engine_remove(e); ++#endif + + return ret; + + err_sign: + EVP_PKEY_free(pkey); + err_priv: ++#ifdef USE_PKCS11_ENGINE + if (info->engine_id) + rsa_engine_remove(e); ++#endif + return ret; + } + +@@ -645,11 +733,13 @@ int rsa_add_verify_data(struct image_sign_info *info, void *keydest) + ENGINE *e = NULL; + + debug("%s: Getting verification data\n", __func__); ++#ifdef USE_PKCS11_ENGINE + if (info->engine_id) { + ret = rsa_engine_init(info->engine_id, &e); + if (ret) + return ret; + } ++#endif + ret = rsa_get_pub_key(info->keydir, info->keyname, e, &pkey); + if (ret) + goto err_get_pub_key; +@@ -726,8 +816,10 @@ int rsa_add_verify_data(struct image_sign_info *info, void *keydest) + err_get_params: + EVP_PKEY_free(pkey); + err_get_pub_key: ++#ifdef USE_PKCS11_ENGINE + if (info->engine_id) + rsa_engine_remove(e); ++#endif + + if (ret) + return ret; diff --git a/meta/recipes-bsp/u-boot/u-boot-common.inc b/meta/recipes-bsp/u-boot/u-boot-common.inc index d82d42cbce..7fce65191b 100644 --- a/meta/recipes-bsp/u-boot/u-boot-common.inc +++ b/meta/recipes-bsp/u-boot/u-boot-common.inc @@ -16,6 +16,7 @@ SRCREV = "ece349ade2973e220f524ce59e59711cc919263f" SRC_URI = "git://git.u-boot-project.org/u-boot/u-boot.git;protocol=https;branch=main;tag=v${PV} \ file://0001-pylibfdt-Replace-removed-SWIG-Python-2-compatibility.patch \ + file://0001-Add-support-for-OpenSSL-Provider-API.patch \ " B = "${WORKDIR}/build" From patchwork Thu Aug 20 18:10:22 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jaipaul Cheernam X-Patchwork-Id: 95938 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 70E42C5DF82 for ; Thu, 20 Aug 2026 18:10:50 +0000 (UTC) Received: from OSPPR02CU001.outbound.protection.outlook.com (OSPPR02CU001.outbound.protection.outlook.com [40.107.159.51]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.157.1787249440652542094 for ; Thu, 20 Aug 2026 11:10:41 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=GVErQ49A; spf=pass (domain: est.tech, ip: 40.107.159.51, mailfrom: jaipaul.cheernam@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=fkGODHM52G4UfWlMaRaAtaVmc95LJKoeZo6fMKG6gucsXY/ZJNI2vtk+F8jfDkSEx5gaaV3orB9NzzWMVLzMn6rndkO/g2IGtTS1ZD7sUbnjZ0jSxmp8qqyGdebBlH/9KnWxjpt0BYm+CZsZjeeW0hIAIQbpPdGQJHHdSzSkyxZTPg0vIlucXKUvhxlIAbCP9ikQP3VaFWNquI5IMbWcLpkN5PBORNSgRqt64bH/k6MX8zslguaXx9VCfbBSLHp9BZXrWoYbeMQWFcYo1HRC/Z8YOaeTczRIzfHQtFn71C2QUilhebUGS8v3GiKmImcaFTRKst/aU6MhPvFMEu+egw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=uKeBELKop9QPKbjypOidbbhKzX2NYmHn2pK1xcdt5eI=; b=dSIY44OSiS6UlF57H1yHa9C8wH4t0LaA9sPsNcv7XmvvPO/iE/yi/qGKQKr5Ho8haPRkzKL+SsP01xdq7Xb3JhgRX3ApYuBBH6XoZu66oRZPMIiAHp/AcbV0SSW4gUNzUNRPrzpUB8+B32Hib9jaYZsD2nJVXGbxNd/mMa2FePZuZoFJ/nZrmBjdXhtYhOhRUXauFpyTLgXX0NQzQA8UB7jf4YlmgOS9cxdBEc457vW+dBIu3w12YFPinUtZddL3on5UpEInUBi+zrOT0M6zJDIZR1gBTnMHchg3uHLAnbv7XB4SD4abrLVKgs8CgotTPB0qU/0uP1P21W1C7uKidg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=uKeBELKop9QPKbjypOidbbhKzX2NYmHn2pK1xcdt5eI=; b=GVErQ49AEFQ/vXHJ9KyTWFGz/OK9LMeLvFDuZsDs/NDr+wW+EPD6s80BxrrENfdQEDZQUqrDBqU+rWXGl9ec+gCJ/frlyEGVyUZTyDkaP7dgVALYQ7jzXYvF1Aav0Kld5arnjFuuEQ7Rb5h1Q9Be8d3OiySFJko7AoqcqNfZV8RUVm74ZwyfY/dfwghCCp4wHxMZjUkWm3nri9v7zWOAEfFSuhkKla4Lwn63tPz7Sab57gB2bYXsVPtI9Q/RGd13r5j3C4ecufXr/Bi1dG2Xbe6QNFKrEPxvSw6Y5K38lxxEiDkNFRtF21JqO/j//IPhXVZMZNPUE6HRVaidnd5iQQ== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from GV1P189MB2954.EURP189.PROD.OUTLOOK.COM (2603:10a6:150:263::18) by PA1P189MB2702.EURP189.PROD.OUTLOOK.COM (2603:10a6:102:452::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.339.8; Thu, 20 Aug 2026 18:10:40 +0000 Received: from GV1P189MB2954.EURP189.PROD.OUTLOOK.COM ([fe80::a7e4:7d5b:ab4a:4b96]) by GV1P189MB2954.EURP189.PROD.OUTLOOK.COM ([fe80::a7e4:7d5b:ab4a:4b96%4]) with mapi id 15.21.0360.003; Thu, 20 Aug 2026 18:10:40 +0000 From: Jaipaul Cheernam To: openembedded-core@lists.openembedded.org Subject: [RFC v2 6/6] kea: fix build with OpenSSL 4.0 Date: Thu, 20 Aug 2026 20:10:22 +0200 Message-ID: <20260820181022.44434-7-jaipaul.cheernam@est.tech> X-Mailer: git-send-email 2.39.5 (Apple Git-154) In-Reply-To: <20260820181022.44434-1-jaipaul.cheernam@est.tech> References: <20260814051829.35088-1-jaipaul.cheernam@est.tech> <20260820181022.44434-1-jaipaul.cheernam@est.tech> X-ClientProxiedBy: DU2PR04CA0354.eurprd04.prod.outlook.com (2603:10a6:10:2b4::7) To GV1P189MB2954.EURP189.PROD.OUTLOOK.COM (2603:10a6:150:263::18) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: GV1P189MB2954:EE_|PA1P189MB2702:EE_ X-MS-Office365-Filtering-Correlation-Id: f36f2c0f-a3f2-4081-46fc-08defee657b4 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|366016|10070799003|23010399003|1800799024|376014|10067099003|56012099006|6133799003|12006099003|11063799006|22082099003|18002099003|13003099007|4143699003; X-Microsoft-Antispam-Message-Info: emgnAuUF7OkJMsjxs5WX5U9ibWsvqF+RzWyKnhh6m+XNejBSnihRZLE2mUxqnhjGNBw510hMDikLYUuZsNvp8p0bCjyIrUT9KT2AsvZY1lWYMBqW+uW1Gxb17ONpZCLGwpaFiVXxV1xcd23nBaz8ytrocoMLiqqZPiI5fDHgkooP39kcVFBZu3vUvZzrmz5JjzHYvj7ZbCviD+oKfMLMnnU5FB5k6y/2BN8qNpGp5HRWy0DuBnBnJiXEqPyDkuVBK9vqHaPbzvwUBmPxAFMXyC2Vp52rQQxKdqpQ0kjsmc6K1VKAW+31vCO64r15FHioqZAG92FrYhL3UkusX4s0tHUt2OJCYWv5FVRBdBOZULu3oHgsLq2LoSmsHn3giQpTlOl3abh1BbNINxAzx3irvyBkA+RjMXoraQYwWcnsdmPwOLUYrHGsEyxKZnRS5tcYbGhFPaTdGj0RqtAem/NvFJ5TkK0x3+feLJALTv59nFoogZ5uY0TVHGBXJSpika0sBKeQ9ICnHPJWDvrJ+q2AaZAvD2f69NwwKuyYMqKXv+TQkzKXNnDzMZ12/VJdyEtKwldIB9wjJpRaLRQ2Z8xmgaHFOs2wPtiSy2MzDptFMJcs+/ImSV8Dv8k781DiVY44 X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:GV1P189MB2954.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(366016)(10070799003)(23010399003)(1800799024)(376014)(10067099003)(56012099006)(6133799003)(12006099003)(11063799006)(22082099003)(18002099003)(13003099007)(4143699003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 2 X-MS-Exchange-AntiSpam-MessageData-0: zSecG2dvsE9t8aiBMAMsgUjbr/1mQZtuzm25V6wbGhgnH7XkgY10axJK/lNGMOyPx3VdPN1e8Yh0hwDWTXm2uDEfV1tdO7haeVW9NpfhFGpLrnGbex+gVxqatuM5eO27xxl6k7/n9DE5ouIxAg9kQQVxrEy/ZYQtR/LkoUVav9lO89bkzvlTibEJ7SeNxZ1e60kssUbWogEnlLgEsHR5lqEMkwuecY0vKGjPmZxs+oVZkNWGdHCyJW/drsPfedb+FzdOw49wYZY63jU4Smt+WXWS9jl+h754U9iE4y84gjzalKWmyTLlk3hw6RrKoQH3AOaVsvj8K+WXxGcSsTu9ka+5ssWLEy4iXaCrBqth9vJs7iCR98Rq82+2mkW3ksvbmKiqQ7tJm0vAo1t0ywrgG+DL3Nw5NSpJktq66uRxGPFeUpja58X52oy74eq1PhfSsr8+gaAsrH6tTPet+ekZcYkEwqXgx+ph8Z4wmzLdZRlsVmBQzJGyRDg3aBCE+OM6F9ZJgb46Ozc2pqyY1wfuVG5R0w08LUOKH2nGxrbY7kChJX1ouT/BaxOI8x42hqr5rZzydLxpYZ6flh9HWGgbZRk4UlGQkWBBjq+bqHbzw11RR9A5DLtYCLoy+GgJfry19eB77tXgOh4heECQ/vZrq8uYBVPxlL0oJRVogLMCpx0sgV0PN9Tcnb3v1HfcVbUrHYmDwhjMdV7M1pQv/iCIxl8sUHzpnZAmQoAMlhMq+r52YcMiIhahu0oHy0IRfLvTEuBvCN7xNlSvVdLXvmEFTdPAXY5ccrlC615Y+Nl7rPdBQ1LtCq5jNMFwASd2Q8kSxSk41VN1R0YteUAeYktq3Is9TnJy1CzTbDgSJKHcA7wtkbY9f+Gp1KAKms/FDsxFnvwKQqV1aHEF3k00UsT7da3O8+vxC6nlLvU5W+BhrQZMPB8LHq/S6avjqLAYGmpid7G3m9WF4Cj3a6bXQoG9GPUx0lwNIQB65YYrVk5axpkq+clDduQDWyQ20IFNkxMbn3YlyWqFKzz1iRnBIcQfSzy1cN5IgCe9lBWbWH1gFQ0JRazbJIeBg5tR+L3wNIvd47TZ2VfJgjFB/buFvVRJtD0xsSisYhNPqTlwY7NetXEG2ialQlf8HcbIXHPM6khYXAcVRhh1C0UPOH1pFPz9brTwabUPaUiPt9QcwaIOVjwfxR05zt3SiSaz2ZhIQWbehzGfxgdAhv90yWedXsGGyBJsbJonpuUC3woGR3Y0oFApytJMcwDiJ5ZEyxEnSnzmqi3TjBiXT8yY3BP8KSY9Ydtv72jPylmzuChsBz1JL7pYd7jHqkvwlieIvRU07PWjLtCrbD19gVL4HUF7/hUUB2k7nOMRIQOjCm4WqH2unMDk40Xr/dDtst6W1PhnEOfZINjAtDp1MYcOEV+xi4dpf+VFgFyVlSoFY88MBgGrjSWeysto9HpQpDvW6V0tWs3kBzhkd2uUQYXNPUWFC4MLpefmDsmXbcgE/YeNmO7t9YISIwMHBNBwu8MOs4174ri4vkYNsNoZrt14EWw8H9kZqPw6bg6aL5nlbWLHP8yCfmo0obavRStSif6m5HaCYcHlY9/t75WGs6i4+hnQn568vof3gFgzTiCpK+WE6JxFIwv3x5mtffAVx0GQIDiwue263IYZ5N0hakBuOzbpsoBSpD7Ba6MiIMkGUH6s2PbU/8MeGzb8qxmUa5sx+jyATNSBLOkGTUsKCbAlK5BePEGifaYOIDt06b2E17a5De7skPnQBYiA0BBYbYj/udamIqeqecnmLIo4 X-MS-Exchange-AntiSpam-MessageData-1: cJmkz2gwHXpuG6YJFGjl7K/Q2Np2Ua5sWxU= X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: f36f2c0f-a3f2-4081-46fc-08defee657b4 X-MS-Exchange-CrossTenant-AuthSource: GV1P189MB2954.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Aug 2026 18:10:40.1751 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: Rz4jIYj7VvWkTLeSAITTLvUe6TIDd373LIgMs11TPB4jACan5y+OO3nKL4aTwOOX2XTX0U1mUWLefMa94VZKSmdOEXm557EGduG/5iYYHbA= X-MS-Exchange-Transport-CrossTenantHeadersStamped: PA1P189MB2702 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 20 Aug 2026 18:10:50 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243880 OpenSSL 4.0 added const qualifiers to X509_get_subject_name() and X509_get_issuer_name() return types. kea assigns these to non-const pointers causing compilation errors with -fpermissive. Add const qualifiers to X509_NAME and X509_NAME_ENTRY pointer declarations in openssl_tls.h. Tracked upstream: https://gitlab.isc.org/isc-projects/kea/-/issues/4673 (milestone: kea3.3.2, labeled: backport-candidate) Upstream-Status: Submitted [https://gitlab.isc.org/isc-projects/kea/-/issues/4673] Signed-off-by: Jaipaul Cheernam --- ...-qualifiers-to-OpenSSL-X509-pointers.patch | 49 +++++++++++++++++++ meta/recipes-connectivity/kea/kea_3.2.0.bb | 1 + 2 files changed, 50 insertions(+) create mode 100644 meta/recipes-connectivity/kea/files/0001-Add-const-qualifiers-to-OpenSSL-X509-pointers.patch diff --git a/meta/recipes-connectivity/kea/files/0001-Add-const-qualifiers-to-OpenSSL-X509-pointers.patch b/meta/recipes-connectivity/kea/files/0001-Add-const-qualifiers-to-OpenSSL-X509-pointers.patch new file mode 100644 index 0000000000..987890f4ff --- /dev/null +++ b/meta/recipes-connectivity/kea/files/0001-Add-const-qualifiers-to-OpenSSL-X509-pointers.patch @@ -0,0 +1,49 @@ +From 82d28b1be73bbc00e73e59d0c59c51a1e76519a5 Mon Sep 17 00:00:00 2001 +From: Simo Sorce +Date: Mon, 27 Apr 2026 17:49:56 -0400 +Subject: [PATCH] Add const qualifiers to OpenSSL X509 pointers + +Added const qualifiers to the X509_NAME and X509_NAME_ENTRY pointers when +retrieving subject and issuer names from TLS certificates. This ensures const- +correctness and maintains compatibility with newer OpenSSL versions, which +return const pointers from these getter functions. + +Signed-off-by: Simo Sorce + +Upstream-Status: Submitted [https://gitlab.isc.org/isc-projects/kea/-/issues/4673] +Signed-off-by: Jaipaul Cheernam +--- + src/lib/asiolink/openssl_tls.h | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/src/lib/asiolink/openssl_tls.h b/src/lib/asiolink/openssl_tls.h +index 57c3323..52a969b 100644 +--- a/src/lib/asiolink/openssl_tls.h ++++ b/src/lib/asiolink/openssl_tls.h +@@ -175,9 +175,9 @@ public: + if (!cert) { + return (""); + } +- ::X509_NAME *name = ::X509_get_subject_name(cert); ++ const ::X509_NAME *name = ::X509_get_subject_name(cert); + int loc = ::X509_NAME_get_index_by_NID(name, NID_commonName, -1); +- ::X509_NAME_ENTRY* ne = ::X509_NAME_get_entry(name, loc); ++ const ::X509_NAME_ENTRY* ne = ::X509_NAME_get_entry(name, loc); + if (!ne) { + ::X509_free(cert); + return (""); +@@ -209,9 +209,9 @@ public: + if (!cert) { + return (""); + } +- ::X509_NAME *name = ::X509_get_issuer_name(cert); ++ const ::X509_NAME *name = ::X509_get_issuer_name(cert); + int loc = ::X509_NAME_get_index_by_NID(name, NID_commonName, -1); +- ::X509_NAME_ENTRY* ne = ::X509_NAME_get_entry(name, loc); ++ const ::X509_NAME_ENTRY* ne = ::X509_NAME_get_entry(name, loc); + if (!ne) { + ::X509_free(cert); + return (""); +-- +2.53.0 + diff --git a/meta/recipes-connectivity/kea/kea_3.2.0.bb b/meta/recipes-connectivity/kea/kea_3.2.0.bb index feeacc8883..38b24eed1f 100644 --- a/meta/recipes-connectivity/kea/kea_3.2.0.bb +++ b/meta/recipes-connectivity/kea/kea_3.2.0.bb @@ -19,6 +19,7 @@ SRC_URI = "http://ftp.isc.org/isc/kea/${PV}/${BP}.tar.xz \ file://0001-src-lib-log-logger_unittest_support.cc-do-not-write-.patch \ file://0001-meson-use-a-runtime-safe-interpreter-string.patch \ file://0001-mk_cfgrpt.sh-strip-prefixes.patch \ + file://0001-Add-const-qualifiers-to-OpenSSL-X509-pointers.patch \ " SRC_URI[sha256sum] = "14bf695d37b65b9b1bf550fea5d0adaf9806c50e5419ef2a176a4b8e9aade3df"