From patchwork Thu Oct 29 08:53:59 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jaipaul Cheernam X-Patchwork-Id: 102338 Received: from GVXPR05CU001.outbound.protection.outlook.com (GVXPR05CU001.outbound.protection.outlook.com [52.101.83.50]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.7321.1793264049995771629 for ; Thu, 29 Oct 2026 01:54:11 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=h3Rg6VdM; spf=pass (domain: est.tech, ip: 52.101.83.50, mailfrom: jaipaul.cheernam@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=W9cLDaemP2qt+9sgfs0Tde8iM5QVeLFhGcd+LfbehxA6npa51PblCuC2SXut/UEvsrC77I73hVSaKi+SvJXJACyfZO5yRIMWZQ33Y0pPL3W5YINSFHR3Ym7R3UnLE/ThEuywVRCZiX2N3IWnZPGE6J00nwVjb4GMtmyJqKigi8/0udHkrDnphvKEVH/AQgvvYWdiTC1ujntbS1x7EDATmISJIBGafPucH7IsyP1cdkY845CHOlI9azTBSXK/2oCRU1nkugevP/+vvGDVNB+p3xykt3pQp5s956kLbjqyWv235/CkZmU4+ea4sn2zfsnRK6g1OA6wpRB6sgufRuIA8A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=jbcgKqUilV5FUYtQGmfd2HB69Fha5kFBMrmkAp0To/8=; b=iInLUSVJbpTYqlBZnsPk+Ak44TjNq3MpAWxADWj6c9MpCto3KfVE73lkfjlgXKaP7F2E9O07x3oweFdhNSK3yrotAcrGJalTsZ4uBgvQqFdk8HDtbI79MZqDuKOZzwV6AucdGxewb/VEv4XE+qdYTOcLVI4nDvPbYHvM2lJEi2lierp1NjWC+1HUUpPJKKsAiqOTqLj17C8tcEmcpLjfvEKeSzRYa7rMUuXan56w6JIlXZqIbDWDaBBeWWa+bbB0iJiShzFT+0lZ+ktjSElaPIAw6hvMhAbezw+1+Bq3cDoChvh3D/khYy31nj32jineuQy7qgfndmg4TGdCMj2d5A== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=jbcgKqUilV5FUYtQGmfd2HB69Fha5kFBMrmkAp0To/8=; b=h3Rg6VdMtQAnPuRjzsZCrHFCbgf9bDN5Lu3m/0Szp0XqOmQy7Of7qXuFZdSZBBF0DGFhWVEwSRNiouZOggpMdOXTmLwNMcsYOUBfowHNxJAUVSFmhgCiOZeQyCyf4jY+2Q7zquittqjgc/aHlqlfydi2XptlE6f1dLC62GUMjI7fFXdWTbMfSauMTCkIhrsNWa/+LYv2Q+vDMeNNxQcWReOVO1Yc350I9aNxtKeid6/AstLtVqcD0BEWJvdRHkR/goPz/gAUxHuxACTiAQljEBw/gQzHN3YQzMG41CZ4kqWMYEYQOVoaCLqW9ndWFmhs+uC6k4gm44F4Jjr3GdZiLw== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from AM6P189MB3107.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:6c0::19) by AS2P189MB2605.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:5e5::6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.569.8; Thu, 29 Oct 2026 08:54:05 +0000 Received: from AM6P189MB3107.EURP189.PROD.OUTLOOK.COM ([fe80::bc97:3847:8f02:acb]) by AM6P189MB3107.EURP189.PROD.OUTLOOK.COM ([fe80::bc97:3847:8f02:acb%6]) with mapi id 15.21.0569.008; Thu, 29 Oct 2026 08:54:05 +0000 From: Jaipaul Cheernam To: openembedded-core@lists.openembedded.org Subject: [PATCH v3 1/3] python3-cryptography: backport InvalidTag fix for openssl 4.1.0 Date: Thu, 29 Oct 2026 09:53:59 +0100 Message-ID: <20261029085401.9109-2-jaipaul.cheernam@est.tech> X-Mailer: git-send-email 2.39.5 (Apple Git-154) In-Reply-To: <20261029085401.9109-1-jaipaul.cheernam@est.tech> References: <20261029085401.9109-1-jaipaul.cheernam@est.tech> X-ClientProxiedBy: LO6P123CA0058.GBRP123.PROD.OUTLOOK.COM (2603:10a6:600:310::19) To AM6P189MB3107.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:6c0::19) Return-Path: jaipaul.cheernam@est.tech MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AM6P189MB3107:EE_|AS2P189MB2605:EE_ X-MS-Office365-Filtering-Correlation-Id: 0230199d-819b-42e1-b86f-08df359a2fa4 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|1800799024|366016|376014|260925022911599003|260925021311599003|260925021911599003|11063799006|56012099006|261009223027099003|261026130827099003|261026121527099003|261026135527099003|261026140227099003|261022105027099003|261021123027099003|261028144727099003|261021135927099003|261022115727099003|261021133027099003|261022113327099003|261021121427099003|10067099003|261022075727099003|261021130227099003|18002099003|22082099003|6133799003; X-Microsoft-Antispam-Message-Info: dSJN4TSWjcT8z8ZfYPV8nblJt0UHnMpcekgsvS+HvJg6o5KEDCwR064GcjYLiTRCT69w3/nP02BXlgu80E78XDLRSF9Cq2YGX+EZgEjPBQSYGHETyv+tFa1Ew5f7MixgyCPLUX/bMQw8oB3nYINDrkRgEg0zH+gl8eeWNF1u1/x1AkKI9jgzuGWy/JI6vetUTNAmHMGyUOUZXVKH/aINH4NpQKssmG1I+1RK+y7peMcfDOF0roMMVXWiOGn8c9JJZvx6bpRqTwg8qRObse2x7xS+l0CyJ8UlaitxQhRa1csrDAD7OIRHIfY9dlB3yZ4/wxS64UvkRn8oKc1i2xrdrV+gEHb7VQEMgSVmrow65VTnXw+2IPOO2VS3Aj7Ng4PJI4i0ErjbCBkkhOp+Y8xzcAfh3g97IaEDQv/k0Lky0qsAh/cSnvFkRP8F9monbBmI0ooVJ5S4TdvSMFzQ6mTGTCcsH5KVYErlATgqXHMAf/sK86lXcAApMkGGj0w0GgG2vGabnMHL8xC8neJK8kyr2PsO2HyNMq86kVULbhFRVbDWh/3n+BXeFXIr6C2PnE7xxwvg1AHlCoNAjB9MebjRnIJ9kmHbLHs+n8r3m+CAgYsN/56aP76ledfTEJ8OYvsS X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AM6P189MB3107.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(1800799024)(366016)(376014)(260925022911599003)(260925021311599003)(260925021911599003)(11063799006)(56012099006)(261009223027099003)(261026130827099003)(261026121527099003)(261026135527099003)(261026140227099003)(261022105027099003)(261021123027099003)(261028144727099003)(261021135927099003)(261022115727099003)(261021133027099003)(261022113327099003)(261021121427099003)(10067099003)(261022075727099003)(261021130227099003)(18002099003)(22082099003)(6133799003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: Rn6hKG7yfPnBe4OMl7UFHj5kPNjn2vq251xdOZ9hyKZF6Qhk//+9+4hRuVK/i7LHUA2GKWRtO+5jNoXsZAuqXXQfb5aGrvwaNLTnJvx9W2bBSLn2ft7srQhDu1rHsvhhBWZmrXaUyt/oegyvZHEee2fltFJKaUcmE/S1zu/hg9lhZjLssFFII+wtsOvGxYkyFy0Q91k9LH5pPfgZ3haLBVr7kRfuQRrZazTfLbI5KFY5PZjoiljZqor+Ab40YyAUj2dlIpIn7mMKbtD13USiW39MnO+/qz05x+LK7xyvVbJLOw7mwtE4VZqmYfJFku2YKlStaFRxR0IpjOnjhp/yamHNlGaLjeMBBJj5/qQo6xZCuyMwEd6dWbAt8gAO9nEeIUiXDBCXThtm7RuxAAu5FLX2cJzQUVJMx3jVc3vv6j3VZNwHh7PhHtajijYcTdJtXxGou0u6oykojO9LRpPJEjGt1sMDn/ldjjAzCSxgKAiQ9kd+UEKkEK2zbRULI0UcDFILth17+0crB90siT4qIzjFj96I8e/J1nofEOTTVNfFQAPZQFOmS5hsPQFcQPytLP1qXVzHTE129xZ5j2L5qjE2hRsmnouQ/W81oIVsVfFRZnfyZFxsIlZV2cfyO3yfzdh/n172iEx9MN5dNI7ZvDOKlOWJzEbpf6wLOqucO4yjqwWyeGZBCvxwKbkA7RymLkzGs4YkxL1/CgmRvXHPaH6B+gd3L7RBUsgKN6julqddSE/QLXYJ1xYIOAV+nIEDppWFMrsRXP8xtGdV9tgqsjCmjOcl9/riemBZDFRnTtrWM0VGUbcSLg/CxwVjUSXiQ4qkWgZGkKhthQBv6+j/qcc1DeYiGVlB4yE1JQPVwdMtRJfXD3FDgGeuP4PXcEeMi9xCkDOm5vMCHH0gkuKgZHY2NUpNkTPthUE20h4O6zYwXMQZHahPBIVQ4f9fJ5V1W9APW8EH9LNhz8fTl+oj0K8/nryctx6DibS/EbZh5ktfn8aWICW2gdWX4h53AyzMR80gyHwLrW/8OGjds2Q+MotsbdhoD7l1DpgrtYb8L/Bnka9W95rNuU5lylWi5SU/eamGoVwEBXGZJzpdpHNTzb4OoyFvoTbt/CutAx7ZxHADKKBaNDv3RwxjqAklgERR1gi8MmydRTAFSj43Mp90cart1vSML5hKOglSsUlOJpeSFw00wnTDRDfIWME4LDKzbh2vVekDKeVK7qbW4ZEqPrfaz0NUlvJDhDfKy6q2RqfqG/T1vRf5KY82j1py4qHyDvrnj1CofpV7zwa1d5GYPDdGtXd3B1l+f1pp1kukMsY1PQ68qgZiFroQhDbcEFDfkmKgnO8oB3M8qcmUPbpzncdSoKckTGPNCFT4G89T8CbwhXjnkXCx2jpmUr0eO1u1KeGbbaXoHjYoNpOAhr1NAtQPeyI33l/Y1s+2H7X52ZtZ2n4iFgTIxrGceho3esGEOci/0dUwoJU7BmkblYBRDEeAurcoEgcNDlEfI+dNkRIaVgZ1YsHu2MbQ/wZGAOViw+SVkCeCpZnO2Uok9rOL4VZVyU6UvY/7bsBSFH8dLaohKn6VIB5o3Qk3aXd21E/tsdm0AipW5UfpYZ3uI2Ju4IaZlt06rWusiU8QiSOzMDsiOhl9sjMLR+zHe+rmfgdvGRzwpt/k0oSKHfvbYY333+dGGp0KU1FvklPJxT+atWBv75C6rGI3Z6cMSWxGPl8lxD/vgyq9/AW//tkxK6AY1w== X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: 0230199d-819b-42e1-b86f-08df359a2fa4 X-MS-Exchange-CrossTenant-AuthSource: AM6P189MB3107.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 Oct 2026 08:54:05.1900 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 1eqXIJraDIzJdPS7wA8tynCrqTeO1A5FbgNHzQWJQyKdHO7d6INSLzyP3MgM9tDIXcYOk1I8rF7akhNhMFOGuEuJGGd5ps9JSx3YLM0PXH4= X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS2P189MB2605 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 29 Oct 2026 08:54:20 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/248911 openssl 4.1.0 changed the AEAD error queue, so bad-tag ptests now raise ValueError instead of InvalidTag. Backport pyca/cryptography#15596. Backport of https://github.com/pyca/cryptography/pull/15596 Signed-off-by: Jaipaul Cheernam --- .../python/python3-cryptography.bb | 1 + ...-on-AEAD-finalize-failure-regardless.patch | 53 +++++++++++++++++++ 2 files changed, 54 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-cryptography/0001-Raise-InvalidTag-on-AEAD-finalize-failure-regardless.patch diff --git a/meta/recipes-devtools/python/python3-cryptography.bb b/meta/recipes-devtools/python/python3-cryptography.bb index 5a1ce9fe2d..311b7313f0 100644 --- a/meta/recipes-devtools/python/python3-cryptography.bb +++ b/meta/recipes-devtools/python/python3-cryptography.bb @@ -16,6 +16,7 @@ SRC_URI[sha256sum] = "7b46165bb56eb4704e2eaaf86f3c940d19154535d9b0ca7d6d590b0406 SRC_URI += "file://0001-pyproject.toml-remove-benchmark-disable-option.patch \ file://check-memfree.py \ file://run-ptest \ + file://0001-Raise-InvalidTag-on-AEAD-finalize-failure-regardless.patch \ " require ${BPN}-crates.inc diff --git a/meta/recipes-devtools/python/python3-cryptography/0001-Raise-InvalidTag-on-AEAD-finalize-failure-regardless.patch b/meta/recipes-devtools/python/python3-cryptography/0001-Raise-InvalidTag-on-AEAD-finalize-failure-regardless.patch new file mode 100644 index 0000000000..4c3be321ee --- /dev/null +++ b/meta/recipes-devtools/python/python3-cryptography/0001-Raise-InvalidTag-on-AEAD-finalize-failure-regardless.patch @@ -0,0 +1,53 @@ +From 098b3b1816c3541847b507b2b1e0ae2e3aa85102 Mon Sep 17 00:00:00 2001 +From: Alex Gaynor +Date: Sat, 5 Sep 2026 17:11:53 -0400 +Subject: [PATCH] Raise InvalidTag on AEAD finalize failure regardless of error + queue (#15596) + +OpenSSL f7d2d2acef (openssl/openssl#32587) now pushes PROV_R_BAD_DECRYPT +onto the error queue when an AEAD tag check fails in EVP_DecryptFinal_ex. +Our finalize only mapped failures to InvalidTag when the error queue was +empty, so on OpenSSL master a bad GCM tag surfaced as a ValueError about +block length instead. + +For modes with an authentication tag, treat any finalize failure as +InvalidTag. Older OpenSSL, BoringSSL, AWS-LC, and LibreSSL still leave +the queue empty, so behavior there is unchanged. + +Claude-Session: https://claude.ai/code/session_01Eg4jjDRiLcBQrdEFsL3fCD + +Co-authored-by: Claude Fable 5.1 + +Upstream-Status: Backport [https://github.com/pyca/cryptography/commit/e83bbe58e373536636baaa7c33a64a6e8f04c953] +Signed-off-by: Jaipaul Cheernam +--- + src/rust/src/backend/ciphers.rs | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +diff --git a/src/rust/src/backend/ciphers.rs b/src/rust/src/backend/ciphers.rs +index f850bef..073bee3 100644 +--- a/src/rust/src/backend/ciphers.rs ++++ b/src/rust/src/backend/ciphers.rs +@@ -233,12 +233,16 @@ impl CipherContext { + py: pyo3::Python<'p>, + ) -> CryptographyResult> { + let mut out_buf = vec![0; self.ctx.block_size()]; +- let n = self.ctx.cipher_final(&mut out_buf).or_else(|e| { +- if e.errors().is_empty() +- && self +- .py_mode +- .bind(py) +- .is_instance(&types::MODE_WITH_AUTHENTICATION_TAG.get(py)?)? ++ let n = self.ctx.cipher_final(&mut out_buf).or_else(|_| { ++ // For authenticated modes, the only way finalize can fail is a ++ // tag mismatch. Older OpenSSL versions (and BoringSSL, AWS-LC, ++ // and LibreSSL) leave the error queue empty in that case, while ++ // OpenSSL >= 4.1 pushes PROV_R_BAD_DECRYPT, so we can't key on ++ // the error queue. ++ if self ++ .py_mode ++ .bind(py) ++ .is_instance(&types::MODE_WITH_AUTHENTICATION_TAG.get(py)?)? + { + return Err(CryptographyError::from(exceptions::InvalidTag::new_err(()))); + } From patchwork Thu Oct 29 08:54:00 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jaipaul Cheernam X-Patchwork-Id: 102340 Received: from AM0PR83CU005.outbound.protection.outlook.com (AM0PR83CU005.outbound.protection.outlook.com [52.101.69.18]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.7330.1793264058525593677 for ; Thu, 29 Oct 2026 01:54:18 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=OUMLWdrk; spf=pass (domain: est.tech, ip: 52.101.69.18, mailfrom: jaipaul.cheernam@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=G8oO7iW4hrCqlLSGcOAtuzm/egJdEiw7f/smirmc4a/t4wa19NHhOzlfvQ70M3rDjsFZxaWMkYQVv3SBONtVqva8DQD3jlr/rUv1vbDJCwH4powilVewVkccU1ppje0ooj7AxOPxfffSVThEGsL6lsGqVb3aeXnSgkOAlNp7pu5BzQXPhLNlZd6ayNffHO99KPY19VTfOUMwqepMxAluJAipsU2hs4P4aCIvehtR/X0lq3IXJSU+8nc3AKF9ivoYr8YsVCB6FYQea8mobT0lydNBPAHPsE0U8CoyYyYbheoWp1dvH2hALKvjKMYMikjikeCJ++1YRXbW+0cI9CbH7A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=fry3pubTc0moZMznDcH6G6IwJ49EAkys2waFU8u7gDM=; b=rKfOTYFU1w1H6gg5XDl/TLyE7+w73euzvMkDwOq6RqugTCBj6CJ2oHm8cAuyA2TpTpp4fLnKaieDKJ81G6EYxtb08wAadFI5f0Q73wHzElTDpFXv6u5SB4TZnJRMyIXDr/HpEbUJKvWkm4nWjqpRuAm2HSxAAmsPlrb+G0ye6UX1ZaXILrutP/f3lS/rpUZGzk/f3l1pUWSV4+W+yosTplTcbVCNnN+2aPZn093qO7ohcUgiSmNrtPMC1MQThyVIl0BtiACwFv5gxhWTxE/9ezUS4kXwSeUhtp2IQSMZ+qwZLnXcXUvl/3KinOqNGT6Nfx9oXaDxB6AgL+vb4+TLwQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=fry3pubTc0moZMznDcH6G6IwJ49EAkys2waFU8u7gDM=; b=OUMLWdrkjXhqMh6Eu+1zzSRzZjcTyEcve/t+HUjP9RViX9GHZoFmplpfRTFKN9mKg6oM+9d44LKwGQbluxuu58/5BfBiJNGAwNZWhxbU2By2IXzXlkXyloUbg2zAfmO1CAd0xDq39UQHDux6IHz6I8g20kSDKDGHcJfEyS7dgkkPyNUu4dfkzVXOWcpGCOn8Jn7CA7J1ZpTiwIg7DjalVAcQFtS2lw4M8igyQALSpBMHcx1oavlV9+GkzMOmdY5TDbooDsrH18DZ17+iCcWCCQ7Go+lmrmwcHSKFxv5kQjINtZhctVeDkENtSfdgRTXZjIRU8xcNZdGdIhs2yhSCnA== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from AM6P189MB3107.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:6c0::19) by AS2P189MB2605.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:5e5::6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.569.8; Thu, 29 Oct 2026 08:54:06 +0000 Received: from AM6P189MB3107.EURP189.PROD.OUTLOOK.COM ([fe80::bc97:3847:8f02:acb]) by AM6P189MB3107.EURP189.PROD.OUTLOOK.COM ([fe80::bc97:3847:8f02:acb%6]) with mapi id 15.21.0569.008; Thu, 29 Oct 2026 08:54:06 +0000 From: Jaipaul Cheernam To: openembedded-core@lists.openembedded.org Subject: [PATCH v3 2/3] python3-pyopenssl: Add patch to return None for TLS 1.3 Date: Thu, 29 Oct 2026 09:54:00 +0100 Message-ID: <20261029085401.9109-3-jaipaul.cheernam@est.tech> X-Mailer: git-send-email 2.39.5 (Apple Git-154) In-Reply-To: <20261029085401.9109-1-jaipaul.cheernam@est.tech> References: <20261029085401.9109-1-jaipaul.cheernam@est.tech> X-ClientProxiedBy: LO4P123CA0605.GBRP123.PROD.OUTLOOK.COM (2603:10a6:600:314::7) To AM6P189MB3107.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:6c0::19) Return-Path: jaipaul.cheernam@est.tech MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AM6P189MB3107:EE_|AS2P189MB2605:EE_ X-MS-Office365-Filtering-Correlation-Id: 2b1e4c9e-3aa8-449e-80f1-08df359a30a2 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|1800799024|366016|376014|260925022911599003|260925021311599003|260925021911599003|11063799006|56012099006|261009223027099003|261026121527099003|261026140227099003|261022105027099003|261021123027099003|261028144727099003|261021121427099003|10067099003|18002099003|22082099003|6133799003|13003099007|3023799007; X-Microsoft-Antispam-Message-Info: oi+NxxSs/BpxjSGwU9qHFt5nmD2XH7E+EkD8qs0C8spgvyftTtEBLyej2StP6tPamgubvCNoCEuhKSOs/o5IqWZULnMXw7sp7JfzC/I93+pQ5YjTEV4TiPE9+bsX9fCRxgMQU6ZHo6OEwy3WXOGu4iwlzaYUDozgmq+h8owG/13zfDw6fpHLTaMavhxdNeRrMaK6Z5HGRkoadIcJ+xJN6/F2bjh9hBQahyqnz3KRH8Gh9fcH1T45XBAziE+Gai77cDoqvpi6oPLMWXnIyga6Frp5d6/dXPaTLaNa5pGNH7eUGOXbfKrsPPCpzw5ZYghmz7ZUTlvVNDsqD5abX44RVm6otA3gConZ9REsUDqgVT24WXLAdoLnVDN2FQwPCIxDPbv8A8xdUzR53GTwiJGKheGHGYh70ZrekwwfLjsOX8HxUYPmIC4OGqi2MdOQXRNW9MsZkJcd+46douq1DbMAd66y1jIzWUMdR72gg9yfD/KD9rp1VlU5GIrYBJQ5NSAjU+RjcxbRRL9w3+AoDuAuf5NqtzSXL//Ph93Rii8guXAdJzlBF3ADeUB8RSsRc1gWXkrGdZY+VaGy/bXb5dfQkzuiY0baCPrBcA3R70QcgFJGQWHDAbYiZllFcpjdqG1JHtgRtA5rodR9o2/frVjRlyDHI4BjT65AFCkmMJuv/8g= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AM6P189MB3107.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(1800799024)(366016)(376014)(260925022911599003)(260925021311599003)(260925021911599003)(11063799006)(56012099006)(261009223027099003)(261026121527099003)(261026140227099003)(261022105027099003)(261021123027099003)(261028144727099003)(261021121427099003)(10067099003)(18002099003)(22082099003)(6133799003)(13003099007)(3023799007);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: mx+u2I8tN7rLlMtF/SlBfadaZjHeN4z+Aj43+hGZF2Z8gZEXe/m4SxuNRBuz8D5L6Xo/x1W48qcrjJlqcPn3Tyz8HLbqDjcHERjZmni2fM56Ula2G2Ws+wlvt6YnXBWsGmKn6AOshEW9k/SEEoup+GRj8GPpjtlb4nW1hIiitEMyTpQtd11W5HD8hUhqSEQcY20Giu41sm3hax4yNQG9HyuV2iH9xpkH/mYFxtz6MGsyYIRoRDlXypeO4X1Z1pAVnt5o1N+L3MpkLCUvvLKtHX8gCBtXZ7hudkbIyvDfW9f4fufFGqHHphuhEdiZV44pMGnQbAJebdUf4e63HxaPrJdiPY8MnRCxaX/S8rEh8umgTiduJjG5ZGg3Woc0HC/u6kSHvAghcGBZhfE+dFA1OX6rnZvKClEzmzBt6KjJbbWg6uD1FhI7kI8Q8XDL5Ee41W4d6V1zCBLEWMKGPNgF0KkiVEU3ydwdcs2PY6j7ee2cJuM7GbX9IRtulkZTP6xnya7ypEprht8mmkVTpKH0L7QTBDjQ0OMXH7Y4K5vAgbA0j8NvMQzz73JZ0slNBYXY1UI3DmKAqqtYfOQTFQvPtVyskzscOrwzfhwcvZXhdMRzqk+laPi5thFknGM88HEwYaA6/QvJZ2Zp2rGIlkMvjX6UkEFJ58bvcJO7IRUNlS9AlYzJPL4anx4oqXDPWdUHr++1G+YvCcmiIk86KJVFRBM6yHwoeNF3Xc4sI0Nxn9V3nPea786eo1KJ0/RNmMkGFpJ0tutoahVGrzGddEoI2PlzhXWXzUd7OdDkSq+UtNAJJl4QJdF6CVNrpqp8oQcK4b9PFY3JD4iZif4heQ1+zXQ3iI0CqPVw1redt4bzwsUVwidvDy6YieQvXIoXEhqGxHK8lWnfcDHEZreKfRZvNYhPzd43vaGfZKQdHNiTZLGxg6yPXR8LKzWoL9qNKN/8W0gGa4Epd7PH2MNWEZ0xWMO2HK1ceecTaQ4jYGtDLvrCJ5xPKIHyebC1sAYQ8S6FYgBF0Tn6mg4v1tfhAKoyO4jv3aG4co28WhNe5YbfOjyXOIcVyRxBfxdZaIHKhBCkL3/+Vb5kyhVgGs3G5vJb0YEormIs1YahFx4AYsS5Ec/W3cv0LdNNgOp6Z3IJW5bLwoIwW4DO+EzsUJC7paiKq7nbvkDvo9IHnRuYG1FGGwtPwaboP44WYGjABSbflTS2/1v5A0snmdapfnvmhFFAfdYdLHi+ZxxKzp8tYKYxWD9jEJGkDKurr0eeC7jSdlGH8ir2aWy1fuR3sIFb2DV3QGOBjAvwJY8agandfFBL6HPObi0hzcSLk2TKYg0G137TYuOHSCe8bnS79JYH3F5rTH2hEak27gRGiEqXYjXEHznp4J2jqgvotbcuFEEkpzlTvn13bsui+uqy6fDe2Jb7/2yFWwSQnUD1C08E6CmVwf3a0X7mokS9xBxyMIK1DbAiqzuDRcYXo0/nk8PkM9LiBo9hlmStwNduamlMrT400sfWNseRQa6MnlPQKALwJM9ks8PpqRK92zz7fAkq5RrcCvGDYbBsJqgd/kxlcvqqoaP4gfyCtBu0a/M46nG8T0p4Kw2AaKKyMKxQGjSYClpR2hJb3+OZdBqEiY2XpVbf3YvvkdzC5CC39RhzYGgRZSXBxJJGFGpaltDUW6PytOuDaj4RUS6ex4CFfRHL6ZKTK2cx/6fimNGn26+m4Xq+U0WVLt/QlJm8TTHk1poJdAazBA== X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: 2b1e4c9e-3aa8-449e-80f1-08df359a30a2 X-MS-Exchange-CrossTenant-AuthSource: AM6P189MB3107.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 Oct 2026 08:54:06.8482 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: ILRAt8jkZGQ2lxe3/seChhyWcNH3aG23ecj/xWayekFR8cA6c58oQ5QZPoZJPbVKVooDIeJCrGNGLz29vJCYcpWTD8DpNSTl2yAgkNkk8D0= X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS2P189MB2605 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 29 Oct 2026 08:54:21 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/248913 - Patch is needed for openssl 4.1.0 upgrade and working on 4.0.3 as well - PR is opened upstream https://github.com/pyca/pyopenssl/pull/1545 ptest results: PASS: 432 FAIL: 0 ERROR: 0 TOTAL: 1 FAIL: 0 Signed-off-by: Jaipaul Cheernam --- ...m-master_key-for-TLS-1.3-connections.patch | 66 +++++++++++++++++++ .../python/python3-pyopenssl_26.4.0.bb | 1 + 2 files changed, 67 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-pyopenssl/0001-Return-None-from-master_key-for-TLS-1.3-connections.patch diff --git a/meta/recipes-devtools/python/python3-pyopenssl/0001-Return-None-from-master_key-for-TLS-1.3-connections.patch b/meta/recipes-devtools/python/python3-pyopenssl/0001-Return-None-from-master_key-for-TLS-1.3-connections.patch new file mode 100644 index 0000000000..0942cbdc56 --- /dev/null +++ b/meta/recipes-devtools/python/python3-pyopenssl/0001-Return-None-from-master_key-for-TLS-1.3-connections.patch @@ -0,0 +1,66 @@ +From a0d7c02047a991ad2bd32621ac5f1b57062dc296 Mon Sep 17 00:00:00 2001 +From: Jaipaul Cheernam +Date: Thu, 29 Oct 2026 07:44:15 +0000 +Subject: [PATCH] Return None from master_key() for TLS 1.3 connections + +TLS 1.3 has no master secret, so SSL_SESSION_get_master_key() reports a +length of 0. master_key() asserted length > 0 and raised +OpenSSL.SSL.Error([]) for TLS 1.3 connections; return None instead, +matching the existing bytes | None return type. + +Fixes https://github.com/pyca/pyopenssl/issues/1544 + +Upstream-Status: Submitted [https://github.com/pyca/pyopenssl/pull/1545] + +Note: Exclude ChangeLog change for backport + +Signed-off-by: Jaipaul Cheernam +--- + src/OpenSSL/SSL.py | 7 +++++-- + tests/test_ssl.py | 8 +++++++- + 2 files changed, 12 insertions(+), 3 deletions(-) + +diff --git a/src/OpenSSL/SSL.py b/src/OpenSSL/SSL.py +index b7d5887..15ac4ab 100644 +--- a/src/OpenSSL/SSL.py ++++ b/src/OpenSSL/SSL.py +@@ -2803,14 +2803,17 @@ class Connection: + """ + Retrieve the value of the master key for this session. + +- :return: A string representing the state ++ :return: The master key, or :obj:`None` if there is no session or the ++ connection uses TLS 1.3, which has no master secret. + """ + session = _lib.SSL_get_session(self._ssl) + if session == _ffi.NULL: + return None + + length = _lib.SSL_SESSION_get_master_key(session, _ffi.NULL, 0) +- _openssl_assert(length > 0) ++ # TLS 1.3 has no master secret, so the length is 0. ++ if length == 0: ++ return None + outp = _no_zero_allocator("unsigned char[]", length) + _lib.SSL_SESSION_get_master_key(session, outp, length) + return _ffi.buffer(outp, length)[:] +diff --git a/tests/test_ssl.py b/tests/test_ssl.py +index a551fc7..085ab35 100644 +--- a/tests/test_ssl.py ++++ b/tests/test_ssl.py +@@ -4259,8 +4259,13 @@ class TestMemoryBIO: + # speaking any more. + assert interact_in_memory(client_conn, server_conn) is None + +- # Now that the handshake is done, there should be a key and nonces. +- assert server_conn.master_key() is not None ++ # Now that the handshake is done, there should be nonces. For TLS <= ++ # 1.2 there is also a master secret; TLS 1.3 has none, so master_key() ++ # may be None there (it is with OpenSSL 4.1+) and must not raise. ++ if server_conn.get_protocol_version() < TLS1_3_VERSION: ++ assert server_conn.master_key() is not None ++ else: ++ server_conn.master_key() + assert server_conn.client_random() is not None + assert server_conn.server_random() is not None + assert server_conn.client_random() == client_conn.client_random() diff --git a/meta/recipes-devtools/python/python3-pyopenssl_26.4.0.bb b/meta/recipes-devtools/python/python3-pyopenssl_26.4.0.bb index 0aa1e8991e..500027fa25 100644 --- a/meta/recipes-devtools/python/python3-pyopenssl_26.4.0.bb +++ b/meta/recipes-devtools/python/python3-pyopenssl_26.4.0.bb @@ -5,6 +5,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=3b83ef96387f14655fc854ddc3c6bd57" DEPENDS += "openssl python3-cryptography" +SRC_URI += "file://0001-Return-None-from-master_key-for-TLS-1.3-connections.patch" SRC_URI[sha256sum] = "28dfcce0162b9211413e26dfbfdf1d24317fbeba18fc93c12400a1856b2a0bc7" inherit pypi setuptools3 ptest-python-pytest From patchwork Thu Oct 29 08:54:01 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jaipaul Cheernam X-Patchwork-Id: 102339 Received: from PA4PR04CU001.outbound.protection.outlook.com (PA4PR04CU001.outbound.protection.outlook.com [40.107.162.47]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.7328.1793264054725604486 for ; Thu, 29 Oct 2026 01:54:15 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=Xvk0g17M; spf=pass (domain: est.tech, ip: 40.107.162.47, mailfrom: jaipaul.cheernam@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=SQWCSq5fQZqtuzWVbhz8o7voCAueknsZIg6VVc7FC5HxJEOorDuaRbVEO11IETtG2CaI9HzPKSU+f7iFTlyMbtcvGzizVpch/OP6bEpnx5SAxOkUQg6c3oPsE8KZKwfzcSn4PFDQTDRQ7cjy606HPWz1ulESWFLbNN3AVqJa63UvL3hoO9RWwMQMp0MQFu/Xr5EvZ0QBNxoBnVr+EMNubdKmO0GvTODi/bFrHxySCyXFsAhU5KDaFnZJjOOoWlhWLJ03qPPbxTelING3dSNjGF9dPYthYezQllPG/rn7owamAa5Px8y2IAZbZCZJrgTp8FtJ6+tDav4rg1KfuUP1Dw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=5PJM/bWBiXHt/9uYZRCS/UGCACq2L2pNR84lwtlsYEY=; b=v/z/UqUaIF1eSGlSZRLwB/e0NxUApP9OF87zPaZNL5TPD0+EgFPK/ayBVwtKULYUIyRSUDVbkDytecHY8mVtudZeUt3AyL/cKIST38B8HR+VQ56WK3k2Bnwj1xEaG7Nk2JURxYMXbSzY29rTUDs5SGLca7OXrUMxKxpmawUn1xyMAk1xkp7pPuCFDPuUlF7zNvKK1v/occI4PqHPzN6Y2IpMaupi3g8vl3/2lAD+GDxcQWPv4t8Yy2AySRfVr8sy8YbKMCV1ttyBuKYwKjf+a1rXTGDcUsM+AxxULuTKVW/ejlBbd7dzYbG8sCRQ+Y81xao8O80CUWJlqIQXyvgSvg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=5PJM/bWBiXHt/9uYZRCS/UGCACq2L2pNR84lwtlsYEY=; b=Xvk0g17MXG3VXtjhfFXMNx6j17knLYfc80MRdwWjxHSydzLAyEjuAp5VoRQ6FNKn/9wnKMUZG8wCd9EQPtVwkHZAM7ciiDqRzGhiFcjJ70VLxEeyEP256+Ok8d6CJH/TsH0bscd5imLOrUm262KOcb+Y+PfqVVX6kMKBmSiY3b29IHfWQ/XZLepGvVzH1ku/yTWXo5buncbXrWh3nVmr3tNLK/AwfUWjidRc2hPCIhpXEvU+nUT9D/PSUJ+yoVdpb6bXQBaNzsjUBVxz+XkE10riB0xe86O1B9m42UmXD9dxtb3zayU1SOdneH+3iD41Il8GzGuqjNEAw8Gqv4bAIg== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from AM6P189MB3107.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:6c0::19) by AS2P189MB2605.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:5e5::6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.569.8; Thu, 29 Oct 2026 08:54:09 +0000 Received: from AM6P189MB3107.EURP189.PROD.OUTLOOK.COM ([fe80::bc97:3847:8f02:acb]) by AM6P189MB3107.EURP189.PROD.OUTLOOK.COM ([fe80::bc97:3847:8f02:acb%6]) with mapi id 15.21.0569.008; Thu, 29 Oct 2026 08:54:09 +0000 From: Jaipaul Cheernam To: openembedded-core@lists.openembedded.org Subject: [PATCH v3 3/3] openssl: Upgrade 4.0.3 -> 4.1.0 Date: Thu, 29 Oct 2026 09:54:01 +0100 Message-ID: <20261029085401.9109-4-jaipaul.cheernam@est.tech> X-Mailer: git-send-email 2.39.5 (Apple Git-154) In-Reply-To: <20261029085401.9109-1-jaipaul.cheernam@est.tech> References: <20261029085401.9109-1-jaipaul.cheernam@est.tech> X-ClientProxiedBy: LO6P123CA0013.GBRP123.PROD.OUTLOOK.COM (2603:10a6:600:338::19) To AM6P189MB3107.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:6c0::19) Return-Path: jaipaul.cheernam@est.tech MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AM6P189MB3107:EE_|AS2P189MB2605:EE_ X-MS-Office365-Filtering-Correlation-Id: a070c43a-f54b-414f-72ae-08df359a318e X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|1800799024|366016|376014|11063799006|56012099006|261009223027099003|261026130827099003|261026121527099003|261026135527099003|261026140227099003|261022105027099003|261021123027099003|261028144727099003|261021135927099003|261022115727099003|261021133027099003|261022113327099003|261021121427099003|10067099003|261022075727099003|261021130227099003|18002099003|22082099003|6133799003; X-Microsoft-Antispam-Message-Info: Yq+8sLsn1gYd/NFR92nl77NNrMSO7vJ39+QvFZ75oZj3HOykm7oBrySR990y6OC7uJIhgoKMmNspvOQQ27KpDUvtT+N9yZ+ADInMBGNLrFRWrWJRBnqHhUAZDB1cviuugZO+MRDZqyzqLVEB8JdGVVz7gCiOXsQ/i4TypQVMclEZFp9vCAr8aNZF0Oxc714BMJ1HKWcxER9qEQnUWw6LjF+6iv76KmVBbbiVKFQKGCAQ77h1+Ykr4fDifR2jJBvRyQpYt3PJigRHGny6XyGLOMVcOBetaq7+zN6ifM3kqXmuufS42WIzHZvTaSSIWq/UJgfbDOuGSuWMlRfN84S4ZdFWqfnZnYAp3OEzYvI52gq1dR8ERRPPXHVIYnIRDjO00yqxLjpl96xNshgtiiga8pnPJEiZeZiLWPk1ve5OQ18IBlLsX9e+fg01D6xLgCg9I3VGEmERe/M7AXZShSTAg6nHesRHK4GzspcuUB6i9zCPW3h6IJ2rmJ89wGn1aCQ5NFSP1rEAtiUa1ufWpiP3uaRWisw3YANG3No+BXdSrrj4LtGQPufPirvYlM1L5A2+nXckPavd0ioRaZXrYJd5odhqbHHPuTSmKFhC6BpAgyblQmnBwLFuW4I/di2pYftK/GVjpxshBY3JicbScUlfnhC0iU4BQLQixw9yoWTQggo= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AM6P189MB3107.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(1800799024)(366016)(376014)(11063799006)(56012099006)(261009223027099003)(261026130827099003)(261026121527099003)(261026135527099003)(261026140227099003)(261022105027099003)(261021123027099003)(261028144727099003)(261021135927099003)(261022115727099003)(261021133027099003)(261022113327099003)(261021121427099003)(10067099003)(261022075727099003)(261021130227099003)(18002099003)(22082099003)(6133799003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: YrtVgEVK9EBgGzNOd9l8jOexqg68KWZ5XVj2iyZ8aHEcLWJxNnO0N2CDCWqvdS2Q4w0GhG32vsWfrbpCLsFz1Gh6upPMLFHYHDW3yVYQcq/bG4mKLeM59Mb0C2G2xnUIi2PucvEeffxixIrhujIDO16NTznga059R7J2PU6ztbeVUxLqbKuwL7TAEotybW+AIFdurl2Xurye0I3UCE3dFbI2/EEmYe2Xj4MoHWlgW1np7Eh8/IXWY30NJjK960vi65nA0us3rHiLdKrAnzwpfsn+RRyCvdaYSnNQEUkihO2EvbLjjrc6FiBoc97M3iavpr8Q3O83q5JbMFeMq/f+pdLe3GgVqu9gi2R8QxRwoIFaqYKuqSpumAlVkhaQ+zdibUPElX7AA71xdD9wYgUPay4dF2YBUNsFUj6AWkpdXq+nRBugsUIelxnq7yjt59qfBiV3yv7QAYcq2R9hdjLEA/OMgwlploiv4WsbzmrHQq3XkW+kld8tHFfhkYg9FGRUGtngbEQg/6fVMsgc2jY8UPC6NNtgUXsiQgJXNU3IA57+z8vxtGPExpvUCLOSvTM0VRcW8QQjfObHQUrc9bVvx5PrdfJieExxSfc01dq42K5Rii8/zJunm8VgjVHTyw2TSJ3HFSkB7E/pqkToldS8ESads5d6upmQpGRZWHJoLsP/mqLI5/aRkOjNF9xga0NoqkCk9p7U3fe2xm5YvkMWhkW9KMUjnHroW28SB1mUd4WyNgpn8AiZXxvRhJ+jUJ9/EdrNj1Rts3AzQpUVmnsfd+078qk4cTBzBazROCV+ECO0waun6BQ/5plQ1VvoTniMsU4Nyahi+incYvJAvsH98IGc9KDIFsbZWaxSq6d9tYcLG/T0sGJKCs5H+lmmK0e+dSFbmHV747RI3ENXs4lq0ztT9uidJqW3riG4ewAYEPXf+d1O34YOQgni8edLEvCuFbygL7oFEqwZPz9tJX6qb5NMiNcxXNo4sudEK9xOohI+8wJzAhL+NqLWomhZ0vd5rc+cx/0PK/RywlsDG/GQZQ1ulF6psWeoUzVNQ2w27Npumnmo1Fa5BLJzWxsLjKjnb7aDq1PxLfBnCtPUC+0EhRWY6V+PG45PbBvQd0+2plfQs1ojdOmizT4B/zBUtcRpUStl2RFrr/LHz9Mw7uePGs7/JDWBiM7cBdqnDu0P+Trr7Q5eJ6oglkybm0l3e60c9GwFIFN6wqXV42pbq6IXGx2XrDi3Psja+Bl2fem2YoQHv6Yk5dA+wNBKiMaciwQAnP8thNpHsp5gikbkRegPPzrmnCgEGYcTJk3kSyvuzUDr6iBSm9M9tWBYhnKh9OrItiGKP7PDf+jYflP3dLIRAUPs4yHBNY/xeUcUp7mlqMHmmFxuq7RPIsPhF9VmXmXCNlicXHC3hUIVguYggPj/t1HlSH2EZ3oCvdr/b4A9qlD5V89ku/FIwud7AEBom/+PIJnyyYKyYlkKYIBHCYOLy4rfRYQkjdXgi+t3ijM+0E4l5gUbvB8B8qzO6FlgNBHd3MGev2yqNUnSOgLx+EOkmVDf9C3Kr/lZCyQYoy8Ou3RUWP4T8g+1YpTmn93ulgT9IRFlfmFul4FbUewGMuE6l3yENVchVIQxPyyUxRZMU+Zf4v284Okly2mxC1iEMt/sE8VxUhX9t9fPLoQZvgImsVBclcJq746luOL5Y0pGqJLHLoKnoux1MVdk+NVpXKS8ShLdwTzidxICvfxwfSy51w== X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: a070c43a-f54b-414f-72ae-08df359a318e X-MS-Exchange-CrossTenant-AuthSource: AM6P189MB3107.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 Oct 2026 08:54:08.3789 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: zoCbqRaXVmOOYl1GwRaOt9lXkTikvhtIZLwKadD1MKepIx282lAaThRiJpHRQlTYswqA3X+KN1mxdZhDAzQYINpUlL1FXwkTTaXq68WtUF0= X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS2P189MB2605 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 29 Oct 2026 08:54:21 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/248912 Release information [1]: OpenSSL 4.1.0 is a feature release adding significant new functionality to OpenSSL. This release incorporates the following potentially significant or incompatible changes: - Added VC-WIN32-MSVC2013 and VC-WIN64A-MSVC2013 build targets to provide internal functions for bridging the gaps in C99 standard support that are present in MSVC 2013. - Added optimized ML-DSA and ML-KEM NTT operations on ppc64le; optimized ML-DSA operations on x86_64; AVX-512-optimized SHAKE x4 operations for ML-DSA on x86_64; AVX-512 and VAES optimizations for AES-CBC decryption on x86_64. - Changed tsget utility to use Net::Curl::Easy (from the Net-Curl CPAN distribution) instead of the abandoned WWW::Curl::Easy. Users who rely on tsget should install Net::Curl::Easy before upgrading. - Dropped Windows-on-Itanium (VC-WIN64I) and Windows CE (VC-CE) targets from Configurations. - Dropped no-ecdsa and no-ecdh options from Configure, as these options did not really disable the implementations. Use no-ec to disable the elliptic curve support. This release adds the following new features: - Support for DTLS 1.3 (RFC 9147). Refer to the ossl-guide-dtlsv13(7) manual page for details. - Support for RFC 8701 GREASE (Generate Random Extensions And Sustain Extensibility). - DTLS support in the SSL listener API. - Support for IKEV2 KDF. - Initial support for the Elbrus2000 (e2k) architecture. [1] https://github.com/openssl/openssl/blob/openssl-4.1/NEWS.md#major-changes-between-openssl-40-and-openssl-410-23-oct-2026 - Refresh existing patches - Verified with world - Verified ptest python3-cryptography TOTAL: 4650 PASS: 4443 FAIL: 0 ERROR: 0 TOTAL: 1 FAIL: 0 Signed-off-by: Jaipaul Cheernam --- Changes since v2: - Add patch for python3-pyopenssl Changes since v1: - Add patch for python3-cryptography .../0001-Configure-do-not-tweak-mips-cflags.patch | 6 +++--- ...trip-sysroot-and-debug-prefix-map-from-co.patch | 14 +++++++------- .../0001-extend-check_cwm-test-timeout.patch | 2 +- .../openssl/{openssl_4.0.3.bb => openssl_4.1.0.bb} | 2 +- 4 files changed, 12 insertions(+), 12 deletions(-) rename meta/recipes-connectivity/openssl/{openssl_4.0.3.bb => openssl_4.1.0.bb} (99%) diff --git a/meta/recipes-connectivity/openssl/openssl/0001-Configure-do-not-tweak-mips-cflags.patch b/meta/recipes-connectivity/openssl/openssl/0001-Configure-do-not-tweak-mips-cflags.patch index 77bfe4e4e5..2991082a5f 100644 --- a/meta/recipes-connectivity/openssl/openssl/0001-Configure-do-not-tweak-mips-cflags.patch +++ b/meta/recipes-connectivity/openssl/openssl/0001-Configure-do-not-tweak-mips-cflags.patch @@ -1,4 +1,4 @@ -From b5cee0cb0f14a78056ef7722a34b361491f1fdda Mon Sep 17 00:00:00 2001 +From 89d2702e00b0826fded82b06a9866e0fe7380540 Mon Sep 17 00:00:00 2001 From: Alexander Kanavin Date: Tue, 30 May 2023 09:11:27 -0700 Subject: [PATCH] Configure: do not tweak mips cflags @@ -17,10 +17,10 @@ Signed-off-by: Tim Orling 1 file changed, 10 deletions(-) diff --git a/Configure b/Configure -index c05a30b..db8adee 100755 +index e66424a..62141fe 100755 --- a/Configure +++ b/Configure -@@ -1575,16 +1575,6 @@ if ($target =~ /^mingw/ && `$config{CC} --target-help 2>&1` =~ m/-mno-cygwin/m) +@@ -1617,16 +1617,6 @@ if ($target =~ /^mingw/ && `$config{CC} --target-help 2>&1` =~ m/-mno-cygwin/m) push @{$config{shared_ldflag}}, "-mno-cygwin"; } diff --git a/meta/recipes-connectivity/openssl/openssl/0001-buildinfo-strip-sysroot-and-debug-prefix-map-from-co.patch b/meta/recipes-connectivity/openssl/openssl/0001-buildinfo-strip-sysroot-and-debug-prefix-map-from-co.patch index 1d9e7539f6..04f46a3d3e 100644 --- a/meta/recipes-connectivity/openssl/openssl/0001-buildinfo-strip-sysroot-and-debug-prefix-map-from-co.patch +++ b/meta/recipes-connectivity/openssl/openssl/0001-buildinfo-strip-sysroot-and-debug-prefix-map-from-co.patch @@ -1,4 +1,4 @@ -From 6df53bfebcf8ca65910a18220a6576fb110918a5 Mon Sep 17 00:00:00 2001 +From 4df92463252f8f0695db0143d3a26566a1736b2c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Martin=20Hundeb=C3=B8ll?= Date: Tue, 6 Nov 2018 14:50:47 +0100 Subject: [PATCH] buildinfo: strip sysroot and debug-prefix-map from compiler @@ -34,12 +34,12 @@ Signed-off-by: Khem Raj 2 files changed, 16 insertions(+), 2 deletions(-) diff --git a/Configurations/unix-Makefile.tmpl b/Configurations/unix-Makefile.tmpl -index eff66e5..bc48f51 100644 +index f8a5b16..807439f 100644 --- a/Configurations/unix-Makefile.tmpl +++ b/Configurations/unix-Makefile.tmpl -@@ -503,13 +503,27 @@ BIN_LDFLAGS={- join(' ', $target{bin_lflags} || (), - '$(CNF_LDFLAGS)', '$(LDFLAGS)') -} - BIN_EX_LIBS=$(CNF_EX_LIBS) $(EX_LIBS) +@@ -532,13 +532,27 @@ BIN_EX_LIBS=$(CNF_EX_LIBS) $(EX_LIBS) + CMOCKA_LIBS={- $config{cmocka_libs} // '' -} + DETOURS_LIBS={- $config{detours_libs} // '' -} -# CPPFLAGS_Q is used for one thing only: to build up buildinf.h +# *_Q variables are used for one thing only: to build up buildinf.h @@ -67,10 +67,10 @@ index eff66e5..bc48f51 100644 # For x86 assembler: Set PROCESSOR to 386 if you want to support diff --git a/crypto/build.info b/crypto/build.info -index 8e4a885..95b0902 100644 +index 422f4aa..3573af9 100644 --- a/crypto/build.info +++ b/crypto/build.info -@@ -114,7 +114,7 @@ DEFINE[../libcrypto]=$UPLINKDEF +@@ -113,7 +113,7 @@ DEFINE[../libcrypto]=$UPLINKDEF DEPEND[info.o]=buildinf.h DEPEND[cversion.o]=buildinf.h diff --git a/meta/recipes-connectivity/openssl/openssl/0001-extend-check_cwm-test-timeout.patch b/meta/recipes-connectivity/openssl/openssl/0001-extend-check_cwm-test-timeout.patch index 26622fd1b1..29b9728479 100644 --- a/meta/recipes-connectivity/openssl/openssl/0001-extend-check_cwm-test-timeout.patch +++ b/meta/recipes-connectivity/openssl/openssl/0001-extend-check_cwm-test-timeout.patch @@ -1,4 +1,4 @@ -From 07bbd037ca61264bcc311856a119b664ce13f586 Mon Sep 17 00:00:00 2001 +From ff0de34474c0dfec4f13dfb4079689c8731bf6ce Mon Sep 17 00:00:00 2001 From: Gyorgy Sarvari Date: Thu, 23 Oct 2025 11:24:36 +0200 Subject: [PATCH] extend check_cwm test timeout diff --git a/meta/recipes-connectivity/openssl/openssl_4.0.3.bb b/meta/recipes-connectivity/openssl/openssl_4.1.0.bb similarity index 99% rename from meta/recipes-connectivity/openssl/openssl_4.0.3.bb rename to meta/recipes-connectivity/openssl/openssl_4.1.0.bb index 122bf61f59..1e47c3cf34 100644 --- a/meta/recipes-connectivity/openssl/openssl_4.0.3.bb +++ b/meta/recipes-connectivity/openssl/openssl_4.1.0.bb @@ -18,7 +18,7 @@ SRC_URI:append:class-nativesdk = " \ file://environment.d-openssl.sh \ " -SRC_URI[sha256sum] = "325b5c806167c13b40b1ffeadfe0248197c00eccc4cf123ec1e28d2d2fd216d9" +SRC_URI[sha256sum] = "50c17baf54cb008f6ce42d50deb4b28050a1aad711636cabd4b241c7e90cc2fd" inherit lib_package multilib_header ptest perlnative manpages