Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package boringssl for openSUSE:Factory checked in at 2026-08-25 13:20:31 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/boringssl (Old) and /work/SRC/openSUSE:Factory/.boringssl.new.1258 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "boringssl" Tue Aug 25 13:20:31 2026 rev:16 rq:1373505 version:0.20260813 Changes: -------- --- /work/SRC/openSUSE:Factory/boringssl/boringssl.changes 2026-05-30 23:02:03.837955540 +0200 +++ /work/SRC/openSUSE:Factory/.boringssl.new.1258/boringssl.changes 2026-08-25 13:21:18.530539758 +0200 @@ -1,0 +2,3842 @@ +Mon Aug 24 14:32:50 UTC 2026 - Fridrich Strba <[email protected]> + +- Update to version 0.20260813: + * Update version for Bazel Central Repository to 0.20260813.0 + * Bump BORINGSSL_API_VERSION + * Fix ACVP RSA PSS. + * Separate serial number validity from serial number length + * crypto/x509: Implement Merkle Tree inclusion proof evaluation + * crypto/x509: Add convenience function to verify signature from byte span + * Defer allocating reassembly buffers in DTLS + * Support cSHAKE and TurboSHAKE. + * runner: replace ptrTo with value-based new + * Enable `check_prefixed_symbols` on the CI-only prefixed symbols builders. + * Fix benchmark names of the IOVec variants. + * AEAD benchmarks: add iovec variants. + * audit_symbols.go: Default to locating libraries in the CWD. + * Add a stub for SSL_get_peer_tmp_key + * draft-ietf-tls-ecdhe-mlkem is now RFC 10024 + * rust: bssl-tls: Unstage the callback uninstallers + * Update Rust and Clang. + * AEAD benchmarks: declare optimization hints. + * Don't unnecessarily tag ssl_cipher_is_deprecated as OPENSSL_EXPORT + * Remove OPENSSL_EXPORT on some internal SSL_SESSION functions + * Add some bit math helpers + * runner: Remove split handshake test machinery from the handshaker + * Revert "Work around a NASM bug" + * Update nasm in CI to 3.01 + * rust: Publish the experimental bssl-tls tokio interop crate + * rust: bssl-tls-tokio: Rework the tests + * rust: bssl-tls: Introduce hyper support + * rust: bssl-tls: Add ALPN support + * Minor include cleanup. + * rust: hoist FFI slice converters to bssl-crypto + * Discard .group sections in fips_shared.lds + * runner: Remove split handshake tests + * rust: Minor nit fixing + * rust: Keep future options open through non-exhaustiveness + * Re-enable the linux32_sde CI builder. + * Unwind EVP_CIPHER_CTX poisoning + * Document that EVP_aes_256_xts is single-shot + * Bump SDE version. + * Make BoringSSL handling of "unusable" EchConfigLists configurable + * Disable urandom_test while under SDE. + * Remove inconsistent null pointer checks in cipher_update hooks + * Delete unused code + * bssl-tls: Use more representative test data for cert parsing + * acvptool: seed key format for ML-DSA sigGen and ML-KEM decap + * Delete the mac_tmp_try_out_cas builder. + * Upload all mobile binaries to CAS when building. + * rust: bssl-tls: Clean up all slice_from_raw_parts + * Upload all Mac binaries to CAS when building. + * Upload all Windows binaries to CAS when building. + * Upload all Linux binaries to CAS when building. + * Linux: also export *.so.* files to CAS. + * Remove old Kyber hybrid from the TLS stack + * Use the correct file list of the ios64 test build archival. + * Improve ECC benchmarks + * Prepare for a new BCR release. + * Test the remaining "interesting" build configs for LUCI uploads. + * Revert "Enable symbol prefixing for the Bazel build" + * Run 5 more temporary test configs. + * When exporting build artifacts to CAS, reduce to necessary stuff. + * rust: bssl-tls: Introduce certificate callback + * rust: bssl-tls: Minor typo fix + * EVP_CIPHER: only poison the object on failure if it was mutated by the call. + * Point CMake more firmly at the `delocate` and `inject_hash` binaries. + * rust: bssl-tls: Allow application to get selected credential + * ssl: Allow retrospection of PSK identity + * Bump Bazel version to 0.20260730.0 + * rust: bssl-tls: Split Methods trait into connection and context variants + * In `linux_tmp_try_out_cas`, explicitly provide list of files to export. + * Create a temporary test CQ builder for setting up CAS uploading of artifacts. + * Preparation for including asm code from pq-code-package. + * TEST_F(BNTest, ModSqrtInvalid): explain what's going on. + * Preserve comments in perlasm. + * Documentation: add proper section heading for CRYPTO ByteBuilder + * rust: bssl-tls: Relax `set_ca_names` to both parties + * third_party/fiat: mark as Static + * New target: `run_unit_tests`. + * Reset the error queue in some more typical cases where unit tests intend to fail. + * Enable thread safety annotations in local bazel builds. + * rust: bssl-tls: Fix documentation + * rust: bssl-tls: RPK with private key methods + * Add Threads dependency in exported CMake config file + * Add CBB_add_u48 + * Disable the linux32_sde runner for now. + * Enable symbol prefixing for the Bazel build + * ssl: Use default ALPN handler + * Fix typo in doc + * Fix notes on the SDE version on CI + * Test runner: when stdout is redirected, assume -pipe. + * rust: bssl-tls-tokio: Remove DTLS convenience wrappers + * Reset the error queue in some typical cases where unit tests intend to fail. + * Add an ErrorsAreAndClear test helper. + * rust: bssl-tls: Add cipher type + * rust: bssl-tls: Simplify the tests + * rust: bssl-tls: Make building a new connection builder infallible + * Add EVP-level RSAPublicKey and RSAPrivateKey parsers + * Add some EVP APIs for low-level EC point and scalar formats + * rust: bssl-tls: Unstage compliance policy + * Revamp evp_test key import + * draft-ietf-tls-keylogfile is now RFC 9850 + * Export SLHDSA_generate_key_from_seed to the public API. + * rust: bssl-tls: Add convenient adapters + * rust: bssl-tls: Refactor the stack iterator + * Use EVP_PKEY_generate_from_alg in tool/server.cc + * rust: bssl-tls: Introduce non-X.509 mode + * ssl: Release the names if `SSL_set0_CA_names` is called after config is shed + * rust: bssl-tls: Add controls for CAs + * rust: bssl-tls: Make getting internal handle for us easier + * rust: bssl-tls: Move DTLS methods into the correct typestate + * rust: bssl-tls: Add missing SSL error codes + * rust: bssl-tls: Do not provide the TlsSession example + * rust/bssl-tls: Expose set_tlsext_host_name to support client SNI. + * Use scopers in CBB_flush_asn1_set_of + * Use the error queue a bit more consistently in CBB functions + * Update version for Bazel Central Repository to 0.20260713.0 + * bssl-sys: fix clippy warnings + * bssl-crypto: support ECDSA verification of already-hashed messages. + * Implement trust anchor groups on the certificate selection side + * Handle serial numbers permissively in OCSP + * runner: Switch to CertificatePropertyList for passing properties to the shim + * Expose CBS_get_asn1_oid_component + * rust: bssl-tls: Unstage the session support + * rust: bssl-tls: Fix predicate on `established` + * MLKEM benchmark: also add a "private key from seed" benchmark. + * ssl: Support ML-KEM by default. +- Add the service go_modules to the _service file and regenerate the vendor.tar.xz +- Rebase curl-impersonate.patch + +------------------------------------------------------------------- +Mon Aug 24 05:19:42 UTC 2026 - Fridrich Strba <[email protected]> + +- Update to version 0.20260708: + * Install headers into /usr/include/boringssl/openssl/ preserving + standard-compliant directory nesting rather than flat-installing + them directly under /usr/include/boringssl and rewriting includes. + * Rebase patches: + - 0003-enable-s390x-builds.patch + -> 0001-enable-s390x-and-ppc64le-builds.patch + - 0006-gcc-disable-werror.patch + -> 0002-gcc-disable-werror.patch.patch + - 0009-soname-sover.patch -> 0003-soname-sover.patch.patch + * Add patch: + - 0004-lower-cmake-version.patch: lower minimum CMake version + requirement to 3.20 to support older build environments + - curl-impersonate.patch: backport curl-impersonate changes + * Remove obsolete patches: + - 0002-crypto-Fix-aead_test-build-on-aarch64.patch + - 0004-fix-alignment-for-ppc64le.patch + - 0005-fix-alignment-for-arm.patch + - 0007-fix-go-vendor-embed_test_data.patch + - 0008-fix-go-vendor-err_data_generate.patch + * Disable Rust DTLS tests for now + * rust: bssl-tls: Disallow downcasting in-handshake to normal handle + * Handle CV-qualifiers in __gnu_cxx audit_symbols exclusion + * Turn SSL into an opaque struct + * Implement MTC plants-04 non-CA cosignature verification. + * Implement a vectorized "quad Keccak". + * Update Android documentation and add -upload-only flag + * Add ABI tests for Poly1305 Arm assembly + * Add ABI tests for AES-GCM-SIV assembly + * Document alignment requirements on AES-GCM-SIV assembly + * Move the alignment specifier on fe1305x2 to the type + * rust: bssl-tls: Introduce asynchronous private key delegate + * tool: correct cast of format argument + * rust: bssl-tls: Add more RPK related configurations + * ssl: Do not request or set hints when handshake is torn down + * Add some tests that X509_NAME_hash does not overcanonicalize + * Add some basic AI agent skills for BoringSSL development + * Expand on crypto/obj/README + * Add missing includes + * Fix outdated comment in fiat METADATA file + * Allow a SSL_SESSION to only ever live in one SSL_CTX. + * Null-check SSL_HANDSHAKE first in SSL_serialize_handshake_hints + * infra: Add buildbucket.creator binding to shadow buckets + * rust: bssl-tls: Introduce early callback support + * infra: Set up basic 'shadow' buckets for ci & try + * Add GREASE for signature_algorithms + * Make it more obvious that some ML-KEM vector_decode calls are infallible + * Import ML-KEM Wycheproof tests + * Clean up mlkem_test.cc to use a traits object + * Update Wycheproof test vectors + * Run Wycheproof ML-DSA signing vectors through verification too + * Fix typo in test name + * Fix ML-KEM constant-time validation regression + * Declassify the result of EC point-on-curve fault checks + * rust: bssl-tls: Correct the name of the SCT getter function + * Fix apparent infinite loop in X509NameAttribute::AsRFC2253String + * SSLBuffer::EnsureCap: ensure `new_cap` can never cause `offset_` overflow. + * ACVP: update other cases of memcpying into ints. + * Fix a bad parameter in `PEM_read_bio_inner`'s base64 decoding. + * ACVP: test SHAKE. + * ACVP: add extra ML-KEM tests. + * Remove some old commented out OpenSSL debug code + * Use scopers for embedded ASN1_STRING and X509_ALGOR + * Make X509_NAME_ENTRY an opaque type + * Switch easy fields in X509 to UniquePtr + * Fold x509_pubkey_{init,cleanup} into the class + * Fold x509_name_{init,cleanup} into the classs + * Allow a single SSL to consume and produce handshake hints + * Remove old Strawberry Perl workaround + * Implement EC_wpa3_sae_hash_to_curve_p256 + * crypto/x509: Fix handling of pathLenConstraint on self-issued intermediates. + * fiat: only use asm variants of P256 symbols if they're actually declared. + * rust: bssl-tls: Properly annotate sections of configuration options + * Revert "Replace most of P-256 assembly code with C" + * Finish documenting <openssl/pem.h> + * Unwind SSL_set_enforce_rsa_key_usage + * Run pregenerate as part of run_tests + * clang-format: p256_test.cc + * perlasm: delimit AESNI `set_encrypt_key_base` function properly + * Remove PEM_TYPE_* constants + * Document low-level PEM functions + * Add TLS_RSA_WITH_AES_256_GCM_SHA384 to ssl_compliance_policy_cnsa1_202603 + * Start expanding and documenting PEM_read and PEM_write functions + * ANY PRIVATE KEY is not a real PEM type + * Const-correct PEM_write functions and i2d_SSL_SESSION + * Normalize in-memory ASN1_BOOLEAN representations on parse + * rust: bssl-tls: report RPK in custom certificate verifier + * rust: bssl-tls: convenient certificate verification outcomes + * rust: bssl-tls: Share some credential configs with builder + * Unexport IMPLEMENT_PEM_* macros + * rust: bssl-tls: make DER encoding use slice sanitation + * Don't depend on tasn_* for ASN1_TYPE functions + * Fix strict aliasing violations in crypto/asn1 from ASN1_VALUE* + * Running spelling and grammar checks over comments. + * Update version for Bazel Central Repository to 0.20260616.0 + * Rewrite tasn_enc and tasn_dec with CBS/CBB + * Split out a CBS_peek_any_asn1_tag helper from CBS_peek_asn1_tag + * Remove unnecessary size limit comment + * Use scopers in IDP and CRDP config parsing + * Add a test for CRLDP parsing + * Break out a few more helper functions for supported crypto/asn1 types + * Support X509 objects with extern ASN1_ITEM helpers + * Wire up some more types to bssl::UniquePtr + * Add a test for PolicyInformation parsing + * Enable .subsections_via_symbols on all assembly files. + * mac_rel CI/CQ build: enable `-Wl,-dead_strip`. + * Add platform configuration for "Pythia". + * Fix comment typo + * Avoid having a L label at the start of a section on macOS. + * ssl: return non-const RPK handle + * Fix license header on p256_internal.h + * Make the SysV gates for fiat assembly more consistent + * Disable fiat P-256 assembly on OPENSSL_NANOLIBC + * OpenSSL Advisory: June 9th, 2026 (BoringSSL Not Affected) + * delocate: Support a few more aarch64 assembly variants + * delocate: Treat BORINGSSL_bcm_text_hash as a synthesized symbol + * xlate scripts: Use .subsections_via_symbols in apple assembly files. + * Store ML-DSA's s1, s2, and t0 in NTT form + * Don't decode t0 twice in the testing-only ML-DSA format + * runner: Unconditionally fill in our vendored ML-DSA public key + * Make Montgomery reduction clearer in ML-DSA + * Add EVP_CIPHER_CTX_max_next_update and EVP_CIPHER_CTX_max_final + * Fix compile-time assertion about sizing of AES-GCM-SIV data. + * Use the vectorized "double Keccak" for ML-DSA too. + * Use templates to simplify ML-DSA's scalar_*code functions, making all dispatch compile-time. + * delete extraneous test data file + * Update documentation about ASN.1 BIT STRING lengths + * Implement MTC plants-04 CA cosignature verification. + * Switch from select to poll in demo command-line tool + * Add a tool to update bazel dependencies + * Update bazel dependencies + * Fix build + * Touch up v2i_AUTHORITY_KEYID + * Add some tests to exercise v2i_AUTHORITY_KEYID + * Clarify that TLS-specific AEADs are not AEADs + * rust: cargo update + * Use scopers in certificate policy conf logic + * Add tests for constructing certificate policies from strings + * util/ar: Fix integer conversion in bounds check + * Update dependencies in go.mod + * runner: Rewrite some ServerKeyExchange serializers with cryptobyte + * Flip the sign on timezone offset calculation + * Update GitHub actions/checkout to version 6 + * Reject invalid IV lengths in EVP_CTRL_GCM_SET_IV_INV + * Include inline functions from BCM in the shared build's hashed region + * draft-ietf-dnsop-svcb-https was also published + * draft-ietf-lamps-dilithium-certificates is now RFC 9881 + * Restore the libcrypto C++ runtime dependency, but with a build flag + * Fix error_depth in the name constraints common name check + * Add default SSL options to SSL_OP_ALL + * Unroll the ML-DSA NTT outer loops. + * In SSL_reset_early_data_reject, clear out unreported bytes written. + * Update Wycheproof test vectors + * Replace most of P-256 assembly code with C + * For AES-GCM-SIV, also require PCLMUL instruction set. + * Add CMS_LIB to kLibraryNames. + * Documentation: Change |...| to `...` for code references in comments 9/N + * Remove the size limits for AES-EAX. + * Documentation: Change |...| to `...` for code references in comments 15/15 + * Documentation: Change |...| to `...` for code references in comments 14/N + * Documentation: Change |...| to `...` for code references in comments 12/N + * Remove unreachable checks in builtin BIO callbacks + * Convert built-in BIOs to write_ex + * Switch some BIO_write calls to BIO_write_ex ++++ 3545 more lines (skipped) ++++ between /work/SRC/openSUSE:Factory/boringssl/boringssl.changes ++++ and /work/SRC/openSUSE:Factory/.boringssl.new.1258/boringssl.changes Old: ---- 0002-crypto-Fix-aead_test-build-on-aarch64.patch 0003-enable-s390x-builds.patch 0004-fix-alignment-for-ppc64le.patch 0005-fix-alignment-for-arm.patch 0006-gcc-disable-werror.patch 0007-fix-go-vendor-embed_test_data.patch 0008-fix-go-vendor-err_data_generate.patch 0009-soname-sover.patch boringssl-0.20210430.tar.xz vendor.tar.gz New: ---- 0001-enable-s390x-and-ppc64le-builds.patch 0002-gcc-disable-werror.patch.patch 0003-soname-sover.patch.patch 0004-lower-cmake-version.patch boringssl-0.20260813.tar.xz curl-impersonate.patch vendor.tar.xz ----------(Old B)---------- Old: * Remove obsolete patches: - 0002-crypto-Fix-aead_test-build-on-aarch64.patch - 0004-fix-alignment-for-ppc64le.patch Old: * Rebase patches: - 0003-enable-s390x-builds.patch -> 0001-enable-s390x-and-ppc64le-builds.patch Old: - 0002-crypto-Fix-aead_test-build-on-aarch64.patch - 0004-fix-alignment-for-ppc64le.patch - 0005-fix-alignment-for-arm.patch Old: - 0004-fix-alignment-for-ppc64le.patch - 0005-fix-alignment-for-arm.patch - 0007-fix-go-vendor-embed_test_data.patch Old: -> 0001-enable-s390x-and-ppc64le-builds.patch - 0006-gcc-disable-werror.patch -> 0002-gcc-disable-werror.patch.patch Old: - 0005-fix-alignment-for-arm.patch - 0007-fix-go-vendor-embed_test_data.patch - 0008-fix-go-vendor-err_data_generate.patch Old: - 0007-fix-go-vendor-embed_test_data.patch - 0008-fix-go-vendor-err_data_generate.patch * Disable Rust DTLS tests for now Old: -> 0002-gcc-disable-werror.patch.patch - 0009-soname-sover.patch -> 0003-soname-sover.patch.patch * Add patch: ----------(Old E)---------- ----------(New B)---------- New: - 0003-enable-s390x-builds.patch -> 0001-enable-s390x-and-ppc64le-builds.patch - 0006-gcc-disable-werror.patch New: - 0006-gcc-disable-werror.patch -> 0002-gcc-disable-werror.patch.patch - 0009-soname-sover.patch -> 0003-soname-sover.patch.patch New: -> 0002-gcc-disable-werror.patch.patch - 0009-soname-sover.patch -> 0003-soname-sover.patch.patch * Add patch: New: * Add patch: - 0004-lower-cmake-version.patch: lower minimum CMake version requirement to 3.20 to support older build environments New:- Add the service go_modules to the _service file and regenerate the vendor.tar.xz - Rebase curl-impersonate.patch ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ boringssl.spec ++++++ --- /var/tmp/diff_new_pack.rLDgbM/_old 2026-08-25 13:21:19.443571954 +0200 +++ /var/tmp/diff_new_pack.rLDgbM/_new 2026-08-25 13:21:19.446572060 +0200 @@ -19,25 +19,26 @@ %define sover 1 %define libname libboringssl%{sover} %define src_install_dir %{_prefix}/src/%{name} +%if 0%{?gcc_version} < 10 +%define with_gcc 11 +%endif Name: boringssl -Version: 0.20210430 +Version: 0.20260813 Release: 0 Summary: An SSL/TLS protocol implementation License: OpenSSL URL: https://boringssl.googlesource.com/boringssl/ Source: %{name}-%{version}.tar.xz -Source1: vendor.tar.gz -Patch2: 0002-crypto-Fix-aead_test-build-on-aarch64.patch -Patch3: 0003-enable-s390x-builds.patch -Patch4: 0004-fix-alignment-for-ppc64le.patch -Patch5: 0005-fix-alignment-for-arm.patch -Patch6: 0006-gcc-disable-werror.patch -Patch7: 0007-fix-go-vendor-embed_test_data.patch -Patch8: 0008-fix-go-vendor-err_data_generate.patch -Patch9: 0009-soname-sover.patch +Source1: vendor.tar.xz +Patch0: 0001-enable-s390x-and-ppc64le-builds.patch +Patch1: 0002-gcc-disable-werror.patch.patch +Patch2: 0003-soname-sover.patch.patch +Patch3: 0004-lower-cmake-version.patch +# https://github.com/lexiforest/curl-impersonate/raw/refs/tags/v2.1.1/patches/boringssl.patch +Patch10: curl-impersonate.patch BuildRequires: cmake >= 3.0 BuildRequires: fdupes -BuildRequires: gcc-c++ +BuildRequires: gcc%{?with_gcc}-c++ BuildRequires: golang(API) >= 1.13 ExclusiveArch: %{ix86} x86_64 aarch64 s390x ppc64le %{arm} riscv64 @@ -73,13 +74,17 @@ %autosetup -a 1 -p 1 %build +%if 0%{?with_gcc} +export CXX=g++-%{with_gcc} +export CC=gcc-%{with_gcc} +%endif # Supress CMake default to include RPATH in binary on platforms which support it. # Failure to supress rpath fails rpmlint: # libboringssl1: E: binary-or-shlib-defines-rpath (Badness: 10000) /usr/lib64/libboringssl_ssl.so.1 # (RUNPATH: /home/abuild/rpmbuild/BUILD/boringssl-0.20210430-build/boringssl-0.20210430/build/crypto) # The binary or shared library defines `RPATH' (or `RUNPATH') that points to a non-system library path. %cmake \ -%ifarch riscv64 +%ifarch %{ix86} -DOPENSSL_NO_ASM=1 \ %endif -DCMAKE_SKIP_RPATH=1 \ @@ -89,8 +94,8 @@ %install # Install libraries # Upstream sources build .so in crypto/ and ssl/ subdirs. TBD if package layout needs to preserve that. -install -D -m0755 build/crypto/libboringssl_crypto.so.%{sover} %{buildroot}%{_libdir}/libboringssl_crypto.so.%{sover} -install -D -m0755 build/ssl/libboringssl_ssl.so.%{sover} %{buildroot}%{_libdir}/libboringssl_ssl.so.%{sover} +install -D -m0755 build/libboringssl_crypto.so.%{sover} %{buildroot}%{_libdir}/libboringssl_crypto.so.%{sover} +install -D -m0755 build/libboringssl_ssl.so.%{sover} %{buildroot}%{_libdir}/libboringssl_ssl.so.%{sover} # Create links from *.so to *.so.SOVER ln -sf libboringssl_crypto.so.%{sover} %{buildroot}%{_libdir}/libboringssl_crypto.so ln -sf libboringssl_ssl.so.%{sover} %{buildroot}%{_libdir}/libboringssl_ssl.so @@ -110,26 +115,23 @@ # Fix script-without-shebang error. # boringssl-source.noarch: E: script-without-shebang -# /usr/src/boringssl/third_party/googletest/test/gtest_test_utils.py -# /usr/src/boringssl/third_party/googletest/test/gtest_xml_test_utils.py +# /usr/src/boringssl/third_party/googletest/googletest/test/gtest_test_utils.py +# /usr/src/boringssl/third_party/googletest/googletest/test/gtest_xml_test_utils.py # /usr/src/boringssl/fuzz/minimise_corpora.sh -# /usr/src/boringssl/util/fipstools/break-tests-android.sh # /usr/src/boringssl/util/fipstools/break-tests.sh # /usr/src/boringssl/crypto/fipsmodule/ec/asm/p256_beeu-x86_64-asm.pl # As built, permissions for these are: -# -rwxr-xr-x third_party/googletest/test/gtest_test_utils.py -# -rwxr-xr-x third_party/googletest/test/gtest_xml_test_utils.py +# -rwxr-xr-x third_party/googletest/googletest/test/gtest_test_utils.py +# -rwxr-xr-x third_party/googletest/googletest/test/gtest_xml_test_utils.py # -rw-r--r-- fuzz/minimise_corpora.sh -# -rw-r--r-- util/fipstools/break-tests-android.sh # -rw-r--r-- util/fipstools/break-tests.sh # -rw-r--r-- crypto/fipsmodule/ec/asm/p256_beeu-x86_64-asm.pl # Unsetting executable bits on .py files has the intended effect to pass the linter -chmod a-x %{buildroot}%{_prefix}/src/boringssl/third_party/googletest/test/gtest_test_utils.py -chmod a-x %{buildroot}%{_prefix}/src/boringssl/third_party/googletest/test/gtest_xml_test_utils.py +chmod a-x %{buildroot}%{_prefix}/src/boringssl/third_party/googletest/googletest/test/gtest_test_utils.py +chmod a-x %{buildroot}%{_prefix}/src/boringssl/third_party/googletest/googletest/test/gtest_xml_test_utils.py # The .sh files already do not have executable bits set but script-without-shebang linter still fails # Insert a bash shebang line for script-without-shebang linter sed -i -e '1i#!/bin/bash' %{buildroot}%{_prefix}/src/boringssl/fuzz/minimise_corpora.sh -sed -i -e '1i#!/bin/bash' %{buildroot}%{_prefix}/src/boringssl/util/fipstools/break-tests-android.sh sed -i -e '1i#!/bin/bash' %{buildroot}%{_prefix}/src/boringssl/util/fipstools/break-tests.sh # Insert a perl shebang line for script-without-shebang linter sed -i -e '1i#!%{_bindir}/perl' %{buildroot}%{_prefix}/src/boringssl/crypto/fipsmodule/ec/asm/p256_beeu-x86_64-asm.pl @@ -138,12 +140,11 @@ find %{buildroot}%{src_install_dir} -type f -name "*.sh" -print -exec chmod +x "{}" + find %{buildroot}%{src_install_dir} -type f -name "*.pl" -print -exec chmod +x "{}" + # Fix these individually, since we don't want all *.py to all be executable -chmod +x %{buildroot}%{_prefix}/src/boringssl/third_party/googletest/test/googletest-json-outfiles-test.py -chmod +x %{buildroot}%{_prefix}/src/boringssl/third_party/googletest/test/googletest-json-output-unittest.py -chmod +x %{buildroot}%{_prefix}/src/boringssl/third_party/googletest/test/googletest-param-test-invalid-name1-test.py -chmod +x %{buildroot}%{_prefix}/src/boringssl/third_party/googletest/test/googletest-param-test-invalid-name2-test.py -chmod +x %{buildroot}%{_prefix}/src/boringssl/third_party/googletest/test/gtest_list_output_unittest.py -chmod +x %{buildroot}%{_prefix}/src/boringssl/util/bot/update_clang.py +chmod +x %{buildroot}%{_prefix}/src/boringssl/third_party/googletest/googletest/test/googletest-json-outfiles-test.py +chmod +x %{buildroot}%{_prefix}/src/boringssl/third_party/googletest/googletest/test/googletest-json-output-unittest.py +chmod +x %{buildroot}%{_prefix}/src/boringssl/third_party/googletest/googletest/test/googletest-param-test-invalid-name1-test.py +chmod +x %{buildroot}%{_prefix}/src/boringssl/third_party/googletest/googletest/test/googletest-param-test-invalid-name2-test.py +chmod +x %{buildroot}%{_prefix}/src/boringssl/third_party/googletest/googletest/test/gtest_list_output_unittest.py # Fix one bash script to be executable chmod +x %{buildroot}%{_prefix}/src/boringssl/vendor/golang.org/x/sys/windows/mkerrors.bash @@ -156,19 +157,16 @@ find %{buildroot}%{src_install_dir} -type f -name "*.py" -exec sed -i 's|#!.*%{_bindir}/env python.*|#!%{_bindir}/python3|' "{}" + find %{buildroot}%{src_install_dir} -type f -name "*.sh" -exec sed -i 's|#!.*%{_bindir}/env bash|#!/bin/bash|' "{}" + -# To avoid conflicts with openssl development files, change all includes from -# openssl to boringssl. -# BoringSSL headers provided by this pachage are installed in -# /usr/include/boringssl for the same reason. -find %{buildroot}%{_prefix}/src/boringssl/include/openssl -type f -exec sed -i 's/openssl/boringssl/' "{}" + - -find %{buildroot}%{_prefix}/src/boringssl/include/openssl -type f -execdir install -D -m0644 "{}" "%{buildroot}%{_includedir}/boringssl/{}" \; +# Install headers into /usr/include/boringssl/openssl/ to avoid conflicts with openssl +# development files, while allowing downstream packages to include them via -I/usr/include/boringssl +mkdir -p %{buildroot}%{_includedir}/boringssl +cp -R %{buildroot}%{src_install_dir}/include/openssl %{buildroot}%{_includedir}/boringssl/ +find %{buildroot}%{_includedir}/boringssl/openssl -type d -exec chmod 0755 "{}" + +find %{buildroot}%{_includedir}/boringssl/openssl -type f -exec chmod 0644 "{}" + # Remove Go build utilities which cause debuginfo error: # dwz: ./usr/src/boringssl/crypto/err/err_data_generate.debug: Found compressed .debug_abbrev section, not attempting dwz compression # dwz: ./usr/src/boringssl/embed_test_data.debug: Found compressed .debug_abbrev section, not attempting dwz compression -rm %{buildroot}%{_prefix}/src/boringssl/crypto/err/err_data_generate -rm %{buildroot}%{_prefix}/src/boringssl/embed_test_data # Relocate doc and license to align with packaging standards mkdir -p %{buildroot}%{_docdir}/%{name} ++++++ 0001-enable-s390x-and-ppc64le-builds.patch ++++++ >From 05d24f2e64dcb584f4d56878eee7ca806bdad7a6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Klaus=20K=C3=A4mpf?= <[email protected]> Date: Mon, 24 Aug 2026 05:29:14 +0000 Subject: [PATCH 1/4] enable s390x and ppc64le builds --- crypto/poly1305/poly1305_test.cc | 5 +++++ include/openssl/target.h | 6 ++++++ 2 files changed, 11 insertions(+) diff --git a/crypto/poly1305/poly1305_test.cc b/crypto/poly1305/poly1305_test.cc index 5f8453258..9920491fb 100644 --- a/crypto/poly1305/poly1305_test.cc +++ b/crypto/poly1305/poly1305_test.cc @@ -27,6 +27,11 @@ #include "../test/test_util.h" #include "internal.h" +#if defined(OPENSSL_S390X) +#define ALIGN_BYTES 8 +#else +#define ALIGN_BYTES 16 +#endif BSSL_NAMESPACE_BEGIN namespace { diff --git a/include/openssl/target.h b/include/openssl/target.h index 2372a055d..7e5a19a52 100644 --- a/include/openssl/target.h +++ b/include/openssl/target.h @@ -40,6 +40,12 @@ #elif defined(__MIPSEL__) && defined(__LP64__) #define OPENSSL_64_BIT #define OPENSSL_MIPS64 +#elif defined(__s390x__) || defined(__S390X__) +#define OPENSSL_64_BIT +#define OPENSSL_S390X +#elif (defined(__PPC64__) || defined(__powerpc64__)) && (defined(__LITTLE_ENDIAN__) || defined(_LITTLE_ENDIAN)) +#define OPENSSL_64_BIT +#define OPENSSL_PPC64LE #elif defined(__riscv) && __SIZEOF_POINTER__ == 8 #define OPENSSL_64_BIT #define OPENSSL_RISCV64 -- 2.55.0 ++++++ 0002-gcc-disable-werror.patch.patch ++++++ >From 4ffec293e90ddfbebd6719c4fca93ac6635ce04c Mon Sep 17 00:00:00 2001 From: Jeff Kowalczyk <[email protected]> Date: Mon, 24 Aug 2026 05:29:14 +0000 Subject: [PATCH 2/4] gcc-disable-werror.patch --- CMakeLists.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index bab3d89dd..b0312e751 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -431,7 +431,7 @@ endif() # # TODO(crbug.com/389897612): Should these be set on a per-target basis? if(CMAKE_COMPILER_IS_GNUCXX OR CLANG) - set(C_CXX_WARNINGS -Werror -Wformat=2 -Wmissing-field-initializers -Wshadow + set(C_CXX_WARNINGS -Wformat=2 -Wmissing-field-initializers -Wshadow -Wsign-compare -Wtype-limits -Wvla -Wwrite-strings -Wimplicit-fallthrough) set(C_WARNINGS -Wold-style-definition -Wstrict-prototypes) set(CXX_WARNING -Wnon-virtual-dtor) -- 2.55.0 ++++++ 0003-soname-sover.patch.patch ++++++ >From c920b1234446aebe00db88e3d56c62e239196d4d Mon Sep 17 00:00:00 2001 From: Jeff Kowalczyk <[email protected]> Date: Mon, 24 Aug 2026 05:31:53 +0000 Subject: [PATCH 3/4] soname-sover.patch --- CMakeLists.txt | 2 ++ 1 file changed, 2 insertions(+) diff --git a/CMakeLists.txt b/CMakeLists.txt index b0312e751..e2dc578dd 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -639,6 +639,7 @@ target_include_directories(crypto PUBLIC ) target_compile_definitions(crypto PRIVATE -DBORINGSSL_IMPLEMENTATION) set_property(TARGET crypto PROPERTY EXPORT_NAME Crypto) +set_target_properties(crypto PROPERTIES OUTPUT_NAME boringssl_crypto SOVERSION 1) if(FIPS_SHARED) # Rewrite libcrypto.so to inject the correct module hash value. This assumes @@ -678,6 +679,7 @@ add_library(ssl ${SSL_SOURCES}) set_property(TARGET ssl PROPERTY EXPORT_NAME SSL) target_link_libraries(ssl crypto) target_compile_definitions(ssl PRIVATE -DBORINGSSL_IMPLEMENTATION) +set_target_properties(ssl PROPERTIES OUTPUT_NAME boringssl_ssl SOVERSION 1) add_library(decrepit ${DECREPIT_SOURCES}) target_link_libraries(decrepit ssl crypto) -- 2.55.0 ++++++ 0004-lower-cmake-version.patch ++++++ >From cbfcd76ff1b80af00686974c512563ea65e2683b Mon Sep 17 00:00:00 2001 From: Fridrich Strba <[email protected]> Date: Mon, 24 Aug 2026 11:00:12 +0200 Subject: [PATCH 4/4] lower cmake version --- CMakeLists.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index e2dc578dd..a69862974 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -12,7 +12,7 @@ # See the License for the specific language governing permissions and # limitations under the License. -cmake_minimum_required(VERSION 3.22) +cmake_minimum_required(VERSION 3.20) # Defer enabling C and CXX languages. project(BoringSSL NONE) -- 2.55.0 ++++++ _service ++++++ --- /var/tmp/diff_new_pack.rLDgbM/_old 2026-08-25 13:21:19.527574917 +0200 +++ /var/tmp/diff_new_pack.rLDgbM/_new 2026-08-25 13:21:19.529574987 +0200 @@ -5,12 +5,17 @@ <param name="changesgenerate">enable</param> <param name="filename">boringssl</param> <param name="versionformat">0.%cd</param> - <param name="revision">2c45d4e03e35a2dd73834252e11e8a7282eb9185</param> + <param name="revision">7c1efd8d6ffb36a57feba44e8c73cf674801f3cb</param> </service> <service mode="manual" name="recompress"> <param name="file">*.tar</param> <param name="compression">xz</param> </service> - <service mode="manual" name="set_version"/> + <service mode="manual" name="set_version"> + <param name="basename">boringssl</param> + </service> + <service name="go_modules" mode="manual"> + <param name="compression">xz</param> + </service> </services> ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.rLDgbM/_old 2026-08-25 13:21:19.547575622 +0200 +++ /var/tmp/diff_new_pack.rLDgbM/_new 2026-08-25 13:21:19.550575728 +0200 @@ -1,6 +1,6 @@ <servicedata> <service name="tar_scm"> <param name="url">https://boringssl.googlesource.com/boringssl</param> - <param name="changesrevision">853ca1ea1168dff08011e5d42d94609cc0ca2e27</param></service></servicedata> + <param name="changesrevision">7c1efd8d6ffb36a57feba44e8c73cf674801f3cb</param></service></servicedata> (No newline at EOF) ++++++ boringssl-0.20210430.tar.xz -> boringssl-0.20260813.tar.xz ++++++ /work/SRC/openSUSE:Factory/boringssl/boringssl-0.20210430.tar.xz /work/SRC/openSUSE:Factory/.boringssl.new.1258/boringssl-0.20260813.tar.xz differ: char 15, line 1 ++++++ curl-impersonate.patch ++++++ ++++ 1455 lines (skipped)
