Hello Sebastian, thank you, the debdiff against 3.6.5-1 is attached.
It does three things: 1. A Debian patch appends `.include /etc/ssl/openssl.cnf.d` to apps/openssl.cnf, with a comment for whoever writes a snippet. 2. debian/openssl.dirs ships /etc/ssl/openssl.cnf.d empty. 3. A new autopkgtest, drop-in-directory, puts a snippet there that activates the legacy provider, checks that MD4 and SHA-256 work, then removes it and checks that legacy is gone. What I measured in a testing container, on 3.6.5-1 and on the built 3.6.5-2: - An empty or a missing directory changes nothing, so the copy of openssl.cnf in libcrypto3-udeb is safe. - A snippet with `legacy = legacy_sect` in [provider_sect] and `activate = 1` in [default_sect] gives both providers. - A snippet that activates legacy alone drops the default provider, which is why the comment asks for `activate = 1` in [default_sect]. - A snippet that cannot be parsed makes OpenSSL ignore the whole configuration, as a broken openssl.cnf does today. - OpenSSL reads the directory in readdir order (OPENSSL_DIR_read in crypto/conf/conf_def.c), so the comment asks snippets not to set the same name. - The package builds and its test suite passes (4980 tests). - The new test script, run as root, fails on 3.6.5-1 with the directory made by hand and passes after upgrading to 3.6.5-2; the unmodified conffile is replaced on upgrade. Fedora ships the same idea as /etc/pki/tls/openssl.d (its openssl.spec creates it and lists it as %dir). If you prefer another name or another place for the include, I will change it. Daniel
diff -Nru openssl-3.6.5/debian/changelog openssl-3.6.5/debian/changelog --- openssl-3.6.5/debian/changelog 2026-09-29 19:39:32.000000000 +0000 +++ openssl-3.6.5/debian/changelog 2026-11-07 23:07:39.000000000 +0000 @@ -1,3 +1,13 @@ +openssl (3.6.5-2) UNRELEASED; urgency=medium + + * Read configuration snippets from /etc/ssl/openssl.cnf.d at the end of + /etc/ssl/openssl.cnf and ship the directory empty, so packages that ship + an OpenSSL provider and administrators can add configuration without + editing the conffile (Closes: #1152488). + * debian/tests: a snippet there activates the legacy provider. + + -- Daniel Campos Ramos <[email protected]> Sat, 07 Nov 2026 23:07:39 +0000 + openssl (3.6.5-1) unstable; urgency=medium * Import 3.6.5 diff -Nru openssl-3.6.5/debian/openssl.dirs openssl-3.6.5/debian/openssl.dirs --- openssl-3.6.5/debian/openssl.dirs 2026-09-29 19:29:57.000000000 +0000 +++ openssl-3.6.5/debian/openssl.dirs 2026-11-07 23:07:39.000000000 +0000 @@ -2,3 +2,4 @@ etc/ssl/private usr/bin usr/lib +etc/ssl/openssl.cnf.d diff -Nru openssl-3.6.5/debian/patches/Read-configuration-snippets-from-etc-ssl-openssl.cnf.d.patch openssl-3.6.5/debian/patches/Read-configuration-snippets-from-etc-ssl-openssl.cnf.d.patch --- openssl-3.6.5/debian/patches/Read-configuration-snippets-from-etc-ssl-openssl.cnf.d.patch 1970-01-01 00:00:00.000000000 +0000 +++ openssl-3.6.5/debian/patches/Read-configuration-snippets-from-etc-ssl-openssl.cnf.d.patch 2026-11-07 23:07:39.000000000 +0000 @@ -0,0 +1,33 @@ +From: Daniel Campos Ramos <[email protected]> +Date: Sat, 7 Nov 2026 20:10:00 -0300 +Subject: Read configuration snippets from /etc/ssl/openssl.cnf.d + +Packages that ship an OpenSSL provider (openssl-provider-fips, pkcs11-provider, +tpm2-openssl, openssl-provider-qat) cannot activate it system-wide without +the administrator editing /etc/ssl/openssl.cnf. Read every .cnf and .conf +file in /etc/ssl/openssl.cnf.d at the end of the file, so a package or an +administrator can add a snippet instead. An empty or missing directory +changes nothing. + +Bug-Debian: https://bugs.debian.org/1152488 +Forwarded: not-needed +--- +--- a/apps/openssl.cnf ++++ b/apps/openssl.cnf +@@ -388,3 +388,16 @@ + # Certificate revocation + cmd = rr + oldcert = $insta::certout # insta.cert.pem ++ ++# Configuration snippets. ++# Every file ending in .cnf or .conf in /etc/ssl/openssl.cnf.d is read here, ++# after the rest of this file, so packages that ship an OpenSSL provider and ++# administrators can add configuration without editing this file. ++# A snippet starts with its own section header, for example [provider_sect]. ++# Activating any provider turns off the implicit activation of the default ++# provider, so a snippet that activates one should also set "activate = 1" ++# in [default_sect]. ++# OpenSSL reads the directory in no particular order, so two snippets should ++# not set the same name in the same section. ++# A snippet that cannot be parsed makes OpenSSL ignore this whole file. ++.include /etc/ssl/openssl.cnf.d diff -Nru openssl-3.6.5/debian/patches/series openssl-3.6.5/debian/patches/series --- openssl-3.6.5/debian/patches/series 2026-09-29 19:30:54.000000000 +0000 +++ openssl-3.6.5/debian/patches/series 2026-11-07 23:07:39.000000000 +0000 @@ -1,3 +1,4 @@ debian-targets.patch man-section.patch Configure-allow-to-enable-ktls-if-target-does-not-start-w.patch +Read-configuration-snippets-from-etc-ssl-openssl.cnf.d.patch diff -Nru openssl-3.6.5/debian/tests/control openssl-3.6.5/debian/tests/control --- openssl-3.6.5/debian/tests/control 2026-09-29 19:29:57.000000000 +0000 +++ openssl-3.6.5/debian/tests/control 2026-11-07 23:07:39.000000000 +0000 @@ -1,3 +1,7 @@ Tests: run-25-test-verify Depends: openssl, perl Restrictions: rw-build-tree, allow-stderr + +Tests: drop-in-directory +Depends: openssl, openssl-provider-legacy +Restrictions: needs-root, allow-stderr diff -Nru openssl-3.6.5/debian/tests/drop-in-directory openssl-3.6.5/debian/tests/drop-in-directory --- openssl-3.6.5/debian/tests/drop-in-directory 1970-01-01 00:00:00.000000000 +0000 +++ openssl-3.6.5/debian/tests/drop-in-directory 2026-11-07 23:07:39.000000000 +0000 @@ -0,0 +1,31 @@ +#!/bin/sh +# /etc/ssl/openssl.cnf reads the .cnf and .conf files in /etc/ssl/openssl.cnf.d +# (#1152488). A snippet there that activates the legacy provider, and keeps the +# default one, takes effect; without it only the default provider is active. +set -e +dir=/etc/ssl/openssl.cnf.d +snippet="$dir/autopkgtest-legacy.cnf" + +test -d "$dir" +trap 'rm -f "$snippet"' EXIT + +providers() { openssl list -providers; } + +providers | grep -q 'OpenSSL Default Provider' +if providers | grep -q 'OpenSSL Legacy Provider'; then + echo "the legacy provider is active before any snippet" >&2 + exit 1 +fi + +printf '[provider_sect]\nlegacy = legacy_sect\n\n[legacy_sect]\nactivate = 1\n\n[default_sect]\nactivate = 1\n' > "$snippet" +providers | grep -q 'OpenSSL Legacy Provider' +providers | grep -q 'OpenSSL Default Provider' +echo hello | openssl dgst -md4 > /dev/null +echo hello | openssl dgst -sha256 > /dev/null + +rm -f "$snippet" +if providers | grep -q 'OpenSSL Legacy Provider'; then + echo "the legacy provider is still active after its snippet was removed" >&2 + exit 1 +fi +echo "drop-in directory: ok"
