Upgrade OpenSSL from 3.5.7 to 4.0.1 and fix all dependent recipe
breakages in oe-core.
OpenSSL 4.0 is a major version bump that removes the ENGINE API,
removes the c_rehash script, makes ASN1_STRING fully opaque, adds
const qualifiers to X509 accessor return types, and removes
per-version TLS method functions.
This series fixes python3, socat, serf, u-boot, and kea to build
against OpenSSL 4.0.
Changes since v3:
- u-boot: fix malformed patch (hunk line count mismatch from pkcs11
modification). Regenerated patch properly.
Changes since v2:
- openssl: remove c_rehash from MULTILIB_SCRIPTS and FILES (fixes
multilib do_package failure)
- python3: add backports from CPython PR #149783 for the
got_eof_error fix (fixes test_https/test_https_sni ptest failures
caused by OpenSSL 4.0 changing EOF signaling behavior)
- u-boot: update Upstream-Status to lore link per reviewer feedback,
include doc/Dockerfile hunks from upstream v4, make pkcs11
provider loading optional (fixes fitimage signing failure when
pkcs11-provider is not installed)
Changes since v1:
- u-boot: move patch from u-boot-tools to u-boot-common.inc (fixes
riscv64 build failure)
- serf/socat: fix Upstream-Status tags
Testing:
- lib32-openssl do_package: passes (multilib fix verified)
- python3 test_https/test_https_sni: passes locally
- u-boot fitimage signing: passes locally
- bitbake world -k with meta-oe/meta-networking/meta-python/meta-perl:
oe-core recipes all build. meta-oe breakages are in their layer.
Known breakages in meta-openembedded (not addressed here):
- freediameter: RDEPENDS on removed openssl-engines package
- pkcs11-helper, krb5, libcoap, grpc, libnet-ssleay-perl, libesmtp,
unbound, wvstreams: various OpenSSL 4.0 API incompatibilities
Notes on upstream status:
- python3: CPython PR #149783 deferred until after Python 3.15.1
- socat: submitted to [email protected]
- serf: fix in trunk (r1935023), no release yet
- u-boot: v4 on ML under review
- kea: tracked as issue #4673
Jaipaul Cheernam (6):
openssl: upgrade 3.5.7 -> 4.0.1
python3: backport OpenSSL 4.0 support from upstream
socat: fix build with OpenSSL 4.0
serf: fix build with OpenSSL 4.0
u-boot: fix build with OpenSSL 4.0
kea: fix build with OpenSSL 4.0
...Add-support-for-OpenSSL-Provider-API.patch | 340 ++++++++++++++++
meta/recipes-bsp/u-boot/u-boot-common.inc | 1 +
...-qualifiers-to-OpenSSL-X509-pointers.patch | 49 +++
meta/recipes-connectivity/kea/kea_3.2.0.bb | 1 +
...ke-history-reporting-when-test-fails.patch | 366 ------------------
...1-Configure-do-not-tweak-mips-cflags.patch | 6 +-
...sysroot-and-debug-prefix-map-from-co.patch | 11 +-
.../0001-extend-check_cwm-test-timeout.patch | 4 +-
.../{openssl_3.5.7.bb => openssl_4.0.1.bb} | 28 +-
...penSSL-4.0-use-ASN1_STRING-accessors.patch | 31 ++
.../socat/socat_1.8.1.3.bb | 1 +
...146207-Add-support-for-OpenSSL-4.0.0.patch | 257 ++++++++++++
...Update-_ssl._SSLSocket-for-OpenSSL-4.patch | 234 +++++++++++
...utdown-test-in-test_ssl.test_got_eof.patch | 41 ++
.../recipes-devtools/python/python3_3.14.7.bb | 3 +
...penSSL-4.0-use-ASN1_STRING-accessors.patch | 35 ++
meta/recipes-support/serf/serf_1.3.10.bb | 1 +
17 files changed, 1012 insertions(+), 397 deletions(-)
create mode 100644
meta/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API.patch
create mode 100644
meta/recipes-connectivity/kea/files/0001-Add-const-qualifiers-to-OpenSSL-X509-pointers.patch
delete mode 100644
meta/recipes-connectivity/openssl/openssl/0001-Added-handshake-history-reporting-when-test-fails.patch
rename meta/recipes-connectivity/openssl/{openssl_3.5.7.bb =>
openssl_4.0.1.bb} (87%)
create mode 100644
meta/recipes-connectivity/socat/files/0001-Fix-build-with-OpenSSL-4.0-use-ASN1_STRING-accessors.patch
create mode 100644
meta/recipes-devtools/python/python3/0001-gh-146207-Add-support-for-OpenSSL-4.0.0.patch
create mode 100644
meta/recipes-devtools/python/python3/0002-gh-148292-Update-_ssl._SSLSocket-for-OpenSSL-4.patch
create mode 100644
meta/recipes-devtools/python/python3/0003-gh-148292-Remove-shutdown-test-in-test_ssl.test_got_eof.patch
create mode 100644
meta/recipes-support/serf/serf/0001-Fix-build-with-OpenSSL-4.0-use-ASN1_STRING-accessors.patch
-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#243992):
https://lists.openembedded.org/g/openembedded-core/message/243992
Mute This Topic: https://lists.openembedded.org/mt/120878891/21656
Group Owner: [email protected]
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub
[[email protected]]
-=-=-=-=-=-=-=-=-=-=-=-
