On Thu, 2026-08-20 at 20:10 +0200, Jaipaul Cheernam via lists.openembedded.org wrote: > This series upgrades OpenSSL from 3.5.7 to 4.0.1 and fixes all > dependent recipes that break due to API changes in OpenSSL 4.0. > > Changes since v1: > - u-boot: moved patch from u-boot-tools_2026.07.bb to u-boot-common.inc > so it applies to both u-boot and u-boot-tools (fixes riscv64 build > failure reported from autobuilder) > - u-boot, kea: corrected Upstream-Status from Backport to Submitted > (neither has been merged upstream yet) > - Dropped rust 1.97.1 from this series (now merged in master) > - No external dependencies — wpa-supplicant 2.12 and rust 1.97.1 > are both merged in master now > > OpenSSL 4.0 is a major release with several breaking changes: > - ENGINE API fully removed > - SSLv3 support removed > - Per-version TLS method functions (SSLv3_method etc.) removed > - ASN1_STRING made opaque > - const qualifiers added to X509 getter functions > > Patches: > 1/6 openssl: upgrade 3.5.7 -> 4.0.1 > 2/6 python3: backport OpenSSL 4.0 support (CPython commit 3364e7e62fa2) > 3/6 socat: fix ASN1_STRING opaque struct access > 4/6 serf: fix ASN1_STRING opaque struct access > 5/6 u-boot: backport Provider API (replaces removed ENGINE API) > 6/6 kea: add const qualifiers to X509 pointers > > Testing: > - bitbake world -k: passes on qemux86-64, qemuarm64, qemuarm, qemuriscv64 > - openssl ptest on qemux86-64: 362 files, 4310 tests, all passed > (338 passed, 24 skipped - fips/lms/rc5/tfo/compression - all expected) > > Sharing this to get feedback and see if there are other recipes that > break with OpenSSL 4.0 that we may have missed. > > Notes on upstream status: > - python3: fix on CPython main, backport PR #146403 closed without merge > - socat: submitted to [email protected] > - serf: fix in trunk (r1935023), no release yet > - u-boot: PR #918 open since March 2026, under review > - kea: tracked as issue #4673, milestone kea3.3.2 > > Jaipaul Cheernam (6): > openssl: upgrade 3.5.7 -> 4.0.1 > python3: backport OpenSSL 4.0 support from upstream > socat: fix build with OpenSSL 4.0 > serf: fix build with OpenSSL 4.0 > u-boot: fix build with OpenSSL 4.0 > kea: fix build with OpenSSL 4.0
Thanks for putting this together. It is definitely getting there but there were some issues. There are some failing selftests: https://autobuilder.yoctoproject.org/valkyrie/#/builders/35/builds/4629 https://autobuilder.yoctoproject.org/valkyrie/#/builders/48/builds/4449 and python ptest doesn't look happy: https://autobuilder.yoctoproject.org/valkyrie/#/builders/73/builds/4352 https://autobuilder.yoctoproject.org/valkyrie/#/builders/110/builds/1004 and multilib looks broken: https://autobuilder.yoctoproject.org/valkyrie/#/builders/92/builds/4423 https://autobuilder.yoctoproject.org/valkyrie/#/builders/59/builds/4476 Nothing too unexpected with a change that invasive though! Cheers, Richard
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#243955): https://lists.openembedded.org/g/openembedded-core/message/243955 Mute This Topic: https://lists.openembedded.org/mt/120850400/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
