Re: [OE-core] [PATCH] openssl: Upgrade 4.0.3 -> 4.1.0

["Mathieu Dubois-Briand" <mathieu.dubois-briand@bootlin.com>]

On Mon Oct 26, 2026 at 7:35 PM CET, Jaipaul Cheernam wrote:
>   Release information [1]:
>
>   OpenSSL 4.1.0 is a feature release adding significant new functionality to OpenSSL.
>
>   This release incorporates the following potentially significant or incompatible changes:
>
>   - Added VC-WIN32-MSVC2013 and VC-WIN64A-MSVC2013 build targets to provide internal functions for bridging the gaps in C99 standard support that are present in MSVC 2013.
>   - Added optimized ML-DSA and ML-KEM NTT operations on ppc64le; optimized ML-DSA operations on x86_64; AVX-512-optimized SHAKE x4 operations for ML-DSA on x86_64; AVX-512 and VAES optimizations for AES-CBC
>   decryption on x86_64.
>   - Changed tsget utility to use Net::Curl::Easy (from the Net-Curl CPAN distribution) instead of the abandoned WWW::Curl::Easy. Users who rely on tsget should install Net::Curl::Easy before upgrading.
>   - Dropped Windows-on-Itanium (VC-WIN64I) and Windows CE (VC-CE) targets from Configurations.
>   - Dropped no-ecdsa and no-ecdh options from Configure, as these options did not really disable the implementations. Use no-ec to disable the elliptic curve support.
>
>   This release adds the following new features:
>
>   - Support for DTLS 1.3 (RFC 9147). Refer to the ossl-guide-dtlsv13(7) manual page for details.
>   - Support for RFC 8701 GREASE (Generate Random Extensions And Sustain Extensibility).
>   - DTLS support in the SSL listener API.
>   - Support for IKEV2 KDF.
>   - Initial support for the Elbrus2000 (e2k) architecture.
>
>   [1] https://github.com/openssl/openssl/blob/openssl-4.1/NEWS.md#major-changes-between-openssl-40-and-openssl-410-23-oct-2026
>
> - Refresh existing patches
> - Verified with world
>
> Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
> ---

Hi Jaipaul,

Thanks for the upgrade. This is breaking python3 crypto:

Failed ptests:
{'python3-cryptography': ['tests/hazmat/primitives/utils.py:TestAESModeGCM.test_gcm',
                          'tests/hazmat/primitives/test_sm4.py:TestSM4ModeGCM.test_invalid_tag[vector0]',
                          'tests/hazmat/primitives/test_ssh.py:TestOpenSSHSerialization.test_load_ssh_private_key_invalid_tag']}

Failed ptests:
{'python3-pyopenssl': ['tests/test_ssl.py:TestMemoryBIO.test_memory_connect']}

https://autobuilder.yoctoproject.org/valkyrie/#/builders/73/builds/4822

Can you have a look at the issue?

Thanks,
Mathieu

-- 
Mathieu Dubois-Briand, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com