[PATCH] openssl: Upgrade 4.0.3 -> 4.1.0

[PATCH] openssl: Upgrade 4.0.3 -> 4.1.0

[Jaipaul Cheernam]

  Release information [1]:

  OpenSSL 4.1.0 is a feature release adding significant new functionality to OpenSSL.

  This release incorporates the following potentially significant or incompatible changes:

  - Added VC-WIN32-MSVC2013 and VC-WIN64A-MSVC2013 build targets to provide internal functions for bridging the gaps in C99 standard support that are present in MSVC 2013.
  - Added optimized ML-DSA and ML-KEM NTT operations on ppc64le; optimized ML-DSA operations on x86_64; AVX-512-optimized SHAKE x4 operations for ML-DSA on x86_64; AVX-512 and VAES optimizations for AES-CBC
  decryption on x86_64.
  - Changed tsget utility to use Net::Curl::Easy (from the Net-Curl CPAN distribution) instead of the abandoned WWW::Curl::Easy. Users who rely on tsget should install Net::Curl::Easy before upgrading.
  - Dropped Windows-on-Itanium (VC-WIN64I) and Windows CE (VC-CE) targets from Configurations.
  - Dropped no-ecdsa and no-ecdh options from Configure, as these options did not really disable the implementations. Use no-ec to disable the elliptic curve support.

  This release adds the following new features:

  - Support for DTLS 1.3 (RFC 9147). Refer to the ossl-guide-dtlsv13(7) manual page for details.
  - Support for RFC 8701 GREASE (Generate Random Extensions And Sustain Extensibility).
  - DTLS support in the SSL listener API.
  - Support for IKEV2 KDF.
  - Initial support for the Elbrus2000 (e2k) architecture.

  [1] https://github.com/openssl/openssl/blob/openssl-4.1/NEWS.md#major-changes-between-openssl-40-and-openssl-410-23-oct-2026

- Refresh existing patches
- Verified with world

Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
---
 .../0001-Configure-do-not-tweak-mips-cflags.patch  |  6 +++---
 ...trip-sysroot-and-debug-prefix-map-from-co.patch | 14 +++++++-------
 .../0001-extend-check_cwm-test-timeout.patch       |  2 +-
 .../openssl/{openssl_4.0.3.bb => openssl_4.1.0.bb} |  2 +-
 4 files changed, 12 insertions(+), 12 deletions(-)
 rename meta/recipes-connectivity/openssl/{openssl_4.0.3.bb => openssl_4.1.0.bb} (99%)

diff --git a/meta/recipes-connectivity/openssl/openssl/0001-Configure-do-not-tweak-mips-cflags.patch b/meta/recipes-connectivity/openssl/openssl/0001-Configure-do-not-tweak-mips-cflags.patch
index 77bfe4e4e52..2991082a5f5 100644
--- a/meta/recipes-connectivity/openssl/openssl/0001-Configure-do-not-tweak-mips-cflags.patch
+++ b/meta/recipes-connectivity/openssl/openssl/0001-Configure-do-not-tweak-mips-cflags.patch
@@ -1,4 +1,4 @@
-From b5cee0cb0f14a78056ef7722a34b361491f1fdda Mon Sep 17 00:00:00 2001
+From 89d2702e00b0826fded82b06a9866e0fe7380540 Mon Sep 17 00:00:00 2001
 From: Alexander Kanavin <alex@linutronix.de>
 Date: Tue, 30 May 2023 09:11:27 -0700
 Subject: [PATCH] Configure: do not tweak mips cflags
@@ -17,10 +17,10 @@ Signed-off-by: Tim Orling <tim.orling@konsulko.com>
  1 file changed, 10 deletions(-)
 
 diff --git a/Configure b/Configure
-index c05a30b..db8adee 100755
+index e66424a..62141fe 100755
 --- a/Configure
 +++ b/Configure
-@@ -1575,16 +1575,6 @@ if ($target =~ /^mingw/ && `$config{CC} --target-help 2>&1` =~ m/-mno-cygwin/m)
+@@ -1617,16 +1617,6 @@ if ($target =~ /^mingw/ && `$config{CC} --target-help 2>&1` =~ m/-mno-cygwin/m)
          push @{$config{shared_ldflag}}, "-mno-cygwin";
          }
  
diff --git a/meta/recipes-connectivity/openssl/openssl/0001-buildinfo-strip-sysroot-and-debug-prefix-map-from-co.patch b/meta/recipes-connectivity/openssl/openssl/0001-buildinfo-strip-sysroot-and-debug-prefix-map-from-co.patch
index 1d9e7539f67..04f46a3d3e2 100644
--- a/meta/recipes-connectivity/openssl/openssl/0001-buildinfo-strip-sysroot-and-debug-prefix-map-from-co.patch
+++ b/meta/recipes-connectivity/openssl/openssl/0001-buildinfo-strip-sysroot-and-debug-prefix-map-from-co.patch
@@ -1,4 +1,4 @@
-From 6df53bfebcf8ca65910a18220a6576fb110918a5 Mon Sep 17 00:00:00 2001
+From 4df92463252f8f0695db0143d3a26566a1736b2c Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Martin=20Hundeb=C3=B8ll?= <martin@geanix.com>
 Date: Tue, 6 Nov 2018 14:50:47 +0100
 Subject: [PATCH] buildinfo: strip sysroot and debug-prefix-map from compiler
@@ -34,12 +34,12 @@ Signed-off-by: Khem Raj <raj.khem@gmail.com>
  2 files changed, 16 insertions(+), 2 deletions(-)
 
 diff --git a/Configurations/unix-Makefile.tmpl b/Configurations/unix-Makefile.tmpl
-index eff66e5..bc48f51 100644
+index f8a5b16..807439f 100644
 --- a/Configurations/unix-Makefile.tmpl
 +++ b/Configurations/unix-Makefile.tmpl
-@@ -503,13 +503,27 @@ BIN_LDFLAGS={- join(' ', $target{bin_lflags} || (),
-                          '$(CNF_LDFLAGS)', '$(LDFLAGS)') -}
- BIN_EX_LIBS=$(CNF_EX_LIBS) $(EX_LIBS)
+@@ -532,13 +532,27 @@ BIN_EX_LIBS=$(CNF_EX_LIBS) $(EX_LIBS)
+ CMOCKA_LIBS={- $config{cmocka_libs} // '' -}
+ DETOURS_LIBS={- $config{detours_libs} // '' -}
  
 -# CPPFLAGS_Q is used for one thing only: to build up buildinf.h
 +# *_Q variables are used for one thing only: to build up buildinf.h
@@ -67,10 +67,10 @@ index eff66e5..bc48f51 100644
  
  # For x86 assembler: Set PROCESSOR to 386 if you want to support
 diff --git a/crypto/build.info b/crypto/build.info
-index 8e4a885..95b0902 100644
+index 422f4aa..3573af9 100644
 --- a/crypto/build.info
 +++ b/crypto/build.info
-@@ -114,7 +114,7 @@ DEFINE[../libcrypto]=$UPLINKDEF
+@@ -113,7 +113,7 @@ DEFINE[../libcrypto]=$UPLINKDEF
  
  DEPEND[info.o]=buildinf.h
  DEPEND[cversion.o]=buildinf.h
diff --git a/meta/recipes-connectivity/openssl/openssl/0001-extend-check_cwm-test-timeout.patch b/meta/recipes-connectivity/openssl/openssl/0001-extend-check_cwm-test-timeout.patch
index 26622fd1b18..29b9728479f 100644
--- a/meta/recipes-connectivity/openssl/openssl/0001-extend-check_cwm-test-timeout.patch
+++ b/meta/recipes-connectivity/openssl/openssl/0001-extend-check_cwm-test-timeout.patch
@@ -1,4 +1,4 @@
-From 07bbd037ca61264bcc311856a119b664ce13f586 Mon Sep 17 00:00:00 2001
+From ff0de34474c0dfec4f13dfb4079689c8731bf6ce Mon Sep 17 00:00:00 2001
 From: Gyorgy Sarvari <skandigraun@gmail.com>
 Date: Thu, 23 Oct 2025 11:24:36 +0200
 Subject: [PATCH] extend check_cwm test timeout
diff --git a/meta/recipes-connectivity/openssl/openssl_4.0.3.bb b/meta/recipes-connectivity/openssl/openssl_4.1.0.bb
similarity index 99%
rename from meta/recipes-connectivity/openssl/openssl_4.0.3.bb
rename to meta/recipes-connectivity/openssl/openssl_4.1.0.bb
index 122bf61f595..1e47c3cf348 100644
--- a/meta/recipes-connectivity/openssl/openssl_4.0.3.bb
+++ b/meta/recipes-connectivity/openssl/openssl_4.1.0.bb
@@ -18,7 +18,7 @@ SRC_URI:append:class-nativesdk = " \
            file://environment.d-openssl.sh \
            "
 
-SRC_URI[sha256sum] = "325b5c806167c13b40b1ffeadfe0248197c00eccc4cf123ec1e28d2d2fd216d9"
+SRC_URI[sha256sum] = "50c17baf54cb008f6ce42d50deb4b28050a1aad711636cabd4b241c7e90cc2fd"
 
 inherit lib_package multilib_header ptest perlnative manpages
 

Re: [OE-core] [PATCH] openssl: Upgrade 4.0.3 -> 4.1.0

[Mathieu Dubois-Briand]

On Mon Oct 26, 2026 at 7:35 PM CET, Jaipaul Cheernam wrote:
>   Release information [1]:
>
>   OpenSSL 4.1.0 is a feature release adding significant new functionality to OpenSSL.
>
>   This release incorporates the following potentially significant or incompatible changes:
>
>   - Added VC-WIN32-MSVC2013 and VC-WIN64A-MSVC2013 build targets to provide internal functions for bridging the gaps in C99 standard support that are present in MSVC 2013.
>   - Added optimized ML-DSA and ML-KEM NTT operations on ppc64le; optimized ML-DSA operations on x86_64; AVX-512-optimized SHAKE x4 operations for ML-DSA on x86_64; AVX-512 and VAES optimizations for AES-CBC
>   decryption on x86_64.
>   - Changed tsget utility to use Net::Curl::Easy (from the Net-Curl CPAN distribution) instead of the abandoned WWW::Curl::Easy. Users who rely on tsget should install Net::Curl::Easy before upgrading.
>   - Dropped Windows-on-Itanium (VC-WIN64I) and Windows CE (VC-CE) targets from Configurations.
>   - Dropped no-ecdsa and no-ecdh options from Configure, as these options did not really disable the implementations. Use no-ec to disable the elliptic curve support.
>
>   This release adds the following new features:
>
>   - Support for DTLS 1.3 (RFC 9147). Refer to the ossl-guide-dtlsv13(7) manual page for details.
>   - Support for RFC 8701 GREASE (Generate Random Extensions And Sustain Extensibility).
>   - DTLS support in the SSL listener API.
>   - Support for IKEV2 KDF.
>   - Initial support for the Elbrus2000 (e2k) architecture.
>
>   [1] https://github.com/openssl/openssl/blob/openssl-4.1/NEWS.md#major-changes-between-openssl-40-and-openssl-410-23-oct-2026
>
> - Refresh existing patches
> - Verified with world
>
> Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
> ---

Hi Jaipaul,

Thanks for the upgrade. This is breaking python3 crypto:

Failed ptests:
{'python3-cryptography': ['tests/hazmat/primitives/utils.py:TestAESModeGCM.test_gcm',
                          'tests/hazmat/primitives/test_sm4.py:TestSM4ModeGCM.test_invalid_tag[vector0]',
                          'tests/hazmat/primitives/test_ssh.py:TestOpenSSHSerialization.test_load_ssh_private_key_invalid_tag']}

Failed ptests:
{'python3-pyopenssl': ['tests/test_ssl.py:TestMemoryBIO.test_memory_connect']}

https://autobuilder.yoctoproject.org/valkyrie/#/builders/73/builds/4822

Can you have a look at the issue?

Thanks,
Mathieu

-- 
Mathieu Dubois-Briand, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com

[PATCH v2 1/2] python3-cryptography: backport InvalidTag fix for openssl 4.1.0

[Jaipaul Cheernam]

  openssl 4.1.0 changed the AEAD error queue, so bad-tag ptests now raise
  ValueError instead of InvalidTag. Backport pyca/cryptography#15596.

Backport of https://github.com/pyca/cryptography/pull/15596

Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
---
 .../python/python3-cryptography.bb            |  1 +
 ...-on-AEAD-finalize-failure-regardless.patch | 53 +++++++++++++++++++
 2 files changed, 54 insertions(+)
 create mode 100644 meta/recipes-devtools/python/python3-cryptography/0001-Raise-InvalidTag-on-AEAD-finalize-failure-regardless.patch

diff --git a/meta/recipes-devtools/python/python3-cryptography.bb b/meta/recipes-devtools/python/python3-cryptography.bb
index 5a1ce9fe2d..311b7313f0 100644
--- a/meta/recipes-devtools/python/python3-cryptography.bb
+++ b/meta/recipes-devtools/python/python3-cryptography.bb
@@ -16,6 +16,7 @@ SRC_URI[sha256sum] = "7b46165bb56eb4704e2eaaf86f3c940d19154535d9b0ca7d6d590b0406
 SRC_URI += "file://0001-pyproject.toml-remove-benchmark-disable-option.patch \
             file://check-memfree.py \
             file://run-ptest \
+            file://0001-Raise-InvalidTag-on-AEAD-finalize-failure-regardless.patch \
            "
 
 require ${BPN}-crates.inc
diff --git a/meta/recipes-devtools/python/python3-cryptography/0001-Raise-InvalidTag-on-AEAD-finalize-failure-regardless.patch b/meta/recipes-devtools/python/python3-cryptography/0001-Raise-InvalidTag-on-AEAD-finalize-failure-regardless.patch
new file mode 100644
index 0000000000..4c3be321ee
--- /dev/null
+++ b/meta/recipes-devtools/python/python3-cryptography/0001-Raise-InvalidTag-on-AEAD-finalize-failure-regardless.patch
@@ -0,0 +1,53 @@
+From 098b3b1816c3541847b507b2b1e0ae2e3aa85102 Mon Sep 17 00:00:00 2001
+From: Alex Gaynor <alex.gaynor@gmail.com>
+Date: Sat, 5 Sep 2026 17:11:53 -0400
+Subject: [PATCH] Raise InvalidTag on AEAD finalize failure regardless of error
+ queue (#15596)
+
+OpenSSL f7d2d2acef (openssl/openssl#32587) now pushes PROV_R_BAD_DECRYPT
+onto the error queue when an AEAD tag check fails in EVP_DecryptFinal_ex.
+Our finalize only mapped failures to InvalidTag when the error queue was
+empty, so on OpenSSL master a bad GCM tag surfaced as a ValueError about
+block length instead.
+
+For modes with an authentication tag, treat any finalize failure as
+InvalidTag. Older OpenSSL, BoringSSL, AWS-LC, and LibreSSL still leave
+the queue empty, so behavior there is unchanged.
+
+Claude-Session: https://claude.ai/code/session_01Eg4jjDRiLcBQrdEFsL3fCD
+
+Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
+
+Upstream-Status: Backport [https://github.com/pyca/cryptography/commit/e83bbe58e373536636baaa7c33a64a6e8f04c953]
+Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
+---
+ src/rust/src/backend/ciphers.rs | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+diff --git a/src/rust/src/backend/ciphers.rs b/src/rust/src/backend/ciphers.rs
+index f850bef..073bee3 100644
+--- a/src/rust/src/backend/ciphers.rs
++++ b/src/rust/src/backend/ciphers.rs
+@@ -233,12 +233,16 @@ impl CipherContext {
+         py: pyo3::Python<'p>,
+     ) -> CryptographyResult<pyo3::Bound<'p, pyo3::types::PyBytes>> {
+         let mut out_buf = vec![0; self.ctx.block_size()];
+-        let n = self.ctx.cipher_final(&mut out_buf).or_else(|e| {
+-            if e.errors().is_empty()
+-                && self
+-                    .py_mode
+-                    .bind(py)
+-                    .is_instance(&types::MODE_WITH_AUTHENTICATION_TAG.get(py)?)?
++        let n = self.ctx.cipher_final(&mut out_buf).or_else(|_| {
++            // For authenticated modes, the only way finalize can fail is a
++            // tag mismatch. Older OpenSSL versions (and BoringSSL, AWS-LC,
++            // and LibreSSL) leave the error queue empty in that case, while
++            // OpenSSL >= 4.1 pushes PROV_R_BAD_DECRYPT, so we can't key on
++            // the error queue.
++            if self
++                .py_mode
++                .bind(py)
++                .is_instance(&types::MODE_WITH_AUTHENTICATION_TAG.get(py)?)?
+             {
+                 return Err(CryptographyError::from(exceptions::InvalidTag::new_err(())));
+             }

[PATCH v2 2/2] openssl: Upgrade 4.0.3 -> 4.1.0

[Jaipaul Cheernam]

  Release information [1]:

  OpenSSL 4.1.0 is a feature release adding significant new functionality to OpenSSL.

  This release incorporates the following potentially significant or incompatible changes:

  - Added VC-WIN32-MSVC2013 and VC-WIN64A-MSVC2013 build targets to provide internal functions for bridging the gaps in C99 standard support that are present in MSVC 2013.
  - Added optimized ML-DSA and ML-KEM NTT operations on ppc64le; optimized ML-DSA operations on x86_64; AVX-512-optimized SHAKE x4 operations for ML-DSA on x86_64; AVX-512 and VAES optimizations for AES-CBC
  decryption on x86_64.
  - Changed tsget utility to use Net::Curl::Easy (from the Net-Curl CPAN distribution) instead of the abandoned WWW::Curl::Easy. Users who rely on tsget should install Net::Curl::Easy before upgrading.
  - Dropped Windows-on-Itanium (VC-WIN64I) and Windows CE (VC-CE) targets from Configurations.
  - Dropped no-ecdsa and no-ecdh options from Configure, as these options did not really disable the implementations. Use no-ec to disable the elliptic curve support.

  This release adds the following new features:

  - Support for DTLS 1.3 (RFC 9147). Refer to the ossl-guide-dtlsv13(7) manual page for details.
  - Support for RFC 8701 GREASE (Generate Random Extensions And Sustain Extensibility).
  - DTLS support in the SSL listener API.
  - Support for IKEV2 KDF.
  - Initial support for the Elbrus2000 (e2k) architecture.

  [1] https://github.com/openssl/openssl/blob/openssl-4.1/NEWS.md#major-changes-between-openssl-40-and-openssl-410-23-oct-2026

- Refresh existing patches
- Verified with world
- Verified ptest python3-cryptography
   TOTAL: 4650
   PASS: 4443
   FAIL: 0
   ERROR: 0
  TOTAL: 1  FAIL: 0

Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
---
 .../0001-Configure-do-not-tweak-mips-cflags.patch  |  6 +++---
 ...trip-sysroot-and-debug-prefix-map-from-co.patch | 14 +++++++-------
 .../0001-extend-check_cwm-test-timeout.patch       |  2 +-
 .../openssl/{openssl_4.0.3.bb => openssl_4.1.0.bb} |  2 +-
 4 files changed, 12 insertions(+), 12 deletions(-)
 rename meta/recipes-connectivity/openssl/{openssl_4.0.3.bb => openssl_4.1.0.bb} (99%)

diff --git a/meta/recipes-connectivity/openssl/openssl/0001-Configure-do-not-tweak-mips-cflags.patch b/meta/recipes-connectivity/openssl/openssl/0001-Configure-do-not-tweak-mips-cflags.patch
index 77bfe4e4e5..2991082a5f 100644
--- a/meta/recipes-connectivity/openssl/openssl/0001-Configure-do-not-tweak-mips-cflags.patch
+++ b/meta/recipes-connectivity/openssl/openssl/0001-Configure-do-not-tweak-mips-cflags.patch
@@ -1,4 +1,4 @@
-From b5cee0cb0f14a78056ef7722a34b361491f1fdda Mon Sep 17 00:00:00 2001
+From 89d2702e00b0826fded82b06a9866e0fe7380540 Mon Sep 17 00:00:00 2001
 From: Alexander Kanavin <alex@linutronix.de>
 Date: Tue, 30 May 2023 09:11:27 -0700
 Subject: [PATCH] Configure: do not tweak mips cflags
@@ -17,10 +17,10 @@ Signed-off-by: Tim Orling <tim.orling@konsulko.com>
  1 file changed, 10 deletions(-)
 
 diff --git a/Configure b/Configure
-index c05a30b..db8adee 100755
+index e66424a..62141fe 100755
 --- a/Configure
 +++ b/Configure
-@@ -1575,16 +1575,6 @@ if ($target =~ /^mingw/ && `$config{CC} --target-help 2>&1` =~ m/-mno-cygwin/m)
+@@ -1617,16 +1617,6 @@ if ($target =~ /^mingw/ && `$config{CC} --target-help 2>&1` =~ m/-mno-cygwin/m)
          push @{$config{shared_ldflag}}, "-mno-cygwin";
          }
  
diff --git a/meta/recipes-connectivity/openssl/openssl/0001-buildinfo-strip-sysroot-and-debug-prefix-map-from-co.patch b/meta/recipes-connectivity/openssl/openssl/0001-buildinfo-strip-sysroot-and-debug-prefix-map-from-co.patch
index 1d9e7539f6..04f46a3d3e 100644
--- a/meta/recipes-connectivity/openssl/openssl/0001-buildinfo-strip-sysroot-and-debug-prefix-map-from-co.patch
+++ b/meta/recipes-connectivity/openssl/openssl/0001-buildinfo-strip-sysroot-and-debug-prefix-map-from-co.patch
@@ -1,4 +1,4 @@
-From 6df53bfebcf8ca65910a18220a6576fb110918a5 Mon Sep 17 00:00:00 2001
+From 4df92463252f8f0695db0143d3a26566a1736b2c Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Martin=20Hundeb=C3=B8ll?= <martin@geanix.com>
 Date: Tue, 6 Nov 2018 14:50:47 +0100
 Subject: [PATCH] buildinfo: strip sysroot and debug-prefix-map from compiler
@@ -34,12 +34,12 @@ Signed-off-by: Khem Raj <raj.khem@gmail.com>
  2 files changed, 16 insertions(+), 2 deletions(-)
 
 diff --git a/Configurations/unix-Makefile.tmpl b/Configurations/unix-Makefile.tmpl
-index eff66e5..bc48f51 100644
+index f8a5b16..807439f 100644
 --- a/Configurations/unix-Makefile.tmpl
 +++ b/Configurations/unix-Makefile.tmpl
-@@ -503,13 +503,27 @@ BIN_LDFLAGS={- join(' ', $target{bin_lflags} || (),
-                          '$(CNF_LDFLAGS)', '$(LDFLAGS)') -}
- BIN_EX_LIBS=$(CNF_EX_LIBS) $(EX_LIBS)
+@@ -532,13 +532,27 @@ BIN_EX_LIBS=$(CNF_EX_LIBS) $(EX_LIBS)
+ CMOCKA_LIBS={- $config{cmocka_libs} // '' -}
+ DETOURS_LIBS={- $config{detours_libs} // '' -}
  
 -# CPPFLAGS_Q is used for one thing only: to build up buildinf.h
 +# *_Q variables are used for one thing only: to build up buildinf.h
@@ -67,10 +67,10 @@ index eff66e5..bc48f51 100644
  
  # For x86 assembler: Set PROCESSOR to 386 if you want to support
 diff --git a/crypto/build.info b/crypto/build.info
-index 8e4a885..95b0902 100644
+index 422f4aa..3573af9 100644
 --- a/crypto/build.info
 +++ b/crypto/build.info
-@@ -114,7 +114,7 @@ DEFINE[../libcrypto]=$UPLINKDEF
+@@ -113,7 +113,7 @@ DEFINE[../libcrypto]=$UPLINKDEF
  
  DEPEND[info.o]=buildinf.h
  DEPEND[cversion.o]=buildinf.h
diff --git a/meta/recipes-connectivity/openssl/openssl/0001-extend-check_cwm-test-timeout.patch b/meta/recipes-connectivity/openssl/openssl/0001-extend-check_cwm-test-timeout.patch
index 26622fd1b1..29b9728479 100644
--- a/meta/recipes-connectivity/openssl/openssl/0001-extend-check_cwm-test-timeout.patch
+++ b/meta/recipes-connectivity/openssl/openssl/0001-extend-check_cwm-test-timeout.patch
@@ -1,4 +1,4 @@
-From 07bbd037ca61264bcc311856a119b664ce13f586 Mon Sep 17 00:00:00 2001
+From ff0de34474c0dfec4f13dfb4079689c8731bf6ce Mon Sep 17 00:00:00 2001
 From: Gyorgy Sarvari <skandigraun@gmail.com>
 Date: Thu, 23 Oct 2025 11:24:36 +0200
 Subject: [PATCH] extend check_cwm test timeout
diff --git a/meta/recipes-connectivity/openssl/openssl_4.0.3.bb b/meta/recipes-connectivity/openssl/openssl_4.1.0.bb
similarity index 99%
rename from meta/recipes-connectivity/openssl/openssl_4.0.3.bb
rename to meta/recipes-connectivity/openssl/openssl_4.1.0.bb
index 122bf61f59..1e47c3cf34 100644
--- a/meta/recipes-connectivity/openssl/openssl_4.0.3.bb
+++ b/meta/recipes-connectivity/openssl/openssl_4.1.0.bb
@@ -18,7 +18,7 @@ SRC_URI:append:class-nativesdk = " \
            file://environment.d-openssl.sh \
            "
 
-SRC_URI[sha256sum] = "325b5c806167c13b40b1ffeadfe0248197c00eccc4cf123ec1e28d2d2fd216d9"
+SRC_URI[sha256sum] = "50c17baf54cb008f6ce42d50deb4b28050a1aad711636cabd4b241c7e90cc2fd"
 
 inherit lib_package multilib_header ptest perlnative manpages
 

Re: [OE-core] [PATCH v2 2/2] openssl: Upgrade 4.0.3 -> 4.1.0

[Mathieu Dubois-Briand]

On Tue Oct 27, 2026 at 7:34 PM CET, Jaipaul Cheernam wrote:
>   Release information [1]:
>
>   OpenSSL 4.1.0 is a feature release adding significant new functionality to OpenSSL.
>
>   This release incorporates the following potentially significant or incompatible changes:
>
>   - Added VC-WIN32-MSVC2013 and VC-WIN64A-MSVC2013 build targets to provide internal functions for bridging the gaps in C99 standard support that are present in MSVC 2013.
>   - Added optimized ML-DSA and ML-KEM NTT operations on ppc64le; optimized ML-DSA operations on x86_64; AVX-512-optimized SHAKE x4 operations for ML-DSA on x86_64; AVX-512 and VAES optimizations for AES-CBC
>   decryption on x86_64.
>   - Changed tsget utility to use Net::Curl::Easy (from the Net-Curl CPAN distribution) instead of the abandoned WWW::Curl::Easy. Users who rely on tsget should install Net::Curl::Easy before upgrading.
>   - Dropped Windows-on-Itanium (VC-WIN64I) and Windows CE (VC-CE) targets from Configurations.
>   - Dropped no-ecdsa and no-ecdh options from Configure, as these options did not really disable the implementations. Use no-ec to disable the elliptic curve support.
>
>   This release adds the following new features:
>
>   - Support for DTLS 1.3 (RFC 9147). Refer to the ossl-guide-dtlsv13(7) manual page for details.
>   - Support for RFC 8701 GREASE (Generate Random Extensions And Sustain Extensibility).
>   - DTLS support in the SSL listener API.
>   - Support for IKEV2 KDF.
>   - Initial support for the Elbrus2000 (e2k) architecture.
>
>   [1] https://github.com/openssl/openssl/blob/openssl-4.1/NEWS.md#major-changes-between-openssl-40-and-openssl-410-23-oct-2026
>
> - Refresh existing patches
> - Verified with world
> - Verified ptest python3-cryptography
>    TOTAL: 4650
>    PASS: 4443
>    FAIL: 0
>    ERROR: 0
>   TOTAL: 1  FAIL: 0
>
> Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
> ---

Hi Jaipaul,

This looks better, but we still have one failure:

Failed ptests:
{'python3-pyopenssl': ['tests/test_ssl.py:TestMemoryBIO.test_memory_connect']}

https://autobuilder.yoctoproject.org/valkyrie/#/builders/73/builds/4828

Thanks,
Mathieu

-- 
Mathieu Dubois-Briand, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com