Re: [OE-core] [RFC v4 0/6] openssl: upgrade 3.5.7 -> 4.0.1

[Richard Purdie <richard.purdie@linuxfoundation.org>]

On Sat, 2026-08-22 at 19:51 +0200, Jaipaul Cheernam via lists.openembedded.org wrote:
> Upgrade OpenSSL from 3.5.7 to 4.0.1 and fix all dependent recipe
> breakages in oe-core.
> 
> OpenSSL 4.0 is a major version bump that removes the ENGINE API,
> removes the c_rehash script, makes ASN1_STRING fully opaque, adds
> const qualifiers to X509 accessor return types, and removes
> per-version TLS method functions.
> 
> This series fixes python3, socat, serf, u-boot, and kea to build
> against OpenSSL 4.0.
> 
> Changes since v3:
>   - u-boot: fix malformed patch (hunk line count mismatch from pkcs11
>     modification). Regenerated patch properly.
> 
> Changes since v2:
>   - openssl: remove c_rehash from MULTILIB_SCRIPTS and FILES (fixes
>     multilib do_package failure)
>   - python3: add backports from CPython PR #149783 for the
>     got_eof_error fix (fixes test_https/test_https_sni ptest failures
>     caused by OpenSSL 4.0 changing EOF signaling behavior)
>   - u-boot: update Upstream-Status to lore link per reviewer feedback,
>     include doc/Dockerfile hunks from upstream v4, make pkcs11
>     provider loading optional (fixes fitimage signing failure when
>     pkcs11-provider is not installed)
> 
> Changes since v1:
>   - u-boot: move patch from u-boot-tools to u-boot-common.inc (fixes
>     riscv64 build failure)
>   - serf/socat: fix Upstream-Status tags

Thanks, definitely getting better!

There was one failure in core I spotted in barebox:

https://autobuilder.yoctoproject.org/valkyrie/#/builders/23/builds/4689

I think that is openssl related but it is hard to be 100% sure.

Cheers,

Richard