Re: [OE-core] [RFC v2 0/6] openssl: upgrade to 4.0.1 and fix dependent recipes

[Richard Purdie <richard.purdie@linuxfoundation.org>]

On Thu, 2026-08-20 at 20:10 +0200, Jaipaul Cheernam via lists.openembedded.org wrote:
> This series upgrades OpenSSL from 3.5.7 to 4.0.1 and fixes all
> dependent recipes that break due to API changes in OpenSSL 4.0.
> 
> Changes since v1:
> - u-boot: moved patch from u-boot-tools_2026.07.bb to u-boot-common.inc
>   so it applies to both u-boot and u-boot-tools (fixes riscv64 build
>   failure reported from autobuilder)
> - u-boot, kea: corrected Upstream-Status from Backport to Submitted
>   (neither has been merged upstream yet)
> - Dropped rust 1.97.1 from this series (now merged in master)
> - No external dependencies — wpa-supplicant 2.12 and rust 1.97.1
>   are both merged in master now
> 
> OpenSSL 4.0 is a major release with several breaking changes:
> - ENGINE API fully removed
> - SSLv3 support removed
> - Per-version TLS method functions (SSLv3_method etc.) removed
> - ASN1_STRING made opaque
> - const qualifiers added to X509 getter functions
> 
> Patches:
>   1/6 openssl: upgrade 3.5.7 -> 4.0.1
>   2/6 python3: backport OpenSSL 4.0 support (CPython commit 3364e7e62fa2)
>   3/6 socat: fix ASN1_STRING opaque struct access
>   4/6 serf: fix ASN1_STRING opaque struct access
>   5/6 u-boot: backport Provider API (replaces removed ENGINE API)
>   6/6 kea: add const qualifiers to X509 pointers
> 
> Testing:
> - bitbake world -k: passes on qemux86-64, qemuarm64, qemuarm, qemuriscv64
> - openssl ptest on qemux86-64: 362 files, 4310 tests, all passed
>   (338 passed, 24 skipped - fips/lms/rc5/tfo/compression - all expected)
> 
> Sharing this to get feedback and see if there are other recipes that
> break with OpenSSL 4.0 that we may have missed.
> 
> Notes on upstream status:
> - python3: fix on CPython main, backport PR #146403 closed without merge
> - socat: submitted to socat@dest-unreach.org
> - serf: fix in trunk (r1935023), no release yet
> - u-boot: PR #918 open since March 2026, under review
> - kea: tracked as issue #4673, milestone kea3.3.2
> 
> Jaipaul Cheernam (6):
>   openssl: upgrade 3.5.7 -> 4.0.1
>   python3: backport OpenSSL 4.0 support from upstream
>   socat: fix build with OpenSSL 4.0
>   serf: fix build with OpenSSL 4.0
>   u-boot: fix build with OpenSSL 4.0
>   kea: fix build with OpenSSL 4.0

Thanks for putting this together. It is definitely getting there but
there were some issues.

There are some failing selftests:

https://autobuilder.yoctoproject.org/valkyrie/#/builders/35/builds/4629
https://autobuilder.yoctoproject.org/valkyrie/#/builders/48/builds/4449

and python ptest doesn't look happy:


https://autobuilder.yoctoproject.org/valkyrie/#/builders/73/builds/4352
https://autobuilder.yoctoproject.org/valkyrie/#/builders/110/builds/1004

and multilib looks broken:

https://autobuilder.yoctoproject.org/valkyrie/#/builders/92/builds/4423
https://autobuilder.yoctoproject.org/valkyrie/#/builders/59/builds/4476

Nothing too unexpected with a change that invasive though!

Cheers,

Richard