Openembedded Core Discussions
 help / color / mirror / Atom feed
* [RFC 0/7] openssl: upgrade to 4.0.1 and fix dependent recipes
@ 2026-08-14  5:18 Jaipaul Cheernam
  2026-08-14  5:18 ` [PATCH 1/7] openssl: upgrade 3.5.7 -> 4.0.1 Jaipaul Cheernam
                   ` (6 more replies)
  0 siblings, 7 replies; 13+ messages in thread
From: Jaipaul Cheernam @ 2026-08-14  5:18 UTC (permalink / raw)
  To: openembedded-core; +Cc: Jaipaul Cheernam

This series upgrades OpenSSL from 3.5.7 to 4.0.1 and fixes all
dependent recipes that break due to API changes in OpenSSL 4.0.

OpenSSL 4.0 is a major release with several breaking changes:
- ENGINE API fully removed
- SSLv3 support removed
- Per-version TLS method functions (SSLv3_method etc.) removed
- ASN1_STRING made opaque
- const qualifiers added to X509 getter functions

Patches:
  1/7 openssl: upgrade 3.5.7 -> 4.0.1
  2/7 python3: backport OpenSSL 4.0 support (CPython commit 3364e7e62fa2)
  3/7 socat: fix ASN1_STRING opaque struct access
  4/7 rust: upgrade 1.96.1 -> 1.97.1 (openssl-sys 0.9.114 adds 4.0 support)
  5/7 serf: fix ASN1_STRING opaque struct access
  6/7 u-boot-tools: backport Provider API (replaces removed ENGINE API)
  7/7 kea: add const qualifiers to X509 pointers

Dependencies:
- wpa-supplicant 2.12 upgrade (already under review):
  https://patchwork.yoctoproject.org/project/oe-core/patch/20260811035602.3661581-1-ankur.tyagi85@gmail.com/

Testing:
- bitbake world: passes on qemux86-64, qemuarm64, qemuarm, qemuriscv64
- openssl ptest on qemux86-64: 362 files, 4310 tests, all passed
  (338 passed, 24 skipped - fips/lms/rc5/tfo/compression - all expected)

Notes on upstream status:
- python3: fix on CPython main, backport PR #146403 closed without merge
- socat: submitted to socat@dest-unreach.org
- rust: based on Deepesh's patchwork submission, fixed missing
  rust-source rename and dropped merged 0005-remap-OUT_DIR patch
- serf: fix in trunk (r1935023), no release yet
- u-boot-tools: PR #918 open since March 2026, under review
- kea: tracked as issue #4673, milestone kea3.3.2

This series depends on the following patches already on the list:
- Ankur Tyagi's wpa-supplicant 2.12 upgrade (under review)
- Deepesh Varatharajan's rust 1.97.1 upgrade (we resolved the
  remaining issues: missing rust-source rename and stale
  0005-remap-OUT_DIR patch that was already merged upstream)

Sharing this early to get feedback and see if there are other
recipes that break with OpenSSL 4.0 that we may have missed.
The wpa-supplicant and rust dependencies are not yet merged,
but the series is complete enough to build world on qemux86-64.

Deepesh Varatharajan (1):
  rust: Upgrade 1.96.1 -> 1.97.1

Jaipaul Cheernam (6):
  openssl: upgrade 3.5.7 -> 4.0.1
  python3: backport OpenSSL 4.0 support from upstream
  socat: fix build with OpenSSL 4.0
  serf: fix build with OpenSSL 4.0
  u-boot-tools: fix build with OpenSSL 4.0
  kea: fix build with OpenSSL 4.0

 .../classes-recipe/rust-target-config.bbclass |   5 +
 meta/conf/distro/include/tcmode-default.inc   |   2 +-
 meta/lib/oeqa/selftest/cases/rust.py          |   3 +-
 ...Add-support-for-OpenSSL-Provider-API.patch | 300 ++++++++++++++
 .../u-boot/u-boot-tools_2026.07.bb            |   4 +-
 ...-qualifiers-to-OpenSSL-X509-pointers.patch |  49 +++
 meta/recipes-connectivity/kea/kea_3.2.0.bb    |   1 +
 ...ke-history-reporting-when-test-fails.patch | 366 ------------------
 ...1-Configure-do-not-tweak-mips-cflags.patch |   6 +-
 ...sysroot-and-debug-prefix-map-from-co.patch |  11 +-
 .../0001-extend-check_cwm-test-timeout.patch  |   4 +-
 .../{openssl_3.5.7.bb => openssl_4.0.1.bb}    |  23 +-
 ...penSSL-4.0-use-ASN1_STRING-accessors.patch |  31 ++
 .../socat/socat_1.8.1.3.bb                    |   1 +
 ...146207-Add-support-for-OpenSSL-4.0.0.patch | 257 ++++++++++++
 .../recipes-devtools/python/python3_3.14.7.bb |   1 +
 .../rust/{cargo_1.96.1.bb => cargo_1.97.1.bb} |   0
 ...lain-syscalls-as-their-time64-varian.patch |  81 ----
 ...xplicit-tail-calls-disable-two-tests.patch |  39 --
 ...lls-ignore-tests-on-unsupported-llvm.patch |  96 -----
 ...ild-script-path-leakage-in-artifacts.patch |  28 --
 ...ibstd-rs_1.96.1.bb => libstd-rs_1.97.1.bb} |   0
 ....96.1.bb => rust-cross-canadian_1.97.1.bb} |   0
 meta/recipes-devtools/rust/rust-snapshot.inc  | 104 ++---
 meta/recipes-devtools/rust/rust-source.inc    |   6 +-
 ...source_1.96.1.bb => rust-source_1.97.1.bb} |   0
 .../rust/{rust_1.96.1.bb => rust_1.97.1.bb}   |   3 +
 ...penSSL-4.0-use-ASN1_STRING-accessors.patch |  35 ++
 meta/recipes-support/serf/serf_1.3.10.bb      |   1 +
 29 files changed, 759 insertions(+), 698 deletions(-)
 create mode 100644 meta/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API.patch
 create mode 100644 meta/recipes-connectivity/kea/files/0001-Add-const-qualifiers-to-OpenSSL-X509-pointers.patch
 delete mode 100644 meta/recipes-connectivity/openssl/openssl/0001-Added-handshake-history-reporting-when-test-fails.patch
 rename meta/recipes-connectivity/openssl/{openssl_3.5.7.bb => openssl_4.0.1.bb} (88%)
 create mode 100644 meta/recipes-connectivity/socat/files/0001-Fix-build-with-OpenSSL-4.0-use-ASN1_STRING-accessors.patch
 create mode 100644 meta/recipes-devtools/python/python3/0001-gh-146207-Add-support-for-OpenSSL-4.0.0.patch
 rename meta/recipes-devtools/rust/{cargo_1.96.1.bb => cargo_1.97.1.bb} (100%)
 delete mode 100644 meta/recipes-devtools/rust/files/0001-riscv32-Define-plain-syscalls-as-their-time64-varian.patch
 delete mode 100644 meta/recipes-devtools/rust/files/0003-explicit-tail-calls-disable-two-tests.patch
 delete mode 100644 meta/recipes-devtools/rust/files/0004-explicit-tail-calls-ignore-tests-on-unsupported-llvm.patch
 delete mode 100644 meta/recipes-devtools/rust/files/0005-remap-OUT_DIR-paths-to-fix-build-script-path-leakage-in-artifacts.patch
 rename meta/recipes-devtools/rust/{libstd-rs_1.96.1.bb => libstd-rs_1.97.1.bb} (100%)
 rename meta/recipes-devtools/rust/{rust-cross-canadian_1.96.1.bb => rust-cross-canadian_1.97.1.bb} (100%)
 rename meta/recipes-devtools/rust/{rust-source_1.96.1.bb => rust-source_1.97.1.bb} (100%)
 rename meta/recipes-devtools/rust/{rust_1.96.1.bb => rust_1.97.1.bb} (98%)
 create mode 100644 meta/recipes-support/serf/serf/0001-Fix-build-with-OpenSSL-4.0-use-ASN1_STRING-accessors.patch



^ permalink raw reply	[flat|nested] 13+ messages in thread

end of thread, other threads:[~2026-08-15 16:20 UTC | newest]

Thread overview: 13+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-14  5:18 [RFC 0/7] openssl: upgrade to 4.0.1 and fix dependent recipes Jaipaul Cheernam
2026-08-14  5:18 ` [PATCH 1/7] openssl: upgrade 3.5.7 -> 4.0.1 Jaipaul Cheernam
2026-08-15 16:20   ` [OE-core] " Mathieu Dubois-Briand
2026-08-14  5:18 ` [PATCH 2/7] python3: backport OpenSSL 4.0 support from upstream Jaipaul Cheernam
2026-08-14  5:18 ` [PATCH 3/7] socat: fix build with OpenSSL 4.0 Jaipaul Cheernam
2026-08-14  5:18 ` [PATCH 4/7] rust: Upgrade 1.96.1 -> 1.97.1 Jaipaul Cheernam
2026-08-15 16:11   ` [OE-core] " Mathieu Dubois-Briand
2026-08-14  5:18 ` [PATCH 5/7] serf: fix build with OpenSSL 4.0 Jaipaul Cheernam
2026-08-14  5:18 ` [PATCH 6/7] u-boot-tools: " Jaipaul Cheernam
2026-08-14 11:12   ` [OE-core] " Alexander Kanavin
2026-08-15 16:14   ` Mathieu Dubois-Briand
2026-08-14  5:18 ` [PATCH 7/7] kea: " Jaipaul Cheernam
2026-08-14 11:14   ` [OE-core] " Alexander Kanavin

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox