Re: [OE-core] [PATCH 1/7] openssl: upgrade 3.5.7 -> 4.0.1

["Mathieu Dubois-Briand" <mathieu.dubois-briand@bootlin.com>]

On Fri Aug 14, 2026 at 7:18 AM CEST, Jaipaul Cheernam wrote:
> Upgrade OpenSSL from 3.5.7 to 4.0.1. This is a major version upgrade.
>
> Changelog: https://github.com/openssl/openssl/blob/openssl-4.0.1/CHANGES.md
>
> New CVE fixes not already in 3.5.7:
>   * CVE-2026-28386: Fixed OOB read in AES-CFB-128 on x86-64 with AVX-512
>   * CVE-2026-35188: Fixed double-free when checking OCSP stapled response
>   * CVE-2026-42765: Fixed NULL deref in cert verification with OCSP
>   * CVE-2026-42771: Fixed OOB read in X509_VERIFY_PARAM_set1_email()
>
> Major breaking changes in 4.0.0:
>   * Removed support for engines. The ENGINE API is fully removed.
>   * Removed support for SSLv3. SSLv3 has been deprecated since 2015.
>   * Removed support for the SSLv2 Client Hello.
>   * Removed per-version TLS method functions (SSLv3_method(),
>     TLSv1_method(), TLSv1_1_method(), TLSv1_2_method()).
>   * Removed c_rehash script tool. Use 'openssl rehash' instead.
>   * ASN1_STRING has been made opaque.
>   * Numerous API function signatures changed to include const qualifiers.
>   * libcrypto no longer cleans up globally allocated data via atexit().
>   * Added AKID verification checks when X509_V_FLAG_X509_STRICT is set.
>   * Support of deprecated elliptic curves in TLS disabled at compile-time
>     by default.
>
> Recipe changes:
>   * Drop 0001-Added-handshake-history-reporting-when-test-fails.patch
>     (merged upstream via PR #22481).
>   * Refresh remaining patches against the new version.
>   * Remove ENGINE API artifacts: engines package, dasync.so/ossltest.so
>     ptest installation, ENGINESDIR references, OPENSSL_ENGINES wrapper
>     variable, and cryptodev-linux PACKAGECONFIG.
>
> Tested: ptest on qemux86-64:
>   Files=362, Tests=4310, Result: PASS
>   Passed: 338, Skipped: 24 (fips, lms, rc5, tfo, compression,
>   sslversions, sslkeylogfile, external tests - all expected)
>   Failed: 0
>

Hi Jaipaul,

Thanks for your patch.

I gave it a go on the autobuilder, and we can see some build issues.

A first one (multilib related ?):
ERROR: lib32-openssl-4.0.1-r0 do_package: Execution of '/srv/pokybuild/yocto-worker/multilib/build/build/tmp/work/x86-pokymllib32-linux/lib32-openssl/4.0.1/temp/run.multilibscript_rename.3735101' failed with exit code 1
...
| mv: cannot stat '/srv/pokybuild/yocto-worker/multilib/build/build/tmp/work/x86-pokymllib32-linux/lib32-openssl/4.0.1/package/usr/bin/c_rehash': No such file or directory
| WARNING: exit code 1 from a shell command.
| DEBUG: Python function do_package finished
NOTE: recipe lib32-openssl-4.0.1-r0: task do_package: Failed
ERROR: Task (virtual:multilib:lib32:/srv/pokybuild/yocto-worker/multilib/build/layers/openembedded-core/meta/recipes-connectivity/openssl/openssl_4.0.1.bb:do_package) failed with exit code '1'

https://autobuilder.yoctoproject.org/valkyrie/#/builders/92/builds/4374
https://autobuilder.yoctoproject.org/valkyrie/#/builders/92/builds/4374

And a second one:
ERROR: openssl-4.0.1-r0 do_compile: Execution of '/srv/pokybuild/yocto-worker/qemux86-alt/build/build/tmp/work/core2-32-poky-linux/openssl/4.0.1/temp/run.do_compile.3557282' failed with exit code 1
...
| ../sources/openssl-4.0.1/providers/implementations/keymgmt/ml_kem_kmgmt.c:25:10: fatal error: prov/der_wrap.h: No such file or directory
|    25 | #include "prov/der_wrap.h"
|       |          ^~~~~~~~~~~~~~~~~
| compilation terminated.

https://autobuilder.yoctoproject.org/valkyrie/#/builders/20/builds/4341

Thanks,
Mathieu

-- 
Mathieu Dubois-Briand, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com