openssl, branch dependabot/github_actions/actions/setup-python-7

Dependabot update

2026-07-27T17:33:20Z

CLA: trivial (deps): Bump actions/setup-python Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6 to 7. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](https://github.com/actions/setup-python/compare/v6...v7) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot]

ech: check memory failure in vpm allocation in store final check

2026-07-27T16:36:03Z

This fixes issue found by fuzz test in updated corpora for echconfiglist_parser. Reviewed-by: Norbert Pocs Reviewed-by: Paul Dale Reviewed-by: Tomas Mraz MergeDate: Mon Jul 27 16:36:15 2026 (Merged from https://github.com/openssl/openssl/pull/32070)

test: fix flaky -md and -iter mismatch checks in 20-test_enc.t

2026-07-27T12:17:19Z

The subtests added in f26d632a0e assert that "openssl enc -d" exits non-zero when the key derivation parameters do not match. enc has no MAC, so a wrong key is not detectable as such; the only signal is whether the garbage happens to form valid PKCS#7 padding, which openssl-enc(1) documents as passing better than one time in 256. With a random salt the tests thus failed about 0.4% of the time. Assert instead that mismatching parameters do not recover the plaintext: the decryption must either fail or produce differing output. Assisted-by: Claude:claude-opus-5[1m] Signed-off-by: Norbert Pocs Reviewed-by: Eugene Syromiatnikov Reviewed-by: Saša Nedvědický Reviewed-by: Neil Horman MergeDate: Mon Jul 27 12:17:21 2026 (Merged from https://github.com/openssl/openssl/pull/32083)

apps: drop invalid trust setting in check_cert_might_be_valid()

2026-07-27T11:50:23Z

check_cert_might_be_valid() called X509_VERIFY_PARAM_set_trust() with X509_TRUST_OK_ANY_EKU, which is a trust_flags bit (1 << 4), not a valid trust id (1..8). The call therefore failed with X509_R_INVALID_TRUST and left that error on the error stack, which was then printed via ERR_print_errors() for every certificate loaded by the x509 app, even on success. The intended liberal behavior is already provided by X509_PURPOSE_ANY and by suppressing X509_V_ERR_CERT_REJECTED, so just remove the bogus call. Add a test checking that printing certificate info emits nothing on stderr. Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Norbert Pocs Reviewed-by: Matt Caswell Reviewed-by: Ryan Hooper MergeDate: Mon Jul 27 11:50:39 2026 (Merged from https://github.com/openssl/openssl/pull/31968)

crypto/pkcs12/p12_decr.c: fix EVP_CIPHER_CTX_ctrl error checks

2026-07-27T10:21:09Z

EVP_CIPHER_CTX_ctrl() reports failure of the EVP_CTRL_AEAD_TLS1_AAD and EVP_CTRL_AEAD_SET_TAG controls as 0, not as a negative value, so the "< 0" checks on the cipher-with-MAC path cannot detect any failure. A return of 0 means a failed or unsupported control, or for EVP_CTRL_AEAD_TLS1_AAD a zero MAC length, none of which is usable here. Change both checks to "<= 0", matching the EVP_CTRL_AEAD_GET_TAG check fixed by commit 674c23d2656e in this function. Follow-up to https://github.com/openssl/openssl/pull/30923. Fixes: ea0add4a8227 "New GOST PKCS12 standard support" CLA: trivial Reviewed-by: Dmitry Belyavskiy Reviewed-by: Andrew Dinh Reviewed-by: Jakub Zelenka MergeDate: Mon Jul 27 10:21:13 2026 (Merged from https://github.com/openssl/openssl/pull/31848)

apps: test dgst -r and -c output formats

2026-07-27T10:19:52Z

Add coverage for the coreutils style output of `openssl dgst -r`, including the newline escaping done by newline_escape_filename() when the digested file name contains a newline, and for the colon separated output of `openssl dgst -c`. The newline in file name part is skipped where such a file cannot be created. Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Daniel Kubec Reviewed-by: Ryan Hooper MergeDate: Mon Jul 27 10:19:58 2026 (Merged from https://github.com/openssl/openssl/pull/32035)

apps: cover the req -subj modification of an existing request

2026-07-27T10:19:01Z

Add a subtest exercising the code path in the req app that rewrites the subject of an existing certificate request loaded via -in, i.e. when -subj is given without -new/-newkey/-x509. Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Matt Caswell Reviewed-by: Ryan Hooper MergeDate: Mon Jul 27 10:19:06 2026 (Merged from https://github.com/openssl/openssl/pull/31965)

ci: accept uppercase hex in dispatch head_sha validation

2026-07-27T10:16:53Z

Co-Authored-By: Claude Opus 4.8 (1M context) Reviewed-by: Milan Broz Reviewed-by: Norbert Pocs MergeDate: Mon Jul 27 10:17:00 2026 (Merged from https://github.com/openssl/openssl/pull/32053)

ci: preserve valgrind fork runs

2026-07-27T10:16:53Z

Reviewed-by: Milan Broz Reviewed-by: Norbert Pocs MergeDate: Mon Jul 27 10:16:58 2026 (Merged from https://github.com/openssl/openssl/pull/32053)

ci: allow dispatch cancellation

2026-07-27T10:16:53Z

Reviewed-by: Milan Broz Reviewed-by: Norbert Pocs MergeDate: Mon Jul 27 10:16:57 2026 (Merged from https://github.com/openssl/openssl/pull/32053)