openssl/Configurations, branch master

Add s390x cross-compile workflow

2026-09-29T16:47:09Z

Add s390x cross-compile workflow and change Configure for the s390x- optimized implementations of ML-KEM and ML-DSA. Signed-off-by: Timo Keller Assisted-by: IBM Bob:2.0.3 Reviewed-by: Mounir Idrassi Reviewed-by: Tomas Mraz Merge-date: Tue Sep 29 16:47:14 2026 Merged-from: https://github.com/openssl/openssl/pull/31929

Add windows arm64 hybridcrt config

2026-09-23T09:28:45Z

Signed-off-by: Norbert Pocs Reviewed-by: Milan Broz Reviewed-by: Tomas Mraz Merge-date: Wed Sep 23 09:28:51 2026 Merged-from: https://github.com/openssl/openssl/pull/32882

Remove /Gs0 windows compiler flag

2026-09-21T10:13:15Z

/Gs0 forces a __chkstk call into every function prologue. On ARM64 the compiler copies the MD4 state into registers before the frame is set up, then loads the __chkstk size argument into x15 while x15 still holds one of those live values, clobbering it. Without /Gs0 the compiler uses the default probe threshold (/Gs4096) and emits no __chkstk for small frames, so the clobber never happens. Resolves: https://github.com/openssl/openssl/issues/28310 Signed-off-by: Norbert Pocs Reviewed-by: Mounir Idrassi Reviewed-by: Eugene Syromiatnikov Reviewed-by: Tomas Mraz Merge-date: Mon Sep 21 10:13:23 2026 Merged-from: https://github.com/openssl/openssl/pull/32872

Convert the paths for generator scripts on windows.

2026-09-07T18:21:24Z

jom as used in CI apparenty handles this for us, but nmake (at least in older versions) does not. we passed CI because it appears to only exercise the jom path on windows. If we convert the slashes in the paths ourselves it works for both. Reviewed-by: Neil Horman Reviewed-by: Andrew Dinh Merge-date: Mon Sep 7 18:21:29 2026 Merged-from: https://github.com/openssl/openssl/pull/32648

Make most generated files read-only, and write them atomically

2026-09-01T14:02:42Z

Generated files were left writable, so a hand edit looked like it had worked and was silently lost at the next build. Only the pods and the generated scripts were protected, by a chmod either side of the recipe, which cost a shell and two processes for each file. Route the generators that write to standard output through a helper that collects the output, sets the mode and renames the result into place. Renaming needs no permission on the file it replaces, so there is no unlocking step, and a generator that fails part way now leaves the previous file rather than a truncated one with a fresh timestamp that make would believe. The perlasm modules name their own output rather than writing to standard output, so they are unchanged and their output stays writable. Reviewed-by: Neil Horman Reviewed-by: Andrew Dinh Reviewed-by: Tomas Mraz Merge-date: Tue Sep 1 14:03:12 2026 Merged-from: https://github.com/openssl/openssl/pull/32243

Stop reloading Pod::Html for every manual page

2026-09-01T14:02:42Z

Pod::Html is compiled before the first pod is read, so converting the manual to HTML started nine hundred perl processes to do about a second of work. Convert the whole set in one invocation that loads the module once and divides the pages between a few forked workers. Nothing depends on an individual page, since the install recipe takes them as arguments, so a stamp is enough to order the work, and the per-page rules stay for building one page by name. The single page option the VMS and Windows build files use is unchanged, and both paths convert through the same code. Reviewed-by: Neil Horman Reviewed-by: Andrew Dinh Reviewed-by: Tomas Mraz Merge-date: Tue Sep 1 14:03:11 2026 Merged-from: https://github.com/openssl/openssl/pull/32243

Stop reloading Pod::Man for every manual page

2026-09-01T14:02:42Z

pod2man is a perl program that compiles Pod::Man before it reads a single pod, and there are over nine hundred pages, so formatting the manual spent most of its effort compiling the same module again and again -- 24 seconds of user time and 6 of system time to produce about two and a half seconds of formatting. Format the manual in one invocation that loads the module once and divides the pages between a few forked workers. No target depends on an individual page, since the install recipes take them as arguments, so a stamp is enough to order the work. The per-page rules stay, calling the same script with a single pod, so one page can still be built by name, and that path is quicker than pod2man was too. Reviewed-by: Neil Horman Reviewed-by: Andrew Dinh Reviewed-by: Tomas Mraz Merge-date: Tue Sep 1 14:03:10 2026 Merged-from: https://github.com/openssl/openssl/pull/32243

Install the HTML manual pages through install-files.pl

2026-09-01T14:02:42Z

The per-page copy loops become one process per section that replaces only a page whose content changed, matching the man page and header installs; an unchanged page keeps its timestamp and a reinstall is quiet. The image documents get the same treatment. Reviewed-by: Neil Horman Reviewed-by: Andrew Dinh Reviewed-by: Tomas Mraz Merge-date: Tue Sep 1 14:03:09 2026 Merged-from: https://github.com/openssl/openssl/pull/32243

Install only changed development and runtime files

2026-09-01T14:01:56Z

Install the public headers and the pkg-config and cmake exporters through a new util/install-files.pl, which handles a whole file set in one process and replaces a file only when its content differs; an unchanged file keeps its timestamp, so builds against the installed tree no longer see every header change after each install. The static and shared library installs keep their staged copies -- the mv is what makes replacing a mapped library safe -- but now compare the staged copy against what is installed and discard it when identical, and only report an install when one happens. Reviewed-by: Neil Horman Reviewed-by: Andrew Dinh Reviewed-by: Tomas Mraz Merge-date: Tue Sep 1 14:03:05 2026 Merged-from: https://github.com/openssl/openssl/pull/32243

Install man pages a section at a time, not a process per page

2026-09-01T14:01:56Z

Replace util/write-man-symlinks with util/install-man-pages.pl, which installs or uninstalls an entire man section in one process: copy, chmod and the NAME-alias symlinks that previously cost a basename, cp, chmod and a full perl interpreter for every one of the ~900 installed pages. Stale alias links are removed before being recreated, with one constraint carried over from the old script's silent symlink failures: on a case-insensitive file system an alias can collide with an installed page (OSSL_TRACE_ENABLED alongside OSSL_trace_enabled), so nothing that is not a symlink is ever removed, and an occupied alias name is skipped. Reviewed-by: Neil Horman Reviewed-by: Andrew Dinh Reviewed-by: Tomas Mraz Merge-date: Tue Sep 1 14:03:04 2026 Merged-from: https://github.com/openssl/openssl/pull/32243