openssl/Configure, branch dependabot/github_actions/actions/setup-python-7

Add mandoc output support for manpages

2026-07-20T09:52:21Z

This change modifies the Makefile generator to support mandoc format manpages, in lieu of \*roff format manpages. After this commit the user has the ability of specifying the manpage format to the `--manpage-format` flag. The 2 supported manpage formats as of writing are "mdoc" and "roff" and the default remains the "roff" format for legacy and portability reasons. The mandoc format requires pod2mdoc to be installed, whereas the roff output format requires pod2man to be installed. The former requires an additional utility be installed, whereas the latter uses pod2man, a utility that has been present with perl distributions for well over a decade. mandoc format support is being added as it is an easier/arguably more structured manpage format to parse, making it easier for downstream consumers like FreeBSD to implement OS-specific build support, as the minimum dependencies for the OpenSSL build process are more involved than the tools available for the FreeBSD OS bootstrapping process. Signed-off-by: Enji Cooper Reviewed-by: Dmitry Belyavskiy Reviewed-by: Tomas Mraz MergeDate: Mon Jul 20 09:52:29 2026 (Merged from https://github.com/openssl/openssl/pull/28450)

test: add Windows unit tests setup and initial dgram test

2026-07-15T16:00:29Z

This adds an initial setup for unit testing on Windows that allows mocking of system functions using Detour library. This works only for library functions and not object function like wrap so it is a bit limited but it is still useful for BIO mocking. An initial BIO bss_dgram test is added covering the Windows specific parts. Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Igor Ustinov Reviewed-by: Tomas Mraz MergeDate: Wed Jul 15 16:00:35 2026 (Merged from https://github.com/openssl/openssl/pull/31915)

Add unit testing cmocka based framework

2026-07-09T17:38:28Z

This adds the unit testing framework that extends the build so it can be enabled and tests are built. It is executed as part of the test using a recipe which executes all unit tests. The documentation is added with more info about writing the unit tests. Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Richard Levitte Reviewed-by: Tomas Mraz MergeDate: Thu Jul 9 17:39:14 2026 (Merged from https://github.com/openssl/openssl/pull/30788)

Add WRAP build.info variable

2026-07-09T17:38:28Z

This is used for adding per target --wrap ld flags for each listed function. Reviewed-by: Richard Levitte Reviewed-by: Tomas Mraz MergeDate: Thu Jul 9 17:39:12 2026 (Merged from https://github.com/openssl/openssl/pull/30788)

Suppress function pointer type validation in clang ubsan

2026-07-08T16:01:04Z

We've been concerned about ubsan errors comming with more recent versions of clang. specifically versions of clang later than 17 generate hundreds of function pointer type validation errors, i.e. assigning a function of type void (*)(TYPE *) to a function pointer of type void (*)(void *). Fixing these requires the creation of lots of thunk function that get littered through the code base, and are generally unpleasant to carry. A better fix requires siginficant code refactoring, and potentially large changes to our ABI, which we can't support until the next major release. So, for now, just suppress those ubsan errors, so we can more properly deal with the issue when we are able. Reviewed-by: Milan Broz Reviewed-by: Bob Beck Reviewed-by: Nikola Pajkovsky MergeDate: Wed Jul 8 16:01:12 2026 (Merged from https://github.com/openssl/openssl/pull/31837)

Configure, INSTALL.md: make atexit deprecated disablable

2026-06-18T12:20:26Z

As the atexit handler was removed in [1], no-atexit configuration option has no effect, make that explicit by disallowing enabling atexit, and update the documentation accordingly. [1] https://github.com/openssl/openssl/pull/29385 References: https://github.com/openssl/openssl/issues/30742 Reviewed-by: Nikola Pajkovsky Reviewed-by: Neil Horman Reviewed-by: Norbert Pocs MergeDate: Thu Jun 18 12:20:34 2026 (Merged from https://github.com/openssl/openssl/pull/30767)

build: make enable-asan work for VC targets

2026-06-10T12:53:06Z

Configure assumed GCC/Clang sanitizer spellings, so enable-asan was a no-op on MSVC. Emit /fsanitize=address instead of -fsanitize=address on VC targets. Reviewed-by: Nikola Pajkovsky Reviewed-by: Saša Nedvědický MergeDate: Wed Jun 10 12:53:11 2026 (Merged from https://github.com/openssl/openssl/pull/31366)

Configure: update $apitable with the recent versions

2026-05-19T09:33:43Z

Fill $apitable with all the major.minor.0 versions up to the current one in development. Note that while 3.5 hasn't had any APIs deprecated, it still makes sense to support passing it as an "API level". Resolves: https://github.com/openssl/openssl/issues/31196 Reported-by: Oliver Roberts Signed-off-by: Eugene Syromiatnikov Reviewed-by: Richard Levitte Reviewed-by: Matt Caswell MergeDate: Tue May 19 09:33:49 2026 (Merged from https://github.com/openssl/openssl/pull/31198)

Add valgrind CT support to ML-DSA

2026-04-22T07:55:12Z

Also slightly refactor the ML-KEM version to share the necesasry defines, and add a daily CI run to check both (presently, for just some platforms with known working valgrind support). Reviewed-by: Nikola Pajkovsky Reviewed-by: Shane Lontis MergeDate: Wed Apr 22 07:55:14 2026 (Merged from https://github.com/openssl/openssl/pull/30863)

Add IKEV2KDF implementation

2026-03-24T17:21:19Z

In compliance with RFC7296 and SP800-135 Reviewed-by: Neil Horman Reviewed-by: Shane Lontis Reviewed-by: Paul Dale MergeDate: Tue Mar 24 17:21:21 2026 (Merged from https://github.com/openssl/openssl/pull/30121)