openssl/Configure, branch master

Add Deprecation Macros for 4.2

2026-10-01T08:21:22Z

Reviewed-by: Eugene Syromiatnikov Reviewed-by: Richard Levitte Reviewed-by: Neil Horman Reviewed-by: Frederik Wedel-Heinen Merge-date: Thu Oct 1 08:21:23 2026 Merged-from: https://github.com/openssl/openssl/pull/33039

Add s390x cross-compile workflow

2026-09-29T16:47:09Z

Add s390x cross-compile workflow and change Configure for the s390x- optimized implementations of ML-KEM and ML-DSA. Signed-off-by: Timo Keller Assisted-by: IBM Bob:2.0.3 Reviewed-by: Mounir Idrassi Reviewed-by: Tomas Mraz Merge-date: Tue Sep 29 16:47:14 2026 Merged-from: https://github.com/openssl/openssl/pull/31929

Fix coding style violation: do not use variable length arrays

2026-09-29T16:39:51Z

Signed-off-by: Nicky Mouha Reviewed-by: Neil Horman Reviewed-by: Paul Dale Reviewed-by: Tomas Mraz Merge-date: Tue Sep 29 16:40:02 2026 Merged-from: https://github.com/openssl/openssl/pull/32967

Use SipHash for the internal fingerprint

2026-09-17T16:44:11Z

Replace SHA-1 with SipHash-2-4 (fixed key, 64-bit output) for the internal X509 and X509_CRL fingerprint. Always build crypto/siphash; no-siphash now only removes the provider MAC. Reviewed-by: Mounir Idrassi Reviewed-by: Nikola Pajkovsky Merge-date: Thu Sep 17 16:44:35 2026 Merged-from: https://github.com/openssl/openssl/pull/32686

Add ASCON-AEAD128 cipher implementation per NIST SP 800-232

2026-09-16T14:24:45Z

Integrate ASCON-AEAD128 authenticated encryption cipher into OpenSSL's default provider and libcrypto. ASCON-AEAD128 is specified in NIST SP 800-232 and provides authenticated encryption with associated data (AEAD) using a 128-bit key and 128-bit nonce. Implementation details: - Add cleanroom crypto/ascon implementation - Add provider cipher implementation following OpenSSL stream cipher patterns with generated parameter dispatch tables - Support standard AEAD operations including AAD handling, tag generation/verification, and context reinitialization Fixes: #28271 Co-authored-by: Billy Brumley Reviewed-by: Neil Horman Reviewed-by: Andrew Dinh Merge-date: Wed Sep 16 14:25:19 2026 Merged-from: https://github.com/openssl/openssl/pull/29934

rand: add seed_strict option enforcing the configured seed source

2026-09-01T12:07:27Z

When a provider requests seeding material via the get_user_entropy or get_user_nonce core callbacks before the primary DRBG was created, the request silently falls back to the operating system entropy sources, because the seed source EVP_RAND_CTX only comes into existence as a side effect of creating the primary DRBG. Whether a configured seed source is used therefore depends on operation order: for example with the FIPS provider, genrsa happened to use the configured source while ecparam -genkey did not. This fallback is acceptable for most setups, but not when the seed source selection is meant to be a guarantee, for example for compliance reasons. Add a seed_strict option to the [random] configuration section which makes the callbacks instantiate the seed source on demand and turns an unusable seed source into an error rather than a silent fallback. The option is off by default with two exceptions: selecting the JITTER seed source, at runtime or at build time via -DOPENSSL_DEFAULT_SEED_SRC, seeds strictly unless the option disables it, and enable-fips-jitter builds always seed strictly. The boolean value parsing is shared with the provider section by factoring the existing parser out into ossl_conf_parse_bool(). A build time default property query can now be set with -DOPENSSL_DEFAULT_SEED_PROPQ. Add a regression test covering the on-demand creation and the no fallback behaviour on the strict provider seeding path, a test for the default non-strict fallback behaviour including the JITTER strictness default, and [random] seed configuration coverage in the rand config test recipe. Fixes #25941 Assisted-by: Claude:claude-fable-5 Reviewed-by: Neil Horman Reviewed-by: Tomas Mraz Merge-date: Tue Sep 1 12:07:39 2026 Merged-from: https://github.com/openssl/openssl/pull/31939

Run 70-test_tls13alerts.t with dtls

2026-08-25T11:41:24Z

Reviewed-by: Viktor Dukhovni Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/24525)

Add mandoc output support for manpages

2026-07-20T09:52:21Z

This change modifies the Makefile generator to support mandoc format manpages, in lieu of \*roff format manpages. After this commit the user has the ability of specifying the manpage format to the `--manpage-format` flag. The 2 supported manpage formats as of writing are "mdoc" and "roff" and the default remains the "roff" format for legacy and portability reasons. The mandoc format requires pod2mdoc to be installed, whereas the roff output format requires pod2man to be installed. The former requires an additional utility be installed, whereas the latter uses pod2man, a utility that has been present with perl distributions for well over a decade. mandoc format support is being added as it is an easier/arguably more structured manpage format to parse, making it easier for downstream consumers like FreeBSD to implement OS-specific build support, as the minimum dependencies for the OpenSSL build process are more involved than the tools available for the FreeBSD OS bootstrapping process. Signed-off-by: Enji Cooper Reviewed-by: Dmitry Belyavskiy Reviewed-by: Tomas Mraz MergeDate: Mon Jul 20 09:52:29 2026 (Merged from https://github.com/openssl/openssl/pull/28450)

test: add Windows unit tests setup and initial dgram test

2026-07-15T16:00:29Z

This adds an initial setup for unit testing on Windows that allows mocking of system functions using Detour library. This works only for library functions and not object function like wrap so it is a bit limited but it is still useful for BIO mocking. An initial BIO bss_dgram test is added covering the Windows specific parts. Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Igor Ustinov Reviewed-by: Tomas Mraz MergeDate: Wed Jul 15 16:00:35 2026 (Merged from https://github.com/openssl/openssl/pull/31915)

Add unit testing cmocka based framework

2026-07-09T17:38:28Z

This adds the unit testing framework that extends the build so it can be enabled and tests are built. It is executed as part of the test using a recipe which executes all unit tests. The documentation is added with more info about writing the unit tests. Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Richard Levitte Reviewed-by: Tomas Mraz MergeDate: Thu Jul 9 17:39:14 2026 (Merged from https://github.com/openssl/openssl/pull/30788)