openssl/Configure, branch openssl-3.6.3

Copyright year updates

2026-06-09T11:44:35Z

Reviewed-by: Neil Horman Reviewed-by: Saša Nedvědický MergeDate: Tue Jun 9 11:44:36 2026 Release: yes

Configure: update $apitable with the recent versions

2026-05-26T09:12:48Z

Fill $apitable with all the major.minor.0 versions up to the current one. Note that while 3.5 hasn't had any APIs deprecated, it still makes sense to support passing it as an "API level". Resolves: https://github.com/openssl/openssl/issues/31196 Reported-by: Oliver Roberts Original-PR: https://github.com/openssl/openssl/pull/31198 Original-Commit: 14306ff118c0 "Configure: update $apitable with the recent versions" Signed-off-by: Eugene Syromiatnikov Reviewed-by: Nikola Pajkovsky Reviewed-by: Frederik Wedel-Heinen MergeDate: Tue May 26 09:12:55 2026 (Merged from https://github.com/openssl/openssl/pull/31234)

fix: Apply cascade-disables before showing status

2025-08-11T14:52:01Z

Reviewed-by: Matt Caswell Reviewed-by: Dmitry Belyavskiy (Merged from https://github.com/openssl/openssl/pull/22621)

fix: restore missing --help in Configure

2025-08-11T14:52:01Z

Reviewed-by: Matt Caswell Reviewed-by: Dmitry Belyavskiy (Merged from https://github.com/openssl/openssl/pull/22621)

add a handshake memory failure test

2025-08-06T13:07:40Z

We would like to be able to test our memory failure paths, but forcing malloc to return NULL at certain points in time. This test does that, by running a sepcific workload n+1 time. In this case the workload is a simple ssl handshake. We run 1 test which sets our malloc wrapper into record mode, in which it just acts as a pass through to the system malloc call and records the number of times it was called. Then we run a second test, which does the same handshake N times, where N is the number of times malloc was called in the previous test. For each iteration in i=0..N we fail the ith malloc operation. We don't check for functional failures in the second test (as we expect failures), we just want to make sure that (a) we don't crash and (b) asan doesn't report any errors. Currently, we get _lots_ of asan failures, but we can use this test to log issues for that and fix those up. Reviewed-by: Matt Caswell Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/28078)

Make LMS disabled by default

2025-07-10T09:04:37Z

Reviewed-by: Viktor Dukhovni Reviewed-by: Matt Caswell (Merged from https://github.com/openssl/openssl/pull/27885)

Add Configurable "lms" option

2025-07-10T09:03:46Z

This option will be used by the base code for enabling Leighton-Micali Signatures (LMS) Reviewed-by: Viktor Dukhovni Reviewed-by: Matt Caswell Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/27885)

Add branch coverage to our coveralls run

2025-06-20T10:40:14Z

Coveralls is capable of reporting not only covered lines in a build, but also the number of times a given branch was taken vs. not taken. This will help us identify locations where we might make better use of the openssl_likely and openssl_unlikely macros to optimize branch prediction when building openssl Reviewed-by: Tomas Mraz Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/27839)

Add pgo build type

2025-06-20T10:40:14Z

One of the ways we can optimize our builds is with profile guided optimization. This entails doing several things: 1) Building with --coverage 2) Running an application against the openssl library from step (1) to generate profile data 3) rebuilding openssl using the input profile from step (2) to optimize the build. This new build configuration will let developers use the profiled data to see what type of optimizations might be possible, as well as giving end users the ability to squeeze a bit more performance out of openssl Reviewed-by: Tomas Mraz Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/27839)

Disable unterminated-string-initialization in strict-warnings

2025-05-02T11:43:04Z

Recently updated to fedora 42, which includes an updated gcc, which triggers a new warning: test/afalgtest.c:44:9: error: initializer-string for array of 'unsigned char' truncates NUL terminator but destination lacks 'nonstring' attribute (18 chars into 17 available) [-Werror=unterminated-string-initialization] 44 | "\x53\x69\x6e\x67\x6c\x65\x20\x62\x6c\x6f\x63\x6b\x20\x6d\x73\x67" The warning occurs because in some locations we create char buffers of length X, and fill it with X bytes of data, truncating the NULL terminator. We could fix it by adding the nonstring attribute, but given that: 1) Adding attributes might impact other platforms that don't understand the attribute. 2) We often create char buffers that don't expect a NULL terminator. 3) Converting the unsigned char arrays to uint8_t, or other types that could be interpreted as non-strings has no impact, only applying the nonstring attribute silences the warning. It seems more sensible to just disable the warning entirely Reviewed-by: Saša Nedvědický Reviewed-by: Richard Levitte Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/27490)