openssl/doc, branch dependabot/github_actions/actions/setup-python-7

DOCS: Fix KEM init function documentation

2026-07-27T07:56:55Z

Document the missing params argument for OSSL_FUNC_kem_decapsulate_init(), remove stale name references, and fix the malformed provider-keymgmt(7) link. Complements: 78c44b05945b Add HPKE DHKEM provider support for EC, X25519 and X448. Signed-off-by: olszomal Reviewed-by: Jakub Zelenka Reviewed-by: Paul Dale MergeDate: Mon Jul 27 07:57:01 2026 (Merged from https://github.com/openssl/openssl/pull/32045)

doc: clarify raw RSA migration

2026-07-27T07:53:56Z

RSA_private_encrypt() and RSA_public_decrypt() support both PKCS#1 v1.5 and no padding, but the migration guide currently describes their EVP replacements as using no padding only. Document direct mappings to EVP_PKEY_sign() and EVP_PKEY_verify_recover(), and explain that compatibility requires no signature digest and the same legacy padding mode, RSA_PKCS1_PADDING or RSA_NO_PADDING. Reviewed-by: Jakub Zelenka Reviewed-by: Paul Dale MergeDate: Mon Jul 27 07:54:00 2026 (Merged from https://github.com/openssl/openssl/pull/31996)

Update SSL_CTX_set1_curves.pod for OpenSSL 3.5 additions

2026-07-24T13:13:02Z

Added documentation of the addition of group tuples in openSSL 3.5 in HISTORY section of SSL_CTX_set1_curves.pod. CLA: trivial Reviewed-by: Viktor Dukhovni Reviewed-by: Nikola Pajkovsky MergeDate: Fri Jul 24 13:13:26 2026 (Merged from https://github.com/openssl/openssl/pull/32007)

doc: document that `HMAC_Update` cannot be called after `HMAC_Final`

2026-07-23T08:33:15Z

Reviewed-by: Paul Dale Reviewed-by: Frederik Wedel-Heinen MergeDate: Thu Jul 23 08:33:21 2026 (Merged from https://github.com/openssl/openssl/pull/31570)

docs: clarify EVP_PKEY context workflow and operation descriptions

2026-07-23T08:28:42Z

Document that a generated key is returned separately from its generation context and that a new key-bound context is needed for subsequent operations. Correct the encrypt and decrypt initialization descriptions and examples accordingly. Correct two copy-and-paste errors in the verify-recover documentation: describe its initializer as starting a verify-recover operation and refer to EVP_PKEY_verify_recover() when discussing its input. Fixes #31989 Assisted-by: Grok:Grok-4.5 Reviewed-by: Tomas Mraz Reviewed-by: Dmitry Belyavskiy MergeDate: Thu Jul 23 08:29:24 2026 (Merged from https://github.com/openssl/openssl/pull/31995)

Make sure we always check return of CRYPTO_UP_REF which can fail.

2026-07-20T11:13:57Z

Reviewed-by: Kurt Roeckx Reviewed-by: Paul Dale MergeDate: Mon Jul 20 11:13:58 2026 (Merged from https://github.com/openssl/openssl/pull/31753)

doc: clarify pkeyutl -rawin and -digest for no-prehash signatures

2026-07-20T09:13:03Z

Complements: 5421423 "Flexible encoders for ML-DSA" Signed-off-by: olszomal Reviewed-by: Tomas Mraz Reviewed-by: Daniel Kubec MergeDate: Mon Jul 20 09:13:08 2026 (Merged from https://github.com/openssl/openssl/pull/31478)

[providers/implementations/ciphers] GCM-SIV: reject out-of-order update calls

2026-07-20T06:55:44Z

For GCM-SIV: 1. AAD must precede the payload 2. the payload must be single shot (2) was already happening, this change moves from a silent fail to an explicit error message for multiple update calls on the payload. For (1), this change unifies the logic for (2) one level up in the wrapper. So the code previously allowed (1), and now errors out after this change. Follow-up to #31906 Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Nikola Pajkovsky Reviewed-by: Daniel Kubec Reviewed-by: Bob Beck MergeDate: Mon Jul 20 06:56:04 2026 (Merged from https://github.com/openssl/openssl/pull/31940)

Prepare a now opaque ASN1_STRING for the size_t rapture.

2026-07-18T13:00:57Z

Now that ASN1_STRING is opaque, we can finally move away from an int for the length internally. The remaining problematic piece for this is that ASN1_STRING_length() returns an int and is public API. Therefore, we deprecate ASN1_STRING_length() and provide a replacement ASN1_STRING_length_ex() that returns a size_t length. We also provide setting functions that take size_t lengths, they are ASN1_STRING_set_data() which takes a uint8_t data pointer and a size_t length, and ASN1_STRING_set_string() which takes a argument that must be a c string and will use strlen to determine the length. (This replaces th previous arcane behaviour of calling "strlen" on a magical input length value of -1, which leads to bugs.) We then deprecate ASN1_STRING_set(). ASN1_STRING_set_string() requires a valid C string argument that may not be NULL - refer to the documentation. Both new functions do not magically add 0 bytes on the end of values, as ASN1_STRING has already been documented for a long time to not depend on this behaviour. Both new functions do not allow the setting of values on an ASN1_BIT_STRING, as ASN1_BIT_STRING_set1 must be used for that. Note that this does *NOT* yet change ASN1_STRING to use size_t internally, this must wait until the integer-returning ASN1_STRING_length() has been deprecated, and then removed in future major. Once ASN1_STRING_length() has been removed then ASN1_STRING internally can change to using a size_t for the length of the data. (And the setters will no longer return an error if the provided size_t length exceeds INT_MAX) Reviewed-by: Milan Broz Reviewed-by: Norbert Pocs MergeDate: Sat Jul 18 13:01:15 2026 (Merged from https://github.com/openssl/openssl/pull/31194)

Don't raise NOT_ENOUGH_DATA on a clean EOF at an object boundary

2026-07-13T08:04:34Z

asn1_d2i_read_bio() reads one ASN.1 object at a time from a BIO. Callers commonly loop, decoding concatenated DER values until the call fails, and rely on a failure with no queued error to recognise a clean end of input. CPython's ssl module does this in _add_ca_certs() when loading the Windows certificate store via SSLContext.load_verify_locations(cadata=...); it re-raises any leftover ASN.1 error other than ASN1_R_HEADER_TOO_LONG as fatal. Commit 9eb6922c59 ("asn1: raise NOT_ENOUGH_DATA on header EOF") changed the BIO_read() check from "i < 0" to "i <= 0", so a clean EOF (BIO_read() returning 0, as an exhausted BIO_new_mem_buf does) on an object boundary now raises ASN1_R_NOT_ENOUGH_DATA instead of failing with an empty error queue. The rewrite in commit 35852da1d9 carried this behaviour forward. As a result Python 3 on Windows fails to initialise an SSLContext with: ssl.SSLError: [ASN1: NOT_ENOUGH_DATA] not enough data Raise ASN1_R_NOT_ENOUGH_DATA only on an actual read error, on an EOF in the middle of an object (some bytes already buffered), or on an EOF while still inside an indefinite-length value awaiting its end-of-contents octets - all of which are genuine truncation. A clean EOF at a top-level object boundary again fails without queuing an error, restoring the long-standing behaviour that looping callers depend on. Add regression tests covering the clean-EOF, truncated, indefinite-length truncation and partial-header cases, and document the read behaviour in ASN1_item_d2i_bio(3). Fixes #31807 Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Dmitry Belyavskiy Reviewed-by: Igor Ustinov Reviewed-by: Tomas Mraz MergeDate: Mon Jul 13 08:05:03 2026 (Merged from https://github.com/openssl/openssl/pull/31818)