openssl/providers/common, branch dependabot/github_actions/actions/setup-python-7

Once initialised, ML-DSA keys should be immutable

2026-06-25T02:03:26Z

ML-DSA keys should become immutable once key material has been added. This is already the case for at least ML-KEM keys, and should generally be the case across all key types. - Added the requisite check in the key management provider ml_dsa_import() function. - Also, consolidated the ML-KEM checks in ml_kem_import(). These were previously partly in ml_kem_key_fromdata(). Reviewed-by: Shane Lontis Reviewed-by: Paul Dale MergeDate: Thu Jun 25 02:03:35 2026 (Merged from https://github.com/openssl/openssl/pull/30421)

Add TLS 1.3 SignatureScheme definitions for SLH-DSA

2026-06-23T16:29:43Z

In accordance with [1]. [1] https://datatracker.ietf.org/doc/html/draft-reddy-tls-slhdsa-02 Resolves: https://github.com/openssl/project/issues/1945 Signed-off-by: Eugene Syromiatnikov Reviewed-by: Bob Beck Reviewed-by: Neil Horman MergeDate: Tue Jun 23 16:30:01 2026 (Merged from https://github.com/openssl/openssl/pull/31248)

make providers includes self contained

2026-05-06T11:35:41Z

Reviewed-by: Tomas Mraz Reviewed-by: Nikola Pajkovsky Reviewed-by: Norbert Pocs MergeDate: Wed May 6 11:36:07 2026 (Merged from https://github.com/openssl/openssl/pull/31001)

Guard include files in providers

2026-05-06T11:35:41Z

Reviewed-by: Tomas Mraz Reviewed-by: Nikola Pajkovsky Reviewed-by: Norbert Pocs MergeDate: Wed May 6 11:36:06 2026 (Merged from https://github.com/openssl/openssl/pull/31001)

Add IKEV2KDF implementation

2026-03-24T17:21:19Z

In compliance with RFC7296 and SP800-135 Reviewed-by: Neil Horman Reviewed-by: Shane Lontis Reviewed-by: Paul Dale MergeDate: Tue Mar 24 17:21:21 2026 (Merged from https://github.com/openssl/openssl/pull/30121)

Fix oids_to_c.pm to not print warnings on Windows.

2026-03-24T17:04:16Z

The oids_to_pm with Strawberry Perl often prints these errors: Use of uninitialized value in join or string at Strawberry/perl/lib/re.pm line 47. This is caused by use re 'debugcolor' in the perl module. As Windows does not have proper termcap database and colors also do not work in cmd shell, let's just use non-colored 'debug' version. Signed-off-by: Milan Broz Reviewed-by: Norbert Pocs Reviewed-by: Nikola Pajkovsky MergeDate: Tue Mar 24 17:04:23 2026 (Merged from https://github.com/openssl/openssl/pull/30521)

Refactor FIPS parameter and indicator handling

2026-03-11T14:55:27Z

Consolidate FIPS indicators and self-test parameters into a single structure managed by `fipsparams.pm`. Replace individual accessor functions with a generic `ossl_fips_config` function that retrieves values by name. This removes repetitive boilerplate code and simplifies parameter access within the FIPS provider. Signed-off-by: Simo Sorce Reviewed-by: Paul Dale Reviewed-by: Shane Lontis Reviewed-by: Dmitry Belyavskiy (Merged from https://github.com/openssl/openssl/pull/30213)

Copyright year updates

2026-03-10T14:37:52Z

Reviewed-by: Tomas Mraz Reviewed-by: Eugene Syromiatnikov MergeDate: Tue Mar 10 14:37:54 2026 Release: yes

Support for RFC8998 curveSM2 + hybrid

2026-02-21T13:24:20Z

This adds support for the "sm2sig_sm3" TLS 1.3 signature algorithm, the "curveSM2" key exchange group (ECDH over SM2) and the associated post-quantum/traditional (PQ/T) hybrid "curveSM2MLKEM768" key exchange. The default key agreement group list is expanded to add two additional PQ groups, immediately after X25519MLKEM768. These are the P-256-based SecP256r1MLKEM768 and the SM2-based curveSMMLKEM768. Neither of the new groups is a default client keyshare group, these would only come into play after a server HRR, if for some reason X25519MLKEM768 is not supported by the server, X25519 is not then the server's most preferred group, and the server supports and prefers one of these of X25519. Reviewed-by: Tim Hudson Reviewed-by: Matt Caswell Reviewed-by: Tomas Mraz Reviewed-by: Paul Yang MergeDate: Sat Feb 21 13:26:07 2026 (Merged from https://github.com/openssl/openssl/pull/29953)

Removing some more EVP_get_smtbysmth calls

2026-02-20T17:05:14Z

Reviewed-by: Paul Dale Reviewed-by: Simo Sorce (Merged from https://github.com/openssl/openssl/pull/30026)