openssl/providers/fips, branch dependabot/github_actions/actions/setup-python-7

We no longer need to test for GCC versions this old

2026-07-10T11:47:13Z

The minimum gcc to compile our code appears to be version 9, and we are now C99. All these older checks become a tautology on anything that will build a modern OpenSSL tree, so clean this up. Reviewed-by: Milan Broz Reviewed-by: Tomas Mraz Reviewed-by: Neil Horman MergeDate: Fri Jul 10 11:47:17 2026 (Merged from https://github.com/openssl/openssl/pull/31677)

Eliminate/fix repeated word usage

2026-07-08T10:07:53Z

Found by running the checkpatch.pl Linux script to enforce coding style. Reviewed-by: Kurt Roeckx Reviewed-by: Neil Horman Reviewed-by: Norbert Pocs Reviewed-by: Eugene Syromiatnikov MergeDate: Wed Jul 8 10:11:11 2026 (Merged from https://github.com/openssl/openssl/pull/31860)

providers/fips/fipsprov.c, test/p_test.c: remove c_gettable_params static global

2026-06-28T17:50:37Z

c_gettable_params is never read anywhere in the files; it was dead storage. Remove it. Signed-off-by: Nikola Pajkovsky Reviewed-by: Norbert Pocs Reviewed-by: Neil Horman Reviewed-by: Eugene Syromiatnikov MergeDate: Sun Jun 28 17:51:55 2026 (Merged from https://github.com/openssl/openssl/pull/31508)

remove read lock from method store cache lookup

2026-06-09T18:02:45Z

Reviewed-by: Saša Nedvědický Reviewed-by: Bob Beck Reviewed-by: Nikola Pajkovsky MergeDate: Tue Jun 9 18:17:12 2026 (Merged from https://github.com/openssl/openssl/pull/31018)

Fix broken hex data by reformatting

2026-06-03T07:46:03Z

The clang format broke some data in hexadecimal format. To make the tool obedient, the trailing comma needs to be removed, then it interpretes the data differently and therefore does not reformat it. The format can then be changed to the correct form. Fixes: https://github.com/openssl/project/issues/1959 Signed-off-by: Norbert Pocs Reviewed-by: Milan Broz Reviewed-by: Eugene Syromiatnikov MergeDate: Wed Jun 3 07:46:14 2026 (Merged from https://github.com/openssl/openssl/pull/31350)

Use valid DH peer pubkey in the KAT tests

2026-05-18T07:34:04Z

Co-authored-by: Viktor Dukhovni Signed-off-by: Norbert Pocs Reviewed-by: Neil Horman Reviewed-by: Viktor Dukhovni Reviewed-by: Tomas Mraz MergeDate: Mon May 18 07:34:16 2026 (Merged from https://github.com/openssl/openssl/pull/31171)

Guard include files in providers

2026-05-06T11:35:41Z

Reviewed-by: Tomas Mraz Reviewed-by: Nikola Pajkovsky Reviewed-by: Norbert Pocs MergeDate: Wed May 6 11:36:06 2026 (Merged from https://github.com/openssl/openssl/pull/31001)

fips: mark X448MLKEM1024 as non-approved

2026-04-20T10:07:45Z

The [FIPS 140-3I.G.](https://csrc.nist.gov/csrc/media/Projects/cryptographic-module-validation-program/documents/fips%20140-3/FIPS%20140-3%20IG.pdf) Section D.S Key Encapsulation Mechanisms have been substantially update on April 9, 2026. It now explicitely lists that hybrid mechanisms must be fixed combinations with both portions being in boundary, and the intent should be to use them with an approved combiner such as HKDF as part of a protocol. With the combinations from the https://datatracker.ietf.org/doc/draft-ietf-tls-ecdhe-mlkem explicitely mentioned that they can reach appoved or allowed claims. Note that consensus for TLS group for X448MLKEM1024 failed to reach on the [pqc forum](https://mailarchive.ietf.org/arch/browse/tls/?gbt=1&index=YIHJrbWVPdXIr8q57nsEUUmuaIo) and is not part of the https://datatracker.ietf.org/doc/draft-ietf-tls-ecdhe-mlkem. And there are no other protocols defined that use this hybrid with an approved combiner. Also on https://test.openquantumsafe.org/ there is x448_mlkem768 but no X448MLKEM1024. To avoid any confusion, it is best to mark this hybrid as non-approved going forward. It is likely also worthfile to deprecate X448MLKEM1024 altogether. Fixes: https://github.com/openssl/openssl/pull/26220 Reviewed-by: Tomas Mraz Reviewed-by: Paul Dale MergeDate: Mon Apr 20 10:08:09 2026 (Merged from https://github.com/openssl/openssl/pull/30856)

Add IKEV2KDF implementation

2026-03-24T17:21:19Z

In compliance with RFC7296 and SP800-135 Reviewed-by: Neil Horman Reviewed-by: Shane Lontis Reviewed-by: Paul Dale MergeDate: Tue Mar 24 17:21:21 2026 (Merged from https://github.com/openssl/openssl/pull/30121)

Disable DLL detach handlers on cygwin

2026-03-19T10:01:30Z

This patch is from cygwin, and was originally added in: https://cygwin.com/cgit/cygwin-packages/openssl/commit/?id=da80cc438622f6b1801fb3fbb06818c3ee070495 In cygwin, it's not safe to call into libc from DLL_THREAD/PROCESS_DETACH, and it results in crashes. CLA: trivial Co-authored-By: Achim Gratz Reviewed-by: Paul Dale Reviewed-by: Tomas Mraz MergeDate: Thu Mar 19 10:02:05 2026 (Merged from https://github.com/openssl/openssl/pull/29321)