openssl/providers/implementations/rands, branch dependabot/github_actions/actions/setup-python-7

test-rng: handle nonce length query in generate mode

2026-07-10T15:47:09Z

The DRBG instantiation probes the parent nonce callback with a NULL output buffer to obtain the nonce length before requesting the actual nonce. The generate mode branch of test_rng_nonce() wrote the bytes without checking the output pointer, crashing when TEST-RAND with generate=1 is used as a DRBG parent. The entropy-buffer branch already handles a NULL output correctly. Assisted-by: Claude:claude-fable-5 Reviewed-by: Paul Dale Reviewed-by: Nikola Pajkovsky MergeDate: Fri Jul 10 15:47:15 2026 (Merged from https://github.com/openssl/openssl/pull/31885)

Allow MinGW-w64 builds to use BCryptGenRandom

2026-07-10T12:05:02Z

MinGW-w64 has provided bcrypt headers and import libraries since version 2.0, but OpenSSL only enabled the BCryptGenRandom seeding path for supported MSVC builds. Enable the existing direct BCryptGenRandom flow for MinGW-w64 when targeting Windows Vista or newer, and link MinGW builds with bcrypt alongside the other Windows import libraries. Use __MINGW64_VERSION_MAJOR to detect MinGW-w64 because it is defined by both the 32-bit and 64-bit MinGW-w64 toolchains. Builds targeting older Windows versions keep the CryptoAPI fallback because USE_BCRYPTGENRANDOM remains disabled when _WIN32_WINNT is below 0x0600. Fixes #13878 Reviewed-by: Milan Broz Reviewed-by: Nikola Pajkovsky Reviewed-by: Neil Horman MergeDate: Fri Jul 10 12:05:09 2026 (Merged from https://github.com/openssl/openssl/pull/13882)

We no longer need to test for GCC versions this old

2026-07-10T11:47:13Z

The minimum gcc to compile our code appears to be version 9, and we are now C99. All these older checks become a tautology on anything that will build a modern OpenSSL tree, so clean this up. Reviewed-by: Milan Broz Reviewed-by: Tomas Mraz Reviewed-by: Neil Horman MergeDate: Fri Jul 10 11:47:17 2026 (Merged from https://github.com/openssl/openssl/pull/31677)

Allow `getentropy` for Emscripten

2026-07-08T17:50:54Z

Usually Emscripten emulates `/dev/urandom`, but in some cases, like with `-sNODERAWFS`, it doesn't. This means that on non-Unix platforms, where `/dev/urandom` does not exist on the host, OpenSSL will fail to seed its PRNG. This fixes that by instead using the POSIX function it implements, like which was already done for WASI. See https://github.com/emscripten-core/emscripten/issues/9628#issuecomment-4892658766 for more context. CLA: trivial Reviewed-by: Kurt Roeckx Reviewed-by: Daniel Kubec Reviewed-by: Paul Dale Reviewed-by: Tomas Mraz MergeDate: Wed Jul 8 17:50:39 2026 (Merged from https://github.com/openssl/openssl/pull/31882) (cherry picked from commit dc219a04088d08de7df5afdb14263b3e9a4c7915)

Fix use of BCryptGenRandom

2026-07-01T09:14:10Z

Current path for Windows RNG (for Vista and above) should use BCryptGenRandom() function but the symbol is not included in platform_symbols. The issue was hidden before commit 1eaf29ef6c reordered Windows header inclusion. Moreover, a cast to ULONG is required for strict warnings build. Reviewed-by: Neil Horman Reviewed-by: Saša Nedvědický Reviewed-by: Norbert Pocs MergeDate: Wed Jul 1 09:14:17 2026 (Merged from https://github.com/openssl/openssl/pull/31774)

Remove direct includes of windows.h where possible

2026-06-20T11:00:32Z

It should be included via e_os.h instead. Reviewed-by: Milan Broz Reviewed-by: Tim Hudson Reviewed-by: Simo Sorce Reviewed-by: Frederik Wedel-Heinen Reviewed-by: Neil Horman MergeDate: Sat Jun 20 11:00:42 2026 (Merged from https://github.com/openssl/openssl/pull/31587)

Revert "convert CRYPTO_THREAD_run_once to use InitOnceExecuteOnce api"

2026-06-17T12:14:51Z

This reverts commit d053fe41a4add4e55dc5633e8aef6602a6a4b90b. Reviewed-by: Eugene Syromiatnikov Reviewed-by: Nikola Pajkovsky MergeDate: Wed Jun 17 12:14:58 2026 (Merged from https://github.com/openssl/openssl/pull/31539)

Fix up mismatched error reason codes

2026-06-11T16:06:34Z

Reviewed-by: Eugene Syromiatnikov Reviewed-by: Norbert Pocs Reviewed-by: Milan Broz Reviewed-by: Paul Dale Reviewed-by: Tomas Mraz MergeDate: Thu Jun 11 16:06:41 2026 (Merged from https://github.com/openssl/openssl/pull/31390)

convert CRYPTO_THREAD_run_once to use InitOnceExecuteOnce api

2026-06-10T19:46:53Z

Issue #22059 reported a race condition in CRYPTO_THREAD_run_once on windows platforms. The most correct fix for this is to convert the windows run_once implementation to use the Win32 InitOnceRunOnce interface. Doing so requires at least Windows Vista/Windows Server 2008 to be available, and because WinXP hasn't built since 3.0 released, it seems sensible to bump our minimal NT version to be 0x600 (Vista/2008) Also, while we're at it, this change caught a bad programming practice in the rio_notifier code, which attempts to reset the once variable during shutdown. The windows static initalizer macro for this api is constructed such that attempting to do so causes a build break. Since once variables are not meant to be reset (since they are only triggered once), remove that reset code to avoid the breakage. Note that this problem was independently found and fixed in #30198. We're taking the fix from this pr (as they are effectively identical), and using that PR to add some much needed tests to the rio code. Reviewed-by: Tomas Mraz Reviewed-by: Matt Caswell Reviewed-by: Bob Beck MergeDate: Wed Jun 10 19:44:19 2026 (Merged from https://github.com/openssl/openssl/pull/31339)

Convert use of artisinally made hand crafted integer types

2026-05-27T09:08:08Z

to use the stdint.h ones. Reviewed-by: Richard Levitte Reviewed-by: Nikola Pajkovsky MergeDate: Wed May 27 09:09:41 2026 (Merged from https://github.com/openssl/openssl/pull/31254)