openssl/util/libcrypto.num, branch dependabot/github_actions/actions/setup-python-7

Prepare a now opaque ASN1_STRING for the size_t rapture.

2026-07-18T13:00:57Z

Now that ASN1_STRING is opaque, we can finally move away from an int for the length internally. The remaining problematic piece for this is that ASN1_STRING_length() returns an int and is public API. Therefore, we deprecate ASN1_STRING_length() and provide a replacement ASN1_STRING_length_ex() that returns a size_t length. We also provide setting functions that take size_t lengths, they are ASN1_STRING_set_data() which takes a uint8_t data pointer and a size_t length, and ASN1_STRING_set_string() which takes a argument that must be a c string and will use strlen to determine the length. (This replaces th previous arcane behaviour of calling "strlen" on a magical input length value of -1, which leads to bugs.) We then deprecate ASN1_STRING_set(). ASN1_STRING_set_string() requires a valid C string argument that may not be NULL - refer to the documentation. Both new functions do not magically add 0 bytes on the end of values, as ASN1_STRING has already been documented for a long time to not depend on this behaviour. Both new functions do not allow the setting of values on an ASN1_BIT_STRING, as ASN1_BIT_STRING_set1 must be used for that. Note that this does *NOT* yet change ASN1_STRING to use size_t internally, this must wait until the integer-returning ASN1_STRING_length() has been deprecated, and then removed in future major. Once ASN1_STRING_length() has been removed then ASN1_STRING internally can change to using a size_t for the length of the data. (And the setters will no longer return an error if the provided size_t length exceeds INT_MAX) Reviewed-by: Milan Broz Reviewed-by: Norbert Pocs MergeDate: Sat Jul 18 13:01:15 2026 (Merged from https://github.com/openssl/openssl/pull/31194)

Add EVP_KDF_CTX_get0_kdf and EVP_KDF_CTX_get1_kdf, deprecate EVP_KDF_CTX_kdf

2026-07-02T07:24:15Z

Resolves: https://github.com/openssl/openssl/issues/28327 Reviewed-by: Bob Beck Reviewed-by: Nikola Pajkovsky MergeDate: Thu Jul 2 07:24:22 2026 (Merged from https://github.com/openssl/openssl/pull/28954)

Provide ASN1_STRING_new_not_owned()

2026-06-03T11:41:32Z

This function provides the ability to construct an ASN1_STRING containing data that is not owned by the constructed ASN1_STRING. The resulting ASN1_STRING, when freed, will not free the data, and it is the caller's resposibility to ensure that the data lives past the lifetime of any returned ASN1_STRING. Why? you may ask? Many places where ->data and ->length were used directly in the past before the opaquification of ASN1_STRING were for this purpose, whether used for actual static data, or to turn bytes created by and in control of the caller into an ASN1_STRING for temporary use as an input. This function makes this easier to do without making copies. The function deliberately does not allow the creation of a BIT_STRING as this would require also always providing unused bits, which is annoying and unnecessary for almost all potential use cases. For: https://github.com/openssl/openssl/issues/29861 For: https://github.com/openssl/openssl/issues/30162 Reviewed-by: Neil Horman Reviewed-by: Saša Nedvědický MergeDate: Wed Jun 3 11:42:49 2026 (Merged from https://github.com/openssl/openssl/pull/30964)

stack: use a copy thunk for typed stack deep copies

2026-05-20T15:53:32Z

typed safestack wrappers pass type-specific copy callbacks such as TYPE *(*)(const TYPE *) to OPENSSL_sk_deep_copy(). The generic stack code then called those callbacks through OPENSSL_sk_copyfunc, void *(*)(const void *), which is an incompatible function pointer type and triggers UBSan. Add an OPENSSL_sk_copyfunc_thunk and store it on typed stacks, mirroring the existing compare/free thunk pattern. Generated safestack helpers now install a per-type copy thunk when constructing a stack, and internal_copy() uses that thunk when deep-copying typed stacks. This preserves the generic stack API while ensuring typed copy callbacks are invoked through their real signature. Fixes: https://github.com/openssl/project/issues/1951 Signed-off-by: Nikola Pajkovsky Reviewed-by: Eugene Syromiatnikov Reviewed-by: Neil Horman MergeDate: Wed May 20 15:53:45 2026 (Merged from https://github.com/openssl/openssl/pull/31151)

Deprecate UTF8_putc/getc() and use uint32_t for unicode

2026-05-18T11:00:12Z

Unicode codepoints fit in 32 bits so we can use uint32_t instead of unsigned long. Also use OPENSSL_load_XX_be instead of manual shifting. Reviewed-by: Viktor Dukhovni Reviewed-by: Norbert Pocs MergeDate: Mon May 18 11:02:37 2026 (Merged from https://github.com/openssl/openssl/pull/30967)

Deprecate the ASN1_BIT_STRING name related funcitons.

2026-05-11T09:23:12Z

These seem to have been from something long long ago that nothing uses anymore. It seems like this is just something we should not be doing in this way. Reviewed-by: Saša Nedvědický Reviewed-by: Norbert Pocs MergeDate: Mon May 11 09:23:13 2026 (Merged from https://github.com/openssl/openssl/pull/30853)

Deprecate the X509_check_{email,host,ip,ip_asc} family of functions

2026-05-11T00:05:22Z

Our own documentation for quite some time has indicated that you should call X509_verify_cert() instead of using these. Actually deprecate them and make apps not use the now deprecated functions. Resolves: https://github.com/openssl/project/issues/1899 References: https://github.com/openssl/project/issues/1897 Reviewed-by: Neil Horman Reviewed-by: Eugene Syromiatnikov Reviewed-by: Norbert Pocs MergeDate: Mon May 11 00:08:33 2026 (Merged from https://github.com/openssl/openssl/pull/30403)

Added the EVP_EC_affine2oct() helper function

2026-05-06T16:46:51Z

This function converts affine coordinates of an EC point to an octet string conforming to Sec. 2.3.4 of the SECG SEC 1 ("Elliptic Curve Cryptography") standard. Reviewed-by: Matt Caswell Reviewed-by: Simo Sorce Reviewed-by: Tomas Mraz MergeDate: Wed May 6 16:47:57 2026 (Merged from https://github.com/openssl/openssl/pull/30597)

Touch the perl miasma in self defense.

2026-05-01T11:01:36Z

The symbol presence test fails for NO_DEPRECATED builds if you use modern CPP practices for definitions. This is the result of my accepting that doing so will be as PTSD inducing as walking into my parents bedroom at an inopportune time, and fixing it. Better me who has less time left to live with the mental trauma than a younger developer. Reviewed-by: Nikola Pajkovsky Reviewed-by: Norbert Pocs MergeDate: Fri May 1 11:01:46 2026 (Merged from https://github.com/openssl/openssl/pull/31016)

Deprecate ASN1_BIT_STRING_set()

2026-04-26T11:45:20Z

Replacement: ASN1_BIT_STRING_set1 Signed-off-by: Norbert Pocs Reviewed-by: Eugene Syromiatnikov Reviewed-by: Richard Levitte MergeDate: Sun Apr 26 11:45:27 2026 (Merged from https://github.com/openssl/openssl/pull/30692)