aboutsummaryrefslogtreecommitdiffstats
path: root/Configure
Commit message (Collapse)AuthorAgeFilesLines
* Add Deprecation Macros for 4.2Bob Beck2026-10-011-1/+1
| | | | | | | | | Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Richard Levitte <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Frederik Wedel-Heinen <[email protected]> Merge-date: Thu Oct 1 08:21:23 2026 Merged-from: https://github.com/openssl/openssl/pull/33039
* Add s390x cross-compile workflowTimo Keller2026-09-291-0/+109
| | | | | | | | | | | | Add s390x cross-compile workflow and change Configure for the s390x- optimized implementations of ML-KEM and ML-DSA. Signed-off-by: Timo Keller <[email protected]> Assisted-by: IBM Bob:2.0.3 Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Tue Sep 29 16:47:14 2026 Merged-from: https://github.com/openssl/openssl/pull/31929
* Fix coding style violation: do not use variable length arraysNicky Mouha2026-09-291-0/+1
| | | | | | | | | Signed-off-by: Nicky Mouha <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Tue Sep 29 16:40:02 2026 Merged-from: https://github.com/openssl/openssl/pull/32967
* Use SipHash for the internal fingerprintBob Beck2026-09-171-1/+4
| | | | | | | | | | | | | Replace SHA-1 with SipHash-2-4 (fixed key, 64-bit output) for the internal X509 and X509_CRL fingerprint. Always build crypto/siphash; no-siphash now only removes the provider MAC. Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Merge-date: Thu Sep 17 16:44:35 2026 Merged-from: https://github.com/openssl/openssl/pull/32686
* Add ASCON-AEAD128 cipher implementation per NIST SP 800-232evil-cry2026-09-161-1/+3
| | | | | | | | | | | | | | | | | | | | | | Integrate ASCON-AEAD128 authenticated encryption cipher into OpenSSL's default provider and libcrypto. ASCON-AEAD128 is specified in NIST SP 800-232 and provides authenticated encryption with associated data (AEAD) using a 128-bit key and 128-bit nonce. Implementation details: - Add cleanroom crypto/ascon implementation - Add provider cipher implementation following OpenSSL stream cipher patterns with generated parameter dispatch tables - Support standard AEAD operations including AAD handling, tag generation/verification, and context reinitialization Fixes: #28271 Co-authored-by: Billy Brumley <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> Merge-date: Wed Sep 16 14:25:19 2026 Merged-from: https://github.com/openssl/openssl/pull/29934
* rand: add seed_strict option enforcing the configured seed sourceJakub Zelenka2026-09-011-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When a provider requests seeding material via the get_user_entropy or get_user_nonce core callbacks before the primary DRBG was created, the request silently falls back to the operating system entropy sources, because the seed source EVP_RAND_CTX only comes into existence as a side effect of creating the primary DRBG. Whether a configured seed source is used therefore depends on operation order: for example with the FIPS provider, genrsa happened to use the configured source while ecparam -genkey did not. This fallback is acceptable for most setups, but not when the seed source selection is meant to be a guarantee, for example for compliance reasons. Add a seed_strict option to the [random] configuration section which makes the callbacks instantiate the seed source on demand and turns an unusable seed source into an error rather than a silent fallback. The option is off by default with two exceptions: selecting the JITTER seed source, at runtime or at build time via -DOPENSSL_DEFAULT_SEED_SRC, seeds strictly unless the option disables it, and enable-fips-jitter builds always seed strictly. The boolean value parsing is shared with the provider section by factoring the existing parser out into ossl_conf_parse_bool(). A build time default property query can now be set with -DOPENSSL_DEFAULT_SEED_PROPQ. Add a regression test covering the on-demand creation and the no fallback behaviour on the strict provider seeding path, a test for the default non-strict fallback behaviour including the JITTER strictness default, and [random] seed configuration coverage in the rand config test recipe. Fixes #25941 Assisted-by: Claude:claude-fable-5 Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Tue Sep 1 12:07:39 2026 Merged-from: https://github.com/openssl/openssl/pull/31939
* Run 70-test_tls13alerts.t with dtlsFrederik Wedel-Heinen2026-08-251-2/+2
| | | | | | Reviewed-by: Viktor Dukhovni <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/24525)
* Add mandoc output support for manpagesEnji Cooper2026-07-201-1/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | This change modifies the Makefile generator to support mandoc format manpages, in lieu of \*roff format manpages. After this commit the user has the ability of specifying the manpage format to the `--manpage-format` flag. The 2 supported manpage formats as of writing are "mdoc" and "roff" and the default remains the "roff" format for legacy and portability reasons. The mandoc format requires pod2mdoc to be installed, whereas the roff output format requires pod2man to be installed. The former requires an additional utility be installed, whereas the latter uses pod2man, a utility that has been present with perl distributions for well over a decade. mandoc format support is being added as it is an easier/arguably more structured manpage format to parse, making it easier for downstream consumers like FreeBSD to implement OS-specific build support, as the minimum dependencies for the OpenSSL build process are more involved than the tools available for the FreeBSD OS bootstrapping process. Signed-off-by: Enji Cooper <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Mon Jul 20 09:52:29 2026 (Merged from https://github.com/openssl/openssl/pull/28450)
* test: add Windows unit tests setup and initial dgram testJakub Zelenka2026-07-151-9/+62
| | | | | | | | | | | | | | | | | This adds an initial setup for unit testing on Windows that allows mocking of system functions using Detour library. This works only for library functions and not object function like wrap so it is a bit limited but it is still useful for BIO mocking. An initial BIO bss_dgram test is added covering the Windows specific parts. Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Igor Ustinov <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Wed Jul 15 16:00:35 2026 (Merged from https://github.com/openssl/openssl/pull/31915)
* Add unit testing cmocka based frameworkJakub Zelenka2026-07-091-1/+31
| | | | | | | | | | | | | | | This adds the unit testing framework that extends the build so it can be enabled and tests are built. It is executed as part of the test using a recipe which executes all unit tests. The documentation is added with more info about writing the unit tests. Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Richard Levitte <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Thu Jul 9 17:39:14 2026 (Merged from https://github.com/openssl/openssl/pull/30788)
* Add WRAP build.info variableJakub Zelenka2026-07-091-0/+13
| | | | | | | | | | This is used for adding per target --wrap ld flags for each listed function. Reviewed-by: Richard Levitte <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Thu Jul 9 17:39:12 2026 (Merged from https://github.com/openssl/openssl/pull/30788)
* Suppress function pointer type validation in clang ubsanNeil Horman2026-07-081-1/+5
| | | | | | | | | | | | | | | | | | | | | | | We've been concerned about ubsan errors comming with more recent versions of clang. specifically versions of clang later than 17 generate hundreds of function pointer type validation errors, i.e. assigning a function of type void (*)(TYPE *) to a function pointer of type void (*)(void *). Fixing these requires the creation of lots of thunk function that get littered through the code base, and are generally unpleasant to carry. A better fix requires siginficant code refactoring, and potentially large changes to our ABI, which we can't support until the next major release. So, for now, just suppress those ubsan errors, so we can more properly deal with the issue when we are able. Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Bob Beck <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> MergeDate: Wed Jul 8 16:01:12 2026 (Merged from https://github.com/openssl/openssl/pull/31837)
* Configure, INSTALL.md: make atexit deprecated disablableEugene Syromiatnikov2026-06-181-2/+3
| | | | | | | | | | | | | | | | As the atexit handler was removed in [1], no-atexit configuration option has no effect, make that explicit by disallowing enabling atexit, and update the documentation accordingly. [1] https://github.com/openssl/openssl/pull/29385 References: https://github.com/openssl/openssl/issues/30742 Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> MergeDate: Thu Jun 18 12:20:34 2026 (Merged from https://github.com/openssl/openssl/pull/30767)
* build: make enable-asan work for VC targetsJakub Zelenka2026-06-101-8/+11
| | | | | | | | | | | Configure assumed GCC/Clang sanitizer spellings, so enable-asan was a no-op on MSVC. Emit /fsanitize=address instead of -fsanitize=address on VC targets. Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> MergeDate: Wed Jun 10 12:53:11 2026 (Merged from https://github.com/openssl/openssl/pull/31366)
* Configure: update $apitable with the recent versionsEugene Syromiatnikov2026-05-191-9/+15
| | | | | | | | | | | | | | | Fill $apitable with all the major.minor.0 versions up to the current one in development. Note that while 3.5 hasn't had any APIs deprecated, it still makes sense to support passing it as an "API level". Resolves: https://github.com/openssl/openssl/issues/31196 Reported-by: Oliver Roberts <[email protected]> Signed-off-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Richard Levitte <[email protected]> Reviewed-by: Matt Caswell <[email protected]> MergeDate: Tue May 19 09:33:49 2026 (Merged from https://github.com/openssl/openssl/pull/31198)
* Add valgrind CT support to ML-DSAViktor Dukhovni2026-04-221-0/+42
| | | | | | | | | | | Also slightly refactor the ML-KEM version to share the necesasry defines, and add a daily CI run to check both (presently, for just some platforms with known working valgrind support). Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Shane Lontis <[email protected]> MergeDate: Wed Apr 22 07:55:14 2026 (Merged from https://github.com/openssl/openssl/pull/30863)
* Add IKEV2KDF implementationHelen Zhang2026-03-241-1/+2
| | | | | | | | | | In compliance with RFC7296 and SP800-135 Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Shane Lontis <[email protected]> Reviewed-by: Paul Dale <[email protected]> MergeDate: Tue Mar 24 17:21:21 2026 (Merged from https://github.com/openssl/openssl/pull/30121)
* Configure: Re-add srtpkdf disablableTomas Mraz2026-03-171-0/+1
| | | | | | | Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Paul Dale <[email protected]> MergeDate: Tue Mar 17 11:16:00 2026 (Merged from https://github.com/openssl/openssl/pull/30446)
* ECDH and ECDSA cannot be really disabled standaloneTomas Mraz2026-03-171-3/+1
| | | | | | | | | We should not pretend it can. Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Paul Dale <[email protected]> MergeDate: Tue Mar 17 11:15:59 2026 (Merged from https://github.com/openssl/openssl/pull/30446)
* feat: Disabled features are generated during configure automaticallyPaul Louvel2026-03-131-75/+104
| | | | | | | Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Paul Dale <[email protected]> MergeDate: Fri Mar 13 15:50:43 2026 (Merged from https://github.com/openssl/openssl/pull/30212)
* Copyright year updatesopenssl-machine2026-03-101-1/+1
| | | | | | | Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> MergeDate: Tue Mar 10 14:37:54 2026 Release: yes
* ECH build artefacts and a bit of codeStephen Farrell2026-02-201-1/+2
| | | | | | Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Matt Caswell <[email protected]> (Merged from https://github.com/openssl/openssl/pull/25193)
* Remove remaining RAND_DRBG.Frederik Wedel-Heinen2026-02-171-2/+1
| | | | | | | | Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Tom Cosgrove <[email protected]> Reviewed-by: Neil Horman <[email protected]> MergeDate: Tue Feb 17 14:09:07 2026 (Merged from https://github.com/openssl/openssl/pull/29782)
* Add abilty to use static vcruntimeNeil Horman2026-02-171-0/+2
| | | | | | | | | | | | Add a config option to selectively enable disable static vcruntime linkage (default disabled, implying dynamic vcruntime linkage) Fixes #12210 Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Tue Feb 17 09:43:37 2026 (Merged from https://github.com/openssl/openssl/pull/29995)
* Remove disabled-optimization warning againMilan Broz2026-01-231-1/+0
| | | | | | | | | | | | | | | | This warning does not play well in combination with sanitizers and its value is dubious. Instead of complicated decisions based on configuration flags just remove it from global list. Fixes: #29673 Signed-off-by: Milan Broz <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Fri Jan 23 14:00:29 2026 (Merged from https://github.com/openssl/openssl/pull/29714)
* Add SRTPKDF implementationHelen Zhang2026-01-231-1/+2
| | | | | | | | | In compliance with RFC 3711, Section 4.3.3 Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Shane Lontis <[email protected]> MergeDate: Fri Jan 23 10:19:32 2026 (Merged from https://github.com/openssl/openssl/pull/29435)
* Deprecate support of weak elliptic curves in TLS by defaultDmitry Belyavskiy2026-01-221-0/+1
| | | | | | | | | | | | See RFC 8422, section 5.1.1 Reviewed-by: Alicja Kario <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Viktor Dukhovni <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Paul Dale <[email protected]> MergeDate: Thu Jan 22 10:00:08 2026 (Merged from https://github.com/openssl/openssl/pull/29658)
* Add float-conversion to default strict warningsMilan Broz2026-01-221-0/+1
| | | | | | | | | | | | | | | | | | | | | | As discussed, bad-function-cast and conversion produces strange results. Add at least float-conversion - Warn for implicit conversions that reduce the precision of a real value. Also fix ct_test absolute value seconds calculation (without using math.h) and then converts is to time_t. (n.b. this is not stricly needed for the relaxed warnings, but it is more readable) Fixes: https://github.com/openssl/project/issues/1816 Signed-off-by: Milan Broz <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> MergeDate: Thu Jan 22 09:58:07 2026 (Merged from https://github.com/openssl/openssl/pull/29663)
* Fix type-limits and add this warning to default strict warningsMilan Broz2026-01-201-1/+1
| | | | | | | | | | | | | | One mistake recently introduced in commit b6aed64e47b. Fixes: https://github.com/openssl/project/issues/1815 Signed-off-by: Milan Broz <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Neil Horman <[email protected]> MergeDate: Tue Jan 20 18:44:58 2026 (Merged from https://github.com/openssl/openssl/pull/29662)
* Fix unterminated-string-initialization and add this warning to strict warningsMilan Broz2026-01-201-1/+0
| | | | | | | | | | | | | | | | | | | The -Wunterminated-string-initialization is a strange gcc warning, as C99 allows non-nul string initialization. Note, it is included in -Wextra, but does not exist in old gcc versions. However, it can report other real bugs. Fixes: https://github.com/openssl/project/issues/1814 Signed-off-by: Milan Broz <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Tue Jan 20 18:43:39 2026 (Merged from https://github.com/openssl/openssl/pull/29661)
* KDF: Add configuration options to disable many of the KDF algorithms.slontis2026-01-191-5/+16
| | | | | | | | | This includes KDF's for ss,x963,hmac-drbg,KB,KRB5,PVK,SNMP,SSH and X942. SSKDF/X963KDF Changes: Modify code to handle algorithms being disabled via configuration options. Reviewed-by: Tim Hudson <[email protected]> Reviewed-by: Paul Dale <[email protected]> (Merged from https://github.com/openssl/openssl/pull/29576)
* Disabling explicit EC curves encodingDmitry Belyavskiy2026-01-171-1/+3
| | | | | | | | In case the parameters don't exactly match the well-known ones Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Simo Sorce <[email protected]> (Merged from https://github.com/openssl/openssl/pull/29639)
* Add disabled-optimization and pointer-arith to compiler warningsMilan Broz2026-01-151-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | These flags seems not to be part of -Wextra, but looks like could be useful in CI. According to gcc man page: disabled-optimization Warn if a requested optimization pass is disabled. pointer-arith Warn about anything that depends on the "size of" a function type or of "void". Fixes: https://github.com/openssl/project/issues/1809 Signed-off-by: Milan Broz <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> MergeDate: Thu Jan 15 16:16:40 2026 (Merged from https://github.com/openssl/openssl/pull/29622)
* Allow enabling deprecated flags that haven't been removed yetAndrew Dinh2025-12-231-2/+3
| | | | | | | | Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Viktor Dukhovni <[email protected]> (Merged from https://github.com/openssl/openssl/pull/29338)
* Deprecate SSL3 Configure flagsAndrew Dinh2025-12-231-11/+11
| | | | | | | | | | | | Show a deprecated warning if users attempt to run Configure script with no-ssl3, no-ssl, or no-ssl3-method. Also adds a fix to the Configure script preventing users from enabling deprecated flags. Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Viktor Dukhovni <[email protected]> (Merged from https://github.com/openssl/openssl/pull/29338)
* Remove support for SSLv3Kurt Roeckx2025-12-231-1/+1
| | | | | | | | Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Viktor Dukhovni <[email protected]> (Merged from https://github.com/openssl/openssl/pull/29338)
* Remove crypto-mdebug-backtrace option from configNeil Horman2025-12-131-3/+1
| | | | | | | | | | | | | | | | | | | | We still build with crypto-mdebug-backtrace enabled in a few ci jobs, but it does nothing. With the upcoming merge of feature/removesslv3, the code changes there prevent the use of this option (i.e. enabling it results in configuration failure). It seems the most sensible thing to do here, given we have a major release is to eliminate the option entirely, as it hasn't done anything since 1.0.2. Fixes openssl/project#1763 Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Simo Sorce <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> (Merged from https://github.com/openssl/openssl/pull/29380)
* Make no-engine config permanently set.Milan Broz2025-12-041-4/+4
| | | | | | | | | | | | | | | | | | | It enables configuration defines: OPENSSL_NO_DYNAMIC_ENGINE OPENSSL_NO_STATIC_ENGINE OPENSSL_NO_ENGINE Fixes openssl/project#1711 Signed-off-by: Milan Broz <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Matt Caswell <[email protected]> (Merged from https://github.com/openssl/openssl/pull/29305)
* Remove engine-related testsMilan Broz2025-12-041-49/+3
| | | | | | | | | | | | | | | | | | | As engines are no longer included in test, these configuration options make no longer sense. All other test should be already enabled. Fixes openssl/project#1376 Signed-off-by: Milan Broz <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Matt Caswell <[email protected]> (Merged from https://github.com/openssl/openssl/pull/29305)
* Remove top-level engines dir.Milan Broz2025-12-041-1/+0
| | | | | | | | | | | | Signed-off-by: Milan Broz <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> (Merged from https://github.com/openssl/openssl/pull/29305)
* Configure: deprecate-disable engine related optionsNorbert Pocs2025-12-041-1/+8
| | | | | | | | | | | | Signed-off-by: Norbert Pocs <[email protected]> Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> (Merged from https://github.com/openssl/openssl/pull/29305)
* Remove OPENSSL_NO_STATIC_ENGINE macroNorbert Pocs2025-12-041-14/+1
| | | | | | | | | | | | | | Resolves: https://github.com/openssl/project/issues/1364 Signed-off-by: Norbert Pocs <[email protected]> Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> (Merged from https://github.com/openssl/openssl/pull/29305)
* Remove OPENSSL_NO_DYNAMIC_ENGINENorbert Pocs2025-12-041-43/+10
| | | | | | | | | | | | | | | | | | Most of the ifdefs were removed, but we want to rewrite the dasync engine to a provider. Therefore that code was not removed; instead a new temporary macro was added named TODO_REWRITE_ME_DASYNC_PROVIDER. Resolves: https://github.com/openssl/project/issues/1363 Signed-off-by: Norbert Pocs <[email protected]> Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> (Merged from https://github.com/openssl/openssl/pull/29305)
* Engine removal: Silence the CI tests about enginesNorbert Pocs2025-12-041-0/+16
| | | | | | | | | | | | | | | | | | | As we can't do every change in one big PR (and we also don't want), therefore there always will be failing tests until everything is resolved/cleaned up. This way we silence the CI about engine tests and later we can reenable them to see what else needs to be fixed. Resolves: https://github.com/openssl/project/issues/1371 Signed-off-by: Norbert Pocs <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Richard Levitte <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> (Merged from https://github.com/openssl/openssl/pull/29305)
* Configure: Warn about deprecated option when enabledNorbert Pocs2025-11-281-0/+4
| | | | | | | | | | | | Currently the deprecated configure option is warned only when "(no|disabled)-feature" is used, but wasn't warning when "enable-feature" was passed as a config option. Signed-off-by: Norbert Pocs <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> (Merged from https://github.com/openssl/openssl/pull/29229)
* Disable also argon2, scrypt and slh-dsa with no-bulkTomas Mraz2025-10-221-3/+3
| | | | | | Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Paul Dale <[email protected]> (Merged from https://github.com/openssl/openssl/pull/28970)
* fix: Apply cascade-disables before showing statusBMDan2025-08-111-0/+2
| | | | | | Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> (Merged from https://github.com/openssl/openssl/pull/22621)
* fix: restore missing --help in ConfigureBMDan2025-08-111-8/+60
| | | | | | Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> (Merged from https://github.com/openssl/openssl/pull/22621)
* add a handshake memory failure testNeil Horman2025-08-061-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | We would like to be able to test our memory failure paths, but forcing malloc to return NULL at certain points in time. This test does that, by running a sepcific workload n+1 time. In this case the workload is a simple ssl handshake. We run 1 test which sets our malloc wrapper into record mode, in which it just acts as a pass through to the system malloc call and records the number of times it was called. Then we run a second test, which does the same handshake N times, where N is the number of times malloc was called in the previous test. For each iteration in i=0..N we fail the ith malloc operation. We don't check for functional failures in the second test (as we expect failures), we just want to make sure that (a) we don't crash and (b) asan doesn't report any errors. Currently, we get _lots_ of asan failures, but we can use this test to log issues for that and fix those up. Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Paul Dale <[email protected]> (Merged from https://github.com/openssl/openssl/pull/28078)
* Make LMS disabled by defaultPauli2025-07-101-0/+1
| | | | | | Reviewed-by: Viktor Dukhovni <[email protected]> Reviewed-by: Matt Caswell <[email protected]> (Merged from https://github.com/openssl/openssl/pull/27885)
generated by cgit (git 2.51.2) at 2026-10-25 17:22:38 +0100