37562 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Tomas Mraz	3918bcdc27	BIO_send/recvmmsg(): Pass msgs_processed to the return callback ... This avoids crash if a legacy BIO callback is set and BIO_sendmmsg() or BIO_recvmmsg() is used. Reported by Stanislav Fort (Aisle Research) Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org> (Merged from https://github.com/openssl/openssl/pull/29395) (cherry picked from commit 380ff14485)	2025-12-19 16:37:34 +01:00
Danny Tsen	67d6844998	ppc64le: Restore VSX registers in AES/GCM ppc64le encrypt/decrypt ... The implementation failed to restore VSX vector registers from vs14-vs22. Re-implemented based on Linux kernel version. Fixes #28961 Signed-off-by: Danny Tsen <dtsen@us.ibm.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28990) (cherry picked from commit ebd690b1eb)	2025-12-19 15:08:54 +01:00
Dmitry Misharov	344372a6e5	add codespell pre-commit check and fix found misspellings ... (cherry picked from commit 29cb236dc9) Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/29431)	2025-12-19 09:07:53 +01:00
Weizhi Ao	27650a4951	Fix silent failure in ASYNC_start_job when size is 0 ... When ASYNC_start_job is called with args != NULL but size == 0, OPENSSL_malloc(0) is called. Depending on the libc implementation, malloc(0) may return NULL, causing a silent failure. This patch modifies the logic to skip allocation if size is 0. CLA: trivial Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/29377) (cherry picked from commit 5cbbced70d)	2025-12-18 17:35:17 +01:00
Matthias Kraft	d4da427c93	Ensure path to libcrypto can be resolved on AIX. ... On AIX, the environment of the test executable for test_includes doesn't contain a resolvable search path to the just built libcrypto. Setup LIBPATH to point to the build results. Fixes #29352. Signed-off-by: Matthias Kraft <Matthias.Kraft@ibm.com> Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/29375) (cherry picked from commit 576efc44ae)	2025-12-18 17:33:05 +01:00
Norbert Pocs	ff62893375	Check return code of UTF8_putc ... Signed-off-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/29376)	2025-12-18 11:39:23 +01:00
Norbert Pocs	d4f988ca4b	Harden ASN1_mbstring_ncopy ... Reported by Murali Aniruddhan Signed-off-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/29376)	2025-12-18 11:39:21 +01:00
Alexandr Nedvedicky	b5861cac48	The stream garbage collector loop in ossl_quic_stream_map_gc() is never entered ... Also remove ready_for_gc_next(), it is not needed any more. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org> (Merged from https://github.com/openssl/openssl/pull/29402)	2025-12-18 11:15:38 +01:00
Bob Beck	bad3803ccb	Defang the lhash test ... This is bascially eating my mac, as it now runs for 80 seconds and eats all the CPU's exercising lock contention. This dials it back to consume at most a quarter of the CPU's in use by HARNESS_JOBS, unless LHASH_WORKERS is set to override it in which case we use that. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/29406) (cherry picked from commit 131c2a1adb)	2025-12-17 08:59:13 -05:00
Tomas Mraz	6c83f92717	apps/req.c: Always set permissions for private key output ... The key output will be always private. Reported with a proposed fix by Stanislav Fort (Aisle Research). Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/29397)	2025-12-17 13:49:43 +01:00
Paul Elliott	ca15083602	Fix error in PAC/BTI AArch64 build ... Clang format removes a space here, which creates a compiler error when building for PAC/BTI. Fix this and Turn off clang format for this line Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/29399)	2025-12-17 13:26:23 +01:00
Igor Ustinov	4cd74d2081	Documentation for BIO flags and related functions. ... Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/29311) (cherry picked from commit e12870deb0)	2025-12-15 16:15:19 +01:00
Tomas Mraz	17411f0c42	other.syms: Add OPENSSL_ppccap as it is now documented ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> (Merged from https://github.com/openssl/openssl/pull/29379)	2025-12-11 15:58:55 +01:00
Bob Beck	5545bf3d60	Add static_ASN1_SEQUENCE_END to the list of statment macros ... This one is pretty special, we should ponder simplifying some of the clever preprocessor stuff here, but for now.. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/29359) (cherry picked from commit ba4970afb5)	2025-12-11 13:21:58 +01:00
Matthias Kraft	d4c9a312f3	Enable send-/recvmmsg for AIX >= 7.2 and disable SUPPORT_LOCAL_ADDR. ... AIX doesn't support this implementation for local addresses. The AF_INET case is unimplemented when sending. The AF_INET6 case is limited to 110 messages. The limiting factor is currently unclear. Fixes #29292 Signed-off-by: Matthias Kraft <Matthias.Kraft@ibm.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/29334) (cherry picked from commit 52cd2a49c5)	2025-12-11 13:19:38 +01:00
Niels Dossche	b1d9191260	Fix memory leak in error path of ec_gen_init() ... ec_gen_set_params() can fail after some big numbers have already been copied over. Those need to be cleaned to avoid a memory leak on failure. This can be done with ec_gen_cleanup(), which is also consistent in how the ecx_gen code does it. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/29335) (cherry picked from commit 26d138af72)	2025-12-11 13:13:54 +01:00
Viktor Dukhovni	4fe413b751	The return value of RSA_*_{en,de}crypt() is signed ... The functions RSA_(public|private)_(en|de)crypt() return a signed result, in particular `-1` may be returned on error, so the caller MUST treat the value as signed. Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/29323) (cherry picked from commit f247d36074)	2025-12-11 13:07:13 +01:00
lan1120	dff307038a	Fix memory leak in abnormal branch of mlx_kem_dup function ... Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/29318) (cherry picked from commit 013e1174df)	2025-12-11 13:05:35 +01:00
George Wilson	ce471e3d33	doc/man3: Add OPENSSL_ppccap.pod ... This patch adds a man page documenting the OPENSSL_ppccap environment variable that is analogous to capability environment variable man pages for other architectures. Fixes #17046 Signed-off-by: George Wilson <gcwilson@linux.ibm.com> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> (Merged from https://github.com/openssl/openssl/pull/29230) (cherry picked from commit ba26e3f46b)	2025-12-11 13:02:19 +01:00
Dmitry Misharov	c16147b606	run codespell pre-commit hook on staged files only ... Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/29360) (cherry picked from commit d70b22bf2d)	2025-12-10 13:31:38 -05:00
Dmitry Misharov	86225378c5	add clang-format as a pre-commit hook ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/29282) (cherry picked from commit d6f3733f94)	2025-12-09 10:28:19 -05:00
Matt Caswell	2d443c01c7	Fix array formatting in evp_extra_test.c ... The reformat did something silly with some of the arrays in evp_extra_test.c Fix the arrays such that clang-format is still happy. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/29349) (cherry picked from commit d54932c9fa)	2025-12-09 10:08:05 -05:00
Bob Beck	b69772afb1	Disable clang-format around this macro ... clang-format sensibly thinks this is an arithmatic operation, and formats the math. Sadly it does not know we eventually stringify this behind several other layers of nested macros and so putting spaces in here is bad. Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/29350) (cherry picked from commit 5b0dffa861)	2025-12-09 09:34:27 -05:00
Neil Horman	f73f62436f	add format commit to git blame ignore file ... Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> (Merged from https://github.com/openssl/openssl/pull/29346)	2025-12-09 05:54:40 -05:00
Bob Beck	65310e7e89	3.5-POST-CLANG-FORMAT-WEBKIT ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> (Merged from https://github.com/openssl/openssl/pull/29262) 3.5-POST-CLANG-FORMAT-WEBKIT	2025-12-09 02:40:50 -07:00
Bob Beck	8b8226e582	3.5-PRE-CLANG-FORMAT-WEBKIT ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> (Merged from https://github.com/openssl/openssl/pull/29262) 3.5-PRE-CLANG-FORMAT-WEBKIT	2025-12-09 02:39:32 -07:00
Pavol Žáčik	a722d0d739	apps/speed.c: Support more signature algorithms ... Some signature algorithms (e.g., ML-DSA-65) cannot be initialized via EVP_PKEY_sign_init, so try also EVP_PKEY_sign_message_init before reporting an error. Fixes #27108. Signed-off-by: Pavol Žáčik <zacik.pa@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/28224) (cherry picked from commit 39e286bd26)	2025-12-08 15:47:43 +01:00
Pavol Žáčik	225a64b376	apps/speed.c: Disable testing of composite signature algorithms ... Creating public key context from name would always fail for composite signature algorithms (such as RSA-SHA256) because the public key algorithm name (e.g., RSA) does not match the name of the composite algorithm. Relates to #27855. Signed-off-by: Pavol Žáčik <zacik.pa@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/28224) (cherry picked from commit dab850f499)	2025-12-08 15:47:41 +01:00
Dr. David von Oheimb	94394a69b1	CMP check_cert_path_3gpp(): add missing checks trying to retrieve newly enrolled cert ... Fixes #29285 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> (Merged from https://github.com/openssl/openssl/pull/29302) (cherry picked from commit 8482cb8232)	2025-12-05 15:03:41 +01:00
Dimitri John Ledkov	830a476451	seed_src_jitter: prevent hypothetical getrandom fallback ... In a hypothetical scenario that jent_entropy_init_ex fails, or if get_jitter_random-value fails, there are a few unexpected posibilities. If jent_entropy_init_ex fails, the seed initialisation may return NULL and then DRBG will be initiated with NULL seed, which will automatically fallback to os-seed, which will escape module boundary (if this jitter rng is from the fips module), and call getrandom syscall. And separately if get_jitter_random_value fails, it may put DRBG in an error state, but it might not put the FIPS module in error state, like it should as per the ISO standard. To instrument these things, I had to create tampered jitterentropy-library that always returns errors for init_ex and read_entropy apis, and then use gdb tracing on both libcrypto.so and fips.so. The most minimal solution to above hypothetical error code paths, is to simply call ossl_set_error_state. It is either harmless, or in case of fips-jitter will correctly put the FIPS module into error state and prevent any further operation; and cruitially prevent silent fallback to getrandom syscall. Note it is unlikely that this ever was out of compliance, as often enough getrandom syscall goes to a kernel with validated entropy source; and openssl fips module still did reject sampling which is too entropy source compliant. Nonetheless it is good to fix this hypothetical error path, and backport this to 3.5 and up. This is similar / additional fixes, to this previous change: - https://github.com/openssl/openssl/pull/25957 - b9886a6f34 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/29226) (cherry picked from commit 21069c983b)	2025-12-05 08:17:24 +11:00
Tomas Mraz	1b3d21a68f	prov-compat-label.yml: Add missing build of 3.6 branch ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/29301) (cherry picked from commit 69ab1e694d)	2025-12-04 18:48:05 +01:00
Bob Beck	4235c8eb8a	nits in progs.pl ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/29261)	2025-12-04 12:00:12 -05:00
Bob Beck	3a28cd849c	Disable clang format around .c includes ... we assume these to be order sensitive and not self contained, so as per our new style we disable clang format around them. we should consider renaming to .inc, or doing away with some of these and just putting the code inline, but that's for later consideration. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/29261)	2025-12-04 12:00:12 -05:00
Bob Beck	f1de967d84	Disable clang format around multi-line macros of sparc assembly ... They are not asm, but spit out stuff that is not C Clang-format gets confused and does bad things with them. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/29261)	2025-12-04 12:00:12 -05:00
Bob Beck	70b1ce1e67	Fix cmp_ctx_test.c to be less sensitive to line wrapping. ... Similar to the previous errtest.c fix this also is not broken by any reformatting today, but this change makes this follow the same pattern as the other things that test OPENSSL_LINE after the fact so we maintain the same paradigm everywhere. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/29261)	2025-12-04 12:00:12 -05:00
Bob Beck	dd05fc581f	fix errtest to be less sensitive to line wrapping changes ... (in it's final form it will work with either compiler because it's currently one line, but was tripped up before by the #ifdef, so redid it to be consistent with the other changes previously in this stack) While I am here correct the test to test for all possible return values of ERR_get_error_all, without the #ifdefs Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/29261)	2025-12-04 12:00:12 -05:00
Bob Beck	69b801b1b2	Fix apps/progs.pl to be slightly less fragile ... In particular fix the regex magic to be tolerant of different ways of formatting a main program. My past life had forgotten this magic 14 years ago when we converted it to just a table of commands in the forks. https://www.youtube.com/watch?v=mWbbjvYmN8A Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/29261)	2025-12-04 12:00:12 -05:00
Bob Beck	9a6040a50a	Add a WebKit clang-format file ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/29261)	2025-12-04 12:00:12 -05:00
Timothy Copeland	a00270c118	check_cert_crl(): Set CRL score for CRLs returned by get_crl callback ... Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/29199) (cherry picked from commit c7a657d800)	2025-12-04 11:17:03 +01:00
lan1120	702b952e3b	mlx_kem_dup(): Set key state to MLX_HAVE_NOKEYS when not copying keypair ... Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/29280) (cherry picked from commit bc06a6c96c)	2025-12-03 17:35:46 +01:00
Matthias Kraft	587843daf1	Skip symbol_presence test on AIX ... AIX `nm` reports symbols in a different way. Fix for: #29247 Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/29276) (cherry picked from commit ad29e4b134)	2025-12-03 17:29:55 +01:00
Dmitry Misharov	a301499043	add release notes from NEWS.md when making a release ... Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/29272)	2025-12-03 17:25:21 +01:00
Dmitry Misharov	2b06dccdf3	remove potentially not secure template expansions ... https://docs.zizmor.sh/audits/#template-injection Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (cherry picked from commit 33ec173876) Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> (Merged from https://github.com/openssl/openssl/pull/29272)	2025-12-03 17:25:21 +01:00
Tomas Mraz	366fd8bae8	dtls_get_reassembled_message(): Fix potential use-after-realloc ... Fortunately due to the initial size of the allocated buffer and the limit for unfragmented DTLS record size the use-after-realloc cannot be triggered. But we fix the potentially problematic code anyway. Reported Joshua Rogers. It was found with the ZeroPath security tooling. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/29278) (cherry picked from commit 6d1d85c31b)	2025-12-03 15:29:17 +01:00
Holger Dengler	f4957ae0c1	s390x: Check and fail on invalid malformed ECDSA signatures ... Check parameters of ECDSA signatures on verify and fail for invalid malformed signatures in the code path for s390x accelerators. Handle condition code of kdsa instruction for detecting invalid parameters. For NIST P521 curves, kdsa ignores completely the upper 14 bytes of the sections for r and s in the parameter-block, so adapt the offset and length for bignum conversions for these curves. This will detect cases of malformed signatures which are not covered by the kdsa parameter checking. Fixes: #29173 Signed-off-by: Holger Dengler <dengler@linux.ibm.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/29214) (cherry picked from commit 8e28ea9e62)	2025-12-03 14:32:56 +01:00
Holger Dengler	4db04d4558	s390x: Return condition code of kdsa instruction ... The kdsa instruction is doing some parameter checking for the verify function codes, like r/s equals zero and range checks. To handle these cases correctly in the calling functions, the asm returns now also condition code 2. Signed-off-by: Holger Dengler <dengler@linux.ibm.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/29214) (cherry picked from commit bcaa2a3af6)	2025-12-03 14:32:55 +01:00
Samaresh Kumar Singh	bff0921714	Improve provider-signature documentation clarity ... - Add explicit links to related EVP_* functions for each signature method - Clarify the differences between sign/verify, message sign/verify, and digest sign/verify functions - Document TLS 1.3 requirements: digest_sign/verify functions are mandatory for libssl usage - Provide guidance for provider developers on which functions to implement for different use cases Fixes #27127 Signed-off-by: Samaresh Kumar Singh <ssam3003@gmail.com> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> (Merged from https://github.com/openssl/openssl/pull/29166) (cherry picked from commit 47418dd8de)	2025-12-03 14:23:32 +01:00
Bernd Edlinger	bd43458256	CIFuzz: Remove some unnecessary files to free up space ... Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/29061) (cherry picked from commit 0857839af1)	2025-12-03 14:11:38 +01:00
Neil Horman	66f92cfb92	ensure destructor key is created prior to any other thread specific key ... https://github.com/openssl/openssl/issues/29077 found that, in the event that a pthread key is created prior to the destructor_key, glibc will NULL-ify any thread specific data before the init_thread_destructor runs, leading to leaks. Ensure that we always create the destructor key prior to any other thread local storage keys Fixes #29907 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org> (Merged from https://github.com/openssl/openssl/pull/29182)	2025-12-01 13:21:55 -05:00
Igor Ustinov	795c5f9d07	Branch 3.2 was removed from and branch 3.6 was added to the ... "Provider compatibility for PRs" test. Do not test the provider from the PR against modified branches. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/29236) (cherry picked from commit 20991f3000)	2025-12-01 10:30:55 +01:00