public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
* [rpms/openssl] f45: Rebase to OpenSSL 4.0.2
@ 2026-08-28 10:57 Dmitry Belyavskiy
0 siblings, 0 replies; only message in thread
From: Dmitry Belyavskiy @ 2026-08-28 10:57 UTC (permalink / raw)
To: git-commits
A new commit has been pushed.
Repo : rpms/openssl
Branch : f45
Commit : 07e26394a799dee4210c52c320487f84b96cb45d
Author : Dmitry Belyavskiy <dbelyavs@redhat.com>
Date : 2026-08-28T12:46:20+02:00
Stats : +67/-377 in 20 file(s)
URL : https://src.fedoraproject.org/rpms/openssl/c/07e26394a799dee4210c52c320487f84b96cb45d?branch=f45
Log:
Rebase to OpenSSL 4.0.2
---
diff --git a/.gitignore b/.gitignore
index a83965c..dd3df57 100644
--- a/.gitignore
+++ b/.gitignore
@@ -71,3 +71,4 @@ openssl-1.0.0a-usa.tar.bz2
/openssl-3.5.5.tar.gz
/openssl-4.0.0-beta1.tar.gz
/openssl-4.0.1.tar.gz
+/openssl-4.0.2.tar.gz
diff --git a/0001-RH-Aarch64-and-ppc64le-use-lib64.patch b/0001-RH-Aarch64-and-ppc64le-use-lib64.patch
index 1a80c03..dcefcb7 100644
--- a/0001-RH-Aarch64-and-ppc64le-use-lib64.patch
+++ b/0001-RH-Aarch64-and-ppc64le-use-lib64.patch
@@ -1,4 +1,4 @@
-From 622dc0b5d9a8cdff80e12eab1a7dd593cf5358bf Mon Sep 17 00:00:00 2001
+From 3f7e619b2e514ffba973859e2ec7cd5988796c2d Mon Sep 17 00:00:00 2001
From: rpm-build <rpm-build>
Date: Wed, 6 Mar 2024 19:17:14 +0100
Subject: [PATCH 01/16] RH: Aarch64 and ppc64le use lib64
@@ -34,5 +34,5 @@ index 528c8298aa..c12a01e658 100644
"linux-arm64ilp32" => { # https://wiki.linaro.org/Platform/arm64-ilp32
inherit_from => [ "linux-generic32" ],
--
-2.54.0
+2.55.0
diff --git a/0002-Add-a-separate-config-file-to-use-for-rpm-installs.patch b/0002-Add-a-separate-config-file-to-use-for-rpm-installs.patch
index 2b38d47..b0bc079 100644
--- a/0002-Add-a-separate-config-file-to-use-for-rpm-installs.patch
+++ b/0002-Add-a-separate-config-file-to-use-for-rpm-installs.patch
@@ -1,4 +1,4 @@
-From 6f4318e5a36a9879abfaa01ac78a1ba0a5eaf0d7 Mon Sep 17 00:00:00 2001
+From a11935596f009939e9b30f86776b5c75bd84d1e5 Mon Sep 17 00:00:00 2001
From: Simo Sorce <simo@redhat.com>
Date: Thu, 6 Mar 2025 08:40:29 -0500
Subject: [PATCH 02/16] Add a separate config file to use for rpm installs
@@ -457,5 +457,5 @@ index 0000000000..92e5be8837
+cmd = rr
+oldcert = $insta::certout # insta.cert.pem
--
-2.54.0
+2.55.0
diff --git a/0003-RH-Do-not-install-html-docs.patch b/0003-RH-Do-not-install-html-docs.patch
index 1134805..8f426e3 100644
--- a/0003-RH-Do-not-install-html-docs.patch
+++ b/0003-RH-Do-not-install-html-docs.patch
@@ -1,4 +1,4 @@
-From 1d91893171ee4f0c415c6c5c7b487cb8ab4e0913 Mon Sep 17 00:00:00 2001
+From 25343448ebc611432b4ee1576e99bf7606f52309 Mon Sep 17 00:00:00 2001
From: rpm-build <rpm-build>
Date: Wed, 6 Mar 2024 19:17:14 +0100
Subject: [PATCH 03/16] RH: Do not install html docs
@@ -26,5 +26,5 @@ index eff66e536f..511bbb2ea7 100644
uninstall_docs: uninstall_man_docs uninstall_html_docs ## Uninstall manpages and HTML documentation
$(RM) -r "$(DESTDIR)$(DOCDIR)"
--
-2.54.0
+2.55.0
diff --git a/0004-RH-Disable-signature-verification-with-bad-digests-R.patch b/0004-RH-Disable-signature-verification-with-bad-digests-R.patch
index 78a445b..117a4fb 100644
--- a/0004-RH-Disable-signature-verification-with-bad-digests-R.patch
+++ b/0004-RH-Disable-signature-verification-with-bad-digests-R.patch
@@ -1,4 +1,4 @@
-From dcea300e0efb8b7fa7fddecea2df4de9c49aa8e7 Mon Sep 17 00:00:00 2001
+From 863ecf2c8546d1f8d93730f3420fe1972da7b1c9 Mon Sep 17 00:00:00 2001
From: rpm-build <rpm-build>
Date: Wed, 6 Mar 2024 19:17:14 +0100
Subject: [PATCH 04/16] RH: Disable signature verification with bad digests -
@@ -30,5 +30,5 @@ index 188c6c93fc..a75e0e11da 100644
const EVP_MD *type = NULL;
--
-2.54.0
+2.55.0
diff --git a/0005-RH-Add-support-for-PROFILE-SYSTEM-system-default-cip.patch b/0005-RH-Add-support-for-PROFILE-SYSTEM-system-default-cip.patch
index 32cf403..7b2155d 100644
--- a/0005-RH-Add-support-for-PROFILE-SYSTEM-system-default-cip.patch
+++ b/0005-RH-Add-support-for-PROFILE-SYSTEM-system-default-cip.patch
@@ -1,4 +1,4 @@
-From a85e076504d1bbdcd24ea771650b67ce1044ece5 Mon Sep 17 00:00:00 2001
+From 5408b7475fc6e6cdae3a2f6cbd70ff8b31eca329 Mon Sep 17 00:00:00 2001
From: rpm-build <rpm-build>
Date: Wed, 6 Mar 2024 19:17:14 +0100
Subject: [PATCH 05/16] RH: Add support for PROFILE SYSTEM system default
@@ -120,7 +120,7 @@ index 49da923059..cfb063088c 100644
/*
diff --git a/include/openssl/ssl.h.in b/include/openssl/ssl.h.in
-index 452b696d5e..eb0c12c4cd 100644
+index 96b9079d2b..fb912579b7 100644
--- a/include/openssl/ssl.h.in
+++ b/include/openssl/ssl.h.in
@@ -212,6 +212,11 @@ extern "C" {
@@ -289,7 +289,7 @@ index 61460c0f85..356f12b328 100644
char *SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf, int len)
diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c
-index 549bd7d125..29c0b74a94 100644
+index a564fd81b3..fbb2644186 100644
--- a/ssl/ssl_lib.c
+++ b/ssl/ssl_lib.c
@@ -671,7 +671,7 @@ int SSL_CTX_set_ssl_version(SSL_CTX *ctx, const SSL_METHOD *meth)
@@ -325,5 +325,5 @@ index 921afe6234..be2c382f85 100644
ADD_TEST(test_default_cipherlist_clear);
#ifndef OPENSSL_NO_TLS1_3
--
-2.54.0
+2.55.0
diff --git a/0006-RH-Add-FIPS_mode-compatibility-macro.patch b/0006-RH-Add-FIPS_mode-compatibility-macro.patch
index 78dce79..547b364 100644
--- a/0006-RH-Add-FIPS_mode-compatibility-macro.patch
+++ b/0006-RH-Add-FIPS_mode-compatibility-macro.patch
@@ -1,4 +1,4 @@
-From fe3371833527298b733945f357c708fdff865d4c Mon Sep 17 00:00:00 2001
+From 30862e6f0ddb829ac5bee625c13fcebc63d30b40 Mon Sep 17 00:00:00 2001
From: rpm-build <rpm-build>
Date: Wed, 6 Mar 2024 19:17:15 +0100
Subject: [PATCH 06/16] RH: Add FIPS_mode compatibility macro
@@ -79,5 +79,5 @@ index eea1f28a19..521cf019f5 100644
ADD_TEST(test_property_list_to_string_bounds);
return 1;
--
-2.54.0
+2.55.0
diff --git a/0007-RH-Add-Kernel-FIPS-mode-flag-support-FIXSTYLE.patch b/0007-RH-Add-Kernel-FIPS-mode-flag-support-FIXSTYLE.patch
index be642a0..ce58597 100644
--- a/0007-RH-Add-Kernel-FIPS-mode-flag-support-FIXSTYLE.patch
+++ b/0007-RH-Add-Kernel-FIPS-mode-flag-support-FIXSTYLE.patch
@@ -1,4 +1,4 @@
-From caed2aca9c327a84716ab769f2060e8d74c407f4 Mon Sep 17 00:00:00 2001
+From a731cbbb27f2dec2f1e5ede2845255836b82a750 Mon Sep 17 00:00:00 2001
From: rpm-build <rpm-build>
Date: Wed, 6 Mar 2024 19:17:15 +0100
Subject: [PATCH 07/16] RH: Add Kernel FIPS mode flag support - FIXSTYLE
@@ -82,5 +82,5 @@ index 1b4050a81f..eb7f409af0 100644
#endif
--
-2.54.0
+2.55.0
diff --git a/0008-RH-Allow-disabling-of-SHA1-signatures.patch b/0008-RH-Allow-disabling-of-SHA1-signatures.patch
index c937551..33110e2 100644
--- a/0008-RH-Allow-disabling-of-SHA1-signatures.patch
+++ b/0008-RH-Allow-disabling-of-SHA1-signatures.patch
@@ -1,4 +1,4 @@
-From d12e7363cd57c63b5a3914dac935a091a53476d5 Mon Sep 17 00:00:00 2001
+From 2174352057fb6761895cb635106c6f9d4fcd37ed Mon Sep 17 00:00:00 2001
From: Dmitry Belyavskiy <dbelyavs@redhat.com>
Date: Mon, 21 Aug 2023 13:07:07 +0200
Subject: [PATCH 08/16] RH: Allow disabling of SHA1 signatures
@@ -426,7 +426,7 @@ index 9e874f0726..3025817fd4 100644
if (EVP_MD_xof(md)) {
ERR_raise(ERR_LIB_PROV, PROV_R_XOF_DIGESTS_NOT_ALLOWED);
diff --git a/providers/implementations/signature/rsa_sig.c b/providers/implementations/signature/rsa_sig.c
-index a3260eda39..ebdbed61a9 100644
+index ba54527739..17b6a3b5a7 100644
--- a/providers/implementations/signature/rsa_sig.c
+++ b/providers/implementations/signature/rsa_sig.c
@@ -26,6 +26,7 @@
@@ -455,7 +455,7 @@ index a3260eda39..ebdbed61a9 100644
ERR_raise_data(ERR_LIB_PROV, PROV_R_DIGEST_NOT_ALLOWED,
"digest=%s", mdname);
goto err;
-@@ -1761,8 +1764,13 @@ static int rsa_set_ctx_params(void *vprsactx, const OSSL_PARAM params[])
+@@ -1767,8 +1770,13 @@ static int rsa_set_ctx_params(void *vprsactx, const OSSL_PARAM params[])
prsactx->pad_mode = pad_mode;
if (prsactx->md == NULL && pmdname == NULL
@@ -472,7 +472,7 @@ index a3260eda39..ebdbed61a9 100644
if (pmgf1mdname != NULL
&& !rsa_setup_mgf1_md(prsactx, pmgf1mdname, pmgf1mdprops))
diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c
-index 9dd87dc4ac..bd5a4f01b0 100644
+index 4bc2748e97..dc91485334 100644
--- a/ssl/t1_lib.c
+++ b/ssl/t1_lib.c
@@ -21,6 +21,7 @@
@@ -483,7 +483,7 @@ index 9dd87dc4ac..bd5a4f01b0 100644
#include "internal/nelem.h"
#include "internal/sizes.h"
#include "internal/tlsgroups.h"
-@@ -2342,6 +2343,7 @@ int ssl_setup_sigalgs(SSL_CTX *ctx)
+@@ -2318,6 +2319,7 @@ int ssl_setup_sigalgs(SSL_CTX *ctx)
EVP_PKEY *tmpkey = EVP_PKEY_new();
int istls;
int ret = 0;
@@ -491,7 +491,7 @@ index 9dd87dc4ac..bd5a4f01b0 100644
if (ctx == NULL)
goto err;
-@@ -2359,6 +2361,7 @@ int ssl_setup_sigalgs(SSL_CTX *ctx)
+@@ -2335,6 +2337,7 @@ int ssl_setup_sigalgs(SSL_CTX *ctx)
goto err;
ERR_set_mark();
@@ -499,7 +499,7 @@ index 9dd87dc4ac..bd5a4f01b0 100644
/* First fill cache and tls12_sigalgs list from legacy algorithm list */
for (i = 0, lu = sigalg_lookup_tbl;
i < OSSL_NELEM(sigalg_lookup_tbl); lu++, i++) {
-@@ -2379,6 +2382,11 @@ int ssl_setup_sigalgs(SSL_CTX *ctx)
+@@ -2355,6 +2358,11 @@ int ssl_setup_sigalgs(SSL_CTX *ctx)
cache[i].available = 0;
continue;
}
@@ -522,5 +522,5 @@ index 2970fb0a09..77efdb982a 100644
+ossl_ctx_legacy_digest_signatures_allowed ? 4_0_0 EXIST::FUNCTION:
+ossl_ctx_legacy_digest_signatures_allowed_set ? 4_0_0 EXIST::FUNCTION:
--
-2.54.0
+2.55.0
diff --git a/0009-FIPS-Force-fips-provider-on.patch b/0009-FIPS-Force-fips-provider-on.patch
index 7a5d35a..cf16363 100644
--- a/0009-FIPS-Force-fips-provider-on.patch
+++ b/0009-FIPS-Force-fips-provider-on.patch
@@ -1,4 +1,4 @@
-From aa5a6ee75a04e286ab7e7dbeac37cd3b68c2b506 Mon Sep 17 00:00:00 2001
+From 1561f21a828eb2d7421e025b78074c2368657b5a Mon Sep 17 00:00:00 2001
From: rpm-build <rpm-build>
Date: Wed, 6 Mar 2024 19:17:15 +0100
Subject: [PATCH 09/16] FIPS: Force fips provider on
@@ -75,5 +75,5 @@ index f2e76ac402..a2a8a9942c 100644
}
--
-2.54.0
+2.55.0
diff --git a/0010-FIPS-RAND-FIPS-140-3-DRBG-NEEDS-REVIEW.patch b/0010-FIPS-RAND-FIPS-140-3-DRBG-NEEDS-REVIEW.patch
index e6cafb6..0fac358 100644
--- a/0010-FIPS-RAND-FIPS-140-3-DRBG-NEEDS-REVIEW.patch
+++ b/0010-FIPS-RAND-FIPS-140-3-DRBG-NEEDS-REVIEW.patch
@@ -1,4 +1,4 @@
-From cae10ead79291110d66e202f8998e5491902831d Mon Sep 17 00:00:00 2001
+From 02286af50ee9191fac53388f0808a715a9083dd9 Mon Sep 17 00:00:00 2001
From: rpm-build <rpm-build>
Date: Wed, 6 Mar 2024 19:17:16 +0100
Subject: [PATCH 10/16] FIPS: RAND: FIPS-140-3 DRBG - NEEDS REVIEW
@@ -68,7 +68,7 @@ index 9e80ef5b1f..ab6c263198 100644
if (reseed_required || prediction_resistance) {
if (!ossl_prov_drbg_reseed_unlocked(drbg, prediction_resistance, NULL,
diff --git a/providers/implementations/rands/seeding/rand_unix.c b/providers/implementations/rands/seeding/rand_unix.c
-index 1af996b25f..18e8c0dec1 100644
+index a26519aa3e..815476dc24 100644
--- a/providers/implementations/rands/seeding/rand_unix.c
+++ b/providers/implementations/rands/seeding/rand_unix.c
@@ -53,6 +53,8 @@
@@ -140,7 +140,7 @@ index 1af996b25f..18e8c0dec1 100644
- return getrandom(buf, buflen, 0);
-#elif (defined(__FreeBSD__) || defined(__NetBSD__)) && defined(KERN_ARND)
- return sysctl_random(buf, buflen);
--#elif defined(__wasi__)
+-#elif defined(__wasi__) || defined(__EMSCRIPTEN__)
- if (getentropy(buf, buflen) == 0)
- return (ssize_t)buflen;
- return -1;
@@ -154,5 +154,5 @@ index 1af996b25f..18e8c0dec1 100644
#endif /* defined(OPENSSL_RAND_SEED_GETRANDOM) */
--
-2.54.0
+2.55.0
diff --git a/0011-FIPS-TLS-Enforce-EMS-in-TLS-1.2-NOTE.patch b/0011-FIPS-TLS-Enforce-EMS-in-TLS-1.2-NOTE.patch
index 2d088a5..5942b6e 100644
--- a/0011-FIPS-TLS-Enforce-EMS-in-TLS-1.2-NOTE.patch
+++ b/0011-FIPS-TLS-Enforce-EMS-in-TLS-1.2-NOTE.patch
@@ -1,4 +1,4 @@
-From e9ca648f74f03fe6380589cd359005ebd71cc2b8 Mon Sep 17 00:00:00 2001
+From 69cf48b40610adf8de8676db46e874868eeddbb4 Mon Sep 17 00:00:00 2001
From: rpm-build <rpm-build>
Date: Wed, 6 Mar 2024 19:17:17 +0100
Subject: [PATCH 11/16] FIPS: TLS: Enforce EMS in TLS 1.2 - NOTE
@@ -62,7 +62,7 @@ index 2e5a789b44..1832f9cf20 100644
Copyright 2019-2026 The OpenSSL Project Authors. All Rights Reserved.
diff --git a/include/openssl/ssl.h.in b/include/openssl/ssl.h.in
-index eb0c12c4cd..9dcec2aac9 100644
+index fb912579b7..60be2e8216 100644
--- a/include/openssl/ssl.h.in
+++ b/include/openssl/ssl.h.in
@@ -457,6 +457,7 @@ typedef int (*SSL_async_callback_fn)(SSL *s, void *arg);
@@ -176,5 +176,5 @@ index 50944328cb..edb2e81273 100644
KDF = TLS1-PRF
Ctrl.digest = digest:SHA256
--
-2.54.0
+2.55.0
diff --git a/0012-FIPS-CMS-Set-default-padding-to-OAEP.patch b/0012-FIPS-CMS-Set-default-padding-to-OAEP.patch
index eca95bb..fd236e3 100644
--- a/0012-FIPS-CMS-Set-default-padding-to-OAEP.patch
+++ b/0012-FIPS-CMS-Set-default-padding-to-OAEP.patch
@@ -1,4 +1,4 @@
-From db42a6ba6d1c2c60fe9fae273e46c6b2b1674d6a Mon Sep 17 00:00:00 2001
+From 18863688987b2b1b8a75304fbb4cd3f90aee4151 Mon Sep 17 00:00:00 2001
From: Simo Sorce <simo@redhat.com>
Date: Thu, 13 Feb 2025 18:08:34 -0500
Subject: [PATCH 12/16] FIPS: CMS: Set default padding to OAEP
@@ -22,7 +22,7 @@ index dbec80e682..5c0503eb60 100644
static int save_certs(char *signerfile, STACK_OF(X509) *signers);
static int cms_cb(int ok, X509_STORE_CTX *ctx);
diff --git a/crypto/cms/cms_env.c b/crypto/cms/cms_env.c
-index 364869d239..5462f80c01 100644
+index b8d0c96211..9876b5d25a 100644
--- a/crypto/cms/cms_env.c
+++ b/crypto/cms/cms_env.c
@@ -21,6 +21,7 @@
@@ -57,5 +57,5 @@ index 364869d239..5462f80c01 100644
if (EVP_PKEY_encrypt(pctx, NULL, &eklen, ec->key, ec->keylen) <= 0)
--
-2.54.0
+2.55.0
diff --git a/0013-FIPS-PKCS12-PBMAC1-defaults.patch b/0013-FIPS-PKCS12-PBMAC1-defaults.patch
index 090377d..d52c223 100644
--- a/0013-FIPS-PKCS12-PBMAC1-defaults.patch
+++ b/0013-FIPS-PKCS12-PBMAC1-defaults.patch
@@ -1,4 +1,4 @@
-From 877df8ff2cf40b79478ce11676ebadf1041c10ad Mon Sep 17 00:00:00 2001
+From 2817a5db284624dcf53402070261179a2b9df14e Mon Sep 17 00:00:00 2001
From: Simo Sorce <simo@redhat.com>
Date: Thu, 13 Feb 2025 18:16:29 -0500
Subject: [PATCH 13/16] FIPS: PKCS12: PBMAC1 defaults
@@ -31,5 +31,5 @@ index 09ed684472..45c7caf3e3 100644
if (!PKCS12_set_pbmac1_pbkdf2(p12, mpass, -1, NULL,
macsaltlen, maciter,
--
-2.54.0
+2.55.0
diff --git a/0014-FIPS-EC-disable-weak-curves.patch b/0014-FIPS-EC-disable-weak-curves.patch
index a4dd7de..c67e83f 100644
--- a/0014-FIPS-EC-disable-weak-curves.patch
+++ b/0014-FIPS-EC-disable-weak-curves.patch
@@ -1,4 +1,4 @@
-From 48ae07d536f94e4fb5db3033ddcb915b1f13deac Mon Sep 17 00:00:00 2001
+From a13523d199369be606c77bbf9365be5451241ac5 Mon Sep 17 00:00:00 2001
From: Simo Sorce <simo@redhat.com>
Date: Fri, 7 Mar 2025 18:06:36 -0500
Subject: [PATCH 14/16] FIPS: EC: disable weak curves
@@ -27,5 +27,5 @@ index cbb2ec8d50..8a8e318583 100644
comment = "CURVE DESCRIPTION NOT AVAILABLE";
if (sname == NULL)
--
-2.54.0
+2.55.0
diff --git a/0015-Make-openssl-speed-run-in-FIPS-mode.patch b/0015-Make-openssl-speed-run-in-FIPS-mode.patch
index 07706e2..041125e 100644
--- a/0015-Make-openssl-speed-run-in-FIPS-mode.patch
+++ b/0015-Make-openssl-speed-run-in-FIPS-mode.patch
@@ -1,4 +1,4 @@
-From 6f8815af14568ff7de50c20f1f752a8f6eb2bec2 Mon Sep 17 00:00:00 2001
+From 59af36526a2a410fac22c53ba2fe50b09266448a Mon Sep 17 00:00:00 2001
From: Dmitry Belyavskiy <beldmit@gmail.com>
Date: Fri, 9 May 2025 15:09:46 +0200
Subject: [PATCH 15/16] Make `openssl speed` run in FIPS mode
@@ -72,5 +72,5 @@ index aa10d32bd5..c6c1dd3ae2 100644
for (i = 0; i < loopargs_len; i++)
--
-2.54.0
+2.55.0
diff --git a/0016-Allow-hybrid-MLKEM-in-FIPS-mode.patch b/0016-Allow-hybrid-MLKEM-in-FIPS-mode.patch
index 5be26e8..648d7f0 100644
--- a/0016-Allow-hybrid-MLKEM-in-FIPS-mode.patch
+++ b/0016-Allow-hybrid-MLKEM-in-FIPS-mode.patch
@@ -1,4 +1,4 @@
-From db9751d617467a7637dcdc6eba20f0f20f24b10e Mon Sep 17 00:00:00 2001
+From 551dd97a53926e2aec00b7801b801f427f7825c2 Mon Sep 17 00:00:00 2001
From: Dmitry Belyavskiy <beldmit@gmail.com>
Date: Fri, 30 May 2025 16:17:37 +0200
Subject: [PATCH 16/16] Allow hybrid MLKEM in FIPS mode
@@ -12,10 +12,10 @@ Subject: [PATCH 16/16] Allow hybrid MLKEM in FIPS mode
5 files changed, 105 insertions(+), 15 deletions(-)
diff --git a/crypto/ml_kem/ml_kem.c b/crypto/ml_kem/ml_kem.c
-index 5d5edc8b93..d6af8e747f 100644
+index 738445562e..6296db7f2e 100644
--- a/crypto/ml_kem/ml_kem.c
+++ b/crypto/ml_kem/ml_kem.c
-@@ -1632,6 +1632,7 @@ ML_KEM_KEY *ossl_ml_kem_key_new(OSSL_LIB_CTX *libctx, const char *properties,
+@@ -1670,6 +1670,7 @@ ML_KEM_KEY *ossl_ml_kem_key_new(OSSL_LIB_CTX *libctx, const char *properties,
{
const ML_KEM_VINFO *vinfo = ossl_ml_kem_get_vinfo(evp_type);
ML_KEM_KEY *key;
@@ -23,7 +23,7 @@ index 5d5edc8b93..d6af8e747f 100644
if (vinfo == NULL) {
ERR_raise_data(ERR_LIB_CRYPTO, ERR_R_PASSED_INVALID_ARGUMENT,
-@@ -1642,15 +1643,17 @@ ML_KEM_KEY *ossl_ml_kem_key_new(OSSL_LIB_CTX *libctx, const char *properties,
+@@ -1680,15 +1681,17 @@ ML_KEM_KEY *ossl_ml_kem_key_new(OSSL_LIB_CTX *libctx, const char *properties,
if ((key = OPENSSL_malloc(sizeof(*key))) == NULL)
return NULL;
@@ -56,10 +56,10 @@ index 390144a473..486475100f 100644
+char *get_adjusted_propq(const char *propq);
#endif /* OPENSSL_HEADER_ML_KEM_H */
diff --git a/providers/defltprov.c b/providers/defltprov.c
-index d19d6ece26..56c6f350e3 100644
+index db9f84748a..d465404dfb 100644
--- a/providers/defltprov.c
+++ b/providers/defltprov.c
-@@ -571,8 +571,8 @@ static const OSSL_ALGORITHM deflt_asym_kem[] = {
+@@ -567,8 +567,8 @@ static const OSSL_ALGORITHM deflt_asym_kem[] = {
{ PROV_NAMES_X448MLKEM1024, "provider=default", ossl_mlx_kem_asym_kem_functions },
#endif
#if !defined(OPENSSL_NO_EC)
@@ -70,7 +70,7 @@ index d19d6ece26..56c6f350e3 100644
#endif
#if !defined(OPENSSL_NO_SM2)
{ PROV_NAMES_curveSM2MLKEM768, "provider=default", ossl_mlx_kem_asym_kem_functions },
-@@ -661,13 +661,13 @@ static const OSSL_ALGORITHM deflt_keymgmt[] = {
+@@ -657,13 +657,13 @@ static const OSSL_ALGORITHM deflt_keymgmt[] = {
{ PROV_NAMES_X25519MLKEM768, "provider=default", ossl_mlx_x25519_kem_kmgmt_functions,
PROV_DESCS_X25519MLKEM768 },
{ PROV_NAMES_X448MLKEM1024, "provider=default", ossl_mlx_x448_kem_kmgmt_functions,
@@ -90,7 +90,7 @@ index d19d6ece26..56c6f350e3 100644
#if !defined(OPENSSL_NO_SM2)
{ PROV_NAMES_curveSM2MLKEM768, "provider=default", ossl_mlx_curve_sm2_kem_kmgmt_functions,
diff --git a/providers/implementations/kem/mlx_kem.c b/providers/implementations/kem/mlx_kem.c
-index 376b3342dd..09fa003612 100644
+index a917fa93d5..04429e0926 100644
--- a/providers/implementations/kem/mlx_kem.c
+++ b/providers/implementations/kem/mlx_kem.c
@@ -19,6 +19,7 @@
@@ -148,15 +148,15 @@ index 376b3342dd..09fa003612 100644
if (ctx == NULL
|| EVP_PKEY_encapsulate_init(ctx, NULL) <= 0
|| EVP_PKEY_encapsulate(ctx, cbuf, &encap_clen, sbuf, &encap_slen) <= 0)
-@@ -238,6 +263,7 @@ static int mlx_kem_encapsulate(void *vctx, unsigned char *ctext, size_t *clen,
- end:
+@@ -242,6 +267,7 @@ end:
+ ML_KEM_SHARED_SECRET_BYTES + key->xinfo->shsec_bytes);
EVP_PKEY_free(xkey);
EVP_PKEY_CTX_free(ctx);
+ OPENSSL_free(adjusted_propq);
return ret;
}
-@@ -253,6 +279,7 @@ static int mlx_kem_decapsulate(void *vctx, uint8_t *shsec, size_t *slen,
+@@ -257,6 +283,7 @@ static int mlx_kem_decapsulate(void *vctx, uint8_t *shsec, size_t *slen,
size_t decap_clen = key->minfo->ctext_bytes + key->xinfo->pubkey_bytes;
int ml_kem_slot = key->xinfo->ml_kem_slot;
int ret = 0;
@@ -164,7 +164,7 @@ index 376b3342dd..09fa003612 100644
if (!mlx_kem_have_prvkey(key)) {
ERR_raise(ERR_LIB_PROV, PROV_R_MISSING_KEY);
-@@ -288,7 +315,8 @@ static int mlx_kem_decapsulate(void *vctx, uint8_t *shsec, size_t *slen,
+@@ -292,7 +319,8 @@ static int mlx_kem_decapsulate(void *vctx, uint8_t *shsec, size_t *slen,
decap_slen = ML_KEM_SHARED_SECRET_BYTES;
cbuf = ctext + ml_kem_slot * key->xinfo->pubkey_bytes;
sbuf = shsec + ml_kem_slot * key->xinfo->shsec_bytes;
@@ -174,8 +174,8 @@ index 376b3342dd..09fa003612 100644
if (ctx == NULL
|| EVP_PKEY_decapsulate_init(ctx, NULL) <= 0
|| EVP_PKEY_decapsulate(ctx, sbuf, &decap_slen, cbuf, decap_clen) <= 0)
-@@ -326,6 +354,7 @@ static int mlx_kem_decapsulate(void *vctx, uint8_t *shsec, size_t *slen,
- end:
+@@ -334,6 +362,7 @@ end:
+ ML_KEM_SHARED_SECRET_BYTES + key->xinfo->shsec_bytes);
EVP_PKEY_CTX_free(ctx);
EVP_PKEY_free(xkey);
+ OPENSSL_free(adjusted_propq);
@@ -183,7 +183,7 @@ index 376b3342dd..09fa003612 100644
}
diff --git a/providers/implementations/keymgmt/mlx_kmgmt.c b/providers/implementations/keymgmt/mlx_kmgmt.c
-index 00ac258682..b3022ea53a 100644
+index 3621688326..7a61f77521 100644
--- a/providers/implementations/keymgmt/mlx_kmgmt.c
+++ b/providers/implementations/keymgmt/mlx_kmgmt.c
@@ -164,6 +164,52 @@ typedef struct export_cb_arg_st {
@@ -283,7 +283,7 @@ index 00ac258682..b3022ea53a 100644
EVP_PKEY_CTX_free(ctx);
return ret;
}
-@@ -671,6 +725,7 @@ static void *mlx_kem_gen(void *vgctx, OSSL_CALLBACK *osslcb, void *cbarg)
+@@ -677,6 +731,7 @@ static void *mlx_kem_gen(void *vgctx, OSSL_CALLBACK *osslcb, void *cbarg)
PROV_ML_KEM_GEN_CTX *gctx = vgctx;
MLX_KEY *key;
char *propq;
@@ -291,7 +291,7 @@ index 00ac258682..b3022ea53a 100644
if (gctx == NULL
|| (gctx->selection & OSSL_KEYMGMT_SELECT_KEYPAIR) == OSSL_KEYMGMT_SELECT_PUBLIC_KEY)
-@@ -686,8 +741,10 @@ static void *mlx_kem_gen(void *vgctx, OSSL_CALLBACK *osslcb, void *cbarg)
+@@ -692,8 +747,10 @@ static void *mlx_kem_gen(void *vgctx, OSSL_CALLBACK *osslcb, void *cbarg)
return key;
/* For now, using the same "propq" for all components */
@@ -304,5 +304,5 @@ index 00ac258682..b3022ea53a 100644
key->xinfo->algorithm_name,
key->xinfo->group_name);
--
-2.54.0
+2.55.0
diff --git a/0017-Don-t-raise-NOT_ENOUGH_DATA-at-object-boundary.patch b/0017-Don-t-raise-NOT_ENOUGH_DATA-at-object-boundary.patch
deleted file mode 100644
index 6d524ee..0000000
--- a/0017-Don-t-raise-NOT_ENOUGH_DATA-at-object-boundary.patch
+++ /dev/null
@@ -1,313 +0,0 @@
-From 4360d537e8ccd716b3fd466c39c7fc81a47f4eb5 Mon Sep 17 00:00:00 2001
-From: Marc Gutman <marcg@activestate.com>
-Date: Thu, 9 Jul 2026 15:23:28 -0500
-Subject: [PATCH] Don't raise NOT_ENOUGH_DATA on a clean EOF at an object
- boundary
-
-asn1_d2i_read_bio() reads one ASN.1 object at a time from a BIO. Callers
-commonly loop, decoding concatenated DER values until the call fails, and
-rely on a failure with no queued error to recognise a clean end of input.
-CPython's ssl module does this in _add_ca_certs() when loading the Windows
-certificate store via SSLContext.load_verify_locations(cadata=...); it
-re-raises any leftover ASN.1 error other than ASN1_R_HEADER_TOO_LONG as
-fatal.
-
-Commit 9eb6922c59 ("asn1: raise NOT_ENOUGH_DATA on header EOF") changed the
-BIO_read() check from "i < 0" to "i <= 0", so a clean EOF (BIO_read()
-returning 0, as an exhausted BIO_new_mem_buf does) on an object boundary now
-raises ASN1_R_NOT_ENOUGH_DATA instead of failing with an empty error queue.
-The rewrite in commit 35852da1d9 carried this behaviour forward. As a
-result Python 3 on Windows fails to initialise an SSLContext with:
-
- ssl.SSLError: [ASN1: NOT_ENOUGH_DATA] not enough data
-
-Raise ASN1_R_NOT_ENOUGH_DATA only on an actual read error, on an EOF in the
-middle of an object (some bytes already buffered), or on an EOF while still
-inside an indefinite-length value awaiting its end-of-contents octets - all
-of which are genuine truncation. A clean EOF at a top-level object boundary
-again fails without queuing an error, restoring the long-standing behaviour
-that looping callers depend on.
-
-Add regression tests covering the clean-EOF, truncated, indefinite-length
-truncation and partial-header cases, and document the read behaviour in
-ASN1_item_d2i_bio(3).
-
-Fixes #31807
-
-Assisted-by: Claude:claude-opus-4-8
-
-Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
-Reviewed-by: Igor Ustinov <igus@openssl.foundation>
-Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
-MergeDate: Mon Jul 13 08:05:03 2026
-(Merged from https://github.com/openssl/openssl/pull/31818)
-
-(cherry picked from commit d7e77b66cabb770932091ed5986221e0d1e57144)
----
- crypto/asn1/a_d2i_fp.c | 15 ++-
- doc/man3/ASN1_item_d2i_bio.pod | 18 +++-
- test/asn1_decode_test.c | 165 +++++++++++++++++++++++++++++++++
- 3 files changed, 196 insertions(+), 2 deletions(-)
-
-diff --git a/crypto/asn1/a_d2i_fp.c b/crypto/asn1/a_d2i_fp.c
-index 9e45398cac..41491b92a1 100644
---- a/crypto/asn1/a_d2i_fp.c
-+++ b/crypto/asn1/a_d2i_fp.c
-@@ -141,7 +141,20 @@ int asn1_d2i_read_bio(BIO *in, BUF_MEM **pb)
- i = BIO_read(in, &(b->data[len]), (int)want);
-
- if (i <= 0) {
-- ERR_raise(ERR_LIB_ASN1, ASN1_R_NOT_ENOUGH_DATA);
-+ /*
-+ * A read error (i < 0), an EOF in the middle of an object
-+ * (diff != 0, some bytes already buffered), or an EOF while
-+ * still inside an indefinite-length constructed value awaiting
-+ * its end-of-contents octets (eos != 0) all mean the input is
-+ * truncated. Only a clean EOF at a top-level object boundary
-+ * (i == 0, diff == 0, eos == 0) is the normal end of input:
-+ * fail without queuing an error so that callers looping over
-+ * concatenated DER values (e.g. the libcrypto d2i_*_bio()
-+ * consumers in CPython's ssl module) terminate cleanly instead
-+ * of seeing a spurious ASN1_R_NOT_ENOUGH_DATA.
-+ */
-+ if (i < 0 || diff != 0 || eos != 0)
-+ ERR_raise(ERR_LIB_ASN1, ASN1_R_NOT_ENOUGH_DATA);
- goto err;
- }
-
-diff --git a/doc/man3/ASN1_item_d2i_bio.pod b/doc/man3/ASN1_item_d2i_bio.pod
-index f8e4678367..9b3f389a23 100644
---- a/doc/man3/ASN1_item_d2i_bio.pod
-+++ b/doc/man3/ASN1_item_d2i_bio.pod
-@@ -59,6 +59,16 @@ B<OSSL_LIB_CTX> provided in the I<libctx> parameter and the property query
- string in I<propq>. See L<crypto(7)/ALGORITHM FETCHING> for more information
- about algorithm fetching.
-
-+When reading from I<in>, decoding consumes one complete DER-encoded structure
-+and leaves any following bytes in the BIO, so concatenated structures can be
-+read with successive calls. Reaching the end of the input cleanly, at a
-+structure boundary, is not treated as an error: the function returns NULL
-+without adding to the error queue. If the end of the input is reached in the
-+middle of a structure, or an indefinite-length value is missing its
-+end-of-contents octets (that is, the input is truncated), an error is queued
-+with reason code B<ASN1_R_NOT_ENOUGH_DATA>. The same applies to
-+ASN1_item_d2i_fp_ex().
-+
- ASN1_item_d2i_bio() is the same as ASN1_item_d2i_bio_ex() except that the
- default B<OSSL_LIB_CTX> is used (i.e. NULL) and with a NULL property query
- string.
-@@ -92,6 +102,12 @@ that the I<libctx> and I<propq> can be used when doing algorithm fetching.
- ASN1_item_d2i_bio(), ASN1_item_unpack_ex() and ASN1_item_unpack() return a pointer to
- an B<ASN1_VALUE> or NULL on error.
-
-+The ASN1_item_d2i_bio() and ASN1_item_d2i_fp() functions, including their
-+B<_ex> variants, also return NULL at a clean end of input. In that case the
-+error queue is left unchanged, so a caller reading concatenated structures in
-+a loop can distinguish a clean end of input from a decoding error by
-+inspecting the error queue, for example with L<ERR_peek_error(3)>.
-+
- ASN1_item_i2d_mem_bio() returns a pointer to a memory BIO or NULL on error.
-
- ASN1_item_pack() returns a pointer to an B<ASN1_STRING> or NULL on error.
-@@ -105,7 +121,7 @@ The function ASN1_item_unpack_ex() was added in OpenSSL 3.2.
-
- =head1 COPYRIGHT
-
--Copyright 2021-2023 The OpenSSL Project Authors. All Rights Reserved.
-+Copyright 2021-2026 The OpenSSL Project Authors. All Rights Reserved.
-
- Licensed under the Apache License 2.0 (the "License"). You may not use
- this file except in compliance with the License. You can obtain a copy
-diff --git a/test/asn1_decode_test.c b/test/asn1_decode_test.c
-index 6e00d40896..8a9629c21d 100644
---- a/test/asn1_decode_test.c
-+++ b/test/asn1_decode_test.c
-@@ -14,7 +14,11 @@
- #include <openssl/asn1.h>
- #include <openssl/asn1t.h>
- #include <openssl/obj_mac.h>
-+#include <openssl/bio.h>
-+#include <openssl/buffer.h>
-+#include <openssl/err.h>
- #include "internal/numbers.h"
-+#include "internal/asn1.h"
- #include "testutil.h"
-
- #ifdef __GNUC__
-@@ -266,6 +270,163 @@ err:
- return ret;
- }
-
-+/*
-+ * A minimal, complete DER object: SEQUENCE { INTEGER 0 }.
-+ * asn1_d2i_read_bio() should consume exactly these bytes.
-+ */
-+static const unsigned char one_obj[] = {
-+ 0x30, 0x03, /* SEQUENCE, length 3 */
-+ 0x02, 0x01, 0x00 /* INTEGER 0 */
-+};
-+
-+/*
-+ * Reading concatenated DER objects from a BIO must stop cleanly at EOF:
-+ * once the input is exhausted on an object boundary, asn1_d2i_read_bio()
-+ * returns < 0 and must NOT leave an error on the queue. Callers that loop
-+ * over concatenated values (e.g. CPython's ssl module loading the Windows
-+ * certificate store via d2i_X509_bio()) rely on this to detect end-of-input;
-+ * a spurious ASN1_R_NOT_ENOUGH_DATA there is reported as a fatal error.
-+ */
-+static int test_d2i_read_bio_clean_eof(void)
-+{
-+ unsigned char two_objs[sizeof(one_obj) * 2];
-+ BIO *bio = NULL;
-+ BUF_MEM *buf = NULL;
-+ int ret = 0;
-+
-+ memcpy(two_objs, one_obj, sizeof(one_obj));
-+ memcpy(two_objs + sizeof(one_obj), one_obj, sizeof(one_obj));
-+
-+ if (!TEST_ptr(bio = BIO_new_mem_buf(two_objs, sizeof(two_objs))))
-+ goto err;
-+ ERR_clear_error();
-+
-+ /* Both complete objects are read, one per call. */
-+ if (!TEST_int_eq(asn1_d2i_read_bio(bio, &buf), (int)sizeof(one_obj)))
-+ goto err;
-+ BUF_MEM_free(buf);
-+ buf = NULL;
-+ if (!TEST_int_eq(asn1_d2i_read_bio(bio, &buf), (int)sizeof(one_obj)))
-+ goto err;
-+ BUF_MEM_free(buf);
-+ buf = NULL;
-+
-+ /* Clean EOF: failure return, but no error must be queued. */
-+ if (!TEST_int_lt(asn1_d2i_read_bio(bio, &buf), 0))
-+ goto err;
-+ if (!TEST_ulong_eq(ERR_peek_error(), 0))
-+ goto err;
-+
-+ ret = 1;
-+err:
-+ BUF_MEM_free(buf);
-+ BIO_free(bio);
-+ return ret;
-+}
-+
-+/*
-+ * In contrast, hitting EOF in the middle of an object is genuine truncation
-+ * and must still be reported as ASN1_R_NOT_ENOUGH_DATA.
-+ */
-+static int test_d2i_read_bio_truncated(void)
-+{
-+ static const unsigned char truncated[] = {
-+ 0x30, 0x05, /* SEQUENCE claims 5 content bytes ... */
-+ 0x02, 0x01 /* ... but only 2 are present */
-+ };
-+ BIO *bio = NULL;
-+ BUF_MEM *buf = NULL;
-+ unsigned long e;
-+ int ret = 0;
-+
-+ if (!TEST_ptr(bio = BIO_new_mem_buf(truncated, sizeof(truncated))))
-+ goto err;
-+ ERR_clear_error();
-+
-+ if (!TEST_int_lt(asn1_d2i_read_bio(bio, &buf), 0))
-+ goto err;
-+ e = ERR_peek_last_error();
-+ if (!TEST_int_eq(ERR_GET_LIB(e), ERR_LIB_ASN1)
-+ || !TEST_int_eq(ERR_GET_REASON(e), ASN1_R_NOT_ENOUGH_DATA))
-+ goto err;
-+
-+ ret = 1;
-+err:
-+ BUF_MEM_free(buf);
-+ BIO_free(bio);
-+ return ret;
-+}
-+
-+/*
-+ * An EOF reached while still inside an indefinite-length constructed value,
-+ * before its end-of-contents octets, is truncation too (not a clean boundary),
-+ * so it must also report ASN1_R_NOT_ENOUGH_DATA rather than an empty queue.
-+ */
-+static int test_d2i_read_bio_indefinite_truncated(void)
-+{
-+ /* SEQUENCE (indefinite) { INTEGER 0 } with the 00 00 EOC missing */
-+ static const unsigned char truncated_indefinite[] = {
-+ 0x30, 0x80, /* SEQUENCE, indefinite length */
-+ 0x02, 0x01, 0x00 /* INTEGER 0; no end-of-contents octets follow */
-+ };
-+ BIO *bio = NULL;
-+ BUF_MEM *buf = NULL;
-+ unsigned long e;
-+ int ret = 0;
-+
-+ bio = BIO_new_mem_buf(truncated_indefinite, sizeof(truncated_indefinite));
-+ if (!TEST_ptr(bio))
-+ goto err;
-+ ERR_clear_error();
-+
-+ if (!TEST_int_lt(asn1_d2i_read_bio(bio, &buf), 0))
-+ goto err;
-+ e = ERR_peek_last_error();
-+ if (!TEST_int_eq(ERR_GET_LIB(e), ERR_LIB_ASN1)
-+ || !TEST_int_eq(ERR_GET_REASON(e), ASN1_R_NOT_ENOUGH_DATA))
-+ goto err;
-+
-+ ret = 1;
-+err:
-+ BUF_MEM_free(buf);
-+ BIO_free(bio);
-+ return ret;
-+}
-+
-+/*
-+ * An EOF reached part-way through an object's header, with some header bytes
-+ * already buffered, is truncation as well. This exercises the "diff != 0" arm
-+ * of the header-read check (distinct from the body read handled elsewhere).
-+ */
-+static int test_d2i_read_bio_partial_header(void)
-+{
-+ /* SEQUENCE with a 2-byte long-form length, but only one length byte given */
-+ static const unsigned char partial_header[] = {
-+ 0x30, 0x82, 0x01 /* SEQUENCE, length declared as 2 bytes, 1 present */
-+ };
-+ BIO *bio = NULL;
-+ BUF_MEM *buf = NULL;
-+ unsigned long e;
-+ int ret = 0;
-+
-+ if (!TEST_ptr(bio = BIO_new_mem_buf(partial_header, sizeof(partial_header))))
-+ goto err;
-+ ERR_clear_error();
-+
-+ if (!TEST_int_lt(asn1_d2i_read_bio(bio, &buf), 0))
-+ goto err;
-+ e = ERR_peek_last_error();
-+ if (!TEST_int_eq(ERR_GET_LIB(e), ERR_LIB_ASN1)
-+ || !TEST_int_eq(ERR_GET_REASON(e), ASN1_R_NOT_ENOUGH_DATA))
-+ goto err;
-+
-+ ret = 1;
-+err:
-+ BUF_MEM_free(buf);
-+ BIO_free(bio);
-+ return ret;
-+}
-+
- int setup_tests(void)
- {
- #ifndef OPENSSL_NO_DEPRECATED_3_0
-@@ -279,5 +440,9 @@ int setup_tests(void)
- ADD_TEST(test_utctime);
- ADD_TEST(test_invalid_template);
- ADD_TEST(test_reuse_asn1_object);
-+ ADD_TEST(test_d2i_read_bio_clean_eof);
-+ ADD_TEST(test_d2i_read_bio_truncated);
-+ ADD_TEST(test_d2i_read_bio_indefinite_truncated);
-+ ADD_TEST(test_d2i_read_bio_partial_header);
- return 1;
- }
---
-2.54.0
-
diff --git a/openssl.spec b/openssl.spec
index 4897f0a..9bdfc7b 100644
--- a/openssl.spec
+++ b/openssl.spec
@@ -29,8 +29,8 @@ print(string.sub(hash, 0, 16))
Summary: Utilities from the general purpose cryptography library with TLS implementation
Name: openssl
-Version: 4.0.1
-Release: 5%{?dist}
+Version: 4.0.2
+Release: 1%{?dist}
Epoch: 1
Source0: openssl-%{version}.tar.gz
Source4: openssl.rpmlintrc
@@ -53,7 +53,6 @@ Patch0013: 0013-FIPS-PKCS12-PBMAC1-defaults.patch
Patch0014: 0014-FIPS-EC-disable-weak-curves.patch
Patch0015: 0015-Make-openssl-speed-run-in-FIPS-mode.patch
Patch0016: 0016-Allow-hybrid-MLKEM-in-FIPS-mode.patch
-Patch0017: 0017-Don-t-raise-NOT_ENOUGH_DATA-at-object-boundary.patch
License: Apache-2.0
URL: http://www.openssl.org/
@@ -376,6 +375,9 @@ ln -s /etc/crypto-policies/back-ends/openssl_fips.config $RPM_BUILD_ROOT%{_sysco
%ldconfig_scriptlets libs
%changelog
+* Fri Aug 28 2026 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:4.0.2-1
+- Rebase to OpenSSL 4.0.2
+
* Fri Jul 17 2026 Pavol Žáčik <pzacik@redhat.com> - 1:4.0.1-5
- Don't raise NOT_ENOUGH_DATA on a clean EOF at an object boundary
(Backport from https://github.com/openssl/openssl/commit/4360d53)
diff --git a/sources b/sources
index a9ebcff..eba35f6 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (openssl-4.0.1.tar.gz) = 84104cbd928a3fbcb9a90c567fa37f927b974d4744b8cd774641e0d07db065d1564fa4c3df4c26818f3c6e726ca71b3aae72109d10482bba3396949886fc8892
+SHA512 (openssl-4.0.2.tar.gz) = 4da808b64fca832b80752c4dc0248ea602c78ecc35fb7455439dccfae3fb74213d3689f455a40533d89e6180d2c81ea5871f2763fa64740c2810af9fdb4104be
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2026-08-28 10:57 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-08-28 10:57 [rpms/openssl] f45: Rebase to OpenSSL 4.0.2 Dmitry Belyavskiy
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox