Add freeze functionality to EVP_SKEYMGMT_fetch

Add unit tests to check functionality

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Fri Apr 17 11:12:10 2026
(Merged from https://github.com/openssl/openssl/pull/30642)

.codespellrc

@@ -14,7 +14,6 @@ ignore-words-list =
     ADDAD,
     addin,
     adin,
-    ADn,
     AFAIR,
     afile,
     afterAll,
@@ -75,7 +74,6 @@ ignore-words-list =
     configury,
     consumation,
     couldn,
-    couter,
     crasher,
     crashers,
     crate,
@@ -132,7 +130,6 @@ ignore-words-list =
     Gost,
     GOST,
     Hart,
-    hashin,
     hasTable,
     hel,
     hist,
@@ -335,7 +332,6 @@ skip =
     *.asc,
     *.bin,
     *.crt,
-    *.csr,
     *.css.map,
     *.eps,
     *.fr.utf-8,
@@ -445,7 +441,6 @@ skip =
     CREDITS,
     CREDITS.TXT,
     DONATIONS,
-    external/*,
     jquery.js,
     jquery.min.map,
     localization*-[a-z][a-z]_[a-zA-Z][a-zA-Z].*,

.ctags.d/exclude.ctags

@@ -1,5 +1,5 @@
 #
-# Copyright 2023-2026 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2023 The OpenSSL Project Authors. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
@@ -10,3 +10,4 @@
 # List file names or patterns you want ctags to ignore.
 --exclude=.ctags.d
 --exclude=test
+--exclude=check-format-test-positives.c

.github/PULL_REQUEST_TEMPLATE.md

@@ -3,11 +3,7 @@ Thank you for your pull request. Please review these requirements:
 
 Contributors guide: https://github.com/openssl/openssl/blob/master/CONTRIBUTING.md
 
-Include a clear description of the issue or feature above this comment if not already provided. This should briefly outline the issue or feature being addressed, along with any relevant implementation details. For performance improvements, include benchmark results as well.
-
-Please always add meaningful commit messages.  Commit message titles (the first line of each commit message which should be separated by an empty line from the rest of the message) should be kept to 50-70 characters if possible.  Further details and Fixes #issue number annotations should be placed in the commit message body (i.e, after the empty line).
-
-Pull requests and commits should be self-contained, allowing readers to understand what changed and why without needing to reference related issues or having prior knowledge. Individual commit messages should include all relevant details to ensure future contributors can easily follow the git history. Clearly explain what is changing and why, and feel free to include detailed (long) descriptions when beneficial to understanding.
+Other than that, provide a description above this comment if there isn't one already
 
 If this fixes a GitHub issue, make sure to have a line saying 'Fixes #XXXX' (without quotes) in the commit message.
 -->

.github/ci-deps.json

@@ -1,5 +0,0 @@
-{
-  "jom-1.1.7.exe": "8435dbf96eb9ee65395d46d04dc3af2ff6b2618aefbc7964eeede9be669e8bd6",
-  "nasm-3.01-installer-x64.exe": "7881e9febc8b6558581041019b7890f109bef0694d93ed82c9589794c7b5a600",
-  "nasm-3.01-installer-x86.exe": "2e3041dd2abe36cb7e9938057c3cf090dd2eac42d3280957359f87c4d83b9ed0"
-}

.github/workflows/aarch64-more-cross-compiles.yml

@@ -1,202 +0,0 @@
-# Copyright 2021-2026 The OpenSSL Project Authors. All Rights Reserved.
-#
-# Licensed under the Apache License 2.0 (the "License").  You may not use
-# this file except in compliance with the License.  You can obtain a copy
-# in the file LICENSE in the source distribution or at
-# https://www.openssl.org/source/license.html
-
-name: Cross Compile for AArch64 Extensions
-
-on:
-  pull_request:
-    types: [opened, reopened, edited, synchronize]
-  push:
-  schedule:
-    - cron: '05 03 * * *'
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  cross-compilation-aarch64:
-    # pull request title contains 'aarch64'
-    # pull request title contains 'arm64'
-    # pull request body contains '[aarch64 ci]'
-    # push event commit message contains '[aarch64 ci]'
-    # cron job
-    # manual dispatch
-    if: contains(github.event.pull_request.title, 'aarch64') || contains(github.event.pull_request.title, 'AArch64') || contains(github.event.pull_request.title, 'arm64') || contains(github.event.pull_request.body, '[aarch64 ci]') || contains(github.event.head_commit.message, '[aarch64 ci]') || (github.event_name == 'schedule' && github.repository == 'openssl/openssl') || github.event_name == 'workflow_dispatch'
-    strategy:
-      fail-fast: false
-      matrix:
-        # The platform matrix specifies:
-        #   arch: the architecture to build for, this defines the tool-chain
-        #         prefix {arch}- and the Debian compiler package gcc-{arch}
-        #         name.
-        #   libs: the Debian package for the necessary link/runtime libraries.
-        #   target: the OpenSSL configuration target to use, this is passed
-        #           directly to the config command line.
-        #   fips:   set to "no" to disable building FIPS, leave unset to
-        #           build the FIPS provider.
-        #   tests: omit this to run all the tests using QEMU, set it to "none"
-        #          to never run the tests, otherwise its value is passed to
-        #          the "make test" command to allow selective disabling of
-        #          tests.
-        #   qemucpu: optional; string that describes CPU properties.
-        #            The string will be used to set the QEMU_CPU variable.
-        #   opensslcapsname: optional; string that describes the postfix of the
-        #                    OpenSSL environment variable that defines CPU
-        #                    capabilities. E.g. "foo" will result in an
-        #                    environment variable with the name OPENSSL_foo.
-        #   opensslcaps: optional; if opensslcapsname (see above) is set, then
-        #                this string will be used as content for the OpenSSL
-        #                capabilities variable.
-        #   capslabel: label used for artifacts.
-        platform: [
-          {
-            # Baseline Armv8 crypto extensions:
-            #   include/crypto/aes_platform.h
-            #   providers/implementations/ciphers/cipher_aes_hw_armv8.inc
-            #   crypto/sha/asm/sha1-armv8.pl
-            #   crypto/aes/asm/aes-sha256-armv8.pl
-            arch: aarch64-linux-gnu,
-            libs: libc6-dev-arm64-cross,
-            target: linux-aarch64,
-            fips: no,
-            qemucpu: max,
-            opensslcapsname: armcap, # OPENSSL_armcap
-            opensslcaps: "0x1d",
-            capslabel: armv8-crypto
-          }, {
-            # PMULL-enabled AES-GCM / GHASH:
-            #   include/crypto/aes_platform.h
-            #   crypto/modes/asm/aes-gcm-armv8_64.pl
-            #   crypto/modes/asm/ghashv8-armx.pl
-            arch: aarch64-linux-gnu,
-            libs: libc6-dev-arm64-cross,
-            target: linux-aarch64,
-            fips: no,
-            qemucpu: max,
-            opensslcapsname: armcap, # OPENSSL_armcap
-            opensslcaps: "0x3d",
-            capslabel: armv8-pmull
-          }, {
-            # SHA512 extension:
-            #   crypto/aes/asm/aes-sha512-armv8.pl
-            arch: aarch64-linux-gnu,
-            libs: libc6-dev-arm64-cross,
-            target: linux-aarch64,
-            fips: no,
-            qemucpu: max,
-            opensslcapsname: armcap, # OPENSSL_armcap
-            opensslcaps: "0x7d",
-            capslabel: armv8-sha512
-          }, {
-            # SHA3-accelerated path. Since OPENSSL_armcap short-circuits runtime
-            # detection, include the derived "worth using" and unroll bits too:
-            #   crypto/sha/sha3.c
-            #   providers/implementations/digests/sha3_prov.c
-            #   providers/implementations/ciphers/cipher_aes_gcm_hw_armv8.inc
-            #   providers/implementations/ciphers/cipher_aes_hw_armv8.inc
-            arch: aarch64-linux-gnu,
-            libs: libc6-dev-arm64-cross,
-            target: linux-aarch64,
-            fips: no,
-            qemucpu: max,
-            opensslcapsname: armcap, # OPENSSL_armcap
-            opensslcaps: "0x1987d",
-            capslabel: armv8-sha3
-          }, {
-            # SVE2 Poly1305 path. OPENSSL_armcap requires the derived
-            # ARMV9_SVE2_POLY1305 bit to be set explicitly when capability
-            # probing is overridden:
-            #   crypto/poly1305/asm/poly1305-armv8.pl
-            #   crypto/chacha/asm/chacha-armv8-sve.pl
-            arch: aarch64-linux-gnu,
-            libs: libc6-dev-arm64-cross,
-            target: linux-aarch64,
-            fips: no,
-            qemucpu: max,
-            opensslcapsname: armcap, # OPENSSL_armcap
-            opensslcaps: "0x2601d",
-            capslabel: armv9-sve2-poly1305
-          }
-        ]
-    runs-on: ubuntu-latest
-    steps:
-    - name: install packages
-      run: |
-        sudo apt-get update
-        sudo apt-get -yq --allow-unauthenticated --allow-downgrades --allow-remove-essential --allow-change-held-packages install \
-            gcc-${{ matrix.platform.arch }} \
-            ${{ matrix.platform.libs }}
-    - uses: actions/checkout@v6
-      with:
-        persist-credentials: false
-    - name: checkout fuzz/corpora submodule
-      run: git submodule update --init --depth 1 fuzz/corpora
-
-    - name: config with FIPS
-      if: matrix.platform.fips != 'no'
-      run: |
-        ./config --banner=Configured --strict-warnings enable-fips enable-lms \
-                 --cross-compile-prefix=${{ matrix.platform.arch }}- \
-                 ${{ matrix.platform.target }}
-    - name: config without FIPS
-      if: matrix.platform.fips == 'no'
-      run: |
-        ./config --banner=Configured --strict-warnings enable-lms \
-                 --cross-compile-prefix=${{ matrix.platform.arch }}- \
-                 ${{ matrix.platform.target }}
-    - name: config dump
-      run: ./configdata.pm --dump
-
-    - name: make
-      run: make -s -j4
-
-    - name: install qemu
-      if: matrix.platform.tests != 'none'
-      run: sudo apt-get -yq --allow-unauthenticated --allow-downgrades --allow-remove-essential --allow-change-held-packages install qemu-user
-
-    - name: Set QEMU environment
-      if: matrix.platform.qemucpu != ''
-      run: echo "QEMU_CPU=${{ matrix.platform.qemucpu }}" >> $GITHUB_ENV
-
-    - name: Set OpenSSL caps environment
-      if: matrix.platform.opensslcapsname != ''
-      run: echo "OPENSSL_${{ matrix.platform.opensslcapsname }}=\
-                 ${{ matrix.platform.opensslcaps }}" >> $GITHUB_ENV
-
-    - name: get cpu info
-      run: cat /proc/cpuinfo
-
-    - name: get openssl cpu info
-      if: matrix.platform.tests != 'none'
-      run: QEMU_LD_PREFIX=/usr/${{ matrix.platform.arch }} ./util/opensslwrap.sh info -cpusettings
-
-    - name: make all tests
-      if: github.event_name == 'push' && matrix.platform.tests == ''
-      run: |
-        .github/workflows/make-test \
-                  TESTS="-test_afalg" \
-                  QEMU_LD_PREFIX=/usr/${{ matrix.platform.arch }}
-    - name: make some tests
-      if: github.event_name == 'push' && matrix.platform.tests != 'none' && matrix.platform.tests != ''
-      run: |
-        .github/workflows/make-test \
-                  TESTS="${{ matrix.platform.tests }} -test_afalg" \
-                  QEMU_LD_PREFIX=/usr/${{ matrix.platform.arch }}
-    - name: make evp tests
-      if: github.event_name == 'pull_request' && matrix.platform.tests != 'none'
-      run: |
-        .github/workflows/make-test \
-                  TESTS="test_evp*" \
-                  QEMU_LD_PREFIX=/usr/${{ matrix.platform.arch }}
-    - name: save artifacts
-      if: success() || failure()
-      uses: actions/upload-artifact@v5
-      with:
-        name: "cross-compiles-aarch64@${{ matrix.platform.capslabel }}"
-        path: artifacts.tar.gz
-        if-no-files-found: ignore

.github/workflows/avx512-sde.yml

@@ -1,167 +0,0 @@
-# Copyright 2026 The OpenSSL Project Authors. All Rights Reserved.
-# Copyright (c) 2026 Intel Corporation. All Rights Reserved.
-#
-# Licensed under the Apache License 2.0 (the "License").  You may not use
-# this file except in compliance with the License.  You can obtain a copy
-# in the file LICENSE in the source distribution or at
-# https://www.openssl.org/source/license.html
-
-# Run AVX512-specific tests under Intel SDE.
-#
-# GitHub Actions runners currently do not have AVX512 hardware.
-# Intel SDE emulates AVX512 instructions and spoofs CPUID,
-# so AVX512 code paths are exercised.
-#
-# To update Intel SDE: find the new mirror ID and file date from
-# https://www.intel.com/content/www/us/en/download/684897
-# and update the three env vars below.
-
-name: AVX512 tests via Intel SDE
-
-on:
-  schedule:
-    - cron: '30 02 * * *'
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-env:
-  SDE_VERSION: 10.8.0
-  SDE_DATE: 2026-03-15
-  SDE_MIRROR_ID: 915934
-
-jobs:
-  linux:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-        with:
-          persist-credentials: false
-
-      - name: install NASM
-        run: sudo apt-get install -y nasm
-
-      - name: install Intel SDE
-        run: |
-          SDE_URL="https://downloadmirror.intel.com/${SDE_MIRROR_ID}/sde-external-${SDE_VERSION}-${SDE_DATE}-lin.tar.xz"
-          SDE_SHA256="50b320cd226acef7a491f5b321fc1be3c3c7984f9e27a456e64894b5b0979dd3"
-          curl -fsSL -o /tmp/sde.tar.xz "$SDE_URL"
-          echo "$SDE_SHA256  /tmp/sde.tar.xz" | sha256sum -c -
-          mkdir /tmp/sde
-          tar -xf /tmp/sde.tar.xz -C /tmp/sde/
-          sudo mv /tmp/sde/sde-external-${SDE_VERSION}-${SDE_DATE}-lin /opt/sde
-          echo "/opt/sde" >> "$GITHUB_PATH"
-
-      - name: config
-        run: |
-          ./config --banner=Configured --strict-warnings no-shared enable-fips
-
-      - name: build
-        run: make -j4
-
-      - name: show CPU and OpenSSL build info
-        run: |
-          cat /proc/cpuinfo | grep -m1 "model name"
-          sde64 -icx -- ./apps/openssl version -c
-
-      - name: ml_dsa_internal_test (AVX512 via SDE)
-        run: sde64 -icx -- ./test/ml_dsa_internal_test
-
-      - name: sha3_x4_internal_test (AVX512 via SDE)
-        run: sde64 -icx -- ./test/sha3_x4_internal_test
-
-      - name: fipsinstall (FIPS KAT via SDE)
-        run: sde64 -icx -- ./apps/openssl fipsinstall -module ./providers/fips.so -out /tmp/fipsmodule.cnf -provider_name fips
-
-  windows:
-    runs-on: windows-2022
-    env:
-      VCVARS: C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars64.bat
-    steps:
-      - uses: actions/checkout@v6
-        with:
-          persist-credentials: false
-
-      - name: install nasm
-        if: github.repository == 'openssl/openssl'
-        run: |
-          $installer = "nasm-3.01-installer-x64.exe"
-          Invoke-WebRequest -Uri "https://openssl-library.org/ci-deps/$installer" -OutFile $installer
-          $expected = (Get-Content "$env:GITHUB_WORKSPACE\.github\ci-deps.json" -Raw | ConvertFrom-Json).$installer
-          $actual = (Get-FileHash $installer -Algorithm SHA256).Hash
-          if ($actual -ne $expected) { throw "SHA256 mismatch for $installer (expected $expected, got $actual)" }
-          Start-Process -FilePath ".\$installer" -ArgumentList '/S' -Wait
-          "C:\Program Files\NASM" | Out-File -FilePath "$env:GITHUB_PATH" -Append
-      - name: install nasm (forks)
-        if: github.repository != 'openssl/openssl'
-        run: |
-          $installer = "nasm-3.01-installer-x64.exe"
-          Invoke-WebRequest -Uri "https://www.nasm.us/pub/nasm/releasebuilds/3.01/win64/$installer" -OutFile $installer
-          Start-Process -FilePath ".\$installer" -ArgumentList '/S' -Wait
-          "C:\Program Files\NASM" | Out-File -FilePath "$env:GITHUB_PATH" -Append
-
-      - name: install jom
-        if: github.repository == 'openssl/openssl'
-        run: |
-          mkdir C:\jom
-          Invoke-WebRequest -Uri "https://openssl-library.org/ci-deps/jom-1.1.7.exe" -OutFile C:\jom\jom.exe
-          $expected = (Get-Content "$env:GITHUB_WORKSPACE\.github\ci-deps.json" -Raw | ConvertFrom-Json).'jom-1.1.7.exe'
-          $actual = (Get-FileHash C:\jom\jom.exe -Algorithm SHA256).Hash
-          if ($actual -ne $expected) { throw "SHA256 mismatch for jom.exe (expected $expected, got $actual)" }
-          "C:\jom" | Out-File -FilePath "$env:GITHUB_PATH" -Append
-      - name: install jom (forks)
-        if: github.repository != 'openssl/openssl'
-        run: |
-          mkdir C:\jom
-          Invoke-WebRequest -Uri "https://download.qt.io/official_releases/jom/jom_1_1_7.zip" -OutFile C:\jom\jom.zip
-          Expand-Archive -Path C:\jom\jom.zip -DestinationPath C:\jom
-          "C:\jom" | Out-File -FilePath "$env:GITHUB_PATH" -Append
-
-      - name: install Intel SDE
-        run: |
-          $url = "https://downloadmirror.intel.com/$env:SDE_MIRROR_ID/sde-external-$env:SDE_VERSION-$env:SDE_DATE-win.tar.xz"
-          $expected = "176F87C80EB42BB91B73E1428F4A0FD067DF322F901F9B4359B20B86B92C2BAE"
-          curl.exe -fsSL -o sde-win.tar.xz $url
-          $actual = (Get-FileHash sde-win.tar.xz -Algorithm SHA256).Hash
-          if ($actual -ne $expected) { throw "SDE SHA256 mismatch: got $actual" }
-          & "C:\Program Files\7-Zip\7z.exe" x sde-win.tar.xz -so | & "C:\Program Files\7-Zip\7z.exe" x -si -ttar -o"C:\sde"
-          $sdeRoot = "C:\sde\sde-external-$env:SDE_VERSION-$env:SDE_DATE-win"
-          if (-not (Test-Path "$sdeRoot\sde.exe")) { throw "sde.exe not found in $sdeRoot" }
-          "$sdeRoot" | Out-File -FilePath $env:GITHUB_PATH -Append
-
-      - name: prepare build directory
-        run: mkdir _build
-
-      - name: config
-        working-directory: _build
-        shell: cmd
-        run: |
-          call "%VCVARS%"
-          perl ..\Configure --banner=Configured --strict-warnings no-shared enable-fips no-makedepend
-
-      - name: build
-        working-directory: _build
-        shell: cmd
-        run: |
-          call "%VCVARS%"
-          jom /j4 /S
-
-      - name: show CPU and OpenSSL build info
-        working-directory: _build
-        run: sde -icx -- apps\openssl.exe version -c
-
-      - name: ml_dsa_internal_test (AVX512 via SDE)
-        working-directory: _build
-        shell: cmd
-        run: sde -icx -- test\ml_dsa_internal_test.exe
-
-      - name: sha3_x4_internal_test (AVX512 via SDE)
-        working-directory: _build
-        shell: cmd
-        run: sde -icx -- test\sha3_x4_internal_test.exe
-
-      - name: fipsinstall (FIPS KAT via SDE)
-        working-directory: _build
-        shell: cmd
-        run: sde -icx -- apps\openssl.exe fipsinstall -module providers\fips.dll -out fipsmodule.cnf -provider_name fips

.github/workflows/backport.yml

@@ -1,4 +1,4 @@
-# Copyright 2021-2026 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2021-2025 The OpenSSL Project Authors. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
@@ -19,9 +19,6 @@ jobs:
       matrix:
         release: [
           {
-            branch: '4.0',
-            cppflags: ''
-          }, {
             branch: '3.6',
             cppflags: ''
           }, {
@@ -30,6 +27,12 @@ jobs:
           }, {
             branch: '3.4',
             cppflags: 'CPPFLAGS=-ansi'
+          }, {
+            branch: '3.3',
+            cppflags: 'CPPFLAGS=-ansi',
+          }, {
+            branch: '3.2',
+            cppflags: 'CPPFLAGS=-ansi'
           }, {
             branch: '3.0',
             cppflags: 'CPPFLAGS=-ansi'
@@ -37,7 +40,7 @@ jobs:
         ]
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v5
       if: ${{ contains(join(github.event.pull_request.labels.*.name,','),matrix.release.branch) }}
       with:
         ref: ${{ github.event.pull_request.head.sha }}
@@ -52,7 +55,7 @@ jobs:
            git config user.name "OpenSSL Machine"
            git config user.email "openssl-machine@openssl.org"
            echo Cherry-picking $REFSTART..$REFEND
-           git cherry-pick $REFSTART..$REFEND || { git diff | head -n1000; exit 1; }
+           git cherry-pick $REFSTART..$REFEND
     - name: config
       if: ${{ contains(join(github.event.pull_request.labels.*.name,','),matrix.release.branch) }}
       run: ${{ matrix.release.cppflags }} ./config --strict-warnings --banner=Configured no-asm enable-fips --strict-warnings -D_DEFAULT_SOURCE && perl configdata.pm --dump

.github/workflows/check-news-changes.yml

@@ -1,105 +0,0 @@
-# Copyright 2026 The OpenSSL Project Authors. All Rights Reserved.
-#
-# Licensed under the Apache License 2.0 (the "License").  You may not use
-# this file except in compliance with the License.  You can obtain a copy
-# in the file LICENSE in the source distribution or at
-# https://www.openssl.org/source/license.html
-
-name: "Scan to check for NEWS/CHANGES suggestions"
-
-on: pull_request
-env:
-  NEED_NEWS_CHANGES: "no"
-  SKIP_NEWS_CHECK: "no"
-  PR_NUMBER: ${{ github.event.number }}
-  GH_TOKEN: ${{ github.token }}
-permissions: {}
-
-jobs:
-  scan_for_news_changes:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-        with:
-          persist-credentials: false
-          fetch-depth: 0
-      - name: "Check if we have the label to skip this test"
-        run: |
-          SKIP_TEST=$(gh pr view $PR_NUMBER --json labels --jq '.labels[] | select(.name == "no_news_changes_needed") | .name')
-          if [ -n "$SKIP_TEST" ]; then
-            echo "SKIP_NEWS_CHECK=yes" >> $GITHUB_ENV
-          fi
-
-      - name: "Check if we already have a NEWS/CHANGES entry"
-        if: ${{ env.SKIP_NEWS_CHECK == 'no' }}
-        run: |
-          git diff --name-only ${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }} > ./names.txt
-          echo "changed files between ${{ github.event.pull_request.base.sha }} and ${{ github.event.pull_request.head.sha }}"
-          cat ./names.txt
-          set +e
-          grep -q "NEWS\.md" names.txt
-          if [ $? -eq 0 ]; then
-            echo "FOUND_NEWS_CHANGES_ADDITION=yes" >> $GITHUB_ENV
-          else
-            grep -q "CHANGES\.md" names.txt
-            if [ $? -eq 0 ]; then
-              echo "FOUND_NEWS_CHANGES_ADDITION=yes" >> $GITHUB_ENV
-            else
-              echo "FOUND_NEWS_CHANGES_ADDITION=no" >> $GITHUB_ENV
-            fi
-          fi
-      - name: "Check if this PR affects a CVE"
-        if: ${{ env.FOUND_NEWS_CHANGES_ADDITION == 'no' && env.SKIP_NEWS_CHECK == 'no' }}
-        run: |
-          git log ${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }} > ./log.txt
-          set +e
-          grep -q "CVE-" ./log.txt
-          if [ $? -eq 0 ]; then
-            echo "Changes in this PR reference a CVE"
-            echo "NEED_NEWS_CHANGES=yes" >> $GITHUB_ENV
-          fi
-      - name: "Check if this PR impacts a public API"
-        if: ${{ env.FOUND_NEWS_CHANGES_ADDITION == 'no' && env.SKIP_NEWS_CHECK == 'no' }}
-        run: |
-          set +e
-          git diff --name-only ${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }} > ./names.txt
-          echo "changed files between ${{ github.event.pull_request.base.sha }} and ${{ github.event.pull_request.head.sha }}"
-          cat ./names.txt
-          grep -q "include/openssl" ./names.txt
-          if [ $? -eq 0 ]; then
-            echo "Changes in this PR may impact public APIS's"
-            echo "NEED_NEWS_CHANGES=yes" >> $GITHUB_ENV
-          fi
-      - name: "Check if this is a feature branch merge"
-        if: ${{ env.FOUND_NEWS_CHANGES_ADDITION == 'no' && env.SKIP_NEWS_CHECK == 'no' }}
-        run: |
-          set +e
-          echo ${{ github.head_ref }} | grep -q "feature"
-          if [ $? -eq 0 ]; then
-            echo "Feature branch found"
-            echo "NEED_NEWS_CHANGES=yes" >> $GITHUB_ENV
-          fi
-      - name: "Check if configuration options have changed"
-        if: ${{ env.FOUND_NEWS_CHANGES_ADDITION == 'no' && env.SKIP_NEWS_CHECK == 'no' }}
-        run: | 
-          git checkout ${{ github.event.pull_request.base.sha }}
-          set +e
-          ./Configure --help > ./before.txt 2>&1
-          git checkout ${{ github.event.pull_request.head.sha }}
-          ./Configure --help > ./after.txt 2>&1
-          set -e
-          CONF_CHANGE=$(diff ./before.txt ./after.txt | wc -l)
-          if [ $CONF_CHANGE -ne 0 ]; then
-            echo "Configuration options changes"
-            echo "NEED_NEWS_CHANGES=yes" >> $GITHUB_ENV
-          fi
-      - name: "Report Results"
-        if: ${{ env.SKIP_NEWS_CHECK == 'no' }}
-        run: |
-          if [ "${{ env.NEED_NEWS_CHANGES }}" == "yes" ]; then
-            echo "Suggest that you add a NEWS/CHANGES entry for this PR"
-            echo "Alternatively, quiet this suggestion by applying the no_news_changes_needed label"
-            exit 1
-          fi
-
-

.github/workflows/ci-doc-changes.yml

@@ -1,125 +0,0 @@
-# Copyright 2021-2026 The OpenSSL Project Authors. All Rights Reserved.
-#
-# Licensed under the Apache License 2.0 (the "License").  You may not use
-# this file except in compliance with the License.  You can obtain a copy
-# in the file LICENSE in the source distribution or at
-# https://www.openssl.org/source/license.html
-
-name: Documentation and Installability CI
-
-on: [pull_request, push]
-
-permissions:
-  contents: read
-
-env:
-  OSSL_RUN_CI_TESTS: 1
-
-jobs:
-  check_docs:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@v6
-      with:
-        persist-credentials: false
-    - name: config
-      run: ./config --strict-warnings --banner=Configured enable-fips && perl configdata.pm --dump
-    - name: make build_generated
-      run: make -s build_generated
-    - name: make doc-nits
-      run: make doc-nits
-    - name: make help
-      run: make help
-    - name: make md-nits
-      run: |
-          sudo gem install mdl
-          make md-nits
-
-  # out-of-source-and-install checks multiple things at the same time:
-  # - That building, testing and installing works from an out-of-source
-  #   build tree
-  # - That building, testing and installing works with a read-only source
-  #   tree
-  out-of-readonly-source-and-install-ubuntu:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@v6
-      with:
-        path: ./source
-        persist-credentials: false
-    - name: checkout fuzz/corpora submodule
-      run: git submodule update --init --depth 1 fuzz/corpora
-      working-directory: ./source
-    - name: make source read-only
-      run: chmod -R a-w ./source
-    - name: create build and install directories
-      run: |
-        mkdir ./build
-        mkdir ./install
-    - name: config
-      run: |
-        ../source/config --banner=Configured enable-demos enable-h3demo enable-fips enable-lms enable-quic enable-acvp-tests --strict-warnings --prefix=$(cd ../install; pwd)
-        perl configdata.pm --dump
-      working-directory: ./build
-    - name: make
-      run: make -s -j4
-      working-directory: ./build
-    - name: get cpu info
-      run: |
-        cat /proc/cpuinfo
-        ./util/opensslwrap.sh version -c
-      working-directory: ./build
-    - name: make test
-      run: ../source/.github/workflows/make-test
-      working-directory: ./build
-    - name: save artifacts
-      if: success() || failure()
-      uses: actions/upload-artifact@v5
-      with:
-        name: "ci@out-of-readonly-source-and-install-ubuntu"
-        path: build/artifacts.tar.gz
-    - name: make install
-      run: make install
-      working-directory: ./build
-
-  out-of-readonly-source-and-install-macos:
-    runs-on: macos-15
-    steps:
-    - uses: actions/checkout@v6
-      with:
-        path: ./source
-        persist-credentials: false
-    - name: checkout fuzz/corpora submodule
-      run: git submodule update --init --depth 1 fuzz/corpora
-      working-directory: ./source
-    - name: make source read-only
-      run: chmod -R a-w ./source
-    - name: create build and install directories
-      run: |
-        mkdir ./build
-        mkdir ./install
-    - name: config
-      run: |
-        ../source/config --banner=Configured enable-fips enable-lms enable-demos enable-h3demo enable-quic enable-acvp-tests --strict-warnings --prefix=$(cd ../install; pwd)
-        perl configdata.pm --dump
-      working-directory: ./build
-    - name: make
-      run: make -s -j4
-      working-directory: ./build
-    - name: get cpu info
-      run: |
-        sysctl machdep.cpu
-        ./util/opensslwrap.sh version -c
-      working-directory: ./build
-    - name: make test
-      run: ../source/.github/workflows/make-test
-      working-directory: ./build
-    - name: save artifacts
-      if: success() || failure()
-      uses: actions/upload-artifact@v5
-      with:
-        name: "ci@out-of-readonly-source-and-install-macos-15"
-        path: build/artifacts.tar.gz
-    - name: make install
-      run: make install
-      working-directory: ./build

.github/workflows/ci.yml

@@ -1,4 +1,4 @@
-# Copyright 2021-2026 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2021-2025 The OpenSSL Project Authors. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
@@ -7,25 +7,7 @@
 
 name: GitHub CI
 
-on:
-  pull_request:
-    paths-ignore:
-      - 'doc/**'
-      - '*.md'
-      - '*.pod'
-      - 'README*'
-      - 'funding.json'
-      - 'LICENSE.txt'
-      - 'VERSION.dat'
-  push:
-    paths-ignore:
-      - 'doc/**'
-      - '*.md'
-      - '*.pod'
-      - 'README*'
-      - 'funding.json'
-      - 'LICENSE.txt'
-      - 'VERSION.dat'
+on: [pull_request, push]
 
 # for some reason, this does not work:
 # variables:
@@ -50,7 +32,7 @@ jobs:
       run: |
         sudo apt-get update
         sudo apt-get -yq --no-install-suggests --no-install-recommends --allow-unauthenticated --allow-downgrades --allow-remove-essential --allow-change-held-packages install unifdef
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v5
       with:
         fetch-depth: 0
         persist-credentials: false
@@ -63,13 +45,32 @@ jobs:
     - name: git diff
       run: git diff --exit-code
 
+  check_docs:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v5
+      with:
+        persist-credentials: false
+    - name: config
+      run: ./config --strict-warnings --banner=Configured enable-fips && perl configdata.pm --dump
+    - name: make build_generated
+      run: make -s build_generated
+    - name: make doc-nits
+      run: make doc-nits
+    - name: make help
+      run: make help
+    - name: make md-nits
+      run: |
+          sudo gem install mdl
+          make md-nits
+
   # This checks that we use ANSI C language syntax and semantics.
   # We are not as strict with libraries, but rather adapt to what's
   # expected to be available in a certain version of each platform.
   check-c99:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: config
@@ -80,21 +81,19 @@ jobs:
   basic_gcc:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: checkout fuzz/corpora submodule
       run: git submodule update --init --depth 1 fuzz/corpora
     - name: localegen
       run: sudo locale-gen tr_TR.UTF-8
-    - name: cmocka
-      run: sudo apt-get -y install libcmocka-dev
     - name: fipsvendor
       # Make one fips build use a customized FIPS vendor
       run: echo "FIPS_VENDOR=CI" >> VERSION.dat
     - name: config
       # enable-quic is on by default, but we leave it here to check we're testing the explicit enable somewhere
-      run: CC=gcc ./config --strict-warnings --banner=Configured enable-demos enable-h3demo enable-ec_explicit_curves enable-sslkeylog enable-fips enable-quic enable-lms enable-unit-tests && perl configdata.pm --dump
+      run: CC=gcc ./config --strict-warnings --banner=Configured enable-demos enable-h3demo enable-sslkeylog enable-fips enable-quic enable-lms && perl configdata.pm --dump
     - name: make
       run: make -s -j4
     - name: get cpu info
@@ -116,7 +115,7 @@ jobs:
   basic_clang:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: checkout fuzz/corpora submodule
@@ -141,11 +140,11 @@ jobs:
   linux-arm64:
     runs-on: ubuntu-24.04-arm
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: config
-      run: ./config --strict-warnings enable-demos enable-fips enable-lms enable-ec_nistp_64_gcc_128 enable-md2 enable-rc5 enable-trace
+      run: ./config --strict-warnings enable-demos enable-fips enable-lms enable-ec_nistp_64_gcc_128 enable-md2 enable-rc5 enable-ssl3 enable-ssl3-method enable-trace
     - name: config dump
       run: ./configdata.pm --dump
     - name: make
@@ -163,35 +162,10 @@ jobs:
         name: "ci@linux-arm64"
         path: artifacts.tar.gz
 
-  gcc-min-version:
-    runs-on: ubuntu-latest
-    container:
-      image: docker.io/gcc:9
-    timeout-minutes: 90
-    strategy:
-      fail-fast: false
-    steps:
-    - uses: actions/checkout@v6
-      with:
-        persist-credentials: false
-    - name: config
-      run: ./config --strict-warnings --banner=Configured enable-fips && perl configdata.pm --dump
-    - name: make
-      run: make -s -j4
-    - name: print gcc version
-      run: |
-        gcc --version
-    - name: get cpu info
-      run: |
-        cat /proc/cpuinfo
-        ./util/opensslwrap.sh version -c
-    - name: make test
-      run: .github/workflows/make-test
-
   linux-x86:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: run container
@@ -204,7 +178,7 @@ jobs:
     - name: config
       run: |
         podman exec -t $CONTAINER_ID sh -c \
-          "./config --strict-warnings linux-x86 enable-demos enable-fips enable-lms enable-md2 enable-rc5 enable-trace"
+          "./config --strict-warnings linux-x86 enable-demos enable-fips enable-lms enable-md2 enable-rc5 enable-ssl3 enable-ssl3-method enable-trace"
     - name: config dump
       run: |
         podman exec -t $CONTAINER_ID sh -c \
@@ -232,7 +206,7 @@ jobs:
   freebsd-x86_64:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: config
@@ -243,7 +217,7 @@ jobs:
         shutdown_vm: false
         run: |
           sudo pkg install -y gcc perl5
-          ./config --strict-warnings enable-fips enable-lms enable-ec_nistp_64_gcc_128 enable-md2 enable-rc5 enable-trace
+          ./config --strict-warnings enable-fips enable-lms enable-ec_nistp_64_gcc_128 enable-md2 enable-rc5 enable-ssl3 enable-ssl3-method enable-trace
     - name: config dump
       uses: cross-platform-actions/action@46e8d7fb25520a8d6c64fd2b7a1192611da98eda #v0.30.0
       with:
@@ -276,7 +250,7 @@ jobs:
   minimal:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: checkout fuzz/corpora submodule
@@ -301,7 +275,7 @@ jobs:
   no-deprecated:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: checkout fuzz/corpora submodule
@@ -326,7 +300,7 @@ jobs:
   no-shared-ubuntu:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: checkout fuzz/corpora submodule
@@ -351,7 +325,7 @@ jobs:
   no-shared-macos:
     runs-on: macos-14
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: checkout fuzz/corpora submodule
@@ -376,7 +350,7 @@ jobs:
   non-caching:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: checkout fuzz/corpora submodule
@@ -405,7 +379,7 @@ jobs:
   address_ub_sanitizer:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: checkout fuzz/corpora submodule
@@ -415,7 +389,7 @@ jobs:
         sudo cat /proc/sys/vm/mmap_rnd_bits
         sudo sysctl -w vm.mmap_rnd_bits=28
     - name: config
-      run: ./config --strict-warnings --banner=Configured --debug enable-demos enable-h3demo enable-asan enable-ec_explicit_curves enable-ubsan enable-rc5 enable-md2 enable-ec_nistp_64_gcc_128 enable-fips enable-lms && perl configdata.pm --dump
+      run: ./config --strict-warnings --banner=Configured --debug enable-demos enable-h3demo enable-asan enable-ubsan enable-rc5 enable-md2 enable-ec_nistp_64_gcc_128 enable-fips enable-lms && perl configdata.pm --dump
     - name: make
       run: make -s -j4
     - name: get cpu info
@@ -434,7 +408,7 @@ jobs:
   fuzz_tests:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: checkout fuzz/corpora submodule
@@ -444,7 +418,7 @@ jobs:
         sudo cat /proc/sys/vm/mmap_rnd_bits
         sudo sysctl -w vm.mmap_rnd_bits=28
     - name: config
-      run: ./config --strict-warnings --banner=Configured --debug -DPEDANTIC -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION enable-asan enable-ec_explicit_curves enable-ubsan enable-rc5 enable-md2 enable-ec_nistp_64_gcc_128 enable-weak-ssl-ciphers enable-nextprotoneg && perl configdata.pm --dump
+      run: ./config --strict-warnings --banner=Configured --debug -DPEDANTIC -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION enable-asan enable-ubsan enable-rc5 enable-md2 enable-ec_nistp_64_gcc_128 enable-weak-ssl-ciphers enable-ssl3 enable-ssl3-method enable-nextprotoneg && perl configdata.pm --dump
     - name: make
       run: make -s -j4
     - name: get cpu info
@@ -461,44 +435,10 @@ jobs:
         path: artifacts.tar.gz
         if-no-files-found: ignore
 
-  fuzz_tests_mfail:
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    steps:
-    - uses: actions/checkout@v6
-      with:
-        persist-credentials: false
-    - name: checkout fuzz/corpora submodule
-      run: git submodule update --init --depth 1 fuzz/corpora
-    - name: Adjust ASLR for sanitizer
-      run: sudo sysctl -w vm.mmap_rnd_bits=28
-    - name: config
-      run: |
-        ./config --strict-warnings --banner=Configured --debug \
-          -DPEDANTIC -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION \
-          enable-asan enable-ec_explicit_curves enable-ubsan \
-          enable-rc5 enable-md2 enable-ec_nistp_64_gcc_128 \
-          enable-weak-ssl-ciphers enable-nextprotoneg
-        perl configdata.pm --dump
-    - name: make
-      run: make -s -j4
-    - name: make test (fuzz with mfail)
-      env:
-        OSSL_FUZZ_TEST_BUDGET: 1200
-        OSSL_FUZZ_TEST_JOBS: 4
-      run: .github/workflows/make-test OPENSSL_TEST_RAND_ORDER=0 TESTS="test_fuzz*"
-    - name: save artifacts
-      if: success() || failure()
-      uses: actions/upload-artifact@v5
-      with:
-        name: "ci@fuzz_tests_mfail"
-        path: artifacts.tar.gz
-        if-no-files-found: ignore
-
   memory_sanitizer:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: checkout fuzz/corpora submodule
@@ -509,7 +449,7 @@ jobs:
         sudo sysctl -w vm.mmap_rnd_bits=28
     - name: config
       # --debug -O1 is to produce a debug build that runs in a reasonable amount of time
-      run: CC=clang ./config --strict-warnings --banner=Configured --debug no-shared -O1 -fsanitize=memory -DOSSL_SANITIZE_MEMORY -fno-optimize-sibling-calls enable-rc5 enable-md2 enable-ec_nistp_64_gcc_128 enable-ec_explicit_curves enable-fips enable-lms no-slh-dsa && perl configdata.pm --dump
+      run: CC=clang ./config --strict-warnings --banner=Configured --debug no-shared -O1 -fsanitize=memory -DOSSL_SANITIZE_MEMORY -fno-optimize-sibling-calls enable-rc5 enable-md2 enable-ec_nistp_64_gcc_128 enable-fips enable-lms no-slh-dsa && perl configdata.pm --dump
     - name: make
       run: make -s -j4
     - name: get cpu info
@@ -528,7 +468,7 @@ jobs:
   threads_sanitizer:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: checkout fuzz/corpora submodule
@@ -557,7 +497,7 @@ jobs:
   enable_non-default_options:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: checkout fuzz/corpora submodule
@@ -584,7 +524,7 @@ jobs:
   full_featured:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: checkout fuzz/corpora submodule
@@ -598,7 +538,7 @@ jobs:
     - name: install extra config support
       run: sudo apt-get -y install libsctp-dev abigail-tools libzstd-dev zstd
     - name: config
-      run: ./config --strict-warnings --banner=Configured enable-demos enable-h3demo enable-ec_explicit_curves enable-ktls enable-fips enable-lms enable-egd enable-ec_nistp_64_gcc_128 enable-md2 enable-rc5 enable-sctp enable-weak-ssl-ciphers enable-trace enable-zlib enable-zstd && perl configdata.pm --dump
+      run: ./config --strict-warnings --banner=Configured enable-demos enable-h3demo enable-ktls enable-fips enable-lms enable-egd enable-ec_nistp_64_gcc_128 enable-md2 enable-rc5 enable-sctp enable-ssl3 enable-ssl3-method enable-weak-ssl-ciphers enable-trace enable-zlib enable-zstd && perl configdata.pm --dump
     - name: make
       run: make -s -j4
     - name: get cpu info
@@ -617,7 +557,7 @@ jobs:
   no-legacy:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: checkout fuzz/corpora submodule
@@ -642,13 +582,13 @@ jobs:
   legacy:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: checkout fuzz/corpora submodule
       run: git submodule update --init --depth 1 fuzz/corpora
     - name: config
-      run: ./config --strict-warnings --banner=Configured --debug enable-demos enable-h3demo no-shared enable-crypto-mdebug enable-rc5 enable-md2 enable-weak-ssl-ciphers enable-zlib enable-ec_nistp_64_gcc_128 enable-ec_explicit_curves no-fips && perl configdata.pm --dump
+      run: ./config --strict-warnings --banner=Configured --debug enable-demos enable-h3demo no-shared enable-crypto-mdebug enable-rc5 enable-md2 enable-ssl3 enable-ssl3-method enable-weak-ssl-ciphers enable-zlib enable-ec_nistp_64_gcc_128 no-fips && perl configdata.pm --dump
     - name: make
       run: make -s -j4
     - name: get cpu info
@@ -664,10 +604,99 @@ jobs:
         name: "ci@legacy"
         path: artifacts.tar.gz
 
+  # out-of-source-and-install checks multiple things at the same time:
+  # - That building, testing and installing works from an out-of-source
+  #   build tree
+  # - That building, testing and installing works with a read-only source
+  #   tree
+  out-of-readonly-source-and-install-ubuntu:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v5
+      with:
+        path: ./source
+        persist-credentials: false
+    - name: checkout fuzz/corpora submodule
+      run: git submodule update --init --depth 1 fuzz/corpora
+      working-directory: ./source
+    - name: make source read-only
+      run: chmod -R a-w ./source
+    - name: create build and install directories
+      run: |
+        mkdir ./build
+        mkdir ./install
+    - name: config
+      run: |
+        ../source/config --banner=Configured enable-demos enable-h3demo enable-fips enable-lms enable-quic enable-acvp-tests --strict-warnings --prefix=$(cd ../install; pwd)
+        perl configdata.pm --dump
+      working-directory: ./build
+    - name: make
+      run: make -s -j4
+      working-directory: ./build
+    - name: get cpu info
+      run: |
+        cat /proc/cpuinfo
+        ./util/opensslwrap.sh version -c
+      working-directory: ./build
+    - name: make test
+      run: ../source/.github/workflows/make-test
+      working-directory: ./build
+    - name: save artifacts
+      if: success() || failure()
+      uses: actions/upload-artifact@v5
+      with:
+        name: "ci@out-of-readonly-source-and-install-ubuntu"
+        path: build/artifacts.tar.gz
+    - name: make install
+      run: make install
+      working-directory: ./build
+
+  out-of-readonly-source-and-install-macos:
+    runs-on: macos-15
+    steps:
+    - uses: actions/checkout@v5
+      with:
+        path: ./source
+        persist-credentials: false
+    - name: checkout fuzz/corpora submodule
+      run: git submodule update --init --depth 1 fuzz/corpora
+      working-directory: ./source
+    - name: make source read-only
+      run: chmod -R a-w ./source
+    - name: create build and install directories
+      run: |
+        mkdir ./build
+        mkdir ./install
+    - name: config
+      run: |
+        ../source/config --banner=Configured enable-fips enable-lms enable-demos enable-h3demo enable-quic enable-acvp-tests --strict-warnings --prefix=$(cd ../install; pwd)
+        perl configdata.pm --dump
+      working-directory: ./build
+    - name: make
+      run: make -s -j4
+      working-directory: ./build
+    - name: get cpu info
+      run: |
+        sysctl machdep.cpu
+        ./util/opensslwrap.sh version -c
+      working-directory: ./build
+    - name: make test
+      run: ../source/.github/workflows/make-test
+      working-directory: ./build
+    - name: save artifacts
+      if: success() || failure()
+      uses: actions/upload-artifact@v5
+      with:
+        name: "ci@out-of-readonly-source-and-install-macos-15"
+        path: build/artifacts.tar.gz
+    - name: make install
+      run: make install
+      working-directory: ./build
+
   external-tests-misc:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v5
       with:
         submodules: recursive
         persist-credentials: false
@@ -675,10 +704,14 @@ jobs:
       run: |
         sudo apt-get update
         sudo apt-get -yq install bison gettext keyutils ldap-utils libldap2-dev libkeyutils-dev python3 python3-paste python3-pyrad slapd tcsh python3-virtualenv virtualenv python3-kdcproxy gdb libtls-dev wget gpg
+    - name: install cpanm and Test2::V0 for gost_engine testing
+      uses: perl-actions/install-with-cpanm@10d60f00b4073f484fc29d45bfbe2f776397ab3d # v1.7
+      with:
+        install: Test2::V0
     - name: setup hostname workaround
       run: sudo hostname localhost
     - name: config
-      run: ./config --strict-warnings --banner=Configured --debug enable-rc5 enable-md2 enable-weak-ssl-ciphers enable-zlib enable-ec_nistp_64_gcc_128 enable-external-tests no-fips && perl configdata.pm --dump
+      run: ./config --strict-warnings --banner=Configured --debug enable-rc5 enable-md2 enable-ssl3 enable-ssl3-method enable-weak-ssl-ciphers enable-zlib enable-ec_nistp_64_gcc_128 enable-external-tests no-fips && perl configdata.pm --dump
     - name: make
       run: make -s -j4
     - uses: dtolnay/rust-toolchain@0f44b27771c32bda9f458f75a1e241b09791b331
@@ -688,9 +721,8 @@ jobs:
       run: |
         cat /proc/cpuinfo
         ./util/opensslwrap.sh version -c
-    - name: test failure when selecting non-existing test case
-      run: |
-        ! make test TESTS="test_external_gost_engine"
+    - name: test external gost-engine
+      run: make test TESTS="test_external_gost_engine"
     - name: test external krb5
       run: make test TESTS="test_external_krb5"
     - name: test external tlsfuzzer
@@ -708,7 +740,7 @@ jobs:
   external-tests-oqs-provider:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v5
       with:
         submodules: recursive
         persist-credentials: false
@@ -729,13 +761,13 @@ jobs:
     steps:
     - name: package installs
       run: |
-        dnf install -y perl-FindBin perl-IPC-Cmd perl-File-Compare perl-File-Copy perl-Test-Simple perl-Test-Harness python3 make g++ perl git meson opensc expect kryoptic xxd
-    - uses: actions/checkout@v6
+        dnf install -y perl-FindBin perl-IPC-Cmd perl-File-Compare perl-File-Copy perl-Test-Simple perl-Test-Harness python3 make g++ perl git meson opensc expect kryoptic
+    - uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: checkout fuzz/corpora and pkcs11-provider submodule
       run: |
-        git config --global --add safe.directory "$GITHUB_WORKSPACE"
+        git config --global --add safe.directory /__w/openssl/openssl
         git submodule update --init --depth 1 fuzz/corpora
         git submodule update --init --depth 1 pkcs11-provider
     - name: config
@@ -761,7 +793,7 @@ jobs:
         PYTHON:
           - 3.9
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v5
       with:
         submodules: recursive
         persist-credentials: false
@@ -786,50 +818,3 @@ jobs:
         ./util/opensslwrap.sh version -c
     - name: test external pyca
       run: make test TESTS="test_external_pyca" VERBOSE=1
-
-  external-test-bssl:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@v6
-      with:
-        persist-credentials: false
-    - name: Configure OpenSSL
-      run: ./config enable-external-tests
-    - name: Build OpenSSL
-      run: make -s -j4
-    - name: Clone BoringSSL 0.20260211.0
-      run: git clone --depth 1 --branch 0.20260211.0  https://boringssl.googlesource.com/boringssl
-    - name: Configure and Build BoringSSL
-      run: |
-        cd boringssl
-        mkdir build
-        cd build
-        cmake -DCMAKE_INSTALL_PREFIX=../../boringssl/.local ..
-        make -s -j4
-        make install
-        cd ../..
-    - name: Test ECH with BoringSSL
-      run: make test TESTS='test_external_ech_bssl' V=1
-
-  external-test-nss:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@v6
-      with:
-        persist-credentials: false
-    - name: Configure OpenSSL
-      run: ./config enable-external-tests
-    - name: Build OpenSSL
-      run: make -s -j4
-    - name: Clone and Build NSS
-      run: |
-        mkdir nss
-        cd nss
-        git clone --depth 1 --branch NSS_3_112_3_RTM https://github.com/nss-dev/nss.git
-        hg clone https://hg.mozilla.org/projects/nspr -r NSPR_4_36_BRANCH
-        cd nss
-        USE_64=1 make nss_build_all
-        USE_64=1 make install
-        cd ../..
-    - name: Test ECH with NSS
-      run: make test TESTS='test_external_ech_nss' V=1

.github/workflows/compiler-zoo.yml

@@ -1,4 +1,4 @@
-# Copyright 2021-2026 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2021-2025 The OpenSSL Project Authors. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
@@ -24,7 +24,7 @@ jobs:
       run: |
         sudo apt-get update
         sudo apt-get -y install ${{ matrix.gcc }}
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: checkout fuzz/corpora submodule
@@ -37,7 +37,7 @@ jobs:
     - name: config dump
       run: ./configdata.pm --dump
     - name: make
-      run: make -s -j4
+      run: make -s -j
     - name: get cpu info
       run: |
         cat /proc/cpuinfo
@@ -49,7 +49,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        clang: [clang-11, clang-12, clang-13, clang-14, clang-15, clang-16, clang-17, clang-18, clang-19, clang-20, clang-21]
+        clang: [clang-11, clang-12, clang-13, clang-14, clang-15, clang-16, clang-17, clang-18, clang-19, clang-20]
     runs-on: ubuntu-22.04
     steps:
     - name: install packages
@@ -60,7 +60,7 @@ jobs:
         echo "deb http://apt.llvm.org/jammy/ llvm-toolchain-jammy-$VERSION main" | sudo tee -a /etc/apt/sources.list
         sudo apt-get update || true
         sudo apt-get -y install ${{ matrix.clang }}
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: checkout fuzz/corpora submodule
@@ -73,7 +73,7 @@ jobs:
     - name: config dump
       run: ./configdata.pm --dump
     - name: make
-      run: make -s -j4
+      run: make -s -j
     - name: get cpu info
       run: |
         cat /proc/cpuinfo

.github/workflows/coveralls.yml

@@ -1,4 +1,4 @@
-# Copyright 2021-2026 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2021-2025 The OpenSSL Project Authors. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
@@ -46,23 +46,29 @@ jobs:
           else
           MATRIX=$(cat << EOF
           [{
-              "branch": "master",
-              "extra_config": "enable-fips enable-tfo enable-lms enable-crypto-mdebug enable-unit-tests"
-            }, {
-              "branch": "openssl-4.0",
-              "extra_config": "enable-fips enable-tfo enable-lms enable-crypto-mdebug"
-            },{
               "branch": "openssl-3.6",
-              "extra_config": "no-afalgeng enable-fips enable-tfo enable-lms"
+              "extra_config": "no-afalgeng enable-fips enable-tfo"
             },{
               "branch": "openssl-3.5",
               "extra_config": "no-afalgeng enable-fips enable-tfo"
             },{
               "branch": "openssl-3.4",
               "extra_config": "no-afalgeng enable-fips enable-tfo"
+            }, {
+              "branch": "openssl-3.3",
+              "extra_config": "no-afalgeng enable-fips enable-tfo"
+            }, {
+              "branch": "openssl-3.2",
+              "extra_config": "no-afalgeng enable-fips enable-tfo"
+            }, {
+              "branch": "openssl-3.1",
+              "extra_config": "no-afalgeng enable-fips"
             }, {
               "branch": "openssl-3.0",
               "extra_config": "no-afalgeng enable-fips"
+            }, {
+              "branch": "master",
+              "extra_config": "enable-fips enable-tfo enable-lms enable-crypto-mdebug enable-allocfail-tests"
           }]
           EOF
           )
@@ -81,7 +87,7 @@ jobs:
         branches: ${{ fromJSON(needs.define-matrix.outputs.branches) }}
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v5
       with:
         submodules: recursive
         ref: ${{ matrix.branches.branch }}
@@ -93,7 +99,7 @@ jobs:
       run: |
         sudo apt-get update
         sudo apt-get -yq install lcov
-        sudo apt-get -yq install bison gettext keyutils ldap-utils libcmocka-dev libldap2-dev libkeyutils-dev python3 python3-paste python3-pyrad slapd tcsh python3-virtualenv virtualenv python3-kdcproxy
+        sudo apt-get -yq install bison gettext keyutils ldap-utils libldap2-dev libkeyutils-dev python3 python3-paste python3-pyrad slapd tcsh python3-virtualenv virtualenv python3-kdcproxy
     - name: install Test2::V0 for gost_engine testing
       uses: perl-actions/install-with-cpanm@10d60f00b4073f484fc29d45bfbe2f776397ab3d #v1.7
       with:
@@ -101,7 +107,7 @@ jobs:
     - name: setup hostname workaround
       run: sudo hostname localhost
     - name: config
-      run: CC=gcc ./config --debug --coverage ${{ matrix.branches.extra_config }} no-asm enable-rc5 enable-md2 enable-nextprotoneg enable-weak-ssl-ciphers enable-zlib enable-ec_nistp_64_gcc_128 enable-buildtest-c++ enable-ssl-trace enable-trace
+      run: CC=gcc ./config --debug --coverage ${{ matrix.branches.extra_config }} no-asm enable-rc5 enable-md2 enable-ssl3 enable-nextprotoneg enable-ssl3-method enable-weak-ssl-ciphers enable-zlib enable-ec_nistp_64_gcc_128 enable-buildtest-c++ enable-ssl-trace enable-trace
     - name: config dump
       run: ./configdata.pm --dump
     - name: make

.github/workflows/cross-compiles.yml

@@ -1,4 +1,4 @@
-# Copyright 2021-2026 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2021-2025 The OpenSSL Project Authors. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
@@ -7,35 +7,13 @@
 
 name: Cross Compile
 
-on:
-  pull_request:
-    paths-ignore:
-      - 'doc/**'
-      - '*.md'
-      - '*.pod'
-      - 'README*'
-      - 'funding.json'
-      - 'LICENSE.txt'
-      - 'VERSION.dat'
-  push:
-    paths-ignore:
-      - 'doc/**'
-      - '*.md'
-      - '*.pod'
-      - 'README*'
-      - 'funding.json'
-      - 'LICENSE.txt'
-      - 'VERSION.dat'
+on: [pull_request, push]
 
 permissions:
   contents: read
 
 jobs:
   cross-compilation:
-    # Run the full test suite on push, and on pull requests labelled with
-    # 'extended tests'.  Other pull requests only run the EVP tests.
-    env:
-      EXTENDED: ${{ github.event_name == 'push' || contains(github.event.pull_request.labels.*.name, 'extended tests') }}
     strategy:
       fail-fast: false
       matrix:
@@ -190,7 +168,7 @@ jobs:
         sudo apt-get -yq --allow-unauthenticated --allow-downgrades --allow-remove-essential --allow-change-held-packages install \
             gcc-${{ matrix.platform.arch }} \
             ${{ matrix.platform.libs }}
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: checkout fuzz/corpora submodule
@@ -233,19 +211,19 @@ jobs:
          cat /proc/cpuinfo
          QEMU_LD_PREFIX=/usr/${{ matrix.platform.arch }} ./util/opensslwrap.sh version -c
     - name: make all tests
-      if: env.EXTENDED == 'true' && matrix.platform.tests == ''
+      if: github.event_name == 'push' && matrix.platform.tests == ''
       run: |
         .github/workflows/make-test \
                   TESTS="-test_afalg" \
                   QEMU_LD_PREFIX=/usr/${{ matrix.platform.arch }}
     - name: make some tests
-      if: env.EXTENDED == 'true' && matrix.platform.tests != 'none' && matrix.platform.tests != ''
+      if: github.event_name == 'push' && matrix.platform.tests != 'none' && matrix.platform.tests != ''
       run: |
         .github/workflows/make-test \
                   TESTS="${{ matrix.platform.tests }} -test_afalg" \
                   QEMU_LD_PREFIX=/usr/${{ matrix.platform.arch }}
     - name: make evp tests
-      if: env.EXTENDED != 'true' && matrix.platform.tests != 'none'
+      if: github.event_name == 'pull_request' && matrix.platform.tests != 'none'
       run: |
         .github/workflows/make-test \
                   TESTS="test_evp*" \

.github/workflows/ct-validation-daily.yml

@@ -1,110 +0,0 @@
-# Copyright 2026 The OpenSSL Project Authors. All Rights Reserved.
-#
-# Licensed under the Apache License 2.0 (the "License").  You may not use
-# this file except in compliance with the License.  You can obtain a copy
-# in the file LICENSE in the source distribution or at
-# https://www.openssl.org/source/license.html
-
-name: Constant-time validation (daily)
-# Verifies that several algorithms needing constant-time execution do not
-# branch on secret data.
-#
-# The library is built with enable-ct-validation, which defines
-# OPENSSL_CONSTANT_TIME_VALIDATION and causes secret regions to be marked
-# as "uninitialised" from Valgrind memcheck's perspective.  The tests are
-# then run via "make test" with OSSL_VALGRIND_CT=yes, which makes
-# OpenSSL::Test::test() wrap every test binary with:
-#
-#   valgrind --tool=memcheck --track-origins=yes --error-exitcode=1
-#
-# The wrapper chain (util/wrap.pl -> util/shlib_wrap.sh) is preserved, so
-# LD_LIBRARY_PATH is set correctly for shared-library builds.  Any
-# control-flow branch or memory index that depends on secret data causes
-# valgrind to exit with code 1, which propagates back through the test
-# harness and fails the job.
-#
-# See include/internal/constant_time.h for the CONSTTIME_SECRET /
-# CONSTTIME_DECLASSIFY macro documentation.
-#
-# Architecture note: Valgrind's memcheck supports x86_64, aarch64, s390x,
-# and ppc64 well.  GitHub Actions provides hosted runners for x86_64
-# (ubuntu-latest) and aarch64 (ubuntu-24.04-arm); we test both here.
-# s390x and ppc64 runners are not available in the public GitHub Actions
-# fleet, so they are not included.
-#
-# Package note: on Debian/Ubuntu the valgrind package bundles the C headers
-# (valgrind/memcheck.h) — no separate -dev package is required.  On Fedora
-# the headers are in valgrind-devel; see Configure for the full list.
-
-on:
-  schedule:
-    - cron: '45 03 * * *'
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  ct-validation:
-    if: github.repository == 'openssl/openssl'
-    strategy:
-      fail-fast: false
-      matrix:
-        # Constant-timeness is a property of the generated machine code, which
-        # the compiler derives differently per architecture. Therefore we verify
-        # both the assembly and C implementations on every architecture we can
-        # run Valgrind on.
-        include:
-          # Default builds use assembler implementations (when available)
-          - name: linux-x86_64
-            runs-on: ubuntu-latest
-            config_extra: ""
-          - name: linux-aarch64
-            runs-on: ubuntu-24.04-arm
-            config_extra: ""
-
-          # no-asm builds always use C implementations
-          - name: linux-x86_64-no-asm
-            runs-on: ubuntu-latest
-            config_extra: no-asm
-          - name: linux-aarch64-no-asm
-            runs-on: ubuntu-24.04-arm
-            config_extra: no-asm
-
-    name: CT validation (${{ matrix.name }})
-    runs-on: ${{ matrix.runs-on }}
-
-    steps:
-      - uses: actions/checkout@v6
-        with:
-          persist-credentials: false
-
-      - name: Install valgrind
-        # On Debian/Ubuntu the main 'valgrind' package includes
-        # /usr/include/valgrind/memcheck.h — no separate -dev package needed.
-        run: |
-          sudo apt-get -y update
-          sudo apt-get -y install valgrind
-
-      - name: Configure with CT validation enabled
-        run: |
-          ./Configure enable-ct-validation ${{ matrix.config_extra }}
-          ./configdata.pm --dump
-
-      - name: Build
-        run: make -j$(nproc)
-
-      - name: Run CT validation under Valgrind
-        # OSSL_VALGRIND_CT=yes causes OpenSSL::Test::test() to wrap each
-        # test binary with valgrind --track-origins=yes --error-exitcode=1.
-        # util/wrap.pl -> util/shlib_wrap.sh sets LD_LIBRARY_PATH first, so
-        # the shared libraries are found correctly.
-        #
-        # Algorithms covered:
-        # - memcmp: test_crypto_memcmp
-        # - ML-KEM: test_internal_ml_kem
-        # - ML-DSA: test_internal_ml_dsa
-        run: |
-          make TESTS="test_internal_ml_kem test_internal_ml_dsa test_crypto_memcmp" \
-               OSSL_VALGRIND_CT=yes \
-               test

.github/workflows/fips-checksums.yml

@@ -1,4 +1,4 @@
-# Copyright 2021-2026 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2021-2024 The OpenSSL Project Authors. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
@@ -6,16 +6,7 @@
 # https://www.openssl.org/source/license.html
 
 name: FIPS Check and ABIDIFF
-on:
-  pull_request:
-    paths-ignore:
-      - 'doc/**'
-      - '*.md'
-      - '*.pod'
-      - 'README*'
-      - 'funding.json'
-      - 'LICENSE.txt'
-      - 'VERSION.dat'
+on: [pull_request]
 
 permissions:
   contents: read
@@ -35,7 +26,7 @@ jobs:
           mkdir ./build
           mkdir ./source
           mkdir ./artifact
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v5
         with:
           repository: ${{ github.event.pull_request.base.repo.full_name }}
           ref: ${{ github.event.pull_request.base.ref }}
@@ -53,7 +44,7 @@ jobs:
       - name: make fips-checksums pristine
         run: make fips-checksums
         working-directory: ./build-pristine
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v5
         with:
           path: source
           persist-credentials: false
@@ -88,7 +79,7 @@ jobs:
   compute-abidiff:
     runs-on: ubuntu-latest
     env:
-      BUILD_OPTS: -g --strict-warnings enable-ktls enable-fips enable-egd enable-ec_nistp_64_gcc_128 enable-md2 enable-rc5 enable-sctp enable-trace enable-zlib enable-zstd
+      BUILD_OPTS: -g --strict-warnings enable-ktls enable-fips enable-egd enable-ec_nistp_64_gcc_128 enable-md2 enable-rc5 enable-sctp enable-ssl3 enable-ssl3-method enable-trace enable-zlib enable-zstd
     steps:
       - name: create build dirs
         run: |
@@ -99,7 +90,7 @@ jobs:
           mkdir ./artifact
       - name: install extra config support
         run: sudo apt-get -y install libsctp-dev abigail-tools libzstd-dev zstd
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v5
         with:
           repository: ${{ github.event.pull_request.base.repo.full_name }}
           ref: ${{ github.event.pull_request.base.ref }}
@@ -111,7 +102,7 @@ jobs:
       - name: make pristine
         run: make -s -j4
         working-directory: ./build-pristine
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v5
         with:
           path: source
           persist-credentials: false

.github/workflows/fuzz-checker.yml

@@ -1,4 +1,4 @@
-# Copyright 2021-2026 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2021-2025 The OpenSSL Project Authors. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
@@ -35,7 +35,7 @@ jobs:
             name: libFuzzer+,
             config: enable-fuzz-libfuzzer enable-asan enable-ubsan -fno-sanitize=function -fsanitize-coverage=trace-cmp -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION,
             libs: --with-fuzzer-lib=/usr/lib/llvm-18/lib/libFuzzer.a --with-fuzzer-include=/usr/include/clang/18/include/fuzzer,
-            extra: enable-fips enable-lms enable-ec_nistp_64_gcc_128 -fno-sanitize=alignment enable-tls1_3 enable-weak-ssl-ciphers enable-rc5 enable-md2 enable-nextprotoneg,
+            extra: enable-fips enable-lms enable-ec_nistp_64_gcc_128 -fno-sanitize=alignment enable-tls1_3 enable-weak-ssl-ciphers enable-rc5 enable-md2 enable-ssl3 enable-ssl3-method enable-nextprotoneg,
             install: libfuzzer-18-dev,
             cc: clang-18,
             linker: clang++-18,
@@ -52,7 +52,7 @@ jobs:
       run: |
         sudo cat /proc/sys/vm/mmap_rnd_bits
         sudo sysctl -w vm.mmap_rnd_bits=28
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v5
       with:
         persist-credentials: false
 

.github/workflows/interop-tests.yml

@@ -16,7 +16,7 @@ jobs:
     if: github.repository == 'openssl/openssl'
     runs-on: ubuntu-22.04
     container:
-      image: docker.io/fedora:43
+      image: docker.io/fedora:40
       options: --sysctl net.ipv6.conf.lo.disable_ipv6=0
     timeout-minutes: 90
     strategy:
@@ -26,31 +26,29 @@ jobs:
     env:
       COMPONENT: ${{ matrix.COMPONENT }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v5
         with:
           persist-credentials: false
       - name: Display environment
         run: export
       - name : Install needed tools
         run: |
-          dnf -y install perl gcc make \
-                 rpmdevtools dnf-utils \
-                 tmt-all beakerlib \
-                 crypto-policies-scripts
+          dnf -y install perl gcc rpmdevtools dnf-utils make tmt-all beakerlib \
+                 fips-mode-setup crypto-policies-scripts
       - name: install interop tests
         run: |
           cd ${GITHUB_WORKSPACE}
-          git clone --branch=openssl-v0.2 --depth=1 https://gitlab.com/redhat-crypto/tests/interop.git
+          git clone --branch=openssl-v0.1 --depth=1 https://gitlab.com/redhat-crypto/tests/interop.git
       - name: build openssl as an rpm
         run: |
           mkdir -p /build/SPECS && cd /build && echo -e "%_topdir /build\n%_lto_cflags %{nil}" >~/.rpmmacros && rpmdev-setuptree
           cd /build && cp ${GITHUB_WORKSPACE}/interop/openssl/openssl.spec SPECS/ && \
           cd SPECS/ && source ${GITHUB_WORKSPACE}/VERSION.dat && \
-          sed -i "s/SOVERSION/$SHLIB_VERSION/" openssl.spec && \
-          sed -i "s/^Version: .*\$/Version: $MAJOR.$MINOR.$PATCH/" openssl.spec
+          sed -i "s/soversion 3/soversion $SHLIB_VERSION/;s/^Version: .*\$/Version: $MAJOR.$MINOR.$PATCH/" openssl.spec && \
+          sed -i 's/^Release: .*$/Release: dev/' openssl.spec
           yum-builddep -y /build/SPECS/openssl.spec # just for sure nothing is missing
           mkdir -p /build/SOURCES
-          tar --transform "s/^__w\/openssl\/openssl/openssl-$MAJOR.$MINOR.$PATCH/" -czf /build/SOURCES/openssl-$MAJOR.$MINOR.$PATCH.tar.gz "$GITHUB_WORKSPACE"
+          tar --transform "s/^__w\/openssl\/openssl/openssl-$MAJOR.$MINOR.$PATCH/" -czf /build/SOURCES/openssl-$MAJOR.$MINOR.$PATCH.tar.gz /__w/openssl/openssl/
           rpmbuild -bb /build/SPECS/openssl.spec
           rpm -i --force /build/RPMS/x86_64/openssl-*
           cp ${GITHUB_WORKSPACE}/interop/openssl/openssl.cnf /etc/pki/tls/openssl.cnf
@@ -68,10 +66,11 @@ jobs:
       matrix:
         branch: [
           { openssl: 'master', openssh: 'openssl-master', openssl_config: 'no-docs'},
-          { openssl: 'openssl-4.0', openssh: 'openssl-4.0', openssl_config: 'no-docs'},
           { openssl: 'openssl-3.6', openssh: 'openssl-3.6', openssl_config: 'no-docs'},
           { openssl: 'openssl-3.5', openssh: 'openssl-3.5', openssl_config: 'no-docs'},
           { openssl: 'openssl-3.4', openssh: 'openssl-3.4', openssl_config: 'no-docs'},
+          { openssl: 'openssl-3.3', openssh: 'openssl-3.3', openssl_config: 'no-docs'},
+          { openssl: 'openssl-3.2', openssh: 'openssl-3.2', openssl_config: 'no-docs'},
           { openssl: 'openssl-3.0', openssh: 'openssl-3.0', openssl_config: ''}
         ]
     runs-on: ubuntu-latest
@@ -80,24 +79,28 @@ jobs:
       TEST_SSH_UNSAFE_PERMISSIONS: 1
       TEST_SSH_HOSTBASED_AUTH: yes
     steps:
-    - name: install dependencies
+    - uses: actions/checkout@v5
+      with:
+        persist-credentials: false
+        ref: ${{ matrix.branch.openssl }}
+        fetch-depth: 1
+    - name: config
+      run: ./config --banner=Configured -fPIC --prefix=/opt/openssl ${{ matrix.openssl_config }} shared -Wl,-rpath,/opt/openssl/lib64 && perl configdata.pm --dump
+    - name: make
+      run: |
+        make -s -j4
+        make -s -j4 install_sw
+    - name: install dependencies of openssh
       run: |
         sudo apt-get update
         sudo apt-get -yq install autoconf zlib1g-dev
-    - uses: actions/checkout@v6
-      with:
-        persist-credentials: false
-        repository: openssh/openssh-portable
-        fetch-depth: 1
-    - name: setup ci
-      run: sh ./.github/setup_ci.sh ${{ matrix.branch.openssh }} ubuntu-latest
-    - name: autoreconf
-      run: autoreconf
-    - name: configure
-      run: sh ./.github/configure.sh ${{ matrix.branch.openssh }}
-    - name: make
+    - name: run openssh
       run: |
+        git clone --branch master --depth 1 https://github.com/openssh/openssh-portable.git
+        cd openssh-portable
+        sh ./.github/setup_ci.sh ${{ matrix.branch.openssh }} ubuntu-latest
+        autoreconf
+        sh ./.github/configure.sh ${{ matrix.branch.openssh }}
         make clean
         make -s -j4
-    - name: run tests
-      run: sh ./.github/run_test.sh
+        sh ./.github/run_test.sh

.github/workflows/make-release.yml

@@ -0,0 +1,48 @@
+# Copyright 2021-2025 The OpenSSL Project Authors. All Rights Reserved.
+#
+# Licensed under the Apache License 2.0 (the "License").  You may not use
+# this file except in compliance with the License.  You can obtain a copy
+# in the file LICENSE in the source distribution or at
+# https://www.openssl.org/source/license.html
+
+name: "Make release"
+
+on:
+  push:
+    tags:
+      - "openssl-*"
+
+permissions: {}
+
+jobs:
+  release:
+    runs-on: "releaser"
+    steps:
+    - name: "Checkout"
+      uses: "actions/checkout@v5"
+      with:
+        fetch-depth: 1
+        ref: ${{ github.ref_name }}
+        github-server-url: "https://github.openssl.org/"
+        repository: "openssl/openssl"
+        token: ${{ secrets.GHE_TOKEN }}
+        path: ${{ github.ref_name }}
+        persist-credentials: false
+    - name: "Prepare assets"
+      env:
+        SIGNING_KEY_UID: ${{ vars.signing_key_uid }}
+      run: |
+        cd "$GITHUB_REF_NAME"
+        ./util/mktar.sh
+        mkdir -p assets && mv "$GITHUB_REF_NAME.tar.gz" assets/ && cd assets
+        openssl sha1 -r "$GITHUB_REF_NAME.tar.gz" > "$GITHUB_REF_NAME.tar.gz.sha1"
+        openssl sha256 -r "$GITHUB_REF_NAME.tar.gz" > "$GITHUB_REF_NAME.tar.gz.sha256"
+        gpg -u "$SIGNING_KEY_UID" -o "$GITHUB_REF_NAME.tar.gz.asc" -sba "$GITHUB_REF_NAME.tar.gz"
+    - name: "Create release"
+      env:
+        GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
+      run: |
+        VERSION=$(echo "$GITHUB_REF_NAME" | cut -d "-" -f 2-)
+        PRE_RELEASE=$([[ "$GITHUB_REF_NAME" =~ alpha|beta ]] && echo "-p" || echo "")
+        NOTES=$(curl -s "https://api.openssl.org/release-metadata/news/?version=$VERSION&capture_title=False")
+        gh release create "$GITHUB_REF_NAME" $PRE_RELEASE -t "OpenSSL $VERSION" -d --notes "$NOTES" -R "$GITHUB_REPOSITORY" "$GITHUB_REF_NAME/assets/"*

.github/workflows/make-test

@@ -19,7 +19,7 @@ export OSSL_CI_ARTIFACTS_PATH="$(cd "$OSSL_CI_ARTIFACTS_PATH"; pwd)"
 
 # Run the tests. This might fail, but we need to capture artifacts anyway.
 set +e
-make test HARNESS_JOBS=${HARNESS_JOBS:-4} LHASH_WORKERS=${LHASH_WORKERS:-16} "$@"
+make test HARNESS_JOBS=${HARNESS_JOBS:-4} "$@"
 RESULT=$?
 set -e
 

.github/workflows/os-zoo.yml

@@ -1,4 +1,4 @@
-# Copyright 2021-2026 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2021-2025 The OpenSSL Project Authors. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
@@ -36,7 +36,7 @@ jobs:
     steps:
     - name: install packages
       run: apk --no-cache add build-base perl linux-headers ${{ matrix.cc }}
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: config
@@ -52,7 +52,7 @@ jobs:
         cat /proc/cpuinfo
         ./util/opensslwrap.sh version -c
     - name: make test
-      run: make test HARNESS_JOBS=${HARNESS_JOBS:-4} LHASH_WORKERS=${LHASH_WORKERS:-16}
+      run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
 
   linux:
     if: github.repository == 'openssl/openssl'
@@ -88,7 +88,7 @@ jobs:
     runs-on: ubuntu-latest
     container: ${{ matrix.zoo.image }}
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: install packages
@@ -104,7 +104,7 @@ jobs:
         cat /proc/cpuinfo
         ./util/opensslwrap.sh version -c
     - name: make test
-      run: make test HARNESS_JOBS=${HARNESS_JOBS:-4} LHASH_WORKERS=${LHASH_WORKERS:-16}
+      run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
 
   macos:
     if: github.repository == 'openssl/openssl'
@@ -114,7 +114,7 @@ jobs:
         os: [macos-14, macos-15, macos-15-intel]
     runs-on: ${{ matrix.os }}
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: checkout fuzz/corpora submodule
@@ -130,7 +130,7 @@ jobs:
         sysctl machdep.cpu
         ./util/opensslwrap.sh version -c
     - name: make test
-      run: make test HARNESS_JOBS=${HARNESS_JOBS:-4} LHASH_WORKERS=${LHASH_WORKERS:-16}
+      run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
 
   windows:
     if: github.repository == 'openssl/openssl'
@@ -141,31 +141,18 @@ jobs:
           - os: windows-2022
             vcvars: C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars64.bat
           - os: windows-2025
-            vcvars: C:\Program Files\Microsoft Visual Studio\18\Enterprise\VC\Auxiliary\Build\vcvars64.bat
+            vcvars: C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars64.bat
     runs-on: ${{ matrix.platform.os }}
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: checkout fuzz/corpora submodule
       run: git submodule update --init --depth 1 fuzz/corpora
     - name: install nasm
       run: |
-        $installer = "nasm-3.01-installer-x64.exe"
-        Invoke-WebRequest -Uri "https://openssl-library.org/ci-deps/$installer" -OutFile $installer
-        $expected = (Get-Content "$env:GITHUB_WORKSPACE\.github\ci-deps.json" -Raw | ConvertFrom-Json).$installer
-        $actual = (Get-FileHash $installer -Algorithm SHA256).Hash
-        if ($actual -ne $expected) { throw "SHA256 mismatch for $installer (expected $expected, got $actual)" }
-        Start-Process -FilePath ".\$installer" -ArgumentList '/S' -Wait
+        choco install nasm
         "C:\Program Files\NASM" | Out-File -FilePath "$env:GITHUB_PATH" -Append
-    - name: install jom
-      run: |
-        mkdir C:\jom
-        Invoke-WebRequest -Uri "https://openssl-library.org/ci-deps/jom-1.1.7.exe" -OutFile C:\jom\jom.exe
-        $expected = (Get-Content "$env:GITHUB_WORKSPACE\.github\ci-deps.json" -Raw | ConvertFrom-Json).'jom-1.1.7.exe'
-        $actual = (Get-FileHash C:\jom\jom.exe -Algorithm SHA256).Hash
-        if ($actual -ne $expected) { throw "SHA256 mismatch for jom.exe (expected $expected, got $actual)" }
-        "C:\jom" | Out-File -FilePath "$env:GITHUB_PATH" -Append
     - name: prepare the build directory
       run: mkdir _build
     - name: config
@@ -180,7 +167,7 @@ jobs:
       shell: cmd
       run: |
         call "${{ matrix.platform.vcvars }}"
-        jom /j4 /S
+        nmake /S
     - name: download coreinfo
       run: |
         mkdir _build\coreinfo
@@ -196,16 +183,16 @@ jobs:
       shell: cmd
       run: |
         call "${{ matrix.platform.vcvars }}"
-        jom test VERBOSE_FAILURE=yes HARNESS_JOBS=4 LHASH_WORKERS=16
+        nmake test VERBOSE_FAILURE=yes HARNESS_JOBS=4
 
   linux-arm64:
     runs-on: ubuntu-24.04-arm
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: config
-      run: ./config --strict-warnings enable-fips enable-ec_nistp_64_gcc_128 enable-md2 enable-rc5 enable-trace
+      run: ./config --strict-warnings enable-fips enable-ec_nistp_64_gcc_128 enable-md2 enable-rc5 enable-ssl3 enable-ssl3-method enable-trace
     - name: config dump
       run: ./configdata.pm --dump
     - name: make
@@ -213,12 +200,12 @@ jobs:
     - name: get cpu info
       run: ./util/opensslwrap.sh version -c
     - name: make test
-      run: make test HARNESS_JOBS=${HARNESS_JOBS:-4} LHASH_WORKERS=${LHASH_WORKERS:-16}
+      run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
 
   linux-x86:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: run container
@@ -231,7 +218,7 @@ jobs:
     - name: config
       run: |
         podman exec -t $CONTAINER_ID sh -c \
-          "./config --strict-warnings linux-x86 enable-demos enable-fips enable-lms enable-md2 enable-rc5 enable-trace"
+          "./config --strict-warnings linux-x86 enable-demos enable-fips enable-lms enable-md2 enable-rc5 enable-ssl3 enable-ssl3-method enable-trace"
     - name: config dump
       run: |
         podman exec -t $CONTAINER_ID sh -c \
@@ -260,11 +247,11 @@ jobs:
     runs-on: linux-ppc64le
     if: github.repository == 'openssl/openssl'
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: config
-      run: ./config --strict-warnings enable-fips enable-ec_nistp_64_gcc_128 enable-md2 enable-rc5 enable-trace
+      run: ./config --strict-warnings enable-fips enable-ec_nistp_64_gcc_128 enable-md2 enable-rc5 enable-ssl3 enable-ssl3-method enable-trace
     - name: config dump
       run: ./configdata.pm --dump
     - name: make
@@ -274,17 +261,17 @@ jobs:
         cat /proc/cpuinfo
         ./util/opensslwrap.sh version -c
     - name: make test
-      run: make test HARNESS_JOBS=${HARNESS_JOBS:-4} LHASH_WORKERS=${LHASH_WORKERS:-16}
+      run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
 
   linux-s390x:
     runs-on: linux-s390x
     if: github.repository == 'openssl/openssl'
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: config
-      run: ./config --strict-warnings enable-fips enable-md2 enable-rc5 enable-trace
+      run: ./config --strict-warnings enable-fips enable-md2 enable-rc5 enable-ssl3 enable-ssl3-method enable-trace
     - name: config dump
       run: ./configdata.pm --dump
     - name: make
@@ -294,17 +281,17 @@ jobs:
         cat /proc/cpuinfo
         ./util/opensslwrap.sh version -c
     - name: make test
-      run: make test HARNESS_JOBS=${HARNESS_JOBS:-4} LHASH_WORKERS=${LHASH_WORKERS:-16}
+      run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
 
   linux-riscv64:
     runs-on: linux-riscv64
     if: github.repository == 'openssl/openssl'
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: config
-      run: ./config enable-fips enable-ec_nistp_64_gcc_128 enable-md2 enable-rc5 enable-trace
+      run: ./config enable-fips enable-ec_nistp_64_gcc_128 enable-md2 enable-rc5 enable-ssl3 enable-ssl3-method enable-trace
     - name: config dump
       run: ./configdata.pm --dump
     - name: make
@@ -314,13 +301,13 @@ jobs:
     - name: make test
       env:
         OPENSSL_riscvcap: RV64GC_ZBA_ZBB_ZBC_ZBS_ZKT_V
-      run: make test HARNESS_JOBS=${HARNESS_JOBS:-4} LHASH_WORKERS=${LHASH_WORKERS:-16}
+      run: make test HARNESS_JOBS=${HARNESS_JOBS:-4}
 
   freebsd-x86_64:
     runs-on: ubuntu-latest
     if: github.repository == 'openssl/openssl'
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: config
@@ -331,7 +318,7 @@ jobs:
         shutdown_vm: false
         run: |
           sudo pkg install -y gcc perl5
-          ./config --strict-warnings enable-fips enable-ec_nistp_64_gcc_128 enable-md2 enable-rc5 enable-trace
+          ./config --strict-warnings enable-fips enable-ec_nistp_64_gcc_128 enable-md2 enable-rc5 enable-ssl3 enable-ssl3-method enable-trace
     - name: config dump
       uses: cross-platform-actions/action@46e8d7fb25520a8d6c64fd2b7a1192611da98eda #v0.30.0
       with:
@@ -354,45 +341,3 @@ jobs:
         run: |
           ./util/opensslwrap.sh version -c
           .github/workflows/make-test
-
-  openbsd-x86_64:
-    runs-on: ubuntu-latest
-    if: github.repository == 'openssl/openssl'
-    steps:
-    - uses: actions/checkout@v6
-    - name: config
-      uses: cross-platform-actions/action@46e8d7fb25520a8d6c64fd2b7a1192611da98eda #v0.30.0
-      with:
-        operating_system: openbsd
-        architecture: x86-64
-        version: '7.7'
-        shutdown_vm: false
-        run: |
-          ./config --strict-warnings enable-fips enable-ec_nistp_64_gcc_128 enable-md2 enable-rc5 enable-trace
-    - name: config dump
-      uses: cross-platform-actions/action@46e8d7fb25520a8d6c64fd2b7a1192611da98eda #v0.30.0
-      with:
-        operating_system: openbsd
-        architecture: x86-64
-        version: '7.7'
-        shutdown_vm: false
-        run: |
-          ./configdata.pm --dump
-    - name: make
-      uses: cross-platform-actions/action@46e8d7fb25520a8d6c64fd2b7a1192611da98eda #v0.30.0
-      with:
-        operating_system: openbsd
-        architecture: x86-64
-        version: '7.7'
-        shutdown_vm: false
-        run: |
-          make -j4
-    - name: make test
-      uses: cross-platform-actions/action@46e8d7fb25520a8d6c64fd2b7a1192611da98eda #v0.30.0
-      with:
-        operating_system: openbsd
-        architecture: x86-64
-        version: '7.7'
-        run: |
-          ./util/opensslwrap.sh version -c
-          .github/workflows/make-test

.github/workflows/oss-fuzz.yml

@@ -1,4 +1,4 @@
-# Copyright 2021-2026 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2021-2024 The OpenSSL Project Authors. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
@@ -15,7 +15,6 @@ permissions:
 
 jobs:
   Fuzzing:
-    if: github.event_name != 'schedule' || github.repository == 'openssl/openssl'
     runs-on: ubuntu-latest
     steps:
     - name: Clear unnecessary files

.github/workflows/perl-minimal-checker.yml

@@ -1,4 +1,4 @@
-# Copyright 2025-2026 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2025 The OpenSSL Project Authors. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
@@ -7,25 +7,7 @@
 
 # Jobs run per pull request submission
 name: Perl-minimal-checker CI
-on:
-  pull_request:
-    paths-ignore:
-      - 'doc/**'
-      - '*.md'
-      - '*.pod'
-      - 'README*'
-      - 'funding.json'
-      - 'LICENSE.txt'
-      - 'VERSION.dat'
-  push:
-    paths-ignore:
-      - 'doc/**'
-      - '*.md'
-      - '*.pod'
-      - 'README*'
-      - 'funding.json'
-      - 'LICENSE.txt'
-      - 'VERSION.dat'
+on: [pull_request, push]
 permissions:
   contents: read
 
@@ -55,7 +37,7 @@ jobs:
         make -j$(nproc) && make install
         perl -MTest::More -e 'print "$Test::More::VERSION\n"'
         popd
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: Build openssl

.github/workflows/prov-compat-label.yml

@@ -1,4 +1,4 @@
-# Copyright 2023-2026 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2023-2025 The OpenSSL Project Authors. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
@@ -10,22 +10,13 @@
 
 name: Provider compatibility for PRs
 
-on:
-  pull_request:
-    paths-ignore:
-      - 'doc/**'
-      - '*.md'
-      - '*.pod'
-      - 'README*'
-      - 'funding.json'
-      - 'LICENSE.txt'
-      - 'VERSION.dat'
+on: [pull_request]
 
 permissions:
   contents: read
 
 env:
-  opts: enable-rc5 enable-md2 enable-weak-ssl-ciphers enable-zlib
+  opts: enable-rc5 enable-md2 enable-ssl3 enable-weak-ssl-ciphers enable-zlib
 
 jobs:
   fips-releases:
@@ -118,43 +109,36 @@ jobs:
             name: '',
             dir: PR,
             tgz: PR.tar.gz,
-            extra_config: "enable-lms enable-tls-deprecated-ec",
           }, {
             name: openssl-3.0,
             dir: branch-3.0,
             tgz: branch-3.0.tar.gz,
-            extra_config: "",
+          }, {
+            name: openssl-3.3,
+            dir: branch-3.3,
+            tgz: branch-3.3.tar.gz,
           }, {
             name: openssl-3.4,
             dir: branch-3.4,
             tgz: branch-3.4.tar.gz,
-            extra_config: "",
           }, {
             name: openssl-3.5,
             dir: branch-3.5,
             tgz: branch-3.5.tar.gz,
-            extra_config: "",
           }, {
             name: openssl-3.6,
             dir: branch-3.6,
             tgz: branch-3.6.tar.gz,
-            extra_config: "enable-lms",
-          }, {
-            name: openssl-4.0,
-            dir: branch-4.0,
-            tgz: branch-4.0.tar.gz,
-            extra_config: "enable-lms enable-tls-deprecated-ec",
           }, {
             name: master,
             dir: branch-master,
             tgz: branch-master.tar.gz,
-            extra_config: "enable-lms enable-tls-deprecated-ec",
           },
         ]
 
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v5
         with:
           path: ${{ matrix.branch.dir }}
           repository: openssl/openssl
@@ -165,7 +149,7 @@ jobs:
 
       - name: config branch
         run: |
-          ./config --banner=Configured enable-shared enable-fips ${{ env.opts }} ${{ matrix.branch.extra_config }}
+          ./config --banner=Configured enable-shared enable-fips ${{ env.opts }}
         working-directory: ${{ matrix.branch.dir }}
       - name: config dump current
         run: ./configdata.pm --dump
@@ -214,20 +198,20 @@ jobs:
         # Note that releases are not used as a test environment for
         # later providers.  Problems in these situations ought to be
         # caught by cross branch testing before the release.
-        tree_a: [ branch-4.0, branch-3.6, branch-3.5, branch-3.4, branch-3.0,
+        tree_a: [ branch-3.6, branch-3.5, branch-3.4, branch-3.3, branch-3.0,
                   openssl-3.0.0, openssl-3.0.8, openssl-3.0.9, openssl-3.1.2 ]
         tree_b: [ PR ]
         include:
           - tree_a: PR
             tree_b: branch-master
-          - tree_a: PR
-            tree_b: branch-4.0
           - tree_a: PR
             tree_b: branch-3.6
           - tree_a: PR
             tree_b: branch-3.5
           - tree_a: PR
             tree_b: branch-3.4
+          - tree_a: PR
+            tree_b: branch-3.3
           - tree_a: PR
             tree_b: branch-3.0
     steps:

.github/workflows/provider-compatibility.yml

@@ -1,4 +1,4 @@
-# Copyright 2023-2026 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2023-2025 The OpenSSL Project Authors. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
@@ -24,7 +24,7 @@ permissions:
   contents: read
 
 env:
-  opts: enable-rc5 enable-md2 enable-weak-ssl-ciphers enable-zlib
+  opts: enable-rc5 enable-md2 enable-ssl3 enable-weak-ssl-ciphers enable-zlib
 
 jobs:
   fips-releases:
@@ -119,6 +119,11 @@ jobs:
             dir: branch-3.0,
             tgz: branch-3.0.tar.gz,
             extra_config: "",
+          }, {
+            name: openssl-3.3,
+            dir: branch-3.3,
+            tgz: branch-3.3.tar.gz,
+            extra_config: "",
           }, {
             name: openssl-3.4,
             dir: branch-3.4,
@@ -134,22 +139,17 @@ jobs:
             dir: branch-3.6,
             tgz: branch-3.6.tar.gz,
             extra_config: "enable-lms",
-          }, {
-            name: openssl-4.0,
-            dir: branch-4.0,
-            tgz: branch-4.0.tar.gz,
-            extra_config: "enable-lms enable-tls-deprecated-ec",
           }, {
             name: master,
             dir: branch-master,
             tgz: branch-master.tar.gz,
-            extra_config: "enable-lms enable-tls-deprecated-ec",
+            extra_config: "enable-lms",
           },
         ]
 
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v5
         with:
           path: ${{ matrix.branch.dir }}
           repository: openssl/openssl
@@ -213,10 +213,10 @@ jobs:
         # Note that releases are not used as a test environment for
         # later providers.  Problems in these situations ought to be
         # caught by cross branch testing before the release.
-        tree_a: [ branch-master, branch-4.0, branch-3.6, branch-3.5, branch-3.4,
+        tree_a: [ branch-master, branch-3.6, branch-3.5, branch-3.4, branch-3.3,
                   branch-3.0,
                   openssl-3.0.0, openssl-3.0.8, openssl-3.0.9, openssl-3.1.2 ]
-        tree_b: [ branch-master, branch-4.0, branch-3.6, branch-3.5, branch-3.4,
+        tree_b: [ branch-master, branch-3.6, branch-3.5, branch-3.4, branch-3.3,
                   branch-3.0  ]
     steps:
       - name: early exit checks

.github/workflows/riscv-more-cross-compiles.yml

@@ -1,4 +1,4 @@
-# Copyright 2021-2026 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2021-2025 The OpenSSL Project Authors. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
@@ -10,14 +10,6 @@ name: Cross Compile for RISC-V Extensions
 on:
   pull_request:
     types: [opened, reopened, edited, synchronize]
-    paths-ignore:
-      - 'doc/**'
-      - '*.md'
-      - '*.pod'
-      - 'README*'
-      - 'funding.json'
-      - 'LICENSE.txt'
-      - 'VERSION.dat'
   push:
   schedule:
     - cron: '35 02 * * *'
@@ -60,9 +52,6 @@ jobs:
         #   opensslcaps: optional; if opensslcapsname (see above) is set, then
         #                this string will be used as content for the OpenSSL
         #                capabilities variable.
-        #   capscheck: optional; ERE pattern passed to grep -E to assert that
-        #              "openssl info -cpusettings" output contains expected
-        #              capabilities when using the hwprobe detection path.
         #   ppa:   Launchpad PPA repository to download packages from.
         platform: [
           # Scalar Crypto
@@ -172,28 +161,6 @@ jobs:
             qemucpu: "rv64,zba=true,zbb=true,zbc=true,zbs=true,zbkb=true,zbkc=true,zbkx=true,zknd=true,zkne=true,zknh=true,zksed=true,zksh=true,zkr=true,zkt=true,v=true,vlen=128,zvbb=true,zvbc=true,zvkb=true,zvkg=true,zvkned=true,zvknha=true,zvknhb=true,zvksed=true,zvksh=true",
             opensslcapsname: riscvcap, # OPENSSL_riscvcap
             opensslcaps: "rv64gc_zba_zbb_zbc_zbs_zbkb_zbkc_zbkx_zknd_zkne_zknh_zksed_zksh_zkr_zkt_v_zvbb_zvbc_zvkb_zvkg_zvkned_zvknha_zvknhb_zvksed_zvksh"
-          }, {
-            # RV64GC with all currently OpenSSL-supported extensions, with zvl256
-            #   crypto/sha/asm/sha512-riscv64-zvkb-zvknhb.pl
-            #   crypto/sm3/asm/sm3-riscv64-zvksh.pl
-            arch: riscv64-linux-gnu,
-            libs: libc6-dev-riscv64-cross,
-            target: linux64-riscv64,
-            fips: no,
-            qemucpu: "rv64,zba=true,zbb=true,zbc=true,zbs=true,zbkb=true,zbkc=true,zbkx=true,zknd=true,zkne=true,zknh=true,zksed=true,zksh=true,zkr=true,zkt=true,v=true,vlen=256,zvbb=true,zvbc=true,zvkb=true,zvkg=true,zvkned=true,zvknha=true,zvknhb=true,zvksed=true,zvksh=true",
-            opensslcapsname: riscvcap, # OPENSSL_riscvcap
-            opensslcaps: "rv64gc_zba_zbb_zbc_zbs_zbkb_zbkc_zbkx_zknd_zkne_zknh_zksed_zksh_zkr_zkt_v_zvbb_zvbc_zvkb_zvkg_zvkned_zvknha_zvknhb_zvksed_zvksh_zvl256"
-          }, {
-            # RV64GC with all currently OpenSSL-supported extensions, with zvl512
-            #   crypto/sha/asm/sha512-riscv64-zvkb-zvknhb.pl
-            #   crypto/sm3/asm/sm3-riscv64-zvksh.pl
-            arch: riscv64-linux-gnu,
-            libs: libc6-dev-riscv64-cross,
-            target: linux64-riscv64,
-            fips: no,
-            qemucpu: "rv64,zba=true,zbb=true,zbc=true,zbs=true,zbkb=true,zbkc=true,zbkx=true,zknd=true,zkne=true,zknh=true,zksed=true,zksh=true,zkr=true,zkt=true,v=true,vlen=512,zvbb=true,zvbc=true,zvkb=true,zvkg=true,zvkned=true,zvknha=true,zvknhb=true,zvksed=true,zvksh=true",
-            opensslcapsname: riscvcap, # OPENSSL_riscvcap
-            opensslcaps: "rv64gc_zba_zbb_zbc_zbs_zbkb_zbkc_zbkx_zknd_zkne_zknh_zksed_zksh_zkr_zkt_v_zvbb_zvbc_zvkb_zvkg_zvkned_zvknha_zvknhb_zvksed_zvksh_zvl512"
           }, {
             # Inline asm
             # zbb/zbkb:
@@ -213,35 +180,6 @@ jobs:
             qemucpu: "rv64,zbb=true,zbkb=true,zknh=true,zksh=true",
             opensslcapsname: riscvcap, # OPENSSL_riscvcap
             opensslcaps: "rv64gc_inlineasm" # for uploading artifact
-          }, {
-            # hwprobe path: RV64GC without V, no OPENSSL_riscvcap override.
-            # Forces the hwprobe_to_cap() code path (skipped when OPENSSL_riscvcap is set).
-            # V is absent so AT_HWCAP V bit is clear (VECTOR_CAPABLE=false).
-            # The rv64 CPU model includes ZBB/ZBC/ZBS/ZBKB by default.
-            arch: riscv64-linux-gnu,
-            libs: libc6-dev-riscv64-cross,
-            target: linux64-riscv64,
-            fips: no,
-            qemucpu: "rv64,zbb=true,zbc=true,zbs=true,zbkb=true,v=false",
-            # No opensslcapsname: hwprobe is used for capability detection.
-            opensslcaps: "rv64gc_novector_hwprobe",
-            # ZBB must be detected
-            capscheck: "_ZBB",
-          }, {
-            # hwprobe path: RV64GC + V + ZVKNED (vlen=128), no OPENSSL_riscvcap override.
-            # Forces the hwprobe_to_cap() code path (skipped when OPENSSL_riscvcap is set).
-            # V is present so AT_HWCAP V bit is set (VECTOR_CAPABLE=true).
-            arch: riscv64-linux-gnu,
-            libs: libc6-dev-riscv64-cross,
-            target: linux64-riscv64,
-            fips: no,
-            qemucpu: "rv64,v=true,vlen=128,zvkned=true",
-            # No opensslcapsname: hwprobe is used for capability detection.
-            opensslcaps: "rv64gc_v_zvkned_hwprobe",
-            # V must be detected. ZVKNED is not reported by QEMU 8.2.2 (ubuntu-latest)
-            # via hwprobe despite being set in QEMU_CPU; tighten once CI moves to a
-            # newer QEMU that reports all Zvk* extensions via hwprobe.
-            capscheck: "_V",
           }
         ]
     runs-on: ubuntu-latest
@@ -256,7 +194,7 @@ jobs:
         sudo apt-get -yq --allow-unauthenticated --allow-downgrades --allow-remove-essential --allow-change-held-packages install \
             gcc-${{ matrix.platform.arch }} \
             ${{ matrix.platform.libs }}
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: checkout fuzz/corpora submodule
@@ -300,13 +238,6 @@ jobs:
       if: matrix.platform.tests != 'none'
       run: QEMU_LD_PREFIX=/usr/${{ matrix.platform.arch }} ./util/opensslwrap.sh info -cpusettings
 
-    - name: check detected capabilities
-      if: matrix.platform.capscheck != ''
-      run: |
-        QEMU_LD_PREFIX=/usr/${{ matrix.platform.arch }} \
-          ./util/opensslwrap.sh info -cpusettings | \
-          grep -qE "${{ matrix.platform.capscheck }}"
-
     - name: make all tests
       if: github.event_name == 'push' && matrix.platform.tests == ''
       run: |

.github/workflows/run-checker-ci.yml

@@ -1,4 +1,4 @@
-# Copyright 2021-2026 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2021-2025 The OpenSSL Project Authors. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
@@ -7,25 +7,7 @@
 
 # Jobs run per pull request submission
 name: Run-checker CI
-on:
-  pull_request:
-    paths-ignore:
-      - 'doc/**'
-      - '*.md'
-      - '*.pod'
-      - 'README*'
-      - 'funding.json'
-      - 'LICENSE.txt'
-      - 'VERSION.dat'
-  push:
-    paths-ignore:
-      - 'doc/**'
-      - '*.md'
-      - '*.pod'
-      - 'README*'
-      - 'funding.json'
-      - 'LICENSE.txt'
-      - 'VERSION.dat'
+on: [pull_request, push]
 permissions:
   contents: read
 
@@ -59,12 +41,12 @@ jobs:
           no-tls1_2,
           no-tls1_3,
           enable-trace enable-fips,
-          no-quic,
-          -DOPENSSL_USE_IPV6=0
+          no-ui,
+          no-quic
         ]
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: checkout fuzz/corpora submodule

.github/workflows/run-checker-daily.yml

@@ -1,4 +1,4 @@
-# Copyright 2021-2026 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2021-2025 The OpenSSL Project Authors. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
@@ -30,6 +30,7 @@ jobs:
           no-asan,
           no-asm,
           no-async,
+          no-atexit,
           no-autoalginit,
           no-autoerrinit,
           no-autoload-config,
@@ -44,6 +45,7 @@ jobs:
           no-cmac,
           no-comp,
           enable-crypto-mdebug,
+          enable-crypto-mdebug-backtrace,
           no-ct,
           enable-demos,
           no-deprecated,
@@ -54,6 +56,8 @@ jobs:
           no-dtls1_2,
           no-dtls1_2-method,
           no-dtls1-method,
+          no-ecdh,
+          no-ecdsa,
           enable-ec_nistp_64_gcc_128,
           enable-egd,
 #          enable-external-tests,  # Requires extra setup
@@ -65,13 +69,10 @@ jobs:
 #          enable-fuzz-libfuzzer,  # Requires extra setup
           no-gost,
           enable-h3demo,
+          enable-heartbeats,
           enable-hqinterop,
-          no-hmac-drbg-kdf,
           no-hw,
           no-idea,
-          no-ikev2kdf,
-          no-kbkdf,
-          no-krb5kdf,
           enable-lms,
           no-makedepend,
           enable-md2,
@@ -85,7 +86,6 @@ jobs:
           no-poly1305,
           no-posix-io,
           no-psk,
-          no-pvkkdf,
           no-rc2,
           enable-rc5,
           no-rdrand,
@@ -101,14 +101,12 @@ jobs:
           no-sm2-precomp,
           no-sm3,
           no-sm4,
-          no-snmpkdf,
           no-sock,
-          no-srtpkdf,
           no-sse2,
-          no-sshkdf,
-          no-sskdf,
           no-ssl,
           no-ssl-trace,
+          enable-ssl3,
+          enable-ssl3-method,
           enable-sslkeylog,
           no-shared,
           no-tests,
@@ -125,8 +123,6 @@ jobs:
           no-uplink,
           no-weak-ssl-ciphers,
           no-whirlpool,
-          no-x942kdf,
-          no-x963kdf,
           enable-zlib-dynamic,
           -DOPENSSL_PEDANTIC_ZEROIZATION,
           -DOPENSSL_PEDANTIC_ZEROIZATION enable-fips,
@@ -136,7 +132,7 @@ jobs:
         ]
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: checkout fuzz/corpora submodule
@@ -158,7 +154,7 @@ jobs:
     if: github.repository == 'openssl/openssl'
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: checkout fuzz/corpora submodule
@@ -205,7 +201,7 @@ jobs:
         sudo apt-get update
         sudo apt-get -yq --no-install-suggests --no-install-recommends --allow-unauthenticated --allow-downgrades --allow-remove-essential --allow-change-held-packages install brotli libbrotli1 libbrotli-dev
     - name: checkout openssl
-      uses: actions/checkout@v6
+      uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: checkout fuzz/corpora submodule
@@ -230,7 +226,7 @@ jobs:
         sudo apt-get update
         sudo apt-get -yq --no-install-suggests --no-install-recommends --allow-unauthenticated --allow-downgrades --allow-remove-essential --allow-change-held-packages install zstd libzstd1 libzstd-dev
     - name: checkout openssl
-      uses: actions/checkout@v6
+      uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: checkout fuzz/corpora submodule
@@ -256,7 +252,7 @@ jobs:
         sudo apt-get -yq --no-install-suggests --no-install-recommends --allow-unauthenticated --allow-downgrades --allow-remove-essential --allow-change-held-packages install brotli libbrotli1 libbrotli-dev
         sudo apt-get -yq --no-install-suggests --no-install-recommends --allow-unauthenticated --allow-downgrades --allow-remove-essential --allow-change-held-packages install zstd libzstd1 libzstd-dev
     - name: checkout openssl
-      uses: actions/checkout@v6
+      uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: checkout fuzz/corpora submodule
@@ -277,7 +273,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: checkout openssl
-      uses: actions/checkout@v6
+      uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: Adjust ASLR for sanitizer
@@ -306,7 +302,7 @@ jobs:
         sudo apt-get update
         sudo apt-get -yq --no-install-suggests --no-install-recommends --allow-unauthenticated --allow-downgrades --allow-remove-essential --allow-change-held-packages install brotli libbrotli1 libbrotli-dev
     - name: checkout openssl
-      uses: actions/checkout@v6
+      uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: checkout fuzz/corpora submodule
@@ -335,7 +331,7 @@ jobs:
         sudo apt-get update
         sudo apt-get -yq --no-install-suggests --no-install-recommends --allow-unauthenticated --allow-downgrades --allow-remove-essential --allow-change-held-packages install zstd libzstd1 libzstd-dev
     - name: checkout openssl
-      uses: actions/checkout@v6
+      uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: checkout fuzz/corpora submodule
@@ -362,7 +358,7 @@ jobs:
         os: [ubuntu-latest, macos-15, macos-15-intel]
     runs-on: ${{matrix.os}}
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: checkout fuzz/corpora submodule
@@ -380,7 +376,7 @@ jobs:
     if: github.repository == 'openssl/openssl'
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: checkout fuzz/corpora submodule
@@ -400,7 +396,7 @@ jobs:
     if: github.repository == 'openssl/openssl'
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: checkout fuzz/corpora submodule
@@ -424,7 +420,7 @@ jobs:
   bn_debug:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: config

.github/workflows/run-checker-merge.yml

@@ -1,4 +1,4 @@
-# Copyright 2021-2026 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2021-2025 The OpenSSL Project Authors. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
@@ -31,7 +31,6 @@ jobs:
           no-srp,
           no-srtp,
           no-ts,
-          no-ui,
           no-integrity-only-ciphers,
           enable-weak-ssl-ciphers,
           enable-zlib,
@@ -43,7 +42,7 @@ jobs:
       run: |
         sudo cat /proc/sys/vm/mmap_rnd_bits
         sudo sysctl -w vm.mmap_rnd_bits=28
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: checkout fuzz/corpora submodule
@@ -65,11 +64,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: checkout openssl
-      uses: actions/checkout@v6
+      uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: checkout jitter
-      uses: actions/checkout@v6
+      uses: actions/checkout@v5
       with:
         repository: smuellerDD/jitterentropy-library
         ref: v3.5.0
@@ -93,7 +92,7 @@ jobs:
   threads_sanitizer_atomic_fallback:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: checkout fuzz/corpora submodule

.github/workflows/run_quic_interop.yml

@@ -18,7 +18,7 @@ jobs:
     if: ${{ github.repository == 'openssl/openssl' && !inputs.only_interop }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v5
         with:
           persist-credentials: false
       - name: "log in to quay.io"
@@ -36,7 +36,7 @@ jobs:
     if: ${{ github.repository == 'openssl/openssl' && !inputs.only_interop }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v5
         with:
           repository: microsoft/msquic
           ref: main
@@ -71,7 +71,7 @@ jobs:
             tests: retry
       fail-fast: false
     steps: &client_steps
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v5
         with:
           repository: 'quic-interop/quic-interop-runner'
           fetch-depth: 0
@@ -98,8 +98,8 @@ jobs:
             "msquic-openssl": { image: "quay.io/openssl-ci/msquic-openssl"
                               , url: "https://github.com/microsoft/msquic"
                               , role: "both"
-                              }}' ./implementations_quic.json > ./implementations.tmp
-          mv ./implementations.tmp implementations_quic.json
+                              }}' ./implementations.json > ./implementations.tmp
+          mv ./implementations.tmp implementations.json
       - name: Set up docker
         uses: docker/setup-docker-action@efe9e3891a4f7307e689f2100b33a155b900a608 # v4.5.0
         with:
@@ -129,7 +129,7 @@ jobs:
             tests: amplificationlimit
       fail-fast: false
     steps: &server_steps
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v5
         with:
           repository: 'quic-interop/quic-interop-runner'
           fetch-depth: 0
@@ -156,8 +156,8 @@ jobs:
             "msquic-openssl": { image: "quay.io/openssl-ci/msquic-openssl"
                               , url: "https://github.com/microsoft/msquic"
                               , role: "both"
-                              }}' ./implementations_quic.json > ./implementations.tmp
-          mv ./implementations.tmp implementations_quic.json
+                              }}' ./implementations.json > ./implementations.tmp
+          mv ./implementations.tmp implementations.json
       - name: Set up docker
         uses: docker/setup-docker-action@efe9e3891a4f7307e689f2100b33a155b900a608 # v4.5.0
         with:

.github/workflows/static-analysis-on-prem.yml

@@ -1,4 +1,4 @@
-# Copyright 2021-2026 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2021-2025 The OpenSSL Project Authors. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
@@ -27,11 +27,11 @@ jobs:
       run: |
         echo ${{ secrets.COVERITY_AUTH_KEY }} | base64 -d > /auth_key_file.txt
         chmod 0600 /auth_key_file.txt
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: Config
-      run: CC=gcc ./config --strict-warnings --banner=Configured --debug enable-lms enable-fips enable-rc5 enable-md2 enable-nextprotoneg enable-weak-ssl-ciphers enable-zlib enable-ec_nistp_64_gcc_128 no-shared enable-buildtest-c++ enable-external-tests -DPEDANTIC
+      run: CC=gcc ./config --strict-warnings --banner=Configured --debug enable-lms enable-fips enable-rc5 enable-md2 enable-ssl3 enable-nextprotoneg enable-ssl3-method enable-weak-ssl-ciphers enable-zlib enable-ec_nistp_64_gcc_128 no-shared enable-buildtest-c++ enable-external-tests -DPEDANTIC
     - name: Config dump
       run: ./configdata.pm --dump
     - name: Make

.github/workflows/static-analysis.yml

@@ -1,4 +1,4 @@
-# Copyright 2021-2026 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2021-2025 The OpenSSL Project Authors. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
@@ -21,7 +21,7 @@ jobs:
     if: github.repository == 'openssl/openssl'
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: tool download
@@ -30,7 +30,7 @@ jobs:
              --post-data "token=${{ secrets.COVERITY_TOKEN }}&project=openssl%2Fopenssl" \
              --progress=dot:giga -O coverity_tool.tgz
     - name: config
-      run: CC=gcc ./config --strict-warnings --banner=Configured --debug enable-lms enable-fips enable-rc5 enable-md2 enable-nextprotoneg enable-weak-ssl-ciphers enable-zlib enable-ec_nistp_64_gcc_128 no-shared enable-buildtest-c++ enable-external-tests -DPEDANTIC
+      run: CC=gcc ./config --strict-warnings --banner=Configured --debug enable-lms enable-fips enable-rc5 enable-md2 enable-ssl3 enable-nextprotoneg enable-ssl3-method enable-weak-ssl-ciphers enable-zlib enable-ec_nistp_64_gcc_128 no-shared enable-buildtest-c++ enable-external-tests -DPEDANTIC
     - name: config dump
       run: ./configdata.pm --dump
     - name: tool install

.github/workflows/style-checks.yml

@@ -1,4 +1,4 @@
-# Copyright 2021-2026 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2021-2024 The OpenSSL Project Authors. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
@@ -7,22 +7,13 @@
 
 name: Coding style validation 
 
-on:
-  pull_request:
-    paths-ignore:
-      - 'doc/**'
-      - '*.md'
-      - '*.pod'
-      - 'README*'
-      - 'funding.json'
-      - 'LICENSE.txt'
-      - 'VERSION.dat'
+on: [pull_request]
 
 jobs:
   check-style:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v5
       - uses: actions/setup-python@v6
       - name: "Get changed files"
         env:

.github/workflows/valgrind-daily.yml

@@ -1,66 +0,0 @@
-# Copyright 2026 The OpenSSL Project Authors. All Rights Reserved.
-#
-# Licensed under the Apache License 2.0 (the "License").  You may not use
-# this file except in compliance with the License.  You can obtain a copy
-# in the file LICENSE in the source distribution or at
-# https://www.openssl.org/source/license.html
-
-name: Test valgrind suppression file
-# Jobs run daily
-
-on:
-  schedule:
-    - cron: '30 02 * * *'
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-    check-valgrind-suppressions:
-      runs-on: ubuntu-latest
-      steps:
-        - uses: actions/checkout@v6
-          with:
-            persist-credentials: false
-        - name: Install valgrind
-          run: |
-            sudo apt-get -y update
-            sudo apt-get -y install valgrind
-        - name: Get parse suppressions script
-          run: |
-            wget https://raw.githubusercontent.com/coqui-ai/STT/refs/tags/v1.4.0/parse_valgrind_suppressions.sh
-            echo "7414fcb9405f8bd1632442a0b66ffb35457994c6b8b49b2aa91530cf9a7ff645  ./parse_valgrind_suppressions.sh" > ./valgrind_suppressions.sha256
-            sha256sum -c ./valgrind_suppressions.sha256
-            chmod 755 ./parse_valgrind_suppressions.sh
-        - name: Configure
-          run: |
-            ./Configure -DOPENSSL_VALGRIND_TEST
-            ./configdata.pm --dump
-        - name: Make
-          run: |
-            make -j
-        - name: Make test
-          run: |
-            # The quic radix and multistream test times out under valgrind in ci
-            make TESTS="-test_quic_radix -test_quic_multistream" OSSL_USE_VALGRIND=yes test
-        - name: Check for leaks
-          run: |
-            set +e
-            NUM_LOGS=$(find . -name 'valgrind.log.*' | wc -l)
-            echo "Found $NUM_LOGS valgrind logs"
-            if [ $NUM_LOGS == 0 ]; then
-              echo "No logs found!"
-              exit 1
-            fi
-            for i in $(find . -name 'valgrind.log.*'); do
-              ./parse_valgrind_suppressions.sh $i >> ./new_suppressions.txt
-            done
-            NEW_SUPPRESSION_LINES=$(cat ./new_suppressions.txt | wc -l)
-            if [ $NEW_SUPPRESSION_LINES != 0 ]; then
-              echo "New Suppressions Found that need to be addressed!"
-              cat ./new_suppressions.txt
-              exit 1
-            fi
-            echo "No new suppressions found"
-            exit 0

.github/workflows/windows.yml

@@ -1,4 +1,4 @@
-# Copyright 2021-2026 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2021-2025 The OpenSSL Project Authors. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
@@ -7,26 +7,7 @@
 
 name: Windows GitHub CI
 
-on:
-  pull_request:
-    paths-ignore:
-      - 'doc/**'
-      - '*.md'
-      - '*.pod'
-      - 'README*'
-      - 'funding.json'
-      - 'LICENSE.txt'
-      - 'VERSION.dat'
-  push:
-    paths-ignore:
-      - 'doc/**'
-      - '*.md'
-      - '*.pod'
-      - 'README*'
-      - 'funding.json'
-      - 'LICENSE.txt'
-      - 'VERSION.dat'
-
+on: [pull_request, push]
 
 permissions:
   contents: read
@@ -44,51 +25,22 @@ jobs:
           - arch: amd64
             os: windows-2025
             config: enable-lms enable-fips no-thread-pool no-quic
-            vcvars: C:\Program Files\Microsoft Visual Studio\18\Enterprise\VC\Auxiliary\Build\vcvars64.bat
+            vcvars: C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars64.bat
           - arch: x86
             os: windows-2022
             config: no-fips enable-lms
             vcvars: C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars32.bat
     runs-on: ${{ matrix.platform.os }}
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: checkout fuzz/corpora submodule
       run: git submodule update --init --depth 1 fuzz/corpora
     - name: install nasm
-      if: github.repository == 'openssl/openssl'
       run: |
-        $installer = "nasm-3.01-installer-${{ matrix.platform.arch == 'x86' && 'x86' || 'x64' }}.exe"
-        Invoke-WebRequest -Uri "https://openssl-library.org/ci-deps/$installer" -OutFile $installer
-        $expected = (Get-Content "$env:GITHUB_WORKSPACE\.github\ci-deps.json" -Raw | ConvertFrom-Json).$installer
-        $actual = (Get-FileHash $installer -Algorithm SHA256).Hash
-        if ($actual -ne $expected) { throw "SHA256 mismatch for $installer (expected $expected, got $actual)" }
-        Start-Process -FilePath ".\$installer" -ArgumentList '/S' -Wait
+        choco install nasm ${{ matrix.platform.arch == 'x86' && '--x86' || '' }}
         "C:\Program Files${{ matrix.platform.arch == 'x86' && ' (x86)' || '' }}\NASM" | Out-File -FilePath "$env:GITHUB_PATH" -Append
-    - name: install nasm (forks)
-      if: github.repository != 'openssl/openssl'
-      run: |
-        $installer = "nasm-3.01-installer-${{ matrix.platform.arch == 'x86' && 'x86' || 'x64' }}.exe"
-        Invoke-WebRequest -Uri "https://www.nasm.us/pub/nasm/releasebuilds/3.01/win${{ matrix.platform.arch == 'x86' && '32' || '64' }}/$installer" -OutFile $installer
-        Start-Process -FilePath ".\$installer" -ArgumentList '/S' -Wait
-        "C:\Program Files${{ matrix.platform.arch == 'x86' && ' (x86)' || '' }}\NASM" | Out-File -FilePath "$env:GITHUB_PATH" -Append
-    - name: install jom
-      if: github.repository == 'openssl/openssl'
-      run: |
-        mkdir C:\jom
-        Invoke-WebRequest -Uri "https://openssl-library.org/ci-deps/jom-1.1.7.exe" -OutFile C:\jom\jom.exe
-        $expected = (Get-Content "$env:GITHUB_WORKSPACE\.github\ci-deps.json" -Raw | ConvertFrom-Json).'jom-1.1.7.exe'
-        $actual = (Get-FileHash C:\jom\jom.exe -Algorithm SHA256).Hash
-        if ($actual -ne $expected) { throw "SHA256 mismatch for jom.exe (expected $expected, got $actual)" }
-        "C:\jom" | Out-File -FilePath "$env:GITHUB_PATH" -Append
-    - name: install jom (forks)
-      if: github.repository != 'openssl/openssl'
-      run: |
-        mkdir C:\jom
-        Invoke-WebRequest -Uri "https://download.qt.io/official_releases/jom/jom_1_1_7.zip" -OutFile C:\jom\jom.zip
-        Expand-Archive -Path C:\jom\jom.zip -DestinationPath C:\jom
-        "C:\jom" | Out-File -FilePath "$env:GITHUB_PATH" -Append
     - name: prepare the build directory
       run: mkdir _build
     - name: config
@@ -103,7 +55,7 @@ jobs:
       shell: cmd
       run: |
         call "${{ matrix.platform.vcvars }}"
-        jom /j4 /S
+        nmake /S
     - name: download coreinfo
       run: |
         mkdir _build\coreinfo
@@ -115,7 +67,6 @@ jobs:
         apps/openssl.exe version -v | %{($_ -split '\s+')[1]}
         apps/openssl.exe version -v | %{($_ -split '\s+')[1] -replace '([0-9]+\.[0-9]+)(\..*)','$1'}
         echo "OSSL_VERSION=$(apps/openssl.exe version -v | %{($_ -split '\s+')[1] -replace '([0-9]+\.[0-9]+)(\..*)','$1'})" | Out-File -FilePath $Env:GITHUB_ENV -Encoding utf8 -Append
-        echo "OSSL_MAJOR=$(apps/openssl.exe version -v | %{($_ -split '\s+')[1] -replace '([0-9]+)\.[0-9]+(\..*)','$1'})" | Out-File -FilePath $Env:GITHUB_ENV -Encoding utf8 -Append
     - name: Set registry keys
       working-directory: _build
       run: |
@@ -132,16 +83,13 @@ jobs:
         ./apps/openssl.exe version -c
     - name: Check platform symbol usage
       working-directory: _build
-      shell: cmd
-      run: |
-        call "${{ matrix.platform.vcvars }}"
-        perl ../util/checkplatformsyms.pl ../util/platform_symbols/windows-symbols.txt libcrypto-%OSSL_MAJOR%${{ matrix.platform.arch == 'amd64' && '-x64' || '' }}.dll ./libssl-%OSSL_MAJOR%${{ matrix.platform.arch == 'amd64' && '-x64' || '' }}.dll
+      run: perl ../util/checkplatformsyms.pl ../util/platform_symbols/windows-symbols.txt libcrypto-3-x64.dll ./libssl-3-x64.dll
     - name: test
       working-directory: _build
       shell: cmd
       run: |
         call "${{ matrix.platform.vcvars }}"
-        jom test VERBOSE_FAILURE=yes TESTS=-test_fuzz* HARNESS_JOBS=4
+        nmake test VERBOSE_FAILURE=yes TESTS=-test_fuzz* HARNESS_JOBS=4
     - name: install
       # Run on 64 bit only as 32 bit is slow enough already
       if: ${{ matrix.platform.arch == 'amd64' }}
@@ -150,47 +98,31 @@ jobs:
       run: |
         call "${{ matrix.platform.vcvars }}"
         mkdir _dest
-        jom /j4 install DESTDIR=_dest
+        nmake install DESTDIR=_dest
 
   plain:
     runs-on: windows-2022
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: checkout fuzz/corpora submodule
       run: git submodule update --init --depth 1 fuzz/corpora
     - name: prepare the build directory
       run: mkdir _build
-    - name: install jom
-      if: github.repository == 'openssl/openssl'
-      run: |
-        mkdir C:\jom
-        Invoke-WebRequest -Uri "https://openssl-library.org/ci-deps/jom-1.1.7.exe" -OutFile C:\jom\jom.exe
-        $expected = (Get-Content "$env:GITHUB_WORKSPACE\.github\ci-deps.json" -Raw | ConvertFrom-Json).'jom-1.1.7.exe'
-        $actual = (Get-FileHash C:\jom\jom.exe -Algorithm SHA256).Hash
-        if ($actual -ne $expected) { throw "SHA256 mismatch for jom.exe (expected $expected, got $actual)" }
-        "C:\jom" | Out-File -FilePath "$env:GITHUB_PATH" -Append
-    - name: install jom (forks)
-      if: github.repository != 'openssl/openssl'
-      run: |
-        mkdir C:\jom
-        Invoke-WebRequest -Uri "https://download.qt.io/official_releases/jom/jom_1_1_7.zip" -OutFile C:\jom\jom.zip
-        Expand-Archive -Path C:\jom\jom.zip -DestinationPath C:\jom
-        "C:\jom" | Out-File -FilePath "$env:GITHUB_PATH" -Append
     - name: config
       working-directory: _build
       shell: cmd
       run: |
         call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars64.bat"
-        perl ..\Configure --banner=Configured --strict-warnings enable-demos no-makedepend no-shared no-fips enable-md2 enable-rc5 enable-weak-ssl-ciphers enable-trace enable-crypto-mdebug -DOSSL_WINCTX=openssl VC-WIN64A-masm
+        perl ..\Configure --banner=Configured --strict-warnings enable-demos no-makedepend no-shared no-fips enable-md2 enable-rc5 enable-ssl3 enable-ssl3-method enable-weak-ssl-ciphers enable-trace enable-crypto-mdebug -DOSSL_WINCTX=openssl VC-WIN64A-masm
         perl configdata.pm --dump
     - name: build
       working-directory: _build
       shell: cmd
       run: |
         call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars64.bat"
-        jom /j4 /S
+        nmake /S
     - name: download coreinfo
       run: |
         mkdir _build\coreinfo
@@ -209,85 +141,16 @@ jobs:
         call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars64.bat"
         nmake test VERBOSE_FAILURE=yes HARNESS_JOBS=4
 
-  unit-tests:
-    runs-on: windows-2022
-    steps:
-    - uses: actions/checkout@v6
-      with:
-        persist-credentials: false
-    - name: checkout fuzz/corpora submodule
-      run: git submodule update --init --depth 1 fuzz/corpora
-    - name: install jom
-      if: github.repository == 'openssl/openssl'
-      run: |
-        mkdir C:\jom
-        Invoke-WebRequest -Uri "https://openssl-library.org/ci-deps/jom-1.1.7.exe" -OutFile C:\jom\jom.exe
-        $expected = (Get-Content "$env:GITHUB_WORKSPACE\.github\ci-deps.json" -Raw | ConvertFrom-Json).'jom-1.1.7.exe'
-        $actual = (Get-FileHash C:\jom\jom.exe -Algorithm SHA256).Hash
-        if ($actual -ne $expected) { throw "SHA256 mismatch for jom.exe (expected $expected, got $actual)" }
-        "C:\jom" | Out-File -FilePath "$env:GITHUB_PATH" -Append
-    - name: install jom (forks)
-      if: github.repository != 'openssl/openssl'
-      run: |
-        mkdir C:\jom
-        Invoke-WebRequest -Uri "https://download.qt.io/official_releases/jom/jom_1_1_7.zip" -OutFile C:\jom\jom.zip
-        Expand-Archive -Path C:\jom\jom.zip -DestinationPath C:\jom
-        "C:\jom" | Out-File -FilePath "$env:GITHUB_PATH" -Append
-    - name: install cmocka and detours via vcpkg
-      shell: pwsh
-      run: |
-        & "$env:VCPKG_INSTALLATION_ROOT\vcpkg.exe" install cmocka:x64-windows-static-md detours:x64-windows-static-md
-        "VCPKG_INST=$env:VCPKG_INSTALLATION_ROOT\installed\x64-windows-static-md" | Out-File -FilePath $env:GITHUB_ENV -Append
-    - name: prepare the build directory
-      run: mkdir _build
-    - name: config
-      working-directory: _build
-      shell: cmd
-      run: |
-        call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars64.bat"
-        perl ..\Configure VC-WIN64A --banner=Configured --strict-warnings no-makedepend no-asm enable-unit-tests ^
-          --with-cmocka-include=%VCPKG_INST%\include  --with-cmocka-lib=%VCPKG_INST%\lib ^
-          --with-detours-include=%VCPKG_INST%\include --with-detours-lib=%VCPKG_INST%\lib
-        perl configdata.pm --dump
-    - name: build
-      working-directory: _build
-      shell: cmd
-      run: |
-        call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars64.bat"
-        jom /j4 /S
-    - name: test
-      working-directory: _build
-      shell: cmd
-      run: |
-        call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars64.bat"
-        jom test VERBOSE=1 TESTS=test_unit
-
   minimal:
     runs-on: windows-2022
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: checkout fuzz/corpora submodule
       run: git submodule update --init --depth 1 fuzz/corpora
     - name: prepare the build directory
       run: mkdir _build
-    - name: install jom
-      if: github.repository == 'openssl/openssl'
-      run: |
-        mkdir C:\jom
-        Invoke-WebRequest -Uri "https://openssl-library.org/ci-deps/jom-1.1.7.exe" -OutFile C:\jom\jom.exe
-        $expected = (Get-Content "$env:GITHUB_WORKSPACE\.github\ci-deps.json" -Raw | ConvertFrom-Json).'jom-1.1.7.exe'
-        $actual = (Get-FileHash C:\jom\jom.exe -Algorithm SHA256).Hash
-        if ($actual -ne $expected) { throw "SHA256 mismatch for jom.exe (expected $expected, got $actual)" }
-        "C:\jom" | Out-File -FilePath "$env:GITHUB_PATH" -Append
-    - name: install jom (forks)
-      if: github.repository != 'openssl/openssl'
-      run: |
-        mkdir C:\jom
-        Invoke-WebRequest -Uri "https://download.qt.io/official_releases/jom/jom_1_1_7.zip" -OutFile C:\jom\jom.zip
-        Expand-Archive -Path C:\jom\jom.zip -DestinationPath C:\jom
-        "C:\jom" | Out-File -FilePath "$env:GITHUB_PATH" -Append
     - name: config
       working-directory: _build
       shell: cmd
@@ -300,7 +163,7 @@ jobs:
       shell: cmd
       run: |
         call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars64.bat"
-        jom /j4 /S
+        nmake
     - name: download coreinfo
       run: |
         mkdir _build\coreinfo
@@ -317,7 +180,7 @@ jobs:
       shell: cmd
       run: |
         call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars64.bat"
-        jom test VERBOSE_FAILURE=yes TESTS=-test_fuzz* HARNESS_JOBS=4
+        nmake test VERBOSE_FAILURE=yes TESTS=-test_fuzz* HARNESS_JOBS=4
 
   cygwin:
     # Run a job for each of the specified target architectures:
@@ -339,7 +202,7 @@ jobs:
       MAKE_PARAMS: -j 4
     steps:
 # Checkout before cygwin can mess with PATH...
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v5
       with:
         persist-credentials: false
     - uses: cygwin/cygwin-install-action@f2009323764960f80959895c7bc3bb30210afe4d #v6
@@ -353,89 +216,7 @@ jobs:
 #    - name: Clone repo
 #      run: bash -c "pwd && git clone --branch ${{ github.ref_name }} --depth 1 https://github.com/${{ github.repository }}.git"
     - name: Full build
-      shell: bash
-      run: |
-        gcc --version
-        ./config ${{ matrix.platform.config }}
-        make $MAKE_PARAMS
+      run: bash -c "gcc --version && ./config ${{ matrix.platform.config }} && make $MAKE_PARAMS"
 # Disable testing for now. TBD: Need local cygwin installation to debug .
 #    - name: Run openssl tests
 #      run: bash -c "cd openssl && make V=1 test"
-
-  mingw64:
-    strategy:
-      matrix:
-        platform:
-          - arch: mingw64
-            target: x86_64
-            #  Avoid MINGW bug in headers. Remove when CI is upgraded.
-            config: enable-demos -Wno-array-bounds
-          - arch: mingw
-            target: i686
-            config: -Wno-array-bounds -Wno-stringop-overflow
-    runs-on: ubuntu-latest
-    env:
-      CC: ${{ matrix.platform.target }}-w64-mingw32-gcc
-      CXX: ${{ matrix.platform.target }}-w64-mingw32-g++
-      AR: ${{ matrix.platform.target }}-w64-mingw32-ar
-      RANLIB: ${{ matrix.platform.target }}-w64-mingw32-ranlib
-      RC: ${{ matrix.platform.target }}-w64-mingw32-windres
-    steps:
-    - uses: actions/checkout@v6
-      with:
-        persist-credentials: false
-    - name: install MINGW64
-      run: sudo apt-get install -y mingw-w64
-    - name: config
-      run: ./config ${{ matrix.platform.arch }}  --strict-warnings --banner=Configured ${{ matrix.platform.config }}
-    - name: make
-      run: make -j4 -s
-
-  msys2-mingw64:
-    strategy:
-      matrix:
-        platform:
-          - arch: UCRT64
-            cc: gcc
-            pkgs:  mingw-w64-ucrt-x86_64-gcc
-            config: mingw64 enable-demos
-          - arch: CLANG64
-            cc: clang
-            pkgs: mingw-w64-clang-x86_64-clang
-            config: mingw64
-    runs-on: windows-latest
-    env:
-      CC: ${{ matrix.platform.cc }}
-      MSYSTEM: ${{ matrix.platform.arch }}
-      CHERE_INVOKING: 'yes'
-    steps:
-      - uses: actions/checkout@v6
-        with:
-          persist-credentials: false
-      - name: install MSYS2
-        run: |
-          $url = 'https://github.com/msys2/msys2-installer/releases/download/nightly-x86_64/msys2-base-x86_64-latest.sfx.exe'
-          (New-Object System.Net.WebClient).DownloadFile($url, 'msys2.exe')
-          # Remove preinstalled MSYS2
-          if (Test-Path C:\msys64) { Remove-Item -Recurse -Force C:\msys64 }
-          .\msys2.exe -y -oC:\
-          Remove-Item msys2.exe
-
-      - name: update MSYS2
-        run: |
-          C:\msys64\usr\bin\bash.exe -lc ' '
-          # Update core and then normal update
-          C:\msys64\usr\bin\bash.exe -lc 'pacman --noconfirm -Syuu'
-          C:\msys64\usr\bin\bash.exe -lc 'pacman --noconfirm -Syuu'
-
-      - name: install dependencies
-        run: C:\msys64\usr\bin\bash.exe -lc 'pacman --noconfirm -S --needed perl git make ${{ matrix.platform.pkgs }}'
-
-      - name: config
-        run: C:\msys64\usr\bin\bash.exe -lc './config --strict-warnings --banner=Configured ${{ matrix.platform.config }}'
-
-      - name: make
-        run: C:\msys64\usr\bin\bash.exe -lc 'make -j4 -s'
-# Tests are broken for now
-#      - name: test
-#        run: C:\msys64\usr\bin\bash.exe -lc 'make test'

.github/workflows/windows_comp.yml

@@ -1,4 +1,4 @@
-# Copyright 2022-2026 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2022-2025 The OpenSSL Project Authors. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
@@ -23,44 +23,15 @@ jobs:
   zstd:
     runs-on: windows-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: checkout fuzz/corpora submodule
       run: git submodule update --init --depth 1 fuzz/corpora
     - name: install nasm
-      if: github.repository == 'openssl/openssl'
       run: |
-        $installer = "nasm-3.01-installer-x64.exe"
-        Invoke-WebRequest -Uri "https://openssl-library.org/ci-deps/$installer" -OutFile $installer
-        $expected = (Get-Content "$env:GITHUB_WORKSPACE\.github\ci-deps.json" -Raw | ConvertFrom-Json).$installer
-        $actual = (Get-FileHash $installer -Algorithm SHA256).Hash
-        if ($actual -ne $expected) { throw "SHA256 mismatch for $installer (expected $expected, got $actual)" }
-        Start-Process -FilePath ".\$installer" -ArgumentList '/S' -Wait
+        choco install nasm
         "C:\Program Files\NASM" | Out-File -FilePath "$env:GITHUB_PATH" -Append
-    - name: install nasm (forks)
-      if: github.repository != 'openssl/openssl'
-      run: |
-        $installer = "nasm-3.01-installer-x64.exe"
-        Invoke-WebRequest -Uri "https://www.nasm.us/pub/nasm/releasebuilds/3.01/win64/$installer" -OutFile $installer
-        Start-Process -FilePath ".\$installer" -ArgumentList '/S' -Wait
-        "C:\Program Files\NASM" | Out-File -FilePath "$env:GITHUB_PATH" -Append
-    - name: install jom
-      if: github.repository == 'openssl/openssl'
-      run: |
-        mkdir C:\jom
-        Invoke-WebRequest -Uri "https://openssl-library.org/ci-deps/jom-1.1.7.exe" -OutFile C:\jom\jom.exe
-        $expected = (Get-Content "$env:GITHUB_WORKSPACE\.github\ci-deps.json" -Raw | ConvertFrom-Json).'jom-1.1.7.exe'
-        $actual = (Get-FileHash C:\jom\jom.exe -Algorithm SHA256).Hash
-        if ($actual -ne $expected) { throw "SHA256 mismatch for jom.exe (expected $expected, got $actual)" }
-        "C:\jom" | Out-File -FilePath "$env:GITHUB_PATH" -Append
-    - name: install jom (forks)
-      if: github.repository != 'openssl/openssl'
-      run: |
-        mkdir C:\jom
-        Invoke-WebRequest -Uri "https://download.qt.io/official_releases/jom/jom_1_1_7.zip" -OutFile C:\jom\jom.zip
-        Expand-Archive -Path C:\jom\jom.zip -DestinationPath C:\jom
-        "C:\jom" | Out-File -FilePath "$env:GITHUB_PATH" -Append
     - name: prepare the build directory
       run: mkdir _build
     - name: Get zstd
@@ -71,15 +42,15 @@ jobs:
       working-directory: _build
       shell: cmd
       run: |
-        call "C:\Program Files\Microsoft Visual Studio\18\Enterprise\VC\Auxiliary\Build\vcvars64.bat"
+        call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars64.bat"
         perl ..\Configure --strict-warnings enable-comp enable-zstd --with-zstd-include=C:\vcpkg\packages\zstd_x64-windows\include --with-zstd-lib=C:\vcpkg\packages\zstd_x64-windows\lib\zstd.lib no-makedepend -DOSSL_WINCTX=openssl VC-WIN64A
         perl configdata.pm --dump
     - name: build
       working-directory: _build
       shell: cmd
       run: |
-        call "C:\Program Files\Microsoft Visual Studio\18\Enterprise\VC\Auxiliary\Build\vcvars64.bat"
-        jom /j4 /S
+        call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars64.bat"
+        nmake
     - name: Gather openssl version info
       working-directory: _build
       run: |
@@ -105,54 +76,28 @@ jobs:
         7z.exe x coreinfo/Coreinfo.zip
         ./Coreinfo64.exe -accepteula -f
         ./apps/openssl.exe version -c
+    - name: Check platform symbol usage
+      run: |
+        perl ./util/checkplatformsyms.pl ./util/platform_symbols/windows-symbols.txt libcrypto-3-x64.dll ./libssl-3-x64.dll
     - name: test
       working-directory: _build
       shell: cmd
       run: |
-        call "C:\Program Files\Microsoft Visual Studio\18\Enterprise\VC\Auxiliary\Build\vcvars64.bat"
-        jom test VERBOSE_FAILURE=yes TESTS="-test_fuzz* -test_fipsload" HARNESS_JOBS=4
+        call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars64.bat"
+        nmake test VERBOSE_FAILURE=yes TESTS="-test_fuzz* -test_fipsload" HARNESS_JOBS=4
 
   brotli:
     runs-on: windows-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: checkout fuzz/corpora submodule
       run: git submodule update --init --depth 1 fuzz/corpora
     - name: install nasm
-      if: github.repository == 'openssl/openssl'
       run: |
-        $installer = "nasm-3.01-installer-x64.exe"
-        Invoke-WebRequest -Uri "https://openssl-library.org/ci-deps/$installer" -OutFile $installer
-        $expected = (Get-Content "$env:GITHUB_WORKSPACE\.github\ci-deps.json" -Raw | ConvertFrom-Json).$installer
-        $actual = (Get-FileHash $installer -Algorithm SHA256).Hash
-        if ($actual -ne $expected) { throw "SHA256 mismatch for $installer (expected $expected, got $actual)" }
-        Start-Process -FilePath ".\$installer" -ArgumentList '/S' -Wait
+        choco install nasm
         "C:\Program Files\NASM" | Out-File -FilePath "$env:GITHUB_PATH" -Append
-    - name: install nasm (forks)
-      if: github.repository != 'openssl/openssl'
-      run: |
-        $installer = "nasm-3.01-installer-x64.exe"
-        Invoke-WebRequest -Uri "https://www.nasm.us/pub/nasm/releasebuilds/3.01/win64/$installer" -OutFile $installer
-        Start-Process -FilePath ".\$installer" -ArgumentList '/S' -Wait
-        "C:\Program Files\NASM" | Out-File -FilePath "$env:GITHUB_PATH" -Append
-    - name: install jom
-      if: github.repository == 'openssl/openssl'
-      run: |
-        mkdir C:\jom
-        Invoke-WebRequest -Uri "https://openssl-library.org/ci-deps/jom-1.1.7.exe" -OutFile C:\jom\jom.exe
-        $expected = (Get-Content "$env:GITHUB_WORKSPACE\.github\ci-deps.json" -Raw | ConvertFrom-Json).'jom-1.1.7.exe'
-        $actual = (Get-FileHash C:\jom\jom.exe -Algorithm SHA256).Hash
-        if ($actual -ne $expected) { throw "SHA256 mismatch for jom.exe (expected $expected, got $actual)" }
-        "C:\jom" | Out-File -FilePath "$env:GITHUB_PATH" -Append
-    - name: install jom (forks)
-      if: github.repository != 'openssl/openssl'
-      run: |
-        mkdir C:\jom
-        Invoke-WebRequest -Uri "https://download.qt.io/official_releases/jom/jom_1_1_7.zip" -OutFile C:\jom\jom.zip
-        Expand-Archive -Path C:\jom\jom.zip -DestinationPath C:\jom
-        "C:\jom" | Out-File -FilePath "$env:GITHUB_PATH" -Append
     - name: prepare the build directory
       run: mkdir _build
     - name: Get brotli
@@ -163,15 +108,15 @@ jobs:
       working-directory: _build
       shell: cmd
       run: |
-        call "C:\Program Files\Microsoft Visual Studio\18\Enterprise\VC\Auxiliary\Build\vcvars64.bat"
+        call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars64.bat"
         perl ..\Configure --strict-warnings enable-comp enable-brotli --with-brotli-include=C:\vcpkg\packages\brotli_x64-windows\include --with-brotli-lib=C:\vcpkg\packages\brotli_x64-windows\lib no-makedepend -DOSSL_WINCTX=openssl VC-WIN64A
         perl configdata.pm --dump
     - name: build
       working-directory: _build
       shell: cmd
       run: |
-        call "C:\Program Files\Microsoft Visual Studio\18\Enterprise\VC\Auxiliary\Build\vcvars64.bat"
-        jom /j4 /S
+        call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars64.bat"
+        nmake
     - name: Gather openssl version info
       working-directory: _build
       run: |
@@ -201,5 +146,5 @@ jobs:
       working-directory: _build
       shell: cmd
       run: |
-        call "C:\Program Files\Microsoft Visual Studio\18\Enterprise\VC\Auxiliary\Build\vcvars64.bat"
-        jom test VERBOSE_FAILURE=yes TESTS="-test_fuzz* -test_fipsload" HARNESS_JOBS=4
+        call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars64.bat"
+        nmake test VERBOSE_FAILURE=yes TESTS="-test_fuzz* -test_fipsload" HARNESS_JOBS=4

.gitignore

@@ -59,8 +59,6 @@
 /include/openssl/x509_vfy.h
 /include/openssl/core_names.h
 
-/apps/include/configuration.h
-
 # Auto generated parameter name files
 /crypto/params_idx.c
 
@@ -88,7 +86,6 @@ providers/common/include/prov/der_wrap.h
 providers/common/include/prov/der_sm2.h
 providers/common/include/prov/der_ml_dsa.h
 providers/common/include/prov/der_hkdf.h
-providers/fips/fipsparams.inc
 providers/implementations/asymciphers/rsa_enc.inc
 providers/implementations/asymciphers/sm2_enc.inc
 providers/implementations/exchange/dh_exch.inc
@@ -104,7 +101,6 @@ providers/implementations/encode_decode/encode_key2ms.inc
 providers/implementations/kdfs/argon2.inc
 providers/implementations/kdfs/hkdf.inc
 providers/implementations/kdfs/hmacdrbg_kdf.inc
-providers/implementations/kdfs/ikev2kdf.inc
 providers/implementations/kdfs/kbkdf.inc
 providers/implementations/kdfs/krb5kdf.inc
 providers/implementations/kdfs/pbkdf1.inc
@@ -112,13 +108,10 @@ providers/implementations/kdfs/pbkdf2.inc
 providers/implementations/kdfs/pkcs12kdf.inc
 providers/implementations/kdfs/pvkkdf.inc
 providers/implementations/kdfs/scrypt.inc
-providers/implementations/kdfs/snmpkdf.inc
-providers/implementations/kdfs/srtpkdf.inc
 providers/implementations/kdfs/sshkdf.inc
 providers/implementations/kdfs/sskdf.inc
 providers/implementations/kdfs/tls1_prf.inc
 providers/implementations/kdfs/x942kdf.inc
-providers/implementations/kdfs/x963kdf.inc
 providers/implementations/kem/ec_kem.inc
 providers/implementations/kem/ecx_kem.inc
 providers/implementations/kem/ml_kem_kem.inc
@@ -139,7 +132,6 @@ providers/implementations/keymgmt/mlx_kmgmt.inc
 providers/implementations/keymgmt/slh_dsa_kmgmt.inc
 providers/implementations/keymgmt/template_kmgmt.inc
 providers/implementations/signature/eddsa_sig.inc
-providers/implementations/signature/mac_legacy_sig.inc
 providers/implementations/signature/ml_dsa_sig.inc
 providers/implementations/signature/rsa_sig.inc
 providers/implementations/signature/slh_dsa_sig.inc
@@ -167,10 +159,7 @@ providers/implementations/ciphers/cipher_sm4_xts.inc
 providers/implementations/digests/blake2_prov.inc
 providers/implementations/digests/digestcommon.inc
 providers/implementations/digests/mdc2_prov.inc
-providers/implementations/digests/sha2_prov.inc
 providers/implementations/digests/sha3_prov.inc
-providers/implementations/digests/ml_dsa_mu_prov.inc
-providers/implementations/digests/cshake_prov.inc
 providers/implementations/include/prov/blake2_params.inc
 providers/implementations/macs/cmac_prov.inc
 providers/implementations/macs/gmac_prov.inc
@@ -200,7 +189,6 @@ providers/implementations/rands/test_rng.inc
 /test/gost2814789t
 /test/ssltest_old
 /test/*test
-/test/*memfail
 /test/fips_aesavs
 /test/fips_desmovs
 /test/fips_dhvs
@@ -311,6 +299,8 @@ providers/implementations/rands/test_rng.inc
 
 # Misc auto generated files
 /doc/man7/openssl_user_macros.pod
+/tools/c_rehash
+/tools/c_rehash.pl
 /util/shlib_wrap.sh
 /util/wrap.pl
 /tags
@@ -431,11 +421,3 @@ doc-nits
 # LSP (Language Server Protocol) support
 .cache/
 compile_commands.json
-
-# coverage files
-*.gcda
-*.gcno
-lcov.info
-run_tests
-depend
-

.pre-commit-config.yaml

@@ -11,9 +11,3 @@ repos:
         types_or: []
         files: '\.c\.in$|\.h\.in$|\.c$|\.h$'
         args: ["--style=file"]
-        exclude: |
-            (?x)^(
-                  crypto/objects/obj_dat.h|
-                  crypto/objects/obj_xref.h|
-                  include/openssl/obj_mac.h
-                 )$

CONTRIBUTING.md

@@ -27,28 +27,6 @@ communication before submitting many pull requests. In addition,
 contributors should personally evaluate potential patches generated by
 automated tools.
 
-Provide a clear description of the issue or feature being addressed,
-including any relevant implementation details and, for performance
-improvements, benchmark results.
-
-Pull requests and commits should be self-contained, enabling readers to
-understand what changed and why without needing to reference related
-issues or having prior knowledge.  Commit messages should include all
-relevant details to help future contributors follow the git history,
-with clear explanations of what is changing and why.  Long descriptions
-are encouraged if they aid understanding.  Commit message titles (their
-first line) should be kept to 50-70 characters if possible.
-
-Pull Requests (PR's) go through multiple phases before they are merged. In the
-first phase the label 'approval: review pending' is added. Once you receive 2 or
-more approvals from [Committers] the label is changed to 'approval: done' and
-24 hours after this the label changes to 'approval: ready to merge'. At some time
-after this your PR will be merged and the PR is closed. Reviewers may ask you to
-make changes at any phase before the Pull Request is merged, and any changes
-(that are not just a rebase) will require re-approval.
-
-[Committers]: https://openssl-library.org/about/committers/index.html
-
 To make it easier to review and accept your pull request, please follow these
 guidelines:
 
@@ -80,37 +58,7 @@ guidelines:
         git push -f [<repository> [<branch>]]
     ```
 
- 2. Similarly, if a non-trivial portion of a contribution was created
-    using an AI tool, you must declare which agent and model were used.
-    This is done by adding `Assisted-by: {agent}:{model}` below the commit
-    message:
-
-    ```
-        One-line summary of change with AI-generated portions
-
-        Assisted-by: Claude:claude-sonnet-4-6
-    ```
-
-    Multiple Assisted-by trailers can be included if multiple tools were used:
-
-    ```
-        Assisted-by: Claude:claude-sonnet-4-6
-        Assisted-by: ChatGPT:gpt-4o
-        Assisted-by: GitHub Copilot:gpt-4.1
-    ```
-
-    You will need to have signed a v1.1 or later CLA in order to
-    include AI-generated content in your contribution. CLAs signed
-    after June 2026 will have the requisite clauses.
-
-    Consult the [OpenSSL AI Code and Documentation Contribution
-    Policy] if an AI model assisted with the creation of your
-    contribution.
-
-    [OpenSSL AI Code and Documentation Contribution
-    Policy]: <https://openssl-library.org/policies/general/ai-policy/>
-
- 3. All source files should start with the following text (with
+ 2. All source files should start with the following text (with
     appropriate comment characters at the start of each line and the
     year(s) updated):
 
@@ -123,37 +71,33 @@ guidelines:
         https://www.openssl.org/source/license.html
     ```
 
- 4. Patches should be as current as possible; expect to have to rebase
+ 3. Patches should be as current as possible; expect to have to rebase
     often. We do not accept merge commits, you will have to remove them
     (usually by rebasing) before it will be acceptable.
 
- 5. Code provided should follow our [coding style](STYLE.md) and
-    [documentation policy](DOCUMENTATION.md) and compile without warnings when
-    using a --strict-warnings configuration.
-
-    Consistent formatting is enforced by using `clang-format` with configuration
-    stored in [.clang-format](.clang-format). OpenSSL uses `WebKit` style.
-    You can configure git pre-commit to automatically reformat your code with
-    [.pre-commit-config.yaml](.pre-commit-config.yaml) configuration.
-    There is also a [Perl tool](util/reformat-patches.sh) to help with
-    reformatting existing patches.
-
+ 4. Code provided should follow our [coding style] and [documentation policy]
+    and compile without warnings.
+    There is a [Perl tool](util/check-format.pl) that helps
+    finding code formatting mistakes and other coding style nits.
     Where `gcc` or `clang` is available, you should use the
     `--strict-warnings` `Configure` option.  OpenSSL compiles on many varied
     platforms: try to ensure you only use portable features.
     Clean builds via GitHub Actions are required. They are started automatically
     whenever a PR is created or updated by committers.
 
- 6. When at all possible, code contributions should include tests. These can
+    [coding style]: https://openssl-library.org/policies/technical/coding-style/
+    [documentation policy]: https://openssl-library.org/policies/technical/documentation-policy/
+
+ 5. When at all possible, code contributions should include tests. These can
     either be added to an existing test, or completely new.  Please see
     [test/README.md](test/README.md) for information on the test framework.
 
- 7. New features or changed functionality must include
+ 6. New features or changed functionality must include
     documentation. Please look at the `.pod` files in `doc/man[1357]` for
     examples of our style. Run `make doc-nits` to make sure that your
     documentation changes are clean.
 
- 8. For user visible changes (API changes, behaviour changes, ...),
+ 7. For user visible changes (API changes, behaviour changes, ...),
     consider adding a note in [CHANGES.md](CHANGES.md).
     This could be a summarising description of the change, and could
     explain the grander details.
@@ -164,37 +108,5 @@ guidelines:
     with a specific release without having to sift through the higher
     noise ratio in git-log.
 
- 9. Guidelines on how to integrate error output of new crypto library modules
+ 8. Guidelines on how to integrate error output of new crypto library modules
     can be found in [crypto/err/README.md](crypto/err/README.md).
-
-10. Once your Pull Request gets to the stage of being reviewed fixup commits
-    should be used where possible. Fixup commits are squashed when the PR is
-    finally merged. Fixup commits are done in the following way:
-
-    ```
-
-        # Add one or more updated files that needed changes
-        git add <filename>
-
-        # Do a fixup commit
-        # <commit-id> is the id of a previous commit that you want to fix up.
-        git commit --fixup <commit-id>
-
-        # Do a non forced push
-        git push
-    ```
-
-    To view commit-id's use:
-
-    ```
-       git log
-    ```
-
-11. If a Pull Request addresses an [issue](https://github.com/openssl/openssl/issues/)
-    the commit should include the line:
-
-    ```
-        Fixes: LINK
-    ```
-
-    where LINK is the https link to the issue in github.

Configurations/00-base-templates.conf

@@ -47,7 +47,7 @@ my %targets=(
 
 	defines		=>
 	    sub {
-                my @defs = ();
+                my @defs = ( 'OPENSSL_BUILDING_OPENSSL' );
                 push @defs, "BROTLI" unless $disabled{brotli};
                 push @defs, "BROTLI_SHARED" unless $disabled{"brotli-dynamic"};
                 push @defs, "ZLIB" unless $disabled{zlib};

Configurations/10-main.conf

@@ -5,8 +5,7 @@
 my $vc_win64a_info = {};
 sub vc_win64a_info {
     unless (%$vc_win64a_info) {
-        # Minimum NASM version is 2.09 otherwise SHA3 might be miscompiled
-        if (`nasm -v 2>NUL` =~ /NASM version ([0-9]+)\.([0-9]+)/ && ($1 > 2 || ($1 == 2 && $2 >= 9))) {
+        if (`nasm -v 2>NUL` =~ /NASM version ([0-9]+\.[0-9]+)/ && $1 >= 2.0) {
             $vc_win64a_info = { AS        => "nasm",
                                 ASFLAGS   => "-g",
                                 asflags   => "-Ox -f win64 -DNEAR",
@@ -61,6 +60,70 @@ sub vc_win32_info {
     return $vc_win32_info;
 }
 
+my $vc_wince_info = {};
+sub vc_wince_info {
+    unless (%$vc_wince_info) {
+        # sanity check
+        $die->('%OSVERSION% is not defined') if (!defined(env('OSVERSION')));
+        $die->('%PLATFORM% is not defined')  if (!defined(env('PLATFORM')));
+        $die->('%TARGETCPU% is not defined') if (!defined(env('TARGETCPU')));
+
+        #
+        # Idea behind this is to mimic flags set by eVC++ IDE...
+        #
+        my $wcevers = env('OSVERSION');                     # WCENNN
+	my $wcevernum;
+	my $wceverdotnum;
+	if ($wcevers =~ /^WCE([1-9])([0-9]{2})$/) {
+	    $wcevernum = "$1$2";
+	    $wceverdotnum = "$1.$2";
+	} else {
+	    $die->('%OSVERSION% value is insane');
+	    $wcevernum = "{unknown}";
+	    $wceverdotnum = "{unknown}";
+	}
+        my $wcecdefs = "-D_WIN32_WCE=$wcevernum -DUNDER_CE=$wcevernum"; # -D_WIN32_WCE=NNN
+        my $wcelflag = "/subsystem:windowsce,$wceverdotnum";        # ...,N.NN
+
+        my $wceplatf =  env('PLATFORM');
+
+        $wceplatf =~ tr/a-z0-9 /A-Z0-9_/;
+        $wcecdefs .= " -DWCE_PLATFORM_$wceplatf";
+
+        my $wcetgt = env('TARGETCPU');                      # just shorter name...
+      SWITCH: for($wcetgt) {
+          /^X86/        && do { $wcecdefs.=" -Dx86 -D_X86_ -D_i386_ -Di_386_";
+                                $wcelflag.=" /machine:X86";     last; };
+          /^ARMV4[IT]/  && do { $wcecdefs.=" -DARM -D_ARM_ -D$wcetgt";
+                                $wcecdefs.=" -DTHUMB -D_THUMB_" if($wcetgt=~/T$/);
+                                $wcecdefs.=" -QRarch4T -QRinterwork-return";
+                                $wcelflag.=" /machine:THUMB";   last; };
+          /^ARM/        && do { $wcecdefs.=" -DARM -D_ARM_ -D$wcetgt";
+                                $wcelflag.=" /machine:ARM";     last; };
+          /^MIPSIV/     && do { $wcecdefs.=" -DMIPS -D_MIPS_ -DR4000 -D$wcetgt";
+                                $wcecdefs.=" -D_MIPS64 -QMmips4 -QMn32";
+                                $wcelflag.=" /machine:MIPSFPU"; last; };
+          /^MIPS16/     && do { $wcecdefs.=" -DMIPS -D_MIPS_ -DR4000 -D$wcetgt";
+                                $wcecdefs.=" -DMIPSII -QMmips16";
+                                $wcelflag.=" /machine:MIPS16";  last; };
+          /^MIPSII/     && do { $wcecdefs.=" -DMIPS -D_MIPS_ -DR4000 -D$wcetgt";
+                                $wcecdefs.=" -QMmips2";
+                                $wcelflag.=" /machine:MIPS";    last; };
+          /^R4[0-9]{3}/ && do { $wcecdefs.=" -DMIPS -D_MIPS_ -DR4000";
+                                $wcelflag.=" /machine:MIPS";    last; };
+          /^SH[0-9]/    && do { $wcecdefs.=" -D$wcetgt -D_${wcetgt}_ -DSHx";
+                                $wcecdefs.=" -Qsh4" if ($wcetgt =~ /^SH4/);
+                                $wcelflag.=" /machine:$wcetgt"; last; };
+          { $wcecdefs.=" -D$wcetgt -D_${wcetgt}_";
+            $wcelflag.=" /machine:$wcetgt";                     last; };
+      }
+
+        $vc_wince_info = { cppflags => $wcecdefs,
+                           lflags => $wcelflag };
+    }
+    return $vc_wince_info;
+}
+
 # Helper functions for the VMS configs
 my $vms_info = {};
 sub vms_info {
@@ -623,6 +686,7 @@ my %targets = (
                                    release => "-O3"),
         cflags           => threads("-pthread"),
         cxxflags         => combine("-std=c++11", threads("-pthread")),
+        lib_cppflags     => "-DOPENSSL_USE_NODELETE",
         ex_libs          => add("-ldl", threads("-pthread")),
         bn_ops           => "BN_LLONG RC4_CHAR",
         thread_scheme    => "pthreads",
@@ -906,6 +970,7 @@ my %targets = (
         perlasm_scheme   => 'void',
     },
     "linux64-sparcv9" => {
+        # GCC 3.1 is a requirement
         inherit_from     => [ "linux-generic64" ],
         cflags           => add("-m64 -mcpu=ultrasparc"),
         cxxflags         => add("-m64 -mcpu=ultrasparc"),
@@ -1434,7 +1499,7 @@ my %targets = (
 
 #### Visual C targets
 #
-# Win64 target, WIN64A denotes AMD64
+# Win64 targets, WIN64I denotes IA-64/Itanium and WIN64A - AMD64
 #
 # Note about /wd4090, disable warning C4090. This warning returns false
 # positives in some situations. Disabling it altogether masks both
@@ -1476,10 +1541,10 @@ my %targets = (
                                 "UNICODE", "_UNICODE",
                                 "_CRT_SECURE_NO_DEPRECATE",
                                 "_WINSOCK_DEPRECATED_NO_WARNINGS"),
-        lib_cflags       => add("/Z7"),
+        lib_cflags       => add("/Zi /Fdossl_static.pdb"),
         lib_defines      => add("L_ENDIAN"),
-        dso_cflags       => "/Z7",
-        bin_cflags       => "/Z7",
+        dso_cflags       => "/Zi /Fddso.pdb",
+        bin_cflags       => "/Zi /Fdapp.pdb",
         # def_flag made to empty string so a .def file gets generated
         shared_defflag   => '',
         shared_ldflag    => "/dll",
@@ -1501,11 +1566,11 @@ my %targets = (
         cflags           => add(picker(default => '/Gs0 /GF /Gy',
                                        debug   =>
                                        sub {
-                                           ($disabled{shared} ? "" : ($disabled{"static-vcruntime"} ? "/MDd" : ($disabled{threads} ? "" : "/MTd")));
+                                           ($disabled{shared} ? "" : "/MDd");
                                        },
                                        release =>
                                        sub {
-                                           ($disabled{shared} ? "" : ($disabled{"static-vcruntime"} ? "/MD": ($disabled{threads} ? "" : "/MT")));
+                                           ($disabled{shared} ? "" : "/MD");
                                        })),
         defines          => add(picker(default => [], # works as type cast
                                        debug   => [ "DEBUG", "_DEBUG" ])),
@@ -1542,6 +1607,17 @@ my %targets = (
         }),
         bn_ops           => add("SIXTY_FOUR_BIT"),
     },
+    "VC-WIN64I" => {
+        inherit_from     => [ "VC-WIN64-common" ],
+        AS               => "ias",
+        ASFLAGS          => "-d debug",
+        asoutflag        => "-o ",
+        sys_id           => "WIN64I",
+        uplink_arch      => 'ia64',
+        asm_arch         => 'ia64',
+        perlasm_scheme   => "ias",
+        multilib         => "-ia64",
+    },
     "VC-WIN64A" => {
         inherit_from     => [ "VC-WIN64-common" ],
         AS               => sub { vc_win64a_info()->{AS} },
@@ -1569,6 +1645,53 @@ my %targets = (
         # some installation path heuristics in windows-makefile.tmpl...
         build_scheme     => add("VC-WOW", { separator => undef }),
     },
+    "VC-CE" => {
+        inherit_from     => [ "VC-common" ],
+        CFLAGS           => add(picker(debug   => "/Od",
+                                       release => "/O1i")),
+        CPPDEFINES       => picker(debug   => [ "DEBUG", "_DEBUG" ]),
+        LDFLAGS          => add("/nologo /opt:ref"),
+        cflags           =>
+            combine('/GF /Gy',
+                    sub { vc_wince_info()->{cflags}; },
+                    sub { `cl 2>&1` =~ /Version ([0-9]+)\./ && $1>=14
+                              ? ($disabled{shared} ? " /MT" : " /MD")
+                              : " /MC"; }),
+        cppflags         => sub { vc_wince_info()->{cppflags}; },
+        lib_defines      => add("NO_CHMOD", "OPENSSL_SMALL_FOOTPRINT"),
+        lib_cppflags     => sub { vc_wince_info()->{cppflags}; },
+        includes         =>
+            add(combine(sub { defined(env('WCECOMPAT'))
+                              ? '$(WCECOMPAT)/include' : (); },
+                        sub { defined(env('PORTSDK_LIBPATH'))
+                                  ? '$(PORTSDK_LIBPATH)/../../include'
+                                  : (); })),
+        lflags           => add(combine(sub { vc_wince_info()->{lflags}; },
+                                        sub { defined(env('PORTSDK_LIBPATH'))
+                                                  ? "/entry:mainCRTstartup" : (); })),
+        sys_id           => "WINCE",
+        bn_ops           => add("BN_LLONG"),
+        ex_libs          => add(sub {
+            my @ex_libs = ();
+            push @ex_libs, 'ws2.lib' unless $disabled{sock};
+            push @ex_libs, 'crypt32.lib';
+            if (defined(env('WCECOMPAT'))) {
+                my $x = '$(WCECOMPAT)/lib';
+                if (-f "$x/env('TARGETCPU')/wcecompatex.lib") {
+                    $x .= '/$(TARGETCPU)/wcecompatex.lib';
+                } else {
+                    $x .= '/wcecompatex.lib';
+                }
+                push @ex_libs, $x;
+            }
+            push @ex_libs, '$(PORTSDK_LIBPATH)/portlib.lib'
+                if (defined(env('PORTSDK_LIBPATH')));
+            push @ex_libs, '/nodefaultlib coredll.lib corelibc.lib'
+                if (env('TARGETCPU') =~ /^X86|^ARMV4[IT]/);
+            return join(" ", @ex_libs);
+        }),
+    },
+
 #### MinGW
     "mingw-common" => {
         inherit_from     => [ 'BASE_unix' ],
@@ -1580,7 +1703,7 @@ my %targets = (
         cppflags         => combine("-DUNICODE -D_UNICODE -DWIN32_LEAN_AND_MEAN",
                                     threads("-D_MT")),
         lib_cppflags     => "-DL_ENDIAN",
-        ex_libs          => add("-lws2_32 -lgdi32 -lcrypt32 -lbcrypt"),
+        ex_libs          => add("-lws2_32 -lgdi32 -lcrypt32"),
         thread_scheme    => "winthreads",
         dso_scheme       => "win32",
         shared_target    => "mingw-shared",
@@ -1733,6 +1856,45 @@ my %targets = (
         shared_cflag     => "-fPIC",
         shared_extension => ".\$(SHLIB_VERSION_NUMBER).dylib",
     },
+    # Option "freeze" such as -std=gnu9x can't negatively interfere
+    # with future defaults for below two targets, because MacOS X
+    # for PPC has no future, it was discontinued by vendor in 2009.
+    "darwin8-ppc-cc" => {
+        inherit_from => [ "darwin-ppc" ],
+        disable => [ "async" ]
+    },
+    "darwin-ppc-cc" => { inherit_from => [ "darwin-ppc" ] }, # Historic alias
+    "darwin-ppc" => {
+        inherit_from     => [ "darwin-common" ],
+        cflags           => add("-arch ppc -std=gnu9x -Wa,-force_cpusubtype_ALL"),
+        lib_cppflags     => add("-DB_ENDIAN"),
+        shared_cflag     => add("-fno-common"),
+        asm_arch         => 'ppc32',
+        perlasm_scheme   => "osx32",
+    },
+    "darwin8-ppc64-cc" => {
+        inherit_from => [ "darwin64-ppc" ],
+        disable => [ "async" ]
+    },
+    "darwin64-ppc-cc" => { inherit_from => [ "darwin64-ppc" ] }, # Historic alias
+    "darwin64-ppc" => {
+        inherit_from     => [ "darwin-common" ],
+        cflags           => add("-arch ppc64 -std=gnu9x"),
+        lib_cppflags     => add("-DB_ENDIAN"),
+        bn_ops           => "SIXTY_FOUR_BIT_LONG RC4_CHAR",
+        asm_arch         => 'ppc64',
+        perlasm_scheme   => "osx64",
+    },
+    "darwin-i386-cc" => { inherit_from => [ "darwin-i386" ] }, # Historic alias
+    "darwin-i386" => {
+        inherit_from     => [ "darwin-common" ],
+        CFLAGS           => add(picker(release => "-fomit-frame-pointer")),
+        cflags           => add("-arch i386"),
+        lib_cppflags     => add("-DL_ENDIAN"),
+        bn_ops           => "BN_LLONG RC4_INT",
+        asm_arch         => 'x86',
+        perlasm_scheme   => "macosx",
+    },
     "darwin64-x86_64-cc" => { inherit_from => [ "darwin64-x86_64" ] }, # Historic alias
     "darwin64-x86_64" => {
         inherit_from     => [ "darwin-common" ],
@@ -1850,7 +2012,8 @@ my %targets = (
                               ? "/WARNINGS=DISABLE=(".join(",",@warnings).")" : (); }),
         cflag_incfirst   => '/FIRST_INCLUDE=',
         lib_defines      =>
-            add("_XOPEN_SOURCE", "_XOPEN_SOURCE_EXTENDED=1",
+            add("OPENSSL_USE_NODELETE",
+                "_XOPEN_SOURCE", "_XOPEN_SOURCE_EXTENDED=1",
                 sub {
                     return vms_info()->{def_zlib}
                         ? "LIBZ=\"\"\"".vms_info()->{def_zlib}."\"\"\"" : ();

Configurations/50-nonstop.conf

@@ -22,6 +22,7 @@
         ex_libs          => add('-lrld'),
         enable           => ['egd'],
 	# Not currently inherited
+        disable          => ['atexit'],
         dso_scheme       => 'DLFCN',
         sys_id           => 'TANDEM',
     },
@@ -190,7 +191,7 @@
                               'nonstop-archenv-x86_64-oss',
                               'nonstop-ilp32',
                               'nonstop-efloat-x86_64' ],
-        disable          => ['threads'],
+        disable          => ['threads','atexit'],
     },
     'nonstop-nsx_put' => {
         inherit_from     => [ 'nonstop-common',
@@ -200,6 +201,7 @@
                               'nonstop-model-put' ],
         multilib         => '-put',
         multibin         => '-put',
+        disable          => ['atexit'],
     },
     'nonstop-nsx_64' => {
         inherit_from     => [ 'nonstop-common',
@@ -208,7 +210,7 @@
                               'nonstop-efloat-x86_64' ],
         multilib         => '64',
         multibin         => '64',
-        disable          => ['threads'],
+        disable          => ['threads','atexit'],
     },
     'nonstop-nsx_64_put' => {
         inherit_from     => [ 'nonstop-common',
@@ -218,6 +220,7 @@
                               'nonstop-model-put' ],
         multilib         => '64-put',
         multibin         => '64-put',
+        disable          => ['atexit'],
     },
     'nonstop-nsx_64_klt' => {
         inherit_from     => [ 'nonstop-common',
@@ -227,18 +230,19 @@
                               'nonstop-model-klt' ],
         multilib         => '64-klt',
         multibin         => '64-klt',
+        disable          => ['atexit'],
     },
     'nonstop-nsx_g' => {
         inherit_from     => [ 'nonstop-common',
                               'nonstop-archenv-x86_64-guardian',
                               'nonstop-ilp32', 'nonstop-nfloat-x86_64' ],
-        disable          => ['threads'],
+        disable          => ['threads','atexit'],
     },
     'nonstop-nsx_g_tandem' => {
         inherit_from     => [ 'nonstop-common',
                               'nonstop-archenv-x86_64-guardian',
                               'nonstop-ilp32', 'nonstop-tfloat-x86_64' ],
-        disable          => ['threads'],
+        disable          => ['threads','atexit'],
     },
     'nonstop-nsv' => {
         inherit_from     => [ 'nonstop-nsx' ],
@@ -248,7 +252,7 @@
                               'nonstop-archenv-itanium-oss',
                               'nonstop-ilp32',
                               'nonstop-efloat-itanium' ],
-        disable          => ['threads'],
+        disable          => ['threads','atexit'],
     },
     'nonstop-nse_put' => {
         inherit_from     => [ 'nonstop-common',
@@ -258,6 +262,7 @@
                               'nonstop-model-put' ],
         multilib         => '-put',
         multibin         => '-put',
+        disable          => ['atexit'],
     },
     'nonstop-nse_64' => {
         inherit_from     => [ 'nonstop-common',
@@ -266,7 +271,7 @@
                               'nonstop-efloat-itanium' ],
         multilib         => '64',
         multibin         => '64',
-        disable          => ['threads'],
+        disable          => ['threads','atexit'],
     },
     'nonstop-nse_64_put' => {
         inherit_from     => [ 'nonstop-common',
@@ -276,4 +281,5 @@
                               'nonstop-model-put' ],
         multilib         => '64-put',
         multibin         => '64-put',
+        disable          => ['atexit'],
     },

Configurations/README.md

@@ -502,7 +502,7 @@ The build-file template is processed with the perl module
 Text::Template, using `{-` and `-}` as delimiters that enclose the
 perl code fragments that generate configuration-dependent content.
 Those perl fragments have access to all the hash variables from
-configdata.pm.
+configdata.pem.
 
 The build-file template is expected to define at least the following
 perl functions in a perl code fragment enclosed with `{-` and `-}`.

Configurations/unix-Makefile.tmpl

@@ -11,7 +11,6 @@
      our $makedepcmd = platform->makedepcmd();
 
      sub windowsdll { $config{target} =~ /^(?:Cygwin|mingw)/ }
-     sub run_on_windows { $^O =~ /^(?:cygwin|msys|MSWin32)/ }
 
      # Shared AIX support is special. We put libcrypto[64].so.ver into
      # libcrypto.a and use libcrypto_a.a as static one, unless using
@@ -73,7 +72,6 @@ OPTIONS={- $config{options} -}
 CONFIGURE_ARGS=({- join(", ",quotify_l(@{$config{perlargv}})) -})
 SRCDIR={- $config{sourcedir} -}
 BLDDIR={- $config{builddir} -}
-RESULT_D=$(BLDDIR)/test-runs
 FIPSKEY={- $config{FIPSKEY} -}
 
 VERSION={- "$config{full_version}" -}
@@ -504,9 +502,6 @@ BIN_LDFLAGS={- join(' ', $target{bin_lflags} || (),
                          '$(CNF_LDFLAGS)', '$(LDFLAGS)') -}
 BIN_EX_LIBS=$(CNF_EX_LIBS) $(EX_LIBS)
 
-CMOCKA_LIBS={- $config{cmocka_libs} // '' -}
-DETOURS_LIBS={- $config{detours_libs} // '' -}
-
 # CPPFLAGS_Q is used for one thing only: to build up buildinf.h
 CPPFLAGS_Q={- $cppflags1 =~ s|([\\"])|\\$1|g;
               $cppflags2 =~ s|([\\"])|\\$1|g;
@@ -604,12 +599,6 @@ list-tests: ## List available tests that can be invoked via "make test TESTS=<na
 
 ##@ Workspace cleaning
 
-cov-clean: ## Remove all coverage data files
-	-find . \( -name '*.gcda' -o -name '*.gcno' \) \! -type d | xargs $(RM)
-
-cov-reset: ## Remove runtime coverage counters
-	-find . -name '*.gcda' \! -type d | xargs $(RM)
-
 libclean:
 	@set -e; for s in $(SHLIB_INFO); do \
 		if [ "$$s" = ";" ]; then continue; fi; \
@@ -644,32 +633,15 @@ clean: libclean ## Clean the workspace, keep the configuration
 	$(RM) $(MANDOCS7)
 	$(RM) $(PROGRAMS) $(TESTPROGS) $(MODULES) $(FIPSMODULE) $(SCRIPTS)
 	$(RM) $(GENERATED_MANDATORY) $(GENERATED)
+	-find . -name '*{- platform->depext() -}' \! -name '.*' \! -type d -exec $(RM) {} \;
+	-find . -name '*{- platform->objext() -}' \! -name '.*' \! -type d -exec $(RM) {} \;
 	$(RM) core
 	$(RM) tags TAGS doc-nits md-nits
-	$(RM) -r $(RESULT_D)
+	$(RM) -r test/test-runs
 	$(RM) providers/fips*.new
-	# Remove the generated dependency files, object files, and symlinks
-	# in a single pass, avoid descending into submodules.
-	-find . \( -path './cloudflare-quiche' \
-	           -o -path './fuzz/corpora' \
-	           -o -path './gost-engine' \
-	           -o -path './krb5' \
-	           -o -path './oqs-provider' \
-	           -o -path './pkcs11-provider' \
-	           -o -path './pyca-cryptography' \
-	           -o -path './python-ecdsa' \
-	           -o -path './tlsfuzzer' \
-	           -o -path './tlslite-ng' \
-	           -o -path './wycheproof' \) \
-	        -prune \
-	        -o \! -type d \
-	           \( -name '*{- platform->depext() -}' \
-	              -o -name '*{- platform->objext() -}' \
-	              -o -type l \) \
-	           \! -name '.*' \
-	           -exec $(RM) '{}' +
+	-find . -type l \! -name '.*' \! -wholename './pkcs11-provider/*' -exec $(RM) {} \;
 
-distclean: clean cov-clean ## Clean and remove the configuration
+distclean: clean ## Clean and remove the configuration
 	$(RM) include/openssl/configuration.h
 	$(RM) configdata.pm
 	$(RM) Makefile
@@ -907,7 +879,6 @@ uninstall_dev: uninstall_runtime_libs
 	done
 	-$(RMDIR) "$(DESTDIR)$(PKGCONFIGDIR)"
 	-$(RMDIR) "$(DESTDIR)$(CMAKECONFIGDIR)"
-	-$(RMDIR) "$(DESTDIR)$(libdir)/cmake"
 	-$(RMDIR) "$(DESTDIR)$(libdir)"
 
 _install_modules_deps: install_runtime_libs build_modules
@@ -1209,18 +1180,10 @@ lint: ## Evaluate C code via "splint"
            echo splint -DLINT -posixlib -preproc -D__gnuc_va_list=void \
 	   -I. -Iinclude -Iapps/include $(CRYPTOHEADERS) $(SSLHEADERS) $(SRCS) )
 
-CLANG_FORMAT_DIFF = clang-format-diff
-
-.PHONY: check-format check-clang-format-diff-cmd
-check-clang-format-diff-cmd:
-	@if ! command -v "$(CLANG_FORMAT_DIFF)" >/dev/null; then \
-		echo "Unable to find ${CLANG_FORMAT_DIFF}";\
-		echo "Please set the CLANG_FORMAT_DIFF variable to your clang-format-diff command";\
-		exit 1;\
-	fi
-
-check-format: check-clang-format-diff-cmd ## Evaluate C code according to OpenSSL coding standards
-	( cd $(SRCDIR); git diff -U0 --no-prefix --no-color | $(CLANG_FORMAT_DIFF) )
+.PHONY: check-format
+check-format: ## Evaluate C code according to OpenSSL coding standards
+	( cd $(SRCDIR); $(PERL) util/check-format.pl \
+			$(SRCS) \$(CRYPTOHEADERS) $(SSLHEADERS) )
 
 generate_apps:
 	( cd $(SRCDIR); $(PERL) VMS/VMSify-conf.pl \
@@ -1317,14 +1280,11 @@ providers/fips.module.sources.new: configdata.pm
 	  for x in crypto/bn/asm/*.pl crypto/bn/asm/*.S \
 		   crypto/aes/asm/*.pl crypto/aes/asm/*.S \
 		   crypto/ec/asm/*.pl \
-		   crypto/ml_dsa/asm/*.pl \
-		   crypto/ml_kem/asm/*.pl \
 		   crypto/modes/asm/*.pl \
 		   crypto/sha/asm/*.pl \
-		   crypto/slh_dsa/asm/*.pl \
 		   crypto/*cpuid.pl crypto/*cpuid.S \
 		   crypto/*cap.c; do \
-	    test -e "$$x" && echo "$$x"; \
+	    echo "$$x"; \
 	  done \
 	) | grep -v sm2p256 | sort | uniq > providers/fips.module.sources.new
 	rm -rf sources-tmp
@@ -1347,8 +1307,7 @@ errors:
            include/openssl/dtls1.h
            include/openssl/srtp.h
            include/openssl/quic.h
-           include/openssl/sslerr_legacy.h
-           include/openssl/ech.h);
+           include/openssl/sslerr_legacy.h );
    my @cryptoheaders_tmpl =
        qw( include/internal/dso.h
            include/internal/o_dir.h
@@ -1583,24 +1542,12 @@ EOF
           my $section = $1;
           my $name = uc basename($args{src}, ".$section");
           my $pod = $gen0;
-
-          if ($config{manpage_format} eq "mdoc") {
-              return <<"EOF";
-$args{src}: $pod
-	pod2mdoc -n $name -s $section\$(MANSUFFIX) \\
-		 -d \$(RELEASE_DATE) \\
-		 $pod >\$\@
-EOF
-          } elsif ($config{manpage_format} eq "roff") {
-              return <<"EOF";
+          return <<"EOF";
 $args{src}: $pod
 	pod2man --name=$name --section=$section\$(MANSUFFIX) --center=OpenSSL \\
 		--date=\$(RELEASE_DATE) --release=\$(VERSION) \\
 		$pod >\$\@
 EOF
-          } else {
-              die "Unhandled manpage format: $config{manpage_format}";
-          }
       } elsif (platform->isdef($args{src})) {
           #
           # Linker script-ish generator
@@ -1911,27 +1858,13 @@ $import: $full
 EOF
           }
       }
-      if (!run_on_windows()) {
-          $recipe .= <<"EOF";
+      $recipe .= <<"EOF";
 $full: $fulldeps
 	\$(CC) \$(LIB_CFLAGS) $linkflags\$(LIB_LDFLAGS)$shared_soname$shared_imp \\
 		-o $full$shared_def \\
 		$fullobjs \\
 		$linklibs \$(LIB_EX_LIBS)
 EOF
-      } else {
-          $recipe .= <<"EOF";
-$full: $fulldeps
-	\$(file >\$@.lst, \\
-		$fullobjs \\
-	)
-	\$(CC) \$(LIB_CFLAGS) $linkflags\$(LIB_LDFLAGS)$shared_soname$shared_imp \\
-		-o $full$shared_def \\
-		@\$@.lst \\
-		$linklibs \$(LIB_EX_LIBS)
-	rm -f \$@.lst
-EOF
-      }
       if (windowsdll()) {
           $recipe .= <<"EOF";
 	rm -f apps/$full
@@ -2036,15 +1969,6 @@ EOF
               push @linkdirs, $d unless grep { $d eq $_ } @linkdirs;
           }
       }
-      my $wrapflags = '';
-      if (defined $unified_info{wraps}->{$args{bin}}) {
-          $wrapflags = ' ' . join(' ',
-                                  map { "-Wl,--wrap=$_" }
-                                  @{$unified_info{wraps}->{$args{bin}}});
-      }
-      my $utlibs = $unified_info{unit_test_libs}->{$args{bin}};
-      $utlibs = $utlibs ne '' ? ' ' . $utlibs : '' if defined $utlibs;
-      $utlibs //= '';
       my $linkflags = join("", map { $_." " } @linkdirs);
       my $linklibs = join("", map { $_." " } @linklibs);
       my $cmd = '$(CC)';
@@ -2062,10 +1986,10 @@ EOF
       return <<"EOF";
 $bin: $deps
 	rm -f $bin
-	\$\${LDCMD:-$cmd} $cmdflags $linkflags\$(BIN_LDFLAGS)$wrapflags \\
+	\$\${LDCMD:-$cmd} $cmdflags $linkflags\$(BIN_LDFLAGS) \\
 		-o $bin \\
 		$objs \\
-		$linklibs\$(BIN_EX_LIBS)$utlibs
+		$linklibs\$(BIN_EX_LIBS)
 EOF
   }
   sub in2script {

Configurations/windows-makefile.tmpl

@@ -38,7 +38,6 @@
 PLATFORM={- $config{target} -}
 SRCDIR={- $config{sourcedir} -}
 BLDDIR={- $config{builddir} -}
-RESULT_D=$(BLDDIR)\test-runs
 FIPSKEY={- $config{FIPSKEY} -}
 
 VERSION={- "$config{full_version}" -}
@@ -209,7 +208,7 @@ OPENSSLDIR_dir={- canonpath($openssldir_dir) -}
 LIBDIR={- our $libdir = $config{libdir} || "lib";
           file_name_is_absolute($libdir) ? "" : $libdir -}
 MODULESDIR_dev={- use File::Spec::Functions qw(:DEFAULT splitpath catpath);
-                  our $modulesprefix = file_name_is_absolute($libdir) ? $libdir : catdir($prefix,$libdir);
+                  our $modulesprefix = catdir($prefix,$libdir);
                   our ($modulesprefix_dev, $modulesprefix_dir,
                        $modulesprefix_file) =
                       splitpath($modulesprefix, 1);
@@ -380,9 +379,6 @@ BIN_LDFLAGS={- join(' ', $target{bin_lflags} || (),
                          '$(CNF_LDFLAGS)', '$(LDFLAGS)') -}
 BIN_EX_LIBS=$(CNF_EX_LIBS) $(EX_LIBS)
 
-CMOCKA_LIBS={- $config{cmocka_libs} // '' -}
-DETOURS_LIBS={- $config{detours_libs} // '' -}
-
 # CPPFLAGS_Q is used for one thing only: to build up buildinf.h
 CPPFLAGS_Q={- $cppflags1 =~ s|([\\"])|\\$1|g;
               $cppflags2 =~ s|([\\"])|\\$1|g;
@@ -453,22 +449,22 @@ uninstall: {- "uninstall_docs" if !$disabled{docs}; -} uninstall_sw {- $disabled
 
 libclean:
 	"$(PERL)" -e "map { m/(.*)\.dll$$/; unlink glob """{.,apps,test,fuzz}/$$1.*"""; } @ARGV" $(SHLIBS)
-	-del /Q /F $(LIBS) libcrypto.* libssl.*
+	-del /Q /F $(LIBS) libcrypto.* libssl.* ossl_static.pdb
 
 clean: libclean
-	{- join("\n\t", map { "-if exist $_ del /Q /F $_" } @HTMLDOCS1) || "\@rem" -}
-	{- join("\n\t", map { "-if exist $_ del /Q /F $_" } @HTMLDOCS3) || "\@rem" -}
-	{- join("\n\t", map { "-if exist $_ del /Q /F $_" } @HTMLDOCS5) || "\@rem" -}
-	{- join("\n\t", map { "-if exist $_ del /Q /F $_" } @HTMLDOCS7) || "\@rem" -}
-	{- join("\n\t", map { "-if exist $_ del /Q /F $_" } @PROGRAMS) || "\@rem" -}
-	{- join("\n\t", map { "-if exist $_ del /Q /F $_" } @MODULES) || "\@rem" -}
-	{- join("\n\t", map { "-if exist $_ del /Q /F $_" } @SCRIPTS) || "\@rem" -}
-	{- join("\n\t", map { "-if exist $_ del /Q /F $_" } @GENERATED_MANDATORY) || "\@rem" -}
-	{- join("\n\t", map { "-if exist $_ del /Q /F $_" } @GENERATED) || "\@rem" -}
+	{- join("\n\t", map { "-del /Q /F $_" } @HTMLDOCS1) || "\@rem" -}
+	{- join("\n\t", map { "-del /Q /F $_" } @HTMLDOCS3) || "\@rem" -}
+	{- join("\n\t", map { "-del /Q /F $_" } @HTMLDOCS5) || "\@rem" -}
+	{- join("\n\t", map { "-del /Q /F $_" } @HTMLDOCS7) || "\@rem" -}
+	{- join("\n\t", map { "-del /Q /F $_" } @PROGRAMS) || "\@rem" -}
+	{- join("\n\t", map { "-del /Q /F $_" } @MODULES) || "\@rem" -}
+	{- join("\n\t", map { "-del /Q /F $_" } @SCRIPTS) || "\@rem" -}
+	{- join("\n\t", map { "-del /Q /F $_" } @GENERATED_MANDATORY) || "\@rem" -}
+	{- join("\n\t", map { "-del /Q /F $_" } @GENERATED) || "\@rem" -}
 	-del /Q /S /F *.d *.obj *.pdb *.ilk *.manifest
 	-del /Q /S /F apps\*.lib apps\*.rc apps\*.res apps\*.exp
 	-del /Q /S /F test\*.exp
-	-@if exist "$(RESULT_D)" rd /Q /S "$(RESULT_D)"
+	-rd /Q /S test\test-runs
 
 distclean: clean
 	-del /Q /F include\openssl\configuration.h
@@ -548,6 +544,8 @@ install_dev: install_runtime_libs
 				       "$(INSTALLTOP)\include\openssl"
 	@"$(PERL)" "$(SRCDIR)\util\mkdir-p.pl" "$(libdir)"
 	@"$(PERL)" "$(SRCDIR)\util\copy.pl" $(INSTALL_LIBS) "$(libdir)"
+	@if "$(SHLIBS)"=="" \
+	 "$(PERL)" "$(SRCDIR)\util\copy.pl" ossl_static.pdb "$(libdir)"
 	@"$(PERL)" "$(SRCDIR)\util\mkdir-p.pl" "$(CMAKECONFIGDIR)"
 	@"$(PERL)" "$(SRCDIR)\util\copy.pl" $(INSTALL_EXPORTERS_CMAKE) "$(CMAKECONFIGDIR)"
 
@@ -586,10 +584,10 @@ install_programs: install_runtime_libs build_inst_programs
 	@if not "$(INSTALL_PROGRAMS)"=="" \
 	 "$(PERL)" "$(SRCDIR)\util\copy.pl" $(INSTALL_PROGRAMS) \
                                         "$(INSTALLTOP)\bin"
-	@if not "$(INSTALL_PROGRAMPDBS)"=="" \
+	@if not "$(INSTALL_PROGRAMS)"=="" \
 	 "$(PERL)" "$(SRCDIR)\util\copy.pl" $(INSTALL_PROGRAMPDBS) \
                                         "$(INSTALLTOP)\bin"
-	@if not "$(BIN_SCRIPTS)"=="" \
+	@if not "$(INSTALL_PROGRAMS)"=="" \
 	 "$(PERL)" "$(SRCDIR)\util\copy.pl" $(BIN_SCRIPTS) \
                                         "$(INSTALLTOP)\bin"
 
@@ -1004,14 +1002,11 @@ EOF
      my $ress = join($target{ld_resp_delim}, @ress);
      my $linklibs = join("", map { "$_$target{ld_resp_delim}" } @deps);
      my $deps = join(" ", @objs, @ress, @deps);
-     my $utlibs = $unified_info{unit_test_libs}->{$args{bin}};
-     $utlibs = (defined $utlibs && $utlibs ne '')
-               ? "$utlibs$target{ld_resp_delim}" : '';
      return <<"EOF";
 $bin: $deps
 	IF EXIST $bin.manifest DEL /F /Q $bin.manifest
 	\$(LD) \$(LDFLAGS) \$(BIN_LDFLAGS) @<<
-$objs$target{ld_resp_delim}\$(LDOUTFLAG)$bin$target{ldpostoutflag}$target{ld_resp_delim}$utlibs$linklibs\$(BIN_EX_LIBS)$target{ldresflag}$target{ldresflag}$ress
+$objs$target{ld_resp_delim}\$(LDOUTFLAG)$bin$target{ldpostoutflag}$target{ld_resp_delim}$linklibs\$(BIN_EX_LIBS)$target{ldresflag}$target{ldresflag}$ress
 <<
 	IF EXIST $bin.manifest \\
 	   \$(MT) \$(MTFLAGS) \$(MTINFLAG)$bin.manifest \$(MTOUTFLAG)$bin

Configure

@@ -1,6 +1,6 @@
 #! /usr/bin/env perl
 # -*- mode: perl; -*-
-# Copyright 2016-2026 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2016-2025 The OpenSSL Project Authors. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
@@ -27,7 +27,7 @@ use OpenSSL::config;
 my $orig_death_handler = $SIG{__DIE__};
 $SIG{__DIE__} = \&death_handler;
 
-my $usage="Usage: Configure [no-<feature> ...] [enable-<feature> ...] [-Dxxx] [-lxxx] [-Lxxx] [-fxxx] [-Kxxx] [no-hw-xxx|no-hw] [[no-]threads] [[no-]thread-pool] [[no-]default-thread-pool] [[no-]shared] [[no-]zlib|zlib-dynamic] [no-asm] [no-egd] [sctp] [386] [--prefix=DIR] [--openssldir=OPENSSLDIR] [--with-xxx[=vvv]] [--config=FILE] [--manpage-format={roff,mdoc}] [--help] os/compiler[:flags]\n";
+my $usage="Usage: Configure [no-<feature> ...] [enable-<feature> ...] [-Dxxx] [-lxxx] [-Lxxx] [-fxxx] [-Kxxx] [no-hw-xxx|no-hw] [[no-]threads] [[no-]thread-pool] [[no-]default-thread-pool] [[no-]shared] [[no-]zlib|zlib-dynamic] [no-asm] [no-egd] [sctp] [386] [--prefix=DIR] [--openssldir=OPENSSLDIR] [--with-xxx[=vvv]] [--config=FILE] [--help] os/compiler[:flags]\n";
 
 my $banner = <<"EOF";
 
@@ -171,17 +171,16 @@ my @gcc_devteam_warn = qw(
     -Wextra
     -Wno-unused-parameter
     -Wno-missing-field-initializers
+    -Wno-unterminated-string-initialization
     -Wswitch
     -Wsign-compare
     -Wshadow
     -Wformat
-    -Wtype-limits
+    -Wno-type-limits
     -Wundef
     -Werror
     -Wmissing-prototypes
     -Wstrict-prototypes
-    -Wpointer-arith
-    -Wfloat-conversion
 );
 
 # These are used in addition to $gcc_devteam_warn when the compiler is clang.
@@ -222,9 +221,16 @@ our $BSDthreads="-pthread -D_THREAD_SAFE -D_REENTRANT";
 #
 # API compatibility name to version number mapping.
 #
-
-# This table expresses when API additions or changes can occur
 my $apitable = {
+    # This table expresses when API additions or changes can occur.
+    # The numbering used changes from 3.0 and on because we updated
+    # (solidified) our version numbering scheme at that point.
+
+    # From 3.0 and on, we internalise the given version number in decimal
+    # as MAJOR * 10000 + MINOR * 100 + 0
+    "3.0.0" => 30000,
+    "3.0"   => 30000,
+
     # Note that before 3.0, we didn't have the same version number scheme.
     # Still, the numbering we use here covers what we need.
     "1.1.1" => 10101,
@@ -235,19 +241,6 @@ my $apitable = {
     "0.9.8" =>   908,
 };
 
-# From 3.0 and on, we internalise the given version number in decimal
-# as MAJOR * 10000 + MINOR * 100 + 0
-my @post30_versions = ([3, 0], [3, 1], [3, 2], [3, 3], [3, 4], [3, 5], [3, 6],
-                       [4, 0], [4, 1],
-                       );
-
-# The numbering used changes from 3.0 and on because we updated
-# (solidified) our version numbering scheme at that point.
-foreach (@post30_versions) {
-    my ($x, $y) = @{$_};
-    $apitable->{"$x.$y.0"} = $apitable->{"$x.$y"} = $x * 10000 + $y * 100;
-}
-
 # For OpenSSL::config::get_platform
 my %guess_opts = ();
 
@@ -295,7 +288,6 @@ my $dofile = abs2rel(catfile($srcdir, "util/dofile.pl"));
 
 my $local_config_envname = 'OPENSSL_LOCAL_CONFIG_DIR';
 
-$config{manpage_format} = "roff";
 $config{sourcedir} = abs2rel($srcdir, $blddir);
 $config{builddir} = abs2rel($blddir, $blddir);
 # echo -n 'holy hand grenade of antioch' | openssl sha256
@@ -421,120 +413,61 @@ my $auto_threads=1;    # enable threads automatically? true by default
 my $default_ranlib;
 
 # Known TLS and DTLS protocols
-my @tls = qw(tls1 tls1_1 tls1_2 tls1_3);
+my @tls = qw(ssl3 tls1 tls1_1 tls1_2 tls1_3);
 my @dtls = qw(dtls1 dtls1_2);
 
 # Explicitly known options that are possible to disable.  They can
 # be regexps, and will be used like this: /^no-${option}$/
 # For developers: keep it sorted alphabetically
 
-my @disablables_protocols = (
-  "cmp",
-  "dtls",
-  "http",
-  "ocsp",
-  "ktls",
-  "tls",
-  "tls-deprecated-ec",
-  "quic",
-  "sctp",
-  "srp",
-  "srtp"
-);
-
-foreach my $proto ((@tls, @dtls))
-        {
-        push(@disablables_protocols, $proto);
-        push(@disablables_protocols, "$proto-method") unless $proto eq "tls1_3";
-        }
-
-my @disablables_algorithms = (
-    "argon2",
-    "aria",
-    "bf",
-    "blake2",
-    "brotli",
-    "camellia",
-    "cast",
-    "chacha",
-    "cmac",
-    "cms",
-    "comp",
-    "des",
-    "dh",
-    "dsa",
-    "hmac-drbg-kdf",
-    "ec",
-    "ec2m",
-    "ecx",
-    "kbkdf",
-    "krb5kdf",
-    "gost",
-    "idea",
-    "ikev2kdf",
-    "md2",
-    "md4",
-    "md5",
-    "mdc2",
-    "ml-dsa",
-    "ml-kem",
-    "lms",
-    "ocb",
-    "poly1305",
-    "psk",
-    "pvkkdf",
-    "rc2",
-    "rc4",
-    "rc5",
-    "rmd160",
-    "scrypt",
-    "seed",
-    "siphash",
-    "slh-dsa",
-    "siv",
-    "snmpkdf",
-    "sm2",
-    "sm3",
-    "sm4",
-    "srtpkdf",
-    "sshkdf",
-    "sskdf",
-    "x942kdf",
-    "x963kdf",
-    "whirlpool",
-    "zlib",
-    "zstd",
-);
-
-my @disablables_features = (
+my @disablables = (
     "acvp-tests",
     "apps",
+    "argon2",
+    "aria",
     "asan",
     "asm",
     "async",
+    "atexit",
     "autoalginit",
     "autoerrinit",
     "autoload-config",
+    "bf",
+    "blake2",
+    "brotli",
     "brotli-dynamic",
     "buildtest-c++",
     "bulk",
     "cached-fetch",
-    "dgram",
+    "camellia",
     "winstore",
+    "cast",
+    "chacha",
+    "cmac",
+    "cmp",
+    "cms",
+    "comp",
     "crypto-mdebug",
     "allocfail-tests",
     "ct",
-    "ct-validation",
     "default-thread-pool",
     "demos",
     "h3demo",
     "hqinterop",
     "deprecated",
+    "des",
+    "dgram",
+    "dh",
     "docs",
+    "dsa",
     "dso",
-    "ech",
-    "ec_explicit_curves",
+    "dtls",
+    "ec",
+    "ec2m",
     "ec_nistp_64_gcc_128",
+    "ecdh",
+    "ecdsa",
+    "ecx",
     "egd",
     "err",
     "external-tests",
@@ -545,48 +478,84 @@ my @disablables_features = (
     "fips-jitter",
     "fuzz-afl",
     "fuzz-libfuzzer",
+    "gost",
+    "http",
+    "idea",
     "integrity-only-ciphers",
     "jitter",
+    "ktls",
     "legacy",
+    "lms",
     "makedepend",
+    "md2",
+    "md4",
+    "mdc2",
+    "ml-dsa",
+    "ml-kem",
     "module",
     "msan",
     "multiblock",
     "nextprotoneg",
+    "ocb",
+    "ocsp",
     "pic",
     "pie",
     "pinshared",
+    "poly1305",
     "posix-io",
+    "psk",
+    "quic",
     "unstable-qlog",
+    "rc2",
+    "rc4",
+    "rc5",
     "rdrand",
     "rfc3779",
+    "rmd160",
+    "scrypt",
+    "sctp",
     "secure-memory",
+    "seed",
     "shared",
+    "siphash",
+    "siv",
+    "slh-dsa",
+    "sm2",
     "sm2-precomp",
+    "sm3",
+    "sm4",
     "sock",
+    "srp",
+    "srtp",
     "sse2",
+    "ssl",
     "ssl-trace",
-    "static-vcruntime",
     "stdio",
     "sslkeylog",
     "tests",
     "tfo",
     "thread-pool",
     "threads",
+    "tls",
+    "tls-deprecated-ec",
     "trace",
     "ts",
     "ubsan",
     "ui-console",
     "unit-test",
-    "unit-tests",
     "uplink",
     "weak-ssl-ciphers",
+    "whirlpool",
+    "zlib",
     "zlib-dynamic",
+    "zstd",
     "zstd-dynamic",
-
-);
-
-my @disablables = sort (@disablables_protocols,@disablables_algorithms,@disablables_features);
+    );
+foreach my $proto ((@tls, @dtls))
+        {
+        push(@disablables, $proto);
+        push(@disablables, "$proto-method") unless $proto eq "tls1_3";
+        }
 
 # Internal disablables, for aliasing purposes.  They serve no special
 # purpose here, but allow scripts to get to know them through configdata.pm,
@@ -597,7 +566,6 @@ my @disablables_int = qw(
     );
 
 my %deprecated_disablables = (
-    "atexit" => undef,
     "engine" => undef,
     "static-engine" => undef,
     "dynamic-engine" => undef,
@@ -608,20 +576,17 @@ my %deprecated_disablables = (
     "padlockeng" => undef,
     "ssl2" => undef,
     "buf-freelists" => undef,
+    "crypto-mdebug-backtrace" => undef,
     "hw" => undef,
     "hw-padlock" => undef,
     "ripemd" => "rmd160",
     "ui" => "ui-console",
     "heartbeats" => undef,
-    "ssl" => undef,
-    "ssl3" => undef,
-    "ssl3-method" => undef,
     );
 
 # All of the following are disabled by default:
 
 our %disabled = ( # "what"         => "comment"
-                  "atexit"              => "default",
                   "fips"                => "default",
                   "fips-jitter"         => "default",
                   "asan"                => "default",
@@ -630,11 +595,10 @@ our %disabled = ( # "what"         => "comment"
                   "buildtest-c++"       => "default",
                   "crypto-mdebug"       => "default",
                   "allocfail-tests"     => "default",
-                  "ct-validation"       => "default",
+                  "crypto-mdebug-backtrace" => "default",
                   "demos"               => "default",
                   "h3demo"              => "default",
                   "hqinterop"           => "default",
-                  "ec_explicit_curves" => "default",
                   "ec_nistp_64_gcc_128" => "default",
                   "egd"                 => "default",
                   "engine"              => "default",
@@ -649,14 +613,13 @@ our %disabled = ( # "what"         => "comment"
                   "msan"                => "default",
                   "rc5"                 => "default",
                   "sctp"                => "default",
+                  "ssl3"                => "default",
+                  "ssl3-method"         => "default",
                   "sslkeylog"           => "default",
-                  "static-vcruntime"    => "default",
                   "tfo"                 => "default",
-                  "tls-deprecated-ec"   => "default",
                   "trace"               => "default",
                   "ubsan"               => "default",
                   "unit-test"           => "default",
-                  "unit-tests"          => "default",
                   "weak-ssl-ciphers"    => "default",
                   "zlib"                => "default",
                   "zlib-dynamic"        => "default",
@@ -668,32 +631,32 @@ our %disabled = ( # "what"         => "comment"
 my @disable_cascades = (
     # "what"            => [ "cascade", ... ]
     "bulk"              => [ "shared", "dso",
-                             "argon2", "aria", "async", "autoload-config",
+                             "argon2", "aria", "async", "atexit", "autoload-config",
                              "blake2", "bf", "camellia", "cast", "chacha",
                              "cmac", "cms", "cmp", "comp", "ct",
                              "des", "dgram", "dh", "dsa",
-                             "ec", "ech",
-                             "filenames", "hmac-drbg-kdf",
-                             "idea", "ikev2kdf", "kbkdf", "krb5kdf", "ktls", "lms",
+                             "ec",
+                             "filenames",
+                             "idea", "ktls", "lms",
                              "md4", "ml-dsa", "ml-kem", "multiblock",
                              "nextprotoneg", "ocsp", "ocb", "poly1305", "psk",
-                             "pvkkdf", "rc2", "rc4", "rmd160",
+                             "rc2", "rc4", "rmd160",
                              "scrypt", "seed", "siphash", "siv",
-                             "slh-dsa", "sm3", "sm4", "snmpkdf",
-                             "srp", "srtp", "srtpkdf", "sshkdf", "sskdf",
-                             "ssl-trace",
+                             "slh-dsa", "sm3", "sm4", "srp",
+                             "srtp", "ssl3-method", "ssl-trace",
                              "tfo",
                              "ts", "ui-console", "whirlpool",
-                             "x942kdf", "x963kdf",
                              "fips-securitychecks" ],
     sub { $config{processor} eq "386" }
                         => [ "sse2" ],
+    "ssl"               => [ "ssl3" ],
+    "ssl3-method"       => [ "ssl3" ],
     "zlib"              => [ "zlib-dynamic" ],
     "brotli"            => [ "brotli-dynamic" ],
     "zstd"              => [ "zstd-dynamic" ],
     "des"               => [ "mdc2" ],
     "deprecated"        => [ "tls-deprecated-ec" ],
-    "ec"                => [ qw(ec2m ec_explicit_curves sm2 gost ecx tls-deprecated-ec) ],
+    "ec"                => [ qw(ec2m ecdsa ecdh sm2 gost ecx tls-deprecated-ec) ],
     "dgram"             => [ "dtls", "quic", "sctp" ],
     "sock"              => [ "dgram", "tfo" ],
     "dtls"              => [ @dtls ],
@@ -706,7 +669,7 @@ my @disable_cascades = (
     "tls1_3"            => [ "quic" ],
     "quic"              => [ "unstable-qlog" ],
 
-    "crypto-mdebug"     => [ "allocfail-tests" ],
+    "crypto-mdebug"     => [ "crypto-mdebug-backtrace", "allocfail-tests" ],
 
     "module"            => [ "fips" ],
 
@@ -726,7 +689,7 @@ my @disable_cascades = (
 
     "stdio"             => [ "apps", "egd" ],
     "apps"              => [ "tests" ],
-    "tests"             => [ "external-tests", "unit-tests" ],
+    "tests"             => [ "external-tests" ],
     "comp"              => [ "zlib", "brotli", "zstd" ],
     "sm3"               => [ "sm2" ],
     sub { !$disabled{"unit-test"} } => [ "heartbeats" ],
@@ -861,11 +824,6 @@ $config{ex_libs} = [ env('__CNF_LDLIBS') || () ];
 $config{openssl_api_defines}=[];
 $config{openssl_sys_defines}=[];
 $config{openssl_feature_defines}=[];
-
-$config{openssl_disabled_protocols}=[];
-$config{openssl_disabled_algorithms}=[];
-$config{openssl_disabled_features}=[];
-
 $config{options}="";
 $config{build_type} = "release";
 my $target="";
@@ -926,14 +884,6 @@ while (@argvcopy)
                         $unsupported_options{$_} = 1;
                         next;
                         }
-
-                # Do not allow users to enable removed features
-                if (/^enable-(.+)$/ && exists $deprecated_disablables{$word}
-                        && $deprecated_disablables{$word} eq undef)
-                        {
-                        $unsupported_options{$_} = 1;
-                        next;
-                        }
                 }
         if (/^no-(.+)$/ || /^disable-(.+)$/)
                 {
@@ -953,6 +903,11 @@ while (@argvcopy)
                                 }
                         $disabled{"dtls"} = "option(dtls)";
                         }
+                elsif ($1 eq "ssl")
+                        {
+                        # Last one of its kind
+                        $disabled{"ssl3"} = "option(ssl)";
+                        }
                 elsif ($1 eq "tls")
                         {
                         # XXX: Tests will fail if all SSL/TLS
@@ -1045,10 +1000,6 @@ while (@argvcopy)
                 {
                 $config{build_type} = "release";
                 }
-        elsif (/^--manpage-format=(mdoc|roff)$/)
-		{
-		$config{manpage_format}="$1";
-		}
         elsif (/^--pgo$/)
                 {
                 $config{build_type} = "pgo";
@@ -1122,22 +1073,6 @@ while (@argvcopy)
                         {
                         $withargs{fuzzer_include}=$1;
                         }
-                elsif (/^--with-cmocka-lib=(.*)$/)
-                        {
-                        $withargs{cmocka_lib}=$1;
-                        }
-                elsif (/^--with-cmocka-include=(.*)$/)
-                        {
-                        $withargs{cmocka_include}=$1;
-                        }
-                elsif (/^--with-detours-lib=(.*)$/)
-                        {
-                        $withargs{detours_lib}=$1;
-                        }
-                elsif (/^--with-detours-include=(.*)$/)
-                        {
-                        $withargs{detours_include}=$1;
-                        }
                 elsif (/^--with-rand-seed=(.*)$/)
                         {
                         foreach my $x (split(m|,|, $1))
@@ -1421,7 +1356,8 @@ at runtime in openssl.cnf or configured at build time with
 -DOPENSSL_DEFAULT_SEED_SRC.
 
 Please read the 'Note on random number generation' section in the
-INSTALL.md instructions for more details.
+INSTALL.md instructions and the RAND_DRBG(7) manual page for more
+details.
 ============================== WARNING ===============================
 
 _____
@@ -1650,12 +1586,12 @@ unless ($disabled{threads}) {
     }
 }
 
-# Find out if clang's sanitizers have been enabled with -fsanitize (or
-# /fsanitize for VC targets) flags and ensure that the corresponding %disabled
-# elements area removed to reflect that the sanitizers are indeed enabled.
+# Find out if clang's sanitizers have been enabled with -fsanitize
+# flags and ensure that the corresponding %disabled elements area
+# removed to reflect that the sanitizers are indeed enabled.
 my %detected_sanitizers = ();
-foreach (grep { /^[-\/]fsanitize=/ } @{$config{CFLAGS} || []}) {
-    (my $checks = $_) =~ s|^[-/]fsanitize=||;
+foreach (grep /^-fsanitize=/, @{$config{CFLAGS} || []}) {
+    (my $checks = $_) =~ s/^-fsanitize=//;
     foreach (split /,/, $checks) {
         my $d = { address       => 'asan',
                   undefined     => 'ubsan',
@@ -1690,17 +1626,11 @@ if (($target{shared_target} // '') eq "")
         }
 
 unless ($disabled{asan} || defined $detected_sanitizers{asan}) {
-    push @{$config{cflags}},
-        $config{target} =~ /^VC-/ ? "/fsanitize=address" : "-fsanitize=address";
+    push @{$config{cflags}}, "-fsanitize=address";
 }
 
-my %predefined_C = compiler_predefined($config{CROSS_COMPILE}.$config{CC});
-
 unless ($disabled{ubsan} || defined $detected_sanitizers{ubsan}) {
     push @{$config{cflags}}, "-fsanitize=undefined", "-fno-sanitize-recover=all", "-DPEDANTIC";
-    if ($predefined_C{__clang__}) {
-        push @{$config{cflags}}, "-fno-sanitize=function";
-    }
 }
 
 unless ($disabled{msan} || defined $detected_sanitizers{msan}) {
@@ -1709,50 +1639,8 @@ unless ($disabled{msan} || defined $detected_sanitizers{msan}) {
 
 unless ($disabled{"fuzz-libfuzzer"} && $disabled{"fuzz-afl"}
         && $disabled{asan} && $disabled{ubsan} && $disabled{msan}) {
-    unless ($config{target} =~ /^VC-/) {
-        push @{$config{cflags}}, "-fno-omit-frame-pointer", "-g";
-        push @{$config{cxxflags}}, "-fno-omit-frame-pointer", "-g" if $config{CXX};
-    }
-}
-
-# Valgrind-based constant-time validation: marks secret data as "undefined"
-# to Valgrind's memcheck tool, so that any control flow or memory indexing
-# that depends on secret data is flagged as an error.  Requires valgrind
-# headers at build time and running the tests under valgrind at test time.
-# Use |make TESTS="test_internal_ml_kem test_internal_ml_dsa" test| under
-# valgrind after building with this option.
-#
-# Package names for the required valgrind headers:
-#   Debian/Ubuntu  : valgrind          (headers bundled in the main package)
-#   Fedora/RHEL    : valgrind-devel
-#   Alpine         : valgrind-dev
-#   Arch Linux     : valgrind
-unless ($disabled{"ct-validation"}) {
-    # Probe for <valgrind/memcheck.h> so that we give a clear error here
-    # rather than a cryptic compile failure inside constant_time.h later.
-    my $cc = ($config{CROSS_COMPILE} // "").$config{CC};
-    my $probe_src = "ct_valgrind_probe_$$.c";
-    my $probe_obj = "ct_valgrind_probe_$$.o";
-    open(my $fh, ">", $probe_src)
-        or die "Cannot write probe file '$probe_src': $!";
-    print $fh "#include <valgrind/memcheck.h>\n";
-    close($fh);
-    my $probe_ok = (system("$cc -c -o $probe_obj $probe_src 2>/dev/null") == 0);
-    unlink($probe_src, $probe_obj);
-    if (!$probe_ok) {
-        die <<EOT;
-
-***** enable-ct-validation requires <valgrind/memcheck.h> at build time,
-***** but the header was not found by '$cc'.
-*****
-***** Install the appropriate package and re-run Configure:
-*****   Debian/Ubuntu : sudo apt-get install valgrind
-*****   Fedora/RHEL   : sudo dnf install valgrind-devel
-*****   Alpine        : sudo apk add valgrind-dev
-*****   Arch Linux    : sudo pacman -S valgrind
-EOT
-    }
-    push @{$config{openssl_feature_defines}}, "OPENSSL_CONSTANT_TIME_VALIDATION";
+    push @{$config{cflags}}, "-fno-omit-frame-pointer", "-g";
+    push @{$config{cxxflags}}, "-fno-omit-frame-pointer", "-g" if $config{CXX};
 }
 #
 # Platform fix-ups
@@ -1780,6 +1668,7 @@ if ($target{sys_id} ne "")
         push @{$config{openssl_sys_defines}}, "OPENSSL_SYS_$target{sys_id}";
         }
 
+my %predefined_C = compiler_predefined($config{CROSS_COMPILE}.$config{CC});
 my %predefined_CXX = $config{CXX}
     ? compiler_predefined($config{CROSS_COMPILE}.$config{CXX})
     : ();
@@ -1940,29 +1829,6 @@ unless ($disabled{winstore}) {
 
 push @{$config{openssl_other_defines}}, "OPENSSL_NO_KTLS" if ($disabled{ktls});
 
-# Keywords accepted in a build.info UNIT_TEST[] link set.
-my @unit_test_keywords = qw(cmocka detours);
-
-unless ($disabled{"unit-tests"}) {
-    if ($target =~ /^linux/ || $target =~ /^BSD/) {
-        $config{cmocka_includes} =
-            $withargs{cmocka_include} ? [$withargs{cmocka_include}] : [];
-        $config{cmocka_libs} = $withargs{cmocka_lib}
-            ? "-L$withargs{cmocka_lib} -lcmocka" : "-lcmocka";
-    } elsif ($target =~ /^VC-/) {
-        $config{cmocka_includes} =
-            $withargs{cmocka_include} ? [$withargs{cmocka_include}] : [];
-        $config{cmocka_libs} = $withargs{cmocka_lib}
-            ? "/LIBPATH:$withargs{cmocka_lib} cmocka.lib" : "cmocka.lib";
-        $config{detours_includes} =
-            $withargs{detours_include} ? [$withargs{detours_include}] : [];
-        $config{detours_libs} = $withargs{detours_lib}
-            ? "/LIBPATH:$withargs{detours_lib} detours.lib" : "detours.lib";
-    } else {
-        disable('no-unit-test-support', 'unit-tests');
-    }
-}
-
 # Get the extra flags used when building shared libraries and modules.  We
 # do this late because some of them depend on %disabled.
 
@@ -2043,20 +1909,6 @@ foreach my $what (sort keys %disabled) {
         my $macro = $disabled_info{$what}->{macro} = "OPENSSL_NO_$WHAT";
         push @{$config{openssl_feature_defines}}, $macro;
 
-        my @rules = (
-            [ \@disablables_protocols,  'openssl_disabled_protocols'  ],
-            [ \@disablables_algorithms, 'openssl_disabled_algorithms' ],
-            [ \@disablables_features,   'openssl_disabled_features'   ],
-        );
-
-        for my $r (@rules) {
-            my ($list, $target) = @$r;
-
-            if (grep { $what eq $_ } @$list) {
-              push @{$config{$target}}, uc $what;
-            }
-        }
-
         $skipdir{"crypto/$skipdir"} = $what
             unless $what eq 'async' || $what eq 'err' || $what eq 'dso' || $what eq 'http';
     }
@@ -2187,8 +2039,6 @@ if ($builder eq "unified") {
         my %includes = ();
         my %defines = ();
         my %depends = ();
-        my %unit_tests = ();
-        my %wraps = ();
         my %generate = ();
         my %imagedocs = ();
         my %htmldocs = ();
@@ -2444,16 +2294,6 @@ if ($builder eq "unified") {
                                 \$attributes{depends}, $+{ATTRIBS},
                                 tokenize($expand_variables->($+{VALUE})))
                          if !@skip || $skip[$#skip] > 0; },
-            qr/^\s* UNIT_TEST ${index_re} \s* = \s* ${value_re} \s* $/x
-            => sub { $push_to->(\%unit_tests, $expand_variables->($+{INDEX}),
-                                undef, undef,
-                                tokenize($expand_variables->($+{VALUE})))
-                         if !@skip || $skip[$#skip] > 0; },
-            qr/^\s* WRAP ${index_re} \s* = \s* ${value_re} \s* $/x
-            => sub { $push_to->(\%wraps, $expand_variables->($+{INDEX}),
-                                undef, undef,
-                                tokenize($expand_variables->($+{VALUE})))
-                         if !@skip || $skip[$#skip] > 0; },
             qr/^\s* GENERATE ${index_re} ${attribs_re} \s* = \s* ${value_re} \s* $/x
             => sub { $push_to->(\%generate, $expand_variables->($+{INDEX}),
                                 \$attributes{generate}, $+{ATTRIBS},
@@ -2740,27 +2580,6 @@ if ($builder eq "unified") {
             }
         }
 
-        foreach my $dest (keys %wraps) {
-            my $ddest = cleanfile($buildd, $dest, $blddir);
-            foreach my $fn (@{$wraps{$dest}}) {
-                push @{$unified_info{wraps}->{$ddest}}, $fn;
-            }
-        }
-
-        foreach my $dest (keys %unit_tests) {
-            my $ddest = cleanfile($buildd, $dest, $blddir);
-            foreach my $kw (@{$unit_tests{$dest}}) {
-                die "***** Unknown keyword '$kw' in UNIT_TEST[$dest] at $sourced/$f\n"
-                    unless grep { $_ eq $kw } @unit_test_keywords;
-            }
-            $unified_info{unit_tests}->{$ddest} =
-                [ @{$unit_tests{$dest}} ];
-        }
-        # WRAP implies cmocka unless an explicit UNIT_TEST set was given
-        foreach my $dest (keys %{$unified_info{wraps} // {}}) {
-            $unified_info{unit_tests}->{$dest} //= [ "cmocka" ];
-        }
-
         foreach my $section (keys %imagedocs) {
             foreach (@{$imagedocs{$section}}) {
                 my $imagedocs = cleanfile($buildd, $_, $blddir);
@@ -3093,28 +2912,6 @@ EOF
     }
 }
 
-# Attach cmocka (and, on Windows, Detours) include paths to unit tests,
-# based on each test's UNIT_TEST[] link set.
-if (!$disabled{"unit-tests"}) {
-    while (my ($dest, $libs) = each %{$unified_info{unit_tests} // {}}) {
-        my %want = map { $_ => 1 } @$libs;
-        push @{$unified_info{includes}->{$dest}}, @{$config{cmocka_includes}}
-            if $want{cmocka} && @{$config{cmocka_includes} // []};
-        push @{$unified_info{includes}->{$dest}}, @{$config{detours_includes}}
-            if $want{detours} && @{$config{detours_includes} // []};
-    }
-}
-
-if (!$disabled{"unit-tests"}) {
-    foreach my $dest (sort keys %{$unified_info{unit_tests} // {}}) {
-        my %want = map { $_ => 1 } @{$unified_info{unit_tests}->{$dest}};
-        my @resolved;
-        push @resolved, '$(CMOCKA_LIBS)'  if $want{cmocka}  && $config{cmocka_libs};
-        push @resolved, '$(DETOURS_LIBS)' if $want{detours} && $config{detours_libs};
-        $unified_info{unit_test_libs}->{$dest} = join(' ', @resolved);
-    }
-}
-
 # For the schemes that need it, we provide the old *_obj configs
 # from the *_asm_obj ones
 foreach (grep /_(asm|aux)_src$/, keys %target) {

DOCUMENTATION.md

@@ -1,194 +0,0 @@
-OpenSSL Documentation Policy
-============================
-
-This document describes the code documentation and commenting requirements
-for the OpenSSL project.
-
-The project's documentation is about making the libraries and tools more
-accessible to our users and making the code more maintainable. This policy
-applies to new submissions; existing code does not uniformly conform to it
-and will be brought up to standard gradually.
-
-Any non-trivial change to existing code must bring the affected code into
-conformance with this policy as part of the same change. In particular,
-renaming or relocating functions, changes to public APIs, and any change
-that would render an existing POD page or in-source comment inaccurate
-require the corresponding documentation to be updated. This includes
-adding documentation that was previously absent where the change brings
-the affected code within the scope of this policy.
-
-The form and style of code comments themselves -- comment markers, layout,
-the use of `/**` and `/*-` blocks, doxygen markup, the structure of the
-sample multi-line comment, and similar -- are described in
-[STYLE.md](STYLE.md). This file describes what *must* be documented and
-where; [STYLE.md](STYLE.md) describes how code comments look.
-
-Command line commands and arguments
------------------------------------
-
-All new commands, as well as new or modified arguments to existing
-commands, must be documented in the `doc/man1` directory. This
-documentation is in POD format.
-
-Public symbols in the libraries
--------------------------------
-
-All new public symbols must be documented in a POD manual page in the
-`doc/man3` directory. This includes types, macros, and functions.
-
-The allowed exceptions are:
-
-- guard macros preventing a header file being included twice
-- new symbols generated automatically via `make update` (errors, objects, etc.)
-
-Each public function's declaration in its public header must carry a
-doxygen comment block. The block's `@see` must include the function's
-own manual page (`name(3)`) and may include additional manual pages
-that a caller needs to use the function correctly. The doxygen block
-is a navigation aid pointing to the canonical reference documentation
-in the corresponding POD file; see [STYLE.md](STYLE.md) for the
-doxygen form.
-
-Overviews, conventions, et al
------------------------------
-
-Where additional user-facing information is required, it should be
-included in the `doc/man7` section. This includes, but is not limited to:
-
-- algorithm descriptions and parameters
-- architectural and subsystem overviews
-- user guides and tutorials
-- conventions and reference material (environment variables, glossary,
-  threading rules, file format conventions)
-
-Internal functions, structures, globals and macros
---------------------------------------------------
-
-Internal functions, structures, globals and macros are non-public
-items declared in any header that is not part of the public API.
-These include items declared in:
-
-- `include/internal/` (shared across subsystems);
-- `include/crypto/` (cryptographic internals);
-- per-directory local headers (for example, `crypto/asn1/asn1_local.h`)
-  shared between source files in a single subdirectory.
-
-These should all be documented at the declaration site -- that is,
-in the header that declares them -- using a doxygen-style comment
-block. For functions, this places the comment at the prototype,
-where editor tooling (clangd and similar) can surface it to readers
-at every call site. The comment should describe the purpose and,
-for functions, the input and output arguments and the return value.
-See [STYLE.md](STYLE.md) for the doxygen conventions used by OpenSSL.
-
-For *trivial* items, where their operation is obvious from their
-implementation, the documentation requirement is not mandated. The
-following are generally representative of trivial items, however it is
-quite possible for any of these to be non-trivial in specific instances
-and therefore require documentation:
-
-- `OSSL_DISPATCH` tables
-- upref functions
-- free functions
-- simple getter/setter functions
-- wrappers for other functions (a function that calls a more recent
-  `_ex` variant or a group of functions that call a common internal
-  routine)
-
-For structures, each of the fields should be commented stating its
-purpose. Again, a *trivial* exception applies where the purpose is
-obvious. Some representative examples:
-
-- `OSSL_LIB_CTX *ctx;` where there is only one library context referenced
-  in the structure.
-- `struct *next;` in a linked list implementation.
-- `CRYPTO_REF_COUNT refcnt;`
-
-File-local items
-----------------
-
-These are functions, structures, globals, and macros that are local
-to a single C file: `static` functions, file-scope variables,
-structures, and macros defined inside a `.c` file with no declaration
-in any header.
-
-These should all be documented at the point of definition. Follow the
-same rules and exceptions as for internal items above. In some cases
-slightly more leniency with respect to *trivial* can be tolerated.
-
-Code comments
--------------
-
-The form, style, and content guidance for code comments are described in
-[STYLE.md](STYLE.md). Comments are required at the points described in
-the internal and static sections above, subject to the *trivial*
-exception, and at the additional points described in
-[STYLE.md](STYLE.md).
-
-Assembly code
--------------
-
-Assembly code should include a good description of the algorithm and
-approach being used. This should be followed by a performance comparison
-and then the assembly code itself. The assembly code should be well
-commented, but it is not necessary to comment every line. A comment
-describing each block of code suffices.
-
-For pure-assembly modules (`.s` files and the perlasm scripts that
-generate them), comments use the native syntax of the assembler or
-generator (typically `#`). Doxygen-style markup does not apply here;
-the algorithm description, performance comparison, and per-block
-comments described above are still required.
-
-For assembly that appears inline inside a C file (within an `asm()`
-statement, for example), the surrounding C function is documented
-with doxygen-style C comments as for any other C code; see
-[STYLE.md](STYLE.md). Comments inside the `asm()` body itself use
-plain C `/* */` comments.
-
-There are no *trivial* exceptions for assembly code.
-
-Configure options
------------------
-
-New options added to the configuration scripts must be documented in the
-[INSTALL.md](INSTALL.md) file.
-
-Changes and news
-----------------
-
-Significant modifications should be documented in the
-[CHANGES.md](CHANGES.md) file.
-
-Very significant features and changes should be documented in the
-[NEWS.md](NEWS.md) file.
-
-In both cases, the added note should be short and to the point, and
-should be written for users of the library, focusing on impact rather
-than implementation details.
-
-Automated sanity checking
--------------------------
-
-The `make doc-nits` command should be run before submitting a pull
-request and any problems it locates must be addressed.
-
-Language
---------
-
-The language used for documentation shall be *British English*.
-
-In general the language, abbreviations, layout and formatting should also
-correspond to the
-[LDP](https://openssl-library.org/policies/general/glossary/#ldp)
-guidelines.
-
-Common sense
-------------
-
-Comments and documentation are to improve readability and comprehension.
-Where the code is obvious, there is no need to include a comment.
-However, common sense applies: always err in favour of including more
-comments than less or none. Code that you have just written that is
-*obvious* will not necessarily be to someone else two years later. See
-[STYLE.md](STYLE.md) for the form and content of code comments.

HACKING.md

@@ -1,5 +1,5 @@
-ADDING FUNCTIONS to OPENSSL
-===========================
+MODIFYING OPENSSL SOURCE
+========================
 
 This document describes the way to add custom modifications to OpenSSL
 sources.
@@ -58,7 +58,7 @@ public function - as defined above - is added, these files must be updated.
 
 To make such an update, please do the following:
 
-    ./Configure --strict-warnings [your-options]
+    ./Configure -Werror --strict-warnings [your-options]
     make update
 
 If you plan to submit the changes you made to OpenSSL (see
@@ -67,19 +67,14 @@ If you plan to submit the changes you made to OpenSSL (see
 
     make doc-nits
 
-`make update` ensures that your functions declarations are added to
-`util/libcrypto.num` or `util/libssl.num`.
-It also generates files related to OIDs (in the `crypto/objects/`  folder)
-and error messages.
-
-More details are at
-  [doc/HOWTO/documenting-functions-macros.md](Documenting Functions and Macros)
+Do note that `make update` also generates files related to OIDs (in the
+`crypto/objects/`  folder) and errors messages.
 
 If a git merge error occurs in one of these generated files, then the
 generated files need to be removed and regenerated using `make update`.
-To aid in this process, the generated files should be committed separately
+To aid in this process, the generated files can be committed separately
 so they can be removed easily by reverting that commit.
 
-[doc/internal/man7/build.info.pod]: ../doc/internal/man7/build.info.pod
-[Configurations/unix-Makefile.tmpl]: ../../Configurations/unix-Makefile.tmpl
-[CONTRIBUTING.md]: ../../CONTRIBUTING.md
+[doc/internal/man7/build.info.pod]: ./doc/internal/man7/build.info.pod
+[Configurations/unix-Makefile.tmpl]: ./Configurations/unix-Makefile.tmpl
+[CONTRIBUTING.md]: ./CONTRIBUTING.md

HOWTO.md

@@ -1,8 +0,0 @@
-MODIFYING OPENSSL SOURCE
-========================
-
-This is a collection of pointers to parts of the documentation that will help
-people doing modifications.
-
-* [doc/HOWTO/adding-functions.md](Adding new Functions)
-* [doc/HOWTO/documenting-functions-macros.md](Documenting Functions and Macros)

INSTALL.md

@@ -169,11 +169,13 @@ issue the following commands to build OpenSSL.
     $ nmake test
 
 As mentioned in the [Choices](#choices) section, you need to pick one
-of the Configure targets in the first command.
+of the four Configure targets in the first command.
 
 Most likely you will be using the `VC-WIN64A`/`VC-WIN64A-HYBRIDCRT` target for
 64bit Windows binaries (AMD64) or `VC-WIN32`/`VC-WIN32-HYBRIDCRT` for 32bit
 Windows binaries (X86).
+The other two options are `VC-WIN64I` (Intel IA64, Itanium) and
+`VC-CE` (Windows CE) are rather uncommon nowadays.
 
 Installing OpenSSL
 ------------------
@@ -426,22 +428,6 @@ The names of the libraries are:
 * brotlidec.lib
 * brotlienc.lib
 
-### with-cmocka-include
-
-    --with-cmocka-include=DIR
-
-The directory for the location of the cmocka include file. This option is only
-necessary if [enable-unit-tests](#enable-unit-tests) is used and the include
-file is not already on the system include path.
-
-### with-cmocka-lib
-
-    --with-cmocka-lib=DIR
-
-The directory containing the cmocka library. This option is only necessary if
-[enable-unit-tests](#enable-unit-tests) is used and the library is not already
-on the system library path.
-
 ### with-zlib-include
 
     --with-zlib-include=DIR
@@ -598,15 +584,6 @@ In the following list, always the non-default variant is documented: if
 feature `xxxx` is disabled by default then `enable-xxxx` is documented and
 if feature `xxxx` is enabled by default then `no-xxxx` is documented.
 
-### enable-static-vcruntime
-
-Build binaries that do not require that VC runtimes are installed
-
-This option will produce binaries that are "self contained", that do not
-depend upon VC runtime libraries being installed, so can be used on any
-computer running MS Windows.  Without this option, the build will produce
-binaries that rely on the VC runtimes being installed and available.
-
 ### enable-ktls
 
 Build with Kernel TLS support.
@@ -657,10 +634,9 @@ Do not build support for async operations.
 
 Do not use `atexit()` in libcrypto builds.
 
-Before version 4.0, OpenSSL used to set `atexit()` handler for cleaning up
-global data, and this option allowed to disable that functionality.  `atexit()`
-handler setup was removed in OpenSSL 4.0, so `no-atexit` option is retained
-for compatibility reasons only, always present, and does nothing.
+`atexit()` has varied semantics between platforms and can cause SIGSEGV in some
+circumstances. This option disables the atexit registration of OPENSSL_cleanup.
+By default, NonStop configurations use `no-atexit`.
 
 ### no-autoalginit
 
@@ -753,6 +729,10 @@ the zlib or `zlib-dynamic` options are also chosen.
 
 This now only enables the `failed-malloc` feature.
 
+### enable-crypto-mdebug-backtrace
+
+This is a no-op; the project uses the compiler's address/leak sanitizer instead.
+
 ### enable-allocfail-tests
 
 This option enables testing that leverages the use of the crypto-mdebug feature
@@ -781,22 +761,20 @@ Don't build and install documentation, i.e. manual pages in various forms.
 
 Don't build support for loading Dynamic Shared Objects (DSO)
 
-### enable-tls-deprecated-ec
+### no-ec
 
-Enable legacy TLS EC groups that were deprecated in RFC8422.  These are the
+Don't build support for Elliptic Curves.
+
+### no-ec2m
+
+Don't build support for binary Elliptic Curves
+
+### no-tls-deprecated-ec
+
+Disable legacy TLS EC groups that were deprecated in RFC8422.  These are the
 Koblitz curves, B<secp160r1>, B<secp160r2>, B<secp192r1>, B<secp224r1>, and the
 binary Elliptic curves that would also be disabled by C<no-ec2m>.
 
-### enable-ec_expicit_curves
-
-Enable support for explictitly specified elliptic curves not matching the
-well-known ones. Until this option is on, such curves can't be instantiated
-from ASN.1 formats.
-
-### no-ech
-
-Don't build support for Encrypted Client Hello (ECH) extension.
-
 ### enable-ec_nistp_64_gcc_128
 
 Enable support for optimised implementations of some commonly used NIST
@@ -832,12 +810,6 @@ external test suites are currently supported:
 See the file [test/README-external.md](test/README-external.md)
 for further details.
 
-### enable-unit-tests
-
-Enable building and running unit tests.
-
-This works only on platforms supporting ld `--wrap` option like Linux and BSD.
-
 ### no-filenames
 
 Don't compile in filename and line number information (e.g.  for errors and
@@ -889,13 +861,6 @@ Note that if this feature is enabled then GOST ciphersuites are only available
 if the GOST algorithms are also available through loading an externally supplied
 engine.
 
-### no-engine, no-static-engine, no-dynamic-engine
-
-The `no-engine` option is always present.  These options are deprecated and do
-nothing, and are retained for backwards compatibility only.  The ENGINE API was
-deprecated in OpenSSL 3.0 and removed in OpenSSL 4.0, so applications should
-transition to using providers instead.
-
 ### no-http
 
 Disable HTTP support.
@@ -906,10 +871,26 @@ Don't build the legacy provider.
 
 Disabling this also disables the legacy algorithms: MD2 (already disabled by default).
 
+### enable-lms
+
+Enable Leighton-Micali Signatures (LMS) support.
+Support is currently limited to verification only as per
+[SP 800-208](https://csrc.nist.gov/pubs/sp/800/208/final).
+
 ### no-makedepend
 
 Don't generate dependencies.
 
+### no-ml-dsa
+
+Disable Module-Lattice-Based Digital Signature Standard (ML-DSA) support.
+ML-DSA is based on CRYSTALS-DILITHIUM. See [FIPS 204].
+
+### no-ml-kem
+
+Disable Module-Lattice-Based Key-Encapsulation Mechanism Standard (ML-KEM)
+support.  ML-KEM is based on CRYSTALS-KYBER. See [FIPS 203].
+
 ### no-module
 
 Don't build any dynamically loadable modules.
@@ -940,17 +921,17 @@ Build with support for Position Independent Execution.
 
 Don't pin the shared libraries.
 
-By default, on supported platforms (such as Linux and GNU Hurd), OpenSSL
-is built with linker options (e.g., `-Wl,-znodelete`) that prevent the
-operating system from unloading the libcrypto and libssl shared libraries
-from memory, even if the application explicitly unloads them using
-`dlclose()`. On platforms that do not support these options, this feature
-is disabled by default.
+By default OpenSSL will attempt to stay in memory until the process exits.
+This is so that libcrypto and libssl can be properly cleaned up automatically
+via an `atexit()` handler.  The handler is registered by libcrypto and cleans
+up both libraries.  On some platforms the `atexit()` handler will run on unload of
+libcrypto (if it has been dynamically loaded) rather than at process exit.
 
-This option prevents the addition of those linker flags, allowing the
-shared libraries to be completely unloaded from the process address space.
-This is useful for applications that dynamically load and unload OpenSSL
-plugins to conserve memory.
+This option can be used to stop OpenSSL from attempting to stay in memory until the
+process exits.  This could lead to crashes if either libcrypto or libssl have
+already been unloaded at the point that the atexit handler is invoked, e.g.  on a
+platform which calls `atexit()` on unload of the library, and libssl is unloaded
+before libcrypto then a crash is likely to happen.
 
 Note that shared library pinning is not automatically disabled for static builds,
 i.e., `no-shared` does not imply `no-pinshared`. This may come as a surprise when
@@ -958,6 +939,10 @@ linking libcrypto statically into a shared third-party library, because in this
 case the shared library will be pinned. To prevent this behaviour, you need to
 configure the static build using `no-shared` and `no-pinshared` together.
 
+Applications can suppress running of the `atexit()` handler at run time by
+using the `OPENSSL_INIT_NO_ATEXIT` option to `OPENSSL_init_crypto()`.
+See the man page for it for further details.
+
 ### no-posix-io
 
 Don't use POSIX IO capabilities.
@@ -985,6 +970,11 @@ Do not create shared libraries, only static ones.
 
 See [Notes on shared libraries](#notes-on-shared-libraries) below.
 
+### no-slh-dsa
+
+Disable Stateless Hash Based Digital Signature Standard support.
+(SLH-DSA is based on SPHINCS+. See [FIPS 205])
+
 ### no-sm2-precomp
 
 Disable using the SM2 precomputed table on aarch64 to make the library smaller.
@@ -1115,12 +1105,10 @@ The User Interface console method enables text based console prompts.
 
 ### enable-unit-test
 
-Enable exposing SSL_test_functions for overwriting ssl_init_wbio_buffer.
+Enable additional unit test APIs.
 
 This should not typically be used in production deployments.
 
-This option is deprecated and will be removed in OpenSSL 5.0.
-
 ### no-uplink
 
 Don't build support for UPLINK interface.
@@ -1177,8 +1165,8 @@ Don't build support for negotiating the specified SSL/TLS protocol.
 
 If `no-tls` is selected then all of `tls1`, `tls1_1`, `tls1_2` and `tls1_3`
 are disabled.
-Similarly `no-dtls` will disable `dtls1` and `dtls1_2`.
-`no-ssl` and `no-ssl3` are deprecated and do nothing.
+Similarly `no-dtls` will disable `dtls1` and `dtls1_2`.  The `no-ssl` option is
+synonymous with `no-ssl3`.  Note this only affects version negotiation.
 OpenSSL will still provide the methods for applications to explicitly select
 the individual protocol versions.
 
@@ -1194,37 +1182,28 @@ Analogous to `no-{protocol}` but in addition do not build the methods for
 applications to explicitly select individual protocol versions.  Note that there
 is no `no-tls1_3-method` option because there is no application method for
 TLSv1.3.
-`no-ssl3` is deprecated and does nothing.
 
 Using individual protocol methods directly is deprecated.  Applications should
 use `TLS_method()` instead.
 
 ### enable-{algorithm}
 
-    enable-{md2|rc5|lms}
+    enable-{md2|rc5}
 
 Build with support for the specified algorithm.
 
-The `lms` algorithm support is currently limited to verification only as per
-[SP 800-208](https://csrc.nist.gov/pubs/sp/800/208/final).
-
 ### no-{algorithm}
 
     no-{aria|bf|blake2|camellia|cast|chacha|cmac|
-        des|dh|dsa|
-        ec|ec2m|ecdh|ecdsa|hmac-drbg-kdf|idea|ikev2kdf|kbkdf|krb5kdf|
-        md4|mdc2|
-        ml-dsa|ml-kem|
-        ocb|poly1305|pvkkdf|rc2|rc4|rmd160|scrypt|
-        seed|siphash|siv|slh-dsa|sm2|sm3|sm4|snmpkdf|srtpkdf|sshkdf|sskdf|
-        x942kdf|x963kdf|whirlpool}
+        des|dh|dsa|ecdh|ecdsa|idea|md4|mdc2|ml-dsa|
+        ml-kem|ocb|poly1305|rc2|rc4|rmd160|scrypt|
+        seed|siphash|siv|sm2|sm3|sm4|whirlpool}
 
 Build without support for the specified algorithm.
 
 The `ripemd` algorithm is deprecated and if used is synonymous with `rmd160`.
 
-Compiler-specific options
--------------------------
+### Compiler-specific options
 
     -Dxxx, -Ixxx, -Wp, -lxxx, -Lxxx, -Wl, -rpath, -R, -framework, -static
 
@@ -1255,17 +1234,7 @@ encoding.
 Take note of the [Environment Variables](#environment-variables) documentation
 below and how these flags interact with those variables.
 
-Miscellaneous options
----------------------
-
-### --manpage-format
-
-Specify a specific output manpage format. The supported output types are mandoc
-and *roff. The *roff output format is the default for legacy and portability
-reasons.
-
-Environment Variables
----------------------
+### Environment Variables
 
     VAR=value
 
@@ -1342,18 +1311,10 @@ If `CC` is set, it is advisable to also set `CXX` to ensure both the C and C++
 compiler are in the same "family".  This becomes relevant with
 `enable-external-tests` and `enable-buildtest-c++`.
 
-Reconfigure
------------
+### Reconfigure
 
-### Make targets
-
-    `$ make reconf`
-
-or
-
-    `$ make reconfigure`
-
-### Description
+    reconf
+    reconfigure
 
 Reconfigure from earlier data.
 
@@ -1971,8 +1932,9 @@ on Cygwin, shared libraries are named `cygcrypto-1.1.dll` and `cygssl-1.1.dll`
 with import libraries `libcrypto.dll.a` and `libssl.dll.a`.
 
 On Windows build with MSVC or using MingW, shared libraries are named
-`libcrypto-1_1.dll` and `libssl-1_1.dll` for 32-bit Windows, and
-`libcrypto-1_1-x64.dll` and `libssl-1_1-x64.dll` for 64-bit x86_64 Windows.
+`libcrypto-1_1.dll` and `libssl-1_1.dll` for 32-bit Windows,
+`libcrypto-1_1-x64.dll` and `libssl-1_1-x64.dll` for 64-bit x86_64 Windows,
+and `libcrypto-1_1-ia64.dll` and `libssl-1_1-ia64.dll` for IA64 Windows.
 With MSVC, the import libraries are named `libcrypto.lib` and `libssl.lib`,
 while with MingW, they are named `libcrypto.dll.a` and `libssl.dll.a`.
 

NEWS.md

@@ -7,7 +7,6 @@ release. For more details please read the CHANGES file.
 OpenSSL Releases
 ----------------
 
- - [OpenSSL 4.1](#openssl-41)
  - [OpenSSL 4.0](#openssl-40)
  - [OpenSSL 3.6](#openssl-36)
  - [OpenSSL 3.5](#openssl-35)
@@ -23,280 +22,18 @@ OpenSSL Releases
  - [OpenSSL 1.0.0](#openssl-100)
  - [OpenSSL 0.9.x](#openssl-09x)
 
-OpenSSL 4.1
------------
-
-### Major changes between OpenSSL 4.0 and OpenSSL 4.1 [under development]
-
-  * API calls `CRYPTO_atomic_load_ptr`, `CRYPTO_atomic_store_ptr`, and
-    `CRYPTO_atomic_cmp_exch_ptr` have been added.
-
-  * Fixed verification of DSA certificates signed with SHA-384 or SHA-512.
-
 OpenSSL 4.0
 -----------
 
-### Major changes between OpenSSL 4.0.0 and OpenSSL 4.0.1 [9 Jun 2026]
+### Major changes between OpenSSL 3.6 and OpenSSL 4.0 [under development]
 
-OpenSSL 4.0.1 is a security patch release.  The most severe CVE fixed
-in this release is High.
-
-This release incorporates the following bug fixes and mitigations:
-
-  * Fixed heap use-after-free in `PKCS7_verify()`.
-    ([CVE-2026-45447])
-
-  * Fixed CMS `AuthEnvelopedData` processing may accept forged messages.
-    ([CVE-2026-34182])
-
-  * Fixed unbounded memory growth in the QUIC `PATH_CHALLENGE` handler.
-    ([CVE-2026-34183])
-
-  * Fixed double-free when checking OCSP stapled response.
-    ([CVE-2026-35188])
-
-  * Fixed NULL pointer dereference in QUIC server initial packet handling.
-    ([CVE-2026-42764])
-
-  * Fixed AES-OCB IV ignored on `EVP_Cipher()` path.
-    ([CVE-2026-45445])
-
-  * Fixed possible heap buffer overflow in ASN.1 multibyte string conversion.
-    ([CVE-2026-7383])
-
-  * Fixed out-of-bounds read in CMS password-based decryption.
-    ([CVE-2026-9076])
-
-  * Fixed heap buffer over-read in ASN.1 content parsing.
-    ([CVE-2026-34180])
-
-  * Fixed PKCS#12 files with PBMAC1 are accepted with short HMAC keys.
-    ([CVE-2026-34181])
-
-  * Fixed NULL dereference in certificate verification with OCSP Checking.
-    ([CVE-2026-42765])
-
-  * Fixed possible NULL dereference in password-dased CMS decryption.
-    ([CVE-2026-42766])
-
-  * Fixed NULL pointer dereference in CRMF `EncryptedValue` decryption.
-    ([CVE-2026-42767])
-
-  * Fixed multi-`RecipientInfo` Bleichenbacher Oracle in `CMS_decrypt()`
-    and `PKCS7_decrypt()`.
-    ([CVE-2026-42768])
-
-  * Fixed trust anchor substitution via `cert`/`issuer` typo in CMP
-    `rootCaKeyUpdate`.
-    ([CVE-2026-42769])
-
-  * Fixed FFC-DH peer validation uses attacker-supplied `q`.
-    ([CVE-2026-42770])
-
-  * Fixed possible out of bounds read in `X509_VERIFY_PARAM_set1_email()`.
-    ([CVE-2026-42771])
-
-  * Fixed incorrect tag processing for empty messages in AES-GCM-SIV
-    and AES-SIV modes.
-    ([CVE-2026-45446])
-
-  * Fixed a regression introduced in 4.0.0 that led to a `openssl pkey`
-    command crash when it was invoked to encrypt a private key with password
-    being provided interactively.
-
-  * Fixed a regression introduced in 4.0.0 that led to `openssl s_client -adv`
-    command prematurely terminating a session when reading input of 16384 bytes
-    in one `read()` call.
-
-### Major changes between OpenSSL 3.6 and OpenSSL 4.0.0 [14 Apr 2026]
-
-OpenSSL 4.0.0 is a feature release adding significant new functionality
-to OpenSSL.
-
-This release incorporates the following potentially significant or incompatible
-changes:
-
-  * Removed extra leading '00:' when printing key data such as an RSA modulus
-    in hexadecimal format where the first (most significant) byte is >= 0x80.
-
-  * Standardized the width of hexadecimal dumps to 24 bytes for signatures
-    (to stay within the 80 characters limit) and 16 bytes for everything else.
-
-  * Lower bounds checks are now enforced when using `PKCS5_PBKDF2_HMAC` API
-    with FIPS provider.
-
-  * Added AKID verification checks when `X509_V_FLAG_X509_STRICT` is set.
-
-  * Augmented CRL verification process with several additional checks.
-
-  * `libcrypto` no longer cleans up globally allocated data via `atexit()`.
-
-  * `BIO_snprintf()` now uses `snprintf()` provided by libc instead of internal
-    implementation.
-
-  * `OPENSSL_cleanup()` now runs in a global destructor, or not at all
-    by default.
-
-  * `ASN1_STRING` has been made opaque.
-
-  * Signatures of numerous API functions, including those that are related
-    to X509 processing, are changed to include `const` qualifiers for argument
-    and return types, where suitable.
-
-  * Deprecated `X509_cmp_time()`, `X509_cmp_current_time()`,
-    and `X509_cmp_timeframe()` in favor of `X509_check_certificate_times()`.
-
-  * Removed support for the SSLv2 Client Hello.
-
-  * Removed support for SSLv3.  SSLv3 has been deprecated since 2015,
-    and OpenSSL had it disabled by default since version 1.1.0 (2016).
-
-  * Removed support for engines.  The `no-engine` build option
-    and the `OPENSSL_NO_ENGINE` macro are always present.
-
-  * Support of deprecated elliptic curves in TLS according to [RFC 8422] was
-    disabled at compile-time by default. To enable it, use the
-    `enable-tls-deprecated-ec` configuration option.
-
-  * Support of explicit EC curves was disabled at compile-time by default.
-    To enable it, use the `enable-ec_explicit_curves` configuration option.
-
-  * Removed `c_rehash` script tool.  Use `openssl rehash` instead.
-
-  * Removed the deprecated `msie-hack` option from the `openssl ca` command.
-
-  * Removed `BIO_f_reliable()` implementation without replacement.
-    It was broken since 3.0 release without any complaints.
-
-  * Removed deprecated support for custom `EVP_CIPHER`, `EVP_MD`, `EVP_PKEY`,
-    and `EVP_PKEY_ASN1` methods.
-
-  * Removed deprecated fixed SSL/TLS version method functions.
-
-  * Removed deprecated functions `ERR_get_state()`, `ERR_remove_state()`
-    and `ERR_remove_thread_state()`. The `ERR_STATE` object is now always
-    opaque.
-
-  * Dropped `darwin-i386{,-cc}` and `darwin-ppc{,64}{,-cc}` targets
-    from Configurations.
-
-This release adds the following new features:
-
-  * Support for Encrypted Client Hello (ECH, [RFC 9849]).
-    See `doc/designs/ech-api.md` for details.
-
-  * Support for [RFC 8998], signature algorithm `sm2sig_sm3`, key exchange
-    group `curveSM2`, and [tls-hybrid-sm2-mlkem] post-quantum group
-    `curveSM2MLKEM768`.
-
-  * cSHAKE function support as per [SP 800-185].
-
-  * "ML-DSA-MU" digest algorithm support.
-
-  * Support for SNMP KDF and SRTP KDF.
-
-  * FIPS self tests can now be deferred and run as needed when installing
-    the FIPS module with the `-defer_tests` option of the `openssl fipsinstall`
-    command.
-
-  * Support for using either static or dynamic VC runtime linkage
-    on Windows.
-
-  * Support for negotiated FFDHE key exchange in TLS 1.2 in accordance
-    with [RFC 7919].
+  * ENGINE support was removed. The `no-engine` build option and the
+   `OPENSSL_NO_ENGINE` macro is always present.
 
 OpenSSL 3.6
 -----------
 
-### Major changes between OpenSSL 3.6.1 and OpenSSL 3.6.2 [7 Apr 2026]
-
-OpenSSL 3.6.2 is a security patch release. The most severe CVE fixed in this
-release is Moderate.
-
-This release incorporates the following bug fixes and mitigations:
-
-  * Fixed incorrect failure handling in RSA KEM RSASVE encapsulation.
-    ([CVE-2026-31790])
-
-  * Fixed loss of key agreement group tuple structure when the `DEFAULT` keyword
-    is used in the server-side configuration of the key-agreement group list.
-    ([CVE-2026-2673])
-
-  * Fixed out-of-bounds read in AES-CFB-128 on x86-64 CPUs with AVX-512 support.
-    ([CVE-2026-28386])
-
-  * Fixed potential use-after-free in DANE client code.
-    ([CVE-2026-28387])
-
-  * Fixed NULL pointer dereference when processing a delta CRL.
-    ([CVE-2026-28388])
-
-  * Fixed possible NULL dereference when processing CMS KeyAgreeRecipientInfo.
-    ([CVE-2026-28389])
-
-  * Fixed possible NULL dereference when processing CMS
-    KeyTransportRecipientInfo.
-    ([CVE-2026-28390])
-
-  * Fixed heap buffer overflow in hexadecimal conversion.
-    ([CVE-2026-31789])
-
-### Major changes between OpenSSL 3.6.0 and OpenSSL 3.6.1 [27 Jan 2026]
-
-OpenSSL 3.6.1 is a security patch release. The most severe CVE fixed in this
-release is High.
-
-This release incorporates the following bug fixes and mitigations:
-
-  * Fixed Improper validation of PBMAC1 parameters in PKCS#12 MAC verification.
-    ([CVE-2025-11187])
-
-  * Fixed Stack buffer overflow in CMS `AuthEnvelopedData` parsing.
-    ([CVE-2025-15467])
-
-  * Fixed NULL dereference in `SSL_CIPHER_find()` function on unknown cipher ID.
-    ([CVE-2025-15468])
-
-  * Fixed `openssl dgst` one-shot codepath silently truncates inputs >16 MiB.
-    ([CVE-2025-15469])
-
-  * Fixed TLS 1.3 `CompressedCertificate` excessive memory allocation.
-    ([CVE-2025-66199])
-
-  * Fixed Heap out-of-bounds write in `BIO_f_linebuffer` on short writes.
-    ([CVE-2025-68160])
-
-  * Fixed Unauthenticated/unencrypted trailing bytes with low-level OCB
-    function calls.
-    ([CVE-2025-69418])
-
-  * Fixed Out of bounds write in `PKCS12_get_friendlyname()` UTF-8 conversion.
-    ([CVE-2025-69419])
-
-  * Fixed Missing `ASN1_TYPE` validation in `TS_RESP_verify_response()`
-    function.
-    ([CVE-2025-69420])
-
-  * Fixed NULL Pointer Dereference in `PKCS12_item_decrypt_d2i_ex()` function.
-    ([CVE-2025-69421])
-
-  * Fixed Missing `ASN1_TYPE` validation in PKCS#12 parsing.
-    ([CVE-2026-22795])
-
-  * Fixed `ASN1_TYPE` Type Confusion in the `PKCS7_digest_from_attributes()`
-    function.
-    ([CVE-2026-22796])
-
-  * Fixed a regression in `X509_V_FLAG_CRL_CHECK_ALL` flag handling by
-    restoring its pre-3.6.0 behaviour.
-
-  * Fixed a regression in handling stapled OCSP responses causing handshake
-    failures for OpenSSL 3.6.0 servers with various client implementations.
-
-### Major changes between OpenSSL 3.5 and OpenSSL 3.6.0 [1 Oct 2025]
-
-OpenSSL 3.6.0 is a feature release adding significant new functionality
-to OpenSSL.
+### Major changes between OpenSSL 3.5 and OpenSSL 3.6 [under development]
 
 This release incorporates the following potentially significant or incompatible
 changes:
@@ -1015,7 +752,7 @@ OpenSSL 1.1.1
 
 ### Major changes between OpenSSL 1.1.1d and OpenSSL 1.1.1e [17 Mar 2020]
 
-  * Fixed an overflow bug in the x86_64 Montgomery squaring procedure
+  * Fixed an overflow bug in the x64_64 Montgomery squaring procedure
     used in exponentiation with 512-bit moduli ([CVE-2019-1551])
 
 ### Major changes between OpenSSL 1.1.1c and OpenSSL 1.1.1d [10 Sep 2019]
@@ -2245,233 +1982,190 @@ OpenSSL 0.9.x
   * Support for various new platforms
 
 <!-- Links -->
-[CHANGES.md]: ./CHANGES.md
-[CMVP]: https://csrc.nist.gov/projects/cryptographic-module-validation-program
-[CVE-2005-2969]: https://openssl-library.org/news/vulnerabilities/#CVE-2005-2969
-[CVE-2006-2937]: https://openssl-library.org/news/vulnerabilities/#CVE-2006-2937
-[CVE-2006-2940]: https://openssl-library.org/news/vulnerabilities/#CVE-2006-2940
-[CVE-2006-3737]: https://openssl-library.org/news/vulnerabilities/#CVE-2006-3737
-[CVE-2006-4339]: https://openssl-library.org/news/vulnerabilities/#CVE-2006-4339
-[CVE-2006-4343]: https://openssl-library.org/news/vulnerabilities/#CVE-2006-4343
-[CVE-2008-5077]: https://openssl-library.org/news/vulnerabilities/#CVE-2008-5077
-[CVE-2009-0590]: https://openssl-library.org/news/vulnerabilities/#CVE-2009-0590
-[CVE-2009-0591]: https://openssl-library.org/news/vulnerabilities/#CVE-2009-0591
-[CVE-2009-0789]: https://openssl-library.org/news/vulnerabilities/#CVE-2009-0789
-[CVE-2009-3555]: https://openssl-library.org/news/vulnerabilities/#CVE-2009-3555
-[CVE-2010-0433]: https://openssl-library.org/news/vulnerabilities/#CVE-2010-0433
-[CVE-2010-0740]: https://openssl-library.org/news/vulnerabilities/#CVE-2010-0740
-[CVE-2010-1633]: https://openssl-library.org/news/vulnerabilities/#CVE-2010-1633
-[CVE-2010-2939]: https://openssl-library.org/news/vulnerabilities/#CVE-2010-2939
-[CVE-2010-3864]: https://openssl-library.org/news/vulnerabilities/#CVE-2010-3864
-[CVE-2010-4180]: https://openssl-library.org/news/vulnerabilities/#CVE-2010-4180
-[CVE-2010-4252]: https://openssl-library.org/news/vulnerabilities/#CVE-2010-4252
-[CVE-2010-5298]: https://openssl-library.org/news/vulnerabilities/#CVE-2010-5298
-[CVE-2011-0014]: https://openssl-library.org/news/vulnerabilities/#CVE-2011-0014
-[CVE-2011-3207]: https://openssl-library.org/news/vulnerabilities/#CVE-2011-3207
-[CVE-2011-3210]: https://openssl-library.org/news/vulnerabilities/#CVE-2011-3210
-[CVE-2011-4108]: https://openssl-library.org/news/vulnerabilities/#CVE-2011-4108
-[CVE-2011-4576]: https://openssl-library.org/news/vulnerabilities/#CVE-2011-4576
-[CVE-2011-4577]: https://openssl-library.org/news/vulnerabilities/#CVE-2011-4577
-[CVE-2011-4619]: https://openssl-library.org/news/vulnerabilities/#CVE-2011-4619
-[CVE-2012-0027]: https://openssl-library.org/news/vulnerabilities/#CVE-2012-0027
-[CVE-2012-0050]: https://openssl-library.org/news/vulnerabilities/#CVE-2012-0050
-[CVE-2012-0884]: https://openssl-library.org/news/vulnerabilities/#CVE-2012-0884
-[CVE-2012-2110]: https://openssl-library.org/news/vulnerabilities/#CVE-2012-2110
-[CVE-2012-2333]: https://openssl-library.org/news/vulnerabilities/#CVE-2012-2333
-[CVE-2012-2686]: https://openssl-library.org/news/vulnerabilities/#CVE-2012-2686
-[CVE-2013-0166]: https://openssl-library.org/news/vulnerabilities/#CVE-2013-0166
-[CVE-2013-0169]: https://openssl-library.org/news/vulnerabilities/#CVE-2013-0169
-[CVE-2013-4353]: https://openssl-library.org/news/vulnerabilities/#CVE-2013-4353
-[CVE-2013-6449]: https://openssl-library.org/news/vulnerabilities/#CVE-2013-6449
-[CVE-2013-6450]: https://openssl-library.org/news/vulnerabilities/#CVE-2013-6450
-[CVE-2014-0076]: https://openssl-library.org/news/vulnerabilities/#CVE-2014-0076
-[CVE-2014-0160]: https://openssl-library.org/news/vulnerabilities/#CVE-2014-0160
-[CVE-2014-0195]: https://openssl-library.org/news/vulnerabilities/#CVE-2014-0195
-[CVE-2014-0198]: https://openssl-library.org/news/vulnerabilities/#CVE-2014-0198
-[CVE-2014-0221]: https://openssl-library.org/news/vulnerabilities/#CVE-2014-0221
-[CVE-2014-0224]: https://openssl-library.org/news/vulnerabilities/#CVE-2014-0224
-[CVE-2014-3470]: https://openssl-library.org/news/vulnerabilities/#CVE-2014-3470
-[CVE-2014-3505]: https://openssl-library.org/news/vulnerabilities/#CVE-2014-3505
-[CVE-2014-3506]: https://openssl-library.org/news/vulnerabilities/#CVE-2014-3506
-[CVE-2014-3507]: https://openssl-library.org/news/vulnerabilities/#CVE-2014-3507
-[CVE-2014-3508]: https://openssl-library.org/news/vulnerabilities/#CVE-2014-3508
-[CVE-2014-3509]: https://openssl-library.org/news/vulnerabilities/#CVE-2014-3509
-[CVE-2014-3510]: https://openssl-library.org/news/vulnerabilities/#CVE-2014-3510
-[CVE-2014-3511]: https://openssl-library.org/news/vulnerabilities/#CVE-2014-3511
-[CVE-2014-3512]: https://openssl-library.org/news/vulnerabilities/#CVE-2014-3512
-[CVE-2014-3513]: https://openssl-library.org/news/vulnerabilities/#CVE-2014-3513
-[CVE-2014-3566]: https://openssl-library.org/news/vulnerabilities/#CVE-2014-3566
-[CVE-2014-3567]: https://openssl-library.org/news/vulnerabilities/#CVE-2014-3567
-[CVE-2014-3568]: https://openssl-library.org/news/vulnerabilities/#CVE-2014-3568
-[CVE-2014-3569]: https://openssl-library.org/news/vulnerabilities/#CVE-2014-3569
-[CVE-2014-3570]: https://openssl-library.org/news/vulnerabilities/#CVE-2014-3570
-[CVE-2014-3571]: https://openssl-library.org/news/vulnerabilities/#CVE-2014-3571
-[CVE-2014-3572]: https://openssl-library.org/news/vulnerabilities/#CVE-2014-3572
-[CVE-2014-5139]: https://openssl-library.org/news/vulnerabilities/#CVE-2014-5139
-[CVE-2014-8275]: https://openssl-library.org/news/vulnerabilities/#CVE-2014-8275
-[CVE-2015-0204]: https://openssl-library.org/news/vulnerabilities/#CVE-2015-0204
-[CVE-2015-0205]: https://openssl-library.org/news/vulnerabilities/#CVE-2015-0205
-[CVE-2015-0206]: https://openssl-library.org/news/vulnerabilities/#CVE-2015-0206
-[CVE-2015-0207]: https://openssl-library.org/news/vulnerabilities/#CVE-2015-0207
-[CVE-2015-0208]: https://openssl-library.org/news/vulnerabilities/#CVE-2015-0208
-[CVE-2015-0209]: https://openssl-library.org/news/vulnerabilities/#CVE-2015-0209
-[CVE-2015-0285]: https://openssl-library.org/news/vulnerabilities/#CVE-2015-0285
-[CVE-2015-0286]: https://openssl-library.org/news/vulnerabilities/#CVE-2015-0286
-[CVE-2015-0287]: https://openssl-library.org/news/vulnerabilities/#CVE-2015-0287
-[CVE-2015-0288]: https://openssl-library.org/news/vulnerabilities/#CVE-2015-0288
-[CVE-2015-0289]: https://openssl-library.org/news/vulnerabilities/#CVE-2015-0289
-[CVE-2015-0290]: https://openssl-library.org/news/vulnerabilities/#CVE-2015-0290
-[CVE-2015-0291]: https://openssl-library.org/news/vulnerabilities/#CVE-2015-0291
-[CVE-2015-0293]: https://openssl-library.org/news/vulnerabilities/#CVE-2015-0293
-[CVE-2015-1787]: https://openssl-library.org/news/vulnerabilities/#CVE-2015-1787
-[CVE-2015-1788]: https://openssl-library.org/news/vulnerabilities/#CVE-2015-1788
-[CVE-2015-1789]: https://openssl-library.org/news/vulnerabilities/#CVE-2015-1789
-[CVE-2015-1790]: https://openssl-library.org/news/vulnerabilities/#CVE-2015-1790
-[CVE-2015-1791]: https://openssl-library.org/news/vulnerabilities/#CVE-2015-1791
-[CVE-2015-1792]: https://openssl-library.org/news/vulnerabilities/#CVE-2015-1792
-[CVE-2015-1793]: https://openssl-library.org/news/vulnerabilities/#CVE-2015-1793
-[CVE-2015-3193]: https://openssl-library.org/news/vulnerabilities/#CVE-2015-3193
-[CVE-2015-3194]: https://openssl-library.org/news/vulnerabilities/#CVE-2015-3194
-[CVE-2015-3195]: https://openssl-library.org/news/vulnerabilities/#CVE-2015-3195
-[CVE-2015-3196]: https://openssl-library.org/news/vulnerabilities/#CVE-2015-3196
-[CVE-2015-3197]: https://openssl-library.org/news/vulnerabilities/#CVE-2015-3197
-[CVE-2016-0701]: https://openssl-library.org/news/vulnerabilities/#CVE-2016-0701
-[CVE-2016-0702]: https://openssl-library.org/news/vulnerabilities/#CVE-2016-0702
-[CVE-2016-0705]: https://openssl-library.org/news/vulnerabilities/#CVE-2016-0705
-[CVE-2016-0797]: https://openssl-library.org/news/vulnerabilities/#CVE-2016-0797
-[CVE-2016-0798]: https://openssl-library.org/news/vulnerabilities/#CVE-2016-0798
-[CVE-2016-0799]: https://openssl-library.org/news/vulnerabilities/#CVE-2016-0799
-[CVE-2016-0800]: https://openssl-library.org/news/vulnerabilities/#CVE-2016-0800
-[CVE-2016-2105]: https://openssl-library.org/news/vulnerabilities/#CVE-2016-2105
-[CVE-2016-2106]: https://openssl-library.org/news/vulnerabilities/#CVE-2016-2106
-[CVE-2016-2107]: https://openssl-library.org/news/vulnerabilities/#CVE-2016-2107
-[CVE-2016-2109]: https://openssl-library.org/news/vulnerabilities/#CVE-2016-2109
-[CVE-2016-2176]: https://openssl-library.org/news/vulnerabilities/#CVE-2016-2176
-[CVE-2016-2177]: https://openssl-library.org/news/vulnerabilities/#CVE-2016-2177
-[CVE-2016-2178]: https://openssl-library.org/news/vulnerabilities/#CVE-2016-2178
-[CVE-2016-2179]: https://openssl-library.org/news/vulnerabilities/#CVE-2016-2179
-[CVE-2016-2180]: https://openssl-library.org/news/vulnerabilities/#CVE-2016-2180
-[CVE-2016-2181]: https://openssl-library.org/news/vulnerabilities/#CVE-2016-2181
-[CVE-2016-2182]: https://openssl-library.org/news/vulnerabilities/#CVE-2016-2182
-[CVE-2016-2183]: https://openssl-library.org/news/vulnerabilities/#CVE-2016-2183
-[CVE-2016-6302]: https://openssl-library.org/news/vulnerabilities/#CVE-2016-6302
-[CVE-2016-6303]: https://openssl-library.org/news/vulnerabilities/#CVE-2016-6303
-[CVE-2016-6304]: https://openssl-library.org/news/vulnerabilities/#CVE-2016-6304
-[CVE-2016-6305]: https://openssl-library.org/news/vulnerabilities/#CVE-2016-6305
-[CVE-2016-6306]: https://openssl-library.org/news/vulnerabilities/#CVE-2016-6306
-[CVE-2016-6307]: https://openssl-library.org/news/vulnerabilities/#CVE-2016-6307
-[CVE-2016-6308]: https://openssl-library.org/news/vulnerabilities/#CVE-2016-6308
-[CVE-2016-6309]: https://openssl-library.org/news/vulnerabilities/#CVE-2016-6309
-[CVE-2016-7052]: https://openssl-library.org/news/vulnerabilities/#CVE-2016-7052
-[CVE-2016-7053]: https://openssl-library.org/news/vulnerabilities/#CVE-2016-7053
-[CVE-2016-7054]: https://openssl-library.org/news/vulnerabilities/#CVE-2016-7054
-[CVE-2016-7055]: https://openssl-library.org/news/vulnerabilities/#CVE-2016-7055
-[CVE-2017-3730]: https://openssl-library.org/news/vulnerabilities/#CVE-2017-3730
-[CVE-2017-3731]: https://openssl-library.org/news/vulnerabilities/#CVE-2017-3731
-[CVE-2017-3732]: https://openssl-library.org/news/vulnerabilities/#CVE-2017-3732
-[CVE-2017-3733]: https://openssl-library.org/news/vulnerabilities/#CVE-2017-3733
-[CVE-2017-3735]: https://openssl-library.org/news/vulnerabilities/#CVE-2017-3735
-[CVE-2017-3736]: https://openssl-library.org/news/vulnerabilities/#CVE-2017-3736
-[CVE-2017-3737]: https://openssl-library.org/news/vulnerabilities/#CVE-2017-3737
-[CVE-2017-3738]: https://openssl-library.org/news/vulnerabilities/#CVE-2017-3738
-[CVE-2018-0732]: https://openssl-library.org/news/vulnerabilities/#CVE-2018-0732
-[CVE-2018-0733]: https://openssl-library.org/news/vulnerabilities/#CVE-2018-0733
-[CVE-2018-0734]: https://openssl-library.org/news/vulnerabilities/#CVE-2018-0734
-[CVE-2018-0735]: https://openssl-library.org/news/vulnerabilities/#CVE-2018-0735
-[CVE-2018-0737]: https://openssl-library.org/news/vulnerabilities/#CVE-2018-0737
-[CVE-2018-0739]: https://openssl-library.org/news/vulnerabilities/#CVE-2018-0739
-[CVE-2018-5407]: https://openssl-library.org/news/vulnerabilities/#CVE-2018-5407
-[CVE-2019-1543]: https://openssl-library.org/news/vulnerabilities/#CVE-2019-1543
-[CVE-2019-1547]: https://openssl-library.org/news/vulnerabilities/#CVE-2019-1547
-[CVE-2019-1549]: https://openssl-library.org/news/vulnerabilities/#CVE-2019-1549
-[CVE-2019-1551]: https://openssl-library.org/news/vulnerabilities/#CVE-2019-1551
-[CVE-2019-1552]: https://openssl-library.org/news/vulnerabilities/#CVE-2019-1552
-[CVE-2019-1559]: https://openssl-library.org/news/vulnerabilities/#CVE-2019-1559
-[CVE-2019-1563]: https://openssl-library.org/news/vulnerabilities/#CVE-2019-1563
-[CVE-2020-1967]: https://openssl-library.org/news/vulnerabilities/#CVE-2020-1967
-[CVE-2020-1971]: https://openssl-library.org/news/vulnerabilities/#CVE-2020-1971
-[CVE-2022-2097]: https://openssl-library.org/news/vulnerabilities/#CVE-2022-2097
-[CVE-2022-2274]: https://openssl-library.org/news/vulnerabilities/#CVE-2022-2274
-[CVE-2022-3996]: https://openssl-library.org/news/vulnerabilities/#CVE-2022-3996
-[CVE-2022-4203]: https://openssl-library.org/news/vulnerabilities/#CVE-2022-4203
-[CVE-2022-4304]: https://openssl-library.org/news/vulnerabilities/#CVE-2022-4304
-[CVE-2022-4450]: https://openssl-library.org/news/vulnerabilities/#CVE-2022-4450
-[CVE-2023-0215]: https://openssl-library.org/news/vulnerabilities/#CVE-2023-0215
-[CVE-2023-0216]: https://openssl-library.org/news/vulnerabilities/#CVE-2023-0216
-[CVE-2023-0217]: https://openssl-library.org/news/vulnerabilities/#CVE-2023-0217
-[CVE-2023-0286]: https://openssl-library.org/news/vulnerabilities/#CVE-2023-0286
-[CVE-2023-0401]: https://openssl-library.org/news/vulnerabilities/#CVE-2023-0401
-[CVE-2023-0464]: https://openssl-library.org/news/vulnerabilities/#CVE-2023-0464
-[CVE-2023-0465]: https://openssl-library.org/news/vulnerabilities/#CVE-2023-0465
-[CVE-2023-0466]: https://openssl-library.org/news/vulnerabilities/#CVE-2023-0466
-[CVE-2023-1255]: https://openssl-library.org/news/vulnerabilities/#CVE-2023-1255
-[CVE-2023-2650]: https://openssl-library.org/news/vulnerabilities/#CVE-2023-2650
-[CVE-2023-2975]: https://openssl-library.org/news/vulnerabilities/#CVE-2023-2975
-[CVE-2023-3446]: https://openssl-library.org/news/vulnerabilities/#CVE-2023-3446
-[CVE-2023-3817]: https://openssl-library.org/news/vulnerabilities/#CVE-2023-3817
-[CVE-2023-4807]: https://openssl-library.org/news/vulnerabilities/#CVE-2023-4807
-[CVE-2023-5363]: https://openssl-library.org/news/vulnerabilities/#CVE-2023-5363
-[CVE-2023-5678]: https://openssl-library.org/news/vulnerabilities/#CVE-2023-5678
-[CVE-2023-6129]: https://openssl-library.org/news/vulnerabilities/#CVE-2023-6129
-[CVE-2023-6237]: https://openssl-library.org/news/vulnerabilities/#CVE-2023-6237
-[CVE-2024-0727]: https://openssl-library.org/news/vulnerabilities/#CVE-2024-0727
-[CVE-2024-2511]: https://openssl-library.org/news/vulnerabilities/#CVE-2024-2511
-[CVE-2024-4603]: https://openssl-library.org/news/vulnerabilities/#CVE-2024-4603
-[CVE-2024-4741]: https://openssl-library.org/news/vulnerabilities/#CVE-2024-4741
-[CVE-2024-5535]: https://openssl-library.org/news/vulnerabilities/#CVE-2024-5535
-[CVE-2024-6119]: https://openssl-library.org/news/vulnerabilities/#CVE-2024-6119
-[CVE-2024-9143]: https://openssl-library.org/news/vulnerabilities/#CVE-2024-9143
-[CVE-2024-13176]: https://openssl-library.org/news/vulnerabilities/#CVE-2024-13176
-[CVE-2025-4575]: https://openssl-library.org/news/vulnerabilities/#CVE-2025-4575
-[CVE-2025-9230]: https://openssl-library.org/news/vulnerabilities/#CVE-2025-9230
-[CVE-2025-9231]: https://openssl-library.org/news/vulnerabilities/#CVE-2025-9231
-[CVE-2025-9232]: https://openssl-library.org/news/vulnerabilities/#CVE-2025-9232
-[CVE-2025-11187]: https://openssl-library.org/news/vulnerabilities/#CVE-2025-11187
-[CVE-2025-15467]: https://openssl-library.org/news/vulnerabilities/#CVE-2025-15467
-[CVE-2025-15468]: https://openssl-library.org/news/vulnerabilities/#CVE-2025-15468
-[CVE-2025-15469]: https://openssl-library.org/news/vulnerabilities/#CVE-2025-15469
-[CVE-2025-66199]: https://openssl-library.org/news/vulnerabilities/#CVE-2025-66199
-[CVE-2025-68160]: https://openssl-library.org/news/vulnerabilities/#CVE-2025-68160
-[CVE-2025-69418]: https://openssl-library.org/news/vulnerabilities/#CVE-2025-69418
-[CVE-2025-69419]: https://openssl-library.org/news/vulnerabilities/#CVE-2025-69419
-[CVE-2025-69420]: https://openssl-library.org/news/vulnerabilities/#CVE-2025-69420
-[CVE-2025-69421]: https://openssl-library.org/news/vulnerabilities/#CVE-2025-69421
-[CVE-2026-2673]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-2673
-[CVE-2026-7383]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-7383
-[CVE-2026-9076]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-9076
-[CVE-2026-22795]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-22795
-[CVE-2026-22796]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-22796
-[CVE-2026-28386]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-28386
-[CVE-2026-28387]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-28387
-[CVE-2026-28388]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-28388
-[CVE-2026-28389]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-28389
-[CVE-2026-28390]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-28390
-[CVE-2026-31789]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-31789
-[CVE-2026-31790]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-31790
-[CVE-2026-34180]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-34180
-[CVE-2026-34181]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-34181
-[CVE-2026-34182]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-34182
-[CVE-2026-34183]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-34183
-[CVE-2026-35188]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-35188
-[CVE-2026-42764]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-42764
-[CVE-2026-42765]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-42765
-[CVE-2026-42766]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-42766
-[CVE-2026-42767]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-42767
-[CVE-2026-42768]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-42768
-[CVE-2026-42769]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-42769
-[CVE-2026-42770]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-42770
-[CVE-2026-42771]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-42771
-[CVE-2026-45445]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-45445
-[CVE-2026-45446]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-45446
-[CVE-2026-45447]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-45447
-[ESV]: https://csrc.nist.gov/Projects/cryptographic-module-validation-program/entropy-validations
+[CVE-2025-9232]: https://www.openssl.org/news/vulnerabilities.html#CVE-2025-9232
+[CVE-2025-9231]: https://www.openssl.org/news/vulnerabilities.html#CVE-2025-9231
+[CVE-2025-9230]: https://www.openssl.org/news/vulnerabilities.html#CVE-2025-9230
+[CVE-2025-4575]: https://www.openssl.org/news/vulnerabilities.html#CVE-2025-4575
+[CVE-2024-13176]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-13176
+[CVE-2024-9143]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-9143
+[CVE-2024-6119]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-6119
+[CVE-2024-5535]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-5535
+[CVE-2024-4741]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-4741
+[CVE-2024-4603]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-4603
+[CVE-2024-2511]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-2511
+[CVE-2024-0727]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-0727
+[CVE-2023-6237]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-6237
+[CVE-2023-6129]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-6129
+[CVE-2023-5678]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-5678
+[CVE-2023-5363]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-5363
+[CVE-2023-4807]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-4807
+[CVE-2023-3817]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-3817
+[CVE-2023-3446]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-3446
+[CVE-2023-2975]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-2975
+[CVE-2023-2650]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-2650
+[CVE-2023-1255]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-1255
+[CVE-2023-0466]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-0466
+[CVE-2023-0465]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-0465
+[CVE-2023-0464]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-0464
+[CVE-2023-0401]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-0401
+[CVE-2023-0286]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-0286
+[CVE-2023-0217]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-0217
+[CVE-2023-0216]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-0216
+[CVE-2023-0215]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-0215
+[CVE-2022-4450]: https://www.openssl.org/news/vulnerabilities.html#CVE-2022-4450
+[CVE-2022-4304]: https://www.openssl.org/news/vulnerabilities.html#CVE-2022-4304
+[CVE-2022-4203]: https://www.openssl.org/news/vulnerabilities.html#CVE-2022-4203
+[CVE-2022-3996]: https://www.openssl.org/news/vulnerabilities.html#CVE-2022-3996
+[CVE-2022-2274]: https://www.openssl.org/news/vulnerabilities.html#CVE-2022-2274
+[CVE-2022-2097]: https://www.openssl.org/news/vulnerabilities.html#CVE-2022-2097
+[CVE-2020-1971]: https://www.openssl.org/news/vulnerabilities.html#CVE-2020-1971
+[CVE-2020-1967]: https://www.openssl.org/news/vulnerabilities.html#CVE-2020-1967
+[CVE-2019-1563]: https://www.openssl.org/news/vulnerabilities.html#CVE-2019-1563
+[CVE-2019-1559]: https://www.openssl.org/news/vulnerabilities.html#CVE-2019-1559
+[CVE-2019-1552]: https://www.openssl.org/news/vulnerabilities.html#CVE-2019-1552
+[CVE-2019-1551]: https://www.openssl.org/news/vulnerabilities.html#CVE-2019-1551
+[CVE-2019-1549]: https://www.openssl.org/news/vulnerabilities.html#CVE-2019-1549
+[CVE-2019-1547]: https://www.openssl.org/news/vulnerabilities.html#CVE-2019-1547
+[CVE-2019-1543]: https://www.openssl.org/news/vulnerabilities.html#CVE-2019-1543
+[CVE-2018-5407]: https://www.openssl.org/news/vulnerabilities.html#CVE-2018-5407
+[CVE-2018-0739]: https://www.openssl.org/news/vulnerabilities.html#CVE-2018-0739
+[CVE-2018-0737]: https://www.openssl.org/news/vulnerabilities.html#CVE-2018-0737
+[CVE-2018-0735]: https://www.openssl.org/news/vulnerabilities.html#CVE-2018-0735
+[CVE-2018-0734]: https://www.openssl.org/news/vulnerabilities.html#CVE-2018-0734
+[CVE-2018-0733]: https://www.openssl.org/news/vulnerabilities.html#CVE-2018-0733
+[CVE-2018-0732]: https://www.openssl.org/news/vulnerabilities.html#CVE-2018-0732
+[CVE-2017-3738]: https://www.openssl.org/news/vulnerabilities.html#CVE-2017-3738
+[CVE-2017-3737]: https://www.openssl.org/news/vulnerabilities.html#CVE-2017-3737
+[CVE-2017-3736]: https://www.openssl.org/news/vulnerabilities.html#CVE-2017-3736
+[CVE-2017-3735]: https://www.openssl.org/news/vulnerabilities.html#CVE-2017-3735
+[CVE-2017-3733]: https://www.openssl.org/news/vulnerabilities.html#CVE-2017-3733
+[CVE-2017-3732]: https://www.openssl.org/news/vulnerabilities.html#CVE-2017-3732
+[CVE-2017-3731]: https://www.openssl.org/news/vulnerabilities.html#CVE-2017-3731
+[CVE-2017-3730]: https://www.openssl.org/news/vulnerabilities.html#CVE-2017-3730
+[CVE-2016-7055]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-7055
+[CVE-2016-7054]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-7054
+[CVE-2016-7053]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-7053
+[CVE-2016-7052]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-7052
+[CVE-2016-6309]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-6309
+[CVE-2016-6308]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-6308
+[CVE-2016-6307]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-6307
+[CVE-2016-6306]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-6306
+[CVE-2016-6305]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-6305
+[CVE-2016-6304]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-6304
+[CVE-2016-6303]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-6303
+[CVE-2016-6302]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-6302
+[CVE-2016-2183]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-2183
+[CVE-2016-2182]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-2182
+[CVE-2016-2181]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-2181
+[CVE-2016-2180]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-2180
+[CVE-2016-2179]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-2179
+[CVE-2016-2178]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-2178
+[CVE-2016-2177]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-2177
+[CVE-2016-2176]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-2176
+[CVE-2016-2109]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-2109
+[CVE-2016-2107]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-2107
+[CVE-2016-2106]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-2106
+[CVE-2016-2105]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-2105
+[CVE-2016-0800]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-0800
+[CVE-2016-0799]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-0799
+[CVE-2016-0798]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-0798
+[CVE-2016-0797]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-0797
+[CVE-2016-0705]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-0705
+[CVE-2016-0702]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-0702
+[CVE-2016-0701]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-0701
+[CVE-2015-3197]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-3197
+[CVE-2015-3196]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-3196
+[CVE-2015-3195]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-3195
+[CVE-2015-3194]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-3194
+[CVE-2015-3193]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-3193
+[CVE-2015-1793]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-1793
+[CVE-2015-1792]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-1792
+[CVE-2015-1791]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-1791
+[CVE-2015-1790]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-1790
+[CVE-2015-1789]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-1789
+[CVE-2015-1788]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-1788
+[CVE-2015-1787]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-1787
+[CVE-2015-0293]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-0293
+[CVE-2015-0291]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-0291
+[CVE-2015-0290]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-0290
+[CVE-2015-0289]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-0289
+[CVE-2015-0288]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-0288
+[CVE-2015-0287]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-0287
+[CVE-2015-0286]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-0286
+[CVE-2015-0285]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-0285
+[CVE-2015-0209]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-0209
+[CVE-2015-0208]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-0208
+[CVE-2015-0207]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-0207
+[CVE-2015-0206]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-0206
+[CVE-2015-0205]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-0205
+[CVE-2015-0204]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-0204
+[CVE-2014-8275]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-8275
+[CVE-2014-5139]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-5139
+[CVE-2014-3572]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3572
+[CVE-2014-3571]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3571
+[CVE-2014-3570]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3570
+[CVE-2014-3569]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3569
+[CVE-2014-3568]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3568
+[CVE-2014-3567]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3567
+[CVE-2014-3566]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3566
+[CVE-2014-3513]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3513
+[CVE-2014-3512]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3512
+[CVE-2014-3511]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3511
+[CVE-2014-3510]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3510
+[CVE-2014-3509]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3509
+[CVE-2014-3508]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3508
+[CVE-2014-3507]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3507
+[CVE-2014-3506]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3506
+[CVE-2014-3505]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3505
+[CVE-2014-3470]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3470
+[CVE-2014-0224]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-0224
+[CVE-2014-0221]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-0221
+[CVE-2014-0198]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-0198
+[CVE-2014-0195]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-0195
+[CVE-2014-0160]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-0160
+[CVE-2014-0076]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-0076
+[CVE-2013-6450]: https://www.openssl.org/news/vulnerabilities.html#CVE-2013-6450
+[CVE-2013-6449]: https://www.openssl.org/news/vulnerabilities.html#CVE-2013-6449
+[CVE-2013-4353]: https://www.openssl.org/news/vulnerabilities.html#CVE-2013-4353
+[CVE-2013-0169]: https://www.openssl.org/news/vulnerabilities.html#CVE-2013-0169
+[CVE-2013-0166]: https://www.openssl.org/news/vulnerabilities.html#CVE-2013-0166
+[CVE-2012-2686]: https://www.openssl.org/news/vulnerabilities.html#CVE-2012-2686
+[CVE-2012-2333]: https://www.openssl.org/news/vulnerabilities.html#CVE-2012-2333
+[CVE-2012-2110]: https://www.openssl.org/news/vulnerabilities.html#CVE-2012-2110
+[CVE-2012-0884]: https://www.openssl.org/news/vulnerabilities.html#CVE-2012-0884
+[CVE-2012-0050]: https://www.openssl.org/news/vulnerabilities.html#CVE-2012-0050
+[CVE-2012-0027]: https://www.openssl.org/news/vulnerabilities.html#CVE-2012-0027
+[CVE-2011-4619]: https://www.openssl.org/news/vulnerabilities.html#CVE-2011-4619
+[CVE-2011-4577]: https://www.openssl.org/news/vulnerabilities.html#CVE-2011-4577
+[CVE-2011-4576]: https://www.openssl.org/news/vulnerabilities.html#CVE-2011-4576
+[CVE-2011-4108]: https://www.openssl.org/news/vulnerabilities.html#CVE-2011-4108
+[CVE-2011-3210]: https://www.openssl.org/news/vulnerabilities.html#CVE-2011-3210
+[CVE-2011-3207]: https://www.openssl.org/news/vulnerabilities.html#CVE-2011-3207
+[CVE-2011-0014]: https://www.openssl.org/news/vulnerabilities.html#CVE-2011-0014
+[CVE-2010-5298]: https://www.openssl.org/news/vulnerabilities.html#CVE-2010-5298
+[CVE-2010-4252]: https://www.openssl.org/news/vulnerabilities.html#CVE-2010-4252
+[CVE-2010-4180]: https://www.openssl.org/news/vulnerabilities.html#CVE-2010-4180
+[CVE-2010-3864]: https://www.openssl.org/news/vulnerabilities.html#CVE-2010-3864
+[CVE-2010-2939]: https://www.openssl.org/news/vulnerabilities.html#CVE-2010-2939
+[CVE-2010-1633]: https://www.openssl.org/news/vulnerabilities.html#CVE-2010-1633
+[CVE-2010-0740]: https://www.openssl.org/news/vulnerabilities.html#CVE-2010-0740
+[CVE-2010-0433]: https://www.openssl.org/news/vulnerabilities.html#CVE-2010-0433
+[CVE-2009-3555]: https://www.openssl.org/news/vulnerabilities.html#CVE-2009-3555
+[CVE-2009-0789]: https://www.openssl.org/news/vulnerabilities.html#CVE-2009-0789
+[CVE-2009-0591]: https://www.openssl.org/news/vulnerabilities.html#CVE-2009-0591
+[CVE-2009-0590]: https://www.openssl.org/news/vulnerabilities.html#CVE-2009-0590
+[CVE-2008-5077]: https://www.openssl.org/news/vulnerabilities.html#CVE-2008-5077
+[CVE-2006-4343]: https://www.openssl.org/news/vulnerabilities.html#CVE-2006-4343
+[CVE-2006-4339]: https://www.openssl.org/news/vulnerabilities.html#CVE-2006-4339
+[CVE-2006-3737]: https://www.openssl.org/news/vulnerabilities.html#CVE-2006-3737
+[CVE-2006-2940]: https://www.openssl.org/news/vulnerabilities.html#CVE-2006-2940
+[CVE-2006-2937]: https://www.openssl.org/news/vulnerabilities.html#CVE-2006-2937
+[CVE-2005-2969]: https://www.openssl.org/news/vulnerabilities.html#CVE-2005-2969
 [OpenSSL Guide]: https://docs.openssl.org/master/man7/ossl-guide-introduction
+[CHANGES.md]: ./CHANGES.md
 [README-QUIC.md]: ./README-QUIC.md
-[RFC 7919]: https://datatracker.ietf.org/doc/html/rfc7919
-[RFC 8422]: https://datatracker.ietf.org/doc/html/rfc8422
-[RFC 8998]: https://datatracker.ietf.org/doc/html/rfc8998#name-iana-considerations
-[RFC 9849]: https://datatracker.ietf.org/doc/html/rfc9849
-[SP 800-185]: https://csrc.nist.gov/pubs/sp/800/185/final
-[SP 800-208]: https://csrc.nist.gov/pubs/sp/800/208/final
 [issue tracker]: https://github.com/openssl/openssl/issues
+[CMVP]: https://csrc.nist.gov/projects/cryptographic-module-validation-program
+[ESV]: https://csrc.nist.gov/Projects/cryptographic-module-validation-program/entropy-validations
+[SP 800-208]: https://csrc.nist.gov/pubs/sp/800/208/final
 [jitterentropy-library]: https://github.com/smuellerDD/jitterentropy-library

NOTES-C99.md

@@ -32,18 +32,4 @@ The list of C-99 features we don't support in OpenSSL project follows:
      {
          char s[n]; /* variable size array */
          ...
-     }
      ```
-
-Exit status macros (`EXIT_SUCCESS`, `EXIT_FAILURE`)
----------------------------------------------------
-
-These macros from `<stdlib.h>` represent *process* exit status.  Do not use
-them as return values from internal APIs (any function that is not `main()`).
-Use them only as the return value from `main()` or as the argument to
-`exit(3)` (or equivalent, such as `_exit()`).
-
-Elsewhere, be consistent with the rest of the codebase: return a positive
-value for success (often `1`), and `0` or a non-positive value for failure,
-or `bool` when that improves clarity.  See
-<https://github.com/openssl/openssl/issues/30562>.

NOTES-NONSTOP.md

@@ -55,6 +55,26 @@ option to `./Configure`.
 TNS/E has moved to a limited support state, so fixes for this platform will not
 be guaranteed in future.
 
+Linking and Loading Considerations
+----------------------------------
+
+Because of how the NonStop Common Runtime Environment (CRE) works, there are
+restrictions on how programs can link and load with OpenSSL libraries.
+On current NonStop platforms, programs cannot both statically link OpenSSL
+libraries and dynamically load OpenSSL shared libraries concurrently. If this
+is done, there is a high probability of encountering a SIGSEGV condition
+relating to `atexit()` processing when a shared library is unloaded and when
+the program terminates. This limitation applies to all OpenSSL shared library
+components.
+
+A control has been added as of 3.3.x to disable calls to `atexit()` within the
+`libcrypto` builds (specifically in `crypto/init.c`). This switch can be
+controlled using `disable-atexit` or `enable-atexit`, and is disabled by default
+for NonStop builds. If you need to have `atexit()` functionality, set
+`enabled-atexit` when configuring OpenSSL to enable the `atexit()` call to
+register `OPENSSL_cleanup()` automatically. Preferably, you can explicitly call
+`OPENSSL_cleanup()` from your application.
+
 Secure Memory
 -------------
 
@@ -167,7 +187,7 @@ the following variables. The following set of compiler defines are required:
 ### Optional Build Variables
 
     DBGFLAG="--debug"
-    CIPHENABLES="enable-weak-ssl-ciphers enable-rc4"
+    CIPHENABLES="enable-ssl3 enable-ssl3-method enable-weak-ssl-ciphers enable-rc4"
 
 ### Internal Known TNS/X to TNS/E Cross Compile Variables
 

NOTES-VALGRIND.md

@@ -70,76 +70,3 @@ with the `VERBOSE` or `VF` or `VFP` options to gather additional information.
 
     $ make test VERBOSE=1 TESTS=test_test EXE_SHELL="$(/bin/pwd)/util/wrap.pl \
        valgrind --error-exitcode=1 --leak-check=full -q" OPENSSL_ia32cap=":0"
-
-Still reachable memory
-======================
-
-OpenSSL 4.0 no longer arms `OPENSSL_cleanup()` function as an `atexit(3)`
-handler. So, unless the application explicitly calls `OPENSSL_cleanup()`, valgrind and
-similar memory leak detectors may report `still reachable` memory blocks
-as memory leaks. An example of a valgrind report reads as follows:
-
-    # valgrind ./pkeyread -f pem -k dh 8
-    ==280439== Memcheck, a memory error detector
-    ==280439== Copyright (C) 2002-2024, and GNU GPL'd, by Julian Seward et al.
-    ==280439== Using Valgrind-3.24.0 and LibVEX; rerun with -h for copyright info
-    ==280439== Command: ./pkeyread -f pem -k dh 8
-    ==280439==
-    Average time per pem(dh) call: 506329.113924us
-    ==280439==
-    ==280439== HEAP SUMMARY:
-    ==280439==     in use at exit: 239,521 bytes in 4,137 blocks
-    ==280439==   total heap usage: 21,841 allocs, 17,704 frees, 4,089,104 bytes allocated
-    ==280439==
-    ==280439== LEAK SUMMARY:
-    ==280439==    definitely lost: 0 bytes in 0 blocks
-    ==280439==    indirectly lost: 0 bytes in 0 blocks
-    ==280439==      possibly lost: 0 bytes in 0 blocks
-    ==280439==    still reachable: 239,521 bytes in 4,137 blocks
-    ==280439==         suppressed: 0 bytes in 0 blocks
-    ==280439== Rerun with --leak-check=full to see details of leaked memory
-    ==280439==
-    ==280439== For lists of detected and suppressed errors, rerun with: -s
-    ==280439== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)
-
-The valgrind output above reports there are 239,521 of reachable memory
-when process exits. That memory is not regarded as a true memory leak
-as the OS will reclaim that memory on process exit, rendering calls to libc
-`free()` within `OPENSSL_cleanup()` useless. Also calling `OPENSSL_cleanup()`
-is discouraged when libcrypto is being linked with process to satisfy more
-than one dependency paths. If it is the case then calling `OPENSSL_cleanup()`
-may lead to spurious application crashes during exit.
-
-If memory leaks caused by _still reachable memory_ are still an issue,
-then preferred way is to suppress those reports using the suppression
-file [1] instead of changing exiting code by adding a call to `OPENSSL_cleanup()`.
-The suppression file for OpenSSL is shipped within the OpenSSL sources and
-can be found at`$OPENSSL_SRCS/util/valgrind.suppressions` where `OPENSSL_SRCS`
-is an environment variable containing path to the OpenSSL source
-tree. To use it, just add `--suppressions` option to the valgrind command:
-`valgrind --suppressions="$OPENSSL_SRCS/util/valgrind.suppression" ...`
-For `pkeyread` the command and output reads as follows:
-
-    # valgrind --suppressions=$OPENSSL_SRCS/util/valgrind.suppression  ./pkeyread -f pem -k dh 8
-    ==280896== Memcheck, a memory error detector
-    ==280896== Copyright (C) 2002-2024, and GNU GPL'd, by Julian Seward et al.
-    ==280896== Using Valgrind-3.24.0 and LibVEX; rerun with -h for copyright info
-    ==280896== Command: ./pkeyread -f pem -k dh 8
-    ==280896==
-    Average time per pem(dh) call: 476190.476190us
-    ==280896==
-    ==280896== HEAP SUMMARY:
-    ==280896==     in use at exit: 239,521 bytes in 4,137 blocks
-    ==280896==   total heap usage: 22,816 allocs, 18,679 frees, 4,325,714 bytes allocated
-    ==280896==
-    ==280896== LEAK SUMMARY:
-    ==280896==    definitely lost: 0 bytes in 0 blocks
-    ==280896==    indirectly lost: 0 bytes in 0 blocks
-    ==280896==      possibly lost: 0 bytes in 0 blocks
-    ==280896==    still reachable: 0 bytes in 0 blocks
-    ==280896==         suppressed: 239,521 bytes in 4,137 blocks
-    ==280896==
-    ==280896== For lists of detected and suppressed errors, rerun with: -s
-    ==280896== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)
-
-[1] <https://valgrind.org/docs/manual/manual-core.html#manual-core.suppress>

NOTES-WINDOWS.md

@@ -7,8 +7,6 @@ Notes for Windows platforms
  - [Native builds using MinGW](#native-builds-using-mingw)
  - [Linking native applications](#linking-native-applications)
  - [Hosted builds using Cygwin](#hosted-builds-using-cygwin)
- - [Hosted builds using Windows Subsystem for Linux (WSL)](
-   #hosted-builds-using-windows-subsystem-for-linux-wsl)
 
 There are various options to build and run OpenSSL on the Windows platforms.
 
@@ -25,7 +23,7 @@ or
 
 "Hosted" OpenSSL relies on an external POSIX compatibility layer
 for building (using GNU/Unix shell, compiler, and tools) and at run time.
-For this option, you can use Cygwin or the Windows Subsystem for Linux (WSL).
+For this option, you can use Cygwin.
 
 Native builds using Visual C++
 ==============================
@@ -94,13 +92,6 @@ Quick start
        dependency feature can speed up build times by up to 50%:
        `perl Configure no-makedepend`
 
-    b. If you want the OpenSSL binaries to be "self contained", usable on any
-       computer running MS Windows, use 'perl Configure enable-static-vcruntime'.
-       Otherwise, build will produce binaries that depend on the VC runtime
-       libraries being installed and available, and will not work on computers
-       that do not have them.  (This option adds 1 MB to the total size of the
-       two dll's.)
-
  6. `nmake`
 
  7. `nmake test`
@@ -296,71 +287,3 @@ NOTE: `make test` and normal file operations may fail in directories
 mounted as text (i.e. `mount -t c:\somewhere /home`) due to Cygwin
 stripping of carriage returns. To avoid this, ensure that a binary
 mount is used, e.g. `mount -b c:\somewhere /home`.
-
-Hosted builds using Windows Subsystem for Linux (WSL)
-======================================================
-
-WSL provides a Linux-compatible environment directly on Windows, allowing
-OpenSSL to be built using standard GNU/Unix tools. The resulting OpenSSL
-runs within the WSL environment and relies on the WSL compatibility layer
-at run time.
-
- 1. Install WSL and a Linux distribution (e.g. Ubuntu), see
-    <https://learn.microsoft.com/windows/wsl/install>
-
- 2. Ensure your distribution is up to date:
-
-        sudo apt update && sudo apt upgrade
-
- 3. Install the required build dependencies. On Debian/Ubuntu-based
-    distributions:
-
-        sudo apt install build-essential perl make
-
- 4. Optionally install the NASM assembler for optimised assembly routines:
-
-        sudo apt install nasm
-
- 5. Run the WSL shell (e.g. Ubuntu) from the Start menu or by running
-    `wsl` from a Windows command prompt
-
- 6. From the root of the OpenSSL source directory, configure the build:
-
-        ./Configure
-
-    or specify a prefix and openssldir explicitly:
-
-        ./Configure --prefix=/usr/local/ssl --openssldir=/usr/local/ssl
-
- 7. Build, test, and install:
-
-        make
-        make test
-        make install
-
-Apart from the setup steps above, follow the Unix / Linux instructions
-in INSTALL.md and the shared library path guidance in NOTES-UNIX.md.
-
-NOTE: The OpenSSL source tree should reside on the Linux filesystem
-(e.g. under `~/`) rather than on a mounted Windows path such as
-`/mnt/c/`. Building from a mounted Windows path can result in
-significantly slower build times and occasional failures due to
-filesystem permission and interoperability differences between NTFS
-and the Linux layer. If your source is on the Windows filesystem,
-copy it into the WSL home directory first:
-
-    cp -r /mnt/c/path/to/openssl ~/openssl
-
-NOTE: If you do build from a mounted Windows path (e.g. /mnt/c/), be aware
-that Windows line endings (CRLF) in source or script files can cause
-configure and build scripts to fail. In this case, run dos2unix on the
-affected files before building:
-
-    dos2unix Configure   # removes all \r (carriage return) characters
-    dos2unix config      # does the same, but for the config script
-    dos2unix *.sh        # runs dos2unix on all shell scripts in the directory,
-                         # ensuring every .sh file has correct Unix line endings
-
-dos2unix can be installed via:
-
-    sudo apt install dos2unix

README-FIPS.md

@@ -109,19 +109,19 @@ which versions are FIPS validated. For this example we use OpenSSL 3.1.2.
 Download and build the latest release of OpenSSL
 ------------------------------------------------
 
-We use OpenSSL 3.6.0 here, (but you could also use the latest 3.6.X)
+We use OpenSSL 3.5.0 here, (but you could also use the latest 3.5.X)
 
-    $ wget https://www.openssl.org/source/openssl-3.6.0.tar.gz
-    $ tar -xf openssl-3.6.0.tar.gz
-    $ cd openssl-3.6.0
+    $ wget https://www.openssl.org/source/openssl-3.5.0.tar.gz
+    $ tar -xf openssl-3.5.0.tar.gz
+    $ cd openssl-3.5.0
     $ ./Configure enable-fips
     $ make
 
 Use the OpenSSL FIPS provider for testing
 -----------------------------------------
 
-We do this by replacing the artifact for the OpenSSL 3.6.0 FIPS provider.
-Note that the OpenSSL 3.6.0 FIPS provider has not been validated
+We do this by replacing the artifact for the OpenSSL 3.5.0 FIPS provider.
+Note that the OpenSSL 3.5.0 FIPS provider has not been validated
 so it must not be used for FIPS purposes.
 
     $ cp ../openssl-3.1.2/providers/fips.so providers/.
@@ -147,7 +147,7 @@ Copy the FIPS provider artifacts (`fips.so` & `fipsmodule.cnf`) to known locatio
 Check that the correct FIPS provider is being used
 --------------------------------------------------
 
-    $ cd ../openssl-3.6.0
+    $ cd ../openssl-3.5.0
     $./util/wrap.pl -fips apps/openssl list -provider-path providers \
     -provider fips -providers
 
@@ -155,7 +155,7 @@ Check that the correct FIPS provider is being used
     Providers:
       base
         name: OpenSSL Base Provider
-        version: 3.6.0
+        version: 3.5.0
         status: active
       fips
         name: OpenSSL FIPS Provider

README.md

@@ -49,7 +49,7 @@ The OpenSSL toolkit includes:
   basis of the TLS implementation, but can also be used independently.
 
 - **openssl**
-  the OpenSSL command line tool, a Swiss Army knife for cryptographic tasks,
+  the OpenSSL command line tool, a swiss army knife for cryptographic tasks,
   testing and analyzing. It can be used for
   - creation of key parameters
   - creation of X.509 certificates, CSRs and CRLs
@@ -150,10 +150,10 @@ The manual pages for the master branch and all current stable releases are
 available online.
 
 - [OpenSSL master](https://docs.openssl.org/master/)
-- [OpenSSL 4.0](https://docs.openssl.org/4.0/)
-- [OpenSSL 3.6](https://docs.openssl.org/3.6/)
 - [OpenSSL 3.5](https://docs.openssl.org/3.5/)
 - [OpenSSL 3.4](https://docs.openssl.org/3.4/)
+- [OpenSSL 3.3](https://docs.openssl.org/3.3/)
+- [OpenSSL 3.2](https://docs.openssl.org/3.2/)
 - [OpenSSL 3.0](https://docs.openssl.org/3.0/)
 
 Demos
@@ -198,7 +198,7 @@ attempting to develop or distribute cryptographic code.
 Copyright
 =========
 
-Copyright (c) 1998-2026 The OpenSSL Project Authors
+Copyright (c) 1998-2025 The OpenSSL Project Authors
 
 Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson
 

VERSION.dat

@@ -1,5 +1,5 @@
 MAJOR=4
-MINOR=1
+MINOR=0
 PATCH=0
 PRE_RELEASE_TAG=dev
 BUILD_METADATA=

VMS/VMSify-conf.pl

@@ -10,7 +10,7 @@
 use strict;
 use warnings;
 
-my @directory_vars = ( "dir", "certs", "new_certs_dir" );
+my @directory_vars = ( "dir", "certs", "crl_dir", "new_certs_dir" );
 my @file_vars = ( "database", "certificate", "serial", "crlnumber",
 		  "crl", "private_key", "RANDFILE" );
 while(<STDIN>) {

VMS/openssl_utils.com.in

@@ -5,3 +5,10 @@ $	v    := {- sprintf "%02d", split(/\./, $config{version}) -}
 $
 $	OPENSSL'v'	:== $OSSL$EXE:OPENSSL'v'
 $	OPENSSL		:== $OSSL$EXE:OPENSSL'v'
+$
+$	IF F$TYPE(PERL) .EQS. "STRING"
+$	THEN
+$	    C_REHASH	:== 'PERL' OSSL$EXE:c_rehash.pl
+$	ELSE
+$	    WRITE SYS$ERROR "NOTE: no perl => no C_REHASH"
+$	ENDIF

apps/asn1parse.c

@@ -1,5 +1,5 @@
 /*
- * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -82,9 +82,8 @@ int asn1parse_main(int argc, char **argv)
     const unsigned char *ctmpbuf;
     int indent = 0, noout = 0, dump = 0, informat = FORMAT_PEM;
     int offset = 0, ret = 1, i, j;
-    long num;
-    size_t tmplen;
-    const unsigned char *tmpbuf;
+    long num, tmplen;
+    unsigned char *tmpbuf;
     unsigned int length = 0;
     OPTION_CHOICE o;
     const ASN1_ITEM *it = NULL;
@@ -193,7 +192,7 @@ int asn1parse_main(int argc, char **argv)
         goto end;
     if (genconf == NULL && genstr == NULL && informat == FORMAT_PEM) {
         if (PEM_read_bio(in, &name, &header, &str, &num) != 1) {
-            BIO_puts(bio_err, "Error reading PEM file\n");
+            BIO_printf(bio_err, "Error reading PEM file\n");
             ERR_print_errors(bio_err);
             goto end;
         }
@@ -242,12 +241,12 @@ int asn1parse_main(int argc, char **argv)
 
     if (sk_OPENSSL_STRING_num(osk)) {
         tmpbuf = str;
-        tmplen = (size_t)num;
+        tmplen = num;
         for (i = 0; i < sk_OPENSSL_STRING_num(osk); i++) {
             ASN1_TYPE *atmp;
             int typ;
             j = strtol(sk_OPENSSL_STRING_value(osk, i), NULL, 0);
-            if (j <= 0 || (size_t)j >= tmplen) {
+            if (j <= 0 || j >= tmplen) {
                 BIO_printf(bio_err, "'%s' is out of range\n",
                     sk_OPENSSL_STRING_value(osk, i));
                 continue;
@@ -256,10 +255,10 @@ int asn1parse_main(int argc, char **argv)
             tmplen -= j;
             atmp = at;
             ctmpbuf = tmpbuf;
-            at = d2i_ASN1_TYPE(NULL, &ctmpbuf, (long)tmplen);
+            at = d2i_ASN1_TYPE(NULL, &ctmpbuf, tmplen);
             ASN1_TYPE_free(atmp);
             if (!at) {
-                BIO_puts(bio_err, "Error parsing structure\n");
+                BIO_printf(bio_err, "Error parsing structure\n");
                 ERR_print_errors(bio_err);
                 goto end;
             }
@@ -272,21 +271,15 @@ int asn1parse_main(int argc, char **argv)
                 goto end;
             }
             /* hmm... this is a little evil but it works */
-            tmpbuf = ASN1_STRING_get0_data(at->value.asn1_string);
-            tmplen = ASN1_STRING_length_ex(at->value.asn1_string);
-            if (tmplen > INT_MAX) {
-                BIO_puts(bio_err, "ASN.1 string length exceeds INT_MAX\n");
-                ERR_print_errors(bio_err);
-                goto end;
-            }
+            tmpbuf = at->value.asn1_string->data;
+            tmplen = at->value.asn1_string->length;
         }
-        /* XXX casts away const */
-        str = (unsigned char *)tmpbuf;
-        num = (int)tmplen;
+        str = tmpbuf;
+        num = tmplen;
     }
 
     if (offset < 0 || offset >= num) {
-        BIO_puts(bio_err, "Error: offset out of range\n");
+        BIO_printf(bio_err, "Error: offset out of range\n");
         goto end;
     }
 
@@ -296,7 +289,7 @@ int asn1parse_main(int argc, char **argv)
         length = (unsigned int)num;
     if (derout != NULL) {
         if (BIO_write(derout, str + offset, length) != (int)length) {
-            BIO_puts(bio_err, "Error writing output\n");
+            BIO_printf(bio_err, "Error writing output\n");
             ERR_print_errors(bio_err);
             goto end;
         }

apps/build.info

@@ -18,7 +18,6 @@ $OPENSSLSRC=\
         pkcs8.c pkey.c pkeyparam.c pkeyutl.c prime.c rand.c req.c \
         s_client.c s_server.c s_time.c sess_id.c skeyutl.c smime.c speed.c \
         spkac.c verify.c version.c x509.c rehash.c storeutl.c \
-        ech.c \
         list.c info.c fipsinstall.c pkcs12.c
 IF[{- !$disabled{'ec'} -}]
   $OPENSSLSRC=$OPENSSLSRC ec.c ecparam.c

apps/ca.c

@@ -1,5 +1,5 @@
 /*
- * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -25,8 +25,6 @@
 #include <openssl/ocsp.h>
 #include <openssl/pem.h>
 
-#include <crypto/asn1.h>
-
 #ifndef W_OK
 #ifdef OPENSSL_SYS_VMS
 #include <unistd.h>
@@ -72,6 +70,7 @@
 #define ENV_POLICY "policy"
 #define ENV_EXTENSIONS "x509_extensions"
 #define ENV_CRLEXT "crl_extensions"
+#define ENV_MSIE_HACK "msie_hack"
 #define ENV_NAMEOPT "name_opt"
 #define ENV_CERTOPT "cert_opt"
 #define ENV_EXTCOPY "copy_extensions"
@@ -142,6 +141,7 @@ static void write_new_certificate(BIO *bp, X509 *x, int output_der, int notext);
 
 static CONF *extfile_conf = NULL;
 static int preserve = 0;
+static int msie_hack = 0;
 
 typedef enum OPTION_choice {
     OPT_COMMON,
@@ -176,6 +176,7 @@ typedef enum OPTION_choice {
     OPT_PRESERVEDN,
     OPT_NOEMAILDN,
     OPT_GENCRL,
+    OPT_MSIE_HACK,
     OPT_CRL_LASTUPDATE,
     OPT_CRL_NEXTUPDATE,
     OPT_CRLDAYS,
@@ -220,6 +221,8 @@ const OPTIONS ca_options[] = {
     { "dateopt", OPT_DATEOPT, 's', "Datetime format used for printing. (rfc_822/iso_8601). Default is rfc_822." },
     { "notext", OPT_NOTEXT, '-', "Do not print the generated certificate" },
     { "batch", OPT_BATCH, '-', "Don't ask questions" },
+    { "msie_hack", OPT_MSIE_HACK, '-',
+        "msie modifications to handle all Universal Strings" },
     { "ss_cert", OPT_SS_CERT, '<', "File contains a self signed cert to sign" },
     { "spkac", OPT_SPKAC, '<',
         "File contains DN and signed public key and challenge" },
@@ -408,7 +411,7 @@ int ca_main(int argc, char **argv)
             enddate = opt_arg();
             break;
         case OPT_DAYS:
-            days = opt_int_arg();
+            days = atoi(opt_arg());
             break;
         case OPT_MD:
             dgst = opt_arg();
@@ -477,6 +480,9 @@ int ca_main(int argc, char **argv)
         case OPT_GENCRL:
             gencrl = 1;
             break;
+        case OPT_MSIE_HACK:
+            msie_hack = 1;
+            break;
         case OPT_CRL_LASTUPDATE:
             crl_lastupdate = opt_arg();
             break;
@@ -617,7 +623,7 @@ end_of_options:
     if (passin == NULL) {
         free_passin = 1;
         if (!app_passwd(passinarg, NULL, &passin, NULL)) {
-            BIO_puts(bio_err, "Error getting password\n");
+            BIO_printf(bio_err, "Error getting password\n");
             goto end;
         }
     }
@@ -639,7 +645,7 @@ end_of_options:
             goto end;
 
         if (!X509_check_private_key(x509, pkey)) {
-            BIO_puts(bio_err,
+            BIO_printf(bio_err,
                 "CA certificate and CA private key do not match\n");
             goto end;
         }
@@ -650,6 +656,9 @@ end_of_options:
     f = app_conf_try_string(conf, BASE_SECTION, ENV_PRESERVE);
     if (f != NULL && (*f == 'y' || *f == 'Y'))
         preserve = 1;
+    f = app_conf_try_string(conf, BASE_SECTION, ENV_MSIE_HACK);
+    if (f != NULL && (*f == 'y' || *f == 'Y'))
+        msie_hack = 1;
 
     f = app_conf_try_string(conf, section, ENV_NAMEOPT);
     if (f != NULL) {
@@ -683,7 +692,7 @@ end_of_options:
 
         outdir = NCONF_get_string(conf, section, ENV_NEW_CERTS_DIR);
         if (outdir == NULL) {
-            BIO_puts(bio_err,
+            BIO_printf(bio_err,
                 "there needs to be defined a directory for new certificate to be placed in\n");
             goto end;
         }
@@ -756,7 +765,7 @@ end_of_options:
         TXT_DB_write(bio_out, db->db);
         BIO_printf(bio_err, "%d entries loaded from the database\n",
             sk_OPENSSL_PSTRING_num(db->db->data));
-        BIO_puts(bio_err, "generating index\n");
+        BIO_printf(bio_err, "generating index\n");
     }
 
     if (index_index(db) <= 0)
@@ -770,11 +779,11 @@ end_of_options:
 
         i = do_updatedb(db, NULL);
         if (i == -1) {
-            BIO_puts(bio_err, "Malloc failure\n");
+            BIO_printf(bio_err, "Malloc failure\n");
             goto end;
         } else if (i == 0) {
             if (verbose)
-                BIO_puts(bio_err, "No entries found to mark expired\n");
+                BIO_printf(bio_err, "No entries found to mark expired\n");
         } else {
             if (!save_index(dbfile, "new", db))
                 goto end;
@@ -871,8 +880,11 @@ end_of_options:
             X509V3_CTX ctx;
 
             X509V3_set_ctx_test(&ctx);
-            if (!do_EXT_add_nconf(extfile_conf, extfile_conf, &ctx, NULL,
-                    "Error checking certificate extensions from extfile section %s\n", extensions)) {
+            X509V3_set_nconf(&ctx, extfile_conf);
+            if (!X509V3_EXT_add_nconf(extfile_conf, &ctx, extensions, NULL)) {
+                BIO_printf(bio_err,
+                    "Error checking certificate extensions from extfile section %s\n",
+                    extensions);
                 ret = 1;
                 goto end;
             }
@@ -888,8 +900,11 @@ end_of_options:
                 X509V3_CTX ctx;
 
                 X509V3_set_ctx_test(&ctx);
-                if (!do_EXT_add_nconf(conf, conf, &ctx, NULL,
-                        "Error checking certificate extension config section %s\n", extensions)) {
+                X509V3_set_nconf(&ctx, conf);
+                if (!X509V3_EXT_add_nconf(conf, &ctx, extensions, NULL)) {
+                    BIO_printf(bio_err,
+                        "Error checking certificate extension config section %s\n",
+                        extensions);
                     ret = 1;
                     goto end;
                 }
@@ -905,27 +920,27 @@ end_of_options:
                 days = 0;
         }
         if (enddate == NULL && days == 0) {
-            BIO_puts(bio_err, "cannot lookup how many days to certify for\n");
+            BIO_printf(bio_err, "cannot lookup how many days to certify for\n");
             goto end;
         }
         if (days != 0 && enddate != NULL)
-            BIO_puts(bio_err,
+            BIO_printf(bio_err,
                 "Warning: -enddate or -not_after option overriding -days option\n");
 
         if (rand_ser) {
             if ((serial = BN_new()) == NULL || !rand_serial(serial, NULL)) {
-                BIO_puts(bio_err, "error generating serial number\n");
+                BIO_printf(bio_err, "error generating serial number\n");
                 goto end;
             }
         } else {
             serial = load_serial(serialfile, NULL, create_ser, NULL);
             if (serial == NULL) {
-                BIO_puts(bio_err, "error while loading serial number\n");
+                BIO_printf(bio_err, "error while loading serial number\n");
                 goto end;
             }
             if (verbose) {
                 if (BN_is_zero(serial)) {
-                    BIO_puts(bio_err, "next serial number is 00\n");
+                    BIO_printf(bio_err, "next serial number is 00\n");
                 } else {
                     if ((f = BN_bn2hex(serial)) == NULL)
                         goto end;
@@ -941,7 +956,7 @@ end_of_options:
         }
 
         if ((cert_sk = sk_X509_new_null()) == NULL) {
-            BIO_puts(bio_err, "Memory allocation failure\n");
+            BIO_printf(bio_err, "Memory allocation failure\n");
             goto end;
         }
         if (spkac_file != NULL) {
@@ -955,11 +970,11 @@ end_of_options:
                 goto end;
             if (j > 0) {
                 total_done++;
-                BIO_puts(bio_err, "\n");
+                BIO_printf(bio_err, "\n");
                 if (!BN_add_word(serial, 1))
                     goto end;
                 if (!sk_X509_push(cert_sk, x)) {
-                    BIO_puts(bio_err, "Memory allocation failure\n");
+                    BIO_printf(bio_err, "Memory allocation failure\n");
                     goto end;
                 }
             }
@@ -976,11 +991,11 @@ end_of_options:
                 goto end;
             if (j > 0) {
                 total_done++;
-                BIO_puts(bio_err, "\n");
+                BIO_printf(bio_err, "\n");
                 if (!BN_add_word(serial, 1))
                     goto end;
                 if (!sk_X509_push(cert_sk, x)) {
-                    BIO_puts(bio_err, "Memory allocation failure\n");
+                    BIO_printf(bio_err, "Memory allocation failure\n");
                     goto end;
                 }
             }
@@ -996,11 +1011,11 @@ end_of_options:
                 goto end;
             if (j > 0) {
                 total_done++;
-                BIO_puts(bio_err, "\n");
+                BIO_printf(bio_err, "\n");
                 if (!BN_add_word(serial, 1))
                     goto end;
                 if (!sk_X509_push(cert_sk, x)) {
-                    BIO_puts(bio_err, "Memory allocation failure\n");
+                    BIO_printf(bio_err, "Memory allocation failure\n");
                     goto end;
                 }
             }
@@ -1017,13 +1032,13 @@ end_of_options:
                 goto end;
             if (j > 0) {
                 total_done++;
-                BIO_puts(bio_err, "\n");
+                BIO_printf(bio_err, "\n");
                 if (!BN_add_word(serial, 1)) {
                     X509_free(x);
                     goto end;
                 }
                 if (!sk_X509_push(cert_sk, x)) {
-                    BIO_puts(bio_err, "Memory allocation failure\n");
+                    BIO_printf(bio_err, "Memory allocation failure\n");
                     X509_free(x);
                     goto end;
                 }
@@ -1042,12 +1057,12 @@ end_of_options:
                 (void)BIO_flush(bio_err);
                 tmp[0] = '\0';
                 if (fgets(tmp, sizeof(tmp), stdin) == NULL) {
-                    BIO_puts(bio_err, "CERTIFICATION CANCELED: I/O error\n");
+                    BIO_printf(bio_err, "CERTIFICATION CANCELED: I/O error\n");
                     ret = 0;
                     goto end;
                 }
                 if (tmp[0] != 'y' && tmp[0] != 'Y') {
-                    BIO_puts(bio_err, "CERTIFICATION CANCELED\n");
+                    BIO_printf(bio_err, "CERTIFICATION CANCELED\n");
                     ret = 0;
                     goto end;
                 }
@@ -1070,26 +1085,26 @@ end_of_options:
 #endif
 
         if (verbose)
-            BIO_puts(bio_err, "writing new certificates\n");
+            BIO_printf(bio_err, "writing new certificates\n");
 
         for (i = 0; i < sk_X509_num(cert_sk); i++) {
             BIO *Cout = NULL;
             X509 *xi = sk_X509_value(cert_sk, i);
             const ASN1_INTEGER *serialNumber = X509_get0_serialNumber(xi);
             const unsigned char *psn = ASN1_STRING_get0_data(serialNumber);
-            const size_t snl = ASN1_STRING_length_ex(serialNumber);
-            const size_t filen_len = 2 * (snl > 0 ? snl : 1) + sizeof(".pem");
+            const int snl = ASN1_STRING_length(serialNumber);
+            const int filen_len = 2 * (snl > 0 ? snl : 1) + sizeof(".pem");
             char *n = new_cert + outdirlen;
 
             if (outdirlen + filen_len > PATH_MAX) {
-                BIO_puts(bio_err, "certificate file name too long\n");
+                BIO_printf(bio_err, "certificate file name too long\n");
                 goto end;
             }
 
             if (snl > 0) {
                 static const char HEX_DIGITS[] = "0123456789ABCDEF";
 
-                for (j = 0; (size_t)j < snl; j++, psn++) {
+                for (j = 0; j < snl; j++, psn++) {
                     *n++ = HEX_DIGITS[*psn >> 4];
                     *n++ = HEX_DIGITS[*psn & 0x0F];
                 }
@@ -1131,7 +1146,7 @@ end_of_options:
             if (!rotate_index(dbfile, "new", "old"))
                 goto end;
 
-            BIO_puts(bio_err, "Database updated\n");
+            BIO_printf(bio_err, "Database updated\n");
         }
     }
 
@@ -1146,8 +1161,10 @@ end_of_options:
             X509V3_CTX ctx;
 
             X509V3_set_ctx_test(&ctx);
-            if (!do_EXT_add_nconf(conf, conf, &ctx, NULL,
-                    "Error checking CRL extension section %s\n", crl_ext)) {
+            X509V3_set_nconf(&ctx, conf);
+            if (!X509V3_EXT_add_nconf(conf, &ctx, crl_ext, NULL)) {
+                BIO_printf(bio_err,
+                    "Error checking CRL extension section %s\n", crl_ext);
                 ret = 1;
                 goto end;
             }
@@ -1157,7 +1174,7 @@ end_of_options:
         if (crlnumberfile != NULL) {
             if ((crlnumber = load_serial(crlnumberfile, NULL, 0, NULL))
                 == NULL) {
-                BIO_puts(bio_err, "error while loading CRL number\n");
+                BIO_printf(bio_err, "error while loading CRL number\n");
                 goto end;
             }
         }
@@ -1171,13 +1188,13 @@ end_of_options:
                 crlhours = 0;
         }
         if ((crl_nextupdate == NULL) && (crldays == 0) && (crlhours == 0) && (crlsec == 0)) {
-            BIO_puts(bio_err,
+            BIO_printf(bio_err,
                 "cannot lookup how long until the next CRL is issued\n");
             goto end;
         }
 
         if (verbose)
-            BIO_puts(bio_err, "making CRL\n");
+            BIO_printf(bio_err, "making CRL\n");
         if ((crl = X509_CRL_new_ex(app_get0_libctx(), app_get0_propq())) == NULL)
             goto end;
         if (!X509_CRL_set_issuer_name(crl, X509_get_subject_name(x509)))
@@ -1226,7 +1243,7 @@ end_of_options:
 
         /* we now have a CRL */
         if (verbose)
-            BIO_puts(bio_err, "signing CRL\n");
+            BIO_printf(bio_err, "signing CRL\n");
 
         /* Add any extensions asked for */
 
@@ -1236,11 +1253,12 @@ end_of_options:
             X509V3_set_ctx(&crlctx, x509, NULL, NULL, crl, 0);
             X509V3_set_nconf(&crlctx, conf);
 
-            if (crl_ext != NULL && !X509V3_EXT_CRL_add_nconf(conf, &crlctx, crl_ext, crl)) {
-                BIO_printf(bio_err,
-                    "Error adding CRL extensions from section %s\n", crl_ext);
-                goto end;
-            }
+            if (crl_ext != NULL)
+                if (!X509V3_EXT_CRL_add_nconf(conf, &crlctx, crl_ext, crl)) {
+                    BIO_printf(bio_err,
+                        "Error adding CRL extensions from section %s\n", crl_ext);
+                    goto end;
+                }
             if (crlnumberfile != NULL) {
                 tmpser = BN_to_ASN1_INTEGER(crlnumber, NULL);
                 if (!tmpser)
@@ -1283,7 +1301,7 @@ end_of_options:
     /*****************************************************************/
     if (dorevoke) {
         if (infile == NULL) {
-            BIO_puts(bio_err, "no input files\n");
+            BIO_printf(bio_err, "no input files\n");
             goto end;
         } else {
             X509 *revcert;
@@ -1305,7 +1323,7 @@ end_of_options:
             if (!rotate_index(dbfile, "new", "old"))
                 goto end;
 
-            BIO_puts(bio_err, "Database updated\n");
+            BIO_printf(bio_err, "Database updated\n");
         }
     }
     ret = 0;
@@ -1363,31 +1381,31 @@ static int certify(X509 **xret, const char *infile, int informat,
     if (req == NULL)
         goto end;
     if ((pktmp = X509_REQ_get0_pubkey(req)) == NULL) {
-        BIO_puts(bio_err, "Error unpacking public key\n");
+        BIO_printf(bio_err, "Error unpacking public key\n");
         goto end;
     }
     if (verbose)
         X509_REQ_print_ex(bio_err, req, nameopt, X509_FLAG_COMPAT);
 
-    BIO_puts(bio_err, "Check that the request matches the signature\n");
+    BIO_printf(bio_err, "Check that the request matches the signature\n");
     ok = 0;
 
     if (selfsign && !X509_REQ_check_private_key(req, pkey)) {
-        BIO_puts(bio_err,
+        BIO_printf(bio_err,
             "Certificate request and CA private key do not match\n");
         goto end;
     }
     i = do_X509_REQ_verify(req, pktmp, vfyopts);
     if (i < 0) {
-        BIO_puts(bio_err, "Signature verification problems...\n");
+        BIO_printf(bio_err, "Signature verification problems...\n");
         goto end;
     }
     if (i == 0) {
-        BIO_puts(bio_err,
+        BIO_printf(bio_err,
             "Signature did not match the certificate request\n");
         goto end;
     }
-    BIO_puts(bio_err, "Signature ok\n");
+    BIO_printf(bio_err, "Signature ok\n");
 
     ok = do_body(xret, pkey, x509, dgst, sigopts, policy, db, serial, subj,
         chtype, multirdn, email_dn, startdate, enddate, days, batch,
@@ -1424,24 +1442,24 @@ static int certify_cert(X509 **xret, const char *infile, int certformat,
     if (verbose)
         X509_print(bio_err, template_cert);
 
-    BIO_puts(bio_err, "Check that the request matches the signature\n");
+    BIO_printf(bio_err, "Check that the request matches the signature\n");
 
     if ((pktmp = X509_get0_pubkey(template_cert)) == NULL) {
-        BIO_puts(bio_err, "error unpacking public key\n");
+        BIO_printf(bio_err, "error unpacking public key\n");
         goto end;
     }
     i = do_X509_verify(template_cert, pktmp, vfyopts);
     if (i < 0) {
         ok = 0;
-        BIO_puts(bio_err, "Signature verification problems....\n");
+        BIO_printf(bio_err, "Signature verification problems....\n");
         goto end;
     }
     if (i == 0) {
         ok = 0;
-        BIO_puts(bio_err, "Signature did not match the certificate\n");
+        BIO_printf(bio_err, "Signature did not match the certificate\n");
         goto end;
     } else {
-        BIO_puts(bio_err, "Signature ok\n");
+        BIO_printf(bio_err, "Signature ok\n");
     }
 
     if ((rreq = X509_to_X509_REQ(template_cert, NULL, NULL)) == NULL)
@@ -1470,10 +1488,10 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
     const X509_NAME *name = NULL;
     X509_NAME *CAname = NULL, *subject = NULL;
     const ASN1_TIME *tm;
-    const ASN1_STRING *str, *str2;
-    const ASN1_OBJECT *obj;
+    ASN1_STRING *str, *str2;
+    ASN1_OBJECT *obj;
     X509 *ret = NULL;
-    const X509_NAME_ENTRY *ne, *tne;
+    X509_NAME_ENTRY *ne, *tne;
     EVP_PKEY *pktmp;
     int ok = -1, i, j, last, nid;
     const char *p;
@@ -1489,49 +1507,52 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
 
     if (subj) {
         X509_NAME *n = parse_name(subj, chtype, multirdn, "subject");
-        int ok_local;
 
         if (!n)
             goto end;
-
-        ok_local = X509_REQ_set_subject_name(req, n);
+        X509_REQ_set_subject_name(req, n);
         X509_NAME_free(n);
-        if (ok_local == 0)
-            goto end;
     }
 
     if (default_op)
-        BIO_puts(bio_err, "The Subject's Distinguished Name is as follows\n");
+        BIO_printf(bio_err, "The Subject's Distinguished Name is as follows\n");
 
     name = X509_REQ_get_subject_name(req);
     for (i = 0; i < X509_NAME_entry_count(name); i++) {
-        int type;
         ne = X509_NAME_get_entry(name, i);
         str = X509_NAME_ENTRY_get_data(ne);
         obj = X509_NAME_ENTRY_get_object(ne);
         nid = OBJ_obj2nid(obj);
-        type = ASN1_STRING_type(str);
+
+        if (msie_hack) {
+            /* assume all type should be strings */
+
+            if (str->type == V_ASN1_UNIVERSALSTRING)
+                ASN1_UNIVERSALSTRING_to_string(str);
+
+            if (str->type == V_ASN1_IA5STRING && nid != NID_pkcs9_emailAddress)
+                str->type = V_ASN1_T61STRING;
+
+            if (nid == NID_pkcs9_emailAddress
+                && str->type == V_ASN1_PRINTABLESTRING)
+                str->type = V_ASN1_IA5STRING;
+        }
 
         /* If no EMAIL is wanted in the subject */
         if (nid == NID_pkcs9_emailAddress && !email_dn)
             continue;
 
         /* check some things */
-        if (nid == NID_pkcs9_emailAddress && type != V_ASN1_IA5STRING) {
-            BIO_puts(bio_err,
+        if (nid == NID_pkcs9_emailAddress && str->type != V_ASN1_IA5STRING) {
+            BIO_printf(bio_err,
                 "\nemailAddress type needs to be of type IA5STRING\n");
             goto end;
         }
-        if (type != V_ASN1_BMPSTRING && type != V_ASN1_UTF8STRING) {
-            size_t tmp = ASN1_STRING_length_ex(str);
-            if (tmp > INT_MAX)
-                goto end;
-            j = ASN1_PRINTABLE_type(ASN1_STRING_get0_data(str), (int)tmp);
-            if ((j == V_ASN1_T61STRING && type != V_ASN1_T61STRING)
-                || (j == V_ASN1_IA5STRING && type == V_ASN1_PRINTABLESTRING)) {
-                BIO_puts(bio_err,
-                    "\nThe string contains characters that are illegal for the"
-                    " ASN.1 type\n");
+        if (str->type != V_ASN1_BMPSTRING && str->type != V_ASN1_UTF8STRING) {
+            j = ASN1_PRINTABLE_type(str->data, str->length);
+            if ((j == V_ASN1_T61STRING && str->type != V_ASN1_T61STRING) || (j == V_ASN1_IA5STRING && str->type == V_ASN1_PRINTABLESTRING)) {
+                BIO_printf(bio_err,
+                    "\nThe string contains characters that are illegal for the ASN.1 type\n");
                 goto end;
             }
         }
@@ -1542,7 +1563,7 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
 
     /* Ok, now we check the 'policy' stuff. */
     if ((subject = X509_NAME_new()) == NULL) {
-        BIO_puts(bio_err, "Memory allocation failure\n");
+        BIO_printf(bio_err, "Memory allocation failure\n");
         goto end;
     }
 
@@ -1567,7 +1588,7 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
 
         last = -1;
         for (;;) {
-            const X509_NAME_ENTRY *push = NULL;
+            X509_NAME_ENTRY *push = NULL;
 
             /* lookup the object in the supplied name list */
             j = X509_NAME_get_index_by_OBJ(name, obj, last);
@@ -1627,8 +1648,8 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
                         "The %s field is different between\n"
                         "CA certificate (%s) and the request (%s)\n",
                         cv->name,
-                        ((str2 == NULL) ? "NULL" : (char *)ASN1_STRING_get0_data(str2)),
-                        ((str == NULL) ? "NULL" : (char *)ASN1_STRING_get0_data(str)));
+                        ((str2 == NULL) ? "NULL" : (char *)str2->data),
+                        ((str == NULL) ? "NULL" : (char *)str->data));
                     goto end;
                 }
             } else {
@@ -1640,7 +1661,7 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
 
             if (push != NULL) {
                 if (!X509_NAME_add_entry(subject, push, -1, 0)) {
-                    BIO_puts(bio_err, "Memory allocation failure\n");
+                    BIO_printf(bio_err, "Memory allocation failure\n");
                     goto end;
                 }
             }
@@ -1659,7 +1680,7 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
 
     /* We are now totally happy, lets make and sign the certificate */
     if (verbose)
-        BIO_puts(bio_err,
+        BIO_printf(bio_err,
             "Everything appears to be ok, creating and signing the certificate\n");
 
     if ((ret = X509_new_ex(app_get0_libctx(), app_get0_propq())) == NULL)
@@ -1703,7 +1724,7 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
         if (!X509V3_set_issuer_pkey(&ext_ctx, pkey))
             goto end;
         if (!cert_matches_key(ret, pkey))
-            BIO_puts(bio_err,
+            BIO_printf(bio_err,
                 "Warning: Signature key and public key of cert do not match\n");
     }
 
@@ -1711,24 +1732,34 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
     if (ext_sect) {
         if (extfile_conf != NULL) {
             if (verbose)
-                BIO_puts(bio_err, "Extra configuration file found\n");
+                BIO_printf(bio_err, "Extra configuration file found\n");
 
             /* Use the extfile_conf configuration db LHASH */
+            X509V3_set_nconf(&ext_ctx, extfile_conf);
+
             /* Adds exts contained in the configuration file */
-            if (!do_EXT_add_nconf(extfile_conf, extfile_conf, &ext_ctx, ret,
-                    "Error adding certificate extensions from extfile section %s\n", ext_sect))
+            if (!X509V3_EXT_add_nconf(extfile_conf, &ext_ctx, ext_sect, ret)) {
+                BIO_printf(bio_err,
+                    "Error adding certificate extensions from extfile section %s\n",
+                    ext_sect);
                 goto end;
+            }
             if (verbose)
-                BIO_puts(bio_err,
+                BIO_printf(bio_err,
                     "Successfully added extensions from file.\n");
         } else if (ext_sect) {
             /* We found extensions to be set from config file */
-            if (!do_EXT_add_nconf(lconf, lconf, &ext_ctx, ret,
-                    "Error adding certificate extensions from config section %s\n", ext_sect))
+            X509V3_set_nconf(&ext_ctx, lconf);
+
+            if (!X509V3_EXT_add_nconf(lconf, &ext_ctx, ext_sect, ret)) {
+                BIO_printf(bio_err,
+                    "Error adding certificate extensions from config section %s\n",
+                    ext_sect);
                 goto end;
+            }
 
             if (verbose)
-                BIO_puts(bio_err,
+                BIO_printf(bio_err,
                     "Successfully added extensions from config\n");
         }
     }
@@ -1736,12 +1767,12 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
     /* Copy extensions from request (if any) */
 
     if (!copy_extensions(ret, req, ext_copy)) {
-        BIO_puts(bio_err, "ERROR: adding extensions from request\n");
+        BIO_printf(bio_err, "ERROR: adding extensions from request\n");
         goto end;
     }
 
     if (verbose)
-        BIO_puts(bio_err,
+        BIO_printf(bio_err,
             "The subject name appears to be ok, checking database for clashes\n");
 
     /* Build the correct Subject if no e-mail is wanted in the subject. */
@@ -1754,7 +1785,7 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
          * because this retains its structure.
          */
         if ((dn_subject = X509_NAME_dup(subject)) == NULL) {
-            BIO_puts(bio_err, "Memory allocation failure\n");
+            BIO_printf(bio_err, "Memory allocation failure\n");
             goto end;
         }
         i = -1;
@@ -1775,7 +1806,7 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
 
     row[DB_name] = X509_NAME_oneline(X509_get_subject_name(ret), NULL, 0);
     if (row[DB_name] == NULL) {
-        BIO_puts(bio_err, "Memory allocation failure\n");
+        BIO_printf(bio_err, "Memory allocation failure\n");
         goto end;
     }
 
@@ -1784,7 +1815,7 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
     else
         row[DB_serial] = BN_bn2hex(serial);
     if (row[DB_serial] == NULL) {
-        BIO_puts(bio_err, "Memory allocation failure\n");
+        BIO_printf(bio_err, "Memory allocation failure\n");
         goto end;
     }
 
@@ -1797,7 +1828,7 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
         OPENSSL_free(row[DB_name]);
         row[DB_name] = OPENSSL_strdup(row[DB_serial]);
         if (row[DB_name] == NULL) {
-            BIO_puts(bio_err, "Memory allocation failure\n");
+            BIO_printf(bio_err, "Memory allocation failure\n");
             goto end;
         }
     }
@@ -1818,13 +1849,13 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
             BIO_printf(bio_err,
                 "ERROR:Serial number %s has already been issued,\n",
                 row[DB_serial]);
-            BIO_puts(bio_err,
+            BIO_printf(bio_err,
                 "      check the database/serial_file for corruption\n");
         }
     }
 
     if (rrow != NULL) {
-        BIO_puts(bio_err, "The matching entry has the following details\n");
+        BIO_printf(bio_err, "The matching entry has the following details\n");
         if (rrow[DB_type][0] == DB_TYPE_EXP)
             p = "Expired";
         else if (rrow[DB_type][0] == DB_TYPE_REV)
@@ -1861,7 +1892,7 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
     }
 
     if (!default_op) {
-        BIO_puts(bio_err, "Certificate Details:\n");
+        BIO_printf(bio_err, "Certificate Details:\n");
         /*
          * Never print signature details because signature not present
          */
@@ -1869,25 +1900,25 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
         X509_print_ex(bio_err, ret, nameopt, certopt);
     }
 
-    BIO_puts(bio_err, "Certificate is to be certified until ");
+    BIO_printf(bio_err, "Certificate is to be certified until ");
     ASN1_TIME_print_ex(bio_err, X509_get0_notAfter(ret), dateopt);
     if (days)
         BIO_printf(bio_err, " (%ld days)", days);
-    BIO_puts(bio_err, "\n");
+    BIO_printf(bio_err, "\n");
 
     if (!batch) {
 
-        BIO_puts(bio_err, "Sign the certificate? [y/n]:");
+        BIO_printf(bio_err, "Sign the certificate? [y/n]:");
         (void)BIO_flush(bio_err);
         buf[0] = '\0';
         if (fgets(buf, sizeof(buf), stdin) == NULL) {
-            BIO_puts(bio_err,
+            BIO_printf(bio_err,
                 "CERTIFICATE WILL NOT BE CERTIFIED: I/O error\n");
             ok = 0;
             goto end;
         }
         if (!(buf[0] == 'y' || buf[0] == 'Y')) {
-            BIO_puts(bio_err, "CERTIFICATE WILL NOT BE CERTIFIED\n");
+            BIO_printf(bio_err, "CERTIFICATE WILL NOT BE CERTIFIED\n");
             ok = 0;
             goto end;
         }
@@ -1903,14 +1934,14 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
     /* We now just add it to the database as DB_TYPE_VAL('V') */
     row[DB_type] = OPENSSL_strdup("V");
     tm = X509_get0_notAfter(ret);
-    row[DB_exp_date] = app_malloc(ASN1_STRING_length_ex(tm) + 1, "row expdate");
-    memcpy(row[DB_exp_date], ASN1_STRING_get0_data(tm), ASN1_STRING_length_ex(tm));
-    row[DB_exp_date][ASN1_STRING_length_ex(tm)] = '\0';
+    row[DB_exp_date] = app_malloc(tm->length + 1, "row expdate");
+    memcpy(row[DB_exp_date], tm->data, tm->length);
+    row[DB_exp_date][tm->length] = '\0';
     row[DB_rev_date] = NULL;
     row[DB_file] = OPENSSL_strdup("unknown");
     if ((row[DB_type] == NULL) || (row[DB_file] == NULL)
         || (row[DB_name] == NULL)) {
-        BIO_puts(bio_err, "Memory allocation failure\n");
+        BIO_printf(bio_err, "Memory allocation failure\n");
         goto end;
     }
 
@@ -1920,9 +1951,8 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
     irow[DB_NUMBER] = NULL;
 
     if (!TXT_DB_insert(db->db, irow)) {
-        BIO_printf(bio_err, "failed to update database\n"
-                            "TXT_DB error number %ld\n",
-            db->db->error);
+        BIO_printf(bio_err, "failed to update database\n");
+        BIO_printf(bio_err, "TXT_DB error number %ld\n", db->db->error);
         goto end;
     }
     irow = NULL;
@@ -2009,9 +2039,7 @@ static int certify_spkac(X509 **xret, const char *infile, EVP_PKEY *pkey,
     /*
      * Build up the subject name set.
      */
-    n = X509_NAME_new();
-    if (n == NULL)
-        goto end;
+    n = X509_REQ_get_subject_name(req);
 
     for (i = 0;; i++) {
         if (sk_CONF_VALUE_num(sk) <= i)
@@ -2035,7 +2063,7 @@ static int certify_spkac(X509 **xret, const char *infile, EVP_PKEY *pkey,
             if (strcmp(type, "SPKAC") == 0) {
                 spki = NETSCAPE_SPKI_b64_decode(cv->value, -1);
                 if (spki == NULL) {
-                    BIO_puts(bio_err,
+                    BIO_printf(bio_err,
                         "unable to load Netscape SPKAC structure\n");
                     goto end;
                 }
@@ -2053,28 +2081,25 @@ static int certify_spkac(X509 **xret, const char *infile, EVP_PKEY *pkey,
         goto end;
     }
 
-    if (!X509_REQ_set_subject_name(req, n))
-        goto end;
-
     /*
      * Now extract the key from the SPKI structure.
      */
 
-    BIO_puts(bio_err, "Check that the SPKAC request matches the signature\n");
+    BIO_printf(bio_err, "Check that the SPKAC request matches the signature\n");
 
     if ((pktmp = NETSCAPE_SPKI_get_pubkey(spki)) == NULL) {
-        BIO_puts(bio_err, "error unpacking SPKAC public key\n");
+        BIO_printf(bio_err, "error unpacking SPKAC public key\n");
         goto end;
     }
 
     j = NETSCAPE_SPKI_verify(spki, pktmp);
     if (j <= 0) {
         EVP_PKEY_free(pktmp);
-        BIO_puts(bio_err,
+        BIO_printf(bio_err,
             "signature verification failed on SPKAC public key\n");
         goto end;
     }
-    BIO_puts(bio_err, "Signature ok\n");
+    BIO_printf(bio_err, "Signature ok\n");
 
     X509_REQ_set_pubkey(req, pktmp);
     EVP_PKEY_free(pktmp);
@@ -2084,7 +2109,6 @@ static int certify_spkac(X509 **xret, const char *infile, EVP_PKEY *pkey,
         ext_copy, 0, dateopt);
 end:
     X509_REQ_free(req);
-    X509_NAME_free(n);
     CONF_free(parms);
     NETSCAPE_SPKI_free(spki);
     X509_NAME_ENTRY_free(ne);
@@ -2123,7 +2147,7 @@ static int do_revoke(X509 *x509, CA_DB *db, REVINFO_TYPE rev_type,
         row[DB_name] = OPENSSL_strdup(row[DB_serial]);
     }
     if ((row[DB_name] == NULL) || (row[DB_serial] == NULL)) {
-        BIO_puts(bio_err, "Memory allocation failure\n");
+        BIO_printf(bio_err, "Memory allocation failure\n");
         goto end;
     }
     /*
@@ -2139,14 +2163,14 @@ static int do_revoke(X509 *x509, CA_DB *db, REVINFO_TYPE rev_type,
         /* We now just add it to the database as DB_TYPE_REV('V') */
         row[DB_type] = OPENSSL_strdup("V");
         tm = X509_get0_notAfter(x509);
-        row[DB_exp_date] = app_malloc(ASN1_STRING_length_ex(tm) + 1, "row exp_data");
-        memcpy(row[DB_exp_date], ASN1_STRING_get0_data(tm), ASN1_STRING_length_ex(tm));
-        row[DB_exp_date][ASN1_STRING_length_ex(tm)] = '\0';
+        row[DB_exp_date] = app_malloc(tm->length + 1, "row exp_data");
+        memcpy(row[DB_exp_date], tm->data, tm->length);
+        row[DB_exp_date][tm->length] = '\0';
         row[DB_rev_date] = NULL;
         row[DB_file] = OPENSSL_strdup("unknown");
 
         if (row[DB_type] == NULL || row[DB_file] == NULL) {
-            BIO_puts(bio_err, "Memory allocation failure\n");
+            BIO_printf(bio_err, "Memory allocation failure\n");
             goto end;
         }
 
@@ -2156,9 +2180,8 @@ static int do_revoke(X509 *x509, CA_DB *db, REVINFO_TYPE rev_type,
         irow[DB_NUMBER] = NULL;
 
         if (!TXT_DB_insert(db->db, irow)) {
-            BIO_printf(bio_err, "failed to update database\n"
-                                "TXT_DB error number %ld\n",
-                db->db->error);
+            BIO_printf(bio_err, "failed to update database\n");
+            BIO_printf(bio_err, "TXT_DB error number %ld\n", db->db->error);
             OPENSSL_free(irow);
             goto end;
         }
@@ -2190,7 +2213,7 @@ static int do_revoke(X509 *x509, CA_DB *db, REVINFO_TYPE rev_type,
         BIO_printf(bio_err, "Revoking Certificate %s.\n", rrow[DB_serial]);
         rev_str = make_revocation_str(rev_type, value);
         if (!rev_str) {
-            BIO_puts(bio_err, "Error in revocation arguments\n");
+            BIO_printf(bio_err, "Error in revocation arguments\n");
             goto end;
         }
         rrow[DB_type][0] = DB_TYPE_REV;
@@ -2271,7 +2294,7 @@ end:
     return ok;
 }
 
-int do_updatedb(CA_DB *db, const time_t *now)
+int do_updatedb(CA_DB *db, time_t *now)
 {
     ASN1_TIME *a_tm = NULL;
     int i, cnt = 0;
@@ -2352,7 +2375,7 @@ static char *make_revocation_str(REVINFO_TYPE rev_type, const char *rev_arg)
     const char *reason = NULL, *other = NULL;
     ASN1_OBJECT *otmp;
     ASN1_UTCTIME *revtm = NULL;
-    size_t i;
+    int i;
 
     switch (rev_type) {
     case REV_NONE:
@@ -2409,15 +2432,15 @@ static char *make_revocation_str(REVINFO_TYPE rev_type, const char *rev_arg)
     if (!revtm)
         return NULL;
 
-    i = ASN1_STRING_length_ex(revtm) + 1;
+    i = revtm->length + 1;
 
     if (reason)
-        i += strlen(reason) + 1;
+        i += (int)(strlen(reason) + 1);
     if (other)
-        i += strlen(other) + 1;
+        i += (int)(strlen(other) + 1);
 
     str = app_malloc(i, "revocation reason");
-    OPENSSL_strlcpy(str, (const char *)ASN1_STRING_get0_data(revtm), i);
+    OPENSSL_strlcpy(str, (char *)revtm->data, i);
     if (reason) {
         OPENSSL_strlcat(str, ",", i);
         OPENSSL_strlcat(str, reason, i);
@@ -2494,7 +2517,7 @@ static int old_entry_print(const ASN1_OBJECT *obj, const ASN1_STRING *str)
 {
     char buf[25], *pbuf;
     const char *p;
-    size_t j;
+    int j;
 
     j = i2a_ASN1_OBJECT(bio_err, obj);
     pbuf = buf;
@@ -2504,30 +2527,30 @@ static int old_entry_print(const ASN1_OBJECT *obj, const ASN1_STRING *str)
     *(pbuf++) = '\0';
     BIO_puts(bio_err, buf);
 
-    if (ASN1_STRING_type(str) == V_ASN1_PRINTABLESTRING)
-        BIO_puts(bio_err, "PRINTABLE:'");
-    else if (ASN1_STRING_type(str) == V_ASN1_T61STRING)
-        BIO_puts(bio_err, "T61STRING:'");
-    else if (ASN1_STRING_type(str) == V_ASN1_IA5STRING)
-        BIO_puts(bio_err, "IA5STRING:'");
-    else if (ASN1_STRING_type(str) == V_ASN1_UNIVERSALSTRING)
-        BIO_puts(bio_err, "UNIVERSALSTRING:'");
+    if (str->type == V_ASN1_PRINTABLESTRING)
+        BIO_printf(bio_err, "PRINTABLE:'");
+    else if (str->type == V_ASN1_T61STRING)
+        BIO_printf(bio_err, "T61STRING:'");
+    else if (str->type == V_ASN1_IA5STRING)
+        BIO_printf(bio_err, "IA5STRING:'");
+    else if (str->type == V_ASN1_UNIVERSALSTRING)
+        BIO_printf(bio_err, "UNIVERSALSTRING:'");
     else
-        BIO_printf(bio_err, "ASN.1 %2d:'", ASN1_STRING_type(str));
+        BIO_printf(bio_err, "ASN.1 %2d:'", str->type);
 
-    p = (const char *)ASN1_STRING_get0_data(str);
-    for (j = ASN1_STRING_length_ex(str); j > 0; j--) {
+    p = (const char *)str->data;
+    for (j = str->length; j > 0; j--) {
         if ((*p >= ' ') && (*p <= '~'))
             BIO_printf(bio_err, "%c", *p);
         else if (*p & 0x80)
             BIO_printf(bio_err, "\\0x%02X", *p);
         else if ((unsigned char)*p == 0xf7)
-            BIO_puts(bio_err, "^?");
+            BIO_printf(bio_err, "^?");
         else
             BIO_printf(bio_err, "^%c", *p + '@');
         p++;
     }
-    BIO_puts(bio_err, "'\n");
+    BIO_printf(bio_err, "'\n");
     return 1;
 }
 
@@ -2544,7 +2567,7 @@ int unpack_revinfo(ASN1_TIME **prevtm, int *preason, ASN1_OBJECT **phold,
 
     tmp = OPENSSL_strdup(str);
     if (!tmp) {
-        BIO_puts(bio_err, "memory allocation failure\n");
+        BIO_printf(bio_err, "memory allocation failure\n");
         goto end;
     }
 
@@ -2566,7 +2589,7 @@ int unpack_revinfo(ASN1_TIME **prevtm, int *preason, ASN1_OBJECT **phold,
     if (prevtm) {
         *prevtm = ASN1_UTCTIME_new();
         if (*prevtm == NULL) {
-            BIO_puts(bio_err, "memory allocation failure\n");
+            BIO_printf(bio_err, "memory allocation failure\n");
             goto end;
         }
         if (!ASN1_UTCTIME_set_string(*prevtm, rtime_str)) {
@@ -2590,7 +2613,7 @@ int unpack_revinfo(ASN1_TIME **prevtm, int *preason, ASN1_OBJECT **phold,
             reason_code = OCSP_REVOKED_STATUS_REMOVEFROMCRL;
         } else if (reason_code == 8) { /* Hold instruction */
             if (!arg_str) {
-                BIO_puts(bio_err, "missing hold instruction\n");
+                BIO_printf(bio_err, "missing hold instruction\n");
                 goto end;
             }
             reason_code = OCSP_REVOKED_STATUS_CERTIFICATEHOLD;
@@ -2606,12 +2629,12 @@ int unpack_revinfo(ASN1_TIME **prevtm, int *preason, ASN1_OBJECT **phold,
                 ASN1_OBJECT_free(hold);
         } else if ((reason_code == 9) || (reason_code == 10)) {
             if (!arg_str) {
-                BIO_puts(bio_err, "missing compromised time\n");
+                BIO_printf(bio_err, "missing compromised time\n");
                 goto end;
             }
             comp_time = ASN1_GENERALIZEDTIME_new();
             if (comp_time == NULL) {
-                BIO_puts(bio_err, "memory allocation failure\n");
+                BIO_printf(bio_err, "memory allocation failure\n");
                 goto end;
             }
             if (!ASN1_GENERALIZEDTIME_set_string(comp_time, arg_str)) {

apps/ciphers.c

@@ -1,5 +1,5 @@
 /*
- * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -20,6 +20,7 @@ typedef enum OPTION_choice {
     OPT_COMMON,
     OPT_STDNAME,
     OPT_CONVERT,
+    OPT_SSL3,
     OPT_TLS1,
     OPT_TLS1_1,
     OPT_TLS1_2,
@@ -47,6 +48,9 @@ const OPTIONS ciphers_options[] = {
 
     OPT_SECTION("Cipher specification"),
     { "s", OPT_S, '-', "Only supported ciphers" },
+#ifndef OPENSSL_NO_SSL3
+    { "ssl3", OPT_SSL3, '-', "Ciphers compatible with SSL3" },
+#endif
 #ifndef OPENSSL_NO_TLS1
     { "tls1", OPT_TLS1, '-', "Ciphers compatible with TLS1" },
 #endif
@@ -131,6 +135,10 @@ int ciphers_main(int argc, char **argv)
         case OPT_CONVERT:
             convert = opt_arg();
             break;
+        case OPT_SSL3:
+            min_version = SSL3_VERSION;
+            max_version = SSL3_VERSION;
+            break;
         case OPT_TLS1:
             min_version = TLS1_VERSION;
             max_version = TLS1_VERSION;
@@ -199,13 +207,13 @@ int ciphers_main(int argc, char **argv)
 #endif
 
     if (ciphersuites != NULL && !SSL_CTX_set_ciphersuites(ctx, ciphersuites)) {
-        BIO_puts(bio_err, "Error setting TLSv1.3 ciphersuites\n");
+        BIO_printf(bio_err, "Error setting TLSv1.3 ciphersuites\n");
         goto err;
     }
 
     if (ciphers != NULL) {
         if (!SSL_CTX_set_cipher_list(ctx, ciphers)) {
-            BIO_puts(bio_err, "Error in cipher list\n");
+            BIO_printf(bio_err, "Error in cipher list\n");
             goto err;
         }
     }
@@ -229,10 +237,10 @@ int ciphers_main(int argc, char **argv)
             if (p == NULL)
                 break;
             if (i != 0)
-                BIO_puts(bio_out, ":");
-            BIO_puts(bio_out, p);
+                BIO_printf(bio_out, ":");
+            BIO_printf(bio_out, "%s", p);
         }
-        BIO_puts(bio_out, "\n");
+        BIO_printf(bio_out, "\n");
     } else {
 
         for (i = 0; i < sk_SSL_CIPHER_num(sk); i++) {

apps/cms.c

@@ -1,5 +1,5 @@
 /*
- * Copyright 2008-2026 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2008-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -284,9 +284,9 @@ const OPTIONS cms_options[] = {
     { "cades", OPT_DUP, '-', "Check signingCertificate (CAdES-BES)" },
     { "verify_retcode", OPT_VERIFY_RETCODE, '-',
         "Exit non-zero on verification failure" },
-    { "CAfile", OPT_CAFILE, '<', "File in PEM format with trusted CA certs" },
-    { "CApath", OPT_CAPATH, '/', "Dir with trusted CA cert files in PEM format" },
-    { "CAstore", OPT_CASTORE, ':', "URI of store with trusted CA certs" },
+    { "CAfile", OPT_CAFILE, '<', "Trusted certificates file" },
+    { "CApath", OPT_CAPATH, '/', "Trusted certificates directory" },
+    { "CAstore", OPT_CASTORE, ':', "Trusted certificates store URI" },
     { "no-CAfile", OPT_NOCAFILE, '-',
         "Do not load the default certificates file" },
     { "no-CApath", OPT_NOCAPATH, '-',
@@ -323,7 +323,7 @@ static CMS_ContentInfo *load_content_info(int informat, BIO *in, int flags,
 
     ret = CMS_ContentInfo_new_ex(app_get0_libctx(), app_get0_propq());
     if (ret == NULL) {
-        BIO_puts(bio_err, "Error allocating CMS_contentinfo\n");
+        BIO_printf(bio_err, "Error allocating CMS_contentinfo\n");
         return NULL;
     }
     switch (informat) {
@@ -791,7 +791,7 @@ int cms_main(int argc, char **argv)
                     keyidx += sk_OPENSSL_STRING_num(skkeys);
             }
             if (keyidx < 0) {
-                BIO_puts(bio_err, "No key specified\n");
+                BIO_printf(bio_err, "No key specified\n");
                 goto opthelp;
             }
             if (key_param == NULL || key_param->idx != keyidx) {
@@ -908,7 +908,7 @@ int cms_main(int argc, char **argv)
                 goto end;
         }
         if (sksigners == NULL) {
-            BIO_puts(bio_err, "No signer certificate specified\n");
+            BIO_printf(bio_err, "No signer certificate specified\n");
             goto opthelp;
         }
         signerfile = NULL;
@@ -916,23 +916,23 @@ int cms_main(int argc, char **argv)
     } else if (operation == SMIME_DECRYPT) {
         if (recipfile == NULL && keyfile == NULL
             && secret_key == NULL && pwri_pass == NULL) {
-            BIO_puts(bio_err,
+            BIO_printf(bio_err,
                 "No recipient certificate or key specified\n");
             goto opthelp;
         }
     } else if (operation == SMIME_ENCRYPT) {
         if (*argv == NULL && secret_key == NULL
             && pwri_pass == NULL && sk_X509_num(encerts) <= 0) {
-            BIO_puts(bio_err, "No recipient(s) certificate(s) specified\n");
+            BIO_printf(bio_err, "No recipient(s) certificate(s) specified\n");
             goto opthelp;
         }
     } else if (!operation) {
-        BIO_puts(bio_err, "No operation option (-encrypt|-decrypt|-sign|-verify|...) specified.\n");
+        BIO_printf(bio_err, "No operation option (-encrypt|-decrypt|-sign|-verify|...) specified.\n");
         goto opthelp;
     }
 
     if (!app_passwd(passinarg, NULL, &passin, NULL)) {
-        BIO_puts(bio_err, "Error getting password\n");
+        BIO_printf(bio_err, "Error getting password\n");
         goto end;
     }
 
@@ -940,19 +940,19 @@ int cms_main(int argc, char **argv)
 
     if ((operation & SMIME_SIGNERS) == 0) {
         if ((flags & CMS_DETACHED) == 0)
-            BIO_puts(bio_err,
+            BIO_printf(bio_err,
                 "Warning: -nodetach option is ignored for non-signing operation\n");
 
         flags &= ~CMS_DETACHED;
     }
     if ((operation & SMIME_IP) == 0 && contfile != NULL)
-        BIO_puts(bio_err,
+        BIO_printf(bio_err,
             "Warning: -contfile option is ignored for the given operation\n");
     if (operation != SMIME_ENCRYPT && *argv != NULL)
-        BIO_puts(bio_err,
+        BIO_printf(bio_err,
             "Warning: recipient certificate file parameters ignored for operation other than -encrypt\n");
     if (operation != SMIME_ENCRYPT && recip_first != NULL)
-        BIO_puts(bio_err,
+        BIO_printf(bio_err,
             "Warning: -recip_kdf and -recip_ukm parameters ignored for operation other than -encrypt\n");
 
     if ((flags & CMS_BINARY) != 0) {
@@ -970,7 +970,7 @@ int cms_main(int argc, char **argv)
         if (!cipher)
             cipher = (EVP_CIPHER *)EVP_aes_256_cbc();
         if (secret_key && !secret_keyid) {
-            BIO_puts(bio_err, "No secret key id\n");
+            BIO_printf(bio_err, "No secret key id\n");
             goto end;
         }
 
@@ -1025,20 +1025,20 @@ int cms_main(int argc, char **argv)
 
     if (digesthex != NULL) {
         if (operation != SMIME_SIGN) {
-            BIO_puts(bio_err,
+            BIO_printf(bio_err,
                 "Cannot use -digest for non-signing operation\n");
             goto end;
         }
         if (infile != NULL
             || (flags & CMS_DETACHED) == 0
             || (flags & CMS_STREAM) != 0) {
-            BIO_puts(bio_err,
+            BIO_printf(bio_err,
                 "Cannot use -digest when -in, -nodetach or streaming is used\n");
             goto end;
         }
         digestbin = OPENSSL_hexstr2buf(digesthex, &digestlen);
         if (digestbin == NULL) {
-            BIO_puts(bio_err,
+            BIO_printf(bio_err,
                 "Invalid hex value after -digest\n");
             goto end;
         }
@@ -1213,7 +1213,7 @@ int cms_main(int argc, char **argv)
                 if (originator != NULL
                     && ERR_GET_REASON(ERR_peek_error())
                         == CMS_R_ERROR_UNSUPPORTED_STATIC_KEY_AGREEMENT) {
-                    BIO_puts(bio_err, "Cannot use originator for encryption\n");
+                    BIO_printf(bio_err, "Cannot use originator for encryption\n");
                     goto end;
                 }
                 goto end;
@@ -1327,7 +1327,7 @@ int cms_main(int argc, char **argv)
     }
 
     if (cms == NULL) {
-        BIO_puts(bio_err, "Error creating CMS structure\n");
+        BIO_printf(bio_err, "Error creating CMS structure\n");
         goto end;
     }
 
@@ -1360,7 +1360,7 @@ int cms_main(int argc, char **argv)
         }
 
         if (!CMS_decrypt(cms, NULL, NULL, indata, out, flags)) {
-            BIO_puts(bio_err, "Error decrypting CMS structure\n");
+            BIO_printf(bio_err, "Error decrypting CMS structure\n");
             goto end;
         }
     } else if (operation == SMIME_DATA_OUT) {
@@ -1371,9 +1371,9 @@ int cms_main(int argc, char **argv)
             goto end;
     } else if (operation == SMIME_DIGEST_VERIFY) {
         if (CMS_digest_verify(cms, indata, out, flags) > 0) {
-            BIO_puts(bio_err, "Verification successful\n");
+            BIO_printf(bio_err, "Verification successful\n");
         } else {
-            BIO_puts(bio_err, "Verification failure\n");
+            BIO_printf(bio_err, "Verification failure\n");
             goto end;
         }
     } else if (operation == SMIME_ENCRYPTED_DECRYPT) {
@@ -1407,9 +1407,9 @@ int cms_main(int argc, char **argv)
 
     } else if (operation == SMIME_VERIFY_RECEIPT) {
         if (CMS_verify_receipt(rcms, cms, other, store, flags) > 0) {
-            BIO_puts(bio_err, "Verification successful\n");
+            BIO_printf(bio_err, "Verification successful\n");
         } else {
-            BIO_puts(bio_err, "Verification failure\n");
+            BIO_printf(bio_err, "Verification failure\n");
             goto end;
         }
     } else {
@@ -1445,11 +1445,11 @@ int cms_main(int argc, char **argv)
         } else if (outformat == FORMAT_ASN1) {
             ret = i2d_CMS_bio_stream(out, cms, in, flags);
         } else {
-            BIO_puts(bio_err, "Bad output format for CMS file\n");
+            BIO_printf(bio_err, "Bad output format for CMS file\n");
             goto end;
         }
         if (ret <= 0) {
-            BIO_puts(bio_err, "Error writing CMS output\n");
+            BIO_printf(bio_err, "Error writing CMS output\n");
             ret = 6;
             goto end;
         }
@@ -1580,15 +1580,13 @@ static void receipt_request_print(CMS_ContentInfo *cms)
             ERR_print_errors(bio_err);
         } else {
             const char *id;
-            size_t idlen;
+            int idlen;
             CMS_ReceiptRequest_get0_values(rr, &scid, &allorfirst,
                 &rlist, &rto);
             BIO_puts(bio_err, "  Signed Content ID:\n");
-            idlen = ASN1_STRING_length_ex(scid);
-            if (idlen > INT_MAX)
-                idlen = INT_MAX;
+            idlen = ASN1_STRING_length(scid);
             id = (const char *)ASN1_STRING_get0_data(scid);
-            BIO_dump_indent(bio_err, id, (int)idlen, 4);
+            BIO_dump_indent(bio_err, id, idlen, 4);
             BIO_puts(bio_err, "  Receipts From");
             if (rlist != NULL) {
                 BIO_puts(bio_err, " List:\n");

apps/configutl.c

@@ -1,5 +1,5 @@
 /*
- * Copyright 2025-2026 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -28,20 +28,20 @@ static void print_escaped_value(BIO *out, const char *value)
         case '#':
         case '\\':
         case '$':
-            BIO_puts(out, "\\");
+            BIO_printf(out, "\\");
             BIO_write(out, p, 1);
             break;
         case '\n':
-            BIO_puts(out, "\\n");
+            BIO_printf(out, "%s", "\\n");
             break;
         case '\r':
-            BIO_puts(out, "\\r");
+            BIO_printf(out, "%s", "\\r");
             break;
         case '\b':
-            BIO_puts(out, "\\b");
+            BIO_printf(out, "%s", "\\b");
             break;
         case '\t':
-            BIO_puts(out, "\\t");
+            BIO_printf(out, "%s", "\\t");
             break;
         case ' ':
             if (p == value || p[1] == '\0') {
@@ -56,7 +56,7 @@ static void print_escaped_value(BIO *out, const char *value)
                  * more trouble than adding the quotes just around the
                  * first and last leading and trailing space.
                  */
-                BIO_puts(out, "\" \"");
+                BIO_printf(out, "%s", "\" \"");
                 break;
             }
             /* FALLTHROUGH */
@@ -80,7 +80,7 @@ static void print_section(BIO *out, const CONF *cnf, OPENSSL_CSTRING section_nam
 
         BIO_printf(out, "%s = ", value->name);
         print_escaped_value(out, value->value);
-        BIO_puts(out, "\n");
+        BIO_printf(out, "\n");
     }
 }
 

apps/crl.c

@@ -1,5 +1,5 @@
 /*
- * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -84,9 +84,9 @@ const OPTIONS crl_options[] = {
     { "gendelta", OPT_GENDELTA, '<', "Other CRL to compare/diff to the Input one" },
 
     OPT_SECTION("Certificate"),
-    { "CAfile", OPT_CAFILE, '<', "File in PEM format with trusted CA certs" },
-    { "CApath", OPT_CAPATH, '/', "Dir with trusted CA cert files in PEM format" },
-    { "CAstore", OPT_CASTORE, ':', "URI of store with trusted CA certs" },
+    { "CApath", OPT_CAPATH, '/', "Verify CRL using certificates in dir" },
+    { "CAfile", OPT_CAFILE, '<', "Verify CRL using certificates in file name" },
+    { "CAstore", OPT_CASTORE, ':', "Verify CRL using certificates in store URI" },
     { "no-CAfile", OPT_NOCAFILE, '-',
         "Do not load the default certificates file" },
     { "no-CApath", OPT_NOCAPATH, '-',
@@ -252,20 +252,20 @@ int crl_main(int argc, char **argv)
             goto end;
         ctx = X509_STORE_CTX_new();
         if (ctx == NULL || !X509_STORE_CTX_init(ctx, store, NULL, NULL)) {
-            BIO_puts(bio_err, "Error initialising X509 store\n");
+            BIO_printf(bio_err, "Error initialising X509 store\n");
             goto end;
         }
 
         xobj = X509_STORE_CTX_get_obj_by_subject(ctx, X509_LU_X509,
             X509_CRL_get_issuer(x));
         if (xobj == NULL) {
-            BIO_puts(bio_err, "Error getting CRL issuer certificate\n");
+            BIO_printf(bio_err, "Error getting CRL issuer certificate\n");
             goto end;
         }
         pkey = X509_get_pubkey(X509_OBJECT_get0_X509(xobj));
         X509_OBJECT_free(xobj);
         if (pkey == NULL) {
-            BIO_puts(bio_err, "Error getting CRL issuer public key\n");
+            BIO_printf(bio_err, "Error getting CRL issuer public key\n");
             goto end;
         }
         i = X509_CRL_verify(x, pkey);
@@ -273,10 +273,11 @@ int crl_main(int argc, char **argv)
         if (i < 0)
             goto end;
         if (i == 0) {
-            BIO_puts(bio_err, "verify failure\n");
+            BIO_printf(bio_err, "verify failure\n");
             goto end;
-        } else
-            BIO_puts(bio_err, "verify OK\n");
+        } else {
+            BIO_printf(bio_err, "verify OK\n");
+        }
     }
 
     if (crldiff != NULL) {
@@ -309,11 +310,7 @@ int crl_main(int argc, char **argv)
         const ASN1_BIT_STRING *sig;
 
         X509_CRL_get0_signature(x, &sig, NULL);
-        /* XXX Casts away const, because it mutates the value! */
-        if (!corrupt_signature((ASN1_BIT_STRING *)sig)) {
-            BIO_puts(bio_err, "Error corrupting signature\n");
-            goto end;
-        }
+        corrupt_signature(sig);
     }
 
     if (num) {
@@ -325,7 +322,7 @@ int crl_main(int argc, char **argv)
                 ASN1_INTEGER *crlnum;
 
                 crlnum = X509_CRL_get_ext_d2i(x, NID_crl_number, NULL, NULL);
-                BIO_puts(bio_out, "crlNumber=");
+                BIO_printf(bio_out, "crlNumber=");
                 if (crlnum) {
                     BIO_puts(bio_out, "0x");
                     i2a_ASN1_INTEGER(bio_out, crlnum);
@@ -333,7 +330,7 @@ int crl_main(int argc, char **argv)
                 } else {
                     BIO_puts(bio_out, "<NONE>");
                 }
-                BIO_puts(bio_out, "\n");
+                BIO_printf(bio_out, "\n");
             }
             if (hash == i) {
                 int ok;
@@ -341,7 +338,7 @@ int crl_main(int argc, char **argv)
                     app_get0_propq(), &ok);
 
                 if (num > 1)
-                    BIO_puts(bio_out, "issuer name hash=");
+                    BIO_printf(bio_out, "issuer name hash=");
                 if (ok) {
                     BIO_printf(bio_out, "%08lx\n", hash_value);
                 } else {
@@ -352,23 +349,23 @@ int crl_main(int argc, char **argv)
 #ifndef OPENSSL_NO_MD5
             if (hash_old == i) {
                 if (num > 1)
-                    BIO_puts(bio_out, "issuer name old hash=");
+                    BIO_printf(bio_out, "issuer name old hash=");
                 BIO_printf(bio_out, "%08lx\n",
                     X509_NAME_hash_old(X509_CRL_get_issuer(x)));
             }
 #endif
             if (lastupdate == i) {
-                BIO_puts(bio_out, "lastUpdate=");
+                BIO_printf(bio_out, "lastUpdate=");
                 ASN1_TIME_print_ex(bio_out, X509_CRL_get0_lastUpdate(x), dateopt);
-                BIO_puts(bio_out, "\n");
+                BIO_printf(bio_out, "\n");
             }
             if (nextupdate == i) {
-                BIO_puts(bio_out, "nextUpdate=");
+                BIO_printf(bio_out, "nextUpdate=");
                 if (X509_CRL_get0_nextUpdate(x))
                     ASN1_TIME_print_ex(bio_out, X509_CRL_get0_nextUpdate(x), dateopt);
                 else
-                    BIO_puts(bio_out, "NONE");
-                BIO_puts(bio_out, "\n");
+                    BIO_printf(bio_out, "NONE");
+                BIO_printf(bio_out, "\n");
             }
             if (fingerprint == i) {
                 int j;
@@ -376,7 +373,7 @@ int crl_main(int argc, char **argv)
                 unsigned char md[EVP_MAX_MD_SIZE];
 
                 if (!X509_CRL_digest(x, digest, md, &n)) {
-                    BIO_puts(bio_err, "out of memory\n");
+                    BIO_printf(bio_err, "out of memory\n");
                     goto end;
                 }
                 BIO_printf(bio_out, "%s Fingerprint=",
@@ -404,7 +401,7 @@ int crl_main(int argc, char **argv)
     else
         i = PEM_write_bio_X509_CRL(out, x);
     if (!i) {
-        BIO_puts(bio_err, "unable to write CRL\n");
+        BIO_printf(bio_err, "unable to write CRL\n");
         goto end;
     }
     ret = 0;

apps/crl2pkcs7.c

@@ -1,5 +1,5 @@
 /*
- * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -121,7 +121,7 @@ int crl2pkcs7_main(int argc, char **argv)
         else if (informat == FORMAT_PEM)
             crl = PEM_read_bio_X509_CRL(in, NULL, NULL, NULL);
         if (crl == NULL) {
-            BIO_puts(bio_err, "unable to load CRL\n");
+            BIO_printf(bio_err, "unable to load CRL\n");
             ERR_print_errors(bio_err);
             goto end;
         }
@@ -156,7 +156,7 @@ int crl2pkcs7_main(int argc, char **argv)
         for (i = 0; i < sk_OPENSSL_STRING_num(certflst); i++) {
             certfile = sk_OPENSSL_STRING_value(certflst, i);
             if (add_certs_from_file(cert_stack, certfile) < 0) {
-                BIO_puts(bio_err, "error loading certificates\n");
+                BIO_printf(bio_err, "error loading certificates\n");
                 ERR_print_errors(bio_err);
                 goto end;
             }
@@ -172,7 +172,7 @@ int crl2pkcs7_main(int argc, char **argv)
     else if (outformat == FORMAT_PEM)
         i = PEM_write_bio_PKCS7(out, p7);
     if (!i) {
-        BIO_puts(bio_err, "unable to write pkcs7 object\n");
+        BIO_printf(bio_err, "unable to write pkcs7 object\n");
         ERR_print_errors(bio_err);
         goto end;
     }

apps/dgst.c

@@ -1,5 +1,5 @@
 /*
- * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -7,10 +7,10 @@
  * https://www.openssl.org/source/license.html
  */
 
-#include "apps.h"
 #include <stdio.h>
 #include <string.h>
 #include <stdlib.h>
+#include "apps.h"
 #include "progs.h"
 #include <openssl/bio.h>
 #include <openssl/err.h>
@@ -20,7 +20,6 @@
 #include <openssl/pem.h>
 #include <openssl/hmac.h>
 #include <ctype.h>
-#include <sys/stat.h>
 
 #undef BUFSIZE
 #define BUFSIZE 1024 * 8
@@ -134,7 +133,7 @@ int dgst_main(int argc, char **argv)
     int oneshot_sign = 0;
 
     buf = app_malloc(BUFSIZE, "I/O buffer");
-    md = EVP_MD_fetch(app_get0_libctx(), argv[0], app_get0_propq());
+    md = (EVP_MD *)EVP_get_digestbyname(argv[0]);
     if (md != NULL)
         digestname = argv[0];
 
@@ -152,12 +151,12 @@ int dgst_main(int argc, char **argv)
             ret = EXIT_SUCCESS;
             goto end;
         case OPT_LIST:
-            BIO_puts(bio_out, "Supported digests:\n");
+            BIO_printf(bio_out, "Supported digests:\n");
             dec.bio = bio_out;
             dec.n = 0;
             OBJ_NAME_do_all_sorted(OBJ_NAME_TYPE_MD_METH,
                 show_digests, &dec);
-            BIO_puts(bio_out, "\n");
+            BIO_printf(bio_out, "\n");
             ret = EXIT_SUCCESS;
             goto end;
         case OPT_C:
@@ -201,7 +200,7 @@ int dgst_main(int argc, char **argv)
             out_bin = 1;
             break;
         case OPT_XOFLEN:
-            xoflen = opt_int_arg();
+            xoflen = atoi(opt_arg());
             break;
         case OPT_DEBUG:
             debug = 1;
@@ -283,7 +282,7 @@ int dgst_main(int argc, char **argv)
     }
 
     if (do_verify && sigfile == NULL) {
-        BIO_puts(bio_err,
+        BIO_printf(bio_err,
             "No signature to verify: use the -signature option\n");
         goto end;
     }
@@ -300,7 +299,7 @@ int dgst_main(int argc, char **argv)
     }
 
     if (!app_passwd(passinarg, NULL, &passin, NULL)) {
-        BIO_puts(bio_err, "Error getting password\n");
+        BIO_printf(bio_err, "Error getting password\n");
         goto end;
     }
 
@@ -316,7 +315,7 @@ int dgst_main(int argc, char **argv)
         goto end;
 
     if ((!(mac_name == NULL) + !(keyfile == NULL) + !(hmac_key == NULL)) > 1) {
-        BIO_puts(bio_err, "MAC and signing key cannot both be specified\n");
+        BIO_printf(bio_err, "MAC and signing key cannot both be specified\n");
         goto end;
     }
 
@@ -388,7 +387,7 @@ int dgst_main(int argc, char **argv)
         if (oneshot_sign) {
             mctx = signctx;
         } else if (BIO_get_md_ctx(bmd, &mctx) <= 0) {
-            BIO_puts(bio_err, "Error getting context\n");
+            BIO_printf(bio_err, "Error getting context\n");
             goto end;
         }
         if (do_verify)
@@ -400,7 +399,7 @@ int dgst_main(int argc, char **argv)
                 app_get0_libctx(),
                 app_get0_propq(), sigkey, NULL);
         if (res == 0) {
-            BIO_puts(bio_err, "Error setting context\n");
+            BIO_printf(bio_err, "Error setting context\n");
             goto end;
         }
         if (sigopts != NULL) {
@@ -420,17 +419,17 @@ int dgst_main(int argc, char **argv)
         EVP_MD_CTX *mctx = NULL;
 
         if (oneshot_sign) {
-            BIO_puts(bio_err, "Oneshot algorithms don't use a digest\n");
+            BIO_printf(bio_err, "Oneshot algorithms don't use a digest\n");
             goto end;
         }
         if (BIO_get_md_ctx(bmd, &mctx) <= 0) {
-            BIO_puts(bio_err, "Error getting context\n");
+            BIO_printf(bio_err, "Error getting context\n");
             goto end;
         }
         if (md == NULL)
             md = (EVP_MD *)EVP_sha256();
         if (!EVP_DigestInit_ex(mctx, md, NULL)) {
-            BIO_puts(bio_err, "Error setting digest\n");
+            BIO_printf(bio_err, "Error setting digest\n");
             goto end;
         }
     }
@@ -465,7 +464,7 @@ int dgst_main(int argc, char **argv)
     }
     if (xoflen > 0) {
         if (!EVP_MD_xof(md)) {
-            BIO_puts(bio_err, "Length can only be specified for XOF\n");
+            BIO_printf(bio_err, "Length can only be specified for XOF\n");
             goto end;
         }
         /*
@@ -474,7 +473,7 @@ int dgst_main(int argc, char **argv)
          * and verify_final methods.
          */
         if (sigkey != NULL) {
-            BIO_puts(bio_err, "Signing key cannot be specified for XOF\n");
+            BIO_printf(bio_err, "Signing key cannot be specified for XOF\n");
             goto end;
         }
     }
@@ -483,14 +482,10 @@ int dgst_main(int argc, char **argv)
         BIO_set_fp(in, stdin, BIO_NOCLOSE);
         if (oneshot_sign)
             ret = do_fp_oneshot_sign(out, signctx, in, separator, out_bin,
-                      sigkey, sigbuf, siglen, NULL, NULL)
-                ? EXIT_SUCCESS
-                : EXIT_FAILURE;
+                sigkey, sigbuf, siglen, NULL, "stdin");
         else
             ret = do_fp(out, buf, inp, separator, out_bin, xoflen,
-                      sigkey, sigbuf, siglen, NULL, md_name, "stdin")
-                ? EXIT_SUCCESS
-                : EXIT_FAILURE;
+                sigkey, sigbuf, siglen, NULL, md_name, "stdin");
     } else {
         const char *sig_name = NULL;
 
@@ -506,12 +501,12 @@ int dgst_main(int argc, char **argv)
                 continue;
             } else {
                 if (oneshot_sign) {
-                    if (!do_fp_oneshot_sign(out, signctx, in, separator, out_bin,
+                    if (do_fp_oneshot_sign(out, signctx, in, separator, out_bin,
                             sigkey, sigbuf, siglen, sig_name,
                             argv[i]))
                         ret = EXIT_FAILURE;
                 } else {
-                    if (!do_fp(out, buf, inp, separator, out_bin, xoflen,
+                    if (do_fp(out, buf, inp, separator, out_bin, xoflen,
                             sigkey, sigbuf, siglen, sig_name, md_name, argv[i]))
                         ret = EXIT_FAILURE;
                 }
@@ -552,15 +547,17 @@ static void show_digests(const OBJ_NAME *name, void *arg)
 
     /* Filter out message digests that we cannot use */
     md = EVP_MD_fetch(app_get0_libctx(), name->name, app_get0_propq());
-    if (md == NULL)
-        return;
+    if (md == NULL) {
+        if (EVP_get_digestbyname(name->name) == NULL)
+            return;
+    }
 
     BIO_printf(dec->bio, "-%-25s", name->name);
     if (++dec->n == 3) {
-        BIO_puts(dec->bio, "\n");
+        BIO_printf(dec->bio, "\n");
         dec->n = 0;
     } else {
-        BIO_puts(dec->bio, " ");
+        BIO_printf(dec->bio, " ");
     }
 
     EVP_MD_free(md);
@@ -636,34 +633,30 @@ static void print_out(BIO *out, unsigned char *buf, size_t len,
         }
         for (i = 0; i < (int)len; i++) {
             if (sep && (i != 0))
-                BIO_puts(out, ":");
+                BIO_printf(out, ":");
             BIO_printf(out, "%02x", buf[i]);
         }
-        BIO_puts(out, "\n");
+        BIO_printf(out, "\n");
     }
 }
 
 static void print_verify_result(BIO *out, int i)
 {
     if (i > 0)
-        BIO_puts(out, "Verified OK\n");
+        BIO_printf(out, "Verified OK\n");
     else if (i == 0)
-        BIO_puts(out, "Verification failure\n");
+        BIO_printf(out, "Verification failure\n");
     else
-        BIO_puts(bio_err, "Error verifying data\n");
+        BIO_printf(bio_err, "Error verifying data\n");
 }
 
-/*
- * Returns 1 on success, 0 on failure.  Do not use EXIT_SUCCESS / EXIT_FAILURE
- * here; reserve those for main() and exit(3) (issue #30562).
- */
 int do_fp(BIO *out, unsigned char *buf, BIO *bp, int sep, int binout, int xoflen,
     EVP_PKEY *key, unsigned char *sigin, int siglen,
     const char *sig_name, const char *md_name,
     const char *file)
 {
     size_t len = BUFSIZE;
-    int i, ret = 0;
+    int i, ret = EXIT_FAILURE;
     unsigned char *allocated_buf = NULL;
 
     while (BIO_pending(bp) || !BIO_eof(bp)) {
@@ -681,7 +674,7 @@ int do_fp(BIO *out, unsigned char *buf, BIO *bp, int sep, int binout, int xoflen
         i = EVP_DigestVerifyFinal(ctx, sigin, (unsigned int)siglen);
         print_verify_result(out, i);
         if (i > 0)
-            ret = 1;
+            ret = EXIT_SUCCESS;
         goto end;
     }
     if (key != NULL) {
@@ -690,7 +683,7 @@ int do_fp(BIO *out, unsigned char *buf, BIO *bp, int sep, int binout, int xoflen
 
         BIO_get_md_ctx(bp, &ctx);
         if (!EVP_DigestSignFinal(ctx, NULL, &tmplen)) {
-            BIO_puts(bio_err, "Error getting maximum length of signed data\n");
+            BIO_printf(bio_err, "Error getting maximum length of signed data\n");
             goto end;
         }
         if (tmplen > BUFSIZE) {
@@ -699,7 +692,7 @@ int do_fp(BIO *out, unsigned char *buf, BIO *bp, int sep, int binout, int xoflen
             buf = allocated_buf;
         }
         if (!EVP_DigestSignFinal(ctx, buf, &len)) {
-            BIO_puts(bio_err, "Error signing data\n");
+            BIO_printf(bio_err, "Error signing data\n");
             goto end;
         }
     } else if (xoflen > 0) {
@@ -714,7 +707,7 @@ int do_fp(BIO *out, unsigned char *buf, BIO *bp, int sep, int binout, int xoflen
         BIO_get_md_ctx(bp, &ctx);
 
         if (!EVP_DigestFinalXOF(ctx, buf, len)) {
-            BIO_puts(bio_err, "Error Digesting Data\n");
+            BIO_printf(bio_err, "Error Digesting Data\n");
             goto end;
         }
     } else {
@@ -723,7 +716,7 @@ int do_fp(BIO *out, unsigned char *buf, BIO *bp, int sep, int binout, int xoflen
             goto end;
     }
     print_out(out, buf, len, sep, binout, sig_name, md_name, file);
-    ret = 1;
+    ret = EXIT_SUCCESS;
 end:
     if (allocated_buf != NULL)
         OPENSSL_clear_free(allocated_buf, len);
@@ -731,87 +724,54 @@ end:
     return ret;
 }
 
-/*
- * Perform one-shot verify or sign on a contiguous data buffer.
- * Returns 0 on failure, 1 on success.
- */
-static int do_oneshot_verify_sign(EVP_MD_CTX *ctx, BIO *out,
-    unsigned char *sigin, int siglen, EVP_PKEY *key,
-    const unsigned char *data, size_t len,
-    int sep, int binout, const char *sig_name, const char *file)
-{
-    int res;
-    size_t siglen_out = 0;
-    unsigned char *sig = NULL;
-
-    if (sigin != NULL) {
-        res = EVP_DigestVerify(ctx, sigin, siglen, data, len);
-        print_verify_result(out, res);
-        return res > 0;
-    }
-    if (key != NULL) {
-        if (EVP_DigestSign(ctx, NULL, &siglen_out, data, len) != 1) {
-            BIO_puts(bio_err, "Error getting maximum length of signed data\n");
-            return 0;
-        }
-        sig = app_malloc(siglen_out, "Signature buffer");
-        if (EVP_DigestSign(ctx, sig, &siglen_out, data, len) != 1) {
-            BIO_puts(bio_err, "Error signing data\n");
-            OPENSSL_free(sig);
-            return 0;
-        }
-        print_out(out, sig, siglen_out, sep, binout, sig_name, NULL, file);
-        OPENSSL_free(sig);
-        return 1;
-    }
-    BIO_puts(bio_err, "key must be set for one-shot algorithms\n");
-    return 0;
-}
-
 /*
  * Some new algorithms only support one shot operations.
  * For these we need to buffer all input and then do the sign on the
  * total buffered input. These algorithms set a NULL digest name which is
  * then used inside EVP_DigestVerify() and EVP_DigestSign().
- * Returns 1 on success, 0 on failure.  Do not use EXIT_SUCCESS / EXIT_FAILURE
- * here; reserve those for main() and exit(3) (issue #30562).
  */
 static int do_fp_oneshot_sign(BIO *out, EVP_MD_CTX *ctx, BIO *in, int sep, int binout,
     EVP_PKEY *key, unsigned char *sigin, int siglen,
     const char *sig_name, const char *file)
 {
-    int ret = 0;
-    size_t buflen = 0;
-    size_t maxlen = 16 * 1024 * 1024;
-    uint8_t *buf = NULL;
+    int res, ret = EXIT_FAILURE;
+    size_t len = 0;
+    int buflen = 0;
+    int maxlen = 16 * 1024 * 1024;
+    uint8_t *buf = NULL, *sig = NULL;
 
-#if defined(OPENSSL_SYS_UNIX) && defined(_POSIX_MAPPED_FILES) && _POSIX_MAPPED_FILES > 0
-    if (file != NULL) {
-        const unsigned char *data = NULL;
-        size_t filesize = 0;
-        int r = app_mmap_file(file, bio_err, (size_t)-1, &data, &filesize);
-
-        if (r == 1) {
-            ret = do_oneshot_verify_sign(ctx, out, sigin, siglen, key, data,
-                filesize, sep, binout, sig_name, file);
-            munmap((void *)data, filesize);
-            return ret;
+    buflen = bio_to_mem(&buf, maxlen, in);
+    if (buflen <= 0) {
+        BIO_printf(bio_err, "Read error in %s\n", file);
+        return ret;
+    }
+    if (sigin != NULL) {
+        res = EVP_DigestVerify(ctx, sigin, siglen, buf, buflen);
+        print_verify_result(out, res);
+        if (res > 0)
+            ret = EXIT_SUCCESS;
+        goto end;
+    }
+    if (key != NULL) {
+        if (EVP_DigestSign(ctx, NULL, &len, buf, buflen) != 1) {
+            BIO_printf(bio_err, "Error getting maximum length of signed data\n");
+            goto end;
         }
-        if (r == -1)
-            return 0; /* error already printed */
-        /* r == 0: empty file, fall through to buffer path */
+        sig = app_malloc(len, "Signature buffer");
+        if (EVP_DigestSign(ctx, sig, &len, buf, buflen) != 1) {
+            BIO_printf(bio_err, "Error signing data\n");
+            goto end;
+        }
+        print_out(out, sig, len, sep, binout, sig_name, NULL, file);
+        ret = EXIT_SUCCESS;
+    } else {
+        BIO_printf(bio_err, "key must be set for one-shot algorithms\n");
+        goto end;
     }
-#endif
 
-    {
-        const char *display_file = file != NULL ? file : "stdin";
-
-        if (!bio_to_mem(&buf, &buflen, maxlen, in))
-            return 0;
-        ret = do_oneshot_verify_sign(ctx, out, sigin, siglen, key, buf, buflen,
-            sep, binout, sig_name, display_file);
-        OPENSSL_clear_free(buf, buflen);
-    }
+end:
+    OPENSSL_free(sig);
+    OPENSSL_clear_free(buf, buflen);
 
     return ret;
 }

apps/dhparam.c

@@ -1,5 +1,5 @@
 /*
- * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -178,7 +178,7 @@ int dhparam_main(int argc, char **argv)
         num = DEFBITS;
 
     if (dsaparam && g) {
-        BIO_puts(bio_err,
+        BIO_printf(bio_err,
             "Error, generator may not be chosen for DSA parameters\n");
         goto end;
     }
@@ -218,16 +218,16 @@ int dhparam_main(int argc, char **argv)
 
         if (dsaparam) {
             if (EVP_PKEY_CTX_set_dsa_paramgen_bits(ctx, num) <= 0) {
-                BIO_puts(bio_err, "Error, unable to set DSA prime length\n");
+                BIO_printf(bio_err, "Error, unable to set DSA prime length\n");
                 goto end;
             }
         } else {
             if (EVP_PKEY_CTX_set_dh_paramgen_prime_len(ctx, num) <= 0) {
-                BIO_puts(bio_err, "Error, unable to set DH prime length\n");
+                BIO_printf(bio_err, "Error, unable to set DH prime length\n");
                 goto end;
             }
             if (EVP_PKEY_CTX_set_dh_paramgen_generator(ctx, g) <= 0) {
-                BIO_puts(bio_err, "Error, unable to set generator\n");
+                BIO_printf(bio_err, "Error, unable to set generator\n");
                 goto end;
             }
         }
@@ -301,13 +301,13 @@ int dhparam_main(int argc, char **argv)
             OSSL_DECODER_CTX_free(decoderctx);
         } while (!done);
         if (tmppkey == NULL) {
-            BIO_puts(bio_err, "Error, unable to load parameters\n");
+            BIO_printf(bio_err, "Error, unable to load parameters\n");
             goto end;
         }
 
         if (dsaparam) {
             if (!EVP_PKEY_is_a(tmppkey, "DSA")) {
-                BIO_puts(bio_err, "Error, unable to load DSA parameters\n");
+                BIO_printf(bio_err, "Error, unable to load DSA parameters\n");
                 goto end;
             }
             pkey = dsa_to_dh(tmppkey);
@@ -316,7 +316,7 @@ int dhparam_main(int argc, char **argv)
         } else {
             if (!EVP_PKEY_is_a(tmppkey, "DH")
                 && !EVP_PKEY_is_a(tmppkey, "DHX")) {
-                BIO_puts(bio_err, "Error, unable to load DH parameters\n");
+                BIO_printf(bio_err, "Error, unable to load DH parameters\n");
                 goto end;
             }
             pkey = tmppkey;
@@ -334,14 +334,14 @@ int dhparam_main(int argc, char **argv)
     if (check) {
         ctx = EVP_PKEY_CTX_new_from_pkey(app_get0_libctx(), pkey, app_get0_propq());
         if (ctx == NULL) {
-            BIO_puts(bio_err, "Error, failed to check DH parameters\n");
+            BIO_printf(bio_err, "Error, failed to check DH parameters\n");
             goto end;
         }
         if (EVP_PKEY_param_check(ctx) <= 0) {
-            BIO_puts(bio_err, "Error, invalid parameters generated\n");
+            BIO_printf(bio_err, "Error, invalid parameters generated\n");
             goto end;
         }
-        BIO_puts(bio_err, "DH parameters appear to be ok.\n");
+        BIO_printf(bio_err, "DH parameters appear to be ok.\n");
     }
 
     if (!noout) {
@@ -354,7 +354,7 @@ int dhparam_main(int argc, char **argv)
 
         if (ectx == NULL || !OSSL_ENCODER_to_bio(ectx, out)) {
             OSSL_ENCODER_CTX_free(ectx);
-            BIO_puts(bio_err, "Error, unable to write DH parameters\n");
+            BIO_printf(bio_err, "Error, unable to write DH parameters\n");
             goto end;
         }
         OSSL_ENCODER_CTX_free(ectx);
@@ -387,7 +387,7 @@ static EVP_PKEY *dsa_to_dh(EVP_PKEY *dh)
     if (!EVP_PKEY_get_bn_param(dh, OSSL_PKEY_PARAM_FFC_P, &bn_p)
         || !EVP_PKEY_get_bn_param(dh, OSSL_PKEY_PARAM_FFC_Q, &bn_q)
         || !EVP_PKEY_get_bn_param(dh, OSSL_PKEY_PARAM_FFC_G, &bn_g)) {
-        BIO_puts(bio_err, "Error, failed to set DH parameters\n");
+        BIO_printf(bio_err, "Error, failed to set DH parameters\n");
         goto err;
     }
 
@@ -399,7 +399,7 @@ static EVP_PKEY *dsa_to_dh(EVP_PKEY *dh)
         || !OSSL_PARAM_BLD_push_BN(tmpl, OSSL_PKEY_PARAM_FFC_G,
             bn_g)
         || (params = OSSL_PARAM_BLD_to_param(tmpl)) == NULL) {
-        BIO_puts(bio_err, "Error, failed to set DH parameters\n");
+        BIO_printf(bio_err, "Error, failed to set DH parameters\n");
         goto err;
     }
 
@@ -407,7 +407,7 @@ static EVP_PKEY *dsa_to_dh(EVP_PKEY *dh)
     if (ctx == NULL
         || EVP_PKEY_fromdata_init(ctx) <= 0
         || EVP_PKEY_fromdata(ctx, &pkey, EVP_PKEY_KEY_PARAMETERS, params) <= 0) {
-        BIO_puts(bio_err, "Error, failed to set DH parameters\n");
+        BIO_printf(bio_err, "Error, failed to set DH parameters\n");
         goto err;
     }
 

apps/dsa.c

@@ -1,5 +1,5 @@
 /*
- * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -174,23 +174,23 @@ int dsa_main(int argc, char **argv)
     private = !pubin && (!pubout || text);
 
     if (!app_passwd(passinarg, passoutarg, &passin, &passout)) {
-        BIO_puts(bio_err, "Error getting passwords\n");
+        BIO_printf(bio_err, "Error getting passwords\n");
         goto end;
     }
 
-    BIO_puts(bio_err, "read DSA key\n");
+    BIO_printf(bio_err, "read DSA key\n");
     if (pubin)
         pkey = load_pubkey(infile, informat, 1, passin, "public key");
     else
         pkey = load_key(infile, informat, 1, passin, "private key");
 
     if (pkey == NULL) {
-        BIO_puts(bio_err, "unable to load Key\n");
+        BIO_printf(bio_err, "unable to load Key\n");
         ERR_print_errors(bio_err);
         goto end;
     }
     if (!EVP_PKEY_is_a(pkey, "DSA")) {
-        BIO_puts(bio_err, "Not a DSA key\n");
+        BIO_printf(bio_err, "Not a DSA key\n");
         goto end;
     }
 
@@ -215,9 +215,9 @@ int dsa_main(int argc, char **argv)
             ERR_print_errors(bio_err);
             goto end;
         }
-        BIO_puts(out, "Public Key=");
+        BIO_printf(out, "Public Key=");
         BN_print(out, pub_key);
-        BIO_puts(out, "\n");
+        BIO_printf(out, "\n");
         BN_free(pub_key);
     }
 
@@ -225,7 +225,7 @@ int dsa_main(int argc, char **argv)
         ret = 0;
         goto end;
     }
-    BIO_puts(bio_err, "writing DSA key\n");
+    BIO_printf(bio_err, "writing DSA key\n");
     if (outformat == FORMAT_ASN1) {
         output_type = "DER";
     } else if (outformat == FORMAT_PEM) {
@@ -234,12 +234,12 @@ int dsa_main(int argc, char **argv)
         output_type = "MSBLOB";
     } else if (outformat == FORMAT_PVK) {
         if (pubin) {
-            BIO_puts(bio_err, "PVK form impossible with public key input\n");
+            BIO_printf(bio_err, "PVK form impossible with public key input\n");
             goto end;
         }
         output_type = "PVK";
     } else {
-        BIO_puts(bio_err, "bad output format specified for outfile\n");
+        BIO_printf(bio_err, "bad output format specified for outfile\n");
         goto end;
     }
 
@@ -287,13 +287,13 @@ int dsa_main(int argc, char **argv)
 
         params[0] = OSSL_PARAM_construct_int("encrypt-level", &pvk_encr);
         if (!OSSL_ENCODER_CTX_set_params(ectx, params)) {
-            BIO_puts(bio_err, "invalid PVK encryption level\n");
+            BIO_printf(bio_err, "invalid PVK encryption level\n");
             goto end;
         }
     }
 
     if (!OSSL_ENCODER_to_bio(ectx, out)) {
-        BIO_puts(bio_err, "unable to write key\n");
+        BIO_printf(bio_err, "unable to write key\n");
         goto end;
     }
     ret = 0;

apps/dsaparam.c

@@ -1,5 +1,5 @@
 /*
- * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -153,7 +153,7 @@ int dsaparam_main(int argc, char **argv)
 
     ctx = EVP_PKEY_CTX_new_from_name(app_get0_libctx(), "DSA", app_get0_propq());
     if (ctx == NULL) {
-        BIO_puts(bio_err,
+        BIO_printf(bio_err,
             "Error, DSA parameter generation context allocation failed\n");
         goto end;
     }
@@ -167,23 +167,23 @@ int dsaparam_main(int argc, char **argv)
         EVP_PKEY_CTX_set_app_data(ctx, bio_err);
         if (verbose) {
             EVP_PKEY_CTX_set_cb(ctx, progress_cb);
-            BIO_printf(bio_err, "Generating DSA parameters, %d bit long prime\n"
-                                "This could take some time\n",
+            BIO_printf(bio_err, "Generating DSA parameters, %d bit long prime\n",
                 num);
+            BIO_printf(bio_err, "This could take some time\n");
         }
         if (EVP_PKEY_paramgen_init(ctx) <= 0) {
-            BIO_puts(bio_err,
+            BIO_printf(bio_err,
                 "Error, DSA key generation paramgen init failed\n");
             goto end;
         }
         if (EVP_PKEY_CTX_set_dsa_paramgen_bits(ctx, num) <= 0) {
-            BIO_puts(bio_err,
+            BIO_printf(bio_err,
                 "Error, DSA key generation setting bit length failed\n");
             goto end;
         }
         if (numqbits > 0) {
             if (EVP_PKEY_CTX_set_dsa_paramgen_q_bits(ctx, numqbits) <= 0) {
-                BIO_puts(bio_err,
+                BIO_printf(bio_err,
                     "Error, DSA key generation setting subprime bit length failed\n");
                 goto end;
             }
@@ -214,7 +214,7 @@ int dsaparam_main(int argc, char **argv)
         else
             i = PEM_write_bio_Parameters(out, params);
         if (!i) {
-            BIO_puts(bio_err, "Error, unable to write DSA parameters\n");
+            BIO_printf(bio_err, "Error, unable to write DSA parameters\n");
             goto end;
         }
     }
@@ -228,7 +228,7 @@ int dsaparam_main(int argc, char **argv)
             goto end;
         }
         if (EVP_PKEY_keygen_init(ctx) <= 0) {
-            BIO_puts(bio_err,
+            BIO_printf(bio_err,
                 "Error, unable to initialise for key generation\n");
             goto end;
         }

apps/ec.c

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2026 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2002-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -54,7 +54,7 @@ const OPTIONS ec_options[] = {
     { "check", OPT_CHECK, '-', "check key consistency" },
     { "", OPT_CIPHER, '-', "Any supported cipher" },
     { "param_enc", OPT_PARAM_ENC, 's',
-        "Selects between named_curve and explicit EC parameter encoding" },
+        "Specifies the way the ec parameters are encoded" },
     { "conv_form", OPT_CONV_FORM, 's', "Specifies the point conversion form " },
 
     OPT_SECTION("Output"),
@@ -172,7 +172,7 @@ int ec_main(int argc, char **argv)
     private = !pubin && (text || (!param_out && !pubout));
 
     if (!app_passwd(passinarg, passoutarg, &passin, &passout)) {
-        BIO_puts(bio_err, "Error getting passwords\n");
+        BIO_printf(bio_err, "Error getting passwords\n");
         goto end;
     }
 
@@ -182,7 +182,7 @@ int ec_main(int argc, char **argv)
         eckey = load_key(infile, informat, 1, passin, "private key");
 
     if (eckey == NULL) {
-        BIO_puts(bio_err, "unable to load Key\n");
+        BIO_printf(bio_err, "unable to load Key\n");
         goto end;
     }
 
@@ -194,25 +194,25 @@ int ec_main(int argc, char **argv)
         && !EVP_PKEY_set_utf8_string_param(
             eckey, OSSL_PKEY_PARAM_EC_POINT_CONVERSION_FORMAT,
             point_format)) {
-        BIO_puts(bio_err, "unable to set point conversion format\n");
+        BIO_printf(bio_err, "unable to set point conversion format\n");
         goto end;
     }
 
     if (asn1_encoding != NULL
         && !EVP_PKEY_set_utf8_string_param(
             eckey, OSSL_PKEY_PARAM_EC_ENCODING, asn1_encoding)) {
-        BIO_puts(bio_err, "unable to set asn1 encoding format\n");
+        BIO_printf(bio_err, "unable to set asn1 encoding format\n");
         goto end;
     }
 
     if (no_public) {
         if (!EVP_PKEY_set_int_param(eckey, OSSL_PKEY_PARAM_EC_INCLUDE_PUBLIC, 0)) {
-            BIO_puts(bio_err, "unable to disable public key encoding\n");
+            BIO_printf(bio_err, "unable to disable public key encoding\n");
             goto end;
         }
     } else {
         if (!EVP_PKEY_set_int_param(eckey, OSSL_PKEY_PARAM_EC_INCLUDE_PUBLIC, 1)) {
-            BIO_puts(bio_err, "unable to enable public key encoding\n");
+            BIO_printf(bio_err, "unable to enable public key encoding\n");
             goto end;
         }
     }
@@ -221,7 +221,7 @@ int ec_main(int argc, char **argv)
         assert(pubin || private);
         if ((pubin && EVP_PKEY_print_public(out, eckey, 0, NULL) <= 0)
             || (!pubin && EVP_PKEY_print_private(out, eckey, 0, NULL) <= 0)) {
-            BIO_puts(bio_err, "unable to print EC key\n");
+            BIO_printf(bio_err, "unable to print EC key\n");
             goto end;
         }
     }
@@ -229,13 +229,13 @@ int ec_main(int argc, char **argv)
     if (check) {
         pctx = EVP_PKEY_CTX_new_from_pkey(NULL, eckey, NULL);
         if (pctx == NULL) {
-            BIO_puts(bio_err, "unable to check EC key\n");
+            BIO_printf(bio_err, "unable to check EC key\n");
             goto end;
         }
         if (EVP_PKEY_check(pctx) <= 0)
-            BIO_puts(bio_err, "EC Key Invalid!\n");
+            BIO_printf(bio_err, "EC Key Invalid!\n");
         else
-            BIO_puts(bio_err, "EC Key valid.\n");
+            BIO_printf(bio_err, "EC Key valid.\n");
         ERR_print_errors(bio_err);
     }
 
@@ -269,7 +269,7 @@ int ec_main(int argc, char **argv)
                     strlen(passout));
         }
         if (!OSSL_ENCODER_to_bio(ectx, out)) {
-            BIO_puts(bio_err, "unable to write EC key\n");
+            BIO_printf(bio_err, "unable to write EC key\n");
             goto end;
         }
     }

apps/ech.c

@@ -1,283 +0,0 @@
-/*
- * Copyright 2024-2026 The OpenSSL Project Authors. All Rights Reserved.
- *
- * Licensed under the Apache License 2.0 (the "License").  You may not use
- * this file except in compliance with the License.  You can obtain a copy
- * in the file LICENSE in the source distribution or at
- * https://www.openssl.org/source/license.html
- */
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include "apps.h"
-#include "progs.h"
-#include <openssl/ssl.h>
-#include <openssl/bio.h>
-#include <openssl/evp.h>
-#include <openssl/err.h>
-#include <openssl/bn.h>
-#include <openssl/pem.h>
-#include <openssl/rand.h>
-#include <openssl/hpke.h>
-
-#include <openssl/objects.h>
-#include <openssl/x509.h>
-
-#ifndef OPENSSL_NO_ECH
-
-#define OSSL_ECH_KEYGEN_MODE 0 /* default: generate a key pair/ECHConfig */
-#define OSSL_ECH_SELPRINT_MODE 1 /* we can print/down-select ECHConfigList */
-#define OSSL_ECH_MAXINFILES 5 /* we'll only take this many inputs */
-
-typedef enum OPTION_choice {
-    /* standard openssl options */
-    OPT_ERR = -1,
-    OPT_EOF = 0,
-    OPT_HELP,
-    OPT_VERBOSE,
-    OPT_TEXT,
-    OPT_OUT,
-    OPT_IN,
-    /* ECHConfig specifics */
-    OPT_PUBLICNAME,
-    OPT_ECHVERSION,
-    OPT_MAXNAMELENGTH,
-    OPT_HPKESUITE,
-    OPT_SELECT
-} OPTION_CHOICE;
-
-const OPTIONS ech_options[] = {
-    OPT_SECTION("General options"),
-    { "help", OPT_HELP, '-', "Display this summary" },
-    { "verbose", OPT_VERBOSE, '-', "Provide additional output" },
-    { "text", OPT_TEXT, '-', "Provide human-readable output" },
-    OPT_SECTION("Key generation"),
-    { "out", OPT_OUT, '>',
-        "Private key and/or ECHConfig [default: echconfig.pem]" },
-    { "public_name", OPT_PUBLICNAME, 's', "public_name value" },
-    { "max_name_len", OPT_MAXNAMELENGTH, 'n',
-        "Maximum host name length value [default: 0]" },
-    { "suite", OPT_HPKESUITE, 's', "HPKE ciphersuite: e.g. \"0x20,1,3\"" },
-    { "ech_version", OPT_ECHVERSION, 'n',
-        "ECHConfig version [default: 0xff0d (13)]" },
-    OPT_SECTION("ECH PEM file downselect/display"),
-    { "in", OPT_IN, '<', "An ECH PEM file" },
-    { "select", OPT_SELECT, 'n', "Downselect to the numbered ECH config" },
-    { NULL }
-};
-
-/**
- * @brief map version string like 0xff01 or 65291 to uint16_t
- * @param arg is the version string, from command line
- * @return is the uint16_t value (with zero for error cases)
- */
-static uint16_t verstr2us(char *arg)
-{
-    long lv = strtol(arg, NULL, 0);
-    uint16_t rv = 0;
-
-    if (lv < 0xffff && lv > 0)
-        rv = (uint16_t)lv;
-    return rv;
-}
-
-int ech_main(int argc, char **argv)
-{
-    char *prog = NULL;
-    OPTION_CHOICE o;
-    int i, rv = 1, verbose = 0, text = 0, outsupp = 0;
-    int select = OSSL_ECHSTORE_ALL, numinfiles = 0;
-    char *outfile = NULL, *infile = NULL;
-    char *infiles[OSSL_ECH_MAXINFILES] = { NULL };
-    char *public_name = NULL, *suitestr = NULL;
-    uint16_t ech_version = OSSL_ECH_CURRENT_VERSION;
-    uint8_t max_name_length = 0;
-    OSSL_HPKE_SUITE hpke_suite = OSSL_HPKE_SUITE_DEFAULT;
-    int mode = OSSL_ECH_KEYGEN_MODE; /* key generation */
-    OSSL_ECHSTORE *es = NULL;
-    BIO *ecf = NULL;
-
-    prog = opt_init(argc, argv, ech_options);
-    while ((o = opt_next()) != OPT_EOF) {
-        switch (o) {
-        case OPT_EOF:
-        case OPT_ERR:
-            BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
-            goto end;
-        case OPT_HELP:
-            opt_help(ech_options);
-            rv = 0;
-            goto end;
-        case OPT_VERBOSE:
-            verbose = 1;
-            break;
-        case OPT_TEXT:
-            text = 1;
-            break;
-        case OPT_SELECT:
-            mode = OSSL_ECH_SELPRINT_MODE;
-            select = strtol(opt_arg(), NULL, 10);
-            break;
-        case OPT_OUT:
-            outfile = opt_arg();
-            outsupp = 1;
-            break;
-        case OPT_IN:
-            mode = OSSL_ECH_SELPRINT_MODE;
-            infile = opt_arg();
-            if (numinfiles >= OSSL_ECH_MAXINFILES) {
-                BIO_printf(bio_err, "too many input files, only %d allowed\n",
-                    OSSL_ECH_MAXINFILES);
-                goto opthelp;
-            }
-            infiles[numinfiles] = infile;
-            numinfiles++;
-            break;
-        case OPT_PUBLICNAME:
-            public_name = opt_arg();
-            break;
-        case OPT_ECHVERSION:
-            ech_version = verstr2us(opt_arg());
-            break;
-        case OPT_MAXNAMELENGTH: {
-            long tmp = strtol(opt_arg(), NULL, 10);
-
-            if (tmp < 0 || tmp > OSSL_ECH_MAX_MAXNAMELEN) {
-                BIO_printf(bio_err,
-                    "max name length out of range [0,%d] (%ld)\n",
-                    OSSL_ECH_MAX_MAXNAMELEN, tmp);
-                goto opthelp;
-            } else {
-                max_name_length = (uint8_t)tmp;
-            }
-        } break;
-        case OPT_HPKESUITE:
-            suitestr = opt_arg();
-            break;
-        }
-    }
-    argc = opt_num_rest();
-    argv = opt_rest();
-    if (argc != 0) {
-        BIO_printf(bio_err, "%s: Unknown parameter %s\n", prog, argv[0]);
-        goto opthelp;
-    }
-    /* Check ECH-specific inputs */
-    switch (ech_version) {
-    case OSSL_ECH_RFC9849_VERSION: /* fall through */
-    case 13:
-        ech_version = OSSL_ECH_RFC9849_VERSION;
-        break;
-    default:
-        BIO_printf(bio_err, "Un-supported version (0x%04x)\n", ech_version);
-        goto end;
-    }
-    if (suitestr != NULL) {
-        if (OSSL_HPKE_str2suite(suitestr, &hpke_suite) != 1) {
-            BIO_printf(bio_err, "Bad OSSL_HPKE_SUITE (%s)\n", suitestr);
-            ERR_print_errors(bio_err);
-            goto end;
-        }
-    }
-    /* Set default if needed */
-    if (outfile == NULL)
-        outfile = "echconfig.pem";
-    es = OSSL_ECHSTORE_new(NULL, NULL);
-    if (es == NULL)
-        goto end;
-    if (mode == OSSL_ECH_KEYGEN_MODE) {
-        if (public_name == NULL) {
-            BIO_printf(bio_err, "public_name required\n");
-            goto end;
-        }
-        if (verbose)
-            BIO_printf(bio_err, "Calling OSSL_ECHSTORE_new_config\n");
-        if ((ecf = bio_open_owner(outfile, FORMAT_PEM, 1)) == NULL
-            || OSSL_ECHSTORE_new_config(es, ech_version, max_name_length,
-                   public_name, hpke_suite)
-                != 1
-            || OSSL_ECHSTORE_write_pem(es, 0, ecf) != 1) {
-            BIO_printf(bio_err, "OSSL_ECHSTORE_new_config error\n");
-            goto end;
-        }
-        if (verbose)
-            BIO_printf(bio_err, "OSSL_ECHSTORE_new_config success\n");
-        rv = 0;
-    }
-    if (mode == OSSL_ECH_SELPRINT_MODE) {
-        if (numinfiles == 0)
-            goto opthelp;
-        for (i = 0; i != numinfiles; i++) {
-            if ((ecf = BIO_new_file(infiles[i], "r")) == NULL
-                || OSSL_ECHSTORE_read_pem(es, ecf, OSSL_ECH_FOR_RETRY) != 1) {
-                BIO_printf(bio_err, "OSSL_ECHSTORE_read_pem error: %s\n",
-                    infiles[i]);
-                goto end;
-            }
-            BIO_free(ecf);
-            ecf = NULL;
-        }
-        if (verbose)
-            BIO_printf(bio_err, "Success reading %d files\n", numinfiles);
-        if (outsupp == 1) {
-            /* write result to that, with downselection if required */
-            if (verbose)
-                BIO_printf(bio_err, "Will write to %s\n", outfile);
-            if (verbose && select != OSSL_ECHSTORE_ALL)
-                BIO_printf(bio_err, "Selected entry: %d\n", select);
-            if ((ecf = BIO_new_file(outfile, "w")) == NULL
-                || OSSL_ECHSTORE_write_pem(es, select, ecf) != 1) {
-                BIO_printf(bio_err, "OSSL_ECHSTORE_write_pem error: %s\n",
-                    outfile);
-                goto end;
-            }
-            if (verbose)
-                BIO_printf(bio_err, "Success writing to %s\n", outfile);
-        }
-        rv = 0;
-    }
-    if (text) {
-        int oi_ind, oi_cnt = 0;
-
-        if (OSSL_ECHSTORE_num_entries(es, &oi_cnt) != 1)
-            goto end;
-        if (verbose)
-            BIO_printf(bio_err, "Printing %d ECHConfig values\n", oi_cnt);
-        for (oi_ind = 0; oi_ind != oi_cnt; oi_ind++) {
-            time_t secs = 0;
-            char *pn = NULL, *ec = NULL;
-            int has_priv, for_retry;
-
-            if (OSSL_ECHSTORE_get1_info(es, oi_ind, &secs, &pn, &ec,
-                    &has_priv, &for_retry)
-                != 1) {
-                OPENSSL_free(pn); /* just in case */
-                OPENSSL_free(ec);
-                goto end;
-            }
-            BIO_printf(bio_err, "ECH entry: %d public_name: %s age: %lld%s%s\n",
-                oi_ind, pn, (long long)secs,
-                has_priv ? " (has private key)" : "",
-                for_retry ? " (will be sent in retry-configs)" : "");
-            BIO_printf(bio_err, "\t%s\n", ec);
-            OPENSSL_free(pn);
-            OPENSSL_free(ec);
-        }
-        if (verbose)
-            BIO_printf(bio_err, "Success printing %d ECHConfigList\n", oi_cnt);
-        rv = 0;
-    }
-end:
-    OSSL_ECHSTORE_free(es);
-    BIO_free_all(ecf);
-    return rv;
-opthelp:
-    BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
-    BIO_printf(bio_err, "\tup to %d -in instances allowed\n", OSSL_ECH_MAXINFILES);
-    OSSL_ECHSTORE_free(es);
-    BIO_free_all(ecf);
-    return rv;
-}
-
-#endif

apps/ecparam.c

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2026 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2002-2025 The OpenSSL Project Authors. All Rights Reserved.
  * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
@@ -57,7 +57,7 @@ const OPTIONS ecparam_options[] = {
     { "text", OPT_TEXT, '-', "Print the ec parameters in text form" },
     { "noout", OPT_NOOUT, '-', "Do not print the ec parameter" },
     { "param_enc", OPT_PARAM_ENC, 's',
-        "Selects between named_curve and explicit EC parameter encoding" },
+        "Specifies the way the ec parameters are encoded" },
 
     OPT_SECTION("Parameter"),
     { "check", OPT_CHECK, '-', "Validate the ec parameters" },
@@ -91,7 +91,8 @@ static int list_builtin_curves(BIO *out)
         if (sname == NULL)
             sname = "";
 
-        BIO_printf(out, "  %-10s: %s\n", sname, comment);
+        BIO_printf(out, "  %-10s: ", sname);
+        BIO_printf(out, "%s\n", comment);
     }
     OPENSSL_free(curves);
     return 1;
@@ -209,11 +210,11 @@ int ecparam_main(int argc, char **argv)
         OSSL_PARAM *p = params;
 
         if (strcmp(curve_name, "secp192r1") == 0) {
-            BIO_puts(bio_err,
+            BIO_printf(bio_err,
                 "using curve name prime192v1 instead of secp192r1\n");
             curve_name = SN_X9_62_prime192v1;
         } else if (strcmp(curve_name, "secp256r1") == 0) {
-            BIO_puts(bio_err,
+            BIO_printf(bio_err,
                 "using curve name prime256v1 instead of secp256r1\n");
             curve_name = SN_X9_62_prime256v1;
         }
@@ -238,7 +239,7 @@ int ecparam_main(int argc, char **argv)
             || EVP_PKEY_keygen_init(gctx_params) <= 0
             || EVP_PKEY_CTX_set_params(gctx_params, params) <= 0
             || EVP_PKEY_keygen(gctx_params, &params_key) <= 0) {
-            BIO_puts(bio_err, "unable to generate key\n");
+            BIO_printf(bio_err, "unable to generate key\n");
             goto end;
         }
     } else {
@@ -257,14 +258,14 @@ int ecparam_main(int argc, char **argv)
             && !EVP_PKEY_set_utf8_string_param(
                 params_key, OSSL_PKEY_PARAM_EC_POINT_CONVERSION_FORMAT,
                 point_format)) {
-            BIO_puts(bio_err, "unable to set point conversion format\n");
+            BIO_printf(bio_err, "unable to set point conversion format\n");
             goto end;
         }
 
         if (asn1_encoding != NULL
             && !EVP_PKEY_set_utf8_string_param(
                 params_key, OSSL_PKEY_PARAM_EC_ENCODING, asn1_encoding)) {
-            BIO_puts(bio_err, "unable to set asn1 encoding format\n");
+            BIO_printf(bio_err, "unable to set asn1 encoding format\n");
             goto end;
         }
     }
@@ -272,7 +273,7 @@ int ecparam_main(int argc, char **argv)
     if (no_seed
         && !EVP_PKEY_set_octet_string_param(params_key, OSSL_PKEY_PARAM_EC_SEED,
             NULL, 0)) {
-        BIO_puts(bio_err, "unable to clear seed\n");
+        BIO_printf(bio_err, "unable to clear seed\n");
         goto end;
     }
 
@@ -282,27 +283,27 @@ int ecparam_main(int argc, char **argv)
 
     if (text
         && EVP_PKEY_print_params(out, params_key, 0, NULL) <= 0) {
-        BIO_puts(bio_err, "unable to print params\n");
+        BIO_printf(bio_err, "unable to print params\n");
         goto end;
     }
 
     if (check || check_named) {
-        BIO_puts(bio_err, "checking elliptic curve parameters: ");
+        BIO_printf(bio_err, "checking elliptic curve parameters: ");
 
         if (check_named
             && !EVP_PKEY_set_utf8_string_param(params_key,
                 OSSL_PKEY_PARAM_EC_GROUP_CHECK_TYPE,
                 OSSL_PKEY_EC_GROUP_CHECK_NAMED)) {
-            BIO_puts(bio_err, "unable to set check_type\n");
+            BIO_printf(bio_err, "unable to set check_type\n");
             goto end;
         }
         pctx = EVP_PKEY_CTX_new_from_pkey(app_get0_libctx(), params_key,
             app_get0_propq());
         if (pctx == NULL || EVP_PKEY_param_check(pctx) <= 0) {
-            BIO_puts(bio_err, "failed\n");
+            BIO_printf(bio_err, "failed\n");
             goto end;
         }
-        BIO_puts(bio_err, "ok\n");
+        BIO_printf(bio_err, "ok\n");
     }
 
     if (outformat == FORMAT_ASN1 && genkey)
@@ -313,7 +314,7 @@ int ecparam_main(int argc, char **argv)
             params_key, OSSL_KEYMGMT_SELECT_DOMAIN_PARAMETERS,
             outformat == FORMAT_ASN1 ? "DER" : "PEM", NULL, NULL);
         if (!OSSL_ENCODER_to_bio(ectx_params, out)) {
-            BIO_puts(bio_err, "unable to write elliptic curve parameters\n");
+            BIO_printf(bio_err, "unable to write elliptic curve parameters\n");
             goto end;
         }
     }
@@ -331,7 +332,7 @@ int ecparam_main(int argc, char **argv)
             app_get0_propq());
         if (EVP_PKEY_keygen_init(gctx_key) <= 0
             || EVP_PKEY_keygen(gctx_key, &key) <= 0) {
-            BIO_puts(bio_err, "unable to generate key\n");
+            BIO_printf(bio_err, "unable to generate key\n");
             goto end;
         }
         assert(private);
@@ -339,8 +340,8 @@ int ecparam_main(int argc, char **argv)
             key, OSSL_KEYMGMT_SELECT_ALL,
             outformat == FORMAT_ASN1 ? "DER" : "PEM", NULL, NULL);
         if (!OSSL_ENCODER_to_bio(ectx_key, out)) {
-            BIO_puts(bio_err, "unable to write elliptic "
-                              "curve parameters\n");
+            BIO_printf(bio_err, "unable to write elliptic "
+                                "curve parameters\n");
             goto end;
         }
     }

apps/enc.c

@@ -1,5 +1,5 @@
 /*
- * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -24,7 +24,6 @@
 #include <openssl/comp.h>
 #endif
 #include <ctype.h>
-#include <inttypes.h>
 
 #undef SIZE
 #undef BSIZE
@@ -115,7 +114,7 @@ const OPTIONS enc_options[] = {
     { "S", OPT_UPPER_S, 's', "Salt, in hex" },
     { "iv", OPT_IV, 's', "IV in hex" },
     { "md", OPT_MD, 's', "Use specified digest to create a key from the passphrase" },
-    { "k", OPT_K, 's', "Passphrase (Deprecated)" },
+    { "k", OPT_K, 's', "Passphrase (Deprecated" },
     { "kfile", OPT_KFILE, '<', "Read passphrase from file (Deprecated)" },
     { "pass", OPT_PASS, 's', "Passphrase source" },
     { "iter", OPT_ITER, 'p',
@@ -143,15 +142,15 @@ const OPTIONS enc_options[] = {
 };
 
 static EVP_SKEY *skey_from_params(const EVP_CIPHER *cipher, const char *skeymgmt,
-    STACK_OF(OPENSSL_STRING) *opts)
+                                  STACK_OF(OPENSSL_STRING) *opts)
 {
     EVP_SKEY *skey = NULL;
     EVP_SKEYMGMT *mgmt = NULL;
     OSSL_PARAM *params = NULL;
 
     mgmt = EVP_SKEYMGMT_fetch(app_get0_libctx(),
-        skeymgmt != NULL ? skeymgmt : EVP_CIPHER_name(cipher),
-        app_get0_propq());
+                              skeymgmt != NULL ? skeymgmt : EVP_CIPHER_name(cipher),
+                              app_get0_propq());
     if (mgmt == NULL)
         return NULL;
 
@@ -162,8 +161,8 @@ static EVP_SKEY *skey_from_params(const EVP_CIPHER *cipher, const char *skeymgmt
     }
 
     skey = EVP_SKEY_import(app_get0_libctx(), EVP_SKEYMGMT_get0_name(mgmt),
-        app_get0_propq(), OSSL_SKEYMGMT_SELECT_ALL, params);
-    app_params_free(params);
+                           app_get0_propq(), OSSL_SKEYMGMT_SELECT_ALL, params);
+    OSSL_PARAM_free(params);
     EVP_SKEYMGMT_free(mgmt);
 
     return skey;
@@ -244,12 +243,12 @@ int enc_main(int argc, char **argv)
             ret = 0;
             goto end;
         case OPT_LIST:
-            BIO_puts(bio_out, "Supported ciphers:\n");
+            BIO_printf(bio_out, "Supported ciphers:\n");
             dec.bio = bio_out;
             dec.n = 0;
             OBJ_NAME_do_all_sorted(OBJ_NAME_TYPE_CIPHER_METH,
                 show_ciphers, &dec);
-            BIO_puts(bio_out, "\n");
+            BIO_printf(bio_out, "\n");
             ret = 0;
             goto end;
         case OPT_E:
@@ -425,7 +424,7 @@ int enc_main(int argc, char **argv)
     if (base64 && bsize < 80)
         bsize = 80;
     if (verbose)
-        BIO_printf(bio_out, "bufsize=%d\n", bsize);
+        BIO_printf(bio_err, "bufsize=%d\n", bsize);
 
 #ifndef OPENSSL_NO_ZLIB
     if (do_zlib)
@@ -448,7 +447,7 @@ int enc_main(int argc, char **argv)
 
     if (infile == NULL) {
         if (!streamable && printkey != 2) { /* if just print key and exit, it's ok */
-            BIO_puts(bio_err, "Unstreamable cipher mode\n");
+            BIO_printf(bio_err, "Unstreamable cipher mode\n");
             goto end;
         }
         in = dup_bio_in(informat);
@@ -460,7 +459,7 @@ int enc_main(int argc, char **argv)
 
     if (str == NULL && passarg != NULL) {
         if (!app_passwd(passarg, NULL, &pass, NULL)) {
-            BIO_puts(bio_err, "Error getting password\n");
+            BIO_printf(bio_err, "Error getting password\n");
             goto end;
         }
         str = pass;
@@ -487,13 +486,13 @@ int enc_main(int argc, char **argv)
                     break;
                 }
                 if (i < 0) {
-                    BIO_puts(bio_err, "bad password read\n");
+                    BIO_printf(bio_err, "bad password read\n");
                     goto end;
                 }
             }
         } else {
 #endif
-            BIO_puts(bio_err, "password required\n");
+            BIO_printf(bio_err, "password required\n");
             goto end;
         }
     }
@@ -584,13 +583,13 @@ int enc_main(int argc, char **argv)
                 sptr = NULL;
             } else {
                 if (hsalt != NULL && !set_hex(hsalt, salt, saltlen)) {
-                    BIO_puts(bio_err, "invalid hex salt value\n");
+                    BIO_printf(bio_err, "invalid hex salt value\n");
                     goto end;
                 }
                 if (enc) { /* encryption */
                     if (hsalt == NULL) {
                         if (RAND_bytes(salt, saltlen) <= 0) {
-                            BIO_puts(bio_err, "RAND_bytes failed\n");
+                            BIO_printf(bio_err, "RAND_bytes failed\n");
                             goto end;
                         }
                         /*
@@ -605,25 +604,25 @@ int enc_main(int argc, char **argv)
                                        (char *)salt,
                                        saltlen)
                                     != saltlen)) {
-                            BIO_puts(bio_err, "error writing output file\n");
+                            BIO_printf(bio_err, "error writing output file\n");
                             goto end;
                         }
                     }
                 } else { /* decryption */
                     if (hsalt == NULL) {
                         if (BIO_read(rbio, mbuf, sizeof(mbuf)) != sizeof(mbuf)) {
-                            BIO_puts(bio_err, "error reading input file\n");
+                            BIO_printf(bio_err, "error reading input file\n");
                             goto end;
                         }
                         if (memcmp(mbuf, magic, sizeof(mbuf)) == 0) { /* file IS salted */
                             if (BIO_read(rbio, salt,
                                     saltlen)
                                 != saltlen) {
-                                BIO_puts(bio_err, "error reading input file\n");
+                                BIO_printf(bio_err, "error reading input file\n");
                                 goto end;
                             }
                         } else { /* file is NOT salted, NO salt available */
-                            BIO_puts(bio_err, "bad magic number\n");
+                            BIO_printf(bio_err, "bad magic number\n");
                             goto end;
                         }
                     }
@@ -644,7 +643,7 @@ int enc_main(int argc, char **argv)
 
                 if (!PKCS5_PBKDF2_HMAC(str, (int)str_len, sptr, islen,
                         iter, dgst, iklen + ivlen, tmpkeyiv)) {
-                    BIO_puts(bio_err, "PKCS5_PBKDF2_HMAC failed\n");
+                    BIO_printf(bio_err, "PKCS5_PBKDF2_HMAC failed\n");
                     goto end;
                 }
                 /* split and move data back to global buffer */
@@ -652,13 +651,13 @@ int enc_main(int argc, char **argv)
                 memcpy(iv, tmpkeyiv + iklen, ivlen);
                 rawkey_set = 1;
             } else {
-                BIO_puts(bio_err, "*** WARNING : "
-                                  "deprecated key derivation used.\n"
-                                  "Using -iter or -pbkdf2 would be better.\n");
+                BIO_printf(bio_err, "*** WARNING : "
+                                    "deprecated key derivation used.\n"
+                                    "Using -iter or -pbkdf2 would be better.\n");
                 if (!EVP_BytesToKey(cipher, dgst, sptr,
                         (unsigned char *)str, (int)str_len,
                         1, key, iv)) {
-                    BIO_puts(bio_err, "EVP_BytesToKey failed\n");
+                    BIO_printf(bio_err, "EVP_BytesToKey failed\n");
                     goto end;
                 }
                 rawkey_set = 1;
@@ -676,9 +675,9 @@ int enc_main(int argc, char **argv)
             int siz = EVP_CIPHER_get_iv_length(cipher);
 
             if (siz == 0) {
-                BIO_puts(bio_err, "warning: iv not used by this cipher\n");
+                BIO_printf(bio_err, "warning: iv not used by this cipher\n");
             } else if (!set_hex(hiv, iv, siz)) {
-                BIO_puts(bio_err, "invalid hex iv value\n");
+                BIO_printf(bio_err, "invalid hex iv value\n");
                 goto end;
             }
         }
@@ -689,12 +688,12 @@ int enc_main(int argc, char **argv)
              * No IV was explicitly set and no IV was generated.
              * Hence the IV is undefined, making correct decryption impossible.
              */
-            BIO_puts(bio_err, "iv undefined\n");
+            BIO_printf(bio_err, "iv undefined\n");
             goto end;
         }
         if (hkey != NULL) {
             if (!set_hex(hkey, key, EVP_CIPHER_get_key_length(cipher))) {
-                BIO_puts(bio_err, "invalid hex key value\n");
+                BIO_printf(bio_err, "invalid hex key value\n");
                 goto end;
             }
             /* wiping secret data as we no longer need it */
@@ -707,7 +706,7 @@ int enc_main(int argc, char **argv)
          * or an opaque symmetric key. We do not allow both options simultaneously.
          */
         if (rawkey_set > 0 && (skeyopts != NULL || skeyuri != NULL)) {
-            BIO_puts(bio_err, "Either a raw key or the skeyopt/skeyuri args must be used.\n");
+            BIO_printf(bio_err, "Either a raw key or the skeyopt/skeyuri args must be used.\n");
             goto end;
         }
 
@@ -736,7 +735,7 @@ int enc_main(int argc, char **argv)
                 char *storepass = NULL;
 
                 if (!app_passwd(storepassarg, NULL, &storepass, NULL)) {
-                    BIO_puts(bio_err,
+                    BIO_printf(bio_err,
                         "Error getting store password from 'storepass' argument\n");
                 }
 
@@ -750,7 +749,7 @@ int enc_main(int argc, char **argv)
                 skey = skey_from_params(cipher, skeymgmt, skeyopts);
                 if (skey == NULL) {
                     BIO_printf(bio_err, "Error creating opaque key object for skeymgmt %s\n",
-                        skeymgmt ? skeymgmt : EVP_CIPHER_name(cipher));
+                               skeymgmt ? skeymgmt : EVP_CIPHER_name(cipher));
                     goto end;
                 }
             }
@@ -807,11 +806,11 @@ int enc_main(int argc, char **argv)
         if (inl <= 0)
             break;
         if (!streamable && !BIO_eof(rbio)) { /* do not output data */
-            BIO_puts(bio_err, "Unstreamable cipher mode\n");
+            BIO_printf(bio_err, "Unstreamable cipher mode\n");
             goto end;
         }
         if (BIO_write(wbio, (char *)buff, inl) != inl) {
-            BIO_puts(bio_err, "error writing output file\n");
+            BIO_printf(bio_err, "error writing output file\n");
             goto end;
         }
         if (!streamable)
@@ -819,17 +818,16 @@ int enc_main(int argc, char **argv)
     }
     if (!BIO_flush(wbio)) {
         if (enc)
-            BIO_puts(bio_err, "bad encrypt\n");
+            BIO_printf(bio_err, "bad encrypt\n");
         else
-            BIO_puts(bio_err, "bad decrypt\n");
+            BIO_printf(bio_err, "bad decrypt\n");
         goto end;
     }
 
     ret = 0;
     if (verbose) {
-        BIO_printf(bio_err, "bytes read   : %8" PRIu64 "\n"
-                            "bytes written: %8" PRIu64 "\n",
-            BIO_number_read(in), BIO_number_written(out));
+        BIO_printf(bio_err, "bytes read   : %8ju\n", BIO_number_read(in));
+        BIO_printf(bio_err, "bytes written: %8ju\n", BIO_number_written(out));
     }
 end:
     ERR_print_errors(bio_err);
@@ -855,29 +853,25 @@ end:
 static void show_ciphers(const OBJ_NAME *name, void *arg)
 {
     struct doall_enc_ciphers *dec = (struct doall_enc_ciphers *)arg;
-    EVP_CIPHER *cipher;
+    const EVP_CIPHER *cipher;
 
     if (!islower((unsigned char)*name->name))
         return;
 
     /* Filter out ciphers that we cannot use */
-    cipher = EVP_CIPHER_fetch(app_get0_libctx(), name->name, app_get0_propq());
+    cipher = EVP_get_cipherbyname(name->name);
     if (cipher == NULL
         || (EVP_CIPHER_get_flags(cipher) & EVP_CIPH_FLAG_AEAD_CIPHER) != 0
         || (EVP_CIPHER_get_flags(cipher) & EVP_CIPH_FLAG_ENC_THEN_MAC) != 0
-        || EVP_CIPHER_get_mode(cipher) == EVP_CIPH_XTS_MODE) {
-        EVP_CIPHER_free(cipher);
+        || EVP_CIPHER_get_mode(cipher) == EVP_CIPH_XTS_MODE)
         return;
-    }
 
     BIO_printf(dec->bio, "-%-25s", name->name);
     if (++dec->n == 3) {
-        BIO_puts(dec->bio, "\n");
+        BIO_printf(dec->bio, "\n");
         dec->n = 0;
     } else
-        BIO_puts(dec->bio, " ");
-
-    EVP_CIPHER_free(cipher);
+        BIO_printf(dec->bio, " ");
 }
 
 static int set_hex(const char *in, unsigned char *out, int size)
@@ -888,17 +882,17 @@ static int set_hex(const char *in, unsigned char *out, int size)
     i = size * 2;
     n = (int)strlen(in);
     if (n > i) {
-        BIO_puts(bio_err, "hex string is too long, ignoring excess\n");
+        BIO_printf(bio_err, "hex string is too long, ignoring excess\n");
         n = i; /* ignore exceeding part */
     } else if (n < i) {
-        BIO_puts(bio_err, "hex string is too short, padding with zero bytes to length\n");
+        BIO_printf(bio_err, "hex string is too short, padding with zero bytes to length\n");
     }
 
     memset(out, 0, size);
     for (i = 0; i < n; i++) {
         j = (unsigned char)*in++;
         if (!isxdigit(j)) {
-            BIO_puts(bio_err, "non-hex digit\n");
+            BIO_printf(bio_err, "non-hex digit\n");
             return 0;
         }
         j = (unsigned char)OPENSSL_hexchar2int(j);

apps/fipsinstall.c

@@ -1,5 +1,5 @@
 /*
- * Copyright 2019-2026 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2019-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -77,8 +77,7 @@ typedef enum OPTION_choice {
     OPT_NO_PBKDF2_LOWER_BOUND_CHECK,
     OPT_ECDH_COFACTOR_CHECK,
     OPT_SELF_TEST_ONLOAD,
-    OPT_SELF_TEST_ONINSTALL,
-    OPT_DEFER_TESTS
+    OPT_SELF_TEST_ONINSTALL
 } OPTION_CHOICE;
 
 const OPTIONS fipsinstall_options[] = {
@@ -151,7 +150,6 @@ const OPTIONS fipsinstall_options[] = {
         "Disable lower bound check for PBKDF2" },
     { "ecdh_cofactor_check", OPT_ECDH_COFACTOR_CHECK, '-',
         "Enable Cofactor check for ECDH" },
-    { "defer_tests", OPT_DEFER_TESTS, '-', "Enables test deferral" },
     OPT_SECTION("Input"),
     { "in", OPT_IN, '<', "Input config file, used when verifying" },
 
@@ -199,7 +197,6 @@ typedef struct {
     unsigned int x942kdf_key_check : 1;
     unsigned int pbkdf2_lower_bound_check : 1;
     unsigned int ecdh_cofactor_check : 1;
-    unsigned int defer_tests : 1;
 } FIPS_OPTS;
 
 /* Pedantic FIPS compliance */
@@ -234,7 +231,6 @@ static const FIPS_OPTS pedantic_opts = {
     1, /* x942kdf_key_check */
     1, /* pbkdf2_lower_bound_check */
     1, /* ecdh_cofactor_check */
-    0, /* defer_tests */
 };
 
 /* Default FIPS settings for backward compatibility */
@@ -269,7 +265,6 @@ static FIPS_OPTS fips_opts = {
     0, /* x942kdf_key_check */
     1, /* pbkdf2_lower_bound_check */
     0, /* ecdh_cofactor_check */
-    0, /* defer_tests */
 };
 
 static int check_non_pedantic_fips(int pedantic, const char *name)
@@ -314,7 +309,7 @@ static int load_fips_prov_and_run_self_test(const char *prov_name,
 
     prov = OSSL_PROVIDER_load(NULL, prov_name);
     if (prov == NULL) {
-        BIO_puts(bio_err, "Failed to load FIPS module\n");
+        BIO_printf(bio_err, "Failed to load FIPS module\n");
         goto end;
     }
     if (!quiet) {
@@ -326,7 +321,7 @@ static int load_fips_prov_and_run_self_test(const char *prov_name,
             &build, sizeof(build));
         *p = OSSL_PARAM_construct_end();
         if (!OSSL_PROVIDER_get_params(prov, params)) {
-            BIO_puts(bio_err, "Failed to query FIPS module parameters\n");
+            BIO_printf(bio_err, "Failed to query FIPS module parameters\n");
             goto end;
         }
         if (OSSL_PARAM_modified(params))
@@ -340,7 +335,7 @@ static int load_fips_prov_and_run_self_test(const char *prov_name,
             &vers, sizeof(vers));
         *p = OSSL_PARAM_construct_end();
         if (!OSSL_PROVIDER_get_params(prov, params)) {
-            BIO_puts(bio_err, "Failed to query FIPS module parameters\n");
+            BIO_printf(bio_err, "Failed to query FIPS module parameters\n");
             goto end;
         }
     }
@@ -368,13 +363,11 @@ static int print_mac(BIO *bio, const char *label, const unsigned char *mac,
 static int write_config_header(BIO *out, const char *prov_name,
     const char *section)
 {
-    return (BIO_printf(out, "openssl_conf = openssl_init\n\n"
-                            "[openssl_init]\n"
-                            "providers = provider_section\n\n"
-                            "[provider_section]\n"
-                            "%s = %s\n\n",
-                prov_name, section)
-        > 0);
+    return BIO_printf(out, "openssl_conf = openssl_init\n\n")
+        && BIO_printf(out, "[openssl_init]\n")
+        && BIO_printf(out, "providers = provider_section\n\n")
+        && BIO_printf(out, "[provider_section]\n")
+        && BIO_printf(out, "%s = %s\n\n", prov_name, section);
 }
 
 /*
@@ -393,75 +386,109 @@ static int write_config_fips_section(BIO *out, const char *section,
 {
     int ret = 0;
 
-    if (BIO_printf(out, "[%s]\n"
-                        "activate = 1\n"
-                        "%s = %s\n"
-                        "%s = %s\n"
-                        "%s = %s\n"
-                        "%s = %s\n"
-                        "%s = %s\n"
-                        "%s = %s\n"
-                        "%s = %s\n"
-                        "%s = %s\n"
-                        "%s = %s\n"
-                        "%s = %s\n"
-                        "%s = %s\n"
-                        "%s = %s\n"
-                        "%s = %s\n"
-                        "%s = %s\n"
-                        "%s = %s\n"
-                        "%s = %s\n"
-                        "%s = %s\n"
-                        "%s = %s\n"
-                        "%s = %s\n"
-                        "%s = %s\n"
-                        "%s = %s\n"
-                        "%s = %s\n"
-                        "%s = %s\n"
-                        "%s = %s\n"
-                        "%s = %s\n"
-                        "%s = %s\n"
-                        "%s = %s\n"
-                        "%s = %s\n"
-                        "%s = %s\n"
-                        "%s = %s\n",
-            section,
-            OSSL_PROV_FIPS_PARAM_INSTALL_VERSION, VERSION_VAL,
-            OSSL_PROV_FIPS_PARAM_CONDITIONAL_ERRORS, opts->conditional_errors ? "1" : "0",
-            OSSL_PROV_PARAM_SECURITY_CHECKS, opts->security_checks ? "1" : "0",
-            OSSL_PROV_PARAM_HMAC_KEY_CHECK, opts->hmac_key_check ? "1" : "0",
-            OSSL_PROV_PARAM_KMAC_KEY_CHECK, opts->kmac_key_check ? "1" : "0",
-            OSSL_PROV_PARAM_TLS1_PRF_EMS_CHECK, opts->tls_prf_ems_check ? "1" : "0",
-            OSSL_PROV_PARAM_NO_SHORT_MAC, opts->no_short_mac ? "1" : "0",
-            OSSL_PROV_PARAM_DRBG_TRUNC_DIGEST, opts->drgb_no_trunc_dgst ? "1" : "0",
-            OSSL_PROV_PARAM_SIGNATURE_DIGEST_CHECK, opts->signature_digest_check ? "1" : "0",
-            OSSL_PROV_PARAM_HKDF_DIGEST_CHECK, opts->hkdf_digest_check ? "1" : "0",
-            OSSL_PROV_PARAM_TLS13_KDF_DIGEST_CHECK, opts->tls13_kdf_digest_check ? "1" : "0",
-            OSSL_PROV_PARAM_TLS1_PRF_DIGEST_CHECK, opts->tls1_prf_digest_check ? "1" : "0",
-            OSSL_PROV_PARAM_SSHKDF_DIGEST_CHECK, opts->sshkdf_digest_check ? "1" : "0",
-            OSSL_PROV_PARAM_SSKDF_DIGEST_CHECK, opts->sskdf_digest_check ? "1" : "0",
-            OSSL_PROV_PARAM_X963KDF_DIGEST_CHECK, opts->x963kdf_digest_check ? "1" : "0",
-            OSSL_PROV_PARAM_DSA_SIGN_DISABLED, opts->dsa_sign_disabled ? "1" : "0",
-            OSSL_PROV_PARAM_TDES_ENCRYPT_DISABLED, opts->tdes_encrypt_disabled ? "1" : "0",
-            OSSL_PROV_PARAM_RSA_PKCS15_PAD_DISABLED, opts->rsa_pkcs15_padding_disabled ? "1" : "0",
-            OSSL_PROV_PARAM_RSA_PSS_SALTLEN_CHECK, opts->rsa_pss_saltlen_check ? "1" : "0",
-            OSSL_PROV_PARAM_RSA_SIGN_X931_PAD_DISABLED, opts->sign_x931_padding_disabled ? "1" : "0",
-            OSSL_PROV_PARAM_HKDF_KEY_CHECK, opts->hkdf_key_check ? "1" : "0",
-            OSSL_PROV_PARAM_KBKDF_KEY_CHECK, opts->kbkdf_key_check ? "1" : "0",
-            OSSL_PROV_PARAM_TLS13_KDF_KEY_CHECK, opts->tls13_kdf_key_check ? "1" : "0",
-            OSSL_PROV_PARAM_TLS1_PRF_KEY_CHECK, opts->tls1_prf_key_check ? "1" : "0",
-            OSSL_PROV_PARAM_SSHKDF_KEY_CHECK, opts->sshkdf_key_check ? "1" : "0",
-            OSSL_PROV_PARAM_SSKDF_KEY_CHECK, opts->sskdf_key_check ? "1" : "0",
-            OSSL_PROV_PARAM_X963KDF_KEY_CHECK, opts->x963kdf_key_check ? "1" : "0",
-            OSSL_PROV_PARAM_X942KDF_KEY_CHECK, opts->x942kdf_key_check ? "1" : "0",
-            OSSL_PROV_PARAM_PBKDF2_LOWER_BOUND_CHECK, opts->pbkdf2_lower_bound_check ? "1" : "0",
-            OSSL_PROV_PARAM_ECDH_COFACTOR_CHECK, opts->ecdh_cofactor_check ? "1" : "0")
+    if (BIO_printf(out, "[%s]\n", section) <= 0
+        || BIO_printf(out, "activate = 1\n") <= 0
+        || BIO_printf(out, "%s = %s\n", OSSL_PROV_FIPS_PARAM_INSTALL_VERSION,
+               VERSION_VAL)
+            <= 0
+        || BIO_printf(out, "%s = %s\n", OSSL_PROV_FIPS_PARAM_CONDITIONAL_ERRORS,
+               opts->conditional_errors ? "1" : "0")
+            <= 0
+        || BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_SECURITY_CHECKS,
+               opts->security_checks ? "1" : "0")
+            <= 0
+        || BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_HMAC_KEY_CHECK,
+               opts->hmac_key_check ? "1" : "0")
+            <= 0
+        || BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_KMAC_KEY_CHECK,
+               opts->kmac_key_check ? "1" : "0")
+            <= 0
+        || BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_TLS1_PRF_EMS_CHECK,
+               opts->tls_prf_ems_check ? "1" : "0")
+            <= 0
+        || BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_NO_SHORT_MAC,
+               opts->no_short_mac ? "1" : "0")
+            <= 0
+        || BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_DRBG_TRUNC_DIGEST,
+               opts->drgb_no_trunc_dgst ? "1" : "0")
+            <= 0
+        || BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_SIGNATURE_DIGEST_CHECK,
+               opts->signature_digest_check ? "1" : "0")
+            <= 0
+        || BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_HKDF_DIGEST_CHECK,
+               opts->hkdf_digest_check ? "1" : "0")
+            <= 0
+        || BIO_printf(out, "%s = %s\n",
+               OSSL_PROV_PARAM_TLS13_KDF_DIGEST_CHECK,
+               opts->tls13_kdf_digest_check ? "1" : "0")
+            <= 0
+        || BIO_printf(out, "%s = %s\n",
+               OSSL_PROV_PARAM_TLS1_PRF_DIGEST_CHECK,
+               opts->tls1_prf_digest_check ? "1" : "0")
+            <= 0
+        || BIO_printf(out, "%s = %s\n",
+               OSSL_PROV_PARAM_SSHKDF_DIGEST_CHECK,
+               opts->sshkdf_digest_check ? "1" : "0")
+            <= 0
+        || BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_SSKDF_DIGEST_CHECK,
+               opts->sskdf_digest_check ? "1" : "0")
+            <= 0
+        || BIO_printf(out, "%s = %s\n",
+               OSSL_PROV_PARAM_X963KDF_DIGEST_CHECK,
+               opts->x963kdf_digest_check ? "1" : "0")
+            <= 0
+        || BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_DSA_SIGN_DISABLED,
+               opts->dsa_sign_disabled ? "1" : "0")
+            <= 0
+        || BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_TDES_ENCRYPT_DISABLED,
+               opts->tdes_encrypt_disabled ? "1" : "0")
+            <= 0
+        || BIO_printf(out, "%s = %s\n",
+               OSSL_PROV_PARAM_RSA_PKCS15_PAD_DISABLED,
+               opts->rsa_pkcs15_padding_disabled ? "1" : "0")
+            <= 0
+        || BIO_printf(out, "%s = %s\n",
+               OSSL_PROV_PARAM_RSA_PSS_SALTLEN_CHECK,
+               opts->rsa_pss_saltlen_check ? "1" : "0")
+            <= 0
+        || BIO_printf(out, "%s = %s\n",
+               OSSL_PROV_PARAM_RSA_SIGN_X931_PAD_DISABLED,
+               opts->sign_x931_padding_disabled ? "1" : "0")
+            <= 0
+        || BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_HKDF_KEY_CHECK,
+               opts->hkdf_key_check ? "1" : "0")
+            <= 0
+        || BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_KBKDF_KEY_CHECK,
+               opts->kbkdf_key_check ? "1" : "0")
+            <= 0
+        || BIO_printf(out, "%s = %s\n",
+               OSSL_PROV_PARAM_TLS13_KDF_KEY_CHECK,
+               opts->tls13_kdf_key_check ? "1" : "0")
+            <= 0
+        || BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_TLS1_PRF_KEY_CHECK,
+               opts->tls1_prf_key_check ? "1" : "0")
+            <= 0
+        || BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_SSHKDF_KEY_CHECK,
+               opts->sshkdf_key_check ? "1" : "0")
+            <= 0
+        || BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_SSKDF_KEY_CHECK,
+               opts->sskdf_key_check ? "1" : "0")
+            <= 0
+        || BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_X963KDF_KEY_CHECK,
+               opts->x963kdf_key_check ? "1" : "0")
+            <= 0
+        || BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_X942KDF_KEY_CHECK,
+               opts->x942kdf_key_check ? "1" : "0")
+            <= 0
+        || BIO_printf(out, "%s = %s\n",
+               OSSL_PROV_PARAM_PBKDF2_LOWER_BOUND_CHECK,
+               opts->pbkdf2_lower_bound_check ? "1" : "0")
+            <= 0
+        || BIO_printf(out, "%s = %s\n", OSSL_PROV_PARAM_ECDH_COFACTOR_CHECK,
+               opts->ecdh_cofactor_check ? "1" : "0")
             <= 0
         || !print_mac(out, OSSL_PROV_FIPS_PARAM_MODULE_MAC, module_mac,
-            module_mac_len)
-        || BIO_printf(out, "%s = %s\n", OSSL_PROV_FIPS_PARAM_DEFER_TESTS,
-               opts->defer_tests ? "1" : "0")
-            <= 0)
+            module_mac_len))
         goto end;
 
     if (install_mac != NULL
@@ -545,37 +572,37 @@ static int verify_config(const char *infile, const char *section,
 
     s = NCONF_get_string(conf, section, OSSL_PROV_FIPS_PARAM_INSTALL_VERSION);
     if (s == NULL || strcmp(s, VERSION_VAL) != 0) {
-        BIO_puts(bio_err, "version not found\n");
+        BIO_printf(bio_err, "version not found\n");
         goto end;
     }
     s = NCONF_get_string(conf, section, OSSL_PROV_FIPS_PARAM_MODULE_MAC);
     if (s == NULL) {
-        BIO_puts(bio_err, "Module integrity MAC not found\n");
+        BIO_printf(bio_err, "Module integrity MAC not found\n");
         goto end;
     }
     buf1 = OPENSSL_hexstr2buf(s, &len);
     if (buf1 == NULL
         || (size_t)len != module_mac_len
         || memcmp(module_mac, buf1, module_mac_len) != 0) {
-        BIO_puts(bio_err, "Module integrity mismatch\n");
+        BIO_printf(bio_err, "Module integrity mismatch\n");
         goto end;
     }
     if (install_mac != NULL && install_mac_len > 0) {
         s = NCONF_get_string(conf, section, OSSL_PROV_FIPS_PARAM_INSTALL_STATUS);
         if (s == NULL || strcmp(s, INSTALL_STATUS_VAL) != 0) {
-            BIO_puts(bio_err, "install status not found\n");
+            BIO_printf(bio_err, "install status not found\n");
             goto end;
         }
         s = NCONF_get_string(conf, section, OSSL_PROV_FIPS_PARAM_INSTALL_MAC);
         if (s == NULL) {
-            BIO_puts(bio_err, "Install indicator MAC not found\n");
+            BIO_printf(bio_err, "Install indicator MAC not found\n");
             goto end;
         }
         buf2 = OPENSSL_hexstr2buf(s, &len);
         if (buf2 == NULL
             || (size_t)len != install_mac_len
             || memcmp(install_mac, buf2, install_mac_len) != 0) {
-            BIO_puts(bio_err, "Install indicator status mismatch\n");
+            BIO_printf(bio_err, "Install indicator status mismatch\n");
             goto end;
         }
     }
@@ -775,9 +802,6 @@ int fipsinstall_main(int argc, char **argv)
             set_selftest_onload_option = 1;
             fips_opts.self_test_onload = 0;
             break;
-        case OPT_DEFER_TESTS:
-            fips_opts.defer_tests = 1;
-            break;
         }
     }
 
@@ -826,7 +850,7 @@ int fipsinstall_main(int argc, char **argv)
 
     module_bio = bio_open_default(module_fname, 'r', FORMAT_BINARY);
     if (module_bio == NULL) {
-        BIO_puts(bio_err, "Failed to open module file\n");
+        BIO_printf(bio_err, "Failed to open module file\n");
         goto end;
     }
 
@@ -842,7 +866,7 @@ int fipsinstall_main(int argc, char **argv)
 
     ctx = EVP_MAC_CTX_new(mac);
     if (ctx == NULL) {
-        BIO_puts(bio_err, "Unable to create MAC CTX for module check\n");
+        BIO_printf(bio_err, "Unable to create MAC CTX for module check\n");
         goto end;
     }
 
@@ -854,7 +878,7 @@ int fipsinstall_main(int argc, char **argv)
             goto end;
 
         if (!EVP_MAC_CTX_set_params(ctx, params)) {
-            BIO_puts(bio_err, "MAC parameter error\n");
+            BIO_printf(bio_err, "MAC parameter error\n");
             ERR_print_errors(bio_err);
             ok = 0;
         }
@@ -865,7 +889,7 @@ int fipsinstall_main(int argc, char **argv)
 
     ctx2 = EVP_MAC_CTX_dup(ctx);
     if (ctx2 == NULL) {
-        BIO_puts(bio_err, "Unable to create MAC CTX for install indicator\n");
+        BIO_printf(bio_err, "Unable to create MAC CTX for install indicator\n");
         goto end;
     }
 
@@ -876,7 +900,7 @@ int fipsinstall_main(int argc, char **argv)
     mem_bio = BIO_new_mem_buf((const void *)INSTALL_STATUS_VAL,
         (int)strlen(INSTALL_STATUS_VAL));
     if (mem_bio == NULL) {
-        BIO_puts(bio_err, "Unable to create memory BIO\n");
+        BIO_printf(bio_err, "Unable to create memory BIO\n");
         goto end;
     }
     if (!do_mac(ctx2, read_buffer, mem_bio, install_mac, &install_mac_len))
@@ -889,7 +913,7 @@ int fipsinstall_main(int argc, char **argv)
                 install_mac, install_mac_len))
             goto end;
         if (!quiet)
-            BIO_puts(bio_err, "VERIFY PASSED\n");
+            BIO_printf(bio_err, "VERIFY PASSED\n");
     } else {
         conf = generate_config_and_load(prov_name, section_name, module_mac,
             module_mac_len, &fips_opts);
@@ -912,7 +936,7 @@ int fipsinstall_main(int argc, char **argv)
         fout = out_fname == NULL ? dup_bio_out(FORMAT_TEXT)
                                  : bio_open_default(out_fname, 'w', FORMAT_TEXT);
         if (fout == NULL) {
-            BIO_puts(bio_err, "Failed to open file\n");
+            BIO_printf(bio_err, "Failed to open file\n");
             goto end;
         }
 
@@ -921,7 +945,7 @@ int fipsinstall_main(int argc, char **argv)
                 install_mac, install_mac_len))
             goto end;
         if (!quiet)
-            BIO_puts(bio_err, "INSTALL PASSED\n");
+            BIO_printf(bio_err, "INSTALL PASSED\n");
     }
 
     ret = 0;

apps/gendsa.c

@@ -1,5 +1,5 @@
 /*
- * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -117,7 +117,7 @@ int gendsa_main(int argc, char **argv)
     private = 1;
 
     if (!app_passwd(NULL, passoutarg, NULL, &passout)) {
-        BIO_puts(bio_err, "Error getting password\n");
+        BIO_printf(bio_err, "Error getting password\n");
         goto end;
     }
 
@@ -136,13 +136,13 @@ int gendsa_main(int argc, char **argv)
 
     ctx = EVP_PKEY_CTX_new_from_pkey(app_get0_libctx(), pkey, app_get0_propq());
     if (ctx == NULL) {
-        BIO_puts(bio_err, "unable to create PKEY context\n");
+        BIO_printf(bio_err, "unable to create PKEY context\n");
         goto end;
     }
     EVP_PKEY_free(pkey);
     pkey = NULL;
     if (EVP_PKEY_keygen_init(ctx) <= 0) {
-        BIO_puts(bio_err, "unable to set up for key generation\n");
+        BIO_printf(bio_err, "unable to set up for key generation\n");
         goto end;
     }
     pkey = app_keygen(ctx, "DSA", nbits, verbose);
@@ -151,7 +151,7 @@ int gendsa_main(int argc, char **argv)
 
     assert(private);
     if (!PEM_write_bio_PrivateKey(out, pkey, enc, NULL, 0, NULL, passout)) {
-        BIO_puts(bio_err, "unable to output generated key\n");
+        BIO_printf(bio_err, "unable to output generated key\n");
         goto end;
     }
     ret = 0;

apps/genpkey.c

@@ -1,5 +1,5 @@
 /*
- * Copyright 2006-2026 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2006-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -22,7 +22,6 @@ static int init_keygen_file(EVP_PKEY_CTX **pctx, const char *file,
 typedef enum OPTION_choice {
     OPT_COMMON,
     OPT_OUTFORM,
-    OPT_ENCOPT,
     OPT_OUT,
     OPT_PASS,
     OPT_PARAMFILE,
@@ -54,7 +53,6 @@ const OPTIONS genpkey_options[] = {
     { "out", OPT_OUT, '>', "Output (private key) file" },
     { "outpubkey", OPT_OUTPUBKEY, '>', "Output public key file" },
     { "outform", OPT_OUTFORM, 'F', "output format (DER or PEM)" },
-    { "encopt", OPT_ENCOPT, 's', "Private key encoder parameter" },
     { "pass", OPT_PASS, 's', "Output file pass phrase source" },
     { "genparam", OPT_GENPARAM, '-', "Generate parameters, not key" },
     { "text", OPT_TEXT, '-', "Print the private key in text" },
@@ -108,7 +106,7 @@ static void show_gen_pkeyopt(const char *algname, OSSL_LIB_CTX *libctx, const ch
     if (params == NULL)
         goto cleanup;
 
-    BIO_puts(bio_err, "\nThe possible -pkeyopt arguments are:\n");
+    BIO_printf(bio_err, "\nThe possible -pkeyopt arguments are:\n");
     for (i = 0; params[i].key != NULL; ++i) {
         const char *name = param_datatype_2name(params[i].data_type, &ishex);
 
@@ -132,7 +130,6 @@ int genpkey_main(int argc, char **argv)
     OPTION_CHOICE o;
     int outformat = FORMAT_PEM, text = 0, ret = 1, rv, do_param = 0;
     int private = 0, i;
-    STACK_OF(OPENSSL_STRING) *encopt = NULL;
     OSSL_LIB_CTX *libctx = app_get0_libctx();
     STACK_OF(OPENSSL_STRING) *keyopt = NULL;
 
@@ -157,12 +154,6 @@ int genpkey_main(int argc, char **argv)
             if (!opt_format(opt_arg(), OPT_FMT_PEMDER, &outformat))
                 goto opthelp;
             break;
-        case OPT_ENCOPT:
-            if (encopt == NULL)
-                encopt = sk_OPENSSL_STRING_new_null();
-            if (!sk_OPENSSL_STRING_push(encopt, opt_arg()))
-                goto end;
-            break;
         case OPT_OUT:
             outfile = opt_arg();
             break;
@@ -245,7 +236,7 @@ int genpkey_main(int argc, char **argv)
     if (!opt_cipher(ciphername, &cipher))
         goto opthelp;
     if (ciphername != NULL && do_param == 1) {
-        BIO_puts(bio_err, "Cannot use cipher with -genparam option\n");
+        BIO_printf(bio_err, "Cannot use cipher with -genparam option\n");
         goto opthelp;
     }
 
@@ -281,16 +272,16 @@ int genpkey_main(int argc, char **argv)
         rv = PEM_write_bio_Parameters(mem_out, pkey);
     } else if (outformat == FORMAT_PEM) {
         assert(private);
-        rv = encode_private_key(mem_out, "PEM", pkey, encopt, cipher, pass);
+        rv = PEM_write_bio_PrivateKey(mem_out, pkey, cipher, NULL, 0, NULL, pass);
         if (rv > 0 && mem_outpubkey != NULL)
             rv = PEM_write_bio_PUBKEY(mem_outpubkey, pkey);
     } else if (outformat == FORMAT_ASN1) {
         assert(private);
-        rv = encode_private_key(mem_out, "DER", pkey, encopt, cipher, pass);
+        rv = i2d_PrivateKey_bio(mem_out, pkey);
         if (rv > 0 && mem_outpubkey != NULL)
             rv = i2d_PUBKEY_bio(mem_outpubkey, pkey);
     } else {
-        BIO_puts(bio_err, "Bad format specified for key\n");
+        BIO_printf(bio_err, "Bad format specified for key\n");
         goto end;
     }
 
@@ -331,7 +322,6 @@ end:
                     outfile, strerror(errno));
         }
     }
-    sk_OPENSSL_STRING_free(encopt);
     EVP_PKEY_free(pkey);
     EVP_PKEY_CTX_free(ctx);
     EVP_CIPHER_free(cipher);

apps/genrsa.c

@@ -1,5 +1,5 @@
 /*
- * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -171,7 +171,7 @@ int genrsa_main(int argc, char **argv)
     if (!opt_cipher(ciphername, &enc))
         goto end;
     if (!app_passwd(NULL, passoutarg, NULL, &passout)) {
-        BIO_puts(bio_err, "Error getting password\n");
+        BIO_printf(bio_err, "Error getting password\n");
         goto end;
     }
 
@@ -188,19 +188,19 @@ int genrsa_main(int argc, char **argv)
     EVP_PKEY_CTX_set_app_data(ctx, bio_err);
 
     if (EVP_PKEY_CTX_set_rsa_keygen_bits(ctx, num) <= 0) {
-        BIO_puts(bio_err, "Error setting RSA length\n");
+        BIO_printf(bio_err, "Error setting RSA length\n");
         goto end;
     }
     if (!BN_set_word(bn, f4)) {
-        BIO_puts(bio_err, "Error allocating RSA public exponent\n");
+        BIO_printf(bio_err, "Error allocating RSA public exponent\n");
         goto end;
     }
     if (EVP_PKEY_CTX_set1_rsa_keygen_pubexp(ctx, bn) <= 0) {
-        BIO_puts(bio_err, "Error setting RSA public exponent\n");
+        BIO_printf(bio_err, "Error setting RSA public exponent\n");
         goto end;
     }
     if (EVP_PKEY_CTX_set_rsa_keygen_primes(ctx, primes) <= 0) {
-        BIO_puts(bio_err, "Error setting number of primes\n");
+        BIO_printf(bio_err, "Error setting number of primes\n");
         goto end;
     }
     pkey = app_keygen(ctx, "RSA", num, verbose);
@@ -213,7 +213,7 @@ int genrsa_main(int argc, char **argv)
         /* Every RSA key has an 'e' */
         EVP_PKEY_get_bn_param(pkey, "e", &e);
         if (e == NULL) {
-            BIO_puts(bio_err, "Error cannot access RSA e\n");
+            BIO_printf(bio_err, "Error cannot access RSA e\n");
             goto end;
         }
         hexe = BN_bn2hex(e);

apps/include/app_params.h

@@ -7,12 +7,7 @@
  * https://www.openssl.org/source/license.html
  */
 
-#if !defined(OSSL_APPS_INCLUDE_APP_PARAMS_H)
-#define OSSL_APPS_INCLUDE_APP_PARAMS_H
-
 #include <openssl/core.h>
 
 int print_param_types(const char *thing, const OSSL_PARAM *pdefs, int indent);
 void print_param_value(const OSSL_PARAM *p, int indent);
-
-#endif /* !defined(OSSL_APPS_INCLUDE_APP_PARAMS_H) */

apps/include/apps.h

@@ -1,5 +1,5 @@
 /*
- * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -10,16 +10,6 @@
 #ifndef OSSL_APPS_H
 #define OSSL_APPS_H
 
-#if defined(__linux__) || defined(__sun__) || defined(__hpux)
-/*
- * Allow open() and stat() to work with files larger than 2GB on 32-bit
- * systems.  See crypto/o_fopen.c and crypto/bio/bss_file.c.
- */
-#ifndef _FILE_OFFSET_BITS
-#define _FILE_OFFSET_BITS 64
-#endif
-#endif
-
 #include "internal/common.h" /* for HAS_PREFIX */
 #include "internal/nelem.h"
 #include <assert.h>
@@ -32,19 +22,6 @@
 #endif
 
 #include <openssl/e_os2.h>
-#if defined(OPENSSL_SYS_UNIX) && defined(_POSIX_MAPPED_FILES) && _POSIX_MAPPED_FILES > 0
-#include <sys/mman.h>
-#include <unistd.h>
-/*
- * Map a file read-only into memory.  Returns 1 on success (*out_data and
- * *out_size set; caller must munmap when done), 0 when file size is 0 (no
- * error, caller may use buffer path), or -1 on error (message printed to
- * bio_err).  known_size: (size_t)-1 = stat to get size; 0 = do not map
- * (return 0); > 0 = use this size (caller obtained it from stat of same path).
- */
-int app_mmap_file(const char *path, BIO *err_bio, size_t known_size,
-    const unsigned char **out_data, size_t *out_size);
-#endif
 #include <openssl/types.h>
 #include <openssl/bio.h>
 #include <openssl/x509.h>
@@ -101,7 +78,7 @@ void wait_for_async(SSL *s);
 int has_stdin_waiting(void);
 #endif
 
-int corrupt_signature(ASN1_STRING *signature);
+void corrupt_signature(const ASN1_STRING *signature);
 
 /* Helpers for setting X509v3 certificate fields notBefore and notAfter */
 int check_cert_time_string(const char *time, const char *desc);
@@ -125,10 +102,6 @@ int wrap_password_callback(char *buf, int bufsiz, int verify, void *cb_data);
 int progress_cb(EVP_PKEY_CTX *ctx);
 
 void dump_cert_text(BIO *out, X509 *x);
-int encode_private_key(
-    BIO *out, const char *output_type, const EVP_PKEY *pkey,
-    const STACK_OF(OPENSSL_STRING) *encopt, const EVP_CIPHER *cipher,
-    const char *pass);
 void print_name(BIO *out, const char *title, const X509_NAME *nm);
 void print_bignum_var(BIO *, const BIGNUM *, const char *,
     int, unsigned char *);
@@ -168,10 +141,11 @@ char *process_additional_mac_key_arguments(const char *arg);
 char *get_str_from_file(const char *filename);
 int load_cert_certs(const char *uri,
     X509 **pcert, STACK_OF(X509) **pcerts,
-    int exclude_http, const char *pass, const char *desc, X509_VERIFY_PARAM *vpm);
-STACK_OF(X509) *load_certs_multifile(char *files, const char *source,
+    int exclude_http, const char *pass, const char *desc,
+    X509_VERIFY_PARAM *vpm);
+STACK_OF(X509) *load_certs_multifile(char *files, const char *pass,
     const char *desc, X509_VERIFY_PARAM *vpm);
-X509_STORE *load_certstore(char *input, const char *source, const char *desc,
+X509_STORE *load_certstore(char *input, const char *pass, const char *desc,
     X509_VERIFY_PARAM *vpm);
 int load_certs(const char *uri, int maybe_stdin, STACK_OF(X509) **certs,
     const char *pass, const char *desc);
@@ -186,7 +160,6 @@ int load_key_certs_crls(const char *uri, int format, int maybe_stdin,
     EVP_SKEY **pskey);
 EVP_SKEY *load_skey(const char *uri, int format, int maybe_stdin,
     const char *pass, int quiet);
-int load_rpk_file(SSL *ssl, const char *file);
 X509_STORE *setup_verify(const char *CAfile, int noCAfile,
     const char *CApath, int noCApath,
     const char *CAstore, int noCAstore);
@@ -243,7 +216,7 @@ typedef struct ca_db_st {
 #endif
 } CA_DB;
 
-extern int do_updatedb(CA_DB *db, const time_t *now);
+extern int do_updatedb(CA_DB *db, time_t *now);
 
 void app_bail_out(char *fmt, ...);
 /**
@@ -291,7 +264,7 @@ int parse_yesno(const char *str, int def);
 X509_NAME *parse_name(const char *str, int chtype, int multirdn,
     const char *desc);
 void policies_print(X509_STORE_CTX *ctx);
-int bio_to_mem(unsigned char **out, size_t *outlen, size_t maxlen, BIO *in);
+int bio_to_mem(unsigned char **out, int maxlen, BIO *in);
 int pkey_ctrl_string(EVP_PKEY_CTX *ctx, const char *value);
 int x509_ctrl_string(X509 *x, const char *value);
 int x509_req_ctrl_string(X509_REQ *x, const char *value);
@@ -299,10 +272,6 @@ int init_gen_str(EVP_PKEY_CTX **pctx,
     const char *algname, int do_param,
     OSSL_LIB_CTX *libctx, const char *propq);
 int cert_matches_key(const X509 *cert, const EVP_PKEY *pkey);
-int do_EXT_add_nconf(CONF *conf1, CONF *conf2, X509V3_CTX *ctx,
-    X509 *cert, const char *msg, const char *sect);
-int do_EXT_REQ_add_nconf(CONF *conf1, CONF *conf2, X509V3_CTX *ctx,
-    X509_REQ *req, const char *msg, const char *sect);
 int do_X509_sign(X509 *x, int force_v1, EVP_PKEY *pkey, const char *md,
     STACK_OF(OPENSSL_STRING) *sigopts, X509V3_CTX *ext_ctx);
 int do_X509_verify(X509 *x, EVP_PKEY *pkey, STACK_OF(OPENSSL_STRING) *vfyopts);
@@ -317,14 +286,12 @@ extern char *psk_key;
 
 unsigned char *next_protos_parse(size_t *outlen, const char *in);
 
-int check_cert_might_be_valid(BIO *bio, BIO *bio_err, X509 *x,
+int check_cert_attributes(BIO *bio, X509 *x,
     const char *checkhost, const char *checkemail,
-    const char *checkip);
+    const char *checkip, int print);
 
 void store_setup_crl_download(X509_STORE *st);
 
-int host_is_ip_address(const char *host);
-
 typedef struct app_http_tls_info_st {
     const char *server;
     const char *port;

apps/include/apps_ui.h

@@ -10,9 +10,6 @@
 #ifndef OSSL_APPS_UI_H
 #define OSSL_APPS_UI_H
 
-#include <openssl/types.h>
-#include <openssl/ui.h>
-
 #define PW_MIN_LENGTH 4
 typedef struct pw_cb_data {
     const void *password;

apps/include/cmp_mock_srv.h

@@ -19,8 +19,6 @@
 OSSL_CMP_SRV_CTX *ossl_cmp_mock_srv_new(OSSL_LIB_CTX *libctx,
     const char *propq);
 void ossl_cmp_mock_srv_free(OSSL_CMP_SRV_CTX *srv_ctx);
-OSSL_CMP_MSG *ossl_cmp_mock_server_perform(OSSL_CMP_CTX *ctx,
-    const OSSL_CMP_MSG *req);
 
 int ossl_cmp_mock_srv_set1_refCert(OSSL_CMP_SRV_CTX *srv_ctx, X509 *cert);
 int ossl_cmp_mock_srv_set1_certOut(OSSL_CMP_SRV_CTX *srv_ctx, X509 *cert);
@@ -36,7 +34,6 @@ int ossl_cmp_mock_srv_set1_oldWithNew(OSSL_CMP_SRV_CTX *srv_ctx, X509 *cert);
 int ossl_cmp_mock_srv_set_statusInfo(OSSL_CMP_SRV_CTX *srv_ctx, int status,
     int fail_info, const char *text);
 int ossl_cmp_mock_srv_set_sendError(OSSL_CMP_SRV_CTX *srv_ctx, int bodytype);
-int ossl_cmp_mock_srv_set_useBadProtection(OSSL_CMP_SRV_CTX *srv_ctx, int bodytype);
 int ossl_cmp_mock_srv_set_pollCount(OSSL_CMP_SRV_CTX *srv_ctx, int count);
 int ossl_cmp_mock_srv_set_checkAfterTime(OSSL_CMP_SRV_CTX *srv_ctx, int sec);
 

apps/include/configuration.h.in

@@ -1,44 +0,0 @@
-/*
- * {- join("\n * ", @autowarntext) -}
- *
- * Copyright 2016-2026 The OpenSSL Project Authors. All Rights Reserved.
- *
- * Licensed under the Apache License 2.0 (the "License").  You may not use
- * this file except in compliance with the License.  You can obtain a copy
- * in the file LICENSE in the source distribution or at
- * https://www.openssl.org/source/license.html
- */
-
-#ifndef APPS_CONFIGURATION_H
-#define APPS_CONFIGURATION_H
-
-/* clang-format off */
-{-
-    my $generate_openssl_disable_array = sub {
-      my ($key) = @_;
-      my $data = $config{$key};
-      my $res = "static const char * const ${key}[] = {\n";
-
-      $res .= "\t\"\",\n";
-
-      if ($data && @$data) {
-
-          foreach (@$data) {
-              $res .= "\t\"$_\",\n";
-          }
-      }
-
-      $res .= "};\n";
-
-      return $res;
-    };
-
-    $OUT .= $generate_openssl_disable_array->('openssl_disabled_protocols');
-    $OUT .= "\n";
-    $OUT .= $generate_openssl_disable_array->('openssl_disabled_algorithms');
-    $OUT .= "\n";
-    $OUT .= $generate_openssl_disable_array->('openssl_disabled_features');
--}
-/* clang-format on */
-
-#endif

apps/include/ec_common.h

@@ -7,12 +7,7 @@
  * https://www.openssl.org/source/license.html
  */
 
-#if !defined(APPS_INCLUDE_EC_COMMON_H)
-#define APPS_INCLUDE_EC_COMMON_H
-
 #ifndef OPENSSL_NO_EC
-#include <stddef.h>
-
 static const char *point_format_options[] = {
     "uncompressed",
     "compressed",
@@ -26,5 +21,3 @@ static const char *asn1_encoding_options[] = {
     NULL
 };
 #endif
-
-#endif /* !defined(APPS_INCLUDE_EC_COMMON_H) */

apps/include/names.h

@@ -7,12 +7,7 @@
  * https://www.openssl.org/source/license.html
  */
 
-#if !defined(OSSL_APPS_INCLUDE_NAMES_H)
-#define OSSL_APPS_INCLUDE_NAMES_H
-
-#include <openssl/evp.h>
 #include <openssl/safestack.h>
-#include <openssl/types.h>
 
 /* Standard comparing function for names */
 int name_cmp(const char *const *a, const char *const *b);
@@ -20,5 +15,3 @@ int name_cmp(const char *const *a, const char *const *b);
 void collect_names(const char *name, void *vdata);
 /* Sorts and prints a stack of names to |out| */
 void print_names(BIO *out, STACK_OF(OPENSSL_CSTRING) *names);
-
-#endif /* !defined(OSSL_APPS_INCLUDE_NAMES_H) */

apps/include/opt.h

@@ -39,9 +39,9 @@
         { "purpose", OPT_V_PURPOSE, 's',                                                   \
             "certificate chain purpose" },                                                 \
         { "verify_name", OPT_V_VERIFY_NAME, 's', "verification policy name" },             \
-        { "verify_depth", OPT_V_VERIFY_DEPTH, 'N',                                         \
+        { "verify_depth", OPT_V_VERIFY_DEPTH, 'n',                                         \
             "chain depth limit" },                                                         \
-        { "auth_level", OPT_V_VERIFY_AUTH_LEVEL, 'N',                                      \
+        { "auth_level", OPT_V_VERIFY_AUTH_LEVEL, 'n',                                      \
             "chain authentication security level" },                                       \
         { "attime", OPT_V_ATTIME, 'M', "verification epoch time" },                        \
         { "verify_hostname", OPT_V_VERIFY_HOSTNAME, 's',                                   \
@@ -341,9 +341,8 @@ typedef struct options_st {
      * value type:
      *
      *   '-' no value (also the value zero)
-     *   'n' any number (type 'int')
-     *   'p' positive number (type 'int', value > 0)
-     *   'N' is a non-negative number (type 'int', value >= 0)
+     *   'n' number (type 'int')
+     *   'p' positive number (type 'int')
      *   'u' unsigned number (type 'unsigned long')
      *   'l' number (type 'unsigned long')
      *   'M' number (type 'intmax_t')
@@ -357,7 +356,7 @@ typedef struct options_st {
      *   'A' any ASN1, der/pem/b64 format  [OPT_FMT_ASN1]
      *   'c' pem/der/smime format          [OPT_FMT_PDS]
      *
-     * The 'l', 'n', 'N' and 'u' value types include the values zero,
+     * The 'l', 'n' and 'u' value types include the values zero,
      * the 'p' value type does not.
      */
     int valtype;

apps/include/s_apps.h

@@ -7,9 +7,6 @@
  * https://www.openssl.org/source/license.html
  */
 
-#if !defined(OSSL_APPS_INCLUDE_S_APPS_H)
-#define OSSL_APPS_INCLUDE_S_APPS_H
-
 #include <openssl/opensslconf.h>
 
 #include <openssl/ssl.h>
@@ -113,8 +110,5 @@ typedef struct srpsrvparm_st {
 
 int set_up_srp_verifier_file(SSL_CTX *ctx, srpsrvparm *srp_callback_parm,
     char *srpuserseed, char *srp_verifier_file);
-void cleanup_srp(srpsrvparm *srp_callback_parm);
 void lookup_srp_user(srpsrvparm *srp_callback_parm, BIO *bio_s_out);
 #endif /* OPENSSL_NO_SRP */
-
-#endif /* !defined(OSSL_APPS_INCLUDE_S_APPS_H) */

apps/kdf.c

@@ -1,5 +1,5 @@
 /*
- * Copyright 2019-2026 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2019-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -39,7 +39,7 @@ const OPTIONS kdf_options[] = {
     { "digest", OPT_DIGEST, 's', "Digest" },
     { "mac", OPT_MAC, 's', "MAC" },
     { OPT_MORE_STR, 1, '-', "See 'Supported Controls' in the EVP_KDF_ docs\n" },
-    { "keylen", OPT_KEYLEN, 'p', "The size of the output derived key" },
+    { "keylen", OPT_KEYLEN, 's', "The size of the output derived key" },
 
     OPT_SECTION("Output"),
     { "out", OPT_OUT, '>', "Output to filename rather than stdout" },
@@ -101,7 +101,7 @@ int kdf_main(int argc, char **argv)
             out_bin = 1;
             break;
         case OPT_KEYLEN:
-            dkm_len = opt_int_arg();
+            dkm_len = atoi(opt_arg());
             break;
         case OPT_OUT:
             outfile = opt_arg();
@@ -162,7 +162,7 @@ int kdf_main(int argc, char **argv)
             goto err;
 
         if (!EVP_KDF_CTX_set_params(ctx, params)) {
-            BIO_puts(bio_err, "KDF parameter error\n");
+            BIO_printf(bio_err, "KDF parameter error\n");
             ERR_print_errors(bio_err);
             ok = 0;
         }
@@ -176,7 +176,7 @@ int kdf_main(int argc, char **argv)
         goto err;
 
     if (dkm_len <= 0) {
-        BIO_puts(bio_err, "Derived key length is mandatory!\n");
+        BIO_printf(bio_err, "Invalid derived key length.\n");
         goto err;
     }
     dkm_bytes = app_malloc(dkm_len, "out buffer");
@@ -184,7 +184,7 @@ int kdf_main(int argc, char **argv)
         goto err;
 
     if (!EVP_KDF_derive(ctx, dkm_bytes, dkm_len, NULL)) {
-        BIO_puts(bio_err, "EVP_KDF_derive failed\n");
+        BIO_printf(bio_err, "EVP_KDF_derive failed\n");
         goto err;
     }
 
@@ -193,7 +193,7 @@ int kdf_main(int argc, char **argv)
     } else {
         hexout = OPENSSL_buf2hexstr(dkm_bytes, dkm_len);
         if (hexout == NULL) {
-            BIO_puts(bio_err, "Memory allocation failure\n");
+            BIO_printf(bio_err, "Memory allocation failure\n");
             goto err;
         }
         BIO_printf(out, "%s\n\n", hexout);

apps/lib/app_params.c

@@ -1,5 +1,5 @@
 /*
- * Copyright 2019-2026 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2019-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -56,7 +56,7 @@ static int describe_param_type(char *buf, size_t bufsz, const OSSL_PARAM *param)
         bufsz -= printed_len;
     }
     if (show_type_number) {
-        printed_len = BIO_snprintf(buf, bufsz, " [%u]", param->data_type);
+        printed_len = BIO_snprintf(buf, bufsz, " [%d]", param->data_type);
         if (printed_len > 0) {
             buf += printed_len;
             bufsz -= printed_len;
@@ -158,13 +158,13 @@ void print_param_value(const OSSL_PARAM *p, int indent)
         if (OSSL_PARAM_get_uint64(p, &u))
             BIO_printf(bio_out, "%llu\n", (unsigned long long int)u);
         else
-            BIO_puts(bio_out, "error getting value\n");
+            BIO_printf(bio_out, "error getting value\n");
         break;
     case OSSL_PARAM_INTEGER:
         if (OSSL_PARAM_get_int64(p, &i))
             BIO_printf(bio_out, "%lld\n", (long long int)i);
         else
-            BIO_puts(bio_out, "error getting value\n");
+            BIO_printf(bio_out, "error getting value\n");
         break;
     case OSSL_PARAM_UTF8_PTR:
         print_param_utf8((const char **)p->data, p->return_size);

apps/lib/app_provider.c

@@ -47,7 +47,6 @@ int app_provider_load(OSSL_LIB_CTX *libctx, const char *provider_name)
         app_providers = sk_OSSL_PROVIDER_new_null();
     if (app_providers == NULL
         || !sk_OSSL_PROVIDER_push(app_providers, prov)) {
-        OSSL_PROVIDER_unload(prov);
         app_providers_cleanup();
         return 0;
     }

apps/lib/app_rand.c

@@ -1,5 +1,5 @@
 /*
- * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -84,7 +84,7 @@ int app_RAND_write(void)
     if (save_rand_file == NULL)
         return 1;
     if (RAND_write_file(save_rand_file) == -1) {
-        BIO_puts(bio_err, "Cannot write random bytes:\n");
+        BIO_printf(bio_err, "Cannot write random bytes:\n");
         ERR_print_errors(bio_err);
         ret = 0;
     }

apps/lib/app_x509.c

@@ -1,5 +1,5 @@
 /*
- * Copyright 2020-2026 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2020-2021 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -25,7 +25,7 @@ static ASN1_OCTET_STRING *mk_octet_string(void *value, size_t value_n)
     ASN1_OCTET_STRING *v = ASN1_OCTET_STRING_new();
 
     if (v == NULL) {
-        BIO_puts(bio_err, "error: allocation failed\n");
+        BIO_printf(bio_err, "error: allocation failed\n");
     } else if (!ASN1_OCTET_STRING_set(v, value, (int)value_n)) {
         ASN1_OCTET_STRING_free(v);
         v = NULL;
@@ -42,7 +42,7 @@ static int x509_ctrl(void *object, int cmd, void *value, size_t value_n)
         ASN1_OCTET_STRING *v = mk_octet_string(value, value_n);
 
         if (v == NULL) {
-            BIO_puts(bio_err,
+            BIO_printf(bio_err,
                 "error: setting distinguishing ID in certificate failed\n");
             return 0;
         }
@@ -65,7 +65,7 @@ static int x509_req_ctrl(void *object, int cmd, void *value, size_t value_n)
         ASN1_OCTET_STRING *v = mk_octet_string(value, value_n);
 
         if (v == NULL) {
-            BIO_puts(bio_err,
+            BIO_printf(bio_err,
                 "error: setting distinguishing ID in certificate signing request failed\n");
             return 0;
         }

apps/lib/apps_ui.c

@@ -1,5 +1,5 @@
 /*
- * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -171,7 +171,7 @@ int password_callback(char *buf, int bufsiz, int verify, PW_CB_DATA *cb_data)
         prompt_info = cb_data->prompt_info;
     prompt = UI_construct_prompt(ui, "pass phrase", prompt_info);
     if (prompt == NULL) {
-        BIO_puts(bio_err, "Out of memory\n");
+        BIO_printf(bio_err, "Out of memory\n");
         UI_free(ui);
         return 0;
     }
@@ -200,13 +200,13 @@ int password_callback(char *buf, int bufsiz, int verify, PW_CB_DATA *cb_data)
     if (ok >= 0)
         res = (int)strlen(buf);
     if (ok == -1) {
-        BIO_puts(bio_err, "User interface error\n");
+        BIO_printf(bio_err, "User interface error\n");
         ERR_print_errors(bio_err);
         OPENSSL_cleanse(buf, (unsigned int)bufsiz);
         res = 0;
     }
     if (ok == -2) {
-        BIO_puts(bio_err, "aborted!\n");
+        BIO_printf(bio_err, "aborted!\n");
         OPENSSL_cleanse(buf, (unsigned int)bufsiz);
         res = 0;
     }

apps/lib/cmp_mock_srv.c

@@ -1,5 +1,5 @@
 /*
- * Copyright 2018-2026 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2018-2025 The OpenSSL Project Authors. All Rights Reserved.
  * Copyright Siemens AG 2018-2020
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
@@ -10,7 +10,6 @@
 
 #include "apps.h"
 #include "cmp_mock_srv.h"
-#include "../../crypto/cmp/cmp_local.h" /* for access to msg->protection */
 
 #include <openssl/cmp.h>
 #include <openssl/err.h>
@@ -29,7 +28,6 @@ typedef struct {
     X509 *oldWithNew; /* to return in oldWithNew of rootKeyUpdate */
     OSSL_CMP_PKISI *statusOut; /* status for ip/cp/kup/rp msg unless polling */
     int sendError; /* send error response on given request type */
-    int useBadProtection; /* use bad protection on given response type */
     OSSL_CMP_MSG *req; /* original request message during polling */
     int pollCount; /* number of polls before actual cert response */
     int curr_pollCount; /* number of polls so far for current request */
@@ -61,7 +59,6 @@ static mock_srv_ctx *mock_srv_ctx_new(void)
         goto err;
 
     ctx->sendError = -1;
-    ctx->useBadProtection = -1;
 
     /* all other elements are initialized to 0 or NULL, respectively */
     return ctx;
@@ -190,19 +187,6 @@ int ossl_cmp_mock_srv_set_sendError(OSSL_CMP_SRV_CTX *srv_ctx, int bodytype)
     return 1;
 }
 
-int ossl_cmp_mock_srv_set_useBadProtection(OSSL_CMP_SRV_CTX *srv_ctx, int bodytype)
-{
-    mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
-
-    if (ctx == NULL) {
-        ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
-        return 0;
-    }
-    /* might check bodytype, but this would require exporting all body types */
-    ctx->useBadProtection = bodytype;
-    return 1;
-}
-
 int ossl_cmp_mock_srv_set_pollCount(OSSL_CMP_SRV_CTX *srv_ctx, int count)
 {
     mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
@@ -345,7 +329,6 @@ static OSSL_CMP_PKISI *process_cert_request(OSSL_CMP_SRV_CTX *srv_ctx,
             STACK_OF(ASN1_UTF8STRING) *strs;
             ASN1_UTF8STRING *str;
             const char *data;
-            size_t len;
 
             if (OBJ_obj2nid(obj) == NID_id_it_certProfile) {
                 if (!OSSL_CMP_ITAV_get0_certProfile(itav, &strs))
@@ -360,8 +343,7 @@ static OSSL_CMP_PKISI *process_cert_request(OSSL_CMP_SRV_CTX *srv_ctx,
                     ERR_raise(ERR_LIB_CMP, ERR_R_PASSED_INVALID_ARGUMENT);
                     return NULL;
                 }
-                if (((len = ASN1_STRING_length_ex(str)) != sizeof("profile1") - 1)
-                    || memcmp(data, "profile1", len) != 0) {
+                if (strcmp(data, "profile1") != 0) {
                     ERR_raise(ERR_LIB_CMP, CMP_R_UNEXPECTED_CERTPROFILE);
                     return NULL;
                 }
@@ -609,7 +591,6 @@ static int process_genm(OSSL_CMP_SRV_CTX *srv_ctx,
         if (rsp != NULL && sk_OSSL_CMP_ITAV_push(*out, rsp))
             return 1;
         sk_OSSL_CMP_ITAV_free(*out);
-        OSSL_CMP_ITAV_free(rsp);
         return 0;
     }
 
@@ -633,10 +614,10 @@ static void process_error(OSSL_CMP_SRV_CTX *srv_ctx, const OSSL_CMP_MSG *error,
         return;
     }
 
-    BIO_puts(bio_err, "mock server received error:\n");
+    BIO_printf(bio_err, "mock server received error:\n");
 
     if (statusInfo == NULL) {
-        BIO_puts(bio_err, "pkiStatusInfo absent\n");
+        BIO_printf(bio_err, "pkiStatusInfo absent\n");
     } else {
         sibuf = OSSL_CMP_snprint_PKIStatusInfo(statusInfo, buf, sizeof(buf));
         BIO_printf(bio_err, "pkiStatusInfo: %s\n",
@@ -644,22 +625,22 @@ static void process_error(OSSL_CMP_SRV_CTX *srv_ctx, const OSSL_CMP_MSG *error,
     }
 
     if (errorCode == NULL)
-        BIO_puts(bio_err, "errorCode absent\n");
+        BIO_printf(bio_err, "errorCode absent\n");
     else
         BIO_printf(bio_err, "errorCode: %ld\n", ASN1_INTEGER_get(errorCode));
 
     if (sk_ASN1_UTF8STRING_num(errorDetails) <= 0) {
-        BIO_puts(bio_err, "errorDetails absent\n");
+        BIO_printf(bio_err, "errorDetails absent\n");
     } else {
-        BIO_puts(bio_err, "errorDetails: ");
+        BIO_printf(bio_err, "errorDetails: ");
         for (i = 0; i < sk_ASN1_UTF8STRING_num(errorDetails); i++) {
             if (i > 0)
-                BIO_puts(bio_err, ", ");
+                BIO_printf(bio_err, ", ");
             ASN1_STRING_print_ex(bio_err,
                 sk_ASN1_UTF8STRING_value(errorDetails, i),
                 ASN1_STRFLGS_ESC_QUOTE);
         }
-        BIO_puts(bio_err, "\n");
+        BIO_printf(bio_err, "\n");
     }
 }
 
@@ -731,25 +712,6 @@ static int process_pollReq(OSSL_CMP_SRV_CTX *srv_ctx,
     return 1;
 }
 
-OSSL_CMP_MSG *ossl_cmp_mock_server_perform(OSSL_CMP_CTX *ctx,
-    const OSSL_CMP_MSG *req)
-{
-    OSSL_CMP_SRV_CTX *srv_ctx = OSSL_CMP_CTX_get_transfer_cb_arg(ctx);
-    OSSL_CMP_MSG *rsp = OSSL_CMP_CTX_server_perform(ctx, req);
-
-    if (srv_ctx != NULL && rsp != NULL) {
-        mock_srv_ctx *mock_ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
-
-        if (mock_ctx != NULL && OSSL_CMP_MSG_get_bodytype(rsp) == mock_ctx->useBadProtection) {
-            ASN1_BIT_STRING *prot = rsp->protection;
-
-            if (prot != NULL && prot->length != 0 && prot->data != NULL)
-                prot->data[0] ^= 0x80; /* flip most significant bit of the first byte */
-        }
-    }
-    return rsp;
-}
-
 OSSL_CMP_SRV_CTX *ossl_cmp_mock_srv_new(OSSL_LIB_CTX *libctx, const char *propq)
 {
     OSSL_CMP_SRV_CTX *srv_ctx = OSSL_CMP_SRV_CTX_new(libctx, propq);