CVS commit: pkgsrc/security/openssl

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Fri Oct  3 09:11:10 UTC 2025

Modified Files:
        pkgsrc/security/openssl: Makefile PLIST distinfo

Log Message:
openssl: updated to 3.6.0

OpenSSL 3.6.0 is a feature release adding significant new functionality to OpenSSL.

This release incorporates the following potentially significant or incompatible
changes:

Added NIST security categories for PKEY objects.

Added support for EVP_SKEY opaque symmetric key objects to the key
derivation and key exchange provider methods. Added EVP_KDF_CTX_set_SKEY(),
EVP_KDF_derive_SKEY(), and EVP_PKEY_derive_SKEY() functions.

Added LMS signature verification support as per [SP 800-208]..
This support is present in both the FIPS and default providers.

An ANSI-C toolchain is no longer sufficient for building OpenSSL.
The code should be built using compilers supporting C-99 features.

Support for the VxWorks platforms has been removed.

Added an openssl configutl utility for processing the OpenSSL
configuration file and dumping the equal configuration file.

Added support for FIPS 186-5 deterministic ECDSA signature
generation to the FIPS provider.

Deprecated EVP_PKEY_ASN1_METHOD-related functions.


To generate a diff of this commit:
cvs rdiff -u -r1.312 -r1.313 pkgsrc/security/openssl/Makefile
cvs rdiff -u -r1.23 -r1.24 pkgsrc/security/openssl/PLIST
cvs rdiff -u -r1.184 -r1.185 pkgsrc/security/openssl/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/security/openssl/Makefile
diff -u pkgsrc/security/openssl/Makefile:1.312 pkgsrc/security/openssl/Makefile:1.313
--- pkgsrc/security/openssl/Makefile:1.312      Tue Sep 30 16:11:00 2025
+++ pkgsrc/security/openssl/Makefile    Fri Oct  3 09:11:10 2025
@@ -1,9 +1,9 @@
-# $NetBSD: Makefile,v 1.312 2025/09/30 16:11:00 wiz Exp $
+# $NetBSD: Makefile,v 1.313 2025/10/03 09:11:10 adam Exp $
 
 # Remember to upload-distfiles when updating OpenSSL -- otherwise it
 # is not possible for users who have bootstrapped without OpenSSL
 # to install it and enable HTTPS fetching.
-DISTNAME=      openssl-3.5.4
+DISTNAME=      openssl-3.6.0
 CATEGORIES=    security
 MASTER_SITES=  ${MASTER_SITE_GITHUB:=openssl/}
 GITHUB_RELEASE=        ${DISTNAME}

Index: pkgsrc/security/openssl/PLIST
diff -u pkgsrc/security/openssl/PLIST:1.23 pkgsrc/security/openssl/PLIST:1.24
--- pkgsrc/security/openssl/PLIST:1.23  Mon Sep 22 05:51:24 2025
+++ pkgsrc/security/openssl/PLIST       Fri Oct  3 09:11:10 2025
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.23 2025/09/22 05:51:24 adam Exp $
+@comment $NetBSD: PLIST,v 1.24 2025/10/03 09:11:10 adam Exp $
 bin/c_rehash
 bin/openssl
 include/openssl/aes.h
@@ -168,6 +168,7 @@ man/man1/openssl-ciphers.1
 man/man1/openssl-cmds.1
 man/man1/openssl-cmp.1
 man/man1/openssl-cms.1
+man/man1/openssl-configutl.1
 man/man1/openssl-crl.1
 man/man1/openssl-crl2pkcs7.1
 man/man1/openssl-dgst.1
@@ -858,10 +859,16 @@ man/man3/CMS_ReceiptRequest_get0_values.
 man/man3/CMS_ReceiptRequest_new.3
 man/man3/CMS_RecipientInfo_decrypt.3
 man/man3/CMS_RecipientInfo_encrypt.3
+man/man3/CMS_RecipientInfo_kari_get0_ctx.3
 man/man3/CMS_RecipientInfo_kari_set0_pkey.3
 man/man3/CMS_RecipientInfo_kari_set0_pkey_and_peer.3
 man/man3/CMS_RecipientInfo_kekri_get0_id.3
 man/man3/CMS_RecipientInfo_kekri_id_cmp.3
+man/man3/CMS_RecipientInfo_kemri_cert_cmp.3
+man/man3/CMS_RecipientInfo_kemri_get0_ctx.3
+man/man3/CMS_RecipientInfo_kemri_get0_kdf_alg.3
+man/man3/CMS_RecipientInfo_kemri_set0_pkey.3
+man/man3/CMS_RecipientInfo_kemri_set_ukm.3
 man/man3/CMS_RecipientInfo_ktri_cert_cmp.3
 man/man3/CMS_RecipientInfo_ktri_get0_signer_id.3
 man/man3/CMS_RecipientInfo_set0_key.3
@@ -966,6 +973,7 @@ man/man3/CRYPTO_THREAD_run_once.3
 man/man3/CRYPTO_THREAD_unlock.3
 man/man3/CRYPTO_THREAD_write_lock.3
 man/man3/CRYPTO_aligned_alloc.3
+man/man3/CRYPTO_aligned_alloc_array.3
 man/man3/CRYPTO_alloc_ex_data.3
 man/man3/CRYPTO_atomic_add.3
 man/man3/CRYPTO_atomic_add64.3
@@ -974,8 +982,10 @@ man/man3/CRYPTO_atomic_load.3
 man/man3/CRYPTO_atomic_load_int.3
 man/man3/CRYPTO_atomic_or.3
 man/man3/CRYPTO_atomic_store.3
+man/man3/CRYPTO_calloc.3
 man/man3/CRYPTO_clear_free.3
 man/man3/CRYPTO_clear_realloc.3
+man/man3/CRYPTO_clear_realloc_array.3
 man/man3/CRYPTO_free.3
 man/man3/CRYPTO_free_ex_data.3
 man/man3/CRYPTO_free_ex_index.3
@@ -985,6 +995,7 @@ man/man3/CRYPTO_get_ex_data.3
 man/man3/CRYPTO_get_ex_new_index.3
 man/man3/CRYPTO_get_mem_functions.3
 man/man3/CRYPTO_malloc.3
+man/man3/CRYPTO_malloc_array.3
 man/man3/CRYPTO_malloc_fn.3
 man/man3/CRYPTO_mem_ctrl.3
 man/man3/CRYPTO_mem_debug_pop.3
@@ -995,11 +1006,14 @@ man/man3/CRYPTO_mem_leaks_fp.3
 man/man3/CRYPTO_memcmp.3
 man/man3/CRYPTO_new_ex_data.3
 man/man3/CRYPTO_realloc.3
+man/man3/CRYPTO_realloc_array.3
 man/man3/CRYPTO_realloc_fn.3
 man/man3/CRYPTO_secure_allocated.3
+man/man3/CRYPTO_secure_calloc.3
 man/man3/CRYPTO_secure_clear_free.3
 man/man3/CRYPTO_secure_free.3
 man/man3/CRYPTO_secure_malloc.3
+man/man3/CRYPTO_secure_malloc_array.3
 man/man3/CRYPTO_secure_malloc_done.3
 man/man3/CRYPTO_secure_malloc_init.3
 man/man3/CRYPTO_secure_malloc_initialized.3
@@ -1728,9 +1742,11 @@ man/man3/EVP_KDF_CTX_gettable_params.3
 man/man3/EVP_KDF_CTX_kdf.3
 man/man3/EVP_KDF_CTX_new.3
 man/man3/EVP_KDF_CTX_reset.3
+man/man3/EVP_KDF_CTX_set_SKEY.3
 man/man3/EVP_KDF_CTX_set_params.3
 man/man3/EVP_KDF_CTX_settable_params.3
 man/man3/EVP_KDF_derive.3
+man/man3/EVP_KDF_derive_SKEY.3
 man/man3/EVP_KDF_do_all_provided.3
 man/man3/EVP_KDF_fetch.3
 man/man3/EVP_KDF_free.3
@@ -2074,6 +2090,7 @@ man/man3/EVP_PKEY_decrypt_init.3
 man/man3/EVP_PKEY_decrypt_init_ex.3
 man/man3/EVP_PKEY_delete_attr.3
 man/man3/EVP_PKEY_derive.3
+man/man3/EVP_PKEY_derive_SKEY.3
 man/man3/EVP_PKEY_derive_init.3
 man/man3/EVP_PKEY_derive_init_ex.3
 man/man3/EVP_PKEY_derive_set_peer.3
@@ -2133,6 +2150,7 @@ man/man3/EVP_PKEY_get_params.3
 man/man3/EVP_PKEY_get_raw_private_key.3
 man/man3/EVP_PKEY_get_raw_public_key.3
 man/man3/EVP_PKEY_get_security_bits.3
+man/man3/EVP_PKEY_get_security_category.3
 man/man3/EVP_PKEY_get_size.3
 man/man3/EVP_PKEY_get_size_t_param.3
 man/man3/EVP_PKEY_get_utf8_string_param.3
@@ -2326,6 +2344,7 @@ man/man3/EVP_SKEY_get0_provider_name.3
 man/man3/EVP_SKEY_get0_raw_key.3
 man/man3/EVP_SKEY_get0_skeymgmt_name.3
 man/man3/EVP_SKEY_import.3
+man/man3/EVP_SKEY_import_SKEYMGMT.3
 man/man3/EVP_SKEY_import_raw_key.3
 man/man3/EVP_SKEY_is_a.3
 man/man3/EVP_SKEY_to_provider.3
@@ -2763,6 +2782,7 @@ man/man3/OPENSSL_LH_stats_bio.3
 man/man3/OPENSSL_LINE.3
 man/man3/OPENSSL_MALLOC_FAILURES.3
 man/man3/OPENSSL_MALLOC_FD.3
+man/man3/OPENSSL_MALLOC_SEED.3
 man/man3/OPENSSL_MSTR.3
 man/man3/OPENSSL_MSTR_HELPER.3
 man/man3/OPENSSL_VERSION_BUILD_METADATA.3
@@ -2774,14 +2794,17 @@ man/man3/OPENSSL_VERSION_PREREQ.3
 man/man3/OPENSSL_VERSION_PRE_RELEASE.3
 man/man3/OPENSSL_VERSION_TEXT.3
 man/man3/OPENSSL_aligned_alloc.3
+man/man3/OPENSSL_aligned_alloc_array.3
 man/man3/OPENSSL_atexit.3
 man/man3/OPENSSL_buf2hexstr.3
 man/man3/OPENSSL_buf2hexstr_ex.3
+man/man3/OPENSSL_calloc.3
 man/man3/OPENSSL_cipher_name.3
 man/man3/OPENSSL_cleanse.3
 man/man3/OPENSSL_cleanup.3
 man/man3/OPENSSL_clear_free.3
 man/man3/OPENSSL_clear_realloc.3
+man/man3/OPENSSL_clear_realloc_array.3
 man/man3/OPENSSL_config.3
 man/man3/OPENSSL_fork_child.3
 man/man3/OPENSSL_fork_parent.3
@@ -2807,18 +2830,22 @@ man/man3/OPENSSL_load_u32_le.3
 man/man3/OPENSSL_load_u64_be.3
 man/man3/OPENSSL_load_u64_le.3
 man/man3/OPENSSL_malloc.3
+man/man3/OPENSSL_malloc_array.3
 man/man3/OPENSSL_malloc_init.3
 man/man3/OPENSSL_mem_debug_pop.3
 man/man3/OPENSSL_mem_debug_push.3
 man/man3/OPENSSL_memdup.3
 man/man3/OPENSSL_no_config.3
 man/man3/OPENSSL_realloc.3
+man/man3/OPENSSL_realloc_array.3
 man/man3/OPENSSL_riscvcap.3
 man/man3/OPENSSL_s390xcap.3
 man/man3/OPENSSL_secure_actual_size.3
+man/man3/OPENSSL_secure_calloc.3
 man/man3/OPENSSL_secure_clear_free.3
 man/man3/OPENSSL_secure_free.3
 man/man3/OPENSSL_secure_malloc.3
+man/man3/OPENSSL_secure_malloc_array.3
 man/man3/OPENSSL_secure_zalloc.3
 man/man3/OPENSSL_sk_deep_copy.3
 man/man3/OPENSSL_sk_delete.3
@@ -2840,6 +2867,7 @@ man/man3/OPENSSL_sk_push.3
 man/man3/OPENSSL_sk_reserve.3
 man/man3/OPENSSL_sk_set.3
 man/man3/OPENSSL_sk_set_cmp_func.3
+man/man3/OPENSSL_sk_set_thunks.3
 man/man3/OPENSSL_sk_shift.3
 man/man3/OPENSSL_sk_sort.3
 man/man3/OPENSSL_sk_unshift.3
@@ -3462,6 +3490,7 @@ man/man3/OSSL_PARAM_set_int64.3
 man/man3/OSSL_PARAM_set_long.3
 man/man3/OSSL_PARAM_set_octet_ptr.3
 man/man3/OSSL_PARAM_set_octet_string.3
+man/man3/OSSL_PARAM_set_octet_string_or_ptr.3
 man/man3/OSSL_PARAM_set_size_t.3
 man/man3/OSSL_PARAM_set_time_t.3
 man/man3/OSSL_PARAM_set_uint.3
@@ -3594,6 +3623,7 @@ man/man3/OSSL_STORE_LOADER_set_find.3
 man/man3/OSSL_STORE_LOADER_set_load.3
 man/man3/OSSL_STORE_LOADER_set_open.3
 man/man3/OSSL_STORE_LOADER_set_open_ex.3
+man/man3/OSSL_STORE_LOADER_settable_ctx_params.3
 man/man3/OSSL_STORE_LOADER_up_ref.3
 man/man3/OSSL_STORE_SEARCH.3
 man/man3/OSSL_STORE_SEARCH_by_alias.3
@@ -4270,7 +4300,9 @@ man/man3/SRP_user_pwd_set0_sv.3
 man/man3/SRP_user_pwd_set1_ids.3
 man/man3/SRP_user_pwd_set_gN.3
 man/man3/SSL_ACCEPT_CONNECTION_NO_BLOCK.3
+man/man3/SSL_ACCEPT_STREAM_BIDI.3
 man/man3/SSL_ACCEPT_STREAM_NO_BLOCK.3
+man/man3/SSL_ACCEPT_STREAM_UNI.3
 man/man3/SSL_CIPHER_description.3
 man/man3/SSL_CIPHER_find.3
 man/man3/SSL_CIPHER_get_auth_nid.3
@@ -4740,6 +4772,7 @@ man/man3/SSL_get0_security_ex_data.3
 man/man3/SSL_get0_server_cert_type.3
 man/man3/SSL_get0_session.3
 man/man3/SSL_get0_signature_name.3
+man/man3/SSL_get0_tlsext_status_ocsp_resp_ex.3
 man/man3/SSL_get0_verified_chain.3
 man/man3/SSL_get0_verify_cert_store.3
 man/man3/SSL_get1_builtin_sigalgs.3
@@ -4924,6 +4957,7 @@ man/man3/SSL_set0_chain.3
 man/man3/SSL_set0_chain_cert_store.3
 man/man3/SSL_set0_rbio.3
 man/man3/SSL_set0_security_ex_data.3
+man/man3/SSL_set0_tlsext_status_ocsp_resp_ex.3
 man/man3/SSL_set0_tmp_dh_pkey.3
 man/man3/SSL_set0_verify_cert_store.3
 man/man3/SSL_set0_wbio.3
@@ -5297,6 +5331,7 @@ man/man3/X509_CRL_get0_extensions.3
 man/man3/X509_CRL_get0_lastUpdate.3
 man/man3/X509_CRL_get0_nextUpdate.3
 man/man3/X509_CRL_get0_signature.3
+man/man3/X509_CRL_get0_tbs_sigalg.3
 man/man3/X509_CRL_get_REVOKED.3
 man/man3/X509_CRL_get_ext.3
 man/man3/X509_CRL_get_ext_by_NID.3
@@ -5564,6 +5599,7 @@ man/man3/X509_STORE_CTX_set_error.3
 man/man3/X509_STORE_CTX_set_error_depth.3
 man/man3/X509_STORE_CTX_set_ex_data.3
 man/man3/X509_STORE_CTX_set_get_crl.3
+man/man3/X509_STORE_CTX_set_ocsp_resp.3
 man/man3/X509_STORE_CTX_set_purpose.3
 man/man3/X509_STORE_CTX_set_trust.3
 man/man3/X509_STORE_CTX_set_verify.3
@@ -6222,6 +6258,7 @@ man/man3/i2d_PKCS7_SIGN_ENVELOPE.3
 man/man3/i2d_PKCS7_bio.3
 man/man3/i2d_PKCS7_bio_stream.3
 man/man3/i2d_PKCS7_fp.3
+man/man3/i2d_PKCS8PrivateKey.3
 man/man3/i2d_PKCS8PrivateKeyInfo_bio.3
 man/man3/i2d_PKCS8PrivateKeyInfo_fp.3
 man/man3/i2d_PKCS8PrivateKey_bio.3
@@ -6421,6 +6458,7 @@ man/man7/EVP_KEYMGMT-EC.7
 man/man7/EVP_KEYMGMT-ED25519.7
 man/man7/EVP_KEYMGMT-ED448.7
 man/man7/EVP_KEYMGMT-HMAC.7
+man/man7/EVP_KEYMGMT-LMS.7
 man/man7/EVP_KEYMGMT-ML-DSA.7
 man/man7/EVP_KEYMGMT-ML-KEM-1024.7
 man/man7/EVP_KEYMGMT-ML-KEM-512.7
@@ -6470,6 +6508,7 @@ man/man7/EVP_PKEY-ED25519.7
 man/man7/EVP_PKEY-ED448.7
 man/man7/EVP_PKEY-FFC.7
 man/man7/EVP_PKEY-HMAC.7
+man/man7/EVP_PKEY-LMS.7
 man/man7/EVP_PKEY-ML-DSA-44.7
 man/man7/EVP_PKEY-ML-DSA-65.7
 man/man7/EVP_PKEY-ML-DSA-87.7
@@ -6511,6 +6550,7 @@ man/man7/EVP_SIGNATURE-ECDSA.7
 man/man7/EVP_SIGNATURE-ED25519.7
 man/man7/EVP_SIGNATURE-ED448.7
 man/man7/EVP_SIGNATURE-HMAC.7
+man/man7/EVP_SIGNATURE-LMS.7
 man/man7/EVP_SIGNATURE-ML-DSA-44.7
 man/man7/EVP_SIGNATURE-ML-DSA-65.7
 man/man7/EVP_SIGNATURE-ML-DSA-87.7
@@ -6533,6 +6573,7 @@ man/man7/EVP_SIGNATURE-SLH-DSA.7
 man/man7/EVP_SIGNATURE-Siphash.7
 man/man7/Ed25519.7
 man/man7/Ed448.7
+man/man7/LMS.7
 man/man7/OPENSSL_API_COMPAT.7
 man/man7/OPENSSL_NO_DEPRECATED.7
 man/man7/OSSL_PROVIDER-FIPS.7

Index: pkgsrc/security/openssl/distinfo
diff -u pkgsrc/security/openssl/distinfo:1.184 pkgsrc/security/openssl/distinfo:1.185
--- pkgsrc/security/openssl/distinfo:1.184      Tue Sep 30 16:11:00 2025
+++ pkgsrc/security/openssl/distinfo    Fri Oct  3 09:11:10 2025
@@ -1,7 +1,7 @@
-$NetBSD: distinfo,v 1.184 2025/09/30 16:11:00 wiz Exp $
+$NetBSD: distinfo,v 1.185 2025/10/03 09:11:10 adam Exp $
 
-BLAKE2s (openssl-3.5.4.tar.gz) = c3443f6a74c0edd058ab9500307d1eb63a2b1475ca830ce0a9ed9cb365a49082
-SHA512 (openssl-3.5.4.tar.gz) = 365aca6f2e59b5c8261fba683425d177874cf6024b0d216ca309112b879c1f4e8da78617e23c3c95d0b4a26b83ecd0d8348038b999d30e597d19f466c4761227
-Size (openssl-3.5.4.tar.gz) = 53190367 bytes
+BLAKE2s (openssl-3.6.0.tar.gz) = 2326b66bf7f763b3698462377f41a1bd01c1928cb3af17669ea7027bdeb0b30a
+SHA512 (openssl-3.6.0.tar.gz) = 866825a1cdf0b705b409402fbc7a713e7d9b8e7736c5126be57b354927954c148a341fc52b02c0629c1e015a889bfd40217f8e703b73235892e91da060909b76
+Size (openssl-3.6.0.tar.gz) = 54974351 bytes
 SHA1 (patch-Configurations_unix-Makefile.tmpl) = ea9b0a0c8de810362813d84a4f85c5ebdedf9fc6
 SHA1 (patch-util_perl_OpenSSL_config.pm) = 3ba3c23046bf69c7d348b4c1c8c8269d83cfa2b4