Rebase to OpenSSL 3.5.8

Resolves: RHEL-242942 Resolves: RHEL-246259 Resolves: RHEL-246288 Resolves: RHEL-246320 Resolves: RHEL-246440 Resolves: RHEL-246444 Resolves: RHEL-246448 Resolves: RHEL-246452 Resolves: RHEL-246456
2026-08-25 16:24:42 +02:00 · 2026-08-25 16:24:42 +02:00 · b9756ef7e0
commit b9756ef7e0
parent 3046144e8e
62 changed files with 487 additions and 830 deletions
--- a/.gitignore
+++ b/.gitignore
@ -61,3 +61,4 @@ openssl-1.0.0a-usa.tar.bz2
 /openssl-3.5.1.tar.gz
 /openssl-3.5.5.tar.gz
 /openssl-3.5.7.tar.gz
+/openssl-3.5.8.tar.gz
--- a/0001-RH-Aarch64-and-ppc64le-use-lib64.patch
+++ b/0001-RH-Aarch64-and-ppc64le-use-lib64.patch
@ -1,4 +1,4 @@
-From ad6ba90718f814f1db71e86a4156098eb2bbeef5 Mon Sep 17 00:00:00 2001
+From be9aad001bf7a45264a88f0f0f6504944369490b Mon Sep 17 00:00:00 2001
 From: rpm-build <rpm-build>
 Date: Wed, 6 Mar 2024 19:17:14 +0100
 Subject: [PATCH 01/57] RH: Aarch64 and ppc64le use lib64
@ -14,10 +14,10 @@ From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce
 1 file changed, 2 insertions(+)

 diff --git a/Configurations/10-main.conf b/Configurations/10-main.conf
-index cba57b4127..3e327017ef 100644
+index 692eccbfa1..08918399e4 100644
 --- a/Configurations/10-main.conf
 +++ b/Configurations/10-main.conf
-@@ -726,6 +726,7 @@ my %targets = (
+@@ -727,6 +727,7 @@ my %targets = (
         lib_cppflags     => add("-DL_ENDIAN"),
         asm_arch         => 'ppc64',
         perlasm_scheme   => "linux64le",
@ -25,7 +25,7 @@ index cba57b4127..3e327017ef 100644
     },
 
     "linux-armv4" => {
-@@ -768,6 +769,7 @@ my %targets = (
+@@ -769,6 +770,7 @@ my %targets = (
         inherit_from     => [ "linux-generic64" ],
         asm_arch         => 'aarch64',
         perlasm_scheme   => "linux64",
@ -34,5 +34,5 @@ index cba57b4127..3e327017ef 100644
     "linux-arm64ilp32" => {  # https://wiki.linaro.org/Platform/arm64-ilp32
         inherit_from     => [ "linux-generic32" ],
 -- 
-2.52.0
+2.55.0

--- a/0002-Add-a-separate-config-file-to-use-for-rpm-installs.patch
+++ b/0002-Add-a-separate-config-file-to-use-for-rpm-installs.patch
@ -1,4 +1,4 @@
-From a10a60403c197128ea6d8076b5111c64594a5026 Mon Sep 17 00:00:00 2001
+From dc4488c19469cb95d7bb1c4f7ff62a5d57cdde95 Mon Sep 17 00:00:00 2001
 From: Simo Sorce <simo@redhat.com>
 Date: Thu, 6 Mar 2025 08:40:29 -0500
 Subject: [PATCH 02/57] Add a separate config file to use for rpm installs
@ -452,5 +452,5 @@ index 0000000000..fe2346eb2b
 +cmd = rr
 +oldcert = $insta::certout # insta.cert.pem
 -- 
-2.52.0
+2.55.0

--- a/0003-RH-Do-not-install-html-docs.patch
+++ b/0003-RH-Do-not-install-html-docs.patch
@ -1,4 +1,4 @@
-From 44f15e373a78a1fb01edf15e7530cea4c8a1b79b Mon Sep 17 00:00:00 2001
+From 7f7ac4e921f70a9cad079ca9475561f355c085bf Mon Sep 17 00:00:00 2001
 From: rpm-build <rpm-build>
 Date: Wed, 6 Mar 2024 19:17:14 +0100
 Subject: [PATCH 03/57] RH: Do not install html docs
@ -13,10 +13,10 @@ From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce
 1 file changed, 1 insertion(+), 1 deletion(-)

 diff --git a/Configurations/unix-Makefile.tmpl b/Configurations/unix-Makefile.tmpl
-index 78be4a3199..962d1330bb 100644
+index 5bf397eba0..9a7d51ac1f 100644
 --- a/Configurations/unix-Makefile.tmpl
 +++ b/Configurations/unix-Makefile.tmpl
-@@ -669,7 +669,7 @@ install_sw: install_dev install_engines install_modules install_runtime ## Insta
+@@ -670,7 +670,7 @@ install_sw: install_dev install_engines install_modules install_runtime ## Insta
 
 uninstall_sw: uninstall_runtime uninstall_modules uninstall_engines uninstall_dev ## Uninstall the software and libraries
 
@ -26,5 +26,5 @@ index 78be4a3199..962d1330bb 100644
 uninstall_docs: uninstall_man_docs uninstall_html_docs ## Uninstall manpages and HTML documentation
 	$(RM) -r "$(DESTDIR)$(DOCDIR)"
 -- 
-2.52.0
+2.55.0

--- a/0004-RH-apps-ca-fix-md-option-help-text.patch-DROP.patch
+++ b/0004-RH-apps-ca-fix-md-option-help-text.patch-DROP.patch
@ -1,4 +1,4 @@
-From 3e60b46747eae0aec3171f13da6be706bcac6b48 Mon Sep 17 00:00:00 2001
+From 398109b4775fc42f1f5d1bdfc34068a51f2b7cc8 Mon Sep 17 00:00:00 2001
 From: rpm-build <rpm-build>
 Date: Wed, 6 Mar 2024 19:17:14 +0100
 Subject: [PATCH 04/57] RH: apps ca fix md option help text.patch - DROP?
@ -26,5 +26,5 @@ index 02b00c7c03..7f77e069ab 100644
     { "keyform", OPT_KEYFORM, 'f',
         "Private key file format (ENGINE, other values ignored)" },
 -- 
-2.52.0
+2.55.0

--- a/0005-RH-Disable-signature-verification-with-bad-digests-R.patch
+++ b/0005-RH-Disable-signature-verification-with-bad-digests-R.patch
@ -1,4 +1,4 @@
-From 04f1fc282cd5f5e7a9fbf2d82a62a9810d2e4acc Mon Sep 17 00:00:00 2001
+From 2e5c5494f72433a7dc4f1979fb29ba7c7d5f1fc1 Mon Sep 17 00:00:00 2001
 From: rpm-build <rpm-build>
 Date: Wed, 6 Mar 2024 19:17:14 +0100
 Subject: [PATCH 05/57] RH: Disable signature verification with bad digests -
@ -30,5 +30,5 @@ index 55f86ee83f..95483afc00 100644
         const EVP_MD *type = NULL;
 
 -- 
-2.52.0
+2.55.0

--- a/0006-RH-Add-support-for-PROFILE-SYSTEM-system-default-cip.patch
+++ b/0006-RH-Add-support-for-PROFILE-SYSTEM-system-default-cip.patch
@ -1,4 +1,4 @@
-From ced223dc078708514c65b1903c783062ec568bb7 Mon Sep 17 00:00:00 2001
+From 80977968258324654798a2cc7be3e8c56407004a Mon Sep 17 00:00:00 2001
 From: rpm-build <rpm-build>
 Date: Wed, 6 Mar 2024 19:17:14 +0100
 Subject: [PATCH 06/57] RH: Add support for PROFILE SYSTEM system default
@ -20,10 +20,10 @@ From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce
 7 files changed, 106 insertions(+), 15 deletions(-)

 diff --git a/Configurations/unix-Makefile.tmpl b/Configurations/unix-Makefile.tmpl
-index 962d1330bb..1920d38655 100644
+index 9a7d51ac1f..dc5811f639 100644
 --- a/Configurations/unix-Makefile.tmpl
 +++ b/Configurations/unix-Makefile.tmpl
-@@ -355,6 +355,10 @@ MANDIR=$(INSTALLTOP)/share/man
+@@ -356,6 +356,10 @@ MANDIR=$(INSTALLTOP)/share/man
 DOCDIR=$(INSTALLTOP)/share/doc/$(BASENAME)
 HTMLDIR=$(DOCDIR)/html
 
@ -34,7 +34,7 @@ index 962d1330bb..1920d38655 100644
 # MANSUFFIX is for the benefit of anyone who may want to have a suffix
 # appended after the manpage file section number.  "ssl" is popular,
 # resulting in files such as config.5ssl rather than config.5.
-@@ -378,6 +382,7 @@ CC=$(CROSS_COMPILE){- $config{CC} -}
+@@ -379,6 +383,7 @@ CC=$(CROSS_COMPILE){- $config{CC} -}
 CXX={- $config{CXX} ? "\$(CROSS_COMPILE)$config{CXX}" : '' -}
 CPPFLAGS={- our $cppflags1 = join(" ",
                                   (map { "-D".$_} @{$config{CPPDEFINES}}),
@ -43,7 +43,7 @@ index 962d1330bb..1920d38655 100644
                                   @{$config{CPPFLAGS}}) -}
 CFLAGS={- join(' ', @{$config{CFLAGS}}) -}
 diff --git a/Configure b/Configure
-index 499585438a..e1b908fe13 100755
+index 1b020faadb..407cca1656 100755
 --- a/Configure
 +++ b/Configure
@@ -27,7 +27,7 @@ use OpenSSL::config;
@ -66,7 +66,7 @@ index 499585438a..e1b908fe13 100755
 # --banner=".." Output specified text instead of default completion banner
 #
 # -w            Don't wait after showing a Configure warning
-@@ -409,6 +413,7 @@ $config{prefix}="";
+@@ -414,6 +418,7 @@ $config{prefix}="";
 $config{openssldir}="";
 $config{processor}="";
 $config{libdir}="";
@ -74,7 +74,7 @@ index 499585438a..e1b908fe13 100755
 my $auto_threads=1;    # enable threads automatically? true by default
 my $default_ranlib;
 
-@@ -1105,6 +1110,10 @@ while (@argvcopy)
+@@ -1110,6 +1115,10 @@ while (@argvcopy)
                         die "FIPS key too long (64 bytes max)\n"
                            if length $1 > 64;
                         }
@ -86,10 +86,10 @@ index 499585438a..e1b908fe13 100755
                         {
                         $banner = $1 . "\n";
 diff --git a/doc/man1/openssl-ciphers.pod.in b/doc/man1/openssl-ciphers.pod.in
-index 69195bcdcb..a6e0ede570 100644
+index e1f9845cee..2496d011aa 100644
 --- a/doc/man1/openssl-ciphers.pod.in
 +++ b/doc/man1/openssl-ciphers.pod.in
-@@ -189,6 +189,15 @@ As of OpenSSL 1.0.0, the B<ALL> cipher suites are sensibly ordered by default.
+@@ -190,6 +190,15 @@ As of OpenSSL 1.0.0, the B<ALL> cipher suites are sensibly ordered by default.
 
 The cipher suites not enabled by B<ALL>, currently B<eNULL>.
 
@ -106,7 +106,7 @@ index 69195bcdcb..a6e0ede570 100644
 
 "High" encryption cipher suites. This currently means those with key lengths
 diff --git a/include/openssl/ssl.h.in b/include/openssl/ssl.h.in
-index bdcc68529b..82410670f4 100644
+index 90be33cb4f..81f6a19ce7 100644
 --- a/include/openssl/ssl.h.in
 +++ b/include/openssl/ssl.h.in
@@ -211,6 +211,11 @@ extern "C" {
@ -122,7 +122,7 @@ index bdcc68529b..82410670f4 100644
 /* Used in SSL_set_shutdown()/SSL_get_shutdown(); */
 #define SSL_SENT_SHUTDOWN 1
 diff --git a/ssl/ssl_ciph.c b/ssl/ssl_ciph.c
-index 7dccec6260..15be7e8067 100644
+index fd2c4b0833..cce1dde0dc 100644
 --- a/ssl/ssl_ciph.c
 +++ b/ssl/ssl_ciph.c
@@ -9,6 +9,7 @@
@ -133,7 +133,7 @@ index 7dccec6260..15be7e8067 100644
 #include <stdio.h>
 #include <ctype.h>
 #include <openssl/objects.h>
-@@ -1404,6 +1405,49 @@ int SSL_set_ciphersuites(SSL *s, const char *str)
+@@ -1408,6 +1409,49 @@ int SSL_set_ciphersuites(SSL *s, const char *str)
     return ret;
 }
 
@ -183,7 +183,7 @@ index 7dccec6260..15be7e8067 100644
 STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(SSL_CTX *ctx,
     STACK_OF(SSL_CIPHER) *tls13_ciphersuites,
     STACK_OF(SSL_CIPHER) **cipher_list,
-@@ -1418,15 +1462,25 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(SSL_CTX *ctx,
+@@ -1422,15 +1466,25 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(SSL_CTX *ctx,
     CIPHER_ORDER *co_list = NULL, *head = NULL, *tail = NULL, *curr;
     const SSL_CIPHER **ca_list = NULL;
     const SSL_METHOD *ssl_method = ctx->method;
@ -211,7 +211,7 @@ index 7dccec6260..15be7e8067 100644
 
     /*
      * To reduce the work to do we only want to process the compiled
-@@ -1448,7 +1502,7 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(SSL_CTX *ctx,
+@@ -1452,7 +1506,7 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(SSL_CTX *ctx,
     if (num_of_ciphers > 0) {
         co_list = OPENSSL_malloc(sizeof(*co_list) * num_of_ciphers);
         if (co_list == NULL)
@ -220,7 +220,7 @@ index 7dccec6260..15be7e8067 100644
     }
 
     ssl_cipher_collect_ciphers(ssl_method, num_of_ciphers,
-@@ -1514,8 +1568,7 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(SSL_CTX *ctx,
+@@ -1518,8 +1572,7 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(SSL_CTX *ctx,
      * in force within each class
      */
     if (!ssl_cipher_strength_sort(&head, &tail)) {
@ -230,7 +230,7 @@ index 7dccec6260..15be7e8067 100644
     }
 
     /*
-@@ -1559,8 +1612,7 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(SSL_CTX *ctx,
+@@ -1563,8 +1616,7 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(SSL_CTX *ctx,
     num_of_alias_max = num_of_ciphers + num_of_group_aliases + 1;
     ca_list = OPENSSL_malloc(sizeof(*ca_list) * num_of_alias_max);
     if (ca_list == NULL) {
@ -240,7 +240,7 @@ index 7dccec6260..15be7e8067 100644
     }
     ssl_cipher_collect_aliases(ca_list, num_of_group_aliases,
         disabled_mkey, disabled_auth, disabled_enc,
-@@ -1585,9 +1637,8 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(SSL_CTX *ctx,
+@@ -1589,9 +1641,8 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(SSL_CTX *ctx,
 
     OPENSSL_free(ca_list); /* Not needed anymore */
 
@ -252,7 +252,7 @@ index 7dccec6260..15be7e8067 100644
     }
 
     /*
-@@ -1595,10 +1646,13 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(SSL_CTX *ctx,
+@@ -1599,10 +1650,13 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(SSL_CTX *ctx,
      * if we cannot get one.
      */
     if ((cipherstack = sk_SSL_CIPHER_new_null()) == NULL) {
@ -268,7 +268,7 @@ index 7dccec6260..15be7e8067 100644
     /* Add TLSv1.3 ciphers first - we always prefer those if possible */
     for (i = 0; i < sk_SSL_CIPHER_num(tls13_ciphersuites); i++) {
         const SSL_CIPHER *sslc = sk_SSL_CIPHER_value(tls13_ciphersuites, i);
-@@ -1653,6 +1707,13 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(SSL_CTX *ctx,
+@@ -1657,6 +1711,13 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(SSL_CTX *ctx,
     *cipher_list = cipherstack;
 
     return cipherstack;
@ -283,7 +283,7 @@ index 7dccec6260..15be7e8067 100644
 
 char *SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf, int len)
 diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c
-index ac77faa677..677b05ba64 100644
+index ba494f5fc0..e8207e1ee9 100644
 --- a/ssl/ssl_lib.c
 +++ b/ssl/ssl_lib.c
@@ -678,7 +678,7 @@ int SSL_CTX_set_ssl_version(SSL_CTX *ctx, const SSL_METHOD *meth)
@ -295,7 +295,7 @@ index ac77faa677..677b05ba64 100644
     if ((sk == NULL) || (sk_SSL_CIPHER_num(sk) <= 0)) {
         ERR_raise(ERR_LIB_SSL, SSL_R_SSL_LIBRARY_HAS_NO_CIPHERS);
         return 0;
-@@ -4102,7 +4102,7 @@ SSL_CTX *SSL_CTX_new_ex(OSSL_LIB_CTX *libctx, const char *propq,
+@@ -4100,7 +4100,7 @@ SSL_CTX *SSL_CTX_new_ex(OSSL_LIB_CTX *libctx, const char *propq,
     if (!ssl_create_cipher_list(ret,
             ret->tls13_ciphersuites,
             &ret->cipher_list, &ret->cipher_list_by_id,
@ -305,10 +305,10 @@ index ac77faa677..677b05ba64 100644
         ERR_raise(ERR_LIB_SSL, SSL_R_LIBRARY_HAS_NO_CIPHERS);
         goto err;
 diff --git a/test/cipherlist_test.c b/test/cipherlist_test.c
-index 9874e6bad6..76b6befbad 100644
+index 921afe6234..be2c382f85 100644
 --- a/test/cipherlist_test.c
 +++ b/test/cipherlist_test.c
-@@ -260,7 +260,9 @@ end:
+@@ -312,7 +312,9 @@ end:
 
 int setup_tests(void)
 {
@ -319,5 +319,5 @@ index 9874e6bad6..76b6befbad 100644
     ADD_TEST(test_default_cipherlist_clear);
 #ifndef OPENSSL_NO_TLS1_3
 -- 
-2.52.0
+2.55.0

--- a/0007-RH-Add-FIPS_mode-compatibility-macro.patch
+++ b/0007-RH-Add-FIPS_mode-compatibility-macro.patch
@ -1,4 +1,4 @@
-From 60f55f072544cb998c42da41ee33ced2b4428b9f Mon Sep 17 00:00:00 2001
+From 005e6daf6097a420efdb869e641f2708a9d0c551 Mon Sep 17 00:00:00 2001
 From: rpm-build <rpm-build>
 Date: Wed, 6 Mar 2024 19:17:15 +0100
 Subject: [PATCH 07/57] RH: Add FIPS_mode compatibility macro
@ -79,5 +79,5 @@ index d470731e50..0b044ec853 100644
     ADD_TEST(test_property_list_to_string_bounds);
     return 1;
 -- 
-2.52.0
+2.55.0

--- a/0008-RH-Add-Kernel-FIPS-mode-flag-support-FIXSTYLE.patch
+++ b/0008-RH-Add-Kernel-FIPS-mode-flag-support-FIXSTYLE.patch
@ -1,4 +1,4 @@
-From 5aa108caf01f482d35aba7acae6b5a8fa1577410 Mon Sep 17 00:00:00 2001
+From d3013b93461e421ac5d13b1bd74dc8478d84cd94 Mon Sep 17 00:00:00 2001
 From: rpm-build <rpm-build>
 Date: Wed, 6 Mar 2024 19:17:15 +0100
 Subject: [PATCH 08/57] RH: Add Kernel FIPS mode flag support - FIXSTYLE
@ -90,5 +90,5 @@ index 1b4050a81f..eb7f409af0 100644
 #endif
 
 -- 
-2.52.0
+2.55.0

--- a/0009-RH-Drop-weak-curve-definitions-RENAMED-SQUASHED.patch
+++ b/0009-RH-Drop-weak-curve-definitions-RENAMED-SQUASHED.patch
@ -1,4 +1,4 @@
-From 8f48c77eb1c8f3e59d4d80041893a1dbf3e1a257 Mon Sep 17 00:00:00 2001
+From abb90da4c709dab8c919dde2f73d5643da95a332 Mon Sep 17 00:00:00 2001
 From: rpm-build <rpm-build>
 Date: Wed, 6 Mar 2024 19:17:15 +0100
 Subject: [PATCH 09/57] RH: Drop weak curve definitions - RENAMED/SQUASHED
@ -28,7 +28,7 @@ From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce
 8 files changed, 10 insertions(+), 1083 deletions(-)

 diff --git a/apps/speed.c b/apps/speed.c
-index a8d7cb14f5..13c8505ed9 100644
+index 6cf9748902..a36faa686d 100644
 --- a/apps/speed.c
 +++ b/apps/speed.c
@@ -458,8 +458,6 @@ static double ffdh_results[FFDH_NUM][1]; /* 1 op: derivation */
@ -68,7 +68,7 @@ index a8d7cb14f5..13c8505ed9 100644
         { "nistp256", NID_X9_62_prime256v1, 256 },
         { "nistp384", NID_secp384r1, 384 },
 diff --git a/crypto/ec/ec_curve.c b/crypto/ec/ec_curve.c
-index c17a7e5477..c6455ff691 100644
+index c3bc92fd75..28c83df735 100644
 --- a/crypto/ec/ec_curve.c
 +++ b/crypto/ec/ec_curve.c
@@ -30,34 +30,6 @@ typedef struct {
@ -799,7 +799,7 @@ index c17a7e5477..c6455ff691 100644
 static const struct {
     EC_CURVE_DATA h;
     unsigned char data[0 + 32 * 6];
-@@ -2740,8 +2047,6 @@ static const ec_list_element curve_list[] = {
+@@ -2570,8 +1877,6 @@ static const ec_list_element curve_list[] = {
         "NIST/SECG curve over a 521 bit prime field" },
 
     /* X9.62 curves */
@ -808,7 +808,7 @@ index c17a7e5477..c6455ff691 100644
     { NID_X9_62_prime256v1, &_EC_X9_62_PRIME_256V1.h,
 #if defined(ECP_NISTZ256_ASM)
         EC_GFp_nistz256_method,
-@@ -2784,26 +2089,6 @@ static const ec_list_element curve_list[] = {
+@@ -2614,26 +1919,6 @@ static const ec_list_element curve_list[] = {
 
 static const ec_list_element curve_list[] = {
     /* prime field curves */
@ -835,7 +835,7 @@ index c17a7e5477..c6455ff691 100644
 #ifndef OPENSSL_NO_EC_NISTP_64_GCC_128
     { NID_secp224r1, &_EC_NIST_PRIME_224.h, EC_GFp_nistp224_method,
         "NIST/SECG curve over a 224 bit prime field" },
-@@ -2833,18 +2118,6 @@ static const ec_list_element curve_list[] = {
+@@ -2663,18 +1948,6 @@ static const ec_list_element curve_list[] = {
 #endif
         "NIST/SECG curve over a 521 bit prime field" },
     /* X9.62 curves */
@ -854,7 +854,7 @@ index c17a7e5477..c6455ff691 100644
     { NID_X9_62_prime256v1, &_EC_X9_62_PRIME_256V1.h,
 #if defined(ECP_NISTZ256_ASM)
         EC_GFp_nistz256_method,
-@@ -2928,36 +2201,6 @@ static const ec_list_element curve_list[] = {
+@@ -2758,36 +2031,6 @@ static const ec_list_element curve_list[] = {
         "X9.62 curve over a 368 bit binary field" },
     { NID_X9_62_c2tnb431r1, &_EC_X9_62_CHAR2_431R1.h, 0,
         "X9.62 curve over a 431 bit binary field" },
@ -891,7 +891,7 @@ index c17a7e5477..c6455ff691 100644
     /* IPSec curves */
     { NID_ipsec3, &_EC_IPSEC_155_ID3.h, 0,
         "\n\tIPSec/IKE/Oakley curve #3 over a 155 bit binary field.\n"
-@@ -2967,18 +2210,6 @@ static const ec_list_element curve_list[] = {
+@@ -2797,18 +2040,6 @@ static const ec_list_element curve_list[] = {
         "\tNot suitable for ECDSA.\n\tQuestionable extension field!" },
 #endif
     /* brainpool curves */
@ -1080,7 +1080,7 @@ index 700d7b5253..6aa4faa461 100644
     { NID_secp224r1, NID_sha224,
         "699325d6fc8fbbb4981a6ded3c3a54ad2e4e3db8a5669201912064c64e700c139248cdc1"
 diff --git a/test/ectest.c b/test/ectest.c
-index 0233f870b6..f243f6fb3c 100644
+index 1e4ae9c63e..56cfc99421 100644
 --- a/test/ectest.c
 +++ b/test/ectest.c
@@ -174,183 +174,26 @@ static int prime_field_tests(void)
@ -1275,7 +1275,7 @@ index 0233f870b6..f243f6fb3c 100644
                                     "FFFFFFFF000000000000000000000001"))
         || !TEST_int_eq(1, BN_check_prime(p, ctx, NULL))
         || !TEST_true(BN_hex2bn(&a, "FFFFFFFFFFFFFFFFFFFFFFFF"
-@@ -3522,7 +3365,7 @@ int setup_tests(void)
+@@ -3107,7 +2950,7 @@ int setup_tests(void)
 
     ADD_TEST(parameter_test);
     ADD_TEST(ossl_parameter_test);
@ -1344,5 +1344,5 @@ index e6a2c9eb59..861c01e177 100644
 Ctrl = key-check:0
 +Result = KEYGEN_GENERATE_ERROR
 -- 
-2.52.0
+2.55.0

--- a/0010-RH-Disable-explicit-ec-curves.patch
+++ b/0010-RH-Disable-explicit-ec-curves.patch
@ -1,4 +1,4 @@
-From a925f827ebbd25236c7449e179cfcd716af60379 Mon Sep 17 00:00:00 2001
+From 1c73ee172cf5c48088b0f939dc75f3ce9d9f525a Mon Sep 17 00:00:00 2001
 From: rpm-build <rpm-build>
 Date: Wed, 6 Mar 2024 19:17:15 +0100
 Subject: [PATCH 10/57] RH: Disable explicit ec curves
@ -18,7 +18,7 @@ From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce
 5 files changed, 45 insertions(+), 38 deletions(-)

 diff --git a/crypto/ec/ec_asn1.c b/crypto/ec/ec_asn1.c
-index bfd0242c6f..bb462121b5 100644
+index 6b44b8068f..bb0d743e73 100644
 --- a/crypto/ec/ec_asn1.c
 +++ b/crypto/ec/ec_asn1.c
@@ -889,6 +889,12 @@ EC_GROUP *d2i_ECPKParameters(EC_GROUP **a, const unsigned char **in, long len)
@ -47,10 +47,10 @@ index bfd0242c6f..bb462121b5 100644
 
     if (priv_key->privateKey) {
 diff --git a/crypto/ec/ec_lib.c b/crypto/ec/ec_lib.c
-index 13dcd29b11..de21cb2f10 100644
+index e29e39aca5..8cd2b8709c 100644
 --- a/crypto/ec/ec_lib.c
 +++ b/crypto/ec/ec_lib.c
-@@ -1551,7 +1551,7 @@ EC_GROUP *EC_GROUP_new_from_params(const OSSL_PARAM params[],
+@@ -1553,7 +1553,7 @@ EC_GROUP *EC_GROUP_new_from_params(const OSSL_PARAM params[],
     int is_prime_field = 1;
     BN_CTX *bnctx = NULL;
     const unsigned char *buf = NULL;
@ -59,7 +59,7 @@ index 13dcd29b11..de21cb2f10 100644
 #endif
 
     /* This is the simple named group case */
-@@ -1726,6 +1726,11 @@ EC_GROUP *EC_GROUP_new_from_params(const OSSL_PARAM params[],
+@@ -1729,6 +1729,11 @@ EC_GROUP *EC_GROUP_new_from_params(const OSSL_PARAM params[],
         goto err;
     }
     if (named_group == group) {
@ -71,7 +71,7 @@ index 13dcd29b11..de21cb2f10 100644
         /*
          * If we did not find a named group then the encoding should be explicit
          * if it was specified
-@@ -1741,6 +1746,7 @@ EC_GROUP *EC_GROUP_new_from_params(const OSSL_PARAM params[],
+@@ -1744,6 +1749,7 @@ EC_GROUP *EC_GROUP_new_from_params(const OSSL_PARAM params[],
             goto err;
         }
         EC_GROUP_set_asn1_flag(group, OPENSSL_EC_EXPLICIT_CURVE);
@ -80,10 +80,10 @@ index 13dcd29b11..de21cb2f10 100644
         EC_GROUP_free(group);
         group = named_group;
 diff --git a/test/ectest.c b/test/ectest.c
-index f243f6fb3c..d8246524f3 100644
+index 56cfc99421..045739617c 100644
 --- a/test/ectest.c
 +++ b/test/ectest.c
-@@ -2791,11 +2791,12 @@ static int do_test_custom_explicit_fromdata(EC_GROUP *group, BN_CTX *ctx,
+@@ -2376,11 +2376,12 @@ static int do_test_custom_explicit_fromdata(EC_GROUP *group, BN_CTX *ctx,
     if (!TEST_ptr(params = OSSL_PARAM_BLD_to_param(bld))
         || !TEST_ptr(pctx = EVP_PKEY_CTX_new_from_name(NULL, "EC", NULL))
         || !TEST_int_gt(EVP_PKEY_fromdata_init(pctx), 0)
@ -98,7 +98,7 @@ index f243f6fb3c..d8246524f3 100644
     /*- Check that all the set values are retrievable -*/
 
     /* There should be no match to a group name since the generator changed */
-@@ -2924,6 +2925,7 @@ static int do_test_custom_explicit_fromdata(EC_GROUP *group, BN_CTX *ctx,
+@@ -2509,6 +2510,7 @@ static int do_test_custom_explicit_fromdata(EC_GROUP *group, BN_CTX *ctx,
 #endif
     )
         goto err;
@ -106,7 +106,7 @@ index f243f6fb3c..d8246524f3 100644
     ret = 1;
 err:
     BN_free(order_out);
-@@ -3217,21 +3219,21 @@ static int custom_params_test(int id)
+@@ -2802,21 +2804,21 @@ static int custom_params_test(int id)
 
     /* Compute keyexchange in both directions */
     if (!TEST_ptr(pctx1 = EVP_PKEY_CTX_new(pkey1, NULL))
@ -135,7 +135,7 @@ index f243f6fb3c..d8246524f3 100644
     /* Both sides should expect the same shared secret */
     if (!TEST_mem_eq(buf1, sslen, buf2, t))
         goto err;
-@@ -3286,7 +3288,7 @@ static int custom_params_test(int id)
+@@ -2871,7 +2873,7 @@ static int custom_params_test(int id)
         /* compare with previous result */
         || !TEST_mem_eq(buf1, t, buf2, sslen))
         goto err;
@ -145,10 +145,10 @@ index f243f6fb3c..d8246524f3 100644
 
 err:
 diff --git a/test/endecode_test.c b/test/endecode_test.c
-index 3f8ed7f392..c3b55af3e7 100644
+index 64701d32b8..93347bed40 100644
 --- a/test/endecode_test.c
 +++ b/test/endecode_test.c
-@@ -63,7 +63,7 @@ static BN_CTX *bnctx = NULL;
+@@ -64,7 +64,7 @@ static BN_CTX *bnctx = NULL;
 static OSSL_PARAM_BLD *bld_prime_nc = NULL;
 static OSSL_PARAM_BLD *bld_prime = NULL;
 static OSSL_PARAM *ec_explicit_prime_params_nc = NULL;
@ -157,7 +157,7 @@ index 3f8ed7f392..c3b55af3e7 100644
 
 #ifndef OPENSSL_NO_EC2M
 static OSSL_PARAM_BLD *bld_tri_nc = NULL;
-@@ -1013,10 +1013,10 @@ IMPLEMENT_TEST_SUITE_LEGACY(EC, "EC")
+@@ -1430,10 +1430,10 @@ IMPLEMENT_TEST_SUITE_LEGACY(EC, "EC")
 DOMAIN_KEYS(ECExplicitPrimeNamedCurve);
 IMPLEMENT_TEST_SUITE(ECExplicitPrimeNamedCurve, "EC", 1)
 IMPLEMENT_TEST_SUITE_LEGACY(ECExplicitPrimeNamedCurve, "EC")
@ -172,7 +172,7 @@ index 3f8ed7f392..c3b55af3e7 100644
 DOMAIN_KEYS(ECExplicitTriNamedCurve);
 IMPLEMENT_TEST_SUITE(ECExplicitTriNamedCurve, "EC", 1)
 IMPLEMENT_TEST_SUITE_LEGACY(ECExplicitTriNamedCurve, "EC")
-@@ -1458,8 +1458,8 @@ int setup_tests(void)
+@@ -1853,8 +1853,8 @@ int setup_tests(void)
         || !create_ec_explicit_prime_params_namedcurve(bld_prime_nc)
         || !create_ec_explicit_prime_params(bld_prime)
         || !TEST_ptr(ec_explicit_prime_params_nc = OSSL_PARAM_BLD_to_param(bld_prime_nc))
@ -183,9 +183,9 @@ index 3f8ed7f392..c3b55af3e7 100644
         || !TEST_ptr(bld_tri_nc = OSSL_PARAM_BLD_new())
         || !TEST_ptr(bld_tri = OSSL_PARAM_BLD_new())
         || !create_ec_explicit_trinomial_params_namedcurve(bld_tri_nc)
-@@ -1486,8 +1486,8 @@ int setup_tests(void)
-     TEST_info("Generating EC keys...");
+@@ -1883,8 +1883,8 @@ int setup_tests(void)
     MAKE_DOMAIN_KEYS(EC, "EC", EC_params);
+ #ifndef OPENSSL_NO_EC_EXPLICIT_CURVES
     MAKE_DOMAIN_KEYS(ECExplicitPrimeNamedCurve, "EC", ec_explicit_prime_params_nc);
 -    MAKE_DOMAIN_KEYS(ECExplicitPrime2G, "EC", ec_explicit_prime_params_explicit);
 -#ifndef OPENSSL_NO_EC2M
@ -194,8 +194,8 @@ index 3f8ed7f392..c3b55af3e7 100644
     MAKE_DOMAIN_KEYS(ECExplicitTriNamedCurve, "EC", ec_explicit_tri_params_nc);
     MAKE_DOMAIN_KEYS(ECExplicitTri2G, "EC", ec_explicit_tri_params_explicit);
 #endif
-@@ -1566,9 +1566,9 @@ int setup_tests(void)
-         ADD_TEST_SUITE_LEGACY(EC);
+@@ -1970,9 +1970,9 @@ int setup_tests(void)
+ #ifndef OPENSSL_NO_EC_EXPLICIT_CURVES
         ADD_TEST_SUITE(ECExplicitPrimeNamedCurve);
         ADD_TEST_SUITE_LEGACY(ECExplicitPrimeNamedCurve);
 -        ADD_TEST_SUITE(ECExplicitPrime2G);
@ -207,18 +207,18 @@ index 3f8ed7f392..c3b55af3e7 100644
         ADD_TEST_SUITE(ECExplicitTriNamedCurve);
         ADD_TEST_SUITE_LEGACY(ECExplicitTriNamedCurve);
         ADD_TEST_SUITE(ECExplicitTri2G);
-@@ -1644,7 +1644,7 @@ void cleanup_tests(void)
- {
+@@ -2058,7 +2058,7 @@ void cleanup_tests(void)
 #ifndef OPENSSL_NO_EC
+ #ifndef OPENSSL_NO_EC_EXPLICIT_CURVES
     OSSL_PARAM_free(ec_explicit_prime_params_nc);
 -    OSSL_PARAM_free(ec_explicit_prime_params_explicit);
 +/*    OSSL_PARAM_free(ec_explicit_prime_params_explicit);*/
     OSSL_PARAM_BLD_free(bld_prime_nc);
     OSSL_PARAM_BLD_free(bld_prime);
 #ifndef OPENSSL_NO_EC2M
-@@ -1666,8 +1666,8 @@ void cleanup_tests(void)
- #ifndef OPENSSL_NO_EC
+@@ -2082,8 +2082,8 @@ void cleanup_tests(void)
     FREE_DOMAIN_KEYS(EC);
+ #ifndef OPENSSL_NO_EC_EXPLICIT_CURVES
     FREE_DOMAIN_KEYS(ECExplicitPrimeNamedCurve);
 -    FREE_DOMAIN_KEYS(ECExplicitPrime2G);
 -#ifndef OPENSSL_NO_EC2M
@ -251,5 +251,5 @@ index 07dc4b4298..4c47fa68c2 100644
 -----BEGIN PRIVATE KEY-----
 MGMCAQAwEAYHKoZIzj0CAQYFK4EEAA8ETDBKAgEBBBUDnQW0mLiHVha/jqFznX/K
 -- 
-2.52.0
+2.55.0

--- a/0011-RH-skipped-tests-EC-curves.patch
+++ b/0011-RH-skipped-tests-EC-curves.patch
@ -1,4 +1,4 @@
-From 2afc42b7faa263387234aa747d676efd140a7c8a Mon Sep 17 00:00:00 2001
+From c607becfce55f1b62e8afc0ceebeab08e193036f Mon Sep 17 00:00:00 2001
 From: rpm-build <rpm-build>
 Date: Wed, 6 Mar 2024 19:17:15 +0100
 Subject: [PATCH 11/57] RH: skipped tests EC curves
@ -78,5 +78,5 @@ index f722800e27..26a01786bb 100644
 my @basic_cmd = ("cmp_vfy_test",
                  data_file("server.crt"),     data_file("client.crt"),
 -- 
-2.52.0
+2.55.0

--- a/0012-RH-skip-quic-pairwise.patch
+++ b/0012-RH-skip-quic-pairwise.patch
@ -1,4 +1,4 @@
-From 48b4a63db033730ef98eb9968e45ba66688598c9 Mon Sep 17 00:00:00 2001
+From 263e1761f11b392337a4bbff6658b97fd7a65ae2 Mon Sep 17 00:00:00 2001
 From: Dmitry Belyavskiy <dbelyavs@redhat.com>
 Date: Thu, 7 Mar 2024 17:37:09 +0100
 Subject: [PATCH 12/57] RH: skip quic pairwise
@ -8,16 +8,16 @@ Patch-id: 115
 Patch-status: |
    # skip quic and pairwise tests temporarily
 ---
- test/quicapitest.c                     |  4 +++-
- test/recipes/01-test_symbol_presence.t |  1 +
- test/recipes/30-test_pairwise_fail.t   | 10 ++++++++--
- 3 files changed, 12 insertions(+), 3 deletions(-)
+ test/quicapitest.c                     | 4 +++-
+ test/recipes/01-test_symbol_presence.t | 1 +
+ test/recipes/30-test_pairwise_fail.t   | 6 ++++--
+ 3 files changed, 8 insertions(+), 3 deletions(-)

 diff --git a/test/quicapitest.c b/test/quicapitest.c
-index 6b9ee8e69a..96cd735819 100644
+index fd950772c8..2c489f528f 100644
 --- a/test/quicapitest.c
 +++ b/test/quicapitest.c
-@@ -3015,7 +3015,9 @@ int setup_tests(void)
+@@ -3287,7 +3287,9 @@ int setup_tests(void)
     ADD_TEST(test_cipher_find);
     ADD_TEST(test_version);
 #if defined(DO_SSL_TRACE_TEST)
@ -41,38 +41,22 @@ index 6c8de64b0b..79a5584099 100644
     note "Duplicates:";
     note join('\n', @duplicates);
 diff --git a/test/recipes/30-test_pairwise_fail.t b/test/recipes/30-test_pairwise_fail.t
-index eaf0dbbb42..21864ad319 100644
+index 1b3269a982..6455f3de8b 100644
 --- a/test/recipes/30-test_pairwise_fail.t
 +++ b/test/recipes/30-test_pairwise_fail.t
-@@ -9,7 +9,7 @@
- use strict;
- use warnings;
+@@ -37,8 +37,10 @@ SKIP: {
+ }
 
-use OpenSSL::Test qw(:DEFAULT bldtop_dir srctop_file srctop_dir data_file);
-+use OpenSSL::Test qw(:DEFAULT bldtop_dir srctop_file srctop_dir data_file with);
- use OpenSSL::Test::Utils;
- 
- BEGIN {
-@@ -39,20 +39,26 @@ SKIP: {
 SKIP: {
-     skip "Skip EC test because of no ec in this build", 2
-         if disabled("ec");
-+    with({ exit_checker => sub {my $val = shift; return $val == 134; } },
-+    sub {
+    use Config;
+    my $is_s390 = ($Config{archname} =~ /^s390/) ? 1 : 0;
+     skip "Skip EC test because of no ec in this build", 1
+-        if disabled("ec");
+        if (disabled("ec") || $is_s390);
     ok(run(test(["pairwise_fail_test", "-config", $provconf,
                  "-pairwise", "ec"])),
        "fips provider ec keygen pairwise failure test");
-+    });
- 
-     skip "FIPS provider version is too old", 1
-         if !$fips_exit;
-+    with({ exit_checker => sub {my $val = shift; return $val == 134; } },
-+    sub {
-     ok(run(test(["pairwise_fail_test", "-config", $provconf,
-                  "-pairwise", "eckat"])),
-        "fips provider ec keygen kat failure test");
-+    });
- }
+@@ -46,7 +48,7 @@ SKIP: {
 
 SKIP: {
     skip "Skip DSA tests because of no dsa in this build", 2
@ -82,5 +66,5 @@ index eaf0dbbb42..21864ad319 100644
                  "-pairwise", "dsa", "-dsaparam", data_file("dsaparam.pem")])),
        "fips provider dsa keygen pairwise failure test");
 -- 
-2.52.0
+2.55.0

--- a/0013-RH-version-aliasing.patch
+++ b/0013-RH-version-aliasing.patch
@ -1,4 +1,4 @@
-From 9a41889c1a026e203f936e0c3b511e6d4ddc4cf2 Mon Sep 17 00:00:00 2001
+From af4e864805feef1a6431bde880ddb6b09c5f1a1f Mon Sep 17 00:00:00 2001
 From: rpm-build <rpm-build>
 Date: Wed, 6 Mar 2024 19:17:17 +0100
 Subject: [PATCH 13/57] RH: version aliasing
@ -17,7 +17,7 @@ From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce
 4 files changed, 15 insertions(+), 2 deletions(-)

 diff --git a/crypto/evp/digest.c b/crypto/evp/digest.c
-index 4b1c95c4ab..8a6e87c11a 100644
+index 224f3000ce..7f0d77ab69 100644
 --- a/crypto/evp/digest.c
 +++ b/crypto/evp/digest.c
@@ -572,7 +572,12 @@ int EVP_DigestSqueeze(EVP_MD_CTX *ctx, unsigned char *md, size_t size)
@ -35,10 +35,10 @@ index 4b1c95c4ab..8a6e87c11a 100644
     EVP_MD_CTX *out = EVP_MD_CTX_new();
 
 diff --git a/crypto/evp/evp_enc.c b/crypto/evp/evp_enc.c
-index 5584e06d7e..d5ff34a4e2 100644
+index 109412b342..b4cfe2b809 100644
 --- a/crypto/evp/evp_enc.c
 +++ b/crypto/evp/evp_enc.c
-@@ -1756,7 +1756,12 @@ int EVP_CIPHER_CTX_rand_key(EVP_CIPHER_CTX *ctx, unsigned char *key)
+@@ -1766,7 +1766,12 @@ int EVP_CIPHER_CTX_rand_key(EVP_CIPHER_CTX *ctx, unsigned char *key)
 #endif /* FIPS_MODULE */
 }
 
@ -79,5 +79,5 @@ index ceb4948839..eab3987a6b 100644
 BN_signed_bn2bin                        5568	3_2_0	EXIST::FUNCTION:
 BN_signed_lebin2bn                      5569	3_2_0	EXIST::FUNCTION:
 -- 
-2.52.0
+2.55.0

--- a/0014-RH-Export-two-symbols-for-OPENSSL_str-n-casecmp.patch
+++ b/0014-RH-Export-two-symbols-for-OPENSSL_str-n-casecmp.patch
@ -1,4 +1,4 @@
-From 51d485de6b9e2a714610daa886bde82b45016c0a Mon Sep 17 00:00:00 2001
+From 365f4de8ff84e3dc77551a0038652bb7973a18f2 Mon Sep 17 00:00:00 2001
 From: Simo Sorce <simo@redhat.com>
 Date: Thu, 13 Feb 2025 16:09:09 -0500
 Subject: [PATCH 14/57] RH: Export two symbols for OPENSSL_str[n]casecmp
@ -17,7 +17,7 @@ with upstream.
 mode change 100644 => 100755 test/recipes/01-test_symbol_presence.t

 diff --git a/crypto/evp/digest.c b/crypto/evp/digest.c
-index 8a6e87c11a..638dac8844 100644
+index 7f0d77ab69..101f49862c 100644
 --- a/crypto/evp/digest.c
 +++ b/crypto/evp/digest.c
@@ -573,7 +573,7 @@ int EVP_DigestSqueeze(EVP_MD_CTX *ctx, unsigned char *md, size_t size)
@ -30,10 +30,10 @@ index 8a6e87c11a..638dac8844 100644
                     symver ("EVP_MD_CTX_dup@OPENSSL_3.2.0")))
 #endif
 diff --git a/crypto/evp/evp_enc.c b/crypto/evp/evp_enc.c
-index d5ff34a4e2..b4edd825cd 100644
+index b4cfe2b809..30c2ec56dc 100644
 --- a/crypto/evp/evp_enc.c
 +++ b/crypto/evp/evp_enc.c
-@@ -1757,7 +1757,7 @@ int EVP_CIPHER_CTX_rand_key(EVP_CIPHER_CTX *ctx, unsigned char *key)
+@@ -1767,7 +1767,7 @@ int EVP_CIPHER_CTX_rand_key(EVP_CIPHER_CTX *ctx, unsigned char *key)
 }
 
 EVP_CIPHER_CTX
@ -43,10 +43,10 @@ index d5ff34a4e2..b4edd825cd 100644
                     symver ("EVP_CIPHER_CTX_dup@OPENSSL_3.2.0")))
 #endif
 diff --git a/crypto/o_str.c b/crypto/o_str.c
-index 35540630be..fde43421ea 100644
+index 154393c7b3..b221ba789e 100644
 --- a/crypto/o_str.c
 +++ b/crypto/o_str.c
-@@ -406,7 +406,12 @@ int openssl_strerror_r(int errnum, char *buf, size_t buflen)
+@@ -417,7 +417,12 @@ int openssl_strerror_r(int errnum, char *buf, size_t buflen)
 #endif
 }
 
@ -60,7 +60,7 @@ index 35540630be..fde43421ea 100644
 {
     int t;
 
-@@ -416,7 +421,12 @@ int OPENSSL_strcasecmp(const char *s1, const char *s2)
+@@ -427,7 +432,12 @@ int OPENSSL_strcasecmp(const char *s1, const char *s2)
     return t;
 }
 
@ -104,5 +104,5 @@ index eab3987a6b..d377d542db 100644
 RAND_set0_public                        5559	3_1_0	EXIST::FUNCTION:
 RAND_set0_private                       5560	3_1_0	EXIST::FUNCTION:
 -- 
-2.52.0
+2.55.0

--- a/0015-RH-TMP-KTLS-test-skip.patch
+++ b/0015-RH-TMP-KTLS-test-skip.patch
@ -1,4 +1,4 @@
-From a6d43e2d94ba1f8ff57dfb403d9d70d9f6f0f433 Mon Sep 17 00:00:00 2001
+From 7db8402c2c44c585ee7e005d96cb715c144c6663 Mon Sep 17 00:00:00 2001
 From: Simo Sorce <simo@redhat.com>
 Date: Thu, 13 Feb 2025 18:11:19 -0500
 Subject: [PATCH 15/57] RH: TMP KTLS test skip
@ -9,7 +9,7 @@ From-dist-git-commit: 83382cc2a09dfcc55d5740fd08fd95c2333a56c9
 1 file changed, 3 insertions(+), 2 deletions(-)

 diff --git a/test/sslapitest.c b/test/sslapitest.c
-index 993d9e6018..a94061d974 100644
+index ece9a59c82..f0aeaf8b89 100644
 --- a/test/sslapitest.c
 +++ b/test/sslapitest.c
@@ -1029,9 +1029,10 @@ end:
@ -26,5 +26,5 @@ index 993d9e6018..a94061d974 100644
 
 static int ping_pong_query(SSL *clientssl, SSL *serverssl)
 -- 
-2.52.0
+2.55.0

--- a/0016-RH-Allow-disabling-of-SHA1-signatures.patch
+++ b/0016-RH-Allow-disabling-of-SHA1-signatures.patch
@ -1,4 +1,4 @@
-From 1efe3493167934ee77a52eba9a6b2a492885a955 Mon Sep 17 00:00:00 2001
+From 2ba303329dd0f2a156a7a586ae81634ac779f01a Mon Sep 17 00:00:00 2001
 From: Dmitry Belyavskiy <dbelyavs@redhat.com>
 Date: Mon, 21 Aug 2023 13:07:07 +0200
 Subject: [PATCH 16/57] RH: Allow disabling of SHA1 signatures
@ -172,7 +172,7 @@ index 184bab933c..2ae7ccea15 100644
             ERR_raise_data(ERR_LIB_EVP, EVP_R_UNKNOWN_OPTION,
                 "name=%s, value=%s", oval->name, oval->value);
 diff --git a/crypto/evp/m_sigver.c b/crypto/evp/m_sigver.c
-index 0a433adbe4..6c9f71569b 100644
+index 01f7e92393..67f07322d5 100644
 --- a/crypto/evp/m_sigver.c
 +++ b/crypto/evp/m_sigver.c
@@ -15,6 +15,7 @@
@ -183,7 +183,7 @@ index 0a433adbe4..6c9f71569b 100644
 
 static int update(EVP_MD_CTX *ctx, const void *data, size_t datalen)
 {
-@@ -251,6 +252,19 @@ reinitialize:
+@@ -253,6 +254,19 @@ reinitialize:
     }
 
     desc = signature->description != NULL ? signature->description : "";
@ -277,7 +277,7 @@ index 1c181933e0..35bdfdb52d 100644
 +#endif
 +
 diff --git a/include/internal/cryptlib.h b/include/internal/cryptlib.h
-index 50aec7e7f4..9678e150e0 100644
+index a4451ca9ee..67efc276c8 100644
 --- a/include/internal/cryptlib.h
 +++ b/include/internal/cryptlib.h
@@ -102,23 +102,24 @@ typedef struct ossl_ex_data_global_st {
@ -386,7 +386,7 @@ index 42823ffe14..4b80f14b40 100644
 /* Disable the security checks in the default provider */
 int ossl_fips_config_securitycheck_enabled(OSSL_LIB_CTX *libctx)
 diff --git a/providers/implementations/signature/dsa_sig.c b/providers/implementations/signature/dsa_sig.c
-index 51dcc3f230..31a89133a3 100644
+index 48237d7eb9..64e677015e 100644
 --- a/providers/implementations/signature/dsa_sig.c
 +++ b/providers/implementations/signature/dsa_sig.c
@@ -163,6 +163,7 @@ static int dsa_setup_md(PROV_DSA_CTX *ctx,
@ -398,7 +398,7 @@ index 51dcc3f230..31a89133a3 100644
         if (md == NULL) {
             ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_DIGEST,
 diff --git a/providers/implementations/signature/ecdsa_sig.c b/providers/implementations/signature/ecdsa_sig.c
-index 0c04fc4ec6..2a4faf4a71 100644
+index 3ce4cd0d2a..758b11210e 100644
 --- a/providers/implementations/signature/ecdsa_sig.c
 +++ b/providers/implementations/signature/ecdsa_sig.c
@@ -197,13 +197,15 @@ static int ecdsa_setup_md(PROV_ECDSA_CTX *ctx,
@ -421,7 +421,7 @@ index 0c04fc4ec6..2a4faf4a71 100644
     if (EVP_MD_xof(md)) {
         ERR_raise(ERR_LIB_PROV, PROV_R_XOF_DIGESTS_NOT_ALLOWED);
 diff --git a/providers/implementations/signature/rsa_sig.c b/providers/implementations/signature/rsa_sig.c
-index fcdfebbbff..bbdd037728 100644
+index 4980474ac0..c92e7ca6ef 100644
 --- a/providers/implementations/signature/rsa_sig.c
 +++ b/providers/implementations/signature/rsa_sig.c
@@ -26,6 +26,7 @@
@ -450,7 +450,7 @@ index fcdfebbbff..bbdd037728 100644
             ERR_raise_data(ERR_LIB_PROV, PROV_R_DIGEST_NOT_ALLOWED,
                 "digest=%s", mdname);
             goto err;
-@@ -1760,8 +1763,13 @@ static int rsa_set_ctx_params(void *vprsactx, const OSSL_PARAM params[])
+@@ -1785,8 +1788,13 @@ static int rsa_set_ctx_params(void *vprsactx, const OSSL_PARAM params[])
     prsactx->pad_mode = pad_mode;
 
     if (prsactx->md == NULL && pmdname == NULL
@ -467,7 +467,7 @@ index fcdfebbbff..bbdd037728 100644
     if (pmgf1mdname != NULL
         && !rsa_setup_mgf1_md(prsactx, pmgf1mdname, pmgf1mdprops))
 diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c
-index cd471a636d..35d0a6f1bb 100644
+index ef1114172a..d2d662b8ac 100644
 --- a/ssl/t1_lib.c
 +++ b/ssl/t1_lib.c
@@ -21,6 +21,7 @@
@ -478,7 +478,7 @@ index cd471a636d..35d0a6f1bb 100644
 #include "internal/nelem.h"
 #include "internal/sizes.h"
 #include "internal/tlsgroups.h"
-@@ -2175,6 +2176,7 @@ int ssl_setup_sigalgs(SSL_CTX *ctx)
+@@ -2164,6 +2165,7 @@ int ssl_setup_sigalgs(SSL_CTX *ctx)
     EVP_PKEY *tmpkey = EVP_PKEY_new();
     int istls;
     int ret = 0;
@ -486,7 +486,7 @@ index cd471a636d..35d0a6f1bb 100644
 
     if (ctx == NULL)
         goto err;
-@@ -2192,6 +2194,7 @@ int ssl_setup_sigalgs(SSL_CTX *ctx)
+@@ -2181,6 +2183,7 @@ int ssl_setup_sigalgs(SSL_CTX *ctx)
         goto err;
 
     ERR_set_mark();
@ -494,7 +494,7 @@ index cd471a636d..35d0a6f1bb 100644
     /* First fill cache and tls12_sigalgs list from legacy algorithm list */
     for (i = 0, lu = sigalg_lookup_tbl;
         i < OSSL_NELEM(sigalg_lookup_tbl); lu++, i++) {
-@@ -2212,6 +2215,11 @@ int ssl_setup_sigalgs(SSL_CTX *ctx)
+@@ -2201,6 +2204,11 @@ int ssl_setup_sigalgs(SSL_CTX *ctx)
             cache[i].available = 0;
             continue;
         }
@ -517,5 +517,5 @@ index d377d542db..c2c55129ae 100644
 +ossl_ctx_legacy_digest_signatures_allowed ?	3_0_1	EXIST::FUNCTION:
 +ossl_ctx_legacy_digest_signatures_allowed_set ?	3_0_1	EXIST::FUNCTION:
 -- 
-2.52.0
+2.55.0

--- a/0017-FIPS-Red-Hat-s-FIPS-module-name-and-version.patch
+++ b/0017-FIPS-Red-Hat-s-FIPS-module-name-and-version.patch
@ -1,4 +1,4 @@
-From 074607f7c460cda25654f1ee990ddba98af6d6db Mon Sep 17 00:00:00 2001
+From 9caf14916de441e5187e2bc7be6bfb638e784c29 Mon Sep 17 00:00:00 2001
 From: Simo Sorce <simo@redhat.com>
 Date: Fri, 7 Mar 2025 18:12:33 -0500
 Subject: [PATCH 17/57] FIPS: Red Hat's FIPS module name and version
@ -9,10 +9,10 @@ Signed-off-by: Simo Sorce <simo@redhat.com>
 1 file changed, 3 insertions(+), 3 deletions(-)

 diff --git a/providers/fips/fipsprov.c b/providers/fips/fipsprov.c
-index 419878719e..0f006301d7 100644
+index 3c749018bc..7928bd0e55 100644
 --- a/providers/fips/fipsprov.c
 +++ b/providers/fips/fipsprov.c
-@@ -201,13 +201,13 @@ static int fips_get_params(void *provctx, OSSL_PARAM params[])
+@@ -200,13 +200,13 @@ static int fips_get_params(void *provctx, OSSL_PARAM params[])
         OSSL_LIB_CTX_FIPS_PROV_INDEX);
 
     p = OSSL_PARAM_locate(params, OSSL_PROV_PARAM_NAME);
@ -30,5 +30,5 @@ index 419878719e..0f006301d7 100644
     p = OSSL_PARAM_locate(params, OSSL_PROV_PARAM_STATUS);
     if (p != NULL && !OSSL_PARAM_set_int(p, ossl_prov_is_running()))
 -- 
-2.52.0
+2.55.0

--- a/0018-FIPS-disable-fipsinstall.patch
+++ b/0018-FIPS-disable-fipsinstall.patch
@ -1,4 +1,4 @@
-From e43a23f06a9e23f1091f88c6dfa6c1bd4e065a7a Mon Sep 17 00:00:00 2001
+From 4a470b2effd2473d876a85941b13a6318a500c4e Mon Sep 17 00:00:00 2001
 From: rpm-build <rpm-build>
 Date: Wed, 6 Mar 2024 19:17:15 +0100
 Subject: [PATCH 18/57] FIPS: disable fipsinstall
@ -530,7 +530,7 @@ index 2db5acd242..1c6b783413 100644
 =head1 COPYRIGHT
 
 diff --git a/doc/man1/openssl.pod b/doc/man1/openssl.pod
-index 635b52aeb1..55bc6e44c6 100644
+index 1963715f38..0f8c415096 100644
 --- a/doc/man1/openssl.pod
 +++ b/doc/man1/openssl.pod
@@ -139,10 +139,6 @@ Engine (loadable module) information and manipulation.
@ -856,5 +856,5 @@ index 3dcbe67c6d..1a5a475d91
 
 # Compatible options for pedantic FIPS compliance
 -- 
-2.52.0
+2.55.0

--- a/0019-FIPS-Force-fips-provider-on.patch
+++ b/0019-FIPS-Force-fips-provider-on.patch
@ -1,4 +1,4 @@
-From b8a5ce1fbad62e0f7b023aab827d2888413d5ced Mon Sep 17 00:00:00 2001
+From 35bea414aee07bf83f41f16f9b583eeddf70b6ea Mon Sep 17 00:00:00 2001
 From: rpm-build <rpm-build>
 Date: Wed, 6 Mar 2024 19:17:15 +0100
 Subject: [PATCH 19/57] FIPS: Force fips provider on
@ -13,7 +13,7 @@ From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce
 1 file changed, 29 insertions(+), 1 deletion(-)

 diff --git a/crypto/provider_conf.c b/crypto/provider_conf.c
-index f2e76ac402..a2a8a9942c 100644
+index f2e76ac402..d92827d3ba 100644
 --- a/crypto/provider_conf.c
 +++ b/crypto/provider_conf.c
@@ -10,6 +10,8 @@
@ -75,5 +75,5 @@ index f2e76ac402..a2a8a9942c 100644
 }
 
 -- 
-2.52.0
+2.55.0

--- a/0020-FIPS-INTEG-CHECK-Embed-hmac-in-fips.so-NOTE.patch
+++ b/0020-FIPS-INTEG-CHECK-Embed-hmac-in-fips.so-NOTE.patch
@ -1,4 +1,4 @@
-From 310346f65db4e3b6052cf165f890f13bfd645f5c Mon Sep 17 00:00:00 2001
+From e05d344de7e39e184823b99cfa641737c9d8f940 Mon Sep 17 00:00:00 2001
 From: rpm-build <rpm-build>
 Date: Wed, 6 Mar 2024 19:17:15 +0100
 Subject: [PATCH 20/57] FIPS: INTEG-CHECK: Embed hmac in fips.so - NOTE
@ -20,10 +20,10 @@ From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce
 create mode 100644 test/fipsmodule.cnf

 diff --git a/providers/fips/self_test.c b/providers/fips/self_test.c
-index 008a4fac84..c72e2605c4 100644
+index aa5a8c7658..34eff75efd 100644
 --- a/providers/fips/self_test.c
 +++ b/providers/fips/self_test.c
-@@ -237,13 +237,137 @@ err:
+@@ -239,13 +239,137 @@ err:
     return ok;
 }
 
@ -162,7 +162,7 @@ index 008a4fac84..c72e2605c4 100644
     OSSL_LIB_CTX *libctx, OSSL_SELF_TEST *ev,
     const char *event_type)
 {
-@@ -255,6 +379,9 @@ static int verify_integrity(OSSL_CORE_BIO *bio, OSSL_FUNC_BIO_read_ex_fn read_ex
+@@ -257,6 +381,9 @@ static int verify_integrity(OSSL_CORE_BIO *bio, OSSL_FUNC_BIO_read_ex_fn read_ex
     EVP_MAC_CTX *ctx = NULL;
     OSSL_PARAM params[2], *p = params;
 
@ -172,7 +172,7 @@ index 008a4fac84..c72e2605c4 100644
     if (!integrity_self_test(ev, libctx))
         goto err;
 
-@@ -318,7 +445,8 @@ int SELF_TEST_post(SELF_TEST_POST_PARAMS *st, int on_demand_test)
+@@ -320,7 +447,8 @@ int SELF_TEST_post(SELF_TEST_POST_PARAMS *st, int on_demand_test)
     int ok = 0;
     long checksum_len;
     OSSL_CORE_BIO *bio_module = NULL;
@ -182,7 +182,7 @@ index 008a4fac84..c72e2605c4 100644
     OSSL_SELF_TEST *ev = NULL;
     EVP_RAND *testrand = NULL;
     EVP_RAND_CTX *rng;
-@@ -354,8 +482,7 @@ int SELF_TEST_post(SELF_TEST_POST_PARAMS *st, int on_demand_test)
+@@ -356,8 +484,7 @@ int SELF_TEST_post(SELF_TEST_POST_PARAMS *st, int on_demand_test)
         return 0;
     }
 
@ -192,7 +192,7 @@ index 008a4fac84..c72e2605c4 100644
         ERR_raise(ERR_LIB_PROV, PROV_R_MISSING_CONFIG_DATA);
         goto end;
     }
-@@ -364,8 +491,15 @@ int SELF_TEST_post(SELF_TEST_POST_PARAMS *st, int on_demand_test)
+@@ -366,8 +493,15 @@ int SELF_TEST_post(SELF_TEST_POST_PARAMS *st, int on_demand_test)
     if (ev == NULL)
         goto end;
 
@ -210,7 +210,7 @@ index 008a4fac84..c72e2605c4 100644
     if (module_checksum == NULL) {
         ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_CONFIG_DATA);
         goto end;
-@@ -373,14 +507,28 @@ int SELF_TEST_post(SELF_TEST_POST_PARAMS *st, int on_demand_test)
+@@ -375,14 +509,28 @@ int SELF_TEST_post(SELF_TEST_POST_PARAMS *st, int on_demand_test)
     bio_module = (*st->bio_new_file_cb)(st->module_filename, "rb");
 
     /* Always check the integrity of the fips module */
@ -243,7 +243,7 @@ index 008a4fac84..c72e2605c4 100644
     if (!SELF_TEST_kats(ev, st->libctx)) {
         ERR_raise(ERR_LIB_PROV, PROV_R_SELF_TEST_KAT_FAILURE);
         goto end;
-@@ -401,7 +549,7 @@ int SELF_TEST_post(SELF_TEST_POST_PARAMS *st, int on_demand_test)
+@@ -403,7 +551,7 @@ int SELF_TEST_post(SELF_TEST_POST_PARAMS *st, int on_demand_test)
 end:
     EVP_RAND_free(testrand);
     OSSL_SELF_TEST_free(ev);
@ -261,5 +261,5 @@ index 0000000000..f05d0dedbe
 +[fips_sect]
 +activate = 1
 -- 
-2.52.0
+2.55.0

--- a/0021-FIPS-INTEG-CHECK-Add-script-to-hmac-ify-fips.so.patch
+++ b/0021-FIPS-INTEG-CHECK-Add-script-to-hmac-ify-fips.so.patch
@ -1,4 +1,4 @@
-From 7fb0257ff4158f41306b730e0b2851bcd6d22747 Mon Sep 17 00:00:00 2001
+From c98ce75030b35047955a8f531a02eb3efb220b65 Mon Sep 17 00:00:00 2001
 From: Simo Sorce <simo@redhat.com>
 Date: Thu, 20 Feb 2025 15:30:32 -0500
 Subject: [PATCH 21/57] FIPS: INTEG-CHECK: Add script to hmac-ify fips.so
@ -28,5 +28,5 @@ index 0000000000..54ae60b07f
 +objcopy --update-section .rodata1=providers/fips.so.hmac providers/fips.so providers/fips.so.mac
 +mv providers/fips.so.mac providers/fips.so
 -- 
-2.52.0
+2.55.0

--- a/0022-FIPS-INTEG-CHECK-Execute-KATS-before-HMAC-REVIEW.patch
+++ b/0022-FIPS-INTEG-CHECK-Execute-KATS-before-HMAC-REVIEW.patch
@ -1,4 +1,4 @@
-From a155bf631d4d923ed08f554344c44d07571d6e02 Mon Sep 17 00:00:00 2001
+From f63a893a787ce689ac83803dbe7fdc6b3a12fc50 Mon Sep 17 00:00:00 2001
 From: rpm-build <rpm-build>
 Date: Wed, 6 Mar 2024 19:17:15 +0100
 Subject: [PATCH 22/57] FIPS: INTEG-CHECK: Execute KATS before HMAC - REVIEW
@ -13,10 +13,10 @@ From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce
 1 file changed, 9 insertions(+), 5 deletions(-)

 diff --git a/providers/fips/self_test.c b/providers/fips/self_test.c
-index c72e2605c4..470cf1fc28 100644
+index 34eff75efd..2fa1e5fe7e 100644
 --- a/providers/fips/self_test.c
 +++ b/providers/fips/self_test.c
-@@ -491,6 +491,15 @@ int SELF_TEST_post(SELF_TEST_POST_PARAMS *st, int on_demand_test)
+@@ -493,6 +493,15 @@ int SELF_TEST_post(SELF_TEST_POST_PARAMS *st, int on_demand_test)
     if (ev == NULL)
         goto end;
 
@ -32,7 +32,7 @@ index c72e2605c4..470cf1fc28 100644
     if (st->module_checksum_data == NULL) {
         module_checksum = fips_hmac_container;
         checksum_len = sizeof(fips_hmac_container);
-@@ -529,11 +538,6 @@ int SELF_TEST_post(SELF_TEST_POST_PARAMS *st, int on_demand_test)
+@@ -531,11 +540,6 @@ int SELF_TEST_post(SELF_TEST_POST_PARAMS *st, int on_demand_test)
         }
     }
 
@ -45,5 +45,5 @@ index c72e2605c4..470cf1fc28 100644
     rng = ossl_rand_get0_private_noncreating(st->libctx);
     if (rng != NULL)
 -- 
-2.52.0
+2.55.0

--- a/0023-FIPS-RSA-encrypt-limits-REVIEW.patch
+++ b/0023-FIPS-RSA-encrypt-limits-REVIEW.patch
@ -1,4 +1,4 @@
-From 97d32c648aa0ba85165f40a9b9fca194301420fa Mon Sep 17 00:00:00 2001
+From bcbaf975d5032243565c88d285418b710854942d Mon Sep 17 00:00:00 2001
 From: rpm-build <rpm-build>
 Date: Wed, 6 Mar 2024 19:17:15 +0100
 Subject: [PATCH 23/57] FIPS: RSA: encrypt limits - REVIEW
@ -911,7 +911,7 @@ index 18e11bdaa9..17ceb59148 100644
 Ctrl = rsa_padding_mode:oaep
 Ctrl = rsa_mgf1_md:sha1
 diff --git a/test/recipes/80-test_cms.t b/test/recipes/80-test_cms.t
-index 279a498475..c278987186 100644
+index b27a03d601..b94f5389c0 100644
 --- a/test/recipes/80-test_cms.t
 +++ b/test/recipes/80-test_cms.t
@@ -267,7 +267,7 @@ my @smime_pkcs7_tests = (
@ -923,7 +923,7 @@ index 279a498475..c278987186 100644
            [ "{cmd1}", @prov, "-encrypt", "-in", $smcont,
              "-aes256", "-stream", "-out", "{output}.cms",
              $smrsa1,
-@@ -1284,6 +1284,9 @@ sub check_availability {
+@@ -1363,6 +1363,9 @@ sub check_availability {
     return "$tnam: skipped, DSA disabled\n"
         if ($no_dsa && $tnam =~ / DSA/);
 
@ -981,5 +981,5 @@ index f7be2e1872..568a1ddba4
             }
             next if $protocol eq "-tls1_3";
 -- 
-2.52.0
+2.55.0

--- a/0024-FIPS-RSA-PCTs.patch
+++ b/0024-FIPS-RSA-PCTs.patch
@ -1,4 +1,4 @@
-From 034d02d047e4a4d84d5c8ca2b54557b1679e8610 Mon Sep 17 00:00:00 2001
+From bdb0ecbad71078d147cd3879f27468d53abb01fe Mon Sep 17 00:00:00 2001
 From: Simo Sorce <simo@redhat.com>
 Date: Mon, 24 Mar 2025 10:50:37 -0400
 Subject: [PATCH 24/57] FIPS: RSA: PCTs
@ -67,7 +67,7 @@ index 3582936d67..383c3071a9 100644
     BN_clear_free(gctx->pub_exp);
     OPENSSL_free(gctx);
 diff --git a/providers/implementations/signature/rsa_sig.c b/providers/implementations/signature/rsa_sig.c
-index bbdd037728..4e0744eeba 100644
+index c92e7ca6ef..f5a04a32ed 100644
 --- a/providers/implementations/signature/rsa_sig.c
 +++ b/providers/implementations/signature/rsa_sig.c
@@ -37,7 +37,7 @@
@ -97,7 +97,7 @@ index bbdd037728..4e0744eeba 100644
 {
     PROV_RSA_CTX *prsactx = NULL;
     char *propq_copy = NULL;
-@@ -1309,7 +1309,7 @@ int rsa_digest_verify_final(void *vprsactx, const unsigned char *sig,
+@@ -1334,7 +1334,7 @@ int rsa_digest_verify_final(void *vprsactx, const unsigned char *sig,
     return ok;
 }
 
@ -106,7 +106,7 @@ index bbdd037728..4e0744eeba 100644
 {
     PROV_RSA_CTX *prsactx = (PROV_RSA_CTX *)vprsactx;
 
-@@ -1861,6 +1861,45 @@ static const OSSL_PARAM *rsa_settable_ctx_md_params(void *vprsactx)
+@@ -1886,6 +1886,45 @@ static const OSSL_PARAM *rsa_settable_ctx_md_params(void *vprsactx)
     return EVP_MD_settable_ctx_params(prsactx->md);
 }
 
@ -153,5 +153,5 @@ index bbdd037728..4e0744eeba 100644
     { OSSL_FUNC_SIGNATURE_NEWCTX, (void (*)(void))rsa_newctx },
     { OSSL_FUNC_SIGNATURE_SIGN_INIT, (void (*)(void))rsa_sign_init },
 -- 
-2.52.0
+2.55.0

--- a/0025-FIPS-RSA-encapsulate-limits.patch
+++ b/0025-FIPS-RSA-encapsulate-limits.patch
@ -1,4 +1,4 @@
-From ca999ba4305afdf6b8465708ecc1a472543bbad6 Mon Sep 17 00:00:00 2001
+From e062487edbdcf3fdb05de59f1926899dfe6997eb Mon Sep 17 00:00:00 2001
 From: rpm-build <rpm-build>
 Date: Wed, 6 Mar 2024 19:17:17 +0100
 Subject: [PATCH 25/57] FIPS: RSA: encapsulate limits
@ -14,10 +14,10 @@ From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce
 2 files changed, 15 insertions(+)

 diff --git a/providers/implementations/kem/rsa_kem.c b/providers/implementations/kem/rsa_kem.c
-index f7bf368a0d..a05cf7c748 100644
+index 47f0c80c94..5bfe6896c8 100644
 --- a/providers/implementations/kem/rsa_kem.c
 +++ b/providers/implementations/kem/rsa_kem.c
-@@ -284,6 +284,13 @@ static int rsasve_generate(PROV_RSA_CTX *prsactx,
+@@ -297,6 +297,13 @@ static int rsasve_generate(PROV_RSA_CTX *prsactx,
     /* Step (1): nlen = Ceil(len(n)/8) */
     nlen = RSA_size(prsactx->rsa);
 
@ -31,7 +31,7 @@ index f7bf368a0d..a05cf7c748 100644
     if (out == NULL) {
         if (nlen == 0) {
             ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_KEY);
-@@ -359,6 +366,13 @@ static int rsasve_recover(PROV_RSA_CTX *prsactx,
+@@ -374,6 +381,13 @@ static int rsasve_recover(PROV_RSA_CTX *prsactx,
     /* Step (1): get the byte length of n */
     nlen = RSA_size(prsactx->rsa);
 
@ -55,5 +55,5 @@ index ecab1454e7..8e5edd35fe 100644
 Op = RSASVE
 +Result = TEST_ENCAPSULATE_LEN_ERROR
 -- 
-2.52.0
+2.55.0

--- a/0026-FIPS-RSA-Disallow-SHAKE-in-OAEP-and-PSS.patch
+++ b/0026-FIPS-RSA-Disallow-SHAKE-in-OAEP-and-PSS.patch
@ -1,4 +1,4 @@
-From 05d9c9154e199bb4a84e215f0b20bd06ac5081d8 Mon Sep 17 00:00:00 2001
+From 64c71ed5188c9e76e87cc79c8a8121df7f42be29 Mon Sep 17 00:00:00 2001
 From: rpm-build <rpm-build>
 Date: Wed, 6 Mar 2024 19:17:17 +0100
 Subject: [PATCH 26/57] FIPS: RSA: Disallow SHAKE in OAEP and PSS
@ -93,5 +93,5 @@ index 98d6e70346..7fe78b9055 100644
     if (hLen <= 0)
         goto err;
 -- 
-2.52.0
+2.55.0

--- a/0027-FIPS-RSA-size-mode-restrictions.patch
+++ b/0027-FIPS-RSA-size-mode-restrictions.patch
@ -1,4 +1,4 @@
-From 4191527585ab1e8923249885cbf87d2f91b8804f Mon Sep 17 00:00:00 2001
+From c0509f78838b7dbf7d3d86045507aff39dc586b4 Mon Sep 17 00:00:00 2001
 From: Simo Sorce <simo@redhat.com>
 Date: Fri, 7 Mar 2025 18:20:30 -0500
 Subject: [PATCH 27/57] FIPS: RSA: size/mode restrictions
@ -12,7 +12,7 @@ Signed-off-by: Simo Sorce <simo@redhat.com>
 4 files changed, 86 insertions(+), 4 deletions(-)

 diff --git a/providers/implementations/signature/rsa_sig.c b/providers/implementations/signature/rsa_sig.c
-index 4e0744eeba..f38431fd60 100644
+index f5a04a32ed..0c9cc8e04a 100644
 --- a/providers/implementations/signature/rsa_sig.c
 +++ b/providers/implementations/signature/rsa_sig.c
@@ -935,6 +935,19 @@ static int rsa_verify_recover(void *vprsactx,
@ -35,7 +35,7 @@ index 4e0744eeba..f38431fd60 100644
 
     if (!ossl_prov_is_running())
         return 0;
-@@ -1027,6 +1040,19 @@ static int rsa_verify_directly(PROV_RSA_CTX *prsactx,
+@@ -1052,6 +1065,19 @@ static int rsa_verify_directly(PROV_RSA_CTX *prsactx,
     const unsigned char *tbs, size_t tbslen)
 {
     size_t rslen;
@ -56,7 +56,7 @@ index 4e0744eeba..f38431fd60 100644
     if (!ossl_prov_is_running())
         return 0;
 diff --git a/ssl/ssl_ciph.c b/ssl/ssl_ciph.c
-index 15be7e8067..823ad48e02 100644
+index cce1dde0dc..d3712d5c43 100644
 --- a/ssl/ssl_ciph.c
 +++ b/ssl/ssl_ciph.c
@@ -350,6 +350,9 @@ int ssl_load_ciphers(SSL_CTX *ctx)
@ -437,5 +437,5 @@ index 17ceb59148..972e90f32f 100644
 # Signing with SHA1 is not allowed in fips mode
 Availablein = fips
 -- 
-2.52.0
+2.55.0

--- a/0028-FIPS-RSA-Mark-x931-as-not-approved-by-default.patch
+++ b/0028-FIPS-RSA-Mark-x931-as-not-approved-by-default.patch
@ -1,4 +1,4 @@
-From d72621c7c9fd09b4d6a917b3a721f0fd114b950d Mon Sep 17 00:00:00 2001
+From 965b25cd50def49f4b5160cb2dc39fe270df63c2 Mon Sep 17 00:00:00 2001
 From: Simo Sorce <simo@redhat.com>
 Date: Mon, 24 Mar 2025 11:03:45 -0400
 Subject: [PATCH 28/57] FIPS: RSA: Mark x931 as not approved by default
@ -22,5 +22,5 @@ index 6bd783eb0a..c1b029de86 100644
 OSSL_FIPS_PARAM(kbkdf_key_check, KBKDF_KEY_CHECK, 0)
 OSSL_FIPS_PARAM(tls13_kdf_key_check, TLS13_KDF_KEY_CHECK, 0)
 -- 
-2.52.0
+2.55.0

--- a/0029-FIPS-RSA-Remove-X9.31-padding-signatures-tests.patch
+++ b/0029-FIPS-RSA-Remove-X9.31-padding-signatures-tests.patch
@ -1,4 +1,4 @@
-From 3618981a35438119a4027d1bf3cb3902431adaa4 Mon Sep 17 00:00:00 2001
+From a23530098276d2d330d9033ce00920b9b3f364cf Mon Sep 17 00:00:00 2001
 From: rpm-build <rpm-build>
 Date: Wed, 6 Mar 2024 19:17:16 +0100
 Subject: [PATCH 29/57] FIPS: RSA: Remove X9.31 padding signatures tests
@ -278,5 +278,5 @@ index 97ec1ff3e5..31fa0eafc6 100644
         "pss",
         4096,
 -- 
-2.52.0
+2.55.0

--- a/0030-FIPS-RSA-NEEDS-REWORK-FIPS-Use-OAEP-in-KATs-support-.patch
+++ b/0030-FIPS-RSA-NEEDS-REWORK-FIPS-Use-OAEP-in-KATs-support-.patch
@ -1,4 +1,4 @@
-From 83b5a2e3a74780873c8831fd8e3cc6bde0006820 Mon Sep 17 00:00:00 2001
+From 350c611443c5242b4f1581c2b7744acc45a13223 Mon Sep 17 00:00:00 2001
 From: Simo Sorce <simo@redhat.com>
 Date: Wed, 12 Feb 2025 17:12:02 -0500
 Subject: [PATCH 30/57] FIPS: RSA: NEEDS-REWORK:
@ -383,5 +383,5 @@ index 0000000000..2833a383c1
 +--
 +
 -- 
-2.52.0
+2.55.0

--- a/0031-FIPS-Deny-SHA-1-signature-verification.patch
+++ b/0031-FIPS-Deny-SHA-1-signature-verification.patch
@ -1,4 +1,4 @@
-From 7061b3b659e0386efa58d9dfb94a4f84832884d0 Mon Sep 17 00:00:00 2001
+From 6b3ea44ada75e17aaefc45a5e219723939a05529 Mon Sep 17 00:00:00 2001
 From: rpm-build <rpm-build>
 Date: Wed, 6 Mar 2024 19:17:15 +0100
 Subject: [PATCH 31/57] FIPS: Deny SHA-1 signature verification
@ -42,7 +42,7 @@ From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce
 8 files changed, 130 insertions(+), 30 deletions(-)

 diff --git a/providers/implementations/signature/dsa_sig.c b/providers/implementations/signature/dsa_sig.c
-index 31a89133a3..0de750c247 100644
+index 64e677015e..d8aee20f4a 100644
 --- a/providers/implementations/signature/dsa_sig.c
 +++ b/providers/implementations/signature/dsa_sig.c
@@ -187,10 +187,7 @@ static int dsa_setup_md(PROV_DSA_CTX *ctx,
@ -58,7 +58,7 @@ index 31a89133a3..0de750c247 100644
             if (!ossl_fips_ind_digest_sign_check(OSSL_FIPS_IND_GET(ctx),
                     OSSL_FIPS_IND_SETTABLE1,
 diff --git a/providers/implementations/signature/ecdsa_sig.c b/providers/implementations/signature/ecdsa_sig.c
-index 2a4faf4a71..f5c101005f 100644
+index 758b11210e..b65e7d58a0 100644
 --- a/providers/implementations/signature/ecdsa_sig.c
 +++ b/providers/implementations/signature/ecdsa_sig.c
@@ -214,10 +214,7 @@ static int ecdsa_setup_md(PROV_ECDSA_CTX *ctx,
@ -74,7 +74,7 @@ index 2a4faf4a71..f5c101005f 100644
         if (!ossl_fips_ind_digest_sign_check(OSSL_FIPS_IND_GET(ctx),
                 OSSL_FIPS_IND_SETTABLE1,
 diff --git a/providers/implementations/signature/rsa_sig.c b/providers/implementations/signature/rsa_sig.c
-index f38431fd60..e90ce3c223 100644
+index 0c9cc8e04a..dc8bed5213 100644
 --- a/providers/implementations/signature/rsa_sig.c
 +++ b/providers/implementations/signature/rsa_sig.c
@@ -407,10 +407,7 @@ static int rsa_setup_md(PROV_RSA_CTX *ctx, const char *mdname,
@ -89,7 +89,7 @@ index f38431fd60..e90ce3c223 100644
 
             if (!ossl_fips_ind_digest_sign_check(OSSL_FIPS_IND_GET(ctx),
                     OSSL_FIPS_IND_SETTABLE1,
-@@ -1790,11 +1787,15 @@ static int rsa_set_ctx_params(void *vprsactx, const OSSL_PARAM params[])
+@@ -1815,11 +1812,15 @@ static int rsa_set_ctx_params(void *vprsactx, const OSSL_PARAM params[])
 
     if (prsactx->md == NULL && pmdname == NULL
         && pad_mode == RSA_PKCS1_PSS_PADDING) {
@ -663,7 +663,7 @@ index 972e90f32f..61e2b4e3ac 100644
 Availablein = fips
 FIPSversion = >=3.4.0
 diff --git a/test/recipes/80-test_cms.t b/test/recipes/80-test_cms.t
-index c278987186..91283c5e74 100644
+index b94f5389c0..985c08b9ae 100644
 --- a/test/recipes/80-test_cms.t
 +++ b/test/recipes/80-test_cms.t
@@ -183,7 +183,7 @@ my @smime_pkcs7_tests = (
@ -707,5 +707,5 @@ index 568a1ddba4..6332aaec4b 100755
         SKIP: {
             skip "No IPv4 available on this machine", 4
 -- 
-2.52.0
+2.55.0

--- a/0032-FIPS-RAND-FIPS-140-3-DRBG-NEEDS-REVIEW.patch
+++ b/0032-FIPS-RAND-FIPS-140-3-DRBG-NEEDS-REVIEW.patch
@ -1,4 +1,4 @@
-From 80a4d4da42db9711d06953f4dcd6e9f29c001292 Mon Sep 17 00:00:00 2001
+From a0493c058ee5d891f7d61b35b131f722c5d81d87 Mon Sep 17 00:00:00 2001
 From: rpm-build <rpm-build>
 Date: Wed, 6 Mar 2024 19:17:16 +0100
 Subject: [PATCH 32/57] FIPS: RAND: FIPS-140-3 DRBG - NEEDS REVIEW
@ -68,7 +68,7 @@ index f9d90d5d43..6b23d55cf5 100644
     if (reseed_required || prediction_resistance) {
         if (!ossl_prov_drbg_reseed_unlocked(drbg, prediction_resistance, NULL,
 diff --git a/providers/implementations/rands/seeding/rand_unix.c b/providers/implementations/rands/seeding/rand_unix.c
-index 80ae817313..1e73a1ec28 100644
+index 0b8a9ec341..5af3c76d64 100644
 --- a/providers/implementations/rands/seeding/rand_unix.c
 +++ b/providers/implementations/rands/seeding/rand_unix.c
@@ -47,12 +47,14 @@
@ -147,7 +147,7 @@ index 80ae817313..1e73a1ec28 100644
 -    return getrandom(buf, buflen, 0);
 -#elif (defined(__FreeBSD__) || defined(__NetBSD__)) && defined(KERN_ARND)
 -    return sysctl_random(buf, buflen);
-#elif defined(__wasi__)
+-#elif defined(__wasi__) || defined(__EMSCRIPTEN__)
 -    if (getentropy(buf, buflen) == 0)
 -        return (ssize_t)buflen;
 -    return -1;
@ -161,5 +161,5 @@ index 80ae817313..1e73a1ec28 100644
 #endif /* defined(OPENSSL_RAND_SEED_GETRANDOM) */
 
 -- 
-2.52.0
+2.55.0

--- a/0033-FIPS-RAND-Forbid-truncated-hashes-SHA-3.patch
+++ b/0033-FIPS-RAND-Forbid-truncated-hashes-SHA-3.patch
--- a/0034-FIPS-PBKDF2-Set-minimum-password-length.patch
+++ b/0034-FIPS-PBKDF2-Set-minimum-password-length.patch
@ -1,4 +1,4 @@
-From 0be17f1220667a7c7758e10dead4be80d521b3fc Mon Sep 17 00:00:00 2001
+From 8e0ea541a46dde7f41101cdb5e54fe686dfafe62 Mon Sep 17 00:00:00 2001
 From: rpm-build <rpm-build>
 Date: Wed, 6 Mar 2024 19:17:17 +0100
 Subject: [PATCH 34/57] FIPS: PBKDF2: Set minimum password length
@ -117,5 +117,5 @@ index 581c8f8799..cc15db4c73 100644
         if (!passed) {
             ERR_raise(ERR_LIB_PROV, error);
 -- 
-2.52.0
+2.55.0

--- a/0035-FIPS-DH-PCT.patch
+++ b/0035-FIPS-DH-PCT.patch
@ -1,4 +1,4 @@
-From a1ee967fae9cb6f4a06d4ffbcd62c6efd9ac05f0 Mon Sep 17 00:00:00 2001
+From 1f1739fa82c67be565e4a7af691ca39224572eb2 Mon Sep 17 00:00:00 2001
 From: Simo Sorce <simo@redhat.com>
 Date: Mon, 24 Mar 2025 10:49:00 -0400
 Subject: [PATCH 35/57] FIPS: DH: PCT
@ -69,5 +69,5 @@ index 2d9f7a8100..ae47dc2cd9 100644
     ok = 1;
 err:
 -- 
-2.52.0
+2.55.0

--- a/0036-FIPS-DH-Disable-FIPS-186-4-type-parameters.patch
+++ b/0036-FIPS-DH-Disable-FIPS-186-4-type-parameters.patch
@ -1,4 +1,4 @@
-From a7ddcb6ceef64c92b5c21389900477bc3a38f46d Mon Sep 17 00:00:00 2001
+From 0f6a3214e4eecd4de0bac7b44e39f5293bc26f19 Mon Sep 17 00:00:00 2001
 From: rpm-build <rpm-build>
 Date: Wed, 6 Mar 2024 19:17:17 +0100
 Subject: [PATCH 36/57] FIPS: DH: Disable FIPS 186-4 type parameters
@ -39,7 +39,7 @@ NOTE: Dropped changes in test/recipes/80-test_cms.t
 11 files changed, 119 insertions(+), 21 deletions(-)

 diff --git a/crypto/dh/dh_backend.c b/crypto/dh/dh_backend.c
-index f68429862c..00b229a295 100644
+index 77b0b3257f..911f602938 100644
 --- a/crypto/dh/dh_backend.c
 +++ b/crypto/dh/dh_backend.c
@@ -47,6 +47,16 @@ int ossl_dh_params_fromdata(DH *dh, const OSSL_PARAM params[])
@ -60,7 +60,7 @@ index f68429862c..00b229a295 100644
     if (param_priv_len != NULL
         && (!OSSL_PARAM_get_long(param_priv_len, &priv_len)
 diff --git a/crypto/dh/dh_check.c b/crypto/dh/dh_check.c
-index 3002609b68..2aabdd2908 100644
+index 8787945f8a..8122916f74 100644
 --- a/crypto/dh/dh_check.c
 +++ b/crypto/dh/dh_check.c
@@ -58,13 +58,15 @@ int DH_check_params(const DH *dh, int *ret)
@ -184,7 +184,7 @@ index dd36dce281..21ac48c1de 100644
         DH_free(ret);
         return NULL;
 diff --git a/providers/implementations/keymgmt/dh_kmgmt.c b/providers/implementations/keymgmt/dh_kmgmt.c
-index 8a1afe7907..759ab77e1b 100644
+index eac99a4fed..46a8e8066d 100644
 --- a/providers/implementations/keymgmt/dh_kmgmt.c
 +++ b/providers/implementations/keymgmt/dh_kmgmt.c
@@ -420,6 +420,11 @@ static int dh_validate(const void *keydata, int selection, int checktype)
@ -200,10 +200,10 @@ index 8a1afe7907..759ab77e1b 100644
         /*
          * Both of these functions check parameters. DH_check_params_ex()
 diff --git a/test/endecode_test.c b/test/endecode_test.c
-index c3b55af3e7..b15bab217e 100644
+index 93347bed40..3dfb1cb56f 100644
 --- a/test/endecode_test.c
 +++ b/test/endecode_test.c
-@@ -85,10 +85,10 @@ static EVP_PKEY *make_template(const char *type, OSSL_PARAM *genparams)
+@@ -87,10 +87,10 @@ static EVP_PKEY *make_template(const char *type, OSSL_PARAM *genparams)
      * for testing only. Use a minimum key size of 2048 for security purposes.
      */
     if (strcmp(type, "DH") == 0)
@ -217,7 +217,7 @@ index c3b55af3e7..b15bab217e 100644
 
     /*
 diff --git a/test/evp_libctx_test.c b/test/evp_libctx_test.c
-index 3786c567a7..773210fadb 100644
+index 0c96f735ad..57ca0e07b4 100644
 --- a/test/evp_libctx_test.c
 +++ b/test/evp_libctx_test.c
@@ -222,7 +222,7 @@ static int do_dh_param_keygen(int tstid, const BIGNUM **bn)
@ -230,10 +230,10 @@ index 3786c567a7..773210fadb 100644
 
     if (expected) {
 diff --git a/test/helpers/predefined_dhparams.c b/test/helpers/predefined_dhparams.c
-index 28070efdb6..4baeb673f3 100644
+index ef71b4498d..59c7776c38 100644
 --- a/test/helpers/predefined_dhparams.c
 +++ b/test/helpers/predefined_dhparams.c
-@@ -311,6 +311,68 @@ EVP_PKEY *get_dhx512(OSSL_LIB_CTX *libctx)
+@@ -120,6 +120,68 @@ EVP_PKEY *get_dhx512(OSSL_LIB_CTX *libctx)
         dhx512_q, sizeof(dhx512_q));
 }
 
@ -329,5 +329,5 @@ index 6332aaec4b..4d8c900c00 100755
                'test sslv2/sslv3 with 1024bit DHE via BIO pair');
           }
 -- 
-2.52.0
+2.55.0

--- a/0037-FIPS-TLS-Enforce-EMS-in-TLS-1.2-NOTE.patch
+++ b/0037-FIPS-TLS-Enforce-EMS-in-TLS-1.2-NOTE.patch
@ -1,4 +1,4 @@
-From 0f4b67897d87b6cb1bd1f65ca2aafbce1c3c6872 Mon Sep 17 00:00:00 2001
+From 8a8136eaa70356abf2ea095e10dfb4f0ed6ea2d6 Mon Sep 17 00:00:00 2001
 From: rpm-build <rpm-build>
 Date: Wed, 6 Mar 2024 19:17:17 +0100
 Subject: [PATCH 37/57] FIPS: TLS: Enforce EMS in TLS 1.2 - NOTE
@ -25,10 +25,10 @@ From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce
 9 files changed, 47 insertions(+), 6 deletions(-)

 diff --git a/doc/man3/SSL_CONF_cmd.pod b/doc/man3/SSL_CONF_cmd.pod
-index 3e2de6e66b..ad9a2dc8bf 100644
+index e78a2231da..60ed79f410 100644
 --- a/doc/man3/SSL_CONF_cmd.pod
 +++ b/doc/man3/SSL_CONF_cmd.pod
-@@ -626,6 +626,9 @@ B<ExtendedMasterSecret>: use extended master secret extension, enabled by
+@@ -624,6 +624,9 @@ B<ExtendedMasterSecret>: use extended master secret extension, enabled by
 default. Inverse of B<SSL_OP_NO_EXTENDED_MASTER_SECRET>: that is,
 B<-ExtendedMasterSecret> is the same as setting B<SSL_OP_NO_EXTENDED_MASTER_SECRET>.
 
@ -63,7 +63,7 @@ index 2505938c13..3887c54f0e 100644
 
 Copyright 2019-2025 The OpenSSL Project Authors. All Rights Reserved.
 diff --git a/include/openssl/ssl.h.in b/include/openssl/ssl.h.in
-index 82410670f4..1026a9b7b0 100644
+index 81f6a19ce7..fbe9f1dda3 100644
 --- a/include/openssl/ssl.h.in
 +++ b/include/openssl/ssl.h.in
@@ -432,6 +432,7 @@ typedef int (*SSL_async_callback_fn)(SSL *s, void *arg);
@ -98,7 +98,7 @@ index 0d93593880..4361edfa49 100644
         SSL_FLAG_TBL("AllowNoDHEKEX", SSL_OP_ALLOW_NO_DHE_KEX),
         SSL_FLAG_TBL("PreferNoDHEKEX", SSL_OP_PREFER_NO_DHE_KEX),
 diff --git a/ssl/statem/extensions_srvr.c b/ssl/statem/extensions_srvr.c
-index cdb914daed..1bcc0fd902 100644
+index 5218547f59..d5c1b39d1f 100644
 --- a/ssl/statem/extensions_srvr.c
 +++ b/ssl/statem/extensions_srvr.c
@@ -12,6 +12,7 @@
@ -109,7 +109,7 @@ index cdb914daed..1bcc0fd902 100644
 
 #define COOKIE_STATE_FORMAT_VERSION 1
 
-@@ -1889,8 +1890,13 @@ EXT_RETURN tls_construct_stoc_ems(SSL_CONNECTION *s, WPACKET *pkt,
+@@ -1898,8 +1899,13 @@ EXT_RETURN tls_construct_stoc_ems(SSL_CONNECTION *s, WPACKET *pkt,
     unsigned int context,
     X509 *x, size_t chainidx)
 {
@ -177,7 +177,7 @@ index 50944328cb..edb2e81273 100644
 KDF = TLS1-PRF
 Ctrl.digest = digest:SHA256
 diff --git a/test/sslapitest.c b/test/sslapitest.c
-index a94061d974..92a33f05db 100644
+index f0aeaf8b89..1873b4ab83 100644
 --- a/test/sslapitest.c
 +++ b/test/sslapitest.c
@@ -582,7 +582,7 @@ static int test_client_cert_verify_cb(void)
@ -190,5 +190,5 @@ index a94061d974..92a33f05db 100644
     if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
             TLS_client_method(), TLS1_VERSION, 0,
 -- 
-2.52.0
+2.55.0

--- a/0038-FIPS-CMS-Set-default-padding-to-OAEP.patch
+++ b/0038-FIPS-CMS-Set-default-padding-to-OAEP.patch
@ -1,4 +1,4 @@
-From c91c7412ab54f8db8cac437e7308a9042c7a4732 Mon Sep 17 00:00:00 2001
+From c341480581a25da55196ba0b466ffad50d08ee34 Mon Sep 17 00:00:00 2001
 From: Simo Sorce <simo@redhat.com>
 Date: Thu, 13 Feb 2025 18:08:34 -0500
 Subject: [PATCH 38/57] FIPS: CMS: Set default padding to OAEP
@ -22,7 +22,7 @@ index 214eea5bcb..c1fc70ef12 100644
 static int save_certs(char *signerfile, STACK_OF(X509) *signers);
 static int cms_cb(int ok, X509_STORE_CTX *ctx);
 diff --git a/crypto/cms/cms_env.c b/crypto/cms/cms_env.c
-index 0828d157fa..e1200a37d4 100644
+index ee86ae71d3..a3b0856046 100644
 --- a/crypto/cms/cms_env.c
 +++ b/crypto/cms/cms_env.c
@@ -14,6 +14,7 @@
@ -57,5 +57,5 @@ index 0828d157fa..e1200a37d4 100644
 
     if (EVP_PKEY_encrypt(pctx, NULL, &eklen, ec->key, ec->keylen) <= 0)
 -- 
-2.52.0
+2.55.0

--- a/0039-FIPS-PKCS12-PBMAC1-defaults.patch
+++ b/0039-FIPS-PKCS12-PBMAC1-defaults.patch
@ -1,4 +1,4 @@
-From 51fc5ce32bfe0fbe018934fa88252efe9073c649 Mon Sep 17 00:00:00 2001
+From 2bbf046d3610da70df48eafd372f7742b2f665e3 Mon Sep 17 00:00:00 2001
 From: Simo Sorce <simo@redhat.com>
 Date: Thu, 13 Feb 2025 18:16:29 -0500
 Subject: [PATCH 39/57] FIPS: PKCS12: PBMAC1 defaults
@ -31,5 +31,5 @@ index 2c83e43845..20aad27c59 100644
                 if (!PKCS12_set_pbmac1_pbkdf2(p12, mpass, -1, NULL,
                         macsaltlen, maciter,
 -- 
-2.52.0
+2.55.0

--- a/0040-FIPS-Fix-encoder-decoder-negative-test.patch
+++ b/0040-FIPS-Fix-encoder-decoder-negative-test.patch
@ -1,4 +1,4 @@
-From 7b7ade7e1ee2f6b10b34bf7f9e7a0165474f5860 Mon Sep 17 00:00:00 2001
+From f63ddd633a81a05890989535016f0af692a0c919 Mon Sep 17 00:00:00 2001
 From: Simo Sorce <simo@redhat.com>
 Date: Wed, 5 Mar 2025 13:22:03 -0500
 Subject: [PATCH 40/57] FIPS: Fix encoder/decoder negative test
@ -31,5 +31,5 @@ index 2acc980e90..660d4e1115
     my $conf2 = srctop_file("test", "default-and-fips.cnf");
     ok(run(test(['decoder_propq_test', '-config', $conf2,
 -- 
-2.52.0
+2.55.0

--- a/0041-FIPS-EC-DH-DSA-PCTs.patch
+++ b/0041-FIPS-EC-DH-DSA-PCTs.patch
@ -1,4 +1,4 @@
-From 17caabce423bbcfe0501ebaa11c2d4a8379aca92 Mon Sep 17 00:00:00 2001
+From 39add9b309bac2f393cf757be6d562def249a145 Mon Sep 17 00:00:00 2001
 From: Simo Sorce <simo@redhat.com>
 Date: Mon, 24 Mar 2025 10:50:06 -0400
 Subject: [PATCH 41/57] FIPS: EC: DH/DSA PCTs
@ -41,7 +41,7 @@ index 43f3515878..0d35fc1590 100644
     retlen = ECDH_compute_key(secret, size, ppubkey, privk, NULL);
 
 diff --git a/providers/implementations/keymgmt/ec_kmgmt.c b/providers/implementations/keymgmt/ec_kmgmt.c
-index 305dc3a6b8..04e604c453 100644
+index 1d740307f6..80c13b3076 100644
 --- a/providers/implementations/keymgmt/ec_kmgmt.c
 +++ b/providers/implementations/keymgmt/ec_kmgmt.c
@@ -963,9 +963,18 @@ struct ec_gen_ctx {
@ -87,7 +87,7 @@ index 305dc3a6b8..04e604c453 100644
 
     if (gctx->group_check != NULL)
         ret = ret && ossl_ec_set_check_group_type_from_name(ec, gctx->group_check);
-@@ -1379,7 +1398,10 @@ static void ec_gen_cleanup(void *genctx)
+@@ -1365,7 +1384,10 @@ static void ec_gen_cleanup(void *genctx)
 
     if (gctx == NULL)
         return;
@ -100,7 +100,7 @@ index 305dc3a6b8..04e604c453 100644
     EC_GROUP_free(gctx->gen_group);
     BN_free(gctx->p);
 diff --git a/providers/implementations/signature/ecdsa_sig.c b/providers/implementations/signature/ecdsa_sig.c
-index f5c101005f..b1576977f7 100644
+index b65e7d58a0..65f294135f 100644
 --- a/providers/implementations/signature/ecdsa_sig.c
 +++ b/providers/implementations/signature/ecdsa_sig.c
@@ -33,7 +33,7 @@
@ -139,7 +139,7 @@ index f5c101005f..b1576977f7 100644
 {
     PROV_ECDSA_CTX *ctx = (PROV_ECDSA_CTX *)vctx;
 
-@@ -854,6 +854,35 @@ static const OSSL_PARAM *ecdsa_settable_ctx_md_params(void *vctx)
+@@ -851,6 +851,35 @@ static const OSSL_PARAM *ecdsa_settable_ctx_md_params(void *vctx)
     return EVP_MD_settable_ctx_params(ctx->md);
 }
 
@ -176,5 +176,5 @@ index f5c101005f..b1576977f7 100644
     { OSSL_FUNC_SIGNATURE_NEWCTX, (void (*)(void))ecdsa_newctx },
     { OSSL_FUNC_SIGNATURE_SIGN_INIT, (void (*)(void))ecdsa_sign_init },
 -- 
-2.52.0
+2.55.0

--- a/0042-FIPS-EC-disable-weak-curves.patch
+++ b/0042-FIPS-EC-disable-weak-curves.patch
@ -1,4 +1,4 @@
-From 2cda3e9adf5534d6be689cff5eeb81459061f52b Mon Sep 17 00:00:00 2001
+From fc9f1fdf78d78e2628e1a407a11dfdc4535e80f4 Mon Sep 17 00:00:00 2001
 From: Simo Sorce <simo@redhat.com>
 Date: Fri, 7 Mar 2025 18:06:36 -0500
 Subject: [PATCH 42/57] FIPS: EC: disable weak curves
@ -27,5 +27,5 @@ index 017dc7568d..596c31a925 100644
             comment = "CURVE DESCRIPTION NOT AVAILABLE";
         if (sname == NULL)
 -- 
-2.52.0
+2.55.0

--- a/0043-FIPS-NO-DSA-Support.patch
+++ b/0043-FIPS-NO-DSA-Support.patch
@ -1,4 +1,4 @@
-From 9fca36a6c0712f3c11e6ba942e99039b17fc75b0 Mon Sep 17 00:00:00 2001
+From f56be05d41df23c0d87b4090730f9acbd12829db Mon Sep 17 00:00:00 2001
 From: Simo Sorce <simo@redhat.com>
 Date: Fri, 7 Mar 2025 18:10:52 -0500
 Subject: [PATCH 43/57] FIPS: NO DSA Support
@ -18,10 +18,10 @@ Signed-off-by: Simo Sorce <simo@redhat.com>
 mode change 100644 => 100755 test/recipes/30-test_evp.t

 diff --git a/providers/fips/fipsprov.c b/providers/fips/fipsprov.c
-index 0f006301d7..f8f2822300 100644
+index 7928bd0e55..f16960b77b 100644
 --- a/providers/fips/fipsprov.c
 +++ b/providers/fips/fipsprov.c
-@@ -431,7 +431,8 @@ static const OSSL_ALGORITHM fips_keyexch[] = {
+@@ -430,7 +430,8 @@ static const OSSL_ALGORITHM fips_keyexch[] = {
 };
 
 static const OSSL_ALGORITHM fips_signature[] = {
@ -31,7 +31,7 @@ index 0f006301d7..f8f2822300 100644
     { PROV_NAMES_DSA, FIPS_DEFAULT_PROPERTIES, ossl_dsa_signature_functions },
     { PROV_NAMES_DSA_SHA1, FIPS_DEFAULT_PROPERTIES, ossl_dsa_sha1_signature_functions },
     { PROV_NAMES_DSA_SHA224, FIPS_DEFAULT_PROPERTIES, ossl_dsa_sha224_signature_functions },
-@@ -559,8 +560,9 @@ static const OSSL_ALGORITHM fips_keymgmt[] = {
+@@ -558,8 +559,9 @@ static const OSSL_ALGORITHM fips_keymgmt[] = {
         PROV_DESCS_DHX },
 #endif
 #ifndef OPENSSL_NO_DSA
@ -44,10 +44,10 @@ index 0f006301d7..f8f2822300 100644
     { PROV_NAMES_RSA, FIPS_DEFAULT_PROPERTIES, ossl_rsa_keymgmt_functions,
         PROV_DESCS_RSA },
 diff --git a/providers/fips/self_test_data.inc b/providers/fips/self_test_data.inc
-index 6abab0a7a1..a7d7684d96 100644
+index 4a0ce24cbb..84b0b1c5c1 100644
 --- a/providers/fips/self_test_data.inc
 +++ b/providers/fips/self_test_data.inc
-@@ -1547,8 +1547,9 @@ static const unsigned char ed448_expected_sig[] = {
+@@ -1546,8 +1546,9 @@ static const unsigned char ed448_expected_sig[] = {
 # endif /* OPENSSL_NO_ECX */
 #endif /* OPENSSL_NO_EC */
 
@ -58,7 +58,7 @@ index 6abab0a7a1..a7d7684d96 100644
 static const unsigned char dsa_p[] = {
     0xa2, 0x9b, 0x88, 0x72, 0xce, 0x8b, 0x84, 0x23,
     0xb7, 0xd5, 0xd2, 0x1d, 0x4b, 0x02, 0xf5, 0x7e,
-@@ -1676,6 +1677,7 @@ static const ST_KAT_PARAM dsa_key[] = {
+@@ -1675,6 +1676,7 @@ static const ST_KAT_PARAM dsa_key[] = {
     ST_KAT_PARAM_END()
 };
 #endif /* OPENSSL_NO_DSA */
@ -66,7 +66,7 @@ index 6abab0a7a1..a7d7684d96 100644
 
 #ifndef OPENSSL_NO_ML_DSA
 static const unsigned char ml_dsa_65_pub_key[] = {
-@@ -3038,6 +3040,7 @@ static const ST_KAT_SIGN st_kat_sign_tests[] = {
+@@ -3037,6 +3039,7 @@ static const ST_KAT_SIGN st_kat_sign_tests[] = {
     },
 # endif /* OPENSSL_NO_ECX */
 #endif /* OPENSSL_NO_EC */
@ -74,7 +74,7 @@ index 6abab0a7a1..a7d7684d96 100644
 #ifndef OPENSSL_NO_DSA
     {
         OSSL_SELF_TEST_DESC_SIGN_DSA,
-@@ -3050,6 +3053,7 @@ static const ST_KAT_SIGN st_kat_sign_tests[] = {
+@@ -3049,6 +3052,7 @@ static const ST_KAT_SIGN st_kat_sign_tests[] = {
         ITM(dsa_expected_sig)
     },
 #endif /* OPENSSL_NO_DSA */
@ -103,10 +103,10 @@ index 15c87c57a7..e3321874c2 100644
 #ifndef OPENSSL_NO_EC
     ec_cofactors = fips_provider_version_ge(libctx, 3, 4, 0);
 diff --git a/test/endecode_test.c b/test/endecode_test.c
-index b15bab217e..acfb5ef36d 100644
+index 3dfb1cb56f..634072de68 100644
 --- a/test/endecode_test.c
 +++ b/test/endecode_test.c
-@@ -1549,6 +1549,7 @@ int setup_tests(void)
+@@ -1952,6 +1952,7 @@ int setup_tests(void)
          * so no legacy tests.
          */
 #endif
@ -114,7 +114,7 @@ index b15bab217e..acfb5ef36d 100644
 #ifndef OPENSSL_NO_DSA
         ADD_TEST_SUITE(DSA);
         ADD_TEST_SUITE_PARAMS(DSA);
-@@ -1559,6 +1560,7 @@ int setup_tests(void)
+@@ -1962,6 +1963,7 @@ int setup_tests(void)
         ADD_TEST_SUITE_PROTECTED_PVK(DSA);
 #endif
 #endif
@ -136,10 +136,10 @@ index cd331c4cfc..e21d6acda4 100644
 plan tests =>
     ($no_fips ? 0 : 2)          # FIPS related tests
 diff --git a/test/recipes/20-test_cli_fips.t b/test/recipes/20-test_cli_fips.t
-index 2abc4d2434..9a6875b3ec 100644
+index fd8842b867..64935ca824 100644
 --- a/test/recipes/20-test_cli_fips.t
 +++ b/test/recipes/20-test_cli_fips.t
-@@ -283,8 +283,7 @@ SKIP: {
+@@ -321,8 +321,7 @@ SKIP: {
 }
 
 SKIP : {
@ -302,7 +302,7 @@ index 5e5315a5b9..660d1db149 100644
 Key = DSA-2048-160
 Input = "Hello"
 diff --git a/test/recipes/80-test_cms.t b/test/recipes/80-test_cms.t
-index 91283c5e74..beadb43cf4 100644
+index 985c08b9ae..d1462a75c9 100644
 --- a/test/recipes/80-test_cms.t
 +++ b/test/recipes/80-test_cms.t
@@ -116,7 +116,7 @@ my @smime_pkcs7_tests = (
@ -396,5 +396,5 @@ index 91283c5e74..beadb43cf4 100644
         "-signer", $smrsa1,
         "-signer", catfile($smdir, "smrsa2.pem"),
 -- 
-2.52.0
+2.55.0

--- a/0044-FIPS-NO-DES-support.patch
+++ b/0044-FIPS-NO-DES-support.patch
@ -1,4 +1,4 @@
-From 62748c233ae3afb8b0797a7d1ce2f391721d2971 Mon Sep 17 00:00:00 2001
+From 25a7a2d914f588d87885e4cff06bb693f5d4b994 Mon Sep 17 00:00:00 2001
 From: Simo Sorce <simo@redhat.com>
 Date: Fri, 7 Mar 2025 18:15:13 -0500
 Subject: [PATCH 44/57] FIPS: NO DES support
@ -14,10 +14,10 @@ Signed-off-by: Simo Sorce <simo@redhat.com>
 6 files changed, 10 insertions(+), 25 deletions(-)

 diff --git a/providers/fips/fipsprov.c b/providers/fips/fipsprov.c
-index f8f2822300..33e1a179cf 100644
+index f16960b77b..16ed6a4a0c 100644
 --- a/providers/fips/fipsprov.c
 +++ b/providers/fips/fipsprov.c
-@@ -355,10 +355,6 @@ static const OSSL_ALGORITHM_CAPABLE fips_ciphers[] = {
+@@ -354,10 +354,6 @@ static const OSSL_ALGORITHM_CAPABLE fips_ciphers[] = {
         ossl_cipher_capable_aes_cbc_hmac_sha256),
     ALGC(PROV_NAMES_AES_256_CBC_HMAC_SHA256, ossl_aes256cbc_hmac_sha256_functions,
         ossl_cipher_capable_aes_cbc_hmac_sha256),
@ -29,7 +29,7 @@ index f8f2822300..33e1a179cf 100644
 };
 static OSSL_ALGORITHM exported_fips_ciphers[OSSL_NELEM(fips_ciphers)];
 diff --git a/providers/fips/self_test_data.inc b/providers/fips/self_test_data.inc
-index a7d7684d96..d8d23e6f90 100644
+index 84b0b1c5c1..c92e8541a9 100644
 --- a/providers/fips/self_test_data.inc
 +++ b/providers/fips/self_test_data.inc
@@ -305,6 +305,7 @@ static const ST_KAT_CIPHER st_kat_cipher_tests[] = {
@ -49,10 +49,10 @@ index a7d7684d96..d8d23e6f90 100644
 
 static const char hkdf_digest[] = "SHA256";
 diff --git a/test/evp_libctx_test.c b/test/evp_libctx_test.c
-index 773210fadb..e0b4efe3f4 100644
+index 57ca0e07b4..d4da35ae2d 100644
 --- a/test/evp_libctx_test.c
 +++ b/test/evp_libctx_test.c
-@@ -984,7 +984,9 @@ int setup_tests(void)
+@@ -842,7 +842,9 @@ int setup_tests(void)
     ADD_TEST(kem_invalid_keytype);
 #endif
 #ifndef OPENSSL_NO_DES
@ -141,7 +141,7 @@ index a11e5ffe54..e4a7cbe75e 100644
 -Input = FA620C1BBE97319E9A0CF0492121F7A20EB08A6A709DCBD00AAF38E4F99E754E
 -Output = 8F49A1B7D6AA2258
 diff --git a/test/recipes/80-test_cms.t b/test/recipes/80-test_cms.t
-index beadb43cf4..71ab4a3910 100644
+index d1462a75c9..8fd99909a5 100644
 --- a/test/recipes/80-test_cms.t
 +++ b/test/recipes/80-test_cms.t
@@ -415,7 +415,7 @@ my @smime_cms_tests = (
@ -154,5 +154,5 @@ index beadb43cf4..71ab4a3910 100644
         "-des3", "-secretkey", "000102030405060708090A0B0C0D0E0F1011121314151617",
         "-stream", "-out", "{output}.cms" ],
 -- 
-2.52.0
+2.55.0

--- a/0045-FIPS-NO-Kmac.patch
+++ b/0045-FIPS-NO-Kmac.patch
@ -1,4 +1,4 @@
-From 7afd41a086ff9d3c39ff592e26d006c769e2a6d7 Mon Sep 17 00:00:00 2001
+From 75ca2b0c1829684e2ecb486d3bef0ac5a6443b47 Mon Sep 17 00:00:00 2001
 From: Simo Sorce <simo@redhat.com>
 Date: Fri, 7 Mar 2025 18:22:07 -0500
 Subject: [PATCH 45/57] FIPS: NO Kmac
@ -15,10 +15,10 @@ Signed-off-by: Simo Sorce <simo@redhat.com>
 7 files changed, 39 insertions(+), 86 deletions(-)

 diff --git a/providers/fips/fipsprov.c b/providers/fips/fipsprov.c
-index 33e1a179cf..7930cf3241 100644
+index 16ed6a4a0c..f2d11326c1 100644
 --- a/providers/fips/fipsprov.c
 +++ b/providers/fips/fipsprov.c
-@@ -294,10 +294,10 @@ static const OSSL_ALGORITHM fips_digests[] = {
+@@ -293,10 +293,10 @@ static const OSSL_ALGORITHM fips_digests[] = {
      * KECCAK-KMAC-128 and KECCAK-KMAC-256 as hashes are mostly useful for
      * KMAC128 and KMAC256.
      */
@ -31,7 +31,7 @@ index 33e1a179cf..7930cf3241 100644
     { NULL, NULL, NULL }
 };
 
-@@ -365,8 +365,9 @@ static const OSSL_ALGORITHM fips_macs[] = {
+@@ -364,8 +364,9 @@ static const OSSL_ALGORITHM fips_macs[] = {
 #endif
     { PROV_NAMES_GMAC, FIPS_DEFAULT_PROPERTIES, ossl_gmac_functions },
     { PROV_NAMES_HMAC, FIPS_DEFAULT_PROPERTIES, ossl_hmac_functions },
@ -44,7 +44,7 @@ index 33e1a179cf..7930cf3241 100644
 };
 
 diff --git a/providers/fips/self_test_data.inc b/providers/fips/self_test_data.inc
-index d8d23e6f90..43f7c89fd6 100644
+index c92e8541a9..675789a87d 100644
 --- a/providers/fips/self_test_data.inc
 +++ b/providers/fips/self_test_data.inc
@@ -533,6 +533,7 @@ static const ST_KAT_PARAM kbkdf_params[] = {
@ -421,5 +421,5 @@ index 831eecbac9..af92ceea98 100644
 -Custom = ""
 -Output = 75358CF39E41494E949707927CEE0AF20A3FF553904C86B08F21CC414BCFD691589D27CF5E15369CBBFF8B9A4C2EB17800855D0235FF635DA82533EC6B759B69
 -- 
-2.52.0
+2.55.0

--- a/0046-FIPS-Fix-some-tests-due-to-our-versioning-change.patch
+++ b/0046-FIPS-Fix-some-tests-due-to-our-versioning-change.patch
@ -1,4 +1,4 @@
-From d6a6afdc614ce0e6273554f50c18cd70000cff01 Mon Sep 17 00:00:00 2001
+From 5e3401812508f7595b5864770bad94644cbba496 Mon Sep 17 00:00:00 2001
 From: Simo Sorce <simo@redhat.com>
 Date: Mon, 10 Mar 2025 13:52:50 -0400
 Subject: [PATCH 46/57] FIPS: Fix some tests due to our versioning change
@ -102,5 +102,5 @@ index af47842fd8..21c75033e8 100644
 
 my @tests_mldsa_tls_1_3 = (
 -- 
-2.52.0
+2.55.0

--- a/0047-Current-Rebase-status.patch
+++ b/0047-Current-Rebase-status.patch
@ -1,4 +1,4 @@
-From 607a195b374a6072c87a500713cea78347b7d252 Mon Sep 17 00:00:00 2001
+From d9465a1a9b641340f624bfa63c2785274f88cd66 Mon Sep 17 00:00:00 2001
 From: Simo Sorce <simo@redhat.com>
 Date: Wed, 12 Feb 2025 17:25:47 -0500
 Subject: [PATCH 47/57] Current Rebase status
@ -102,5 +102,5 @@ index 2833a383c1..c8f6c992a8 100644
 +./Configure --prefix=$HOME/tmp/openssl-rebase --openssldir=$HOME/tmp/openssl-rebase/etc/pki/tls enable-ec_nistp_64_gcc_128 --system-ciphers-file=$HOME/tmp/openssl-rebase/etc/crypto-policies/back-ends/opensslcnf.config zlib enable-camellia enable-seed enable-rfc3779 enable-sctp enable-cms enable-md2 enable-rc5 enable-ktls enable-fips no-mdc2 no-ec2m no-sm2 no-sm4 no-atexit enable-buildtest-c++ shared linux-x86_64 $RPM_OPT_FLAGS '-DDEVRANDOM="\"/dev/urandom\"" -DOPENSSL_PEDANTIC_ZEROIZATION -DREDHAT_FIPS_VENDOR="\"Red Hat Enterprise Linux OpenSSL FIPS Provider\"" -DREDHAT_FIPS_VERSION="\"3.5.0-4c714d97fd77d1a8\""' -Wl,--allow-multiple-definition
 +
 -- 
-2.52.0
+2.55.0

--- a/0048-FIPS-KDF-key-lenght-errors.patch
+++ b/0048-FIPS-KDF-key-lenght-errors.patch
@ -1,4 +1,4 @@
-From be07c8ed65b9657227d03b905b9a490bd14bd173 Mon Sep 17 00:00:00 2001
+From 4284e37eb278449637fd7a524d663fddb4d55415 Mon Sep 17 00:00:00 2001
 From: Simo Sorce <simo@redhat.com>
 Date: Mon, 14 Apr 2025 15:25:40 -0400
 Subject: [PATCH 48/57] FIPS: KDF key lenght errors
@ -171,5 +171,5 @@ index 1fb2472001..93c07ede7c 100644
 
 # Test that the key whose length is shorter than 112 bits is reported as
 -- 
-2.52.0
+2.55.0

--- a/0049-FIPS-fix-disallowed-digests-tests.patch
+++ b/0049-FIPS-fix-disallowed-digests-tests.patch
@ -1,4 +1,4 @@
-From 53462749e29bd8f96e52f3f31cf1de2114e896c3 Mon Sep 17 00:00:00 2001
+From 54d48627806bd48d94e06b37917c415921b110f8 Mon Sep 17 00:00:00 2001
 From: Simo Sorce <simo@redhat.com>
 Date: Tue, 15 Apr 2025 13:41:42 -0400
 Subject: [PATCH 49/57] FIPS: fix disallowed digests tests
@ -47,5 +47,5 @@ index 6688c217aa..8347f773e6 100644
 # Test that the key whose length is shorter than 112 bits is reported as
 # unapproved
 -- 
-2.52.0
+2.55.0

--- a/0050-Make-openssl-speed-run-in-FIPS-mode.patch
+++ b/0050-Make-openssl-speed-run-in-FIPS-mode.patch
@ -1,4 +1,4 @@
-From ed9fd546659e691f51df032d6e364cee45c3bf0b Mon Sep 17 00:00:00 2001
+From ac6d6209d562fe7f4845b8d685336fc027635bb6 Mon Sep 17 00:00:00 2001
 From: Dmitry Belyavskiy <beldmit@gmail.com>
 Date: Fri, 9 May 2025 15:09:46 +0200
 Subject: [PATCH 50/57] Make `openssl speed` run in FIPS mode
@ -8,10 +8,10 @@ Subject: [PATCH 50/57] Make `openssl speed` run in FIPS mode
 1 file changed, 22 insertions(+), 22 deletions(-)

 diff --git a/apps/speed.c b/apps/speed.c
-index 13c8505ed9..c31e30f235 100644
+index a36faa686d..5b2fe33b59 100644
 --- a/apps/speed.c
 +++ b/apps/speed.c
-@@ -3231,18 +3231,18 @@ int speed_main(int argc, char **argv)
+@@ -3232,18 +3232,18 @@ int speed_main(int argc, char **argv)
             (void *)key32, 16);
         params[1] = OSSL_PARAM_construct_end();
 
@ -41,7 +41,7 @@ index 13c8505ed9..c31e30f235 100644
     }
 
     if (doit[D_KMAC256]) {
-@@ -3252,18 +3252,18 @@ int speed_main(int argc, char **argv)
+@@ -3253,18 +3253,18 @@ int speed_main(int argc, char **argv)
             (void *)key32, 32);
         params[1] = OSSL_PARAM_construct_end();
 
@ -72,5 +72,5 @@ index 13c8505ed9..c31e30f235 100644
 
     for (i = 0; i < loopargs_len; i++)
 -- 
-2.52.0
+2.55.0

--- a/0051-Backport-upstream-27483-for-PKCS11-needs.patch
+++ b/0051-Backport-upstream-27483-for-PKCS11-needs.patch
@ -1,4 +1,4 @@
-From b03deba991f7f0677127f6030fde0011ab30430b Mon Sep 17 00:00:00 2001
+From f5f2478cf04960619344dcbe647fb699ed621a6c Mon Sep 17 00:00:00 2001
 From: Dmitry Belyavskiy <beldmit@gmail.com>
 Date: Mon, 12 May 2025 14:34:39 +0200
 Subject: [PATCH 51/57] Backport upstream #27483 for PKCS11 needs
@ -63,10 +63,10 @@ index c75776cce4..7e35b2cc9e 100644
 
 #endif
 diff --git a/test/evp_skey_test.c b/test/evp_skey_test.c
-index 7fd70ca732..dddf92f9da 100644
+index 11b1a4e1cd..37d9c0f578 100644
 --- a/test/evp_skey_test.c
 +++ b/test/evp_skey_test.c
-@@ -107,6 +107,66 @@ end:
+@@ -93,6 +93,66 @@ end:
     return ret;
 }
 
@ -133,7 +133,7 @@ index 7fd70ca732..dddf92f9da 100644
 #define IV_SIZE 16
 #define DATA_SIZE 32
 static int test_aes_raw_skey(void)
-@@ -267,6 +327,7 @@ int setup_tests(void)
+@@ -253,6 +313,7 @@ int setup_tests(void)
         return 0;
 
     ADD_TEST(test_skey_cipher);
@ -142,5 +142,5 @@ index 7fd70ca732..dddf92f9da 100644
     ADD_TEST(test_aes_raw_skey);
 #ifndef OPENSSL_NO_DES
 -- 
-2.52.0
+2.55.0

--- a/0052-Red-Hat-9-FIPS-indicator-defines.patch
+++ b/0052-Red-Hat-9-FIPS-indicator-defines.patch
@ -1,4 +1,4 @@
-From 4a6768577382850dd3f3580f232a2a2ac7ed09c2 Mon Sep 17 00:00:00 2001
+From 434784f897cdd5927ffc109599542723a5eb8fd7 Mon Sep 17 00:00:00 2001
 From: Dmitry Belyavskiy <beldmit@gmail.com>
 Date: Mon, 12 May 2025 16:21:23 +0200
 Subject: [PATCH 52/57] Red Hat 9 FIPS indicator defines
@ -125,5 +125,5 @@ index 262c184ca2..6009253440 100644
     'KEM_PARAM_FIPS_KEY_CHECK' =>       '*PKEY_PARAM_FIPS_KEY_CHECK',
     'KEM_PARAM_FIPS_APPROVED_INDICATOR' => '*ALG_PARAM_FIPS_APPROVED_INDICATOR',
 -- 
-2.52.0
+2.55.0

--- a/0053-Allow-hybrid-MLKEM-in-FIPS-mode.patch
+++ b/0053-Allow-hybrid-MLKEM-in-FIPS-mode.patch
@ -1,4 +1,4 @@
-From 1b1a5447386cf8a149c4cd603c893a691eb210b5 Mon Sep 17 00:00:00 2001
+From 6bd63b3a1c5267c5c14f57ffecbe7771295dc464 Mon Sep 17 00:00:00 2001
 From: Dmitry Belyavskiy <beldmit@gmail.com>
 Date: Fri, 30 May 2025 16:17:37 +0200
 Subject: [PATCH 53/57] Allow hybrid MLKEM in FIPS mode
@ -12,10 +12,10 @@ Subject: [PATCH 53/57] Allow hybrid MLKEM in FIPS mode
 5 files changed, 105 insertions(+), 15 deletions(-)

 diff --git a/crypto/ml_kem/ml_kem.c b/crypto/ml_kem/ml_kem.c
-index dd8a39197a..833abf9f1d 100644
+index 6c3141ca2d..5a71926c47 100644
 --- a/crypto/ml_kem/ml_kem.c
 +++ b/crypto/ml_kem/ml_kem.c
-@@ -1924,6 +1924,7 @@ ML_KEM_KEY *ossl_ml_kem_key_new(OSSL_LIB_CTX *libctx, const char *properties,
+@@ -1965,6 +1965,7 @@ ML_KEM_KEY *ossl_ml_kem_key_new(OSSL_LIB_CTX *libctx, const char *properties,
 {
     const ML_KEM_VINFO *vinfo = ossl_ml_kem_get_vinfo(evp_type);
     ML_KEM_KEY *key;
@ -23,7 +23,7 @@ index dd8a39197a..833abf9f1d 100644
 
     if (vinfo == NULL) {
         ERR_raise_data(ERR_LIB_CRYPTO, ERR_R_PASSED_INVALID_ARGUMENT,
-@@ -1934,15 +1935,17 @@ ML_KEM_KEY *ossl_ml_kem_key_new(OSSL_LIB_CTX *libctx, const char *properties,
+@@ -1975,15 +1976,17 @@ ML_KEM_KEY *ossl_ml_kem_key_new(OSSL_LIB_CTX *libctx, const char *properties,
     if ((key = OPENSSL_malloc(sizeof(*key))) == NULL)
         return NULL;
 
@ -56,7 +56,7 @@ index dbe9192364..35dcbbf32c 100644
 +char *get_adjusted_propq(const char *propq);
 #endif /* OPENSSL_HEADER_ML_KEM_H */
 diff --git a/providers/defltprov.c b/providers/defltprov.c
-index 90655395c1..f74b160d6f 100644
+index de2a46515e..76bba34b79 100644
 --- a/providers/defltprov.c
 +++ b/providers/defltprov.c
@@ -517,8 +517,8 @@ static const OSSL_ALGORITHM deflt_asym_kem[] = {
@ -70,7 +70,7 @@ index 90655395c1..f74b160d6f 100644
 #endif
 #endif
     { NULL, NULL, NULL }
-@@ -594,13 +594,13 @@ static const OSSL_ALGORITHM deflt_keymgmt[] = {
+@@ -598,13 +598,13 @@ static const OSSL_ALGORITHM deflt_keymgmt[] = {
     { PROV_NAMES_X25519MLKEM768, "provider=default", ossl_mlx_x25519_kem_kmgmt_functions,
         PROV_DESCS_X25519MLKEM768 },
     { PROV_NAMES_X448MLKEM1024, "provider=default", ossl_mlx_x448_kem_kmgmt_functions,
@ -90,7 +90,7 @@ index 90655395c1..f74b160d6f 100644
 #endif
 #ifndef OPENSSL_NO_SLH_DSA
 diff --git a/providers/implementations/kem/mlx_kem.c b/providers/implementations/kem/mlx_kem.c
-index 376b3342dd..09fa003612 100644
+index a917fa93d5..04429e0926 100644
 --- a/providers/implementations/kem/mlx_kem.c
 +++ b/providers/implementations/kem/mlx_kem.c
@@ -19,6 +19,7 @@
@ -148,15 +148,15 @@ index 376b3342dd..09fa003612 100644
     if (ctx == NULL
         || EVP_PKEY_encapsulate_init(ctx, NULL) <= 0
         || EVP_PKEY_encapsulate(ctx, cbuf, &encap_clen, sbuf, &encap_slen) <= 0)
-@@ -238,6 +263,7 @@ static int mlx_kem_encapsulate(void *vctx, unsigned char *ctext, size_t *clen,
- end:
+@@ -242,6 +267,7 @@ end:
+             ML_KEM_SHARED_SECRET_BYTES + key->xinfo->shsec_bytes);
     EVP_PKEY_free(xkey);
     EVP_PKEY_CTX_free(ctx);
 +    OPENSSL_free(adjusted_propq);
     return ret;
 }
 
-@@ -253,6 +279,7 @@ static int mlx_kem_decapsulate(void *vctx, uint8_t *shsec, size_t *slen,
+@@ -257,6 +283,7 @@ static int mlx_kem_decapsulate(void *vctx, uint8_t *shsec, size_t *slen,
     size_t decap_clen = key->minfo->ctext_bytes + key->xinfo->pubkey_bytes;
     int ml_kem_slot = key->xinfo->ml_kem_slot;
     int ret = 0;
@ -164,7 +164,7 @@ index 376b3342dd..09fa003612 100644
 
     if (!mlx_kem_have_prvkey(key)) {
         ERR_raise(ERR_LIB_PROV, PROV_R_MISSING_KEY);
-@@ -288,7 +315,8 @@ static int mlx_kem_decapsulate(void *vctx, uint8_t *shsec, size_t *slen,
+@@ -292,7 +319,8 @@ static int mlx_kem_decapsulate(void *vctx, uint8_t *shsec, size_t *slen,
     decap_slen = ML_KEM_SHARED_SECRET_BYTES;
     cbuf = ctext + ml_kem_slot * key->xinfo->pubkey_bytes;
     sbuf = shsec + ml_kem_slot * key->xinfo->shsec_bytes;
@ -174,8 +174,8 @@ index 376b3342dd..09fa003612 100644
     if (ctx == NULL
         || EVP_PKEY_decapsulate_init(ctx, NULL) <= 0
         || EVP_PKEY_decapsulate(ctx, sbuf, &decap_slen, cbuf, decap_clen) <= 0)
-@@ -326,6 +354,7 @@ static int mlx_kem_decapsulate(void *vctx, uint8_t *shsec, size_t *slen,
- end:
+@@ -334,6 +362,7 @@ end:
+             ML_KEM_SHARED_SECRET_BYTES + key->xinfo->shsec_bytes);
     EVP_PKEY_CTX_free(ctx);
     EVP_PKEY_free(xkey);
 +    OPENSSL_free(adjusted_propq);
@ -183,7 +183,7 @@ index 376b3342dd..09fa003612 100644
 }
 
 diff --git a/providers/implementations/keymgmt/mlx_kmgmt.c b/providers/implementations/keymgmt/mlx_kmgmt.c
-index 46ed63039e..6ce9aa3c9a 100644
+index 75267f88e7..7beea2c2f0 100644
 --- a/providers/implementations/keymgmt/mlx_kmgmt.c
 +++ b/providers/implementations/keymgmt/mlx_kmgmt.c
@@ -155,6 +155,52 @@ typedef struct export_cb_arg_st {
@ -250,7 +250,7 @@ index 46ed63039e..6ce9aa3c9a 100644
         if (len != sub_arg->publen) {
             ERR_raise_data(ERR_LIB_PROV, ERR_R_INTERNAL_ERROR,
                 "Unexpected %s public key length %lu != %lu",
-@@ -343,12 +393,14 @@ load_slot(OSSL_LIB_CTX *libctx, const char *propq, const char *pname,
+@@ -349,12 +399,14 @@ load_slot(OSSL_LIB_CTX *libctx, const char *propq, const char *pname,
     void *val;
     int ml_kem_slot = key->xinfo->ml_kem_slot;
     int ret = 0;
@ -265,7 +265,7 @@ index 46ed63039e..6ce9aa3c9a 100644
     } else {
         alg = key->xinfo->algorithm_name;
         group = (char *)key->xinfo->group_name;
-@@ -358,7 +410,8 @@ load_slot(OSSL_LIB_CTX *libctx, const char *propq, const char *pname,
+@@ -364,7 +416,8 @@ load_slot(OSSL_LIB_CTX *libctx, const char *propq, const char *pname,
     }
     val = (void *)(in + off);
 
@ -275,7 +275,7 @@ index 46ed63039e..6ce9aa3c9a 100644
         || EVP_PKEY_fromdata_init(ctx) <= 0)
         goto err;
     parr[0] = OSSL_PARAM_construct_octet_string(pname, val, len);
-@@ -369,6 +422,7 @@ load_slot(OSSL_LIB_CTX *libctx, const char *propq, const char *pname,
+@@ -375,6 +428,7 @@ load_slot(OSSL_LIB_CTX *libctx, const char *propq, const char *pname,
         ret = 1;
 
 err:
@ -283,7 +283,7 @@ index 46ed63039e..6ce9aa3c9a 100644
     EVP_PKEY_CTX_free(ctx);
     return ret;
 }
-@@ -685,6 +739,7 @@ static void *mlx_kem_gen(void *vgctx, OSSL_CALLBACK *osslcb, void *cbarg)
+@@ -697,6 +751,7 @@ static void *mlx_kem_gen(void *vgctx, OSSL_CALLBACK *osslcb, void *cbarg)
     PROV_ML_KEM_GEN_CTX *gctx = vgctx;
     MLX_KEY *key;
     char *propq;
@ -291,7 +291,7 @@ index 46ed63039e..6ce9aa3c9a 100644
 
     if (gctx == NULL
         || (gctx->selection & OSSL_KEYMGMT_SELECT_KEYPAIR) == OSSL_KEYMGMT_SELECT_PUBLIC_KEY)
-@@ -700,8 +755,10 @@ static void *mlx_kem_gen(void *vgctx, OSSL_CALLBACK *osslcb, void *cbarg)
+@@ -712,8 +767,10 @@ static void *mlx_kem_gen(void *vgctx, OSSL_CALLBACK *osslcb, void *cbarg)
         return key;
 
     /* For now, using the same "propq" for all components */
@ -304,5 +304,5 @@ index 46ed63039e..6ce9aa3c9a 100644
         key->xinfo->algorithm_name,
         key->xinfo->group_name);
 -- 
-2.52.0
+2.55.0

--- a/0054-Temporarily-disable-SLH-DSA-FIPS-self-tests.patch
+++ b/0054-Temporarily-disable-SLH-DSA-FIPS-self-tests.patch
@ -1,4 +1,4 @@
-From 3f73722b8e546a3f8f4e8bc7d74527f4fe7c4413 Mon Sep 17 00:00:00 2001
+From 6f965e9d16680ebe78fc855f91a0019878bbba0c Mon Sep 17 00:00:00 2001
 From: Simo Sorce <simo@redhat.com>
 Date: Tue, 15 Jul 2025 12:32:14 -0400
 Subject: [PATCH 54/57] Temporarily disable SLH-DSA FIPS self-tests
@ -9,10 +9,10 @@ Signed-off-by: Simo Sorce <simo@redhat.com>
 1 file changed, 6 insertions(+)

 diff --git a/providers/fips/self_test_data.inc b/providers/fips/self_test_data.inc
-index 43f7c89fd6..7b03aad775 100644
+index 675789a87d..b83528a7f3 100644
 --- a/providers/fips/self_test_data.inc
 +++ b/providers/fips/self_test_data.inc
-@@ -2886,6 +2886,7 @@ static const ST_KAT_PARAM ml_dsa_sig_init[] = {
+@@ -2885,6 +2885,7 @@ static const ST_KAT_PARAM ml_dsa_sig_init[] = {
 };
 #endif /* OPENSSL_NO_ML_DSA */
 
@ -20,7 +20,7 @@ index 43f7c89fd6..7b03aad775 100644
 #ifndef OPENSSL_NO_SLH_DSA
 /*
  * Deterministic SLH_DSA key generation supplies the private key elements and
-@@ -2976,6 +2977,7 @@ static const unsigned char slh_dsa_shake_128f_sig_digest[] = {
+@@ -2975,6 +2976,7 @@ static const unsigned char slh_dsa_shake_128f_sig_digest[] = {
     0x89, 0x77, 0x00, 0x72, 0x03, 0x92, 0xd1, 0xa6,
 };
 #endif /* OPENSSL_NO_SLH_DSA */
@ -28,7 +28,7 @@ index 43f7c89fd6..7b03aad775 100644
 
 /* Hash DRBG inputs for signature KATs */
 static const unsigned char sig_kat_entropyin[] = {
-@@ -3075,6 +3077,7 @@ static const ST_KAT_SIGN st_kat_sign_tests[] = {
+@@ -3074,6 +3076,7 @@ static const ST_KAT_SIGN st_kat_sign_tests[] = {
         ml_dsa_sig_init
     },
 #endif /* OPENSSL_NO_ML_DSA */
@ -36,7 +36,7 @@ index 43f7c89fd6..7b03aad775 100644
 #ifndef OPENSSL_NO_SLH_DSA
     /*
      * FIPS 140-3 IG 10.3.A.16 Note 29 says:
-@@ -3105,6 +3108,7 @@ static const ST_KAT_SIGN st_kat_sign_tests[] = {
+@@ -3104,6 +3107,7 @@ static const ST_KAT_SIGN st_kat_sign_tests[] = {
         slh_dsa_sig_params, slh_dsa_sig_params
     },
 #endif /* OPENSSL_NO_SLH_DSA */
@ -44,7 +44,7 @@ index 43f7c89fd6..7b03aad775 100644
 };
 
 #if !defined(OPENSSL_NO_ML_DSA)
-@@ -3509,6 +3513,7 @@ static const ST_KAT_ASYM_KEYGEN st_kat_asym_keygen_tests[] = {
+@@ -3508,6 +3512,7 @@ static const ST_KAT_ASYM_KEYGEN st_kat_asym_keygen_tests[] = {
         ml_dsa_key
     },
 # endif
@ -52,7 +52,7 @@ index 43f7c89fd6..7b03aad775 100644
 # if !defined(OPENSSL_NO_SLH_DSA)
     {
         OSSL_SELF_TEST_DESC_KEYGEN_SLH_DSA,
-@@ -3517,6 +3522,7 @@ static const ST_KAT_ASYM_KEYGEN st_kat_asym_keygen_tests[] = {
+@@ -3516,6 +3521,7 @@ static const ST_KAT_ASYM_KEYGEN st_kat_asym_keygen_tests[] = {
         slh_dsa_128f_keygen_expected_params
     },
 # endif
@ -61,5 +61,5 @@ index 43f7c89fd6..7b03aad775 100644
 #endif /* !OPENSSL_NO_ML_DSA || !OPENSSL_NO_SLH_DSA */
 
 -- 
-2.52.0
+2.55.0

--- a/0055-Add-a-define-to-disable-symver-attributes.patch
+++ b/0055-Add-a-define-to-disable-symver-attributes.patch
@ -1,4 +1,4 @@
-From 24875d5f4486540cc7baf23c3f94234ee9800862 Mon Sep 17 00:00:00 2001
+From d6b81a69dfbf084b4dcb1405eb109caaee18569d Mon Sep 17 00:00:00 2001
 From: Simo Sorce <simo@redhat.com>
 Date: Thu, 17 Jul 2025 09:40:34 -0400
 Subject: [PATCH 55/57] Add a define to disable symver attributes
@ -14,7 +14,7 @@ Signed-off-by: Simo Sorce <simo@redhat.com>
 3 files changed, 4 insertions(+), 4 deletions(-)

 diff --git a/crypto/evp/digest.c b/crypto/evp/digest.c
-index 638dac8844..5b1b54c195 100644
+index 101f49862c..dbf9bbba7a 100644
 --- a/crypto/evp/digest.c
 +++ b/crypto/evp/digest.c
@@ -573,7 +573,7 @@ int EVP_DigestSqueeze(EVP_MD_CTX *ctx, unsigned char *md, size_t size)
@ -27,10 +27,10 @@ index 638dac8844..5b1b54c195 100644
                     symver ("EVP_MD_CTX_dup@OPENSSL_3.2.0")))
 #endif
 diff --git a/crypto/evp/evp_enc.c b/crypto/evp/evp_enc.c
-index b4edd825cd..e7b124a79b 100644
+index 30c2ec56dc..4117fafdfa 100644
 --- a/crypto/evp/evp_enc.c
 +++ b/crypto/evp/evp_enc.c
-@@ -1757,7 +1757,7 @@ int EVP_CIPHER_CTX_rand_key(EVP_CIPHER_CTX *ctx, unsigned char *key)
+@@ -1767,7 +1767,7 @@ int EVP_CIPHER_CTX_rand_key(EVP_CIPHER_CTX *ctx, unsigned char *key)
 }
 
 EVP_CIPHER_CTX
@ -40,10 +40,10 @@ index b4edd825cd..e7b124a79b 100644
                     symver ("EVP_CIPHER_CTX_dup@OPENSSL_3.2.0")))
 #endif
 diff --git a/crypto/o_str.c b/crypto/o_str.c
-index fde43421ea..807e070827 100644
+index b221ba789e..ca583d9ce6 100644
 --- a/crypto/o_str.c
 +++ b/crypto/o_str.c
-@@ -407,7 +407,7 @@ int openssl_strerror_r(int errnum, char *buf, size_t buflen)
+@@ -418,7 +418,7 @@ int openssl_strerror_r(int errnum, char *buf, size_t buflen)
 }
 
 int
@ -52,7 +52,7 @@ index fde43421ea..807e070827 100644
 __attribute__ ((symver ("OPENSSL_strcasecmp@@OPENSSL_3.0.3"),
                     symver ("OPENSSL_strcasecmp@OPENSSL_3.0.1")))
 #endif
-@@ -422,7 +422,7 @@ OPENSSL_strcasecmp(const char *s1, const char *s2)
+@@ -433,7 +433,7 @@ OPENSSL_strcasecmp(const char *s1, const char *s2)
 }
 
 int
@ -62,5 +62,5 @@ index fde43421ea..807e070827 100644
                     symver ("OPENSSL_strncasecmp@OPENSSL_3.0.1")))
 #endif
 -- 
-2.52.0
+2.55.0

--- a/0056-Add-targets-to-skip-build-of-non-installable-program.patch
+++ b/0056-Add-targets-to-skip-build-of-non-installable-program.patch
@ -1,4 +1,4 @@
-From 4b634bdcc4dedc8516529d39062adc1305c7bf9b Mon Sep 17 00:00:00 2001
+From df6335c8de7d4a81ac2a6d3c721d6236f11eb300 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Pavol=20=C5=BD=C3=A1=C4=8Dik?= <zacik.pa@gmail.com>
 Date: Tue, 19 Aug 2025 14:26:07 +0200
 Subject: [PATCH 56/57] Add targets to skip build of non-installable programs
@ -60,10 +60,10 @@ index db6a1b1799..bc7fc36b46 100644
         @ ! Install the main program
         - CREATE/DIR ossl_installroot:[EXE.'arch']
 diff --git a/Configurations/unix-Makefile.tmpl b/Configurations/unix-Makefile.tmpl
-index 1920d38655..bfede44ce4 100644
+index dc5811f639..f905313d7d 100644
 --- a/Configurations/unix-Makefile.tmpl
 +++ b/Configurations/unix-Makefile.tmpl
-@@ -547,7 +547,9 @@ LANG=C
+@@ -548,7 +548,9 @@ LANG=C
 {- dependmagic('build_sw', 'Build all the software (default target)'); -}: build_libs_nodep build_modules_nodep build_programs_nodep link-utils
 {- dependmagic('build_libs', 'Build the libraries libssl and libcrypto'); -}: build_libs_nodep
 {- dependmagic('build_modules', 'Build the modules (i.e. providers and engines)'); -}: build_modules_nodep
@ -74,7 +74,7 @@ index 1920d38655..bfede44ce4 100644
 
 all: build_sw {- "build_docs" if !$disabled{docs}; -} ## Build software and documentation
 debuginfo: $(SHLIBS)
-@@ -566,6 +568,7 @@ build_generated: $(GENERATED_MANDATORY)
+@@ -567,6 +569,7 @@ build_generated: $(GENERATED_MANDATORY)
 build_libs_nodep: $(LIBS) {- join(" ",map { platform->sharedlib_simple($_) // platform->sharedlib_import($_) // platform->sharedlib($_) // () } @{$unified_info{libraries}}) -}
 build_modules_nodep: $(MODULES)
 build_programs_nodep: $(PROGRAMS) $(SCRIPTS)
@ -82,7 +82,7 @@ index 1920d38655..bfede44ce4 100644
 
 # Kept around for backward compatibility
 build_apps build_tests: build_programs
-@@ -680,7 +683,7 @@ uninstall_docs: uninstall_man_docs uninstall_html_docs ## Uninstall manpages and
+@@ -681,7 +684,7 @@ uninstall_docs: uninstall_man_docs uninstall_html_docs ## Uninstall manpages and
 	$(RM) -r "$(DESTDIR)$(DOCDIR)"
 
 {- output_off() if $disabled{fips}; "" -}
@ -91,7 +91,7 @@ index 1920d38655..bfede44ce4 100644
 	@[ -n "$(INSTALLTOP)" ] || (echo INSTALLTOP should not be empty; exit 1)
 	@$(PERL) $(SRCDIR)/util/mkdir-p.pl "$(DESTDIR)$(MODULESDIR)"
 	@$(PERL) $(SRCDIR)/util/mkdir-p.pl "$(DESTDIR)$(OPENSSLDIR)"
-@@ -966,7 +969,7 @@ install_runtime_libs: build_libs
+@@ -967,7 +970,7 @@ install_runtime_libs: build_libs
 		: {- output_on() if windowsdll(); "" -}; \
 	done
 
@ -101,10 +101,10 @@ index 1920d38655..bfede44ce4 100644
 	@$(PERL) $(SRCDIR)/util/mkdir-p.pl "$(DESTDIR)$(bindir)"
 	@$(ECHO) "*** Installing runtime programs"
 diff --git a/Configurations/windows-makefile.tmpl b/Configurations/windows-makefile.tmpl
-index 894834cfb7..b5872124de 100644
+index e553e8f9fe..f5ec2a726b 100644
 --- a/Configurations/windows-makefile.tmpl
 +++ b/Configurations/windows-makefile.tmpl
-@@ -418,6 +418,8 @@ PROCESSOR= {- $config{processor} -}
+@@ -419,6 +419,8 @@ PROCESSOR= {- $config{processor} -}
 {- dependmagic('build_libs'); -}: build_libs_nodep
 {- dependmagic('build_modules'); -}: build_modules_nodep
 {- dependmagic('build_programs'); -}: build_programs_nodep
@ -113,7 +113,7 @@ index 894834cfb7..b5872124de 100644
 
 build_docs: build_html_docs
 build_html_docs: $(HTMLDOCS1) $(HTMLDOCS3) $(HTMLDOCS5) $(HTMLDOCS7)
-@@ -430,6 +432,8 @@ build_modules_nodep: $(MODULES)
+@@ -431,6 +433,8 @@ build_modules_nodep: $(MODULES)
 	@
 build_programs_nodep: $(PROGRAMS) $(SCRIPTS)
 	@
@ -122,7 +122,7 @@ index 894834cfb7..b5872124de 100644
 
 # Kept around for backward compatibility
 build_apps build_tests: build_programs
-@@ -507,7 +511,7 @@ install_docs: install_html_docs
+@@ -508,7 +512,7 @@ install_docs: install_html_docs
 uninstall_docs: uninstall_html_docs
 
 {- output_off() if $disabled{fips}; "" -}
@ -131,7 +131,7 @@ index 894834cfb7..b5872124de 100644
 #	@[ -n "$(INSTALLTOP)" ] || (echo INSTALLTOP should not be empty; exit 1)
 	@"$(PERL)" "$(SRCDIR)\util\mkdir-p.pl" "$(MODULESDIR)"
 	@"$(PERL)" "$(SRCDIR)\util\mkdir-p.pl" "$(OPENSSLDIR)"
-@@ -607,7 +611,7 @@ install_runtime_libs: build_libs
+@@ -608,7 +612,7 @@ install_runtime_libs: build_libs
 	 "$(PERL)" "$(SRCDIR)\util\copy.pl" $(INSTALL_SHLIBPDBS) \
                                         "$(INSTALLTOP)\bin"
 
@ -154,5 +154,5 @@ index a1614fe8a9..e88ff4bae1 100755
     if (/^##@/) {
 	printf "\n\033[1m%s\033[0m\n", substr($Fld[$_], (5)-1);
 -- 
-2.52.0
+2.55.0

--- a/0057-Disable-RSA-PKCS1.5-FIPS-POST-not-relevant-for-RHEL.patch
+++ b/0057-Disable-RSA-PKCS1.5-FIPS-POST-not-relevant-for-RHEL.patch
@ -1,4 +1,4 @@
-From 3ffdc68f16d6b326ff0854053fc9206be3dabcc2 Mon Sep 17 00:00:00 2001
+From 9c744fee11aee9290b471b671f1205331928bc33 Mon Sep 17 00:00:00 2001
 From: Dmitry Belyavskiy <beldmit@gmail.com>
 Date: Wed, 21 Jan 2026 18:13:43 +0100
 Subject: [PATCH 57/57] Disable RSA-PKCS1.5 FIPS POST, not relevant for RHEL
@ -8,10 +8,10 @@ Subject: [PATCH 57/57] Disable RSA-PKCS1.5 FIPS POST, not relevant for RHEL
 1 file changed, 2 insertions(+), 2 deletions(-)

 diff --git a/providers/fips/self_test_kats.c b/providers/fips/self_test_kats.c
-index f453b2f2fb..5b37387d83 100644
+index 0559a30cd6..496c5eaa39 100644
 --- a/providers/fips/self_test_kats.c
 +++ b/providers/fips/self_test_kats.c
-@@ -1190,8 +1190,8 @@ int SELF_TEST_kats(OSSL_SELF_TEST *st, OSSL_LIB_CTX *libctx)
+@@ -1197,8 +1197,8 @@ int SELF_TEST_kats(OSSL_SELF_TEST *st, OSSL_LIB_CTX *libctx)
         ret = 0;
     if (!self_test_kems(st, libctx))
         ret = 0;
@ -23,5 +23,5 @@ index f453b2f2fb..5b37387d83 100644
     RAND_set0_private(libctx, saved_rand);
     return ret;
 -- 
-2.52.0
+2.55.0

--- a/0058-asn1_d2i_read_bio_EOF.patch
+++ b/0058-asn1_d2i_read_bio_EOF.patch
@ -1,304 +0,0 @@
-From 836406633204bccb6d7a8718e15de8c3c2213a8e Mon Sep 17 00:00:00 2001
-From: icanhasmath <marcg@activestate.com>
-Date: Tue, 30 Jun 2026 16:55:40 -0500
-Subject: [PATCH 1/2] Don't raise NOT_ENOUGH_DATA on a clean EOF at an object
- boundary
-
-asn1_d2i_read_bio() reads one ASN.1 object at a time from a BIO.  Callers
-commonly loop, decoding concatenated DER values until the call fails, and
-rely on a failure with no queued error to recognise a clean end of input.
-CPython's ssl module does this in _add_ca_certs() when loading the Windows
-certificate store via SSLContext.load_verify_locations(cadata=...); it
-re-raises any leftover ASN.1 error other than ASN1_R_HEADER_TOO_LONG as
-fatal.
-
-Commit 9eb6922c59 ("asn1: raise NOT_ENOUGH_DATA on header EOF") changed the
-BIO_read() check from "i < 0" to "i <= 0", so a clean EOF (BIO_read()
-returning 0, as an exhausted BIO_new_mem_buf does) on an object boundary now
-raises ASN1_R_NOT_ENOUGH_DATA instead of failing with an empty error queue.
-The rewrite in commit 35852da1d9 carried this behaviour forward.  As a
-result Python 3 on Windows fails to initialise an SSLContext with:
-
-    ssl.SSLError: [ASN1: NOT_ENOUGH_DATA] not enough data
-
-Raise ASN1_R_NOT_ENOUGH_DATA only on an actual read error, or when EOF is
-reached in the middle of an object (diff != 0), which is genuine truncation.
-A clean EOF on an object boundary again fails without queuing an error,
-restoring the long-standing behaviour that looping callers depend on.
-
-Add regression tests for both the clean-EOF and truncated cases, and a
-CHANGES.md entry.
-
-Fixes #31807
-
-Assisted-by: Claude:claude-opus-4-8
---
- crypto/asn1/a_d2i_fp.c  |  15 ++++-
- test/asn1_decode_test.c | 130 ++++++++++++++++++++++++++++++++++++++++
- 2 files changed, 144 insertions(+), 1 deletion(-)
-
-diff --git a/crypto/asn1/a_d2i_fp.c b/crypto/asn1/a_d2i_fp.c
-index a23dea8ebd..19595683ef 100644
--- a/crypto/asn1/a_d2i_fp.c
-+++ b/crypto/asn1/a_d2i_fp.c
-@@ -139,7 +139,20 @@ int asn1_d2i_read_bio(BIO *in, BUF_MEM **pb)
-             }
-             i = BIO_read(in, &(b->data[len]), want);
-             if (i <= 0) {
-                ERR_raise(ERR_LIB_ASN1, ASN1_R_NOT_ENOUGH_DATA);
-+                /*
-+                 * A read error (i < 0), an EOF in the middle of an object
-+                 * (diff != 0, some bytes already buffered), or an EOF while
-+                 * still inside an indefinite-length constructed value awaiting
-+                 * its end-of-contents octets (eos != 0) all mean the input is
-+                 * truncated.  Only a clean EOF at a top-level object boundary
-+                 * (i == 0, diff == 0, eos == 0) is the normal end of input:
-+                 * fail without queuing an error so that callers looping over
-+                 * concatenated DER values (e.g. the libcrypto d2i_*_bio()
-+                 * consumers in CPython's ssl module) terminate cleanly instead
-+                 * of seeing a spurious ASN1_R_NOT_ENOUGH_DATA.
-+                 */
-+                if (i < 0 || diff != 0 || eos != 0)
-+                    ERR_raise(ERR_LIB_ASN1, ASN1_R_NOT_ENOUGH_DATA);
-                 goto err;
-             }
-             if (i > 0) {
-diff --git a/test/asn1_decode_test.c b/test/asn1_decode_test.c
-index 6e00d40896..ec20d6ebbc 100644
--- a/test/asn1_decode_test.c
-+++ b/test/asn1_decode_test.c
-@@ -14,7 +14,11 @@
- #include <openssl/asn1.h>
- #include <openssl/asn1t.h>
- #include <openssl/obj_mac.h>
-+#include <openssl/bio.h>
-+#include <openssl/buffer.h>
-+#include <openssl/err.h>
- #include "internal/numbers.h"
-+#include "internal/asn1.h"
- #include "testutil.h"
- 
- #ifdef __GNUC__
-@@ -266,6 +270,129 @@ err:
-     return ret;
- }
- 
-+/*
-+ * A minimal, complete DER object: SEQUENCE { INTEGER 0 }.
-+ * asn1_d2i_read_bio() should consume exactly these bytes.
-+ */
-+static const unsigned char one_obj[] = {
-+    0x30, 0x03, /* SEQUENCE, length 3 */
-+    0x02, 0x01, 0x00 /*   INTEGER 0        */
-+};
-+
-+/*
-+ * Reading concatenated DER objects from a BIO must stop cleanly at EOF:
-+ * once the input is exhausted on an object boundary, asn1_d2i_read_bio()
-+ * returns < 0 and must NOT leave an error on the queue.  Callers that loop
-+ * over concatenated values (e.g. CPython's ssl module loading the Windows
-+ * certificate store via d2i_X509_bio()) rely on this to detect end-of-input;
-+ * a spurious ASN1_R_NOT_ENOUGH_DATA there is reported as a fatal error.
-+ */
-+static int test_d2i_read_bio_clean_eof(void)
-+{
-+    unsigned char two_objs[sizeof(one_obj) * 2];
-+    BIO *bio = NULL;
-+    BUF_MEM *buf = NULL;
-+    int ret = 0;
-+
-+    memcpy(two_objs, one_obj, sizeof(one_obj));
-+    memcpy(two_objs + sizeof(one_obj), one_obj, sizeof(one_obj));
-+
-+    if (!TEST_ptr(bio = BIO_new_mem_buf(two_objs, sizeof(two_objs))))
-+        goto err;
-+    ERR_clear_error();
-+
-+    /* Both complete objects are read, one per call. */
-+    if (!TEST_int_eq(asn1_d2i_read_bio(bio, &buf), (int)sizeof(one_obj)))
-+        goto err;
-+    BUF_MEM_free(buf);
-+    buf = NULL;
-+    if (!TEST_int_eq(asn1_d2i_read_bio(bio, &buf), (int)sizeof(one_obj)))
-+        goto err;
-+    BUF_MEM_free(buf);
-+    buf = NULL;
-+
-+    /* Clean EOF: failure return, but no error must be queued. */
-+    if (!TEST_int_lt(asn1_d2i_read_bio(bio, &buf), 0))
-+        goto err;
-+    if (!TEST_ulong_eq(ERR_peek_error(), 0))
-+        goto err;
-+
-+    ret = 1;
-+err:
-+    BUF_MEM_free(buf);
-+    BIO_free(bio);
-+    return ret;
-+}
-+
-+/*
-+ * In contrast, hitting EOF in the middle of an object is genuine truncation
-+ * and must still be reported as ASN1_R_NOT_ENOUGH_DATA.
-+ */
-+static int test_d2i_read_bio_truncated(void)
-+{
-+    static const unsigned char truncated[] = {
-+        0x30, 0x05, /* SEQUENCE claims 5 content bytes ... */
-+        0x02, 0x01 /* ... but only 2 are present         */
-+    };
-+    BIO *bio = NULL;
-+    BUF_MEM *buf = NULL;
-+    unsigned long e;
-+    int ret = 0;
-+
-+    if (!TEST_ptr(bio = BIO_new_mem_buf(truncated, sizeof(truncated))))
-+        goto err;
-+    ERR_clear_error();
-+
-+    if (!TEST_int_lt(asn1_d2i_read_bio(bio, &buf), 0))
-+        goto err;
-+    e = ERR_peek_last_error();
-+    if (!TEST_int_eq(ERR_GET_LIB(e), ERR_LIB_ASN1)
-+        || !TEST_int_eq(ERR_GET_REASON(e), ASN1_R_NOT_ENOUGH_DATA))
-+        goto err;
-+
-+    ret = 1;
-+err:
-+    BUF_MEM_free(buf);
-+    BIO_free(bio);
-+    return ret;
-+}
-+
-+/*
-+ * An EOF reached while still inside an indefinite-length constructed value,
-+ * before its end-of-contents octets, is truncation too (not a clean boundary),
-+ * so it must also report ASN1_R_NOT_ENOUGH_DATA rather than an empty queue.
-+ */
-+static int test_d2i_read_bio_indefinite_truncated(void)
-+{
-+    /* SEQUENCE (indefinite) { INTEGER 0 } with the 00 00 EOC missing */
-+    static const unsigned char truncated_indefinite[] = {
-+        0x30, 0x80, /* SEQUENCE, indefinite length */
-+        0x02, 0x01, 0x00 /* INTEGER 0; no end-of-contents octets follow */
-+    };
-+    BIO *bio = NULL;
-+    BUF_MEM *buf = NULL;
-+    unsigned long e;
-+    int ret = 0;
-+
-+    if (!TEST_ptr(bio = BIO_new_mem_buf(truncated_indefinite,
-+                                        sizeof(truncated_indefinite))))
-+        goto err;
-+    ERR_clear_error();
-+
-+    if (!TEST_int_lt(asn1_d2i_read_bio(bio, &buf), 0))
-+        goto err;
-+    e = ERR_peek_last_error();
-+    if (!TEST_int_eq(ERR_GET_LIB(e), ERR_LIB_ASN1)
-+        || !TEST_int_eq(ERR_GET_REASON(e), ASN1_R_NOT_ENOUGH_DATA))
-+        goto err;
-+
-+    ret = 1;
-+err:
-+    BUF_MEM_free(buf);
-+    BIO_free(bio);
-+    return ret;
-+}
-+
- int setup_tests(void)
- {
- #ifndef OPENSSL_NO_DEPRECATED_3_0
-@@ -279,5 +406,8 @@ int setup_tests(void)
-     ADD_TEST(test_utctime);
-     ADD_TEST(test_invalid_template);
-     ADD_TEST(test_reuse_asn1_object);
-+    ADD_TEST(test_d2i_read_bio_clean_eof);
-+    ADD_TEST(test_d2i_read_bio_truncated);
-+    ADD_TEST(test_d2i_read_bio_indefinite_truncated);
-     return 1;
- }
-- 
-2.54.0
-
-
-From a7272fcb339ec8e11578a23fcd667167b6dbab49 Mon Sep 17 00:00:00 2001
-From: icanhasmath <marcg@activestate.com>
-Date: Fri, 3 Jul 2026 09:32:10 -0500
-Subject: [PATCH 2/2] test: cover the partial-header EOF case in
- asn1_d2i_read_bio
-
-The existing asn1_d2i_read_bio tests cover a clean EOF at an object
-boundary, an EOF in the middle of an object body, and an EOF inside an
-unterminated indefinite-length value.  None exercised an EOF reached
-part-way through an object header, with header bytes already buffered,
-which is the "diff != 0" arm of the header-read truncation check.
-
-Add test_d2i_read_bio_partial_header feeding a SEQUENCE whose 2-byte
-long-form length is truncated after the first byte, and assert it reports
-ASN1_R_NOT_ENOUGH_DATA.
-
-Assisted-by: Claude:claude-opus-4-8
---
- test/asn1_decode_test.c | 39 +++++++++++++++++++++++++++++++++++++--
- 1 file changed, 37 insertions(+), 2 deletions(-)
-
-diff --git a/test/asn1_decode_test.c b/test/asn1_decode_test.c
-index ec20d6ebbc..8a9629c21d 100644
--- a/test/asn1_decode_test.c
-+++ b/test/asn1_decode_test.c
-@@ -374,8 +374,42 @@ static int test_d2i_read_bio_indefinite_truncated(void)
-     unsigned long e;
-     int ret = 0;
- 
-    if (!TEST_ptr(bio = BIO_new_mem_buf(truncated_indefinite,
-                                        sizeof(truncated_indefinite))))
-+    bio = BIO_new_mem_buf(truncated_indefinite, sizeof(truncated_indefinite));
-+    if (!TEST_ptr(bio))
-+        goto err;
-+    ERR_clear_error();
-+
-+    if (!TEST_int_lt(asn1_d2i_read_bio(bio, &buf), 0))
-+        goto err;
-+    e = ERR_peek_last_error();
-+    if (!TEST_int_eq(ERR_GET_LIB(e), ERR_LIB_ASN1)
-+        || !TEST_int_eq(ERR_GET_REASON(e), ASN1_R_NOT_ENOUGH_DATA))
-+        goto err;
-+
-+    ret = 1;
-+err:
-+    BUF_MEM_free(buf);
-+    BIO_free(bio);
-+    return ret;
-+}
-+
-+/*
-+ * An EOF reached part-way through an object's header, with some header bytes
-+ * already buffered, is truncation as well.  This exercises the "diff != 0" arm
-+ * of the header-read check (distinct from the body read handled elsewhere).
-+ */
-+static int test_d2i_read_bio_partial_header(void)
-+{
-+    /* SEQUENCE with a 2-byte long-form length, but only one length byte given */
-+    static const unsigned char partial_header[] = {
-+        0x30, 0x82, 0x01 /* SEQUENCE, length declared as 2 bytes, 1 present */
-+    };
-+    BIO *bio = NULL;
-+    BUF_MEM *buf = NULL;
-+    unsigned long e;
-+    int ret = 0;
-+
-+    if (!TEST_ptr(bio = BIO_new_mem_buf(partial_header, sizeof(partial_header))))
-         goto err;
-     ERR_clear_error();
- 
-@@ -409,5 +443,6 @@ int setup_tests(void)
-     ADD_TEST(test_d2i_read_bio_clean_eof);
-     ADD_TEST(test_d2i_read_bio_truncated);
-     ADD_TEST(test_d2i_read_bio_indefinite_truncated);
-+    ADD_TEST(test_d2i_read_bio_partial_header);
-     return 1;
- }
-- 
-2.54.0
-
--- a/0100-RHEL9-Allow-SHA1-in-seclevel-2-if-rh-allow-sha1-signatures.patch
+++ b/0100-RHEL9-Allow-SHA1-in-seclevel-2-if-rh-allow-sha1-signatures.patch
@ -120,41 +120,6 @@ index 4b74ee1a34..5f089de107 100644
     /* Finally see if security callback allows it */
     secbits = sigalg_security_bits(SSL_CONNECTION_GET_CTX(s), lu);
     sigalgstr[0] = (lu->sigalg >> 8) & 0xff;
-@@ -2977,6 +2994,8 @@ static int ssl_security_cert_sig(SSL *s, SSL_CTX *ctx, X509 *x, int op)
- {
-     /* Lookup signature algorithm digest */
-     int secbits, nid, pknid;
-+    OSSL_LIB_CTX *libctx = NULL;
-+
- 
-     /* Don't check signature if self signed */
-     if ((X509_get_extension_flags(x) & EXFLAG_SS) != 0)
-@@ -2985,6 +3004,25 @@ static int ssl_security_cert_sig(SSL *s, SSL_CTX *ctx, X509 *x, int op)
-     /* If digest NID not defined use signature NID */
-     if (nid == NID_undef)
-         nid = pknid;
-+
-+    if (x && x->libctx)
-+        libctx = x->libctx;
-+    else if (ctx && ctx->libctx)
-+        libctx = ctx->libctx;
-+    else if (s && s->session_ctx && s->session_ctx->libctx)
-+        libctx = s->session_ctx->libctx;
-+    else
-+        libctx = OSSL_LIB_CTX_get0_global_default();
-+
-+    if (nid == NID_sha1
-+            && ossl_ctx_legacy_digest_signatures_allowed(libctx, 0)
-+            && ((s != NULL && SSL_get_security_level(SSL_CONNECTION_GET_SSL(s)) < 3)
-+                || (ctx != NULL && SSL_CTX_get_security_level(ctx) < 3)
-+            ))
-+        /* When rh-allow-sha1-signatures = yes and security level <= 2,
-+         * explicitly allow SHA1 for backwards compatibility. */
-+        return 1;
-+
-     if (s != NULL)
-         return ssl_security(s, op, secbits, nid, x);
-     else
 diff --git a/test/recipes/25-test_verify.t b/test/recipes/25-test_verify.t
 index ab8cdff..84421cc 100644
 --- a/test/recipes/25-test_verify.t
@ -163,8 +128,8 @@ index ab8cdff..84421cc 100644
     run(app([@args]));
 }
 
-plan tests => 204;
-+plan tests => 203;
+-plan tests => 206;
+plan tests => 205;
 
 # Canonical success
 ok(verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert"]),
--- a/openssl.spec
+++ b/openssl.spec
@ -28,8 +28,8 @@ print(string.sub(hash, 0, 16))

 Summary: Utilities from the general purpose cryptography library with TLS implementation
 Name: openssl
-Version: 3.5.7
-Release: 3%{?dist}
+Version: 3.5.8
+Release: 1%{?dist}
 Epoch: 1
 Source0: openssl-%{version}.tar.gz
 Source1: fips-hmacify.sh
@ -98,7 +98,6 @@ Patch0054: 0054-Temporarily-disable-SLH-DSA-FIPS-self-tests.patch
 Patch0055: 0055-Add-a-define-to-disable-symver-attributes.patch
 Patch0056: 0056-Add-targets-to-skip-build-of-non-installable-program.patch
 Patch0057: 0057-Disable-RSA-PKCS1.5-FIPS-POST-not-relevant-for-RHEL.patch
-Patch0058: 0058-asn1_d2i_read_bio_EOF.patch

 #The patches that are different for RHEL9 and 10 start here
 Patch0100: 0100-RHEL9-Allow-SHA1-in-seclevel-2-if-rh-allow-sha1-signatures.patch
@ -457,6 +456,18 @@ ln -s /etc/crypto-policies/back-ends/openssl_fips.config $RPM_BUILD_ROOT%{_sysco
 %ldconfig_scriptlets libs

 %changelog
+* Tue Aug 25 2026 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.5.8-1
+- Rebase to OpenSSL 3.5.8
+  Resolves: RHEL-242942
+  Resolves: RHEL-246259
+  Resolves: RHEL-246288
+  Resolves: RHEL-246320
+  Resolves: RHEL-246440
+  Resolves: RHEL-246444
+  Resolves: RHEL-246448
+  Resolves: RHEL-246452
+  Resolves: RHEL-246456
+
 * Thu Aug 13 2026 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.5.7-3
 - In FIPS mode when neither FIPS provider nor FIPS provider configuration is
  present, OpenSSL silently falls back to the default provider.
--- a/2
+++ b/2
@ -1 +1 @@
-SHA512 (openssl-3.5.7.tar.gz) = de5351d2d532e1a3908a738f7d8aae448d32bc60bdb24808c556a24bc37a3f53daedf12b5d432eeb8c235e16939d842f908332ede8a447ca103ad1c493c820d7
+SHA512 (openssl-3.5.8.tar.gz) = 62a1dbed0fad75245b332e41b85a1f7c2379189525e7628a7cf68947d115e90a47f179e3f87d27641e5b2d357c357292179fc0e64eccecdebc81c083f7a8ebe4