From d92cda3629bea1d928c492d6eafb870ec0709d6b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Matthias=20A=C3=9Fhauer?= Date: Tue, 7 Apr 2026 16:31:30 +0000 Subject: [PATCH 1/4] mingw-w64-openssl: update to 3.5.6 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Matthias Aßhauer --- mingw-w64-openssl/PKGBUILD | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/mingw-w64-openssl/PKGBUILD b/mingw-w64-openssl/PKGBUILD index 3ccd76d025799..f78f76a06a034 100644 --- a/mingw-w64-openssl/PKGBUILD +++ b/mingw-w64-openssl/PKGBUILD @@ -4,7 +4,7 @@ _realname=openssl pkgbase=mingw-w64-${_realname} pkgname=("${MINGW_PACKAGE_PREFIX}-${_realname}" "${MINGW_PACKAGE_PREFIX}-${_realname}-pdb") -pkgver=3.5.5 +pkgver=3.5.6 pkgrel=1 pkgdesc="The Open Source toolkit for Secure Sockets Layer and Transport Layer Security (mingw-w64)" arch=('any') @@ -29,7 +29,7 @@ source=("https://github.com/openssl/openssl/releases/download/openssl-${pkgver}/ '0008-Define-SIO_UDP_NETRESET-if-necessary.patch' 'pathtools.c' 'pathtools.h') -sha256sums=('b28c91532a8b65a1f983b4c28b7488174e4a01008e29ce8e69bd789f28bc2a89' +sha256sums=('deae7c80cba99c4b4f940ecadb3c3338b13cb77418409238e57d7f31f2a3b736' 'SKIP' 'baaaab0e91caf5690d4a264146cff2030bb5852ad14712d7f89e7e072533ae11' 'a45ab8e18db920e8c559d80598664cfb52d2f4e09653f4caaa0f4de0055982cf' From 28ed767b38d607bc69efa1baf609e06fd8d310f2 Mon Sep 17 00:00:00 2001 From: Johannes Schindelin Date: Tue, 14 Apr 2026 13:42:19 +0200 Subject: [PATCH 2/4] openssl: also treat Cygwin Perl like MSYS Perl in test guards Git for Windows recently stopped building its own Perl and switched to the MSYS2-provided one. That Perl reports $^O as 'cygwin' rather than 'msys', which means OpenSSL's test skip guards that check for 'msys' no longer fire. Tests that open listening sockets (notably 82-test_ocsp_cert_chain.t and 90-test_store.t) then hang indefinitely because Windows Defender's firewall prompts for permission to allow the connection, which blocks in CI where nobody can click "Allow". The fix has two parts. For guards that were introduced by our own carried patches (0005-Fix-Text-comparison, 0006-Mangle-Absolute-path, 0007-Fix-OS-detection), the patches themselves are updated to match 'cygwin' alongside 'msys' from the start. For guards that exist in upstream OpenSSL (in 02-test_errstr.t, 25-test_eai_data.t, 25-test_x509.t, 80-test_cmp_http.t, 82-test_ocsp_cert_chain.t, 82-test_tfo_cli.t, and 90-test_store.t), a new patch 0009-Also-treat-Cygwin-Perl-like-MSYS-Perl-in-test-skip-g.patch is added. MSYS2 upstream does not carry this patch because they have not encountered the firewall hang in their CI, but it is a safety measure that costs nothing and prevents real hangs on Windows build agents where Defender is active. The patches were produced from the playground repository at mingw-w64-openssl/src/playground, which can be recreated as follows: git init playground && cd playground /usr/src/git/contrib/fast-import/import-tars.perl \ ../openssl-3.5.6.tar.gz git checkout import-tars git am ../../000[1-9]-*.patch git fast-export --no-data HEAD | \ awk '/^author /{a=$0} /^committer /{$0="committer " substr(a,8)} 1' | \ git fast-import --force --quiet The fast-export/fast-import awk trick forces committer identity and timestamp to match the author on every commit, including the import commit created by import-tars.perl (which otherwise uses the identity of whoever runs the script). This makes the resulting OIDs fully reproducible, so `git format-patch --no-signature -o ../.. -9 HEAD` always exports identical patches. Assisted-by: Claude Opus 4.6 Signed-off-by: Johannes Schindelin --- mingw-w64-openssl/0001-support-aarch64.patch | 8 +- mingw-w64-openssl/0002-relocation.patch | 20 +-- .../0003-test_rand-use-the-better-chomp.patch | 4 +- .../0004-mingw32-broken-test.patch | 6 +- .../0005-Fix-Text-comparison.patch | 14 +- .../0006-Mangle-Absolute-path.patch | 14 +- mingw-w64-openssl/0007-Fix-OS-detection.patch | 28 +-- ...Define-SIO_UDP_NETRESET-if-necessary.patch | 9 +- ...n-Perl-like-MSYS-Perl-in-test-skip-g.patch | 160 ++++++++++++++++++ mingw-w64-openssl/PKGBUILD | 21 ++- 10 files changed, 228 insertions(+), 56 deletions(-) create mode 100644 mingw-w64-openssl/0009-Also-treat-Cygwin-Perl-like-MSYS-Perl-in-test-skip-g.patch diff --git a/mingw-w64-openssl/0001-support-aarch64.patch b/mingw-w64-openssl/0001-support-aarch64.patch index 7a4de4c22ae5e..40be1bc7cf59b 100644 --- a/mingw-w64-openssl/0001-support-aarch64.patch +++ b/mingw-w64-openssl/0001-support-aarch64.patch @@ -1,8 +1,8 @@ -From b3431910bb8956041d8edd15cd0a3afa0a149efd Mon Sep 17 00:00:00 2001 +From b3a145a437302ebc822c81695f4b9a4d6c47de2c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=D9=85=D9=87=D8=AF=D9=8A=20=D8=B4=D9=8A=D9=86=D9=88=D9=86?= =?UTF-8?q?=20=28Mehdi=20Chinoune=29?= Date: Sat, 7 Jan 2023 08:19:23 +0100 -Subject: [PATCH 1/7] support-aarch64 +Subject: [PATCH 1/9] support-aarch64 openssl: update to 3.0.7 --- @@ -10,10 +10,10 @@ openssl: update to 3.0.7 1 file changed, 12 insertions(+) diff --git a/Configurations/10-main.conf b/Configurations/10-main.conf -index cba57b4..dd8dd5e 100644 +index 692eccb..c27dcae 100644 --- a/Configurations/10-main.conf +++ b/Configurations/10-main.conf -@@ -1746,6 +1746,18 @@ my %targets = ( +@@ -1747,6 +1747,18 @@ my %targets = ( multilib => "64", }, diff --git a/mingw-w64-openssl/0002-relocation.patch b/mingw-w64-openssl/0002-relocation.patch index 1f39e351aafd8..812fa2bdc9405 100644 --- a/mingw-w64-openssl/0002-relocation.patch +++ b/mingw-w64-openssl/0002-relocation.patch @@ -1,8 +1,8 @@ -From 993b0cec8ad81b84a42236b007f1bca623db1520 Mon Sep 17 00:00:00 2001 +From e64549f98276b31ab4a6c45d0b837b8cc22b8bfc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=D9=85=D9=87=D8=AF=D9=8A=20=D8=B4=D9=8A=D9=86=D9=88=D9=86?= =?UTF-8?q?=20=28Mehdi=20Chinoune=29?= Date: Sat, 7 Jan 2023 08:19:23 +0100 -Subject: [PATCH 2/7] relocation +Subject: [PATCH 2/9] relocation openssl: update to 3.0.7 --- @@ -26,7 +26,7 @@ index aee5c46..9a97547 100644 SOURCE[../libcrypto]=$UPLINKSRC diff --git a/crypto/engine/eng_list.c b/crypto/engine/eng_list.c -index 0f24f2f..a9b2206 100644 +index 917fa84..8d8e3cf 100644 --- a/crypto/engine/eng_list.c +++ b/crypto/engine/eng_list.c @@ -12,6 +12,7 @@ @@ -51,10 +51,10 @@ index 0f24f2f..a9b2206 100644 + load_dir = reloc; + } iterator = ENGINE_by_id("dynamic"); - if (!iterator || !ENGINE_ctrl_cmd_string(iterator, "ID", id, 0) || - !ENGINE_ctrl_cmd_string(iterator, "DIR_LOAD", "2", 0) || + if (!iterator || !ENGINE_ctrl_cmd_string(iterator, "ID", id, 0) || !ENGINE_ctrl_cmd_string(iterator, "DIR_LOAD", "2", 0) || !ENGINE_ctrl_cmd_string(iterator, "DIR_ADD", load_dir, 0) || !ENGINE_ctrl_cmd_string(iterator, "LIST_ADD", "1", 0) || !ENGINE_ctrl_cmd_string(iterator, "LOAD", NULL, 0)) + goto notfound; diff --git a/crypto/provider_core.c b/crypto/provider_core.c -index c71c1e7..19c3dbb 100644 +index 507be35..0f8da50 100644 --- a/crypto/provider_core.c +++ b/crypto/provider_core.c @@ -30,6 +30,7 @@ @@ -63,9 +63,9 @@ index c71c1e7..19c3dbb 100644 #include "crypto/context.h" +#include "pathtools.h" #ifndef FIPS_MODULE - # include - # include -@@ -991,8 +992,13 @@ static int provider_init(OSSL_PROVIDER *prov) + #include + #include +@@ -997,8 +998,13 @@ static int provider_init(OSSL_PROVIDER *prov) if (load_dir == NULL) { load_dir = ossl_safe_getenv("OPENSSL_MODULES"); @@ -82,7 +82,7 @@ index c71c1e7..19c3dbb 100644 DSO_ctrl(prov->module, DSO_CTRL_SET_FLAGS, diff --git a/crypto/x509/x509_def.c b/crypto/x509/x509_def.c -index 7d5b642..7f0a1d1 100644 +index 5a6ecaf..447a45a 100644 --- a/crypto/x509/x509_def.c +++ b/crypto/x509/x509_def.c @@ -10,6 +10,7 @@ diff --git a/mingw-w64-openssl/0003-test_rand-use-the-better-chomp.patch b/mingw-w64-openssl/0003-test_rand-use-the-better-chomp.patch index 0bb304c1579e7..eacbd753e4f0c 100644 --- a/mingw-w64-openssl/0003-test_rand-use-the-better-chomp.patch +++ b/mingw-w64-openssl/0003-test_rand-use-the-better-chomp.patch @@ -1,7 +1,7 @@ -From fbb81a899dabd443737e726fde930906fce5f846 Mon Sep 17 00:00:00 2001 +From 0eda9fae1ece0f89b08cbcfcf55fe0099711cf49 Mon Sep 17 00:00:00 2001 From: Johannes Schindelin Date: Wed, 25 Oct 2023 17:10:17 +0200 -Subject: [PATCH 3/7] test_rand: use the "better chomp" +Subject: [PATCH 3/9] test_rand: use the "better chomp" Following in the footsteps of https://github.com/openssl/openssl/commit/9ba96fbb2523cb12747c559c704c58bd8f9e7982 diff --git a/mingw-w64-openssl/0004-mingw32-broken-test.patch b/mingw-w64-openssl/0004-mingw32-broken-test.patch index aa37550a94bee..86b926c2a6dde 100644 --- a/mingw-w64-openssl/0004-mingw32-broken-test.patch +++ b/mingw-w64-openssl/0004-mingw32-broken-test.patch @@ -1,14 +1,14 @@ -From c4e21984736e7837d0aa160f2007cc92c1d3710e Mon Sep 17 00:00:00 2001 +From d21e01aa7fa2981c3897fe8e170d03c66b3a2c1d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Matthias=20A=C3=9Fhauer?= Date: Fri, 24 Nov 2023 06:47:04 +0000 -Subject: [PATCH 4/7] mingw32-broken-test +Subject: [PATCH 4/9] mingw32-broken-test --- test/asn1_time_test.c | 7 ------- 1 file changed, 7 deletions(-) diff --git a/test/asn1_time_test.c b/test/asn1_time_test.c -index 32bc4ff..4d1fdbe 100644 +index 6e18cd0..450f470 100644 --- a/test/asn1_time_test.c +++ b/test/asn1_time_test.c @@ -68,13 +68,6 @@ static const struct TESTDATA_asn1_to_utc asn1_to_utc[] = { diff --git a/mingw-w64-openssl/0005-Fix-Text-comparison.patch b/mingw-w64-openssl/0005-Fix-Text-comparison.patch index 651729b26e0a5..e5dcbe17d0c66 100644 --- a/mingw-w64-openssl/0005-Fix-Text-comparison.patch +++ b/mingw-w64-openssl/0005-Fix-Text-comparison.patch @@ -1,7 +1,7 @@ -From f208d3920935f0efeac542391305e5baffe47687 Mon Sep 17 00:00:00 2001 +From 2313d1d189ac8d0107778b69fd7d93093bc8546c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Matthias=20A=C3=9Fhauer?= Date: Tue, 16 Sep 2025 15:23:00 +0200 -Subject: [PATCH 5/7] Fix Text comparison +Subject: [PATCH 5/9] Fix Text comparison 0615d3a (Use text compare for PEM and text files, 2025-03-19) introduced perls compare_text into the tests, but didn't account for a scenario like our @@ -9,6 +9,10 @@ MINGW-Packages where openssl uses CRLF as an EOL, but the perl running the tests expects just LF. Teach the affected tests to compare while accounting for differences in EOLs. + +Since Git for Windows recently stopped building its own Perl and now uses +the MSYS2-provided one, $^O reports 'cygwin' rather than 'msys'. Account +for both values so the CRLF normalization fires in either case. --- test/recipes/15-test_dsaparam.t | 3 +-- test/recipes/15-test_ml_kem_codecs.t | 2 +- @@ -48,7 +52,7 @@ index bebb8b8..71292f1 100644 use OpenSSL::Glob; use OpenSSL::Test qw/:DEFAULT data_file srctop_file bldtop_dir/; diff --git a/test/recipes/15-test_pkey.t b/test/recipes/15-test_pkey.t -index 70bb083..e01ccd6 100644 +index 1f23795..6dd7b09 100644 --- a/test/recipes/15-test_pkey.t +++ b/test/recipes/15-test_pkey.t @@ -11,8 +11,8 @@ use warnings; @@ -87,7 +91,7 @@ index 50cb01a..6d40cfd 100644 setup("test_pkcs8"); diff --git a/util/perl/OpenSSL/Test/Utils.pm b/util/perl/OpenSSL/Test/Utils.pm -index 34eafc4..daeb155 100644 +index 34eafc4..7a70d53 100644 --- a/util/perl/OpenSSL/Test/Utils.pm +++ b/util/perl/OpenSSL/Test/Utils.pm @@ -11,11 +11,12 @@ use strict; @@ -108,7 +112,7 @@ index 34eafc4..daeb155 100644 return $have_IPv6; } -+if ($^O eq 'msys') { ++if ($^O eq 'msys' || $^O eq 'cygwin') { + no warnings 'redefine'; + sub compare_text { + return File::Compare::compare_text($_[0], $_[1], sub {$_[0]=~ s/\r\n/\n/;$_[1]=~ s/\r\n/\n/; $_[0] ne $_[1]}); diff --git a/mingw-w64-openssl/0006-Mangle-Absolute-path.patch b/mingw-w64-openssl/0006-Mangle-Absolute-path.patch index e6a28dd54186f..09471d4b826bd 100644 --- a/mingw-w64-openssl/0006-Mangle-Absolute-path.patch +++ b/mingw-w64-openssl/0006-Mangle-Absolute-path.patch @@ -1,26 +1,30 @@ -From 2c09395d987f18c333b15b3a33f4f412a3aac7ff Mon Sep 17 00:00:00 2001 +From de78b43696852c8e403d40527e3478209545463f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Matthias=20A=C3=9Fhauer?= Date: Wed, 17 Sep 2025 10:53:00 +0200 -Subject: [PATCH 6/7] Mangle Absolute path +Subject: [PATCH 6/9] Mangle Absolute path Test 25-test_verify.t tries to test some file:// URLs containing an absolute path, but perls abs_path() creates MSYS2 absolute paths in our case, which our native openssl doesn't understand. Run the path through cygpath to convert it into the expected format. + +Since Git for Windows recently stopped building its own Perl and now uses +the MSYS2-provided one, $^O reports 'cygwin' rather than 'msys'. Account +for both values so the cygpath conversion fires in either case. --- test/recipes/25-test_verify.t | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/test/recipes/25-test_verify.t b/test/recipes/25-test_verify.t -index 673c3d5..786a302 100644 +index ab8cdff..b7a6029 100644 --- a/test/recipes/25-test_verify.t +++ b/test/recipes/25-test_verify.t -@@ -614,6 +614,10 @@ my $foo_file = "cert.pem"; +@@ -626,6 +626,10 @@ my $foo_file = "cert.pem"; copy($rootcert, $foo_file); ok(vfy_root("-CAstore", $foo_file), "CAstore foo:file"); my $abs_cert = abs_path($rootcert); -+if ($^O eq "msys") { ++if ($^O eq "msys" || $^O eq "cygwin") { + $abs_cert = `cygpath -m $abs_cert`; + chomp $abs_cert; +} diff --git a/mingw-w64-openssl/0007-Fix-OS-detection.patch b/mingw-w64-openssl/0007-Fix-OS-detection.patch index 947c5230e38cc..88cb3865b0248 100644 --- a/mingw-w64-openssl/0007-Fix-OS-detection.patch +++ b/mingw-w64-openssl/0007-Fix-OS-detection.patch @@ -1,12 +1,16 @@ -From f4413c73dc50a0b249bc7ca629dbf5906e7a23c1 Mon Sep 17 00:00:00 2001 +From 68e41868b1711ae6a4fee3e77e1f0bb37d9e1546 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Matthias=20A=C3=9Fhauer?= Date: Tue, 16 Sep 2025 17:29:00 +0200 -Subject: [PATCH 7/7] Fix OS detection +Subject: [PATCH 7/9] Fix OS detection OpenSSL tests assume the perl that runs the tests to be native to the platform of the openssl being tested. This isn't the case for our MINGW-Packages. Teach the affected tests to treat msys perl the same as they would MSWin32 perl. + +Since Git for Windows recently stopped building its own Perl and now uses +the MSYS2-provided one, $^O reports 'cygwin' rather than 'msys'. Account +for both values in the OS detection guards. --- test/recipes/20-test_speed.t | 4 ++-- test/recipes/25-test_verify.t | 4 ++-- @@ -14,7 +18,7 @@ Teach the affected tests to treat msys perl the same as they would MSWin32 perl. 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/test/recipes/20-test_speed.t b/test/recipes/20-test_speed.t -index 3c3c5fa..1c37d5d 100644 +index c6a9824..cff981b 100644 --- a/test/recipes/20-test_speed.t +++ b/test/recipes/20-test_speed.t @@ -29,7 +29,7 @@ ok(run(app(['openssl', 'speed', '-testmode'])), @@ -22,7 +26,7 @@ index 3c3c5fa..1c37d5d 100644 SKIP: { skip "Multi option is not supported by this OpenSSL build", 1 - if $^O =~ /^(VMS|MSWin32)$/; -+ if $^O =~ /^(VMS|MSWin32|msys)$/; ++ if $^O =~ /^(VMS|MSWin32|msys|cygwin)$/; ok(run(app(['openssl', 'speed', '-testmode', '-multi', 2])), "Test the multi option"); @@ -31,34 +35,34 @@ index 3c3c5fa..1c37d5d 100644 SKIP: { skip "Mlock option is not supported by this OpenSSL build", 1 - if $^O !~ /^(linux|MSWin32)$/; -+ if $^O =~ /^(linux|MSWin32|msys)$/; ++ if $^O =~ /^(linux|MSWin32|msys|cygwin)$/; ok(run(app(['openssl', 'speed', '-testmode', '-mlock'])), "Test the mlock option"); diff --git a/test/recipes/25-test_verify.t b/test/recipes/25-test_verify.t -index 786a302..0f9b7b5 100644 +index b7a6029..4e1bb67 100644 --- a/test/recipes/25-test_verify.t +++ b/test/recipes/25-test_verify.t -@@ -605,7 +605,7 @@ ok(!vfy_root("-CAstore", "non-existing", "-CAfile", $rootcert), "CAfile and non- +@@ -617,7 +617,7 @@ ok(!vfy_root("-CAstore", "non-existing", "-CAfile", $rootcert), "CAfile and non- SKIP: { skip "file names with colons aren't supported on Windows and VMS", 1 - if $^O =~ /^(MSWin32|VMS)$/; -+ if $^O =~ /^(MsWin32|VMS|msys)$/; ++ if $^O =~ /^(MsWin32|VMS|msys|cygwin)$/; my $foo_file = "foo:cert.pem"; copy($rootcert, $foo_file); ok(vfy_root("-CAstore", $foo_file), "CAstore foo:file"); -@@ -622,7 +622,7 @@ if ($^O eq "msys") { +@@ -634,7 +634,7 @@ if ($^O eq "msys" || $^O eq "cygwin") { # file://authority/C:/what/ever/foo.pem and file:///C:/what/ever/foo.pem # file://C:/what/ever/foo.pem is non-standard and may not be accepted. # See RFC 8089 for details. -$abs_cert = "/" . $abs_cert if ($^O eq "MSWin32"); -+$abs_cert = "/" . $abs_cert if ($^O eq "MSWin32" or $^O eq "msys"); ++$abs_cert = "/" . $abs_cert if ($^O eq "MSWin32" or $^O eq "msys" or $^O eq "cygwin"); ok(vfy_root("-CAstore", "file://".$abs_cert), "CAstore file:///path"); ok(vfy_root("-CAstore", "file://localhost".$abs_cert), "CAstore file://localhost/path"); ok(!vfy_root("-CAstore", "file://otherhost".$abs_cert), "CAstore file://otherhost/path"); diff --git a/test/recipes/70-test_sslrecords.t b/test/recipes/70-test_sslrecords.t -index 299ecb6..8efbca4 100644 +index 299ecb6..13192e3 100644 --- a/test/recipes/70-test_sslrecords.t +++ b/test/recipes/70-test_sslrecords.t @@ -43,7 +43,7 @@ SKIP: { @@ -66,7 +70,7 @@ index 299ecb6..8efbca4 100644 SKIP: { skip "DTLS 1.2 is disabled", 22 if disabled("dtls1_2"); - skip "DTLSProxy does not work on Windows", 22 if $^O =~ /^(MSWin32)$/; -+ skip "DTLSProxy does not work on Windows", 22 if $^O =~ /^(MSWin32|msys)$/; ++ skip "DTLSProxy does not work on Windows", 22 if $^O =~ /^(MSWin32|msys|cygwin)$/; run_tests(1); } diff --git a/mingw-w64-openssl/0008-Define-SIO_UDP_NETRESET-if-necessary.patch b/mingw-w64-openssl/0008-Define-SIO_UDP_NETRESET-if-necessary.patch index f972e685c7fd4..9a5e3db265106 100644 --- a/mingw-w64-openssl/0008-Define-SIO_UDP_NETRESET-if-necessary.patch +++ b/mingw-w64-openssl/0008-Define-SIO_UDP_NETRESET-if-necessary.patch @@ -1,7 +1,7 @@ -From c3c28ed00601a2fbab8efbdc787cb0e1696b1fea Mon Sep 17 00:00:00 2001 +From f482755719e780a0655d1c0b8c1fcf1183a188b0 Mon Sep 17 00:00:00 2001 From: Johannes Schindelin Date: Tue, 27 Jan 2026 17:48:43 +0100 -Subject: [PATCH] Define `SIO_UDP_NETRESET` if necessary +Subject: [PATCH 8/9] Define `SIO_UDP_NETRESET` if necessary Older `mingw-w64-headers` versions seem not to define this constant, but OpenSSL started using it in v3.5.5. @@ -12,7 +12,7 @@ Signed-off-by: Johannes Schindelin 1 file changed, 3 insertions(+) diff --git a/ssl/quic/quic_reactor.c b/ssl/quic/quic_reactor.c -index 1a95f13..fd913c7 100644 +index c30bc3c..0c8c5ac 100644 --- a/ssl/quic/quic_reactor.c +++ b/ssl/quic/quic_reactor.c @@ -15,6 +15,9 @@ @@ -25,6 +25,3 @@ index 1a95f13..fd913c7 100644 #endif /* --- -2.52.0.windows.1 - diff --git a/mingw-w64-openssl/0009-Also-treat-Cygwin-Perl-like-MSYS-Perl-in-test-skip-g.patch b/mingw-w64-openssl/0009-Also-treat-Cygwin-Perl-like-MSYS-Perl-in-test-skip-g.patch new file mode 100644 index 0000000000000..af95b6230cc08 --- /dev/null +++ b/mingw-w64-openssl/0009-Also-treat-Cygwin-Perl-like-MSYS-Perl-in-test-skip-g.patch @@ -0,0 +1,160 @@ +From f7f115d7a811be46afad90d9b987dd2ae7680ae7 Mon Sep 17 00:00:00 2001 +From: Johannes Schindelin +Date: Tue, 14 Apr 2026 12:47:25 +0200 +Subject: [PATCH 9/9] Also treat Cygwin Perl like MSYS Perl in test skip guards + +Git for Windows recently stopped shipping its own Perl build and switched +to the MSYS2-provided one. That Perl reports $^O as 'cygwin' rather than +'msys', so the upstream skip guards that protect tests from running on +non-native Perl (where they would hang on Windows Firewall prompts or +fail due to path conventions) no longer fire. + +Add 'cygwin' alongside 'msys' in every upstream skip guard that exists to +prevent test hangs and spurious failures when OpenSSL is built as a MINGW +package but tested with MSYS2's Cygwin-derived Perl. +--- + test/recipes/02-test_errstr.t | 2 +- + test/recipes/25-test_eai_data.t | 2 +- + test/recipes/25-test_x509.t | 2 +- + test/recipes/80-test_cmp_http.t | 2 +- + test/recipes/82-test_ocsp_cert_chain.t | 2 +- + test/recipes/82-test_tfo_cli.t | 2 +- + test/recipes/90-test_store.t | 12 ++++++------ + 7 files changed, 12 insertions(+), 12 deletions(-) + +diff --git a/test/recipes/02-test_errstr.t b/test/recipes/02-test_errstr.t +index 07a68ad..01713c1 100644 +--- a/test/recipes/02-test_errstr.t ++++ b/test/recipes/02-test_errstr.t +@@ -29,7 +29,7 @@ plan skip_all => 'This is unsupported for cross compiled configurations' + # on Windows when built with msys perl. Similar problems are also observed + # in MSVC builds, depending on the perl implementation used. + plan skip_all => 'This is unsupported on MSYS/MinGW or MSWin32' +- if $^O eq 'msys' or $^O eq 'MSWin32'; ++ if $^O eq 'msys' or $^O eq 'cygwin' or $^O eq 'MSWin32'; + + plan skip_all => 'OpenSSL is configured "no-autoerrinit" or "no-err"' + if disabled('autoerrinit') || disabled('err'); +diff --git a/test/recipes/25-test_eai_data.t b/test/recipes/25-test_eai_data.t +index 63548d0..c36edab 100644 +--- a/test/recipes/25-test_eai_data.t ++++ b/test/recipes/25-test_eai_data.t +@@ -50,7 +50,7 @@ ok(run(app(["openssl", "x509", "-ext", "subjectAltName", "-in", $utf8_pem, "-noo + is(cmp_text($out, srctop_file($folder, "san.utf8")), 0, 'Comparing othername for IDN domain'); + + SKIP: { +- skip "Unicode tests disabled on MingW", 2 if $^O =~ /^msys$/; ++ skip "Unicode tests disabled on MingW", 2 if $^O =~ /^(msys|cygwin)$/; + + ok(run(app(["openssl", "verify", "-nameopt", "utf8", "-no_check_time", "-verify_email", "学生\@elementary.school.example.com", "-CAfile", $ascii_chain_pem, $ascii_pem]))); + ok(run(app(["openssl", "verify", "-nameopt", "utf8", "-no_check_time", "-verify_email", "医生\@大学.example.com", "-CAfile", $utf8_chain_pem, $utf8_pem]))); +diff --git a/test/recipes/25-test_x509.t b/test/recipes/25-test_x509.t +index e4e373f..13e90c0 100644 +--- a/test/recipes/25-test_x509.t ++++ b/test/recipes/25-test_x509.t +@@ -56,7 +56,7 @@ SKIP: { + + SKIP: { + skip "DES disabled", 1 if disabled("des"); +- skip "Platform doesn't support command line UTF-8", 1 if $^O =~ /^(VMS|msys)$/; ++ skip "Platform doesn't support command line UTF-8", 1 if $^O =~ /^(VMS|msys|cygwin)$/; + + my $p12 = srctop_file("test", "shibboleth.pfx"); + my $p12pass = "σύνθημα γνώρισμα"; +diff --git a/test/recipes/80-test_cmp_http.t b/test/recipes/80-test_cmp_http.t +index 63b2525..6fbc683 100644 +--- a/test/recipes/80-test_cmp_http.t ++++ b/test/recipes/80-test_cmp_http.t +@@ -36,7 +36,7 @@ plan skip_all => "These tests are not supported in a no-cms build" + if disabled("cms"); # central key pair generation + + plan skip_all => "Tests involving local HTTP server not available on Windows or VMS" +- if $^O =~ /^(VMS|MSWin32|msys)$/; ++ if $^O =~ /^(VMS|MSWin32|msys|cygwin)$/; + plan skip_all => "Tests involving local HTTP server not available in cross-compile builds" + if defined $ENV{EXE_SHELL}; + +diff --git a/test/recipes/82-test_ocsp_cert_chain.t b/test/recipes/82-test_ocsp_cert_chain.t +index a0c3737..281bf66 100644 +--- a/test/recipes/82-test_ocsp_cert_chain.t ++++ b/test/recipes/82-test_ocsp_cert_chain.t +@@ -26,7 +26,7 @@ plan skip_all => "$test_name requires sock enabled" + plan skip_all => "$test_name requires TLS enabled" + if alldisabled(available_protocols("tls")); + plan skip_all => "$test_name is not available Windows or VMS" +- if $^O =~ /^(VMS|MSWin32|msys)$/; ++ if $^O =~ /^(VMS|MSWin32|msys|cygwin)$/; + + plan tests => 3; + +diff --git a/test/recipes/82-test_tfo_cli.t b/test/recipes/82-test_tfo_cli.t +index f069912..758fd82 100644 +--- a/test/recipes/82-test_tfo_cli.t ++++ b/test/recipes/82-test_tfo_cli.t +@@ -20,7 +20,7 @@ plan skip_all => "test_tfo_cli needs sock enabled" if disabled("sock"); + plan skip_all => "test_tfo_cli needs tls < 1.3 enabled" + if disabled("tls1") && disabled("tls1_1") && disabled("tls1_2"); + plan skip_all => "test_tfo_cli does not run on Windows nor VMS" +- if $^O =~ /^(VMS|MSWin32|msys)$/; ++ if $^O =~ /^(VMS|MSWin32|msys|cygwin)$/; + + plan tests => 8; + +diff --git a/test/recipes/90-test_store.t b/test/recipes/90-test_store.t +index f0f9e4d..e5224e7 100644 +--- a/test/recipes/90-test_store.t ++++ b/test/recipes/90-test_store.t +@@ -121,7 +121,7 @@ my $n = 4 + scalar @methods + # Test doesn't work under msys because the file name munging doesn't work + # correctly with the "ot:" prefix + my $do_test_ossltest_store = +- !(disabled("engine") || disabled("dynamic-engine") || $^O =~ /^msys$/); ++ !(disabled("engine") || disabled("dynamic-engine") || $^O =~ /^(msys|cygwin)$/); + + if ($do_test_ossltest_store) { + # test loading with apps 'org.openssl.engine:' loader, using the +@@ -201,7 +201,7 @@ indir "store_$$" => sub { + ok(run(app([@storeutl, "-noout", to_abs_file($file)]))); + SKIP: + { +- skip "file: tests disabled on MingW", 4 if $^O =~ /^msys$/; ++ skip "file: tests disabled on MingW", 4 if $^O =~ /^(msys|cygwin)$/; + + ok(run(app([@storeutl, "-noout", + to_abs_file_uri($file)]))); +@@ -229,7 +229,7 @@ indir "store_$$" => sub { + + SKIP: + { +- skip "file: tests disabled on MingW", 2 if $^O =~ /^msys$/; ++ skip "file: tests disabled on MingW", 2 if $^O =~ /^(msys|cygwin)$/; + + ok(run(app([@storeutl, "-noout", "-passin", + "pass:password", to_abs_file_uri($_)]))); +@@ -240,7 +240,7 @@ indir "store_$$" => sub { + foreach (values %generated_file_files) { + SKIP: + { +- skip "file: tests disabled on MingW", 1 if $^O =~ /^msys$/; ++ skip "file: tests disabled on MingW", 1 if $^O =~ /^(msys|cygwin)$/; + + ok(run(app([@storeutl, "-noout", $_]))); + } +@@ -248,7 +248,7 @@ indir "store_$$" => sub { + foreach (@noexist_file_files) { + SKIP: + { +- skip "file: tests disabled on MingW", 1 if $^O =~ /^msys$/; ++ skip "file: tests disabled on MingW", 1 if $^O =~ /^(msys|cygwin)$/; + + ok(!run(app([@storeutl, "-noout", $_]))); + } +@@ -260,7 +260,7 @@ indir "store_$$" => sub { + ok(run(app([@storeutl, "-noout", to_abs_file($dir, 1)]))); + SKIP: + { +- skip "file: tests disabled on MingW", 1 if $^O =~ /^msys$/; ++ skip "file: tests disabled on MingW", 1 if $^O =~ /^(msys|cygwin)$/; + + ok(run(app([@storeutl, "-noout", + to_abs_file_uri($dir, 1)]))); diff --git a/mingw-w64-openssl/PKGBUILD b/mingw-w64-openssl/PKGBUILD index f78f76a06a034..e66b96c9e1ebb 100644 --- a/mingw-w64-openssl/PKGBUILD +++ b/mingw-w64-openssl/PKGBUILD @@ -27,18 +27,20 @@ source=("https://github.com/openssl/openssl/releases/download/openssl-${pkgver}/ '0006-Mangle-Absolute-path.patch' '0007-Fix-OS-detection.patch' '0008-Define-SIO_UDP_NETRESET-if-necessary.patch' + '0009-Also-treat-Cygwin-Perl-like-MSYS-Perl-in-test-skip-g.patch' 'pathtools.c' 'pathtools.h') sha256sums=('deae7c80cba99c4b4f940ecadb3c3338b13cb77418409238e57d7f31f2a3b736' 'SKIP' - 'baaaab0e91caf5690d4a264146cff2030bb5852ad14712d7f89e7e072533ae11' - 'a45ab8e18db920e8c559d80598664cfb52d2f4e09653f4caaa0f4de0055982cf' - 'c41bc19de1448b08b61ee47b55620e7629e9189a9a7f4e2fac42e8a9e5823d30' - '0862c9751775f1c75d0495538951343ff83c83a5344e61e091dd3e964a630640' - '52a4c65eb0af1a8319e2ece6e714ae6130f27bd46ba8d40966428694d64728ed' - 'eca965cb6761cfa294857fd85eef4aa27fdc7e322ebcd88a1b67c4c668be7121' - 'a00fe4dbc0c5848ccb1b205e3aae2dccd5246745e517e74349dfdb3b25968047' - 'f2d2fec8009fc0acd291329b7de97b8b4082587e22cc4d95cd6cb0a858b46aa1' + '8503b2d481e8392a67152d529cfbb01cc9b9c4a8d7a529b202f3a1a385058c34' + 'e64661d67c47c1f8b5a409a230fd5a7a97c5b9070ceeefdc469788cf85068c36' + '49f3855724820b3a543fe48ddd3fe3a3ad4a6e425e43934d46cce745a2b087d9' + 'd226be89fdd2d9b576d6e6167858973ca2c6f4c9f606e7685e4451483a7ee5e0' + '7b536140d138d2af264ac23f3f9d2fae4c8226854c8b6a02b724b34c523ac5cb' + '2785fc1ee7c908c8a9b0b5e18371ce1baf75f5684877bf388004b74009e6ecb6' + '9a5c55ae51a8411034339ff9fc028cfb11337511957554b1681c1163160d82c8' + '32a166a50fe916fb872be441bf7db1f56d67222b7b38ccfe5da394802f79eeac' + '4f7c427058e5edc533c5c653ef5189e2b38998f4fb2e300f5db2675ed4bef5fb' '08209cbf1633fa92eae7e5d28f95f8df9d6184cc20fa878c99aec4709bb257fd' '965d3921ec4fdeec94a2718bc2c85ce5e1a00ea0e499330a554074a7ae15dfc6') @@ -72,7 +74,8 @@ prepare() { 0005-Fix-Text-comparison.patch \ 0006-Mangle-Absolute-path.patch \ 0007-Fix-OS-detection.patch \ - 0008-Define-SIO_UDP_NETRESET-if-necessary.patch + 0008-Define-SIO_UDP_NETRESET-if-necessary.patch \ + 0009-Also-treat-Cygwin-Perl-like-MSYS-Perl-in-test-skip-g.patch if [[ "$MSYSTEM" == MINGW32 ]] then From bc43add570655979b4c5cf60d04c2d9266f0d968 Mon Sep 17 00:00:00 2001 From: Johannes Schindelin Date: Tue, 14 Apr 2026 13:48:41 +0200 Subject: [PATCH 3/4] openssl: use -j1 for `make install` to avoid permission errors With parallel make, the install step can fail with "Error 13" (permission denied) when multiple jobs race to run pod2man or write to the same directory simultaneously. MSYS2 upstream hit the same problem and added -j1 for `make install` in their 3.4.0 update (msys2/MINGW-packages@3c238e9727, referencing https://github.com/openssl/openssl/issues/24298). Assisted-by: Claude Opus 4.6 Signed-off-by: Johannes Schindelin --- mingw-w64-openssl/PKGBUILD | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mingw-w64-openssl/PKGBUILD b/mingw-w64-openssl/PKGBUILD index e66b96c9e1ebb..b1815e20d871f 100644 --- a/mingw-w64-openssl/PKGBUILD +++ b/mingw-w64-openssl/PKGBUILD @@ -172,7 +172,7 @@ _package() { return } - make install DESTDIR="${pkgdir}" + make -j1 install DESTDIR="${pkgdir}" install -Dm644 "${srcdir}/${_realname}-${pkgver}/LICENSE.txt" "${pkgdir}${MINGW_PREFIX}/share/licenses/${_realname}/LICENSE" } From 53f70129afd78606d71568f7e423647951698ee4 Mon Sep 17 00:00:00 2001 From: Johannes Schindelin Date: Tue, 14 Apr 2026 14:32:56 +0200 Subject: [PATCH 4/4] openssl: run test suite with parallel jobs The OpenSSL test suite runs via Perl's Test::Harness, which defaults to sequential execution (HARNESS_JOBS=1) unless told otherwise. With 342 test files, sequential execution takes well over an hour on CI. Setting HARNESS_JOBS=8 brings this down to about 12 minutes on a 6-core machine, as verified locally (710 wallclock seconds, 4335 tests, all passing). The default of 8 is a reasonable middle ground: high enough to saturate typical CI agents, low enough to avoid file descriptor exhaustion. The value can still be overridden via the environment for machines where a different number is appropriate. Assisted-by: Claude Opus 4.6 Signed-off-by: Johannes Schindelin --- mingw-w64-openssl/PKGBUILD | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mingw-w64-openssl/PKGBUILD b/mingw-w64-openssl/PKGBUILD index b1815e20d871f..4704168c33233 100644 --- a/mingw-w64-openssl/PKGBUILD +++ b/mingw-w64-openssl/PKGBUILD @@ -157,7 +157,7 @@ build() { check() { cd "${srcdir}/build-${MSYSTEM}" - make VERBOSE_FAILURE=1 TESTS=-test_symbol_presence test + HARNESS_JOBS=${HARNESS_JOBS:-8} make VERBOSE_FAILURE=1 TESTS=-test_symbol_presence test } _package() {