Skip to content

Upgrade openssl to 3.3.7#16518

Open
jykanase wants to merge 4 commits intomicrosoft:3.0-devfrom
Kanishk-Bansal:topic_openssl-3.0
Open

Upgrade openssl to 3.3.7#16518
jykanase wants to merge 4 commits intomicrosoft:3.0-devfrom
Kanishk-Bansal:topic_openssl-3.0

Conversation

@jykanase
Copy link
Copy Markdown
Contributor

@jykanase jykanase commented Apr 8, 2026

Merge Checklist

All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)

  • The toolchain has been rebuilt successfully (or no changes were made to it)
  • The toolchain/worker package manifests are up-to-date
  • Any updated packages successfully build (or no packages were changed)
  • Packages depending on static components modified in this PR (Golang, *-static subpackages, etc.) have had their Release tag incremented.
  • Package tests (%check section) have been verified with RUN_CHECK=y for existing SPEC files, or added to new SPEC files
  • All package sources are available
  • cgmanifest files are up-to-date and sorted (./cgmanifest.json, ./toolkit/scripts/toolchain/cgmanifest.json, .github/workflows/cgmanifest.json)
  • LICENSE-MAP files are up-to-date (./LICENSES-AND-NOTICES/SPECS/data/licenses.json, ./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md, ./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)
  • All source files have up-to-date hashes in the *.signatures.json files
  • sudo make go-tidy-all and sudo make go-test-coverage pass
  • Documentation has been updated to match any changes to the build system
  • Ready to merge

Summary

Upgrade openssl to 3.3.7

Change Log
  • openssl.spec
  • openssl.signatures.json
  • cgmanifest.json
  • patches.
Does this affect the toolchain?

YES

Associated issues
  • #xxxx
Links to CVEs
Test Methodology
  • Local Build
Screenshot 2026-04-08 230608

@jykanase jykanase requested a review from a team as a code owner April 8, 2026 17:43
@microsoft-github-policy-service microsoft-github-policy-service bot added Packaging 3.0-dev PRs Destined for AzureLinux 3.0 labels Apr 8, 2026
@@ -1,7 +1,7 @@
From 7a65ee33793fa8a28c0dfc94e6872ce92f408b15 Mon Sep 17 00:00:00 2001
rom 7a65ee33793fa8a28c0dfc94e6872ce92f408b15 Mon Sep 17 00:00:00 2001
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
rom 7a65ee33793fa8a28c0dfc94e6872ce92f408b15 Mon Sep 17 00:00:00 2001
From 7a65ee33793fa8a28c0dfc94e6872ce92f408b15 Mon Sep 17 00:00:00 2001

%ldconfig_scriptlets libs

%changelog
* Wed 08 2026 Jyoti Kanase <v-jykanase@microsoft.com> - 3.3.7
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
* Wed 08 2026 Jyoti Kanase <v-jykanase@microsoft.com> - 3.3.7
* Wed April 08 2026 Jyoti Kanase <v-jykanase@microsoft.com> - 3.3.7-1

Copy link
Copy Markdown
Contributor

@Kanishk-Bansal Kanishk-Bansal left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 — 0001-Replacing-deprecated-functions patch reversal: The rebased patch now removes SSLv3 NULL-return guards and reverts DTLS from DTLS_method() back to dtlsv1_method(). If 3.3.7 handles this internally, it's fine — but needs confirmation is it expected

Copy link
Copy Markdown
Contributor

@Kanishk-Bansal Kanishk-Bansal left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Month is missing from changelog

@jykanase jykanase force-pushed the topic_openssl-3.0 branch from 28800ff to fee4bdf Compare April 9, 2026 05:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

3.0-dev PRs Destined for AzureLinux 3.0 Packaging security

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants