openssl 3.3.2

.github/workflows/build-macos-openssl.yml

@@ -36,7 +36,7 @@ jobs:
       - name: Download OpenSSL
         run: |
           source ./cryptography-linux/openssl-version.sh
-          curl -Lo openssl.tar.gz https://www.openssl.org/source/$OPENSSL_VERSION.tar.gz
+          curl -Lo openssl.tar.gz https://github.com/openssl/openssl/releases/download/$OPENSSL_VERSION/$OPENSSL_VERSION.tar.gz
           shasum -a 256 -c <<< "$OPENSSL_SHA256 *openssl.tar.gz"
       - name: Extract OpenSSL
         run: |

.github/workflows/build-windows-openssl.yml

@@ -37,7 +37,7 @@ jobs:
         shell: bash
       - name: Download OpenSSL source
         run: |
-          wget "https://www.openssl.org/source/${env:OPENSSL_VERSION}.tar.gz" -OutFile 'openssl-latest.tar.gz'
+          wget "https://github.com/openssl/openssl/releases/download/${env:OPENSSL_VERSION}/${env:OPENSSL_VERSION}.tar.gz" -OutFile 'openssl-latest.tar.gz'
           if ((Get-FileHash openssl-latest.tar.gz -Algorithm SHA256).Hash -ne $env:OPENSSL_SHA256) {
               Write-Error 'Hashes do not match' -ErrorAction Stop
           }

cryptography-linux/Dockerfile

@@ -29,6 +29,7 @@ RUN \
 COPY --from=staticnodejs /out/ /staticnode/
 ADD install_openssl.sh /root/install_openssl.sh
 ADD openssl-version.sh /root/openssl-version.sh
+ADD list-util-pairs-25367.patch /root/list-util-pairs-25367.patch
 RUN ./install_openssl.sh
 
 RUN curl https://sh.rustup.rs -sSf | sh -s -- -y --default-toolchain stable --profile minimal

cryptography-linux/install_openssl.sh

@@ -1,13 +1,17 @@
 #!/bin/bash
 set -xe
 
-OPENSSL_URL="https://www.openssl.org/source/"
+OPENSSL_URL="https://github.com/openssl/openssl/releases/download"
 source /root/openssl-version.sh
 
-curl -#LO "${OPENSSL_URL}/${OPENSSL_VERSION}.tar.gz"
+curl -#LO "${OPENSSL_URL}/${OPENSSL_VERSION}/${OPENSSL_VERSION}.tar.gz"
 echo "${OPENSSL_SHA256}  ${OPENSSL_VERSION}.tar.gz" | sha256sum -c -
 tar zxf ${OPENSSL_VERSION}.tar.gz
 pushd ${OPENSSL_VERSION}
+# Patch to work around OpenSSL 3.3.2 requiring a newer perl than manylinux2014
+if [ -f /etc/redhat-release ] && grep -q "CentOS Linux release 7" /etc/redhat-release; then
+    git apply ../list-util-pairs-25367.patch
+fi
 ./config $OPENSSL_BUILD_FLAGS --prefix=/opt/pyca/cryptography/openssl --openssldir=/opt/pyca/cryptography/openssl
 make depend
 make -j4

cryptography-linux/list-util-pairs-25367.patch

@@ -0,0 +1,51 @@
+diff --git a/util/mkinstallvars.pl b/util/mkinstallvars.pl
+index 52a3d607bd..b67a1c477f 100644
+--- a/util/mkinstallvars.pl
++++ b/util/mkinstallvars.pl
+@@ -10,8 +10,14 @@
+ # form, or passed as variable assignments on the command line.
+ # The result is a Perl module creating the package OpenSSL::safe::installdata.
+
++use 5.10.0;
++use strict;
++use warnings;
++use Carp;
++
+ use File::Spec;
+-use List::Util qw(pairs);
++#use List::Util qw(pairs);
++sub _pairs (@);
+
+ # These are expected to be set up as absolute directories
+ my @absolutes = qw(PREFIX libdir);
+@@ -19,9 +25,9 @@ my @absolutes = qw(PREFIX libdir);
+ # as subdirectories to PREFIX or LIBDIR.  The order of the pairs is important,
+ # since the LIBDIR subdirectories depend on the calculation of LIBDIR from
+ # PREFIX.
+-my @subdirs = pairs (PREFIX => [ qw(BINDIR LIBDIR INCLUDEDIR APPLINKDIR) ],
+-                     LIBDIR => [ qw(ENGINESDIR MODULESDIR PKGCONFIGDIR
+-                                    CMAKECONFIGDIR) ]);
++my @subdirs = _pairs (PREFIX => [ qw(BINDIR LIBDIR INCLUDEDIR APPLINKDIR) ],
++                      LIBDIR => [ qw(ENGINESDIR MODULESDIR PKGCONFIGDIR
++                                     CMAKECONFIGDIR) ]);
+ # For completeness, other expected variables
+ my @others = qw(VERSION LDLIBS);
+
+@@ -151,3 +157,17 @@ our \@LDLIBS                     =
+
+ 1;
+ _____
++
++######## Helpers
++
++sub _pairs (@) {
++    croak "Odd number of arguments" if @_ & 1;
++
++    my @pairlist = ();
++
++    while (@_) {
++        my $x = [ shift, shift ];
++        push @pairlist, $x;
++    }
++    return @pairlist;
++}

cryptography-linux/openssl-version.sh

@@ -1,5 +1,5 @@
-export OPENSSL_VERSION="openssl-3.3.1"
-export OPENSSL_SHA256="777cd596284c883375a2a7a11bf5d2786fc5413255efab20c50d6ffe6d020b7e"
+export OPENSSL_VERSION="openssl-3.3.2"
+export OPENSSL_SHA256="2e8a40b01979afe8be0bbfb3de5dc1c6709fedb46d6c89c10da114ab5fc3d281"
 # We need a base set of flags because on Windows using MSVC
 # enable-ec_nistp_64_gcc_128 doesn't work since there's no 128-bit type
 export OPENSSL_BUILD_FLAGS_WINDOWS="no-ssl3 no-ssl3-method no-zlib no-shared no-module no-comp no-dynamic-engine no-apps no-docs no-sm2-precomp no-atexit"