build: out-kludge the installed header include kludge

This is a, erm, beautiful(?) mess. I feel like there probably ought to be a better way to handle this use case, but the way that the includes are handled in this specific codebase are extremely weird (how many times have you actually seen #include_next get used?). It may be worth making this a more natural path to take, though.
build: update for zig-0.13.0 release
2024-06-18 20:41:00 -07:00 · 2024-06-17 23:16:44 -07:00 · 2024-05-12 23:42:59 -07:00 · 2024-01-15 15:38:06 -08:00 · 2024-01-15 15:38:06 -08:00 · 2024-01-15 15:30:20 -08:00
24 changed files with 1989 additions and 270 deletions
--- a/.github/rust-openssl.patch
+++ b/.github/rust-openssl.patch
@@ -1,13 +1,13 @@
 diff --git a/openssl-sys/build/main.rs b/openssl-sys/build/main.rs
-index 21ccf3d0..1cf2d184 100644
+index 82013b6c..2974abed 100644
 --- a/openssl-sys/build/main.rs
 +++ b/openssl-sys/build/main.rs
-@@ -272,7 +272,7 @@ See rust-openssl documentation for more information:
-             (3, 7, 0) => ('3', '7', '0'),
+@@ -273,7 +273,7 @@ See rust-openssl documentation for more information:
             (3, 7, 1) => ('3', '7', '1'),
             (3, 7, _) => ('3', '7', 'x'),
-            (3, 8, 0) => ('3', '8', '0'),
-+            (3, 8, _) => ('3', '8', '0'),
+             (3, 8, 0) => ('3', '8', '0'),
+-            (3, 8, 1) => ('3', '8', '1'),
+            (3, 8, _) => ('3', '8', 'x'),
             _ => version_error(),
         };
 
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -63,11 +63,7 @@ if(NOT CMAKE_BUILD_TYPE AND NOT CMAKE_CONFIGURATION_TYPES)
 endif()

 # Enable asserts regardless of build type
-if(MSVC)
-	add_definitions(/UNDEBUG)
-else()
-	add_definitions(-UNDEBUG)
-endif()
+add_definitions(-UNDEBUG)

 set(BUILD_NC true)

@@ -152,17 +148,17 @@ if(MSVC)
 			"C4100" # 'identifier' : unreferenced formal parameter
 			"C4127" # conditional expression is constant
 			"C4146" # unary minus operator applied to unsigned type,
-				# result still unsigned
+			        # result still unsigned
 			"C4244" # 'argument' : conversion from 'type1' to 'type2',
-				# possible loss of data
+			        # possible loss of data
 			"C4245" # 'conversion' : conversion from 'type1' to 'type2',
-				# signed/unsigned mismatch
+			        # signed/unsigned mismatch
 			"C4267" # 'var' : conversion from 'size_t' to 'type',
-				# possible loss of data
+			        # possible loss of data
 			"C4389" # 'operator' : signed/unsigned mismatch
 			"C4706" # assignment within conditional expression
 			"C4996" # The POSIX name for this item is deprecated.
-				# Instead, use the ISO C and C++ conformant name
+			        # Instead, use the ISO C and C++ conformant name
 		)
 	elseif(CMAKE_C_COMPILER_ID MATCHES "Intel")
 		add_definitions(-D_CRT_SUPPRESS_RESTRICT)
@@ -333,32 +329,32 @@ endif()
 # single architecture work on macOS at least.
 #
 # Don't set CMAKE_OSX_ARCHITECTURES to more than a single value for now.
-if(APPLE)
+if(APPLE AND (NOT CMAKE_OSX_ARCHITECTURES STREQUAL ""))
 	set(CMAKE_SYSTEM_PROCESSOR "${CMAKE_OSX_ARCHITECTURES}")
 endif()

-if("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "(aarch64|arm64)")
+if("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "(aarch64|arm64|ARM64)")
 	set(HOST_AARCH64 true)
 elseif("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "arm")
 	set(HOST_ARM true)
 elseif("${CMAKE_SYSTEM_NAME}" STREQUAL "SunOS" AND "${CMAKE_SYSTEM_PROCESSOR}" STREQUAL "i386")
 	set(HOST_X86_64 true)
-elseif("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "(x86_64|amd64)")
+elseif("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "(x86_64|amd64|AMD64)")
 	set(HOST_X86_64 true)
-elseif("${CMAKE_SYSTEM_NAME}" MATCHES "[i?86|x86]")
+elseif("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "(i[3-6]86|[xX]86)")
 	set(ENABLE_ASM false)
 	set(HOST_I386 true)
-elseif("${CMAKE_SYSTEM_NAME}" MATCHES "mips64")
+elseif("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "mips64")
 	set(HOST_MIPS64 true)
-elseif("${CMAKE_SYSTEM_NAME}" MATCHES "mips")
+elseif("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "mips")
 	set(HOST_MIPS true)
-elseif("${CMAKE_SYSTEM_NAME}" MATCHES "powerpc")
+elseif("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "powerpc")
 	set(HOST_POWERPC true)
-elseif("${CMAKE_SYSTEM_NAME}" MATCHES "ppc64")
+elseif("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "ppc64")
 	set(HOST_PPC64 true)
-elseif("${CMAKE_SYSTEM_NAME}" MATCHES "riscv64")
+elseif("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "riscv64")
 	set(HOST_RISCV64 true)
-elseif("${CMAKE_SYSTEM_NAME}" MATCHES "sparc64")
+elseif("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "sparc64")
 	set(HOST_SPARC64 true)
 else()
 	set(ENABLE_ASM false)
@@ -405,7 +401,6 @@ if(SIZEOF_TIME_T STREQUAL "4")
 	message(WARNING " ** Warning, this system is unable to represent times past 2038\n"
 	                " ** It will behave incorrectly when handling valid RFC5280 dates")
 endif()
-add_definitions(-DSIZEOF_TIME_T=${SIZEOF_TIME_T})

 set(OPENSSL_LIBS ssl crypto ${PLATFORM_LIBS})
 set(LIBTLS_LIBS tls ${PLATFORM_LIBS})
@@ -473,8 +468,8 @@ if(ENABLE_LIBRESSL_INSTALL)
  	INSTALL_DESTINATION "${LIBRESSL_INSTALL_CMAKEDIR}"
 	)
 	install(FILES
-		"${CMAKE_BINARY_DIR}/install-config/LibreSSLConfig.cmake"
-		"${CMAKE_BINARY_DIR}/LibreSSLConfigVersion.cmake"
+		"${CMAKE_CURRENT_BINARY_DIR}/install-config/LibreSSLConfig.cmake"
+		"${CMAKE_CURRENT_BINARY_DIR}/LibreSSLConfigVersion.cmake"
 		DESTINATION "${LIBRESSL_INSTALL_CMAKEDIR}"
 	)
 endif()
--- a/43
+++ b/43
@@ -28,7 +28,48 @@ history is also available from Git.

 LibreSSL Portable Release Notes:

-3.8.1 - In development
+3.9.0 - In development
+
+	* Portable changes
+	* Internal improvements
+	* Documentation improvements
+	* Testing and proactive security
+	* Bug fixes
+	  - Fixed aliasing issues in BN_mod_exp_simple() and BN_mod_exp_recp()
+
+3.8.2 - Stable release
+
+	* Portable changes
+	  - Fixed processor detection for CMake targets.
+	     Thanks to @jiegec from github.
+	  - Enabled building oscpcheck with MSVC.
+	     Thanks to @FtZPetruska from github.
+	  - Improve CMake package detection and installation.
+	     Thanks to @mark-groundctl from github.
+	  - Fixed assembly optimizations on x64 Windows targets.
+	  - Allow disabling warnings about WINCRYPT overrides.
+	  - Use system arc4random on FreeBSD 12 and newer.
+	* Documentation improvements
+	  - Documented the RFC 3779 API.
+	* Compatibility changes
+	  - Restrict the RFC 3779 code to IPv4 and IPv6. It was not written
+	    to be able to deal with anything else.
+	  - Fixed EVP_CIPHER_CTX_iv_length() to return what was set with
+	    EVP_CTRL_AEAD_SET_IVLEN or one of its aliases.
+	* Bug fixes
+	  - Fixed EVP_PKEY_get{0,1}_RSA for RSA-PSS.
+	  - Plug a potential memory leak in ASN1_TIME_normalize().
+	  - Avoid memory leak in EVP_CipherInit().
+	  - Redirect EVP_PKEY_get1_* through their get0 siblings.
+	  - Fixed a use of uninitialized in i2r_IPAddrBlocks().
+	  - Rewrote CMS_SignerInfo_{sign,verify}().
+	  - Further cleanup and refactoring in the EC code.
+	  - Allow IP addresses to be specified in a URI.
+	  - Fixed a copy-paste error in ASN1_TIME_compare() that could lead
+	    to two UTCTimes or two GeneralizedTimes incorrectly being compared
+	    as equal.
+
+3.8.1 - Development release

 	* Portable changes
 	  - Applications bundled as part of the LibreSSL package internally,
--- a/LibreSSLConfig.cmake.in
+++ b/LibreSSLConfig.cmake.in
@@ -6,16 +6,19 @@ set_and_check(LIBRESSL_INCLUDE_DIR @PACKAGE_INCLUDE_DIRECTORY@)
 if(EXISTS "${CMAKE_CURRENT_LIST_DIR}/LibreSSL-Crypto.cmake")
  include("${CMAKE_CURRENT_LIST_DIR}/LibreSSL-Crypto.cmake")
  set(LIBRESSL_CRYPTO_LIBRARY LibreSSL::Crypto)
+  set(LibreSSL_Crypto_FOUND TRUE)
 endif()

 if(EXISTS "${CMAKE_CURRENT_LIST_DIR}/LibreSSL-SSL.cmake")
  include("${CMAKE_CURRENT_LIST_DIR}/LibreSSL-SSL.cmake")
  set(LIBRESSL_SSL_LIBRARY LibreSSL::SSL)
+  set(LibreSSL_SSL_FOUND TRUE)
 endif()

 if(EXISTS "${CMAKE_CURRENT_LIST_DIR}/LibreSSL-TLS.cmake")
  include("${CMAKE_CURRENT_LIST_DIR}/LibreSSL-TLS.cmake")
  set(LIBRESSL_TLS_LIBRARY LibreSSL::TLS)
+  set(LibreSSL_TLS_FOUND TRUE)
 endif()

 set(LIBRESSL_LIBRARIES
@@ -24,10 +27,10 @@ set(LIBRESSL_LIBRARIES
  ${LIBRESSL_TLS_LIBRARY}
 )

-check_required_components(
-  Crypto
-  SSL
-  TLS
-)
+check_required_components(LibreSSL)

-set(LIBRESSL_FOUND TRUE)
+if(DEFINED LibreSSL_FOUND)
+	set(LIBRESSL_FOUND ${LibreSSL_FOUND})
+else()
+	set(LIBRESSL_FOUND TRUE)
+endif()
--- a/2
+++ b/2
@@ -1 +1 @@
-master
+OPENBSD_7_4
--- a/README.md
+++ b/README.md
@@ -4,13 +4,13 @@ This is a somewhat hacky port of the LibreSSL build system to Zig. It builds Lib

 Notes:

-1. In order for this to work, `.\update.sh` must have first been run to bring in the LibreSSL OpenBSD sources. (Or, if you trust me, you may use the `zig-3.8.1` branch which has the upstream sources committed to the repository, for ease of use with the Zig package manager).
+1. In order for this to work, `.\update.sh` must have first been run to bring in the LibreSSL OpenBSD sources. (Or, if you trust me, you may use the `zig-3.8.2` branch which has the upstream sources committed to the repository, for ease of use with the Zig package manager).

 2. I don't know if this causes LibreSSL to be compiled in a way that Compromises Its Cryptographic Integrity. Hopefully it is not even possible to do such a thing in the first place. But I am not an expert, and I ain't looking to port the tests.

 3. This does not (currently) compile the assembly routines, only the C versions, which may cause reduced performance on some platforms.

-4. Only the "big 3" platforms are supported (namely: macOS, Linux, and Windows), and they may be poorly supported, at that. I can cross compile to them from my computer but I have not tried natively compiling on all platforms.
+4. Only the "big 3" platforms are supported (namely: macOS, Linux, and Windows). Native and cross-compilation appears to work on modern versions of all three, but this has not been exhaustively tested.

 5. Why LibreSSL? It has a CMake-based build system rather than the insane hand-rolled perl mess that OpenSSL does, so it was very straightforward to follow the build process for the purposes of porting it. In theory, its OpenSSL compatibility layer makes it possible to use with a variety of other programs that want to link OpenSSL.

--- a/apps/ocspcheck/CMakeLists.txt
+++ b/apps/ocspcheck/CMakeLists.txt
@@ -1,5 +1,3 @@
-if(NOT MSVC)
-
 set(
 	OCSPCHECK_SRC
 	http.c
@@ -33,5 +31,3 @@ if(ENABLE_LIBRESSL_INSTALL)
 	install(FILES ocspcheck.8 DESTINATION ${CMAKE_INSTALL_MANDIR}/man8)

 endif(ENABLE_LIBRESSL_INSTALL)
-
-endif()
--- a/build.zig
+++ b/build.zig
@@ -5,11 +5,12 @@ const LibreSslBuildOptions = struct {
    libcrypto_name: []const u8 = "crypto",
    libssl_name: []const u8 = "ssl",
    libtls_name: []const u8 = "tls",
-    target: std.zig.CrossTarget,
+    target: std.Build.ResolvedTarget,
    optimize: std.builtin.OptimizeMode,
 };

 const LibreSslLibs = struct {
+    target: std.Build.ResolvedTarget,
    libcrypto: *std.Build.Step.Compile,
    libssl: *std.Build.Step.Compile,
    libtls: *std.Build.Step.Compile,
@@ -38,13 +39,19 @@ const LibreSslLibs = struct {
        b.installArtifact(self.libtls);
    }

+    pub fn installHeader(self: LibreSslLibs, source: std.Build.LazyPath, dest: []const u8) void {
+        self.libcrypto.installHeader(source, dest);
+        self.libssl.installHeader(source, dest);
+        self.libtls.installHeader(source, dest);
+    }
+
    pub fn header_search(
        self: LibreSslLibs,
        b: *std.Build,
        base: []const u8,
        skiplist: []const SkipSpec,
    ) !void {
-        const dir = try b.build_root.handle.openIterableDir(base, .{});
+        const dir = try b.build_root.handle.openDir(base, .{ .iterate = true });
        var walker = try dir.walk(b.allocator);
        defer walker.deinit();

@@ -57,29 +64,20 @@ const LibreSslLibs = struct {
            }

            if (std.mem.endsWith(u8, child.basename, ".h")) {
-                const full = try std.mem.concat(b.allocator, u8, &.{ base, child.path });
-                defer b.allocator.free(full);
-
-                self.libcrypto.installHeader(full, child.path);
-                self.libssl.installHeader(full, child.path);
-                self.libtls.installHeader(full, child.path);
+                const full = b.pathJoin(&.{ base, child.path });
+                const path = b.path(full);
+                self.installHeader(path, child.path);
            }
        }
    }
 };

-// TODO: this doesn't get cached, so it runs on every single build, which kind of sucks.
-// Also it won't work on windows.
-pub fn patchLibresslCompat(b: *std.Build) !void {
-    var child = std.ChildProcess.init(&.{ "/bin/sh", "update.sh" }, b.allocator);
-    _ = try child.spawnAndWait();
-}
-
 pub fn libresslBuild(
    b: *std.Build,
    options: LibreSslBuildOptions,
 ) !LibreSslLibs {
    const libressl_libs: LibreSslLibs = .{
+        .target = options.target,
        .libcrypto = b.addStaticLibrary(.{
            .name = options.libcrypto_name,
            .target = options.target,
@@ -101,7 +99,7 @@ pub fn libresslBuild(

    libressl_libs.linkLibC();

-    const tinfo = libressl_libs.libcrypto.target_info.target;
+    const tinfo = libressl_libs.target.result;

    const common_cflags = [_][]const u8{
        "-fno-sanitize=undefined",
@@ -113,13 +111,13 @@ pub fn libresslBuild(
        else => &common_cflags,
    };

-    libressl_libs.libcrypto.addCSourceFiles(&libcrypto_sources, cflags);
-    libressl_libs.libcrypto.addCSourceFiles(&libcrypto_nonasm, cflags);
-    libressl_libs.libcrypto.addCSourceFiles(&libcrypto_nonasm_or_armv4, cflags);
+    libressl_libs.libcrypto.addCSourceFiles(.{ .files = &libcrypto_sources, .flags = cflags });
+    libressl_libs.libcrypto.addCSourceFiles(.{ .files = &libcrypto_nonasm, .flags = cflags });
+    libressl_libs.libcrypto.addCSourceFiles(.{ .files = &libcrypto_nonasm_or_armv4, .flags = cflags });

-    libressl_libs.libssl.addCSourceFiles(&libssl_sources, cflags);
+    libressl_libs.libssl.addCSourceFiles(.{ .files = &libssl_sources, .flags = cflags });

-    libressl_libs.libtls.addCSourceFiles(&libtls_sources, cflags);
+    libressl_libs.libtls.addCSourceFiles(.{ .files = &libtls_sources, .flags = cflags });

    libressl_libs.defineCMacro("LIBRESSL_INTERNAL", null);
    libressl_libs.defineCMacro("OPENSSL_NO_HW_PADLOCK", null);
@@ -130,8 +128,8 @@ pub fn libresslBuild(

    switch (tinfo.os.tag) {
        .macos => {
-            libressl_libs.libcrypto.addCSourceFiles(&libcrypto_unix_sources, cflags);
-            libressl_libs.libcrypto.addCSourceFiles(&libcrypto_macos_compat, cflags);
+            libressl_libs.libcrypto.addCSourceFiles(.{ .files = &libcrypto_unix_sources, .flags = cflags });
+            libressl_libs.libcrypto.addCSourceFiles(.{ .files = &libcrypto_macos_compat, .flags = cflags });

            libressl_libs.defineCMacro("HAVE_CLOCK_GETTIME", null);
            libressl_libs.defineCMacro("HAVE_ASPRINTF", null);
@@ -154,8 +152,8 @@ pub fn libresslBuild(
            libressl_libs.defineCMacro("HAVE_NETINET_IP_H", null);
        },
        .linux => {
-            libressl_libs.libcrypto.addCSourceFiles(&libcrypto_unix_sources, cflags);
-            libressl_libs.libcrypto.addCSourceFiles(&libcrypto_linux_compat, cflags);
+            libressl_libs.libcrypto.addCSourceFiles(.{ .files = &libcrypto_unix_sources, .flags = cflags });
+            libressl_libs.libcrypto.addCSourceFiles(.{ .files = &libcrypto_linux_compat, .flags = cflags });

            libressl_libs.defineCMacro("_DEFAULT_SOURCE", null);
            libressl_libs.defineCMacro("_BSD_SOURCE", null);
@@ -183,9 +181,9 @@ pub fn libresslBuild(
            libressl_libs.defineCMacro("HAVE_NETINET_IP_H", null);

            if (tinfo.abi.isGnu()) {
-                libressl_libs.libcrypto.addCSourceFiles(&libcrypto_linux_glibc_compat, cflags);
+                libressl_libs.libcrypto.addCSourceFiles(.{ .files = &libcrypto_linux_glibc_compat, .flags = cflags });
            } else if (tinfo.abi.isMusl()) {
-                libressl_libs.libcrypto.addCSourceFiles(&libcrypto_linux_musl_compat, cflags);
+                libressl_libs.libcrypto.addCSourceFiles(.{ .files = &libcrypto_linux_musl_compat, .flags = cflags });

                libressl_libs.defineCMacro("HAVE_STRLCAT", null);
                libressl_libs.defineCMacro("HAVE_STRLCPY", null);
@@ -195,9 +193,9 @@ pub fn libresslBuild(
            libressl_libs.linkSystemLibrary("pthread");
        },
        .windows => {
-            libressl_libs.libcrypto.addCSourceFiles(&libcrypto_windows_sources, cflags);
-            libressl_libs.libcrypto.addCSourceFiles(&libcrypto_windows_compat, cflags);
-            libressl_libs.libtls.addCSourceFiles(&libtls_windows_sources, cflags);
+            libressl_libs.libcrypto.addCSourceFiles(.{ .files = &libcrypto_windows_sources, .flags = cflags });
+            libressl_libs.libcrypto.addCSourceFiles(.{ .files = &libcrypto_windows_compat, .flags = cflags });
+            libressl_libs.libtls.addCSourceFiles(.{ .files = &libtls_windows_sources, .flags = cflags });

            if (tinfo.abi != .msvc) {
                libressl_libs.defineCMacro("_GNU_SOURCE", null);
@@ -234,18 +232,16 @@ pub fn libresslBuild(
        else => @panic("unsupported target OS"),
    }

-    const conf_header = switch (tinfo.cpu.arch) {
+    const conf_header = b.path(switch (tinfo.cpu.arch) {
        .aarch64, .aarch64_be, .aarch64_32 => source_header_prefix ++ "arch/aarch64/opensslconf.h",
        .x86 => source_header_prefix ++ "arch/i386/opensslconf.h",
        .riscv64 => source_header_prefix ++ "arch/riscv64/opensslconf.h",
        .x86_64 => source_header_prefix ++ "arch/amd64/opensslconf.h",

        else => @panic("unsupported target CPU arch"),
-    };
+    });

-    libressl_libs.libcrypto.installHeader(conf_header, "openssl/opensslconf.h");
-    libressl_libs.libssl.installHeader(conf_header, "openssl/opensslconf.h");
-    libressl_libs.libtls.installHeader(conf_header, "openssl/opensslconf.h");
+    libressl_libs.installHeader(conf_header, "openssl/opensslconf.h");

    try libressl_libs.header_search(
        b,
@@ -258,15 +254,15 @@ pub fn libresslBuild(
    );

    for (libcrypto_include_paths) |path| {
-        libressl_libs.libcrypto.addIncludePath(.{ .path = path });
+        libressl_libs.libcrypto.addIncludePath(b.path(path));
    }

    for (libssl_include_paths) |path| {
-        libressl_libs.libssl.addIncludePath(.{ .path = path });
+        libressl_libs.libssl.addIncludePath(b.path(path));
    }

    for (libtls_include_paths) |path| {
-        libressl_libs.libtls.addIncludePath(.{ .path = path });
+        libressl_libs.libtls.addIncludePath(b.path(path));
    }

    switch (tinfo.cpu.arch) {
@@ -274,21 +270,25 @@ pub fn libresslBuild(
        .aarch64_be,
        .aarch64_32,
        => libressl_libs.libcrypto.addIncludePath(
-            .{ .path = libcrypto_src_prefix ++ "bn/arch/aarch64" },
+            b.path(libcrypto_src_prefix ++ "bn/arch/aarch64"),
        ),
        .x86 => libressl_libs.libcrypto.addIncludePath(
-            .{ .path = libcrypto_src_prefix ++ "bn/arch/i386" },
+            b.path(libcrypto_src_prefix ++ "bn/arch/i386"),
        ),
        .riscv64 => libressl_libs.libcrypto.addIncludePath(
-            .{ .path = libcrypto_src_prefix ++ "bn/arch/riscv64" },
+            b.path(libcrypto_src_prefix ++ "bn/arch/riscv64"),
        ),
        .x86_64 => libressl_libs.libcrypto.addIncludePath(
-            .{ .path = libcrypto_src_prefix ++ "bn/arch/amd64" },
+            b.path(libcrypto_src_prefix ++ "bn/arch/amd64"),
        ),

        else => @panic("unsupported target CPU arch"),
    }

+    const inctree = libressl_libs.libcrypto.getEmittedIncludeTree();
+    libressl_libs.libcrypto.step.dependOn(&libressl_libs.libcrypto.installed_headers_include_tree.?.step);
+    libressl_libs.libcrypto.addIncludePath(inctree);
+
    libressl_libs.libssl.linkLibrary(libressl_libs.libcrypto);

    // cmake builds libtls with libcrypto and libssl symbols jammed into it. However,
@@ -307,38 +307,9 @@ pub fn build(b: *std.Build) !void {
    const target = b.standardTargetOptions(.{});
    const optimize = b.standardOptimizeOption(.{});

-    // if (builtin.os.tag != .windows) try patchLibresslCompat(b);
    _ = try libresslBuild(b, .{ .target = target, .optimize = optimize });
 }

-// libressl_libs.defineCMacro("HAVE_ASPRINTF", null);
-// libressl_libs.defineCMacro("HAVE_REALLOCARRAY", null);
-// libressl_libs.defineCMacro("HAVE_STRCASECMP", null);
-// libressl_libs.defineCMacro("HAVE_STRLCAT", null);
-// libressl_libs.defineCMacro("HAVE_STRLCPY", null);
-// libressl_libs.defineCMacro("HAVE_STRNDUP", null);
-// libressl_libs.defineCMacro("HAVE_STRNLEN", null);
-// libressl_libs.defineCMacro("HAVE_STRSEP", null);
-// libressl_libs.defineCMacro("HAVE_STRTONUM", null);
-// libressl_libs.defineCMacro("HAVE_TIMEGM", null);
-// libressl_libs.defineCMacro("HAVE_ARC4RANDOM_BUF", null);
-// libressl_libs.defineCMacro("HAVE_ARC4RANDOM_UNIFORM", null);
-// libressl_libs.defineCMacro("HAVE_EXPLICIT_BZERO", null);
-// libressl_libs.defineCMacro("HAVE_GETAUXVAL", null);
-// libressl_libs.defineCMacro("HAVE_GETENTROPY", null);
-// libressl_libs.defineCMacro("HAVE_GETPAGESIZE", null);
-// libressl_libs.defineCMacro("HAVE_GETPROGNAME", null);
-// libressl_libs.defineCMacro("HAVE_SYSLOG_R", null);
-// libressl_libs.defineCMacro("HAVE_SYSLOG", null);
-// libressl_libs.defineCMacro("HAVE_TIMESPECSUB", null);
-// libressl_libs.defineCMacro("HAVE_TIMINGSAFE_BCMP", null);
-// libressl_libs.defineCMacro("HAVE_MEMCMP", null);
-// libressl_libs.defineCMacro("HAVE_MEMMEM", null);
-// libressl_libs.defineCMacro("HAVE_ENDIAN_H", null);
-// libressl_libs.defineCMacro("HAVE_MACHINE_ENDIAN_H", null);
-// libressl_libs.defineCMacro("HAVE_ERR_H", null);
-// libressl_libs.defineCMacro("HAVE_NETINET_IP_H", null);
-
 const SkipSpec = union(enum) {
    starts_with: []const u8,
    ends_with: []const u8,
@@ -475,48 +446,6 @@ const libcrypto_windows_compat = [_][]const u8{
    libcrypto_src_prefix ++ "compat/timingsafe_memcmp.c",
 };

-// const libcrypto_compat_sources = [_][]const u8{
-//     libcrypto_src_prefix ++ "compat/bsd-asprintf.c",
-//     libcrypto_src_prefix ++ "compat/freezero.c",
-//     libcrypto_src_prefix ++ "compat/getpagesize.c",
-
-//     libcrypto_src_prefix ++ "compat/getprogname_windows.c",
-//     libcrypto_src_prefix ++ "compat/getprogname_linux.c",
-//     libcrypto_src_prefix ++ "compat/getprogname_unimpl.c",
-
-//     libcrypto_src_prefix ++ "compat/reallocarray.c",
-//     libcrypto_src_prefix ++ "compat/recallocarray.c",
-
-//     libcrypto_src_prefix ++ "compat/strcasecmp.c",
-//     libcrypto_src_prefix ++ "compat/strlcat.c",
-//     libcrypto_src_prefix ++ "compat/strlcpy.c",
-//     libcrypto_src_prefix ++ "compat/strndup.c",
-//     libcrypto_src_prefix ++ "compat/strnlen.c",
-//     libcrypto_src_prefix ++ "compat/strsep.c",
-//     libcrypto_src_prefix ++ "compat/strtonum.c",
-
-//     libcrypto_src_prefix ++ "compat/syslog_r.c",
-//     libcrypto_src_prefix ++ "compat/timegm.c",
-
-//     libcrypto_src_prefix ++ "compat/explicit_bzero_win.c",
-//     libcrypto_src_prefix ++ "compat/explicit_bzero.c",
-
-//     libcrypto_src_prefix ++ "compat/arc4random.c",
-//     libcrypto_src_prefix ++ "compat/arc4random_uniform.c",
-
-//     libcrypto_src_prefix ++ "compat/getentropy_win.c",
-//     libcrypto_src_prefix ++ "compat/getentropy_aix.c",
-//     libcrypto_src_prefix ++ "compat/getentropy_freebsd.c",
-//     libcrypto_src_prefix ++ "compat/getentropy_hpux.c",
-//     libcrypto_src_prefix ++ "compat/getentropy_linux.c",
-//     libcrypto_src_prefix ++ "compat/getentropy_netbsd.c",
-//     libcrypto_src_prefix ++ "compat/getentropy_osx.c",
-//     libcrypto_src_prefix ++ "compat/getentropy_solaris.c",
-
-//     libcrypto_src_prefix ++ "compat/timingsafe_bcmp.c",
-//     libcrypto_src_prefix ++ "compat/timingsafe_memcmp.c",
-// };
-
 const libcrypto_sources = [_][]const u8{
    libcrypto_src_prefix ++ "cpt_err.c",
    libcrypto_src_prefix ++ "cryptlib.c",
--- a/crypto/CMakeLists.txt
+++ b/crypto/CMakeLists.txt
@@ -111,7 +111,6 @@ if(HOST_ASM_MACOSX_X86_64)
 		bn/arch/amd64/word_clz.S
 		bn/arch/amd64/bn_arch.c
 	)
-	add_definitions(-Dendbr64=)
 	add_definitions(-DAES_ASM)
 	add_definitions(-DBSAES_ASM)
 	add_definitions(-DVPAES_ASM)
@@ -153,6 +152,7 @@ if(HOST_ASM_MASM_X86_64)
 		whrlpool/wp-masm-x86_64.S
 		cpuid-masm-x86_64.S
 	)
+	add_definitions(-Dendbr64=)
 	add_definitions(-DAES_ASM)
 	add_definitions(-DBSAES_ASM)
 	add_definitions(-DVPAES_ASM)
@@ -193,6 +193,7 @@ if(HOST_ASM_MINGW64_X86_64)
 		whrlpool/wp-mingw64-x86_64.S
 		cpuid-mingw64-x86_64.S
 	)
+	add_definitions(-Dendbr64=)
 	add_definitions(-DAES_ASM)
 	add_definitions(-DBSAES_ASM)
 	add_definitions(-DVPAES_ASM)
@@ -778,6 +779,8 @@ endif()
 if(NOT HAVE_GETOPT)
 	set(CRYPTO_SRC ${CRYPTO_SRC} compat/getopt_long.c)
 	set(EXTRA_EXPORT ${EXTRA_EXPORT} getopt)
+	set(EXTRA_EXPORT ${EXTRA_EXPORT} optarg)
+	set(EXTRA_EXPORT ${EXTRA_EXPORT} optind)
 endif()

 if(NOT HAVE_GETPAGESIZE)
--- a/crypto/Makefile.am
+++ b/crypto/Makefile.am
@@ -36,6 +36,7 @@ EXTRA_DIST += empty.c

 # needed for a CMake target
 EXTRA_DIST += compat/strcasecmp.c
+EXTRA_DIST += compat/getopt_long.c

 BUILT_SOURCES = crypto_portable.sym
 CLEANFILES = crypto_portable.sym
--- a/crypto/Makefile.am.macosx-x86_64
+++ b/crypto/Makefile.am.macosx-x86_64
@@ -34,7 +34,6 @@ ASM_X86_64_MACOSX += bn/arch/amd64/bn_arch.c
 EXTRA_DIST += $(ASM_X86_64_MACOSX)

 if HOST_ASM_MACOSX_X86_64
-libcrypto_la_CPPFLAGS += -Dendbr64=
 libcrypto_la_CPPFLAGS += -DAES_ASM
 libcrypto_la_CPPFLAGS += -DBSAES_ASM
 libcrypto_la_CPPFLAGS += -DVPAES_ASM
--- a/crypto/compat/ui_openssl_win.c
+++ b/crypto/compat/ui_openssl_win.c
@@ -139,9 +139,6 @@ static int is_a_tty;

 /* Declare static functions */
 static int read_till_nl(FILE *);
-static void recsig(int);
-static void pushsig(void);
-static void popsig(void);
 static int read_string_inner(UI *ui, UI_STRING *uis, int echo, int strip_nl);

 static int read_string(UI *ui, UI_STRING *uis);
@@ -236,8 +233,6 @@ read_till_nl(FILE *in)
 	return 1;
 }

-static volatile sig_atomic_t intr_signal;
-
 static int
 read_string_inner(UI *ui, UI_STRING *uis, int echo, int strip_nl)
 {
@@ -247,12 +242,9 @@ read_string_inner(UI *ui, UI_STRING *uis, int echo, int strip_nl)
 	int maxsize = BUFSIZ - 1;
 	char *p;

-	intr_signal = 0;
 	ok = 0;
 	ps = 0;

-	pushsig();
-
 	ps = 1;

 	if (!echo && !noecho_console(ui))
@@ -276,16 +268,11 @@ read_string_inner(UI *ui, UI_STRING *uis, int echo, int strip_nl)
 		ok = 1;

 error:
-	if (intr_signal == SIGINT)
-		ok = -1;
 	if (!echo)
 		fprintf(tty_out, "\n");
 	if (ps >= 2 && !echo && !echo_console(ui))
 		ok = 0;

-	if (ps >= 1)
-		popsig();
-
 	explicit_bzero(result, BUFSIZ);
 	return ok;
 }
@@ -348,32 +335,3 @@ close_console(UI *ui)

 	return 1;
 }
-
-/* Internal functions to handle signals and act on them */
-static void
-pushsig(void)
-{
-	savsig[SIGABRT] = signal(SIGABRT, recsig);
-	savsig[SIGFPE]  = signal(SIGFPE,  recsig);
-	savsig[SIGILL]  = signal(SIGILL,  recsig);
-	savsig[SIGINT]  = signal(SIGINT,  recsig);
-	savsig[SIGSEGV] = signal(SIGSEGV, recsig);
-	savsig[SIGTERM] = signal(SIGTERM, recsig);
-}
-
-static void
-popsig(void)
-{
-	signal(SIGABRT, savsig[SIGABRT]);
-	signal(SIGFPE,  savsig[SIGFPE]);
-	signal(SIGILL,  savsig[SIGILL]);
-	signal(SIGINT,  savsig[SIGINT]);
-	signal(SIGSEGV, savsig[SIGSEGV]);
-	signal(SIGTERM, savsig[SIGTERM]);
-}
-
-static void
-recsig(int i)
-{
-	intr_signal = i;
-}
--- a/include/Makefile.am
+++ b/include/Makefile.am
@@ -10,6 +10,7 @@ noinst_HEADERS += compat/dirent_msvc.h
 noinst_HEADERS += compat/endian.h
 noinst_HEADERS += compat/err.h
 noinst_HEADERS += compat/fcntl.h
+noinst_HEADERS += compat/getopt.h
 noinst_HEADERS += compat/limits.h
 noinst_HEADERS += compat/netdb.h
 noinst_HEADERS += compat/poll.h
--- a/include/compat/time.h
+++ b/include/compat/time.h
@@ -3,6 +3,14 @@
 * sys/time.h compatibility shim
 */

+#ifndef SIZEOF_TIME_T
+#ifdef SMALL_TIME_T
+#define SIZEOF_TIME_T 4
+#else
+#define SIZEOF_TIME_T 8
+#endif
+#endif
+
 #ifdef _MSC_VER
 #if _MSC_VER >= 1900
 #include <../ucrt/time.h>
--- a/include/compat/unistd.h
+++ b/include/compat/unistd.h
@@ -23,6 +23,7 @@ ssize_t pwrite(int d, const void *buf, size_t nbytes, off_t offset);
 #include <io.h>
 #include <process.h>

+#define STDIN_FILENO    0
 #define STDOUT_FILENO   1
 #define STDERR_FILENO   2

@@ -65,7 +66,7 @@ int getentropy(void *buf, size_t buflen);
 #endif

 #ifndef HAVE_GETOPT
-#include <getopt.h>
+#include "getopt.h"
 #endif

 #ifndef HAVE_GETPAGESIZE
--- a/m4/check-os-options.m4
+++ b/m4/check-os-options.m4
@@ -61,9 +61,15 @@ char buf[1]; getentropy(buf, 1);
 	*freebsd*)
 		HOST_OS=freebsd
 		HOST_ABI=elf
-		# fork detection missing, weak seed on failure
-		# https://svnweb.freebsd.org/base/head/lib/libc/gen/arc4random.c?revision=268642&view=markup
-		USE_BUILTIN_ARC4RANDOM=yes
+		AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
+#include <sys/param.h>
+#if __FreeBSD_version < 1200000
+        undefined
+#endif
+                       ]], [[]])],
+                       [ USE_BUILTIN_ARC4RANDOM=no ],
+                       [ USE_BUILTIN_ARC4RANDOM=yes ]
+		)
 		AC_SUBST([PROG_LDADD], ['-lthr'])
 		;;
 	*hpux*)
--- a/man/links
+++ b/man/links
@@ -6,6 +6,9 @@ AES_encrypt.3,AES_cbc_encrypt.3
 AES_encrypt.3,AES_decrypt.3
 AES_encrypt.3,AES_set_decrypt_key.3
 AES_encrypt.3,AES_set_encrypt_key.3
+ASIdentifiers_new.3,ASIdentifiers_free.3
+ASIdentifiers_new.3,d2i_ASIdentifiers.3
+ASIdentifiers_new.3,i2d_ASIdentifiers.3
 ASN1_BIT_STRING_set.3,ASN1_BIT_STRING_get_bit.3
 ASN1_BIT_STRING_set.3,ASN1_BIT_STRING_set_bit.3
 ASN1_INTEGER_get.3,ASN1_ENUMERATED_get.3
@@ -137,6 +140,17 @@ ASN1_put_object.3,ASN1_object_size.3
 ASN1_put_object.3,ASN1_put_eoc.3
 ASN1_time_parse.3,ASN1_TIME_set_tm.3
 ASN1_time_parse.3,ASN1_time_tm_cmp.3
+ASRange_new.3,ASIdOrRange_free.3
+ASRange_new.3,ASIdOrRange_new.3
+ASRange_new.3,ASIdentifierChoice_free.3
+ASRange_new.3,ASIdentifierChoice_new.3
+ASRange_new.3,ASRange_free.3
+ASRange_new.3,d2i_ASIdOrRange.3
+ASRange_new.3,d2i_ASIdentifierChoice.3
+ASRange_new.3,d2i_ASRange.3
+ASRange_new.3,i2d_ASIdOrRange.3
+ASRange_new.3,i2d_ASIdentifierChoice.3
+ASRange_new.3,i2d_ASRange.3
 AUTHORITY_KEYID_new.3,AUTHORITY_KEYID_free.3
 BASIC_CONSTRAINTS_new.3,BASIC_CONSTRAINTS_free.3
 BF_set_key.3,BF_cbc_encrypt.3
@@ -869,8 +883,23 @@ EVP_AEAD_CTX_init.3,EVP_aead_aes_128_gcm.3
 EVP_AEAD_CTX_init.3,EVP_aead_aes_256_gcm.3
 EVP_AEAD_CTX_init.3,EVP_aead_chacha20_poly1305.3
 EVP_AEAD_CTX_init.3,EVP_aead_xchacha20_poly1305.3
+EVP_CIPHER_CTX_ctrl.3,EVP_CIPHER_CTX_get_iv.3
+EVP_CIPHER_CTX_ctrl.3,EVP_CIPHER_CTX_iv_length.3
+EVP_CIPHER_CTX_ctrl.3,EVP_CIPHER_CTX_key_length.3
+EVP_CIPHER_CTX_ctrl.3,EVP_CIPHER_CTX_set_iv.3
+EVP_CIPHER_CTX_ctrl.3,EVP_CIPHER_CTX_set_key_length.3
+EVP_CIPHER_CTX_ctrl.3,EVP_CIPHER_CTX_set_padding.3
+EVP_CIPHER_CTX_ctrl.3,EVP_CIPHER_iv_length.3
+EVP_CIPHER_CTX_ctrl.3,EVP_CIPHER_key_length.3
 EVP_CIPHER_CTX_get_cipher_data.3,EVP_CIPHER_CTX_buf_noconst.3
 EVP_CIPHER_CTX_get_cipher_data.3,EVP_CIPHER_CTX_set_cipher_data.3
+EVP_CIPHER_CTX_set_flags.3,EVP_CIPHER_CTX_clear_flags.3
+EVP_CIPHER_CTX_set_flags.3,EVP_CIPHER_CTX_get_app_data.3
+EVP_CIPHER_CTX_set_flags.3,EVP_CIPHER_CTX_rand_key.3
+EVP_CIPHER_CTX_set_flags.3,EVP_CIPHER_CTX_set_app_data.3
+EVP_CIPHER_CTX_set_flags.3,EVP_CIPHER_CTX_test_flags.3
+EVP_CIPHER_CTX_set_flags.3,EVP_CIPHER_asn1_to_param.3
+EVP_CIPHER_CTX_set_flags.3,EVP_CIPHER_param_to_asn1.3
 EVP_CIPHER_do_all.3,EVP_CIPHER_do_all_sorted.3
 EVP_CIPHER_do_all.3,EVP_MD_do_all.3
 EVP_CIPHER_do_all.3,EVP_MD_do_all_sorted.3
@@ -885,37 +914,31 @@ EVP_CIPHER_meth_new.3,EVP_CIPHER_meth_set_impl_ctx_size.3
 EVP_CIPHER_meth_new.3,EVP_CIPHER_meth_set_init.3
 EVP_CIPHER_meth_new.3,EVP_CIPHER_meth_set_iv_length.3
 EVP_CIPHER_meth_new.3,EVP_CIPHER_meth_set_set_asn1_params.3
+EVP_CIPHER_nid.3,EVP_CIPHER_CTX_block_size.3
+EVP_CIPHER_nid.3,EVP_CIPHER_CTX_flags.3
+EVP_CIPHER_nid.3,EVP_CIPHER_CTX_mode.3
+EVP_CIPHER_nid.3,EVP_CIPHER_CTX_nid.3
+EVP_CIPHER_nid.3,EVP_CIPHER_CTX_type.3
+EVP_CIPHER_nid.3,EVP_CIPHER_block_size.3
+EVP_CIPHER_nid.3,EVP_CIPHER_flags.3
+EVP_CIPHER_nid.3,EVP_CIPHER_mode.3
+EVP_CIPHER_nid.3,EVP_CIPHER_name.3
+EVP_CIPHER_nid.3,EVP_CIPHER_type.3
 EVP_DigestInit.3,EVP_Digest.3
 EVP_DigestInit.3,EVP_DigestFinal.3
 EVP_DigestInit.3,EVP_DigestFinal_ex.3
 EVP_DigestInit.3,EVP_DigestInit_ex.3
 EVP_DigestInit.3,EVP_DigestUpdate.3
-EVP_DigestInit.3,EVP_MAX_MD_SIZE.3
-EVP_DigestInit.3,EVP_MD_CTX_block_size.3
 EVP_DigestInit.3,EVP_MD_CTX_cleanup.3
-EVP_DigestInit.3,EVP_MD_CTX_clear_flags.3
 EVP_DigestInit.3,EVP_MD_CTX_copy.3
 EVP_DigestInit.3,EVP_MD_CTX_copy_ex.3
 EVP_DigestInit.3,EVP_MD_CTX_create.3
-EVP_DigestInit.3,EVP_MD_CTX_ctrl.3
 EVP_DigestInit.3,EVP_MD_CTX_destroy.3
 EVP_DigestInit.3,EVP_MD_CTX_free.3
 EVP_DigestInit.3,EVP_MD_CTX_init.3
 EVP_DigestInit.3,EVP_MD_CTX_md.3
-EVP_DigestInit.3,EVP_MD_CTX_md_data.3
 EVP_DigestInit.3,EVP_MD_CTX_new.3
-EVP_DigestInit.3,EVP_MD_CTX_pkey_ctx.3
 EVP_DigestInit.3,EVP_MD_CTX_reset.3
-EVP_DigestInit.3,EVP_MD_CTX_set_flags.3
-EVP_DigestInit.3,EVP_MD_CTX_set_pkey_ctx.3
-EVP_DigestInit.3,EVP_MD_CTX_size.3
-EVP_DigestInit.3,EVP_MD_CTX_test_flags.3
-EVP_DigestInit.3,EVP_MD_CTX_type.3
-EVP_DigestInit.3,EVP_MD_block_size.3
-EVP_DigestInit.3,EVP_MD_flags.3
-EVP_DigestInit.3,EVP_MD_pkey_type.3
-EVP_DigestInit.3,EVP_MD_size.3
-EVP_DigestInit.3,EVP_MD_type.3
 EVP_DigestInit.3,EVP_get_digestbyname.3
 EVP_DigestInit.3,EVP_get_digestbynid.3
 EVP_DigestInit.3,EVP_get_digestbyobj.3
@@ -942,41 +965,14 @@ EVP_EncodeInit.3,EVP_ENCODE_CTX_new.3
 EVP_EncodeInit.3,EVP_EncodeBlock.3
 EVP_EncodeInit.3,EVP_EncodeFinal.3
 EVP_EncodeInit.3,EVP_EncodeUpdate.3
-EVP_EncryptInit.3,EVP_CIPHER_CTX_block_size.3
 EVP_EncryptInit.3,EVP_CIPHER_CTX_cipher.3
 EVP_EncryptInit.3,EVP_CIPHER_CTX_cleanup.3
-EVP_EncryptInit.3,EVP_CIPHER_CTX_clear_flags.3
 EVP_EncryptInit.3,EVP_CIPHER_CTX_copy.3
-EVP_EncryptInit.3,EVP_CIPHER_CTX_ctrl.3
 EVP_EncryptInit.3,EVP_CIPHER_CTX_encrypting.3
-EVP_EncryptInit.3,EVP_CIPHER_CTX_flags.3
 EVP_EncryptInit.3,EVP_CIPHER_CTX_free.3
-EVP_EncryptInit.3,EVP_CIPHER_CTX_get_app_data.3
-EVP_EncryptInit.3,EVP_CIPHER_CTX_get_iv.3
 EVP_EncryptInit.3,EVP_CIPHER_CTX_init.3
-EVP_EncryptInit.3,EVP_CIPHER_CTX_iv_length.3
-EVP_EncryptInit.3,EVP_CIPHER_CTX_key_length.3
-EVP_EncryptInit.3,EVP_CIPHER_CTX_mode.3
 EVP_EncryptInit.3,EVP_CIPHER_CTX_new.3
-EVP_EncryptInit.3,EVP_CIPHER_CTX_nid.3
-EVP_EncryptInit.3,EVP_CIPHER_CTX_rand_key.3
 EVP_EncryptInit.3,EVP_CIPHER_CTX_reset.3
-EVP_EncryptInit.3,EVP_CIPHER_CTX_set_app_data.3
-EVP_EncryptInit.3,EVP_CIPHER_CTX_set_flags.3
-EVP_EncryptInit.3,EVP_CIPHER_CTX_set_iv.3
-EVP_EncryptInit.3,EVP_CIPHER_CTX_set_key_length.3
-EVP_EncryptInit.3,EVP_CIPHER_CTX_set_padding.3
-EVP_EncryptInit.3,EVP_CIPHER_CTX_test_flags.3
-EVP_EncryptInit.3,EVP_CIPHER_CTX_type.3
-EVP_EncryptInit.3,EVP_CIPHER_asn1_to_param.3
-EVP_EncryptInit.3,EVP_CIPHER_block_size.3
-EVP_EncryptInit.3,EVP_CIPHER_flags.3
-EVP_EncryptInit.3,EVP_CIPHER_iv_length.3
-EVP_EncryptInit.3,EVP_CIPHER_key_length.3
-EVP_EncryptInit.3,EVP_CIPHER_mode.3
-EVP_EncryptInit.3,EVP_CIPHER_nid.3
-EVP_EncryptInit.3,EVP_CIPHER_param_to_asn1.3
-EVP_EncryptInit.3,EVP_CIPHER_type.3
 EVP_EncryptInit.3,EVP_Cipher.3
 EVP_EncryptInit.3,EVP_CipherFinal.3
 EVP_EncryptInit.3,EVP_CipherFinal_ex.3
@@ -1018,6 +1014,12 @@ EVP_EncryptInit.3,EVP_rc2_cfb.3
 EVP_EncryptInit.3,EVP_rc2_cfb64.3
 EVP_EncryptInit.3,EVP_rc2_ecb.3
 EVP_EncryptInit.3,EVP_rc2_ofb.3
+EVP_MD_CTX_ctrl.3,EVP_MD_CTX_clear_flags.3
+EVP_MD_CTX_ctrl.3,EVP_MD_CTX_md_data.3
+EVP_MD_CTX_ctrl.3,EVP_MD_CTX_pkey_ctx.3
+EVP_MD_CTX_ctrl.3,EVP_MD_CTX_set_flags.3
+EVP_MD_CTX_ctrl.3,EVP_MD_CTX_set_pkey_ctx.3
+EVP_MD_CTX_ctrl.3,EVP_MD_CTX_test_flags.3
 EVP_MD_meth_new.3,EVP_MD_meth_dup.3
 EVP_MD_meth_new.3,EVP_MD_meth_free.3
 EVP_MD_meth_new.3,EVP_MD_meth_set_app_datasize.3
@@ -1030,6 +1032,15 @@ EVP_MD_meth_new.3,EVP_MD_meth_set_init.3
 EVP_MD_meth_new.3,EVP_MD_meth_set_input_blocksize.3
 EVP_MD_meth_new.3,EVP_MD_meth_set_result_size.3
 EVP_MD_meth_new.3,EVP_MD_meth_set_update.3
+EVP_MD_nid.3,EVP_MD_CTX_block_size.3
+EVP_MD_nid.3,EVP_MD_CTX_size.3
+EVP_MD_nid.3,EVP_MD_CTX_type.3
+EVP_MD_nid.3,EVP_MD_block_size.3
+EVP_MD_nid.3,EVP_MD_flags.3
+EVP_MD_nid.3,EVP_MD_name.3
+EVP_MD_nid.3,EVP_MD_pkey_type.3
+EVP_MD_nid.3,EVP_MD_size.3
+EVP_MD_nid.3,EVP_MD_type.3
 EVP_OpenInit.3,EVP_OpenFinal.3
 EVP_OpenInit.3,EVP_OpenUpdate.3
 EVP_PKCS82PKEY.3,EVP_PKEY2PKCS8.3
@@ -1054,6 +1065,7 @@ EVP_PKEY_CTX_ctrl.3,EVP_PKEY_CTX_set_ecdh_kdf_md.3
 EVP_PKEY_CTX_ctrl.3,EVP_PKEY_CTX_set_ecdh_kdf_outlen.3
 EVP_PKEY_CTX_ctrl.3,EVP_PKEY_CTX_set_ecdh_kdf_type.3
 EVP_PKEY_CTX_ctrl.3,EVP_PKEY_CTX_set_signature_md.3
+EVP_PKEY_CTX_get_operation.3,EVP_PKEY_CTX_get0_pkey.3
 EVP_PKEY_CTX_new.3,EVP_PKEY_CTX_dup.3
 EVP_PKEY_CTX_new.3,EVP_PKEY_CTX_free.3
 EVP_PKEY_CTX_new.3,EVP_PKEY_CTX_new_id.3
@@ -1093,18 +1105,22 @@ EVP_PKEY_cmp.3,EVP_PKEY_cmp_parameters.3
 EVP_PKEY_cmp.3,EVP_PKEY_copy_parameters.3
 EVP_PKEY_cmp.3,EVP_PKEY_missing_parameters.3
 EVP_PKEY_decrypt.3,EVP_PKEY_decrypt_init.3
+EVP_PKEY_derive.3,EVP_PKEY_CTX_get0_peerkey.3
 EVP_PKEY_derive.3,EVP_PKEY_derive_init.3
 EVP_PKEY_derive.3,EVP_PKEY_derive_set_peer.3
 EVP_PKEY_encrypt.3,EVP_PKEY_encrypt_init.3
 EVP_PKEY_keygen.3,EVP_PKEY_CTX_get_app_data.3
 EVP_PKEY_keygen.3,EVP_PKEY_CTX_get_cb.3
 EVP_PKEY_keygen.3,EVP_PKEY_CTX_get_keygen_info.3
+EVP_PKEY_keygen.3,EVP_PKEY_CTX_set0_keygen_info.3
 EVP_PKEY_keygen.3,EVP_PKEY_CTX_set_app_data.3
 EVP_PKEY_keygen.3,EVP_PKEY_CTX_set_cb.3
 EVP_PKEY_keygen.3,EVP_PKEY_gen_cb.3
 EVP_PKEY_keygen.3,EVP_PKEY_keygen_init.3
 EVP_PKEY_keygen.3,EVP_PKEY_paramgen.3
 EVP_PKEY_keygen.3,EVP_PKEY_paramgen_init.3
+EVP_PKEY_meth_new.3,EVP_PKEY_CTX_get_data.3
+EVP_PKEY_meth_new.3,EVP_PKEY_CTX_set_data.3
 EVP_PKEY_meth_new.3,EVP_PKEY_meth_add0.3
 EVP_PKEY_meth_new.3,EVP_PKEY_meth_copy.3
 EVP_PKEY_meth_new.3,EVP_PKEY_meth_find.3
@@ -1288,6 +1304,21 @@ HMAC.3,HMAC_Init.3
 HMAC.3,HMAC_Init_ex.3
 HMAC.3,HMAC_Update.3
 HMAC.3,HMAC_size.3
+IPAddressRange_new.3,IPAddressChoice_free.3
+IPAddressRange_new.3,IPAddressChoice_new.3
+IPAddressRange_new.3,IPAddressFamily_free.3
+IPAddressRange_new.3,IPAddressFamily_new.3
+IPAddressRange_new.3,IPAddressOrRange_free.3
+IPAddressRange_new.3,IPAddressOrRange_new.3
+IPAddressRange_new.3,IPAddressRange_free.3
+IPAddressRange_new.3,d2i_IPAddressChoice.3
+IPAddressRange_new.3,d2i_IPAddressFamily.3
+IPAddressRange_new.3,d2i_IPAddressOrRange.3
+IPAddressRange_new.3,d2i_IPAddressRange.3
+IPAddressRange_new.3,i2d_IPAddressChoice.3
+IPAddressRange_new.3,i2d_IPAddressFamily.3
+IPAddressRange_new.3,i2d_IPAddressOrRange.3
+IPAddressRange_new.3,i2d_IPAddressRange.3
 MD5.3,MD4.3
 MD5.3,MD4_Final.3
 MD5.3,MD4_Init.3
@@ -1424,6 +1455,7 @@ OPENSSL_sk_new.3,sk_zero.3
 OpenSSL_add_all_algorithms.3,EVP_cleanup.3
 OpenSSL_add_all_algorithms.3,OpenSSL_add_all_ciphers.3
 OpenSSL_add_all_algorithms.3,OpenSSL_add_all_digests.3
+OpenSSL_add_all_algorithms.3,SSLeay_add_all_algorithms.3
 PEM_ASN1_read.3,PEM_ASN1_read_bio.3
 PEM_ASN1_read.3,d2i_of_void.3
 PEM_X509_INFO_read.3,PEM_X509_INFO_read_bio.3
@@ -1610,9 +1642,6 @@ RSA_get0_key.3,RSA_set0_factors.3
 RSA_get0_key.3,RSA_set0_key.3
 RSA_get0_key.3,RSA_set_flags.3
 RSA_get0_key.3,RSA_test_flags.3
-RSA_get_ex_new_index.3,CRYPTO_EX_dup.3
-RSA_get_ex_new_index.3,CRYPTO_EX_free.3
-RSA_get_ex_new_index.3,CRYPTO_EX_new.3
 RSA_get_ex_new_index.3,RSA_get_ex_data.3
 RSA_get_ex_new_index.3,RSA_set_ex_data.3
 RSA_meth_new.3,RSA_meth_dup.3
@@ -1679,6 +1708,8 @@ RSA_print.3,DSAparams_print.3
 RSA_print.3,DSAparams_print_fp.3
 RSA_print.3,RSA_print_fp.3
 RSA_private_encrypt.3,RSA_public_decrypt.3
+RSA_public_encrypt.3,EVP_PKEY_decrypt_old.3
+RSA_public_encrypt.3,EVP_PKEY_encrypt_old.3
 RSA_public_encrypt.3,RSA_private_decrypt.3
 RSA_security_bits.3,BN_security_bits.3
 RSA_security_bits.3,DH_security_bits.3
@@ -1814,7 +1845,6 @@ SSL_CTX_set_client_cert_cb.3,client_cert_cb.3
 SSL_CTX_set_default_passwd_cb.3,SSL_CTX_get_default_passwd_cb.3
 SSL_CTX_set_default_passwd_cb.3,SSL_CTX_get_default_passwd_cb_userdata.3
 SSL_CTX_set_default_passwd_cb.3,SSL_CTX_set_default_passwd_cb_userdata.3
-SSL_CTX_set_default_passwd_cb.3,pem_password_cb.3
 SSL_CTX_set_generate_session_id.3,GEN_SESSION_CB.3
 SSL_CTX_set_generate_session_id.3,SSL_has_matching_session_id.3
 SSL_CTX_set_generate_session_id.3,SSL_set_generate_session_id.3
@@ -2446,6 +2476,19 @@ X509at_get_attr.3,X509at_get0_data_by_OBJ.3
 X509at_get_attr.3,X509at_get_attr_by_NID.3
 X509at_get_attr.3,X509at_get_attr_by_OBJ.3
 X509at_get_attr.3,X509at_get_attr_count.3
+X509v3_addr_add_inherit.3,X509v3_addr_add_prefix.3
+X509v3_addr_add_inherit.3,X509v3_addr_add_range.3
+X509v3_addr_add_inherit.3,X509v3_addr_canonize.3
+X509v3_addr_add_inherit.3,X509v3_addr_is_canonical.3
+X509v3_addr_get_range.3,X509v3_addr_get_afi.3
+X509v3_addr_inherits.3,X509v3_asid_inherits.3
+X509v3_addr_subset.3,X509v3_asid_subset.3
+X509v3_addr_validate_path.3,X509v3_addr_validate_resource_set.3
+X509v3_addr_validate_path.3,X509v3_asid_validate_path.3
+X509v3_addr_validate_path.3,X509v3_asid_validate_resource_set.3
+X509v3_asid_add_id_or_range.3,X509v3_asid_add_inherit.3
+X509v3_asid_add_id_or_range.3,X509v3_asid_canonize.3
+X509v3_asid_add_id_or_range.3,X509v3_asid_is_canonical.3
 X509v3_get_ext_by_NID.3,X509_CRL_add_ext.3
 X509v3_get_ext_by_NID.3,X509_CRL_delete_ext.3
 X509v3_get_ext_by_NID.3,X509_CRL_get_ext.3
@@ -2816,9 +2859,10 @@ d2i_X509_SIG.3,d2i_PKCS8_fp.3
 d2i_X509_SIG.3,i2d_PKCS8_bio.3
 d2i_X509_SIG.3,i2d_PKCS8_fp.3
 d2i_X509_SIG.3,i2d_X509_SIG.3
+des_read_pw.3,EVP_get_pw_prompt.3
 des_read_pw.3,EVP_read_pw_string.3
 des_read_pw.3,EVP_read_pw_string_min.3
-des_read_pw.3,des_read_pw_string.3
+des_read_pw.3,EVP_set_pw_prompt.3
 i2a_ASN1_STRING.3,a2i_ASN1_ENUMERATED.3
 i2a_ASN1_STRING.3,a2i_ASN1_INTEGER.3
 i2a_ASN1_STRING.3,a2i_ASN1_STRING.3
@@ -2922,7 +2966,6 @@ tls_ocsp_process_response.3,tls_peer_ocsp_url.3
 tls_read.3,tls_close.3
 tls_read.3,tls_error.3
 tls_read.3,tls_handshake.3
-tls_read.3,tls_reset.3
 tls_read.3,tls_write.3
 x509_verify.3,x509_verify_ctx_chain.3
 x509_verify.3,x509_verify_ctx_error_depth.3
--- a/patches/asm/0001-Revert-Add-endbr64-where-needed-by-inspection.-Passe.patch
+++ b/patches/asm/0001-Revert-Add-endbr64-where-needed-by-inspection.-Passe.patch
--- a/patches/asm/0002-Revert-Use-explicit-.text-instead-of-.previous-to-pl.patch
+++ b/patches/asm/0002-Revert-Use-explicit-.text-instead-of-.previous-to-pl.patch
@@ -0,0 +1,162 @@
+From 8861777e025998cc80bb9e39e88a332e8aec2f26 Mon Sep 17 00:00:00 2001
+From: Brent Cook <busterb@gmail.com>
+Date: Mon, 30 Oct 2023 22:00:12 -0500
+Subject: [PATCH 2/4] Revert "Use explicit .text instead of .previous to please
+ Windows/MinGW on amd64"
+
+This reverts commit e8192f57c4e5910ce7badced4a24c8827810d567.
+---
+ src/lib/libcrypto/aes/asm/aes-x86_64.pl        | 2 +-
+ src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl | 2 +-
+ src/lib/libcrypto/aes/asm/aesni-x86_64.pl      | 2 +-
+ src/lib/libcrypto/aes/asm/bsaes-x86_64.pl      | 2 +-
+ src/lib/libcrypto/aes/asm/vpaes-x86_64.pl      | 2 +-
+ src/lib/libcrypto/bn/asm/x86_64-mont5.pl       | 2 +-
+ src/lib/libcrypto/camellia/asm/cmll-x86_64.pl  | 2 +-
+ src/lib/libcrypto/modes/asm/ghash-x86_64.pl    | 2 +-
+ src/lib/libcrypto/sha/asm/sha1-x86_64.pl       | 2 +-
+ src/lib/libcrypto/sha/asm/sha512-x86_64.pl     | 4 ++--
+ 10 files changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/src/lib/libcrypto/aes/asm/aes-x86_64.pl b/src/lib/libcrypto/aes/asm/aes-x86_64.pl
+index b7399b552..2986a9fcc 100755
+--- a/src/lib/libcrypto/aes/asm/aes-x86_64.pl
+++ b/src/lib/libcrypto/aes/asm/aes-x86_64.pl
+@@ -2535,7 +2535,7 @@ $code.=<<___;
+ 	.long	0x80808080, 0x80808080, 0xfefefefe, 0xfefefefe
+ 	.long	0x1b1b1b1b, 0x1b1b1b1b, 0, 0
+ .align	64
+-.text
+.previous
+ ___
+ 
+ # EXCEPTION_DISPOSITION handler (EXCEPTION_RECORD *rec,ULONG64 frame,
+diff --git a/src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl b/src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl
+index bafa906a0..8a428c9b1 100644
+--- a/src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl
+++ b/src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl
+@@ -1084,7 +1084,7 @@ K_XX_XX:
+ .long	0xca62c1d6,0xca62c1d6,0xca62c1d6,0xca62c1d6	# K_60_79
+ .long	0x00010203,0x04050607,0x08090a0b,0x0c0d0e0f	# pbswap mask
+ .align	64
+-.text
+.previous
+ ___
+ 
+ # EXCEPTION_DISPOSITION handler (EXCEPTION_RECORD *rec,ULONG64 frame,
+diff --git a/src/lib/libcrypto/aes/asm/aesni-x86_64.pl b/src/lib/libcrypto/aes/asm/aesni-x86_64.pl
+index e662fbc7c..09612b1f8 100644
+--- a/src/lib/libcrypto/aes/asm/aesni-x86_64.pl
+++ b/src/lib/libcrypto/aes/asm/aesni-x86_64.pl
+@@ -2732,7 +2732,7 @@ $code.=<<___;
+ .Lxts_magic:
+ 	.long	0x87,0,1,0
+ .align	64
+-.text
+.previous
+ ___
+ 
+ # EXCEPTION_DISPOSITION handler (EXCEPTION_RECORD *rec,ULONG64 frame,
+diff --git a/src/lib/libcrypto/aes/asm/bsaes-x86_64.pl b/src/lib/libcrypto/aes/asm/bsaes-x86_64.pl
+index 20e9e1f71..347f4c302 100644
+--- a/src/lib/libcrypto/aes/asm/bsaes-x86_64.pl
+++ b/src/lib/libcrypto/aes/asm/bsaes-x86_64.pl
+@@ -2937,7 +2937,7 @@ _bsaes_const:
+ 	.quad	0x6363636363636363, 0x6363636363636363
+ .align	64
+ .size	_bsaes_const,.-_bsaes_const
+-.text
+.previous
+ ___
+ 
+ # EXCEPTION_DISPOSITION handler (EXCEPTION_RECORD *rec,ULONG64 frame,
+diff --git a/src/lib/libcrypto/aes/asm/vpaes-x86_64.pl b/src/lib/libcrypto/aes/asm/vpaes-x86_64.pl
+index 3ffb1a303..ad5fa7522 100644
+--- a/src/lib/libcrypto/aes/asm/vpaes-x86_64.pl
+++ b/src/lib/libcrypto/aes/asm/vpaes-x86_64.pl
+@@ -1063,7 +1063,7 @@ _vpaes_consts:
+ 	.quad	0x12D7560F93441D00, 0xCA4B8159D8C58E9C
+ .align	64
+ .size	_vpaes_consts,.-_vpaes_consts
+-.text
+.previous
+ ___
+ 
+ if ($win64) {
+diff --git a/src/lib/libcrypto/bn/asm/x86_64-mont5.pl b/src/lib/libcrypto/bn/asm/x86_64-mont5.pl
+index 7b9c6df27..1c8aa255c 100755
+--- a/src/lib/libcrypto/bn/asm/x86_64-mont5.pl
+++ b/src/lib/libcrypto/bn/asm/x86_64-mont5.pl
+@@ -1037,7 +1037,7 @@ $code.=<<___;
+ .Linc:
+ 	.long	0,0, 1,1
+ 	.long	2,2, 2,2
+-.text
+.previous
+ ___
+ 
+ # EXCEPTION_DISPOSITION handler (EXCEPTION_RECORD *rec,ULONG64 frame,
+diff --git a/src/lib/libcrypto/camellia/asm/cmll-x86_64.pl b/src/lib/libcrypto/camellia/asm/cmll-x86_64.pl
+index 586e5d6e9..c16725f5c 100644
+--- a/src/lib/libcrypto/camellia/asm/cmll-x86_64.pl
+++ b/src/lib/libcrypto/camellia/asm/cmll-x86_64.pl
+@@ -625,7 +625,7 @@ $_ivp="40(%rsp)";
+ $_rsp="48(%rsp)";
+ 
+ $code.=<<___;
+-.text
+.previous
+ .globl	Camellia_cbc_encrypt
+ .type	Camellia_cbc_encrypt,\@function,6
+ .align	16
+diff --git a/src/lib/libcrypto/modes/asm/ghash-x86_64.pl b/src/lib/libcrypto/modes/asm/ghash-x86_64.pl
+index 71d0822ac..bce62947f 100644
+--- a/src/lib/libcrypto/modes/asm/ghash-x86_64.pl
+++ b/src/lib/libcrypto/modes/asm/ghash-x86_64.pl
+@@ -670,7 +670,7 @@ $code.=<<___;
+ 	.value	0xB5E0,0xB422,0xB664,0xB7A6,0xB2E8,0xB32A,0xB16C,0xB0AE
+ 	.value	0xBBF0,0xBA32,0xB874,0xB9B6,0xBCF8,0xBD3A,0xBF7C,0xBEBE
+ .align	64
+-.text
+.previous
+ ___
+ 
+ # EXCEPTION_DISPOSITION handler (EXCEPTION_RECORD *rec,ULONG64 frame,
+diff --git a/src/lib/libcrypto/sha/asm/sha1-x86_64.pl b/src/lib/libcrypto/sha/asm/sha1-x86_64.pl
+index 43eee73c4..1ec7f609a 100755
+--- a/src/lib/libcrypto/sha/asm/sha1-x86_64.pl
+++ b/src/lib/libcrypto/sha/asm/sha1-x86_64.pl
+@@ -1079,7 +1079,7 @@ K_XX_XX:
+ .long	0x8f1bbcdc,0x8f1bbcdc,0x8f1bbcdc,0x8f1bbcdc	# K_40_59
+ .long	0xca62c1d6,0xca62c1d6,0xca62c1d6,0xca62c1d6	# K_60_79
+ .long	0x00010203,0x04050607,0x08090a0b,0x0c0d0e0f	# pbswap mask
+-.text
+.previous
+ ___
+ }}}
+ $code.=<<___;
+diff --git a/src/lib/libcrypto/sha/asm/sha512-x86_64.pl b/src/lib/libcrypto/sha/asm/sha512-x86_64.pl
+index 0517eab66..1a7d9bf2d 100755
+--- a/src/lib/libcrypto/sha/asm/sha512-x86_64.pl
+++ b/src/lib/libcrypto/sha/asm/sha512-x86_64.pl
+@@ -289,7 +289,7 @@ $TABLE:
+ 	.long	0x391c0cb3,0x4ed8aa4a,0x5b9cca4f,0x682e6ff3
+ 	.long	0x748f82ee,0x78a5636f,0x84c87814,0x8cc70208
+ 	.long	0x90befffa,0xa4506ceb,0xbef9a3f7,0xc67178f2
+-.text
+.previous
+ ___
+ } else {
+ $code.=<<___;
+@@ -337,7 +337,7 @@ $TABLE:
+ 	.quad	0x3c9ebe0a15c9bebc,0x431d67c49c100d4c
+ 	.quad	0x4cc5d4becb3e42b6,0x597f299cfc657e2a
+ 	.quad	0x5fcb6fab3ad6faec,0x6c44198c4a475817
+-.text
+.previous
+ ___
+ }
+ 
+-- 
+2.42.0
+
--- a/patches/asm/0003-Revert-Use-.section-.rodata-instead-of-a-plain-.roda.patch
+++ b/patches/asm/0003-Revert-Use-.section-.rodata-instead-of-a-plain-.roda.patch
@@ -0,0 +1,203 @@
+From 1407448470aff891f9a9eff550ecda06202ffd29 Mon Sep 17 00:00:00 2001
+From: Brent Cook <busterb@gmail.com>
+Date: Mon, 30 Oct 2023 22:00:49 -0500
+Subject: [PATCH 3/4] Revert "Use .section .rodata instead of a plain .rodata"
+
+This reverts commit 67afc07de0ed3a0ccc272df42853ba565a8277c6.
+---
+ src/lib/libcrypto/aes/asm/aes-x86_64.pl        | 2 +-
+ src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl | 2 +-
+ src/lib/libcrypto/aes/asm/aesni-x86_64.pl      | 2 +-
+ src/lib/libcrypto/aes/asm/bsaes-x86_64.pl      | 2 +-
+ src/lib/libcrypto/aes/asm/vpaes-x86_64.pl      | 2 +-
+ src/lib/libcrypto/bn/asm/x86_64-mont5.pl       | 2 +-
+ src/lib/libcrypto/camellia/asm/cmll-x86_64.pl  | 2 +-
+ src/lib/libcrypto/modes/asm/ghash-x86_64.pl    | 2 +-
+ src/lib/libcrypto/perlasm/x86gas.pl            | 2 +-
+ src/lib/libcrypto/sha/asm/sha1-x86_64.pl       | 2 +-
+ src/lib/libcrypto/sha/asm/sha512-ppc.pl        | 2 +-
+ src/lib/libcrypto/sha/asm/sha512-x86_64.pl     | 4 ++--
+ src/lib/libcrypto/whrlpool/asm/wp-x86_64.pl    | 2 +-
+ 13 files changed, 14 insertions(+), 14 deletions(-)
+
+diff --git a/src/lib/libcrypto/aes/asm/aes-x86_64.pl b/src/lib/libcrypto/aes/asm/aes-x86_64.pl
+index 2986a9fcc..d9f501b25 100755
+--- a/src/lib/libcrypto/aes/asm/aes-x86_64.pl
+++ b/src/lib/libcrypto/aes/asm/aes-x86_64.pl
+@@ -2113,7 +2113,7 @@ ___
+ }
+ 
+ $code.=<<___;
+-.section .rodata
+.rodata
+ .align	64
+ .LAES_Te:
+ ___
+diff --git a/src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl b/src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl
+index 8a428c9b1..4e83b6ba4 100644
+--- a/src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl
+++ b/src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl
+@@ -1075,7 +1075,7 @@ $code.=<<___;
+ ___
+ }
+ $code.=<<___;
+-.section .rodata
+.rodata
+ .align	64
+ K_XX_XX:
+ .long	0x5a827999,0x5a827999,0x5a827999,0x5a827999	# K_00_19
+diff --git a/src/lib/libcrypto/aes/asm/aesni-x86_64.pl b/src/lib/libcrypto/aes/asm/aesni-x86_64.pl
+index 09612b1f8..2ab7106c0 100644
+--- a/src/lib/libcrypto/aes/asm/aesni-x86_64.pl
+++ b/src/lib/libcrypto/aes/asm/aesni-x86_64.pl
+@@ -2721,7 +2721,7 @@ ___
+ }
+ 
+ $code.=<<___;
+-.section .rodata
+.rodata
+ .align	64
+ .Lbswap_mask:
+ 	.byte	15,14,13,12,11,10,9,8,7,6,5,4,3,2,1,0
+diff --git a/src/lib/libcrypto/aes/asm/bsaes-x86_64.pl b/src/lib/libcrypto/aes/asm/bsaes-x86_64.pl
+index 347f4c302..a40f83601 100644
+--- a/src/lib/libcrypto/aes/asm/bsaes-x86_64.pl
+++ b/src/lib/libcrypto/aes/asm/bsaes-x86_64.pl
+@@ -2882,7 +2882,7 @@ $code.=<<___;
+ ___
+ }
+ $code.=<<___;
+-.section .rodata
+.rodata
+ .type	_bsaes_const,\@object
+ .align	64
+ _bsaes_const:
+diff --git a/src/lib/libcrypto/aes/asm/vpaes-x86_64.pl b/src/lib/libcrypto/aes/asm/vpaes-x86_64.pl
+index ad5fa7522..63af96c1d 100644
+--- a/src/lib/libcrypto/aes/asm/vpaes-x86_64.pl
+++ b/src/lib/libcrypto/aes/asm/vpaes-x86_64.pl
+@@ -964,7 +964,7 @@ _vpaes_preheat:
+ ##                     Constants                      ##
+ ##                                                    ##
+ ########################################################
+-.section .rodata
+.rodata
+ .type	_vpaes_consts,\@object
+ .align	64
+ _vpaes_consts:
+diff --git a/src/lib/libcrypto/bn/asm/x86_64-mont5.pl b/src/lib/libcrypto/bn/asm/x86_64-mont5.pl
+index 1c8aa255c..5d30f210c 100755
+--- a/src/lib/libcrypto/bn/asm/x86_64-mont5.pl
+++ b/src/lib/libcrypto/bn/asm/x86_64-mont5.pl
+@@ -1032,7 +1032,7 @@ $code.=<<___;
+ ___
+ }
+ $code.=<<___;
+-.section .rodata
+.rodata
+ .align	64
+ .Linc:
+ 	.long	0,0, 1,1
+diff --git a/src/lib/libcrypto/camellia/asm/cmll-x86_64.pl b/src/lib/libcrypto/camellia/asm/cmll-x86_64.pl
+index c16725f5c..90c56d9e5 100644
+--- a/src/lib/libcrypto/camellia/asm/cmll-x86_64.pl
+++ b/src/lib/libcrypto/camellia/asm/cmll-x86_64.pl
+@@ -599,7 +599,7 @@ sub S0222 { my $i=shift; $i=@SBOX[$i]; $i=($i<<1|$i>>7)&0xff; $i=$i<<16|$i<<8|$i
+ sub S3033 { my $i=shift; $i=@SBOX[$i]; $i=($i>>1|$i<<7)&0xff; $i=$i<<24|$i<<8|$i; sprintf("0x%08x",$i); }
+ 
+ $code.=<<___;
+-.section .rodata
+.rodata
+ .align	64
+ .LCamellia_SIGMA:
+ .long	0x3bcc908b, 0xa09e667f, 0x4caa73b2, 0xb67ae858
+diff --git a/src/lib/libcrypto/modes/asm/ghash-x86_64.pl b/src/lib/libcrypto/modes/asm/ghash-x86_64.pl
+index bce62947f..3ae8629cb 100644
+--- a/src/lib/libcrypto/modes/asm/ghash-x86_64.pl
+++ b/src/lib/libcrypto/modes/asm/ghash-x86_64.pl
+@@ -622,7 +622,7 @@ ___
+ }
+ 
+ $code.=<<___;
+-.section .rodata
+.rodata
+ .align	64
+ .Lbswap_mask:
+ 	.byte	15,14,13,12,11,10,9,8,7,6,5,4,3,2,1,0
+diff --git a/src/lib/libcrypto/perlasm/x86gas.pl b/src/lib/libcrypto/perlasm/x86gas.pl
+index b84e28be9..f28a59054 100644
+--- a/src/lib/libcrypto/perlasm/x86gas.pl
+++ b/src/lib/libcrypto/perlasm/x86gas.pl
+@@ -307,7 +307,7 @@ sub ::dataseg
+ {   push(@out,".data\n");   }
+ 
+ sub ::rodataseg
+-{   push(@out,".section .rodata\n");   }
+{   push(@out,".rodata\n");   }
+ 
+ sub ::previous
+ {   push(@out,".previous\n");   }
+diff --git a/src/lib/libcrypto/sha/asm/sha1-x86_64.pl b/src/lib/libcrypto/sha/asm/sha1-x86_64.pl
+index 1ec7f609a..0abbbab6b 100755
+--- a/src/lib/libcrypto/sha/asm/sha1-x86_64.pl
+++ b/src/lib/libcrypto/sha/asm/sha1-x86_64.pl
+@@ -1071,7 +1071,7 @@ $code.=<<___;
+ ___
+ }
+ $code.=<<___;
+-.section .rodata
+.rodata
+ .align	64
+ K_XX_XX:
+ .long	0x5a827999,0x5a827999,0x5a827999,0x5a827999	# K_00_19
+diff --git a/src/lib/libcrypto/sha/asm/sha512-ppc.pl b/src/lib/libcrypto/sha/asm/sha512-ppc.pl
+index 28bd997cf..1f02cfdd5 100755
+--- a/src/lib/libcrypto/sha/asm/sha512-ppc.pl
+++ b/src/lib/libcrypto/sha/asm/sha512-ppc.pl
+@@ -375,7 +375,7 @@ $code.=<<___;
+ 	$ST	$H,`7*$SZ`($ctx)
+ 	bne	Lsha2_block_private
+ 	blr
+-	.section .rodata
+	.rodata
+ Ltable:
+ ___
+ $code.=<<___ if ($SZ==8);
+diff --git a/src/lib/libcrypto/sha/asm/sha512-x86_64.pl b/src/lib/libcrypto/sha/asm/sha512-x86_64.pl
+index 1a7d9bf2d..6698b1d40 100755
+--- a/src/lib/libcrypto/sha/asm/sha512-x86_64.pl
+++ b/src/lib/libcrypto/sha/asm/sha512-x86_64.pl
+@@ -269,7 +269,7 @@ ___
+ 
+ if ($SZ==4) {
+ $code.=<<___;
+-.section .rodata
+.rodata
+ .align	64
+ .type	$TABLE,\@object
+ $TABLE:
+@@ -293,7 +293,7 @@ $TABLE:
+ ___
+ } else {
+ $code.=<<___;
+-.section .rodata
+.rodata
+ .align	64
+ .type	$TABLE,\@object
+ $TABLE:
+diff --git a/src/lib/libcrypto/whrlpool/asm/wp-x86_64.pl b/src/lib/libcrypto/whrlpool/asm/wp-x86_64.pl
+index de5d3acfb..510a74b91 100644
+--- a/src/lib/libcrypto/whrlpool/asm/wp-x86_64.pl
+++ b/src/lib/libcrypto/whrlpool/asm/wp-x86_64.pl
+@@ -204,7 +204,7 @@ $code.=<<___;
+ 	ret
+ .size	$func,.-$func
+ 
+-.section .rodata
+.rodata
+ .align	64
+ .type	$table,\@object
+ $table:
+-- 
+2.42.0
+
--- a/patches/asm/0004-Revert-Move-constants-out-of-text-segment-into-rodat.patch
+++ b/patches/asm/0004-Revert-Move-constants-out-of-text-segment-into-rodat.patch
@@ -0,0 +1,292 @@
+From 87b24a6d5a932061cc88b84a856663b328d1c166 Mon Sep 17 00:00:00 2001
+From: Brent Cook <busterb@gmail.com>
+Date: Mon, 30 Oct 2023 22:01:49 -0500
+Subject: [PATCH 4/4] Revert "Move constants out of text segment into rodata to
+ prepare for xonly support"
+
+This reverts commit b5834617204e7520b0209bcff7f1c4a559e05422.
+---
+ src/lib/libcrypto/aes/asm/aes-x86_64.pl        | 3 +--
+ src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl | 4 ++--
+ src/lib/libcrypto/aes/asm/aesni-x86_64.pl      | 4 ++--
+ src/lib/libcrypto/aes/asm/bsaes-x86_64.pl      | 3 +--
+ src/lib/libcrypto/aes/asm/vpaes-x86_64.pl      | 3 +--
+ src/lib/libcrypto/bn/asm/x86_64-mont.pl        | 4 ++++
+ src/lib/libcrypto/bn/asm/x86_64-mont5.pl       | 3 +--
+ src/lib/libcrypto/camellia/asm/cmll-x86_64.pl  | 4 ++--
+ src/lib/libcrypto/modes/asm/ghash-x86_64.pl    | 4 ++--
+ src/lib/libcrypto/sha/asm/sha1-x86_64.pl       | 3 +--
+ src/lib/libcrypto/sha/asm/sha512-x86_64.pl     | 4 ----
+ src/lib/libcrypto/whrlpool/asm/wp-x86_64.pl    | 1 -
+ 12 files changed, 17 insertions(+), 23 deletions(-)
+
+diff --git a/src/lib/libcrypto/aes/asm/aes-x86_64.pl b/src/lib/libcrypto/aes/asm/aes-x86_64.pl
+index d9f501b25..9072f603a 100755
+--- a/src/lib/libcrypto/aes/asm/aes-x86_64.pl
+++ b/src/lib/libcrypto/aes/asm/aes-x86_64.pl
+@@ -2113,7 +2113,6 @@ ___
+ }
+ 
+ $code.=<<___;
+-.rodata
+ .align	64
+ .LAES_Te:
+ ___
+@@ -2534,8 +2533,8 @@ ___
+ $code.=<<___;
+ 	.long	0x80808080, 0x80808080, 0xfefefefe, 0xfefefefe
+ 	.long	0x1b1b1b1b, 0x1b1b1b1b, 0, 0
+.asciz  "AES for x86_64, CRYPTOGAMS by <appro\@openssl.org>"
+ .align	64
+-.previous
+ ___
+ 
+ # EXCEPTION_DISPOSITION handler (EXCEPTION_RECORD *rec,ULONG64 frame,
+diff --git a/src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl b/src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl
+index 4e83b6ba4..880bcc2d5 100644
+--- a/src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl
+++ b/src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl
+@@ -1075,7 +1075,6 @@ $code.=<<___;
+ ___
+ }
+ $code.=<<___;
+-.rodata
+ .align	64
+ K_XX_XX:
+ .long	0x5a827999,0x5a827999,0x5a827999,0x5a827999	# K_00_19
+@@ -1083,8 +1082,9 @@ K_XX_XX:
+ .long	0x8f1bbcdc,0x8f1bbcdc,0x8f1bbcdc,0x8f1bbcdc	# K_40_59
+ .long	0xca62c1d6,0xca62c1d6,0xca62c1d6,0xca62c1d6	# K_60_79
+ .long	0x00010203,0x04050607,0x08090a0b,0x0c0d0e0f	# pbswap mask
+
+.asciz	"AESNI-CBC+SHA1 stitch for x86_64, CRYPTOGAMS by <appro\@openssl.org>"
+ .align	64
+-.previous
+ ___
+ 
+ # EXCEPTION_DISPOSITION handler (EXCEPTION_RECORD *rec,ULONG64 frame,
+diff --git a/src/lib/libcrypto/aes/asm/aesni-x86_64.pl b/src/lib/libcrypto/aes/asm/aesni-x86_64.pl
+index 2ab7106c0..96978bd35 100644
+--- a/src/lib/libcrypto/aes/asm/aesni-x86_64.pl
+++ b/src/lib/libcrypto/aes/asm/aesni-x86_64.pl
+@@ -2721,7 +2721,6 @@ ___
+ }
+ 
+ $code.=<<___;
+-.rodata
+ .align	64
+ .Lbswap_mask:
+ 	.byte	15,14,13,12,11,10,9,8,7,6,5,4,3,2,1,0
+@@ -2731,8 +2730,9 @@ $code.=<<___;
+ 	.long	1,0,0,0
+ .Lxts_magic:
+ 	.long	0x87,0,1,0
+
+.asciz  "AES for Intel AES-NI, CRYPTOGAMS by <appro\@openssl.org>"
+ .align	64
+-.previous
+ ___
+ 
+ # EXCEPTION_DISPOSITION handler (EXCEPTION_RECORD *rec,ULONG64 frame,
+diff --git a/src/lib/libcrypto/aes/asm/bsaes-x86_64.pl b/src/lib/libcrypto/aes/asm/bsaes-x86_64.pl
+index a40f83601..14dc2c02e 100644
+--- a/src/lib/libcrypto/aes/asm/bsaes-x86_64.pl
+++ b/src/lib/libcrypto/aes/asm/bsaes-x86_64.pl
+@@ -2882,7 +2882,6 @@ $code.=<<___;
+ ___
+ }
+ $code.=<<___;
+-.rodata
+ .type	_bsaes_const,\@object
+ .align	64
+ _bsaes_const:
+@@ -2935,9 +2934,9 @@ _bsaes_const:
+ 	.quad	0x02060a0e03070b0f, 0x0004080c0105090d
+ .L63:
+ 	.quad	0x6363636363636363, 0x6363636363636363
+.asciz	"Bit-sliced AES for x86_64/SSSE3, Emilia Käsper, Peter Schwabe, Andy Polyakov"
+ .align	64
+ .size	_bsaes_const,.-_bsaes_const
+-.previous
+ ___
+ 
+ # EXCEPTION_DISPOSITION handler (EXCEPTION_RECORD *rec,ULONG64 frame,
+diff --git a/src/lib/libcrypto/aes/asm/vpaes-x86_64.pl b/src/lib/libcrypto/aes/asm/vpaes-x86_64.pl
+index 63af96c1d..bd7f45b85 100644
+--- a/src/lib/libcrypto/aes/asm/vpaes-x86_64.pl
+++ b/src/lib/libcrypto/aes/asm/vpaes-x86_64.pl
+@@ -964,7 +964,6 @@ _vpaes_preheat:
+ ##                     Constants                      ##
+ ##                                                    ##
+ ########################################################
+-.rodata
+ .type	_vpaes_consts,\@object
+ .align	64
+ _vpaes_consts:
+@@ -1061,9 +1060,9 @@ _vpaes_consts:
+ .Lk_dsbo:	# decryption sbox final output
+ 	.quad	0x1387EA537EF94000, 0xC7AA6DB9D4943E2D
+ 	.quad	0x12D7560F93441D00, 0xCA4B8159D8C58E9C
+.asciz	"Vector Permutation AES for x86_64/SSSE3, Mike Hamburg (Stanford University)"
+ .align	64
+ .size	_vpaes_consts,.-_vpaes_consts
+-.previous
+ ___
+ 
+ if ($win64) {
+diff --git a/src/lib/libcrypto/bn/asm/x86_64-mont.pl b/src/lib/libcrypto/bn/asm/x86_64-mont.pl
+index cae7309d5..c35493e80 100755
+--- a/src/lib/libcrypto/bn/asm/x86_64-mont.pl
+++ b/src/lib/libcrypto/bn/asm/x86_64-mont.pl
+@@ -1495,6 +1495,10 @@ $code.=<<___;
+ .size	bn_sqr4x_mont,.-bn_sqr4x_mont
+ ___
+ }}}
+$code.=<<___;
+.asciz	"Montgomery Multiplication for x86_64, CRYPTOGAMS by <appro\@openssl.org>"
+.align	16
+___
+ 
+ print $code;
+ close STDOUT;
+diff --git a/src/lib/libcrypto/bn/asm/x86_64-mont5.pl b/src/lib/libcrypto/bn/asm/x86_64-mont5.pl
+index 5d30f210c..bb7ad4c4b 100755
+--- a/src/lib/libcrypto/bn/asm/x86_64-mont5.pl
+++ b/src/lib/libcrypto/bn/asm/x86_64-mont5.pl
+@@ -1032,12 +1032,11 @@ $code.=<<___;
+ ___
+ }
+ $code.=<<___;
+-.rodata
+ .align	64
+ .Linc:
+ 	.long	0,0, 1,1
+ 	.long	2,2, 2,2
+-.previous
+.asciz	"Montgomery Multiplication with scatter/gather for x86_64, CRYPTOGAMS by <appro\@openssl.org>"
+ ___
+ 
+ # EXCEPTION_DISPOSITION handler (EXCEPTION_RECORD *rec,ULONG64 frame,
+diff --git a/src/lib/libcrypto/camellia/asm/cmll-x86_64.pl b/src/lib/libcrypto/camellia/asm/cmll-x86_64.pl
+index 90c56d9e5..df6bf11a2 100644
+--- a/src/lib/libcrypto/camellia/asm/cmll-x86_64.pl
+++ b/src/lib/libcrypto/camellia/asm/cmll-x86_64.pl
+@@ -599,7 +599,6 @@ sub S0222 { my $i=shift; $i=@SBOX[$i]; $i=($i<<1|$i>>7)&0xff; $i=$i<<16|$i<<8|$i
+ sub S3033 { my $i=shift; $i=@SBOX[$i]; $i=($i>>1|$i<<7)&0xff; $i=$i<<24|$i<<8|$i; sprintf("0x%08x",$i); }
+ 
+ $code.=<<___;
+-.rodata
+ .align	64
+ .LCamellia_SIGMA:
+ .long	0x3bcc908b, 0xa09e667f, 0x4caa73b2, 0xb67ae858
+@@ -625,7 +624,6 @@ $_ivp="40(%rsp)";
+ $_rsp="48(%rsp)";
+ 
+ $code.=<<___;
+-.previous
+ .globl	Camellia_cbc_encrypt
+ .type	Camellia_cbc_encrypt,\@function,6
+ .align	16
+@@ -859,6 +857,8 @@ Camellia_cbc_encrypt:
+ .Lcbc_abort:
+ 	ret
+ .size	Camellia_cbc_encrypt,.-Camellia_cbc_encrypt
+
+.asciz	"Camellia for x86_64 by <appro\@openssl.org>"
+ ___
+ }
+ 
+diff --git a/src/lib/libcrypto/modes/asm/ghash-x86_64.pl b/src/lib/libcrypto/modes/asm/ghash-x86_64.pl
+index 3ae8629cb..38d779edb 100644
+--- a/src/lib/libcrypto/modes/asm/ghash-x86_64.pl
+++ b/src/lib/libcrypto/modes/asm/ghash-x86_64.pl
+@@ -622,7 +622,6 @@ ___
+ }
+ 
+ $code.=<<___;
+-.rodata
+ .align	64
+ .Lbswap_mask:
+ 	.byte	15,14,13,12,11,10,9,8,7,6,5,4,3,2,1,0
+@@ -669,8 +668,9 @@ $code.=<<___;
+ 	.value	0xA7D0,0xA612,0xA454,0xA596,0xA0D8,0xA11A,0xA35C,0xA29E
+ 	.value	0xB5E0,0xB422,0xB664,0xB7A6,0xB2E8,0xB32A,0xB16C,0xB0AE
+ 	.value	0xBBF0,0xBA32,0xB874,0xB9B6,0xBCF8,0xBD3A,0xBF7C,0xBEBE
+
+.asciz	"GHASH for x86_64, CRYPTOGAMS by <appro\@openssl.org>"
+ .align	64
+-.previous
+ ___
+ 
+ # EXCEPTION_DISPOSITION handler (EXCEPTION_RECORD *rec,ULONG64 frame,
+diff --git a/src/lib/libcrypto/sha/asm/sha1-x86_64.pl b/src/lib/libcrypto/sha/asm/sha1-x86_64.pl
+index 0abbbab6b..cc8ef5337 100755
+--- a/src/lib/libcrypto/sha/asm/sha1-x86_64.pl
+++ b/src/lib/libcrypto/sha/asm/sha1-x86_64.pl
+@@ -1071,7 +1071,6 @@ $code.=<<___;
+ ___
+ }
+ $code.=<<___;
+-.rodata
+ .align	64
+ K_XX_XX:
+ .long	0x5a827999,0x5a827999,0x5a827999,0x5a827999	# K_00_19
+@@ -1079,10 +1078,10 @@ K_XX_XX:
+ .long	0x8f1bbcdc,0x8f1bbcdc,0x8f1bbcdc,0x8f1bbcdc	# K_40_59
+ .long	0xca62c1d6,0xca62c1d6,0xca62c1d6,0xca62c1d6	# K_60_79
+ .long	0x00010203,0x04050607,0x08090a0b,0x0c0d0e0f	# pbswap mask
+-.previous
+ ___
+ }}}
+ $code.=<<___;
+.asciz	"SHA1 block transform for x86_64, CRYPTOGAMS by <appro\@openssl.org>"
+ .align	64
+ ___
+ 
+diff --git a/src/lib/libcrypto/sha/asm/sha512-x86_64.pl b/src/lib/libcrypto/sha/asm/sha512-x86_64.pl
+index 6698b1d40..bc4b2e748 100755
+--- a/src/lib/libcrypto/sha/asm/sha512-x86_64.pl
+++ b/src/lib/libcrypto/sha/asm/sha512-x86_64.pl
+@@ -269,7 +269,6 @@ ___
+ 
+ if ($SZ==4) {
+ $code.=<<___;
+-.rodata
+ .align	64
+ .type	$TABLE,\@object
+ $TABLE:
+@@ -289,11 +288,9 @@ $TABLE:
+ 	.long	0x391c0cb3,0x4ed8aa4a,0x5b9cca4f,0x682e6ff3
+ 	.long	0x748f82ee,0x78a5636f,0x84c87814,0x8cc70208
+ 	.long	0x90befffa,0xa4506ceb,0xbef9a3f7,0xc67178f2
+-.previous
+ ___
+ } else {
+ $code.=<<___;
+-.rodata
+ .align	64
+ .type	$TABLE,\@object
+ $TABLE:
+@@ -337,7 +334,6 @@ $TABLE:
+ 	.quad	0x3c9ebe0a15c9bebc,0x431d67c49c100d4c
+ 	.quad	0x4cc5d4becb3e42b6,0x597f299cfc657e2a
+ 	.quad	0x5fcb6fab3ad6faec,0x6c44198c4a475817
+-.previous
+ ___
+ }
+ 
+diff --git a/src/lib/libcrypto/whrlpool/asm/wp-x86_64.pl b/src/lib/libcrypto/whrlpool/asm/wp-x86_64.pl
+index 510a74b91..afadd5d2f 100644
+--- a/src/lib/libcrypto/whrlpool/asm/wp-x86_64.pl
+++ b/src/lib/libcrypto/whrlpool/asm/wp-x86_64.pl
+@@ -204,7 +204,6 @@ $code.=<<___;
+ 	ret
+ .size	$func,.-$func
+ 
+-.rodata
+ .align	64
+ .type	$table,\@object
+ $table:
+-- 
+2.42.0
+
--- a/patches/windows_headers.patch
+++ b/patches/windows_headers.patch
@@ -1,26 +1,25 @@
-diff -u include/openssl.orig/dtls1.h include/openssl/dtls1.h
--- include/openssl.orig/dtls1.h	Mon Dec  7 07:58:32 2015
-+++ include/openssl/dtls1.h	Mon Dec  7 07:56:14 2015
+--- include/openssl/dtls1.h.orig	Wed Nov  1 13:15:36 2023
+++ include/openssl/dtls1.h	Wed Nov  1 13:15:54 2023
@@ -60,7 +60,11 @@
 #ifndef HEADER_DTLS1_H
 #define HEADER_DTLS1_H
-
+ 
 +#if defined(_WIN32)
 +#include <winsock2.h>
 +#else
 #include <sys/time.h>
 +#endif
-
+ 
 #include <stdio.h>
 #include <stdlib.h>
--- include/openssl/ossl_typ.h.orig	Fri Feb 18 16:30:39 2022
-+++ include/openssl/ossl_typ.h	Mon Feb 21 05:39:35 2022
-@@ -82,6 +82,22 @@
+--- include/openssl/ossl_typ.h.orig	Wed Nov  1 13:15:36 2023
+++ include/openssl/ossl_typ.h	Wed Nov  1 13:18:23 2023
+@@ -82,6 +82,22 @@ typedef struct asn1_object_st ASN1_OBJECT;
 typedef struct ASN1_ITEM_st ASN1_ITEM;
 typedef struct asn1_pctx_st ASN1_PCTX;
 
 +#if defined(_WIN32) && defined(__WINCRYPT_H__)
-+#ifndef LIBRESSL_INTERNAL
+#if !defined(LIBRESSL_INTERNAL) && !defined(LIBRESSL_DISABLE_OVERRIDE_WINCRYPT_DEFINES_WARNING)
 +#ifdef _MSC_VER
 +#pragma message("Warning, overriding WinCrypt defines")
 +#else
@@ -38,15 +37,14 @@ diff -u include/openssl.orig/dtls1.h include/openssl/dtls1.h
 #ifdef BIGNUM
 #undef BIGNUM
 #endif
-diff -u include/openssl.orig/pkcs7.h include/openssl/pkcs7.h
--- include/openssl.orig/pkcs7.h	Mon Dec  7 07:58:32 2015
-+++ include/openssl/pkcs7.h	Mon Dec  7 07:56:14 2015
+--- include/openssl/pkcs7.h.orig	Wed Nov  1 13:15:36 2023
+++ include/openssl/pkcs7.h	Wed Nov  1 13:17:58 2023
@@ -69,6 +69,18 @@
 extern "C" {
 #endif
-
+ 
 +#if defined(_WIN32) && defined(__WINCRYPT_H__)
-+#ifndef LIBRESSL_INTERNAL
+#if !defined(LIBRESSL_INTERNAL) && !defined(LIBRESSL_DISABLE_OVERRIDE_WINCRYPT_DEFINES_WARNING)
 +#ifdef _MSC_VER
 +#pragma message("Warning, overriding WinCrypt defines")
 +#else
@@ -60,14 +58,14 @@ diff -u include/openssl.orig/pkcs7.h include/openssl/pkcs7.h
 /*
 Encryption_ID		DES-CBC
 Digest_ID		MD5
--- include/openssl/x509.h.orig	Thu Aug  3 13:35:00 2023
-+++ include/openssl/x509.h	Thu Aug  3 13:35:18 2023
+--- include/openssl/x509.h.orig	Wed Nov  1 13:15:36 2023
+++ include/openssl/x509.h	Wed Nov  1 13:18:44 2023
@@ -100,6 +100,19 @@
 extern "C" {
 #endif
 
 +#if defined(_WIN32) && defined(__WINCRYPT_H__)
-+#ifndef LIBRESSL_INTERNAL
+#if !defined(LIBRESSL_INTERNAL) && !defined(LIBRESSL_DISABLE_OVERRIDE_WINCRYPT_DEFINES_WARNING)
 +#ifdef _MSC_VER
 +#pragma message("Warning, overriding WinCrypt defines")
 +#else
--- a/tls/CMakeLists.txt
+++ b/tls/CMakeLists.txt
@@ -22,6 +22,8 @@ if(WIN32)
 		compat/pread.c
 		compat/pwrite.c
 	)
+
+	set(LIBTLS_EXTRA_EXPORT ${LIBTLS_EXTRA_EXPORT} ftruncate)
 endif()

 if(NOT "${OPENSSLDIR}" STREQUAL "")
--- a/update.sh
+++ b/update.sh
@@ -195,7 +195,20 @@ fixup_masm() {
 }

 # generate assembly crypto algorithms
-asm_src=$libcrypto_src
+asm_src=$CWD/asm
+
+setup_asm_generator() {
+	rm -fr $asm_src
+	cp -a $libcrypto_src $asm_src
+}
+
+setup_asm_generator_patched() {
+	setup_asm_generator
+	for i in `ls -1 patches/asm/*.patch | sort -n`; do
+		patch -d $asm_src -p 4 < $i 1> /dev/null 2>/dev/null ;
+	done
+}
+
 gen_asm_stdout() {
 	CC=true perl $asm_src/$2 $1 > crypto/$3.tmp
 	[ $1 = "elf" ] && cat <<-EOF >> crypto/$3.tmp
@@ -236,6 +249,8 @@ gen_asm() {
 	fi
 }

+setup_asm_generator
+
 echo generating mips ASM source for elf
 gen_asm_mips o32 aes aes-mips    aes-mips
 gen_asm_mips o32 bn  mips        bn-mips
@@ -265,6 +280,14 @@ $CP $libcrypto_src/arch/arm/arm_arch.h crypto

 for abi in elf macosx masm mingw64; do
 	echo generating x86_64 ASM source for $abi
+
+	# use patched generators for non-elf targets
+	if [ $abi = "elf" ]; then
+		setup_asm_generator
+	else
+		setup_asm_generator_patched
+	fi
+
 	gen_asm_stdout $abi aes/asm/aes-x86_64.pl        aes/aes-$abi-x86_64.S
 	gen_asm_stdout $abi aes/asm/vpaes-x86_64.pl      aes/vpaes-$abi-x86_64.S
 	gen_asm_stdout $abi aes/asm/bsaes-x86_64.pl      aes/bsaes-$abi-x86_64.S
Author	SHA1	Message	Date
torque	0e1bc3a222	build: out-kludge the installed header include kludge This is a, erm, beautiful(?) mess. I feel like there probably ought to be a better way to handle this use case, but the way that the includes are handled in this specific codebase are extremely weird (how many times have you actually seen #include_next get used?). It may be worth making this a more natural path to take, though.	2024-06-18 20:41:00 -07:00
torque	bb0e7bc98c	build: update for zig-0.13.0 release Deprecated LazyPath fields were removed. This would have been the correct non-lazy (irony intended?) way of updating for zig 0.12 as well, and indeed this build works with zig-0.12.1.	2024-06-17 23:16:44 -07:00
torque	a2e9a8301d	build: update for zig-0.12.0 release Minor fixes for the header installation.	2024-05-12 23:42:59 -07:00
torque	9679f074d2	build: update for zig-0.12.0-dev.2208+4debd4338 Incorporate various build API changes. Hopefully there won't be any other major API changes before the 0.12.0 release.	2024-01-15 15:38:06 -08:00
torque	c673c25fc9	readme: update	2024-01-15 15:38:06 -08:00
torque	7940593eb8	build: remove unused code	2024-01-15 15:30:20 -08:00
torque	e68d5f484b	build: handle architecture include more gracefully The "openssl/opensslconf.h" header is copied from an architecture-specific source file, which means that specific path is not valid within the source tree. I previously hacked around this by copying the file within the source tree, but that had the major downside of invalidating various cache layers after the copy was performed. Since we install this header with the right name, a slightly better solution, hopefully, is to add the header install path as an include directory. In theory, this will not invalidate any caching and improve the build process slightly.	2024-01-15 15:28:44 -08:00
torque	e2db88c634	build.zig: update for 3.8.2 I had a big thing written here about how including opensslconf.h broke but then I found out I had accidentally committed an arch-specific opensslconf in the source tree somehow in the other branches. Whoops. Anyway, the build system copies this around now so it should work even better (???).	2023-11-06 23:58:01 -08:00
torque	c06f268a16	build.zig: fix copy-paste error in header search logic This didn't cause problems because the only file excluded this way has its full name provided, so it matches either way.	2023-11-06 22:36:24 -08:00
torque	9f96f4f711	build.zig: update for v3.8.1	2023-11-06 22:36:24 -08:00
torque	e85e51738d	add build.zig	2023-11-06 22:36:24 -08:00
torque	bbf2737c2b	move upstream readme	2023-11-06 22:36:24 -08:00
Brent Cook	2553853c96	changelog revisions	2023-11-02 04:41:13 -05:00
Brent Cook	79fe4adf48	Revert "Link x509_algor test to build" This reverts commit `04fa997f54`.	2023-11-01 21:33:40 -05:00
Brent Cook	f075fe34bf	update 3.8.2 changelog	2023-11-01 21:17:55 -05:00
Brent Cook	2652fb2f1e	Land #924 , Allow disabling warning about WINCRYPT overrides	2023-11-01 20:51:11 -05:00
Brent Cook	ef83583d88	Land #923 , enable system arc4random on FreeBSD 12+	2023-11-01 20:50:51 -05:00
Brent Cook	1a5be425a9	Land #922 , build fixes for various platforms	2023-11-01 20:50:15 -05:00
Brent Cook	18f5064a9d	Land #913 , CMake build fixes	2023-11-01 20:49:49 -05:00
Pierre Wendling	f06374e731	MSVC: Enable building ocspcheck. - Add `STDIN_FILENO` to compat unistd header. - Use quotes to include compat getopt header in the compat unistd. - Export additional symbols needed by ocspcheck (optarg, optind, ftruncate)	2023-11-01 20:49:34 -05:00
Brent Cook	60f4156d76	Land #909 , Fix processor detection with Cmake	2023-11-01 20:48:51 -05:00
Theo Buehler	eed367e19c	Allow disabling warning about WINCRYPT overrides Fixes #919	2023-11-01 13:21:25 +01:00
Brent Cook	124e0192c8	enable system arc4random on FreeBSD 12+	2023-11-01 06:43:41 -05:00
Brent Cook	548b3d0485	restrict patches to windows / macos platforms	2023-10-31 09:25:23 -05:00
Brent Cook	9bca15bad5	reenable assembly for MSVC	2023-10-30 22:57:33 -05:00
Brent Cook	dd1d96f643	fix cross-compilation on Windows 11 Arm64 signal.h is less populated in this environment, remove stub signal handlers	2023-10-30 22:57:33 -05:00
Brent Cook	98a5122bc6	portable asm generator patches for portable This reverses changes from the 3.8.x upstream that are causing issues on a few different platforms, including macOS x64, Windows, and older Linux/FreeBSD.	2023-10-30 22:55:29 -05:00
Brent Cook	1fd73818df	adjust how sizeof time_t is set, the current way causes issues with MSVC 2022's preprocessor	2023-10-29 16:52:28 -05:00
Brent Cook	ce79c96489	Land #913 , CMake build fixes	2023-10-29 12:34:01 -05:00
Pierre Wendling	c4bb6b79ea	MSVC: Enable building ocspcheck. - Add `STDIN_FILENO` to compat unistd header. - Use quotes to include compat getopt header in the compat unistd. - Export additional symbols needed by ocspcheck (optarg, optind, ftruncate)	2023-10-29 12:28:44 -05:00
Brent Cook	8048941622	Land #909 , Fix processor detection with Cmake	2023-10-29 12:01:49 -05:00
Brent Cook	321fa56d9a	disable MSVC x64 asm	2023-10-29 11:20:18 -05:00
Brent Cook	01e3b10f50	remove conflicting align directives for MASM	2023-10-29 11:18:52 -05:00
Brent Cook	fca20b23d6	remove unneeded switch for MSVC, cleanup comment alignment	2023-10-29 11:17:00 -05:00
Theo Buehler	fe731f3db0	Update ChangeLog	2023-10-19 06:01:07 -06:00
Brent Cook	5319ff3b17	create OpenBSD 7.4 branch	2023-10-18 04:08:21 -05:00
Theo Buehler	04fa997f54	Link x509_algor test to build	2023-10-11 09:56:40 -06:00
Theo Buehler	b112e37275	Update ChangeLog	2023-10-03 10:46:50 -06:00
Theo Buehler	8e4af3b18b	Update ChangeLog	2023-10-02 06:39:11 -06:00
Brent Cook	1defa3baa5	package getopt compat files	2023-10-01 21:11:11 -05:00
Theo Buehler	c923880fb9	Update ChangeLog	2023-10-01 17:24:14 -06:00
Theo Buehler	e56ec2ae95	Update man links	2023-09-29 10:57:53 -06:00
Theo Buehler	70db97f5a6	ChangeLog	2023-09-29 10:23:51 -06:00
Theo Buehler	f3c946b03f	Update man links	2023-09-28 07:52:48 -06:00
Theo Buehler	dbf729b46e	Update changelog	2023-09-28 07:50:19 -06:00
Theo Buehler	9e5971d828	Update ChangeLog	2023-09-24 14:26:34 -06:00
Theo Buehler	ef5867b4e6	Update man links	2023-09-18 13:03:12 -06:00
Marc Aldorasi	c90e80d21e	Properly check components	2023-09-12 15:08:44 -04:00
Marc Aldorasi	4663543082	Consistently use CMAKE_CURRENT_BINARY_DIR	2023-09-12 15:07:51 -04:00
Theo Buehler	ccaec87950	update man links	2023-09-10 13:30:20 -06:00
Theo Buehler	34f45b6cd7	Update man links	2023-09-07 11:51:21 -06:00
Jiajie Chen	70688874f8	Fix processor detection in CMakeLists.txt	2023-09-04 09:34:44 +08:00
Theo Buehler	a6bd25d3bd	Rebase rust-openssl patch	2023-09-02 04:02:03 -06:00
Theo Buehler	8fa9337f65	Prepare 3.8.2 ChangeLog	2023-08-31 10:13:29 -06:00