build: out-kludge the installed header include kludge

This is a, erm, beautiful(?) mess. I feel like there probably ought to be a better way to handle this use case, but the way that the includes are handled in this specific codebase are extremely weird (how many times have you actually seen #include_next get used?). It may be worth making this a more natural path to take, though.
build: update for zig-0.13.0 release
2024-06-18 20:41:00 -07:00 · 2024-06-17 23:16:44 -07:00 · 2024-05-12 23:42:59 -07:00 · 2024-01-15 15:38:06 -08:00 · 2024-01-15 15:38:06 -08:00 · 2024-01-15 15:30:20 -08:00
25 changed files with 3206 additions and 360 deletions
--- a/.github/rust-openssl.patch
+++ b/.github/rust-openssl.patch
@@ -1,13 +1,13 @@
 diff --git a/openssl-sys/build/main.rs b/openssl-sys/build/main.rs
-index 21ccf3d0..1cf2d184 100644
+index 82013b6c..2974abed 100644
 --- a/openssl-sys/build/main.rs
 +++ b/openssl-sys/build/main.rs
-@@ -272,7 +272,7 @@ See rust-openssl documentation for more information:
-             (3, 7, 0) => ('3', '7', '0'),
+@@ -273,7 +273,7 @@ See rust-openssl documentation for more information:
             (3, 7, 1) => ('3', '7', '1'),
             (3, 7, _) => ('3', '7', 'x'),
-            (3, 8, 0) => ('3', '8', '0'),
-+            (3, 8, _) => ('3', '8', '0'),
+             (3, 8, 0) => ('3', '8', '0'),
+-            (3, 8, 1) => ('3', '8', '1'),
+            (3, 8, _) => ('3', '8', 'x'),
             _ => version_error(),
         };
 
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -63,11 +63,7 @@ if(NOT CMAKE_BUILD_TYPE AND NOT CMAKE_CONFIGURATION_TYPES)
 endif()

 # Enable asserts regardless of build type
-if(MSVC)
-	add_definitions(/UNDEBUG)
-else()
-	add_definitions(-UNDEBUG)
-endif()
+add_definitions(-UNDEBUG)

 set(BUILD_NC true)

@@ -152,17 +148,17 @@ if(MSVC)
 			"C4100" # 'identifier' : unreferenced formal parameter
 			"C4127" # conditional expression is constant
 			"C4146" # unary minus operator applied to unsigned type,
-				# result still unsigned
+			        # result still unsigned
 			"C4244" # 'argument' : conversion from 'type1' to 'type2',
-				# possible loss of data
+			        # possible loss of data
 			"C4245" # 'conversion' : conversion from 'type1' to 'type2',
-				# signed/unsigned mismatch
+			        # signed/unsigned mismatch
 			"C4267" # 'var' : conversion from 'size_t' to 'type',
-				# possible loss of data
+			        # possible loss of data
 			"C4389" # 'operator' : signed/unsigned mismatch
 			"C4706" # assignment within conditional expression
 			"C4996" # The POSIX name for this item is deprecated.
-				# Instead, use the ISO C and C++ conformant name
+			        # Instead, use the ISO C and C++ conformant name
 		)
 	elseif(CMAKE_C_COMPILER_ID MATCHES "Intel")
 		add_definitions(-D_CRT_SUPPRESS_RESTRICT)
@@ -333,32 +329,32 @@ endif()
 # single architecture work on macOS at least.
 #
 # Don't set CMAKE_OSX_ARCHITECTURES to more than a single value for now.
-if(APPLE)
+if(APPLE AND (NOT CMAKE_OSX_ARCHITECTURES STREQUAL ""))
 	set(CMAKE_SYSTEM_PROCESSOR "${CMAKE_OSX_ARCHITECTURES}")
 endif()

-if("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "(aarch64|arm64)")
+if("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "(aarch64|arm64|ARM64)")
 	set(HOST_AARCH64 true)
 elseif("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "arm")
 	set(HOST_ARM true)
 elseif("${CMAKE_SYSTEM_NAME}" STREQUAL "SunOS" AND "${CMAKE_SYSTEM_PROCESSOR}" STREQUAL "i386")
 	set(HOST_X86_64 true)
-elseif("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "(x86_64|amd64)")
+elseif("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "(x86_64|amd64|AMD64)")
 	set(HOST_X86_64 true)
-elseif("${CMAKE_SYSTEM_NAME}" MATCHES "[i?86|x86]")
+elseif("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "(i[3-6]86|[xX]86)")
 	set(ENABLE_ASM false)
 	set(HOST_I386 true)
-elseif("${CMAKE_SYSTEM_NAME}" MATCHES "mips64")
+elseif("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "mips64")
 	set(HOST_MIPS64 true)
-elseif("${CMAKE_SYSTEM_NAME}" MATCHES "mips")
+elseif("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "mips")
 	set(HOST_MIPS true)
-elseif("${CMAKE_SYSTEM_NAME}" MATCHES "powerpc")
+elseif("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "powerpc")
 	set(HOST_POWERPC true)
-elseif("${CMAKE_SYSTEM_NAME}" MATCHES "ppc64")
+elseif("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "ppc64")
 	set(HOST_PPC64 true)
-elseif("${CMAKE_SYSTEM_NAME}" MATCHES "riscv64")
+elseif("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "riscv64")
 	set(HOST_RISCV64 true)
-elseif("${CMAKE_SYSTEM_NAME}" MATCHES "sparc64")
+elseif("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "sparc64")
 	set(HOST_SPARC64 true)
 else()
 	set(ENABLE_ASM false)
@@ -405,7 +401,6 @@ if(SIZEOF_TIME_T STREQUAL "4")
 	message(WARNING " ** Warning, this system is unable to represent times past 2038\n"
 	                " ** It will behave incorrectly when handling valid RFC5280 dates")
 endif()
-add_definitions(-DSIZEOF_TIME_T=${SIZEOF_TIME_T})

 set(OPENSSL_LIBS ssl crypto ${PLATFORM_LIBS})
 set(LIBTLS_LIBS tls ${PLATFORM_LIBS})
@@ -473,8 +468,8 @@ if(ENABLE_LIBRESSL_INSTALL)
  	INSTALL_DESTINATION "${LIBRESSL_INSTALL_CMAKEDIR}"
 	)
 	install(FILES
-		"${CMAKE_BINARY_DIR}/install-config/LibreSSLConfig.cmake"
-		"${CMAKE_BINARY_DIR}/LibreSSLConfigVersion.cmake"
+		"${CMAKE_CURRENT_BINARY_DIR}/install-config/LibreSSLConfig.cmake"
+		"${CMAKE_CURRENT_BINARY_DIR}/LibreSSLConfigVersion.cmake"
 		DESTINATION "${LIBRESSL_INSTALL_CMAKEDIR}"
 	)
 endif()
--- a/43
+++ b/43
@@ -28,7 +28,48 @@ history is also available from Git.

 LibreSSL Portable Release Notes:

-3.8.1 - In development
+3.9.0 - In development
+
+	* Portable changes
+	* Internal improvements
+	* Documentation improvements
+	* Testing and proactive security
+	* Bug fixes
+	  - Fixed aliasing issues in BN_mod_exp_simple() and BN_mod_exp_recp()
+
+3.8.2 - Stable release
+
+	* Portable changes
+	  - Fixed processor detection for CMake targets.
+	     Thanks to @jiegec from github.
+	  - Enabled building oscpcheck with MSVC.
+	     Thanks to @FtZPetruska from github.
+	  - Improve CMake package detection and installation.
+	     Thanks to @mark-groundctl from github.
+	  - Fixed assembly optimizations on x64 Windows targets.
+	  - Allow disabling warnings about WINCRYPT overrides.
+	  - Use system arc4random on FreeBSD 12 and newer.
+	* Documentation improvements
+	  - Documented the RFC 3779 API.
+	* Compatibility changes
+	  - Restrict the RFC 3779 code to IPv4 and IPv6. It was not written
+	    to be able to deal with anything else.
+	  - Fixed EVP_CIPHER_CTX_iv_length() to return what was set with
+	    EVP_CTRL_AEAD_SET_IVLEN or one of its aliases.
+	* Bug fixes
+	  - Fixed EVP_PKEY_get{0,1}_RSA for RSA-PSS.
+	  - Plug a potential memory leak in ASN1_TIME_normalize().
+	  - Avoid memory leak in EVP_CipherInit().
+	  - Redirect EVP_PKEY_get1_* through their get0 siblings.
+	  - Fixed a use of uninitialized in i2r_IPAddrBlocks().
+	  - Rewrote CMS_SignerInfo_{sign,verify}().
+	  - Further cleanup and refactoring in the EC code.
+	  - Allow IP addresses to be specified in a URI.
+	  - Fixed a copy-paste error in ASN1_TIME_compare() that could lead
+	    to two UTCTimes or two GeneralizedTimes incorrectly being compared
+	    as equal.
+
+3.8.1 - Development release

 	* Portable changes
 	  - Applications bundled as part of the LibreSSL package internally,
--- a/LibreSSLConfig.cmake.in
+++ b/LibreSSLConfig.cmake.in
@@ -6,16 +6,19 @@ set_and_check(LIBRESSL_INCLUDE_DIR @PACKAGE_INCLUDE_DIRECTORY@)
 if(EXISTS "${CMAKE_CURRENT_LIST_DIR}/LibreSSL-Crypto.cmake")
  include("${CMAKE_CURRENT_LIST_DIR}/LibreSSL-Crypto.cmake")
  set(LIBRESSL_CRYPTO_LIBRARY LibreSSL::Crypto)
+  set(LibreSSL_Crypto_FOUND TRUE)
 endif()

 if(EXISTS "${CMAKE_CURRENT_LIST_DIR}/LibreSSL-SSL.cmake")
  include("${CMAKE_CURRENT_LIST_DIR}/LibreSSL-SSL.cmake")
  set(LIBRESSL_SSL_LIBRARY LibreSSL::SSL)
+  set(LibreSSL_SSL_FOUND TRUE)
 endif()

 if(EXISTS "${CMAKE_CURRENT_LIST_DIR}/LibreSSL-TLS.cmake")
  include("${CMAKE_CURRENT_LIST_DIR}/LibreSSL-TLS.cmake")
  set(LIBRESSL_TLS_LIBRARY LibreSSL::TLS)
+  set(LibreSSL_TLS_FOUND TRUE)
 endif()

 set(LIBRESSL_LIBRARIES
@@ -24,10 +27,10 @@ set(LIBRESSL_LIBRARIES
  ${LIBRESSL_TLS_LIBRARY}
 )

-check_required_components(
-  Crypto
-  SSL
-  TLS
-)
+check_required_components(LibreSSL)

-set(LIBRESSL_FOUND TRUE)
+if(DEFINED LibreSSL_FOUND)
+	set(LIBRESSL_FOUND ${LibreSSL_FOUND})
+else()
+	set(LIBRESSL_FOUND TRUE)
+endif()
--- a/2
+++ b/2
@@ -1 +1 @@
-master
+OPENBSD_7_4
--- a/README.md
+++ b/README.md
@@ -1,213 +1,16 @@
-![LibreSSL image](https://www.libressl.org/images/libressl.jpg)
-## Official portable version of [LibreSSL](https://www.libressl.org) ##
+### LibreSSL with a Zig build system

-[![Linux Build Status](https://github.com/libressl/portable/actions/workflows/linux_test.yml/badge.svg)](https://github.com/libressl/portable/actions/workflows/linux_test.yml)
-[![macOS Build Status](https://github.com/libressl/portable/actions/workflows/macos_test.yml/badge.svg)](https://github.com/libressl/portable/actions/workflows/macos_test.yml)
-[![Android Build Status](https://github.com/libressl/portable/actions/workflows/android_test.yml/badge.svg)](https://github.com/libressl/portable/actions/workflows/android_test.yml)
-[![Cross Build Status](https://github.com/libressl/portable/actions/workflows/cross_test.yml/badge.svg)](https://github.com/libressl/portable/actions/workflows/cross_test.yml)
-[![Solaris Build Status](https://github.com/libressl/portable/actions/workflows/solaris_test.yml/badge.svg)](https://github.com/libressl/portable/actions/workflows/solaris_test.yml)
-[![Fuzzing Status](https://oss-fuzz-build-logs.storage.googleapis.com/badges/libressl.svg)](https://bugs.chromium.org/p/oss-fuzz/issues/list?sort=-opened&can=1&q=proj:libressl)
-[![ASan Status](https://github.com/libressl/portable/actions/workflows/linux_test_asan.yml/badge.svg)](https://github.com/libressl/portable/actions/workflows/linux_test_asan.yml)
+This is a somewhat hacky port of the LibreSSL build system to Zig. It builds LibreSSL exclusively as static libraries. It does not (currently) build the LibreSSL command-line executables, like `openssl`.

-LibreSSL is a fork of [OpenSSL](https://www.openssl.org) 1.0.1g developed by the
-[OpenBSD](https://www.openbsd.org) project.  Our goal is to modernize the codebase,
-improve security, and apply best practice development processes from OpenBSD.
+Notes:

-## Compatibility with OpenSSL: ##
+1. In order for this to work, `.\update.sh` must have first been run to bring in the LibreSSL OpenBSD sources. (Or, if you trust me, you may use the `zig-3.8.2` branch which has the upstream sources committed to the repository, for ease of use with the Zig package manager).

-LibreSSL provides much of the OpenSSL 1.1 API. The OpenSSL 3 API is not currently
-supported. Incompatibilities between the projects exist and are unavoidable since
-both evolve with different goals and priorities. Important incompatibilities will
-be addressed if possible and as long as they are not too detrimental to LibreSSL's
-goals of simplicity, security and sanity. We do not add new features, ciphers and
-API without a solid reason and require that new code be clean and of high quality.
+2. I don't know if this causes LibreSSL to be compiled in a way that Compromises Its Cryptographic Integrity. Hopefully it is not even possible to do such a thing in the first place. But I am not an expert, and I ain't looking to port the tests.

-LibreSSL is not ABI compatible with any release of OpenSSL, or necessarily
-earlier releases of LibreSSL. You will need to relink your programs to
-LibreSSL in order to use it, just as in moving between major versions of OpenSSL.
-LibreSSL's installed library version numbers are incremented to account for
-ABI and API changes.
+3. This does not (currently) compile the assembly routines, only the C versions, which may cause reduced performance on some platforms.

-## Compatibility with other operating systems: ##
+4. Only the "big 3" platforms are supported (namely: macOS, Linux, and Windows). Native and cross-compilation appears to work on modern versions of all three, but this has not been exhaustively tested.

-While primarily developed on and taking advantage of APIs available on OpenBSD,
-the LibreSSL portable project attempts to provide working alternatives for
-other operating systems, and assists with improving OS-native implementations
-where possible.
+5. Why LibreSSL? It has a CMake-based build system rather than the insane hand-rolled perl mess that OpenSSL does, so it was very straightforward to follow the build process for the purposes of porting it. In theory, its OpenSSL compatibility layer makes it possible to use with a variety of other programs that want to link OpenSSL.

-At the time of this writing, LibreSSL is known to build and work on:
-
-* Linux (kernel 3.17 or later recommended)
-* FreeBSD (tested with 9.2 and later)
-* NetBSD (7.0 or later recommended)
-* HP-UX (11i)
-* Solaris 11 and later
-* Mac OS X (tested with 10.8 and later)
-* AIX (5.3 and later)
-
-LibreSSL also supports the following Windows environments:
-* Microsoft Windows (Windows 7 / Windows Server 2008r2 or later, x86 and x64)
-* Wine (32-bit and 64-bit)
-* Mingw-w64, Cygwin, and Visual Studio
-
-Official release tarballs are available at your friendly neighborhood
-OpenBSD mirror in directory
-[LibreSSL](https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/),
-although we suggest that you use a [mirror](https://www.openbsd.org/ftp.html).
-
-The LibreSSL portable build framework is also
-[mirrored](https://github.com/libressl/portable) on GitHub.
-
-Please report bugs either to the public libressl@openbsd.org mailing list,
-or to the GitHub
-[issue tracker](https://github.com/libressl/portable/issues)
-
-Severe vulnerabilities or bugs requiring coordination with OpenSSL can be
-sent to the core team at libressl-security@openbsd.org.
-
-# Building LibreSSL #
-
-## Prerequisites when building from a Git checkout ##
-
-If you have checked this source using Git, or have downloaded a source tarball
-from Github, follow these initial steps to prepare the source tree for
-building. _Note: Your build will fail if you do not follow these instructions! If you cannot follow these instructions (e.g. Windows system using CMake) or cannot meet these prerequistes, please download an official release distribution from https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/ instead. Using official releases is strongly advised if you are not a developer._
-
-1. Ensure you have the following packages installed:
-   automake, autoconf, git, libtool, perl
-2. Run `./autogen.sh` to prepare the source tree for building or
-   run `./dist.sh` to prepare a tarball.
-
-## Steps that apply to all builds ##
-
-Once you have a source tree, either by downloaded using git and having
-run the `autogen.sh` script above, or by downloading a release distribution from
-an OpenBSD mirror, run these commands to build and install the package on most
-systems:
-
-```sh
-./configure   # see ./configure --help for configuration options
-make check    # runs builtin unit tests
-make install  # set DESTDIR= to install to an alternate location
-```
-
-If you wish to use the CMake build system, use these commands:
-
-```sh
-mkdir build
-cd build
-cmake ..
-make
-make test
-```
-
-For faster builds, you can use Ninja as well:
-
-```sh
-mkdir build-ninja
-cd build-ninja
-cmake -G"Ninja" ..
-ninja
-ninja test
-```
-
-### OS specific build information: ###
-
-#### HP-UX (11i) ####
-
-Set the UNIX_STD environment variable to `2003` before running `configure`
-in order to build with the HP C/aC++ compiler. See the "standards(5)" man
-page for more details.
-
-```sh
-export UNIX_STD=2003
-./configure
-make
-```
-
-#### Windows - Mingw-w64 ####
-
-LibreSSL builds against relatively recent versions of Mingw-w64, not to be
-confused with the original mingw.org project.  Mingw-w64 3.2 or later
-should work. See README.windows for more information
-
-#### Windows - Visual Studio ####
-
-LibreSSL builds using the CMake target "Visual Studio 12 2013" and newer. To
-generate a Visual Studio project, install CMake, enter the LibreSSL source
-directory and run:
-
-```sh
- mkdir build-vs2013
- cd build-vs2013
- cmake -G"Visual Studio 12 2013" ..
-```
-
-Replace "Visual Studio 12 2013" with whatever version of Visual Studio you
-have installed. This will generate a LibreSSL.sln file that you can incorporate
-into other projects or build by itself.
-
-#### Cmake - Additional Options ####
-
-| Option Name | Default | Description
-| ------------ | -----: | ------
-|  LIBRESSL_SKIP_INSTALL | OFF | allows skipping install() rules.  Can be specified from command line using <br>```-DLIBRESSL_SKIP_INSTALL=ON``` |
-|  LIBRESSL_APPS | ON | allows skipping application builds. Apps are required to run tests |
-|  LIBRESSL_TESTS | ON | allows skipping of tests. Tests are only available in static builds |
-|  BUILD_SHARED_LIBS | OFF | CMake option for building shared libraries. |
-|  ENABLE_ASM | ON | builds assembly optimized rules. |
-|  ENABLE_EXTRATESTS | OFF | Enable extra tests that may be unreliable on some platforms |
-|  ENABLE_NC | OFF | Enable installing TLS-enabled nc(1) |
-|  OPENSSLDIR | Blank | Set the default openssl directory.  Can be specified from command line using <br>```-DOPENSSLDIR=<dirname>``` |
-
-# Using LibreSSL #
-
-## CMake ##
-
-Make a new folder in your project root (where your main CMakeLists.txt file is located) called CMake. Copy the FindLibreSSL.cmake file to that folder, and add the following line to your main CMakeLists.txt:
-
-```cmake
-set(CMAKE_MODULE_PATH "${CMAKE_CURRENT_SOURCE_DIR}/CMake;${CMAKE_MODULE_PATH}")
-```
-
-After your **add_executable** or **add_library** line in your CMakeLists.txt file add the following:
-
-```cmake
-find_package(LibreSSL REQUIRED)
-```
-
-It will tell CMake to find LibreSSL and if found will let you use the following 3 interfaces in your CMakeLists.txt file:
-
-* LibreSSL::Crypto
-* LibreSSL::SSL
-* LibreSSL::TLS
-
-If you for example want to use the LibreSSL TLS library in your test program, include it like so (SSL and Crypto are required by TLS and included automatically too):
-
-```cmake
-target_link_libraries(test LibreSSL::TLS)
-```
-
-Full example:
-
-```cmake
-cmake_minimum_required(VERSION 3.10.0)
-
-set(CMAKE_MODULE_PATH "${CMAKE_CURRENT_SOURCE_DIR}/CMake;${CMAKE_MODULE_PATH}")
-
-project(test)
-
-add_executable(test Main.cpp)
-
-find_package(LibreSSL REQUIRED)
-
-target_link_libraries(test LibreSSL::TLS)
-```
-
-#### Linux ####
-
-Following the guide in the sections above to compile LibreSSL using make and running "sudo make install" will install LibreSSL to the /usr/local/ folder, and will found automatically by find_package. If your system installs it to another location or you have placed them yourself in a different location, you can set the CMake variable LIBRESSL_ROOT_DIR to the correct path, to help CMake find the library.
-
-#### Windows ####
-
-Placing the library files in C:/Program Files/LibreSSL/lib and the include files in C:/Program Files/LibreSSL/include should let CMake find them automatically, but it is recommended that you use CMake-GUI to set the paths. It is more convenient as you can have the files in any folder you choose.
--- a/README.upstream.md
+++ b/README.upstream.md
@@ -0,0 +1,212 @@
+![LibreSSL image](https://www.libressl.org/images/libressl.jpg)
+## Official portable version of [LibreSSL](https://www.libressl.org) ##
+
+[![Linux Build Status](https://github.com/libressl/portable/actions/workflows/linux_test.yml/badge.svg)](https://github.com/libressl/portable/actions/workflows/linux_test.yml)
+[![macOS Build Status](https://github.com/libressl/portable/actions/workflows/macos_test.yml/badge.svg)](https://github.com/libressl/portable/actions/workflows/macos_test.yml)
+[![Android_Build Status](https://github.com/libressl/portable/actions/workflows/android_test.yml/badge.svg)](https://github.com/libressl/portable/actions/workflows/android_test.yml)
+[![Cross_Build Status](https://github.com/libressl/portable/actions/workflows/cross_test.yml/badge.svg)](https://github.com/libressl/portable/actions/workflows/cross_test.yml)
+[![Fuzzing Status](https://oss-fuzz-build-logs.storage.googleapis.com/badges/libressl.svg)](https://bugs.chromium.org/p/oss-fuzz/issues/list?sort=-opened&can=1&q=proj:libressl)
+[![ASan Status](https://github.com/libressl/portable/actions/workflows/linux_test_asan.yml/badge.svg)](https://github.com/libressl/portable/actions/workflows/linux_test_asan.yml)
+
+LibreSSL is a fork of [OpenSSL](https://www.openssl.org) 1.0.1g developed by the
+[OpenBSD](https://www.openbsd.org) project.  Our goal is to modernize the codebase,
+improve security, and apply best practice development processes from OpenBSD.
+
+## Compatibility with OpenSSL: ##
+
+LibreSSL provides much of the OpenSSL 1.1 API. The OpenSSL 3 API is not currently
+supported. Incompatibilities between the projects exist and are unavoidable since
+both evolve with different goals and priorities. Important incompatibilities will
+be addressed if possible and as long as they are not too detrimental to LibreSSL's
+goals of simplicity, security and sanity. We do not add new features, ciphers and
+API without a solid reason and require that new code be clean and of high quality.
+
+LibreSSL is not ABI compatible with any release of OpenSSL, or necessarily
+earlier releases of LibreSSL. You will need to relink your programs to
+LibreSSL in order to use it, just as in moving between major versions of OpenSSL.
+LibreSSL's installed library version numbers are incremented to account for
+ABI and API changes.
+
+## Compatibility with other operating systems: ##
+
+While primarily developed on and taking advantage of APIs available on OpenBSD,
+the LibreSSL portable project attempts to provide working alternatives for
+other operating systems, and assists with improving OS-native implementations
+where possible.
+
+At the time of this writing, LibreSSL is known to build and work on:
+
+* Linux (kernel 3.17 or later recommended)
+* FreeBSD (tested with 9.2 and later)
+* NetBSD (7.0 or later recommended)
+* HP-UX (11i)
+* Solaris (11 and later preferred)
+* Mac OS X (tested with 10.8 and later)
+* AIX (5.3 and later)
+
+LibreSSL also supports the following Windows environments:
+* Microsoft Windows (Windows 7 / Windows Server 2008r2 or later, x86 and x64)
+* Wine (32-bit and 64-bit)
+* Mingw-w64, Cygwin, and Visual Studio
+
+Official release tarballs are available at your friendly neighborhood
+OpenBSD mirror in directory
+[LibreSSL](https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/),
+although we suggest that you use a [mirror](https://www.openbsd.org/ftp.html).
+
+The LibreSSL portable build framework is also
+[mirrored](https://github.com/libressl/portable) on GitHub.
+
+Please report bugs either to the public libressl@openbsd.org mailing list,
+or to the GitHub
+[issue tracker](https://github.com/libressl/portable/issues)
+
+Severe vulnerabilities or bugs requiring coordination with OpenSSL can be
+sent to the core team at libressl-security@openbsd.org.
+
+# Building LibreSSL #
+
+## Prerequisites when building from a Git checkout ##
+
+If you have checked this source using Git, or have downloaded a source tarball
+from Github, follow these initial steps to prepare the source tree for
+building. _Note: Your build will fail if you do not follow these instructions! If you cannot follow these instructions (e.g. Windows system using CMake) or cannot meet these prerequistes, please download an official release distribution from https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/ instead. Using official releases is strongly advised if you are not a developer._
+
+1. Ensure you have the following packages installed:
+   automake, autoconf, git, libtool, perl
+2. Run `./autogen.sh` to prepare the source tree for building or
+   run `./dist.sh` to prepare a tarball.
+
+## Steps that apply to all builds ##
+
+Once you have a source tree, either by downloaded using git and having
+run the `autogen.sh` script above, or by downloading a release distribution from
+an OpenBSD mirror, run these commands to build and install the package on most
+systems:
+
+```sh
+./configure   # see ./configure --help for configuration options
+make check    # runs builtin unit tests
+make install  # set DESTDIR= to install to an alternate location
+```
+
+If you wish to use the CMake build system, use these commands:
+
+```sh
+mkdir build
+cd build
+cmake ..
+make
+make test
+```
+
+For faster builds, you can use Ninja as well:
+
+```sh
+mkdir build-ninja
+cd build-ninja
+cmake -G"Ninja" ..
+ninja
+ninja test
+```
+
+### OS specific build information: ###
+
+#### HP-UX (11i) ####
+
+Set the UNIX_STD environment variable to `2003` before running `configure`
+in order to build with the HP C/aC++ compiler. See the "standards(5)" man
+page for more details.
+
+```sh
+export UNIX_STD=2003
+./configure
+make
+```
+
+#### Windows - Mingw-w64 ####
+
+LibreSSL builds against relatively recent versions of Mingw-w64, not to be
+confused with the original mingw.org project.  Mingw-w64 3.2 or later
+should work. See README.windows for more information
+
+#### Windows - Visual Studio ####
+
+LibreSSL builds using the CMake target "Visual Studio 12 2013" and newer. To
+generate a Visual Studio project, install CMake, enter the LibreSSL source
+directory and run:
+
+```sh
+ mkdir build-vs2013
+ cd build-vs2013
+ cmake -G"Visual Studio 12 2013" ..
+```
+
+Replace "Visual Studio 12 2013" with whatever version of Visual Studio you
+have installed. This will generate a LibreSSL.sln file that you can incorporate
+into other projects or build by itself.
+
+#### Cmake - Additional Options ####
+
+| Option Name | Default | Description
+| ------------ | -----: | ------
+|  LIBRESSL_SKIP_INSTALL | OFF | allows skipping install() rules.  Can be specified from command line using <br>```-DLIBRESSL_SKIP_INSTALL=ON``` |
+|  LIBRESSL_APPS | ON | allows skipping application builds. Apps are required to run tests |
+|  LIBRESSL_TESTS | ON | allows skipping of tests. Tests are only available in static builds |
+|  BUILD_SHARED_LIBS | OFF | CMake option for building shared libraries. |
+|  ENABLE_ASM | ON | builds assembly optimized rules. |
+|  ENABLE_EXTRATESTS | OFF | Enable extra tests that may be unreliable on some platforms |
+|  ENABLE_NC | OFF | Enable installing TLS-enabled nc(1) |
+|  OPENSSLDIR | Blank | Set the default openssl directory.  Can be specified from command line using <br>```-DOPENSSLDIR=<dirname>``` |
+
+# Using LibreSSL #
+
+## CMake ##
+
+Make a new folder in your project root (where your main CMakeLists.txt file is located) called CMake. Copy the FindLibreSSL.cmake file to that folder, and add the following line to your main CMakeLists.txt:
+
+```cmake
+set(CMAKE_MODULE_PATH "${CMAKE_CURRENT_SOURCE_DIR}/CMake;${CMAKE_MODULE_PATH}")
+```
+
+After your **add_executable** or **add_library** line in your CMakeLists.txt file add the following:
+
+```cmake
+find_package(LibreSSL REQUIRED)
+```
+
+It will tell CMake to find LibreSSL and if found will let you use the following 3 interfaces in your CMakeLists.txt file:
+
+* LibreSSL::Crypto
+* LibreSSL::SSL
+* LibreSSL::TLS
+
+If you for example want to use the LibreSSL TLS library in your test program, include it like so (SSL and Cryto are required by TLS and included automatically too):
+
+```cmake
+target_link_libraries(test LibreSSL::TLS)
+```
+
+Full example:
+
+```cmake
+cmake_minimum_required(VERSION 3.10.0)
+
+set(CMAKE_MODULE_PATH "${CMAKE_CURRENT_SOURCE_DIR}/CMake;${CMAKE_MODULE_PATH}")
+
+project(test)
+
+add_executable(test Main.cpp)
+
+find_package(LibreSSL REQUIRED)
+
+target_link_libraries(test LibreSSL::TLS)
+```
+
+#### Linux ####
+
+Following the guide in the sections above to compile LibreSSL using make and running "sudo make install" will install LibreSSL to the /usr/local/ folder, and will found automatically by find_package. If your system installs it to another location or you have placed them yourself in a different location, you can set the CMake variable LIBRESSL_ROOT_DIR to the correct path, to help CMake find the library.
+
+#### Windows ####
+
+Placing the library files in C:/Program Files/LibreSSL/lib and the include files in C:/Program Files/LibreSSL/include should let CMake find them automatically, but it is recommended that you use CMake-GUI to set the paths. It is more convenient as you can have the files in any folder you choose.
--- a/apps/ocspcheck/CMakeLists.txt
+++ b/apps/ocspcheck/CMakeLists.txt
@@ -1,5 +1,3 @@
-if(NOT MSVC)
-
 set(
 	OCSPCHECK_SRC
 	http.c
@@ -33,5 +31,3 @@ if(ENABLE_LIBRESSL_INSTALL)
 	install(FILES ocspcheck.8 DESTINATION ${CMAKE_INSTALL_MANDIR}/man8)

 endif(ENABLE_LIBRESSL_INSTALL)
-
-endif()
--- a/build.zig
+++ b/build.zig
--- a/crypto/CMakeLists.txt
+++ b/crypto/CMakeLists.txt
@@ -111,7 +111,6 @@ if(HOST_ASM_MACOSX_X86_64)
 		bn/arch/amd64/word_clz.S
 		bn/arch/amd64/bn_arch.c
 	)
-	add_definitions(-Dendbr64=)
 	add_definitions(-DAES_ASM)
 	add_definitions(-DBSAES_ASM)
 	add_definitions(-DVPAES_ASM)
@@ -153,6 +152,7 @@ if(HOST_ASM_MASM_X86_64)
 		whrlpool/wp-masm-x86_64.S
 		cpuid-masm-x86_64.S
 	)
+	add_definitions(-Dendbr64=)
 	add_definitions(-DAES_ASM)
 	add_definitions(-DBSAES_ASM)
 	add_definitions(-DVPAES_ASM)
@@ -193,6 +193,7 @@ if(HOST_ASM_MINGW64_X86_64)
 		whrlpool/wp-mingw64-x86_64.S
 		cpuid-mingw64-x86_64.S
 	)
+	add_definitions(-Dendbr64=)
 	add_definitions(-DAES_ASM)
 	add_definitions(-DBSAES_ASM)
 	add_definitions(-DVPAES_ASM)
@@ -778,6 +779,8 @@ endif()
 if(NOT HAVE_GETOPT)
 	set(CRYPTO_SRC ${CRYPTO_SRC} compat/getopt_long.c)
 	set(EXTRA_EXPORT ${EXTRA_EXPORT} getopt)
+	set(EXTRA_EXPORT ${EXTRA_EXPORT} optarg)
+	set(EXTRA_EXPORT ${EXTRA_EXPORT} optind)
 endif()

 if(NOT HAVE_GETPAGESIZE)
--- a/crypto/Makefile.am
+++ b/crypto/Makefile.am
@@ -36,6 +36,7 @@ EXTRA_DIST += empty.c

 # needed for a CMake target
 EXTRA_DIST += compat/strcasecmp.c
+EXTRA_DIST += compat/getopt_long.c

 BUILT_SOURCES = crypto_portable.sym
 CLEANFILES = crypto_portable.sym
--- a/crypto/Makefile.am.macosx-x86_64
+++ b/crypto/Makefile.am.macosx-x86_64
@@ -34,7 +34,6 @@ ASM_X86_64_MACOSX += bn/arch/amd64/bn_arch.c
 EXTRA_DIST += $(ASM_X86_64_MACOSX)

 if HOST_ASM_MACOSX_X86_64
-libcrypto_la_CPPFLAGS += -Dendbr64=
 libcrypto_la_CPPFLAGS += -DAES_ASM
 libcrypto_la_CPPFLAGS += -DBSAES_ASM
 libcrypto_la_CPPFLAGS += -DVPAES_ASM
--- a/crypto/compat/ui_openssl_win.c
+++ b/crypto/compat/ui_openssl_win.c
@@ -139,9 +139,6 @@ static int is_a_tty;

 /* Declare static functions */
 static int read_till_nl(FILE *);
-static void recsig(int);
-static void pushsig(void);
-static void popsig(void);
 static int read_string_inner(UI *ui, UI_STRING *uis, int echo, int strip_nl);

 static int read_string(UI *ui, UI_STRING *uis);
@@ -236,8 +233,6 @@ read_till_nl(FILE *in)
 	return 1;
 }

-static volatile sig_atomic_t intr_signal;
-
 static int
 read_string_inner(UI *ui, UI_STRING *uis, int echo, int strip_nl)
 {
@@ -247,12 +242,9 @@ read_string_inner(UI *ui, UI_STRING *uis, int echo, int strip_nl)
 	int maxsize = BUFSIZ - 1;
 	char *p;

-	intr_signal = 0;
 	ok = 0;
 	ps = 0;

-	pushsig();
-
 	ps = 1;

 	if (!echo && !noecho_console(ui))
@@ -276,16 +268,11 @@ read_string_inner(UI *ui, UI_STRING *uis, int echo, int strip_nl)
 		ok = 1;

 error:
-	if (intr_signal == SIGINT)
-		ok = -1;
 	if (!echo)
 		fprintf(tty_out, "\n");
 	if (ps >= 2 && !echo && !echo_console(ui))
 		ok = 0;

-	if (ps >= 1)
-		popsig();
-
 	explicit_bzero(result, BUFSIZ);
 	return ok;
 }
@@ -348,32 +335,3 @@ close_console(UI *ui)

 	return 1;
 }
-
-/* Internal functions to handle signals and act on them */
-static void
-pushsig(void)
-{
-	savsig[SIGABRT] = signal(SIGABRT, recsig);
-	savsig[SIGFPE]  = signal(SIGFPE,  recsig);
-	savsig[SIGILL]  = signal(SIGILL,  recsig);
-	savsig[SIGINT]  = signal(SIGINT,  recsig);
-	savsig[SIGSEGV] = signal(SIGSEGV, recsig);
-	savsig[SIGTERM] = signal(SIGTERM, recsig);
-}
-
-static void
-popsig(void)
-{
-	signal(SIGABRT, savsig[SIGABRT]);
-	signal(SIGFPE,  savsig[SIGFPE]);
-	signal(SIGILL,  savsig[SIGILL]);
-	signal(SIGINT,  savsig[SIGINT]);
-	signal(SIGSEGV, savsig[SIGSEGV]);
-	signal(SIGTERM, savsig[SIGTERM]);
-}
-
-static void
-recsig(int i)
-{
-	intr_signal = i;
-}
--- a/include/Makefile.am
+++ b/include/Makefile.am
@@ -10,6 +10,7 @@ noinst_HEADERS += compat/dirent_msvc.h
 noinst_HEADERS += compat/endian.h
 noinst_HEADERS += compat/err.h
 noinst_HEADERS += compat/fcntl.h
+noinst_HEADERS += compat/getopt.h
 noinst_HEADERS += compat/limits.h
 noinst_HEADERS += compat/netdb.h
 noinst_HEADERS += compat/poll.h
--- a/include/compat/time.h
+++ b/include/compat/time.h
@@ -3,6 +3,14 @@
 * sys/time.h compatibility shim
 */

+#ifndef SIZEOF_TIME_T
+#ifdef SMALL_TIME_T
+#define SIZEOF_TIME_T 4
+#else
+#define SIZEOF_TIME_T 8
+#endif
+#endif
+
 #ifdef _MSC_VER
 #if _MSC_VER >= 1900
 #include <../ucrt/time.h>
--- a/include/compat/unistd.h
+++ b/include/compat/unistd.h
@@ -23,6 +23,7 @@ ssize_t pwrite(int d, const void *buf, size_t nbytes, off_t offset);
 #include <io.h>
 #include <process.h>

+#define STDIN_FILENO    0
 #define STDOUT_FILENO   1
 #define STDERR_FILENO   2

@@ -65,7 +66,7 @@ int getentropy(void *buf, size_t buflen);
 #endif

 #ifndef HAVE_GETOPT
-#include <getopt.h>
+#include "getopt.h"
 #endif

 #ifndef HAVE_GETPAGESIZE
--- a/m4/check-os-options.m4
+++ b/m4/check-os-options.m4
@@ -61,9 +61,15 @@ char buf[1]; getentropy(buf, 1);
 	*freebsd*)
 		HOST_OS=freebsd
 		HOST_ABI=elf
-		# fork detection missing, weak seed on failure
-		# https://svnweb.freebsd.org/base/head/lib/libc/gen/arc4random.c?revision=268642&view=markup
-		USE_BUILTIN_ARC4RANDOM=yes
+		AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
+#include <sys/param.h>
+#if __FreeBSD_version < 1200000
+        undefined
+#endif
+                       ]], [[]])],
+                       [ USE_BUILTIN_ARC4RANDOM=no ],
+                       [ USE_BUILTIN_ARC4RANDOM=yes ]
+		)
 		AC_SUBST([PROG_LDADD], ['-lthr'])
 		;;
 	*hpux*)
--- a/man/links
+++ b/man/links
@@ -6,6 +6,9 @@ AES_encrypt.3,AES_cbc_encrypt.3
 AES_encrypt.3,AES_decrypt.3
 AES_encrypt.3,AES_set_decrypt_key.3
 AES_encrypt.3,AES_set_encrypt_key.3
+ASIdentifiers_new.3,ASIdentifiers_free.3
+ASIdentifiers_new.3,d2i_ASIdentifiers.3
+ASIdentifiers_new.3,i2d_ASIdentifiers.3
 ASN1_BIT_STRING_set.3,ASN1_BIT_STRING_get_bit.3
 ASN1_BIT_STRING_set.3,ASN1_BIT_STRING_set_bit.3
 ASN1_INTEGER_get.3,ASN1_ENUMERATED_get.3
@@ -137,6 +140,17 @@ ASN1_put_object.3,ASN1_object_size.3
 ASN1_put_object.3,ASN1_put_eoc.3
 ASN1_time_parse.3,ASN1_TIME_set_tm.3
 ASN1_time_parse.3,ASN1_time_tm_cmp.3
+ASRange_new.3,ASIdOrRange_free.3
+ASRange_new.3,ASIdOrRange_new.3
+ASRange_new.3,ASIdentifierChoice_free.3
+ASRange_new.3,ASIdentifierChoice_new.3
+ASRange_new.3,ASRange_free.3
+ASRange_new.3,d2i_ASIdOrRange.3
+ASRange_new.3,d2i_ASIdentifierChoice.3
+ASRange_new.3,d2i_ASRange.3
+ASRange_new.3,i2d_ASIdOrRange.3
+ASRange_new.3,i2d_ASIdentifierChoice.3
+ASRange_new.3,i2d_ASRange.3
 AUTHORITY_KEYID_new.3,AUTHORITY_KEYID_free.3
 BASIC_CONSTRAINTS_new.3,BASIC_CONSTRAINTS_free.3
 BF_set_key.3,BF_cbc_encrypt.3
@@ -869,8 +883,23 @@ EVP_AEAD_CTX_init.3,EVP_aead_aes_128_gcm.3
 EVP_AEAD_CTX_init.3,EVP_aead_aes_256_gcm.3
 EVP_AEAD_CTX_init.3,EVP_aead_chacha20_poly1305.3
 EVP_AEAD_CTX_init.3,EVP_aead_xchacha20_poly1305.3
+EVP_CIPHER_CTX_ctrl.3,EVP_CIPHER_CTX_get_iv.3
+EVP_CIPHER_CTX_ctrl.3,EVP_CIPHER_CTX_iv_length.3
+EVP_CIPHER_CTX_ctrl.3,EVP_CIPHER_CTX_key_length.3
+EVP_CIPHER_CTX_ctrl.3,EVP_CIPHER_CTX_set_iv.3
+EVP_CIPHER_CTX_ctrl.3,EVP_CIPHER_CTX_set_key_length.3
+EVP_CIPHER_CTX_ctrl.3,EVP_CIPHER_CTX_set_padding.3
+EVP_CIPHER_CTX_ctrl.3,EVP_CIPHER_iv_length.3
+EVP_CIPHER_CTX_ctrl.3,EVP_CIPHER_key_length.3
 EVP_CIPHER_CTX_get_cipher_data.3,EVP_CIPHER_CTX_buf_noconst.3
 EVP_CIPHER_CTX_get_cipher_data.3,EVP_CIPHER_CTX_set_cipher_data.3
+EVP_CIPHER_CTX_set_flags.3,EVP_CIPHER_CTX_clear_flags.3
+EVP_CIPHER_CTX_set_flags.3,EVP_CIPHER_CTX_get_app_data.3
+EVP_CIPHER_CTX_set_flags.3,EVP_CIPHER_CTX_rand_key.3
+EVP_CIPHER_CTX_set_flags.3,EVP_CIPHER_CTX_set_app_data.3
+EVP_CIPHER_CTX_set_flags.3,EVP_CIPHER_CTX_test_flags.3
+EVP_CIPHER_CTX_set_flags.3,EVP_CIPHER_asn1_to_param.3
+EVP_CIPHER_CTX_set_flags.3,EVP_CIPHER_param_to_asn1.3
 EVP_CIPHER_do_all.3,EVP_CIPHER_do_all_sorted.3
 EVP_CIPHER_do_all.3,EVP_MD_do_all.3
 EVP_CIPHER_do_all.3,EVP_MD_do_all_sorted.3
@@ -885,37 +914,31 @@ EVP_CIPHER_meth_new.3,EVP_CIPHER_meth_set_impl_ctx_size.3
 EVP_CIPHER_meth_new.3,EVP_CIPHER_meth_set_init.3
 EVP_CIPHER_meth_new.3,EVP_CIPHER_meth_set_iv_length.3
 EVP_CIPHER_meth_new.3,EVP_CIPHER_meth_set_set_asn1_params.3
+EVP_CIPHER_nid.3,EVP_CIPHER_CTX_block_size.3
+EVP_CIPHER_nid.3,EVP_CIPHER_CTX_flags.3
+EVP_CIPHER_nid.3,EVP_CIPHER_CTX_mode.3
+EVP_CIPHER_nid.3,EVP_CIPHER_CTX_nid.3
+EVP_CIPHER_nid.3,EVP_CIPHER_CTX_type.3
+EVP_CIPHER_nid.3,EVP_CIPHER_block_size.3
+EVP_CIPHER_nid.3,EVP_CIPHER_flags.3
+EVP_CIPHER_nid.3,EVP_CIPHER_mode.3
+EVP_CIPHER_nid.3,EVP_CIPHER_name.3
+EVP_CIPHER_nid.3,EVP_CIPHER_type.3
 EVP_DigestInit.3,EVP_Digest.3
 EVP_DigestInit.3,EVP_DigestFinal.3
 EVP_DigestInit.3,EVP_DigestFinal_ex.3
 EVP_DigestInit.3,EVP_DigestInit_ex.3
 EVP_DigestInit.3,EVP_DigestUpdate.3
-EVP_DigestInit.3,EVP_MAX_MD_SIZE.3
-EVP_DigestInit.3,EVP_MD_CTX_block_size.3
 EVP_DigestInit.3,EVP_MD_CTX_cleanup.3
-EVP_DigestInit.3,EVP_MD_CTX_clear_flags.3
 EVP_DigestInit.3,EVP_MD_CTX_copy.3
 EVP_DigestInit.3,EVP_MD_CTX_copy_ex.3
 EVP_DigestInit.3,EVP_MD_CTX_create.3
-EVP_DigestInit.3,EVP_MD_CTX_ctrl.3
 EVP_DigestInit.3,EVP_MD_CTX_destroy.3
 EVP_DigestInit.3,EVP_MD_CTX_free.3
 EVP_DigestInit.3,EVP_MD_CTX_init.3
 EVP_DigestInit.3,EVP_MD_CTX_md.3
-EVP_DigestInit.3,EVP_MD_CTX_md_data.3
 EVP_DigestInit.3,EVP_MD_CTX_new.3
-EVP_DigestInit.3,EVP_MD_CTX_pkey_ctx.3
 EVP_DigestInit.3,EVP_MD_CTX_reset.3
-EVP_DigestInit.3,EVP_MD_CTX_set_flags.3
-EVP_DigestInit.3,EVP_MD_CTX_set_pkey_ctx.3
-EVP_DigestInit.3,EVP_MD_CTX_size.3
-EVP_DigestInit.3,EVP_MD_CTX_test_flags.3
-EVP_DigestInit.3,EVP_MD_CTX_type.3
-EVP_DigestInit.3,EVP_MD_block_size.3
-EVP_DigestInit.3,EVP_MD_flags.3
-EVP_DigestInit.3,EVP_MD_pkey_type.3
-EVP_DigestInit.3,EVP_MD_size.3
-EVP_DigestInit.3,EVP_MD_type.3
 EVP_DigestInit.3,EVP_get_digestbyname.3
 EVP_DigestInit.3,EVP_get_digestbynid.3
 EVP_DigestInit.3,EVP_get_digestbyobj.3
@@ -942,41 +965,14 @@ EVP_EncodeInit.3,EVP_ENCODE_CTX_new.3
 EVP_EncodeInit.3,EVP_EncodeBlock.3
 EVP_EncodeInit.3,EVP_EncodeFinal.3
 EVP_EncodeInit.3,EVP_EncodeUpdate.3
-EVP_EncryptInit.3,EVP_CIPHER_CTX_block_size.3
 EVP_EncryptInit.3,EVP_CIPHER_CTX_cipher.3
 EVP_EncryptInit.3,EVP_CIPHER_CTX_cleanup.3
-EVP_EncryptInit.3,EVP_CIPHER_CTX_clear_flags.3
 EVP_EncryptInit.3,EVP_CIPHER_CTX_copy.3
-EVP_EncryptInit.3,EVP_CIPHER_CTX_ctrl.3
 EVP_EncryptInit.3,EVP_CIPHER_CTX_encrypting.3
-EVP_EncryptInit.3,EVP_CIPHER_CTX_flags.3
 EVP_EncryptInit.3,EVP_CIPHER_CTX_free.3
-EVP_EncryptInit.3,EVP_CIPHER_CTX_get_app_data.3
-EVP_EncryptInit.3,EVP_CIPHER_CTX_get_iv.3
 EVP_EncryptInit.3,EVP_CIPHER_CTX_init.3
-EVP_EncryptInit.3,EVP_CIPHER_CTX_iv_length.3
-EVP_EncryptInit.3,EVP_CIPHER_CTX_key_length.3
-EVP_EncryptInit.3,EVP_CIPHER_CTX_mode.3
 EVP_EncryptInit.3,EVP_CIPHER_CTX_new.3
-EVP_EncryptInit.3,EVP_CIPHER_CTX_nid.3
-EVP_EncryptInit.3,EVP_CIPHER_CTX_rand_key.3
 EVP_EncryptInit.3,EVP_CIPHER_CTX_reset.3
-EVP_EncryptInit.3,EVP_CIPHER_CTX_set_app_data.3
-EVP_EncryptInit.3,EVP_CIPHER_CTX_set_flags.3
-EVP_EncryptInit.3,EVP_CIPHER_CTX_set_iv.3
-EVP_EncryptInit.3,EVP_CIPHER_CTX_set_key_length.3
-EVP_EncryptInit.3,EVP_CIPHER_CTX_set_padding.3
-EVP_EncryptInit.3,EVP_CIPHER_CTX_test_flags.3
-EVP_EncryptInit.3,EVP_CIPHER_CTX_type.3
-EVP_EncryptInit.3,EVP_CIPHER_asn1_to_param.3
-EVP_EncryptInit.3,EVP_CIPHER_block_size.3
-EVP_EncryptInit.3,EVP_CIPHER_flags.3
-EVP_EncryptInit.3,EVP_CIPHER_iv_length.3
-EVP_EncryptInit.3,EVP_CIPHER_key_length.3
-EVP_EncryptInit.3,EVP_CIPHER_mode.3
-EVP_EncryptInit.3,EVP_CIPHER_nid.3
-EVP_EncryptInit.3,EVP_CIPHER_param_to_asn1.3
-EVP_EncryptInit.3,EVP_CIPHER_type.3
 EVP_EncryptInit.3,EVP_Cipher.3
 EVP_EncryptInit.3,EVP_CipherFinal.3
 EVP_EncryptInit.3,EVP_CipherFinal_ex.3
@@ -1018,6 +1014,12 @@ EVP_EncryptInit.3,EVP_rc2_cfb.3
 EVP_EncryptInit.3,EVP_rc2_cfb64.3
 EVP_EncryptInit.3,EVP_rc2_ecb.3
 EVP_EncryptInit.3,EVP_rc2_ofb.3
+EVP_MD_CTX_ctrl.3,EVP_MD_CTX_clear_flags.3
+EVP_MD_CTX_ctrl.3,EVP_MD_CTX_md_data.3
+EVP_MD_CTX_ctrl.3,EVP_MD_CTX_pkey_ctx.3
+EVP_MD_CTX_ctrl.3,EVP_MD_CTX_set_flags.3
+EVP_MD_CTX_ctrl.3,EVP_MD_CTX_set_pkey_ctx.3
+EVP_MD_CTX_ctrl.3,EVP_MD_CTX_test_flags.3
 EVP_MD_meth_new.3,EVP_MD_meth_dup.3
 EVP_MD_meth_new.3,EVP_MD_meth_free.3
 EVP_MD_meth_new.3,EVP_MD_meth_set_app_datasize.3
@@ -1030,6 +1032,15 @@ EVP_MD_meth_new.3,EVP_MD_meth_set_init.3
 EVP_MD_meth_new.3,EVP_MD_meth_set_input_blocksize.3
 EVP_MD_meth_new.3,EVP_MD_meth_set_result_size.3
 EVP_MD_meth_new.3,EVP_MD_meth_set_update.3
+EVP_MD_nid.3,EVP_MD_CTX_block_size.3
+EVP_MD_nid.3,EVP_MD_CTX_size.3
+EVP_MD_nid.3,EVP_MD_CTX_type.3
+EVP_MD_nid.3,EVP_MD_block_size.3
+EVP_MD_nid.3,EVP_MD_flags.3
+EVP_MD_nid.3,EVP_MD_name.3
+EVP_MD_nid.3,EVP_MD_pkey_type.3
+EVP_MD_nid.3,EVP_MD_size.3
+EVP_MD_nid.3,EVP_MD_type.3
 EVP_OpenInit.3,EVP_OpenFinal.3
 EVP_OpenInit.3,EVP_OpenUpdate.3
 EVP_PKCS82PKEY.3,EVP_PKEY2PKCS8.3
@@ -1054,6 +1065,7 @@ EVP_PKEY_CTX_ctrl.3,EVP_PKEY_CTX_set_ecdh_kdf_md.3
 EVP_PKEY_CTX_ctrl.3,EVP_PKEY_CTX_set_ecdh_kdf_outlen.3
 EVP_PKEY_CTX_ctrl.3,EVP_PKEY_CTX_set_ecdh_kdf_type.3
 EVP_PKEY_CTX_ctrl.3,EVP_PKEY_CTX_set_signature_md.3
+EVP_PKEY_CTX_get_operation.3,EVP_PKEY_CTX_get0_pkey.3
 EVP_PKEY_CTX_new.3,EVP_PKEY_CTX_dup.3
 EVP_PKEY_CTX_new.3,EVP_PKEY_CTX_free.3
 EVP_PKEY_CTX_new.3,EVP_PKEY_CTX_new_id.3
@@ -1093,18 +1105,22 @@ EVP_PKEY_cmp.3,EVP_PKEY_cmp_parameters.3
 EVP_PKEY_cmp.3,EVP_PKEY_copy_parameters.3
 EVP_PKEY_cmp.3,EVP_PKEY_missing_parameters.3
 EVP_PKEY_decrypt.3,EVP_PKEY_decrypt_init.3
+EVP_PKEY_derive.3,EVP_PKEY_CTX_get0_peerkey.3
 EVP_PKEY_derive.3,EVP_PKEY_derive_init.3
 EVP_PKEY_derive.3,EVP_PKEY_derive_set_peer.3
 EVP_PKEY_encrypt.3,EVP_PKEY_encrypt_init.3
 EVP_PKEY_keygen.3,EVP_PKEY_CTX_get_app_data.3
 EVP_PKEY_keygen.3,EVP_PKEY_CTX_get_cb.3
 EVP_PKEY_keygen.3,EVP_PKEY_CTX_get_keygen_info.3
+EVP_PKEY_keygen.3,EVP_PKEY_CTX_set0_keygen_info.3
 EVP_PKEY_keygen.3,EVP_PKEY_CTX_set_app_data.3
 EVP_PKEY_keygen.3,EVP_PKEY_CTX_set_cb.3
 EVP_PKEY_keygen.3,EVP_PKEY_gen_cb.3
 EVP_PKEY_keygen.3,EVP_PKEY_keygen_init.3
 EVP_PKEY_keygen.3,EVP_PKEY_paramgen.3
 EVP_PKEY_keygen.3,EVP_PKEY_paramgen_init.3
+EVP_PKEY_meth_new.3,EVP_PKEY_CTX_get_data.3
+EVP_PKEY_meth_new.3,EVP_PKEY_CTX_set_data.3
 EVP_PKEY_meth_new.3,EVP_PKEY_meth_add0.3
 EVP_PKEY_meth_new.3,EVP_PKEY_meth_copy.3
 EVP_PKEY_meth_new.3,EVP_PKEY_meth_find.3
@@ -1288,6 +1304,21 @@ HMAC.3,HMAC_Init.3
 HMAC.3,HMAC_Init_ex.3
 HMAC.3,HMAC_Update.3
 HMAC.3,HMAC_size.3
+IPAddressRange_new.3,IPAddressChoice_free.3
+IPAddressRange_new.3,IPAddressChoice_new.3
+IPAddressRange_new.3,IPAddressFamily_free.3
+IPAddressRange_new.3,IPAddressFamily_new.3
+IPAddressRange_new.3,IPAddressOrRange_free.3
+IPAddressRange_new.3,IPAddressOrRange_new.3
+IPAddressRange_new.3,IPAddressRange_free.3
+IPAddressRange_new.3,d2i_IPAddressChoice.3
+IPAddressRange_new.3,d2i_IPAddressFamily.3
+IPAddressRange_new.3,d2i_IPAddressOrRange.3
+IPAddressRange_new.3,d2i_IPAddressRange.3
+IPAddressRange_new.3,i2d_IPAddressChoice.3
+IPAddressRange_new.3,i2d_IPAddressFamily.3
+IPAddressRange_new.3,i2d_IPAddressOrRange.3
+IPAddressRange_new.3,i2d_IPAddressRange.3
 MD5.3,MD4.3
 MD5.3,MD4_Final.3
 MD5.3,MD4_Init.3
@@ -1424,6 +1455,7 @@ OPENSSL_sk_new.3,sk_zero.3
 OpenSSL_add_all_algorithms.3,EVP_cleanup.3
 OpenSSL_add_all_algorithms.3,OpenSSL_add_all_ciphers.3
 OpenSSL_add_all_algorithms.3,OpenSSL_add_all_digests.3
+OpenSSL_add_all_algorithms.3,SSLeay_add_all_algorithms.3
 PEM_ASN1_read.3,PEM_ASN1_read_bio.3
 PEM_ASN1_read.3,d2i_of_void.3
 PEM_X509_INFO_read.3,PEM_X509_INFO_read_bio.3
@@ -1610,9 +1642,6 @@ RSA_get0_key.3,RSA_set0_factors.3
 RSA_get0_key.3,RSA_set0_key.3
 RSA_get0_key.3,RSA_set_flags.3
 RSA_get0_key.3,RSA_test_flags.3
-RSA_get_ex_new_index.3,CRYPTO_EX_dup.3
-RSA_get_ex_new_index.3,CRYPTO_EX_free.3
-RSA_get_ex_new_index.3,CRYPTO_EX_new.3
 RSA_get_ex_new_index.3,RSA_get_ex_data.3
 RSA_get_ex_new_index.3,RSA_set_ex_data.3
 RSA_meth_new.3,RSA_meth_dup.3
@@ -1679,6 +1708,8 @@ RSA_print.3,DSAparams_print.3
 RSA_print.3,DSAparams_print_fp.3
 RSA_print.3,RSA_print_fp.3
 RSA_private_encrypt.3,RSA_public_decrypt.3
+RSA_public_encrypt.3,EVP_PKEY_decrypt_old.3
+RSA_public_encrypt.3,EVP_PKEY_encrypt_old.3
 RSA_public_encrypt.3,RSA_private_decrypt.3
 RSA_security_bits.3,BN_security_bits.3
 RSA_security_bits.3,DH_security_bits.3
@@ -1814,7 +1845,6 @@ SSL_CTX_set_client_cert_cb.3,client_cert_cb.3
 SSL_CTX_set_default_passwd_cb.3,SSL_CTX_get_default_passwd_cb.3
 SSL_CTX_set_default_passwd_cb.3,SSL_CTX_get_default_passwd_cb_userdata.3
 SSL_CTX_set_default_passwd_cb.3,SSL_CTX_set_default_passwd_cb_userdata.3
-SSL_CTX_set_default_passwd_cb.3,pem_password_cb.3
 SSL_CTX_set_generate_session_id.3,GEN_SESSION_CB.3
 SSL_CTX_set_generate_session_id.3,SSL_has_matching_session_id.3
 SSL_CTX_set_generate_session_id.3,SSL_set_generate_session_id.3
@@ -2446,6 +2476,19 @@ X509at_get_attr.3,X509at_get0_data_by_OBJ.3
 X509at_get_attr.3,X509at_get_attr_by_NID.3
 X509at_get_attr.3,X509at_get_attr_by_OBJ.3
 X509at_get_attr.3,X509at_get_attr_count.3
+X509v3_addr_add_inherit.3,X509v3_addr_add_prefix.3
+X509v3_addr_add_inherit.3,X509v3_addr_add_range.3
+X509v3_addr_add_inherit.3,X509v3_addr_canonize.3
+X509v3_addr_add_inherit.3,X509v3_addr_is_canonical.3
+X509v3_addr_get_range.3,X509v3_addr_get_afi.3
+X509v3_addr_inherits.3,X509v3_asid_inherits.3
+X509v3_addr_subset.3,X509v3_asid_subset.3
+X509v3_addr_validate_path.3,X509v3_addr_validate_resource_set.3
+X509v3_addr_validate_path.3,X509v3_asid_validate_path.3
+X509v3_addr_validate_path.3,X509v3_asid_validate_resource_set.3
+X509v3_asid_add_id_or_range.3,X509v3_asid_add_inherit.3
+X509v3_asid_add_id_or_range.3,X509v3_asid_canonize.3
+X509v3_asid_add_id_or_range.3,X509v3_asid_is_canonical.3
 X509v3_get_ext_by_NID.3,X509_CRL_add_ext.3
 X509v3_get_ext_by_NID.3,X509_CRL_delete_ext.3
 X509v3_get_ext_by_NID.3,X509_CRL_get_ext.3
@@ -2816,9 +2859,10 @@ d2i_X509_SIG.3,d2i_PKCS8_fp.3
 d2i_X509_SIG.3,i2d_PKCS8_bio.3
 d2i_X509_SIG.3,i2d_PKCS8_fp.3
 d2i_X509_SIG.3,i2d_X509_SIG.3
+des_read_pw.3,EVP_get_pw_prompt.3
 des_read_pw.3,EVP_read_pw_string.3
 des_read_pw.3,EVP_read_pw_string_min.3
-des_read_pw.3,des_read_pw_string.3
+des_read_pw.3,EVP_set_pw_prompt.3
 i2a_ASN1_STRING.3,a2i_ASN1_ENUMERATED.3
 i2a_ASN1_STRING.3,a2i_ASN1_INTEGER.3
 i2a_ASN1_STRING.3,a2i_ASN1_STRING.3
@@ -2922,7 +2966,6 @@ tls_ocsp_process_response.3,tls_peer_ocsp_url.3
 tls_read.3,tls_close.3
 tls_read.3,tls_error.3
 tls_read.3,tls_handshake.3
-tls_read.3,tls_reset.3
 tls_read.3,tls_write.3
 x509_verify.3,x509_verify_ctx_chain.3
 x509_verify.3,x509_verify_ctx_error_depth.3
--- a/patches/asm/0001-Revert-Add-endbr64-where-needed-by-inspection.-Passe.patch
+++ b/patches/asm/0001-Revert-Add-endbr64-where-needed-by-inspection.-Passe.patch
--- a/patches/asm/0002-Revert-Use-explicit-.text-instead-of-.previous-to-pl.patch
+++ b/patches/asm/0002-Revert-Use-explicit-.text-instead-of-.previous-to-pl.patch
@@ -0,0 +1,162 @@
+From 8861777e025998cc80bb9e39e88a332e8aec2f26 Mon Sep 17 00:00:00 2001
+From: Brent Cook <busterb@gmail.com>
+Date: Mon, 30 Oct 2023 22:00:12 -0500
+Subject: [PATCH 2/4] Revert "Use explicit .text instead of .previous to please
+ Windows/MinGW on amd64"
+
+This reverts commit e8192f57c4e5910ce7badced4a24c8827810d567.
+---
+ src/lib/libcrypto/aes/asm/aes-x86_64.pl        | 2 +-
+ src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl | 2 +-
+ src/lib/libcrypto/aes/asm/aesni-x86_64.pl      | 2 +-
+ src/lib/libcrypto/aes/asm/bsaes-x86_64.pl      | 2 +-
+ src/lib/libcrypto/aes/asm/vpaes-x86_64.pl      | 2 +-
+ src/lib/libcrypto/bn/asm/x86_64-mont5.pl       | 2 +-
+ src/lib/libcrypto/camellia/asm/cmll-x86_64.pl  | 2 +-
+ src/lib/libcrypto/modes/asm/ghash-x86_64.pl    | 2 +-
+ src/lib/libcrypto/sha/asm/sha1-x86_64.pl       | 2 +-
+ src/lib/libcrypto/sha/asm/sha512-x86_64.pl     | 4 ++--
+ 10 files changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/src/lib/libcrypto/aes/asm/aes-x86_64.pl b/src/lib/libcrypto/aes/asm/aes-x86_64.pl
+index b7399b552..2986a9fcc 100755
+--- a/src/lib/libcrypto/aes/asm/aes-x86_64.pl
+++ b/src/lib/libcrypto/aes/asm/aes-x86_64.pl
+@@ -2535,7 +2535,7 @@ $code.=<<___;
+ 	.long	0x80808080, 0x80808080, 0xfefefefe, 0xfefefefe
+ 	.long	0x1b1b1b1b, 0x1b1b1b1b, 0, 0
+ .align	64
+-.text
+.previous
+ ___
+ 
+ # EXCEPTION_DISPOSITION handler (EXCEPTION_RECORD *rec,ULONG64 frame,
+diff --git a/src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl b/src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl
+index bafa906a0..8a428c9b1 100644
+--- a/src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl
+++ b/src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl
+@@ -1084,7 +1084,7 @@ K_XX_XX:
+ .long	0xca62c1d6,0xca62c1d6,0xca62c1d6,0xca62c1d6	# K_60_79
+ .long	0x00010203,0x04050607,0x08090a0b,0x0c0d0e0f	# pbswap mask
+ .align	64
+-.text
+.previous
+ ___
+ 
+ # EXCEPTION_DISPOSITION handler (EXCEPTION_RECORD *rec,ULONG64 frame,
+diff --git a/src/lib/libcrypto/aes/asm/aesni-x86_64.pl b/src/lib/libcrypto/aes/asm/aesni-x86_64.pl
+index e662fbc7c..09612b1f8 100644
+--- a/src/lib/libcrypto/aes/asm/aesni-x86_64.pl
+++ b/src/lib/libcrypto/aes/asm/aesni-x86_64.pl
+@@ -2732,7 +2732,7 @@ $code.=<<___;
+ .Lxts_magic:
+ 	.long	0x87,0,1,0
+ .align	64
+-.text
+.previous
+ ___
+ 
+ # EXCEPTION_DISPOSITION handler (EXCEPTION_RECORD *rec,ULONG64 frame,
+diff --git a/src/lib/libcrypto/aes/asm/bsaes-x86_64.pl b/src/lib/libcrypto/aes/asm/bsaes-x86_64.pl
+index 20e9e1f71..347f4c302 100644
+--- a/src/lib/libcrypto/aes/asm/bsaes-x86_64.pl
+++ b/src/lib/libcrypto/aes/asm/bsaes-x86_64.pl
+@@ -2937,7 +2937,7 @@ _bsaes_const:
+ 	.quad	0x6363636363636363, 0x6363636363636363
+ .align	64
+ .size	_bsaes_const,.-_bsaes_const
+-.text
+.previous
+ ___
+ 
+ # EXCEPTION_DISPOSITION handler (EXCEPTION_RECORD *rec,ULONG64 frame,
+diff --git a/src/lib/libcrypto/aes/asm/vpaes-x86_64.pl b/src/lib/libcrypto/aes/asm/vpaes-x86_64.pl
+index 3ffb1a303..ad5fa7522 100644
+--- a/src/lib/libcrypto/aes/asm/vpaes-x86_64.pl
+++ b/src/lib/libcrypto/aes/asm/vpaes-x86_64.pl
+@@ -1063,7 +1063,7 @@ _vpaes_consts:
+ 	.quad	0x12D7560F93441D00, 0xCA4B8159D8C58E9C
+ .align	64
+ .size	_vpaes_consts,.-_vpaes_consts
+-.text
+.previous
+ ___
+ 
+ if ($win64) {
+diff --git a/src/lib/libcrypto/bn/asm/x86_64-mont5.pl b/src/lib/libcrypto/bn/asm/x86_64-mont5.pl
+index 7b9c6df27..1c8aa255c 100755
+--- a/src/lib/libcrypto/bn/asm/x86_64-mont5.pl
+++ b/src/lib/libcrypto/bn/asm/x86_64-mont5.pl
+@@ -1037,7 +1037,7 @@ $code.=<<___;
+ .Linc:
+ 	.long	0,0, 1,1
+ 	.long	2,2, 2,2
+-.text
+.previous
+ ___
+ 
+ # EXCEPTION_DISPOSITION handler (EXCEPTION_RECORD *rec,ULONG64 frame,
+diff --git a/src/lib/libcrypto/camellia/asm/cmll-x86_64.pl b/src/lib/libcrypto/camellia/asm/cmll-x86_64.pl
+index 586e5d6e9..c16725f5c 100644
+--- a/src/lib/libcrypto/camellia/asm/cmll-x86_64.pl
+++ b/src/lib/libcrypto/camellia/asm/cmll-x86_64.pl
+@@ -625,7 +625,7 @@ $_ivp="40(%rsp)";
+ $_rsp="48(%rsp)";
+ 
+ $code.=<<___;
+-.text
+.previous
+ .globl	Camellia_cbc_encrypt
+ .type	Camellia_cbc_encrypt,\@function,6
+ .align	16
+diff --git a/src/lib/libcrypto/modes/asm/ghash-x86_64.pl b/src/lib/libcrypto/modes/asm/ghash-x86_64.pl
+index 71d0822ac..bce62947f 100644
+--- a/src/lib/libcrypto/modes/asm/ghash-x86_64.pl
+++ b/src/lib/libcrypto/modes/asm/ghash-x86_64.pl
+@@ -670,7 +670,7 @@ $code.=<<___;
+ 	.value	0xB5E0,0xB422,0xB664,0xB7A6,0xB2E8,0xB32A,0xB16C,0xB0AE
+ 	.value	0xBBF0,0xBA32,0xB874,0xB9B6,0xBCF8,0xBD3A,0xBF7C,0xBEBE
+ .align	64
+-.text
+.previous
+ ___
+ 
+ # EXCEPTION_DISPOSITION handler (EXCEPTION_RECORD *rec,ULONG64 frame,
+diff --git a/src/lib/libcrypto/sha/asm/sha1-x86_64.pl b/src/lib/libcrypto/sha/asm/sha1-x86_64.pl
+index 43eee73c4..1ec7f609a 100755
+--- a/src/lib/libcrypto/sha/asm/sha1-x86_64.pl
+++ b/src/lib/libcrypto/sha/asm/sha1-x86_64.pl
+@@ -1079,7 +1079,7 @@ K_XX_XX:
+ .long	0x8f1bbcdc,0x8f1bbcdc,0x8f1bbcdc,0x8f1bbcdc	# K_40_59
+ .long	0xca62c1d6,0xca62c1d6,0xca62c1d6,0xca62c1d6	# K_60_79
+ .long	0x00010203,0x04050607,0x08090a0b,0x0c0d0e0f	# pbswap mask
+-.text
+.previous
+ ___
+ }}}
+ $code.=<<___;
+diff --git a/src/lib/libcrypto/sha/asm/sha512-x86_64.pl b/src/lib/libcrypto/sha/asm/sha512-x86_64.pl
+index 0517eab66..1a7d9bf2d 100755
+--- a/src/lib/libcrypto/sha/asm/sha512-x86_64.pl
+++ b/src/lib/libcrypto/sha/asm/sha512-x86_64.pl
+@@ -289,7 +289,7 @@ $TABLE:
+ 	.long	0x391c0cb3,0x4ed8aa4a,0x5b9cca4f,0x682e6ff3
+ 	.long	0x748f82ee,0x78a5636f,0x84c87814,0x8cc70208
+ 	.long	0x90befffa,0xa4506ceb,0xbef9a3f7,0xc67178f2
+-.text
+.previous
+ ___
+ } else {
+ $code.=<<___;
+@@ -337,7 +337,7 @@ $TABLE:
+ 	.quad	0x3c9ebe0a15c9bebc,0x431d67c49c100d4c
+ 	.quad	0x4cc5d4becb3e42b6,0x597f299cfc657e2a
+ 	.quad	0x5fcb6fab3ad6faec,0x6c44198c4a475817
+-.text
+.previous
+ ___
+ }
+ 
+-- 
+2.42.0
+
--- a/patches/asm/0003-Revert-Use-.section-.rodata-instead-of-a-plain-.roda.patch
+++ b/patches/asm/0003-Revert-Use-.section-.rodata-instead-of-a-plain-.roda.patch
@@ -0,0 +1,203 @@
+From 1407448470aff891f9a9eff550ecda06202ffd29 Mon Sep 17 00:00:00 2001
+From: Brent Cook <busterb@gmail.com>
+Date: Mon, 30 Oct 2023 22:00:49 -0500
+Subject: [PATCH 3/4] Revert "Use .section .rodata instead of a plain .rodata"
+
+This reverts commit 67afc07de0ed3a0ccc272df42853ba565a8277c6.
+---
+ src/lib/libcrypto/aes/asm/aes-x86_64.pl        | 2 +-
+ src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl | 2 +-
+ src/lib/libcrypto/aes/asm/aesni-x86_64.pl      | 2 +-
+ src/lib/libcrypto/aes/asm/bsaes-x86_64.pl      | 2 +-
+ src/lib/libcrypto/aes/asm/vpaes-x86_64.pl      | 2 +-
+ src/lib/libcrypto/bn/asm/x86_64-mont5.pl       | 2 +-
+ src/lib/libcrypto/camellia/asm/cmll-x86_64.pl  | 2 +-
+ src/lib/libcrypto/modes/asm/ghash-x86_64.pl    | 2 +-
+ src/lib/libcrypto/perlasm/x86gas.pl            | 2 +-
+ src/lib/libcrypto/sha/asm/sha1-x86_64.pl       | 2 +-
+ src/lib/libcrypto/sha/asm/sha512-ppc.pl        | 2 +-
+ src/lib/libcrypto/sha/asm/sha512-x86_64.pl     | 4 ++--
+ src/lib/libcrypto/whrlpool/asm/wp-x86_64.pl    | 2 +-
+ 13 files changed, 14 insertions(+), 14 deletions(-)
+
+diff --git a/src/lib/libcrypto/aes/asm/aes-x86_64.pl b/src/lib/libcrypto/aes/asm/aes-x86_64.pl
+index 2986a9fcc..d9f501b25 100755
+--- a/src/lib/libcrypto/aes/asm/aes-x86_64.pl
+++ b/src/lib/libcrypto/aes/asm/aes-x86_64.pl
+@@ -2113,7 +2113,7 @@ ___
+ }
+ 
+ $code.=<<___;
+-.section .rodata
+.rodata
+ .align	64
+ .LAES_Te:
+ ___
+diff --git a/src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl b/src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl
+index 8a428c9b1..4e83b6ba4 100644
+--- a/src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl
+++ b/src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl
+@@ -1075,7 +1075,7 @@ $code.=<<___;
+ ___
+ }
+ $code.=<<___;
+-.section .rodata
+.rodata
+ .align	64
+ K_XX_XX:
+ .long	0x5a827999,0x5a827999,0x5a827999,0x5a827999	# K_00_19
+diff --git a/src/lib/libcrypto/aes/asm/aesni-x86_64.pl b/src/lib/libcrypto/aes/asm/aesni-x86_64.pl
+index 09612b1f8..2ab7106c0 100644
+--- a/src/lib/libcrypto/aes/asm/aesni-x86_64.pl
+++ b/src/lib/libcrypto/aes/asm/aesni-x86_64.pl
+@@ -2721,7 +2721,7 @@ ___
+ }
+ 
+ $code.=<<___;
+-.section .rodata
+.rodata
+ .align	64
+ .Lbswap_mask:
+ 	.byte	15,14,13,12,11,10,9,8,7,6,5,4,3,2,1,0
+diff --git a/src/lib/libcrypto/aes/asm/bsaes-x86_64.pl b/src/lib/libcrypto/aes/asm/bsaes-x86_64.pl
+index 347f4c302..a40f83601 100644
+--- a/src/lib/libcrypto/aes/asm/bsaes-x86_64.pl
+++ b/src/lib/libcrypto/aes/asm/bsaes-x86_64.pl
+@@ -2882,7 +2882,7 @@ $code.=<<___;
+ ___
+ }
+ $code.=<<___;
+-.section .rodata
+.rodata
+ .type	_bsaes_const,\@object
+ .align	64
+ _bsaes_const:
+diff --git a/src/lib/libcrypto/aes/asm/vpaes-x86_64.pl b/src/lib/libcrypto/aes/asm/vpaes-x86_64.pl
+index ad5fa7522..63af96c1d 100644
+--- a/src/lib/libcrypto/aes/asm/vpaes-x86_64.pl
+++ b/src/lib/libcrypto/aes/asm/vpaes-x86_64.pl
+@@ -964,7 +964,7 @@ _vpaes_preheat:
+ ##                     Constants                      ##
+ ##                                                    ##
+ ########################################################
+-.section .rodata
+.rodata
+ .type	_vpaes_consts,\@object
+ .align	64
+ _vpaes_consts:
+diff --git a/src/lib/libcrypto/bn/asm/x86_64-mont5.pl b/src/lib/libcrypto/bn/asm/x86_64-mont5.pl
+index 1c8aa255c..5d30f210c 100755
+--- a/src/lib/libcrypto/bn/asm/x86_64-mont5.pl
+++ b/src/lib/libcrypto/bn/asm/x86_64-mont5.pl
+@@ -1032,7 +1032,7 @@ $code.=<<___;
+ ___
+ }
+ $code.=<<___;
+-.section .rodata
+.rodata
+ .align	64
+ .Linc:
+ 	.long	0,0, 1,1
+diff --git a/src/lib/libcrypto/camellia/asm/cmll-x86_64.pl b/src/lib/libcrypto/camellia/asm/cmll-x86_64.pl
+index c16725f5c..90c56d9e5 100644
+--- a/src/lib/libcrypto/camellia/asm/cmll-x86_64.pl
+++ b/src/lib/libcrypto/camellia/asm/cmll-x86_64.pl
+@@ -599,7 +599,7 @@ sub S0222 { my $i=shift; $i=@SBOX[$i]; $i=($i<<1|$i>>7)&0xff; $i=$i<<16|$i<<8|$i
+ sub S3033 { my $i=shift; $i=@SBOX[$i]; $i=($i>>1|$i<<7)&0xff; $i=$i<<24|$i<<8|$i; sprintf("0x%08x",$i); }
+ 
+ $code.=<<___;
+-.section .rodata
+.rodata
+ .align	64
+ .LCamellia_SIGMA:
+ .long	0x3bcc908b, 0xa09e667f, 0x4caa73b2, 0xb67ae858
+diff --git a/src/lib/libcrypto/modes/asm/ghash-x86_64.pl b/src/lib/libcrypto/modes/asm/ghash-x86_64.pl
+index bce62947f..3ae8629cb 100644
+--- a/src/lib/libcrypto/modes/asm/ghash-x86_64.pl
+++ b/src/lib/libcrypto/modes/asm/ghash-x86_64.pl
+@@ -622,7 +622,7 @@ ___
+ }
+ 
+ $code.=<<___;
+-.section .rodata
+.rodata
+ .align	64
+ .Lbswap_mask:
+ 	.byte	15,14,13,12,11,10,9,8,7,6,5,4,3,2,1,0
+diff --git a/src/lib/libcrypto/perlasm/x86gas.pl b/src/lib/libcrypto/perlasm/x86gas.pl
+index b84e28be9..f28a59054 100644
+--- a/src/lib/libcrypto/perlasm/x86gas.pl
+++ b/src/lib/libcrypto/perlasm/x86gas.pl
+@@ -307,7 +307,7 @@ sub ::dataseg
+ {   push(@out,".data\n");   }
+ 
+ sub ::rodataseg
+-{   push(@out,".section .rodata\n");   }
+{   push(@out,".rodata\n");   }
+ 
+ sub ::previous
+ {   push(@out,".previous\n");   }
+diff --git a/src/lib/libcrypto/sha/asm/sha1-x86_64.pl b/src/lib/libcrypto/sha/asm/sha1-x86_64.pl
+index 1ec7f609a..0abbbab6b 100755
+--- a/src/lib/libcrypto/sha/asm/sha1-x86_64.pl
+++ b/src/lib/libcrypto/sha/asm/sha1-x86_64.pl
+@@ -1071,7 +1071,7 @@ $code.=<<___;
+ ___
+ }
+ $code.=<<___;
+-.section .rodata
+.rodata
+ .align	64
+ K_XX_XX:
+ .long	0x5a827999,0x5a827999,0x5a827999,0x5a827999	# K_00_19
+diff --git a/src/lib/libcrypto/sha/asm/sha512-ppc.pl b/src/lib/libcrypto/sha/asm/sha512-ppc.pl
+index 28bd997cf..1f02cfdd5 100755
+--- a/src/lib/libcrypto/sha/asm/sha512-ppc.pl
+++ b/src/lib/libcrypto/sha/asm/sha512-ppc.pl
+@@ -375,7 +375,7 @@ $code.=<<___;
+ 	$ST	$H,`7*$SZ`($ctx)
+ 	bne	Lsha2_block_private
+ 	blr
+-	.section .rodata
+	.rodata
+ Ltable:
+ ___
+ $code.=<<___ if ($SZ==8);
+diff --git a/src/lib/libcrypto/sha/asm/sha512-x86_64.pl b/src/lib/libcrypto/sha/asm/sha512-x86_64.pl
+index 1a7d9bf2d..6698b1d40 100755
+--- a/src/lib/libcrypto/sha/asm/sha512-x86_64.pl
+++ b/src/lib/libcrypto/sha/asm/sha512-x86_64.pl
+@@ -269,7 +269,7 @@ ___
+ 
+ if ($SZ==4) {
+ $code.=<<___;
+-.section .rodata
+.rodata
+ .align	64
+ .type	$TABLE,\@object
+ $TABLE:
+@@ -293,7 +293,7 @@ $TABLE:
+ ___
+ } else {
+ $code.=<<___;
+-.section .rodata
+.rodata
+ .align	64
+ .type	$TABLE,\@object
+ $TABLE:
+diff --git a/src/lib/libcrypto/whrlpool/asm/wp-x86_64.pl b/src/lib/libcrypto/whrlpool/asm/wp-x86_64.pl
+index de5d3acfb..510a74b91 100644
+--- a/src/lib/libcrypto/whrlpool/asm/wp-x86_64.pl
+++ b/src/lib/libcrypto/whrlpool/asm/wp-x86_64.pl
+@@ -204,7 +204,7 @@ $code.=<<___;
+ 	ret
+ .size	$func,.-$func
+ 
+-.section .rodata
+.rodata
+ .align	64
+ .type	$table,\@object
+ $table:
+-- 
+2.42.0
+
--- a/patches/asm/0004-Revert-Move-constants-out-of-text-segment-into-rodat.patch
+++ b/patches/asm/0004-Revert-Move-constants-out-of-text-segment-into-rodat.patch
@@ -0,0 +1,292 @@
+From 87b24a6d5a932061cc88b84a856663b328d1c166 Mon Sep 17 00:00:00 2001
+From: Brent Cook <busterb@gmail.com>
+Date: Mon, 30 Oct 2023 22:01:49 -0500
+Subject: [PATCH 4/4] Revert "Move constants out of text segment into rodata to
+ prepare for xonly support"
+
+This reverts commit b5834617204e7520b0209bcff7f1c4a559e05422.
+---
+ src/lib/libcrypto/aes/asm/aes-x86_64.pl        | 3 +--
+ src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl | 4 ++--
+ src/lib/libcrypto/aes/asm/aesni-x86_64.pl      | 4 ++--
+ src/lib/libcrypto/aes/asm/bsaes-x86_64.pl      | 3 +--
+ src/lib/libcrypto/aes/asm/vpaes-x86_64.pl      | 3 +--
+ src/lib/libcrypto/bn/asm/x86_64-mont.pl        | 4 ++++
+ src/lib/libcrypto/bn/asm/x86_64-mont5.pl       | 3 +--
+ src/lib/libcrypto/camellia/asm/cmll-x86_64.pl  | 4 ++--
+ src/lib/libcrypto/modes/asm/ghash-x86_64.pl    | 4 ++--
+ src/lib/libcrypto/sha/asm/sha1-x86_64.pl       | 3 +--
+ src/lib/libcrypto/sha/asm/sha512-x86_64.pl     | 4 ----
+ src/lib/libcrypto/whrlpool/asm/wp-x86_64.pl    | 1 -
+ 12 files changed, 17 insertions(+), 23 deletions(-)
+
+diff --git a/src/lib/libcrypto/aes/asm/aes-x86_64.pl b/src/lib/libcrypto/aes/asm/aes-x86_64.pl
+index d9f501b25..9072f603a 100755
+--- a/src/lib/libcrypto/aes/asm/aes-x86_64.pl
+++ b/src/lib/libcrypto/aes/asm/aes-x86_64.pl
+@@ -2113,7 +2113,6 @@ ___
+ }
+ 
+ $code.=<<___;
+-.rodata
+ .align	64
+ .LAES_Te:
+ ___
+@@ -2534,8 +2533,8 @@ ___
+ $code.=<<___;
+ 	.long	0x80808080, 0x80808080, 0xfefefefe, 0xfefefefe
+ 	.long	0x1b1b1b1b, 0x1b1b1b1b, 0, 0
+.asciz  "AES for x86_64, CRYPTOGAMS by <appro\@openssl.org>"
+ .align	64
+-.previous
+ ___
+ 
+ # EXCEPTION_DISPOSITION handler (EXCEPTION_RECORD *rec,ULONG64 frame,
+diff --git a/src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl b/src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl
+index 4e83b6ba4..880bcc2d5 100644
+--- a/src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl
+++ b/src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl
+@@ -1075,7 +1075,6 @@ $code.=<<___;
+ ___
+ }
+ $code.=<<___;
+-.rodata
+ .align	64
+ K_XX_XX:
+ .long	0x5a827999,0x5a827999,0x5a827999,0x5a827999	# K_00_19
+@@ -1083,8 +1082,9 @@ K_XX_XX:
+ .long	0x8f1bbcdc,0x8f1bbcdc,0x8f1bbcdc,0x8f1bbcdc	# K_40_59
+ .long	0xca62c1d6,0xca62c1d6,0xca62c1d6,0xca62c1d6	# K_60_79
+ .long	0x00010203,0x04050607,0x08090a0b,0x0c0d0e0f	# pbswap mask
+
+.asciz	"AESNI-CBC+SHA1 stitch for x86_64, CRYPTOGAMS by <appro\@openssl.org>"
+ .align	64
+-.previous
+ ___
+ 
+ # EXCEPTION_DISPOSITION handler (EXCEPTION_RECORD *rec,ULONG64 frame,
+diff --git a/src/lib/libcrypto/aes/asm/aesni-x86_64.pl b/src/lib/libcrypto/aes/asm/aesni-x86_64.pl
+index 2ab7106c0..96978bd35 100644
+--- a/src/lib/libcrypto/aes/asm/aesni-x86_64.pl
+++ b/src/lib/libcrypto/aes/asm/aesni-x86_64.pl
+@@ -2721,7 +2721,6 @@ ___
+ }
+ 
+ $code.=<<___;
+-.rodata
+ .align	64
+ .Lbswap_mask:
+ 	.byte	15,14,13,12,11,10,9,8,7,6,5,4,3,2,1,0
+@@ -2731,8 +2730,9 @@ $code.=<<___;
+ 	.long	1,0,0,0
+ .Lxts_magic:
+ 	.long	0x87,0,1,0
+
+.asciz  "AES for Intel AES-NI, CRYPTOGAMS by <appro\@openssl.org>"
+ .align	64
+-.previous
+ ___
+ 
+ # EXCEPTION_DISPOSITION handler (EXCEPTION_RECORD *rec,ULONG64 frame,
+diff --git a/src/lib/libcrypto/aes/asm/bsaes-x86_64.pl b/src/lib/libcrypto/aes/asm/bsaes-x86_64.pl
+index a40f83601..14dc2c02e 100644
+--- a/src/lib/libcrypto/aes/asm/bsaes-x86_64.pl
+++ b/src/lib/libcrypto/aes/asm/bsaes-x86_64.pl
+@@ -2882,7 +2882,6 @@ $code.=<<___;
+ ___
+ }
+ $code.=<<___;
+-.rodata
+ .type	_bsaes_const,\@object
+ .align	64
+ _bsaes_const:
+@@ -2935,9 +2934,9 @@ _bsaes_const:
+ 	.quad	0x02060a0e03070b0f, 0x0004080c0105090d
+ .L63:
+ 	.quad	0x6363636363636363, 0x6363636363636363
+.asciz	"Bit-sliced AES for x86_64/SSSE3, Emilia Käsper, Peter Schwabe, Andy Polyakov"
+ .align	64
+ .size	_bsaes_const,.-_bsaes_const
+-.previous
+ ___
+ 
+ # EXCEPTION_DISPOSITION handler (EXCEPTION_RECORD *rec,ULONG64 frame,
+diff --git a/src/lib/libcrypto/aes/asm/vpaes-x86_64.pl b/src/lib/libcrypto/aes/asm/vpaes-x86_64.pl
+index 63af96c1d..bd7f45b85 100644
+--- a/src/lib/libcrypto/aes/asm/vpaes-x86_64.pl
+++ b/src/lib/libcrypto/aes/asm/vpaes-x86_64.pl
+@@ -964,7 +964,6 @@ _vpaes_preheat:
+ ##                     Constants                      ##
+ ##                                                    ##
+ ########################################################
+-.rodata
+ .type	_vpaes_consts,\@object
+ .align	64
+ _vpaes_consts:
+@@ -1061,9 +1060,9 @@ _vpaes_consts:
+ .Lk_dsbo:	# decryption sbox final output
+ 	.quad	0x1387EA537EF94000, 0xC7AA6DB9D4943E2D
+ 	.quad	0x12D7560F93441D00, 0xCA4B8159D8C58E9C
+.asciz	"Vector Permutation AES for x86_64/SSSE3, Mike Hamburg (Stanford University)"
+ .align	64
+ .size	_vpaes_consts,.-_vpaes_consts
+-.previous
+ ___
+ 
+ if ($win64) {
+diff --git a/src/lib/libcrypto/bn/asm/x86_64-mont.pl b/src/lib/libcrypto/bn/asm/x86_64-mont.pl
+index cae7309d5..c35493e80 100755
+--- a/src/lib/libcrypto/bn/asm/x86_64-mont.pl
+++ b/src/lib/libcrypto/bn/asm/x86_64-mont.pl
+@@ -1495,6 +1495,10 @@ $code.=<<___;
+ .size	bn_sqr4x_mont,.-bn_sqr4x_mont
+ ___
+ }}}
+$code.=<<___;
+.asciz	"Montgomery Multiplication for x86_64, CRYPTOGAMS by <appro\@openssl.org>"
+.align	16
+___
+ 
+ print $code;
+ close STDOUT;
+diff --git a/src/lib/libcrypto/bn/asm/x86_64-mont5.pl b/src/lib/libcrypto/bn/asm/x86_64-mont5.pl
+index 5d30f210c..bb7ad4c4b 100755
+--- a/src/lib/libcrypto/bn/asm/x86_64-mont5.pl
+++ b/src/lib/libcrypto/bn/asm/x86_64-mont5.pl
+@@ -1032,12 +1032,11 @@ $code.=<<___;
+ ___
+ }
+ $code.=<<___;
+-.rodata
+ .align	64
+ .Linc:
+ 	.long	0,0, 1,1
+ 	.long	2,2, 2,2
+-.previous
+.asciz	"Montgomery Multiplication with scatter/gather for x86_64, CRYPTOGAMS by <appro\@openssl.org>"
+ ___
+ 
+ # EXCEPTION_DISPOSITION handler (EXCEPTION_RECORD *rec,ULONG64 frame,
+diff --git a/src/lib/libcrypto/camellia/asm/cmll-x86_64.pl b/src/lib/libcrypto/camellia/asm/cmll-x86_64.pl
+index 90c56d9e5..df6bf11a2 100644
+--- a/src/lib/libcrypto/camellia/asm/cmll-x86_64.pl
+++ b/src/lib/libcrypto/camellia/asm/cmll-x86_64.pl
+@@ -599,7 +599,6 @@ sub S0222 { my $i=shift; $i=@SBOX[$i]; $i=($i<<1|$i>>7)&0xff; $i=$i<<16|$i<<8|$i
+ sub S3033 { my $i=shift; $i=@SBOX[$i]; $i=($i>>1|$i<<7)&0xff; $i=$i<<24|$i<<8|$i; sprintf("0x%08x",$i); }
+ 
+ $code.=<<___;
+-.rodata
+ .align	64
+ .LCamellia_SIGMA:
+ .long	0x3bcc908b, 0xa09e667f, 0x4caa73b2, 0xb67ae858
+@@ -625,7 +624,6 @@ $_ivp="40(%rsp)";
+ $_rsp="48(%rsp)";
+ 
+ $code.=<<___;
+-.previous
+ .globl	Camellia_cbc_encrypt
+ .type	Camellia_cbc_encrypt,\@function,6
+ .align	16
+@@ -859,6 +857,8 @@ Camellia_cbc_encrypt:
+ .Lcbc_abort:
+ 	ret
+ .size	Camellia_cbc_encrypt,.-Camellia_cbc_encrypt
+
+.asciz	"Camellia for x86_64 by <appro\@openssl.org>"
+ ___
+ }
+ 
+diff --git a/src/lib/libcrypto/modes/asm/ghash-x86_64.pl b/src/lib/libcrypto/modes/asm/ghash-x86_64.pl
+index 3ae8629cb..38d779edb 100644
+--- a/src/lib/libcrypto/modes/asm/ghash-x86_64.pl
+++ b/src/lib/libcrypto/modes/asm/ghash-x86_64.pl
+@@ -622,7 +622,6 @@ ___
+ }
+ 
+ $code.=<<___;
+-.rodata
+ .align	64
+ .Lbswap_mask:
+ 	.byte	15,14,13,12,11,10,9,8,7,6,5,4,3,2,1,0
+@@ -669,8 +668,9 @@ $code.=<<___;
+ 	.value	0xA7D0,0xA612,0xA454,0xA596,0xA0D8,0xA11A,0xA35C,0xA29E
+ 	.value	0xB5E0,0xB422,0xB664,0xB7A6,0xB2E8,0xB32A,0xB16C,0xB0AE
+ 	.value	0xBBF0,0xBA32,0xB874,0xB9B6,0xBCF8,0xBD3A,0xBF7C,0xBEBE
+
+.asciz	"GHASH for x86_64, CRYPTOGAMS by <appro\@openssl.org>"
+ .align	64
+-.previous
+ ___
+ 
+ # EXCEPTION_DISPOSITION handler (EXCEPTION_RECORD *rec,ULONG64 frame,
+diff --git a/src/lib/libcrypto/sha/asm/sha1-x86_64.pl b/src/lib/libcrypto/sha/asm/sha1-x86_64.pl
+index 0abbbab6b..cc8ef5337 100755
+--- a/src/lib/libcrypto/sha/asm/sha1-x86_64.pl
+++ b/src/lib/libcrypto/sha/asm/sha1-x86_64.pl
+@@ -1071,7 +1071,6 @@ $code.=<<___;
+ ___
+ }
+ $code.=<<___;
+-.rodata
+ .align	64
+ K_XX_XX:
+ .long	0x5a827999,0x5a827999,0x5a827999,0x5a827999	# K_00_19
+@@ -1079,10 +1078,10 @@ K_XX_XX:
+ .long	0x8f1bbcdc,0x8f1bbcdc,0x8f1bbcdc,0x8f1bbcdc	# K_40_59
+ .long	0xca62c1d6,0xca62c1d6,0xca62c1d6,0xca62c1d6	# K_60_79
+ .long	0x00010203,0x04050607,0x08090a0b,0x0c0d0e0f	# pbswap mask
+-.previous
+ ___
+ }}}
+ $code.=<<___;
+.asciz	"SHA1 block transform for x86_64, CRYPTOGAMS by <appro\@openssl.org>"
+ .align	64
+ ___
+ 
+diff --git a/src/lib/libcrypto/sha/asm/sha512-x86_64.pl b/src/lib/libcrypto/sha/asm/sha512-x86_64.pl
+index 6698b1d40..bc4b2e748 100755
+--- a/src/lib/libcrypto/sha/asm/sha512-x86_64.pl
+++ b/src/lib/libcrypto/sha/asm/sha512-x86_64.pl
+@@ -269,7 +269,6 @@ ___
+ 
+ if ($SZ==4) {
+ $code.=<<___;
+-.rodata
+ .align	64
+ .type	$TABLE,\@object
+ $TABLE:
+@@ -289,11 +288,9 @@ $TABLE:
+ 	.long	0x391c0cb3,0x4ed8aa4a,0x5b9cca4f,0x682e6ff3
+ 	.long	0x748f82ee,0x78a5636f,0x84c87814,0x8cc70208
+ 	.long	0x90befffa,0xa4506ceb,0xbef9a3f7,0xc67178f2
+-.previous
+ ___
+ } else {
+ $code.=<<___;
+-.rodata
+ .align	64
+ .type	$TABLE,\@object
+ $TABLE:
+@@ -337,7 +334,6 @@ $TABLE:
+ 	.quad	0x3c9ebe0a15c9bebc,0x431d67c49c100d4c
+ 	.quad	0x4cc5d4becb3e42b6,0x597f299cfc657e2a
+ 	.quad	0x5fcb6fab3ad6faec,0x6c44198c4a475817
+-.previous
+ ___
+ }
+ 
+diff --git a/src/lib/libcrypto/whrlpool/asm/wp-x86_64.pl b/src/lib/libcrypto/whrlpool/asm/wp-x86_64.pl
+index 510a74b91..afadd5d2f 100644
+--- a/src/lib/libcrypto/whrlpool/asm/wp-x86_64.pl
+++ b/src/lib/libcrypto/whrlpool/asm/wp-x86_64.pl
+@@ -204,7 +204,6 @@ $code.=<<___;
+ 	ret
+ .size	$func,.-$func
+ 
+-.rodata
+ .align	64
+ .type	$table,\@object
+ $table:
+-- 
+2.42.0
+
--- a/patches/windows_headers.patch
+++ b/patches/windows_headers.patch
@@ -1,6 +1,5 @@
-diff -u include/openssl.orig/dtls1.h include/openssl/dtls1.h
--- include/openssl.orig/dtls1.h	Mon Dec  7 07:58:32 2015
-+++ include/openssl/dtls1.h	Mon Dec  7 07:56:14 2015
+--- include/openssl/dtls1.h.orig	Wed Nov  1 13:15:36 2023
+++ include/openssl/dtls1.h	Wed Nov  1 13:15:54 2023
@@ -60,7 +60,11 @@
 #ifndef HEADER_DTLS1_H
 #define HEADER_DTLS1_H
@@ -13,14 +12,14 @@ diff -u include/openssl.orig/dtls1.h include/openssl/dtls1.h
 
 #include <stdio.h>
 #include <stdlib.h>
--- include/openssl/ossl_typ.h.orig	Fri Feb 18 16:30:39 2022
-+++ include/openssl/ossl_typ.h	Mon Feb 21 05:39:35 2022
-@@ -82,6 +82,22 @@
+--- include/openssl/ossl_typ.h.orig	Wed Nov  1 13:15:36 2023
+++ include/openssl/ossl_typ.h	Wed Nov  1 13:18:23 2023
+@@ -82,6 +82,22 @@ typedef struct asn1_object_st ASN1_OBJECT;
 typedef struct ASN1_ITEM_st ASN1_ITEM;
 typedef struct asn1_pctx_st ASN1_PCTX;
 
 +#if defined(_WIN32) && defined(__WINCRYPT_H__)
-+#ifndef LIBRESSL_INTERNAL
+#if !defined(LIBRESSL_INTERNAL) && !defined(LIBRESSL_DISABLE_OVERRIDE_WINCRYPT_DEFINES_WARNING)
 +#ifdef _MSC_VER
 +#pragma message("Warning, overriding WinCrypt defines")
 +#else
@@ -38,15 +37,14 @@ diff -u include/openssl.orig/dtls1.h include/openssl/dtls1.h
 #ifdef BIGNUM
 #undef BIGNUM
 #endif
-diff -u include/openssl.orig/pkcs7.h include/openssl/pkcs7.h
--- include/openssl.orig/pkcs7.h	Mon Dec  7 07:58:32 2015
-+++ include/openssl/pkcs7.h	Mon Dec  7 07:56:14 2015
+--- include/openssl/pkcs7.h.orig	Wed Nov  1 13:15:36 2023
+++ include/openssl/pkcs7.h	Wed Nov  1 13:17:58 2023
@@ -69,6 +69,18 @@
 extern "C" {
 #endif
 
 +#if defined(_WIN32) && defined(__WINCRYPT_H__)
-+#ifndef LIBRESSL_INTERNAL
+#if !defined(LIBRESSL_INTERNAL) && !defined(LIBRESSL_DISABLE_OVERRIDE_WINCRYPT_DEFINES_WARNING)
 +#ifdef _MSC_VER
 +#pragma message("Warning, overriding WinCrypt defines")
 +#else
@@ -60,14 +58,14 @@ diff -u include/openssl.orig/pkcs7.h include/openssl/pkcs7.h
 /*
 Encryption_ID		DES-CBC
 Digest_ID		MD5
--- include/openssl/x509.h.orig	Thu Aug  3 13:35:00 2023
-+++ include/openssl/x509.h	Thu Aug  3 13:35:18 2023
+--- include/openssl/x509.h.orig	Wed Nov  1 13:15:36 2023
+++ include/openssl/x509.h	Wed Nov  1 13:18:44 2023
@@ -100,6 +100,19 @@
 extern "C" {
 #endif
 
 +#if defined(_WIN32) && defined(__WINCRYPT_H__)
-+#ifndef LIBRESSL_INTERNAL
+#if !defined(LIBRESSL_INTERNAL) && !defined(LIBRESSL_DISABLE_OVERRIDE_WINCRYPT_DEFINES_WARNING)
 +#ifdef _MSC_VER
 +#pragma message("Warning, overriding WinCrypt defines")
 +#else
--- a/tls/CMakeLists.txt
+++ b/tls/CMakeLists.txt
@@ -22,6 +22,8 @@ if(WIN32)
 		compat/pread.c
 		compat/pwrite.c
 	)
+
+	set(LIBTLS_EXTRA_EXPORT ${LIBTLS_EXTRA_EXPORT} ftruncate)
 endif()

 if(NOT "${OPENSSLDIR}" STREQUAL "")
--- a/update.sh
+++ b/update.sh
@@ -195,7 +195,20 @@ fixup_masm() {
 }

 # generate assembly crypto algorithms
-asm_src=$libcrypto_src
+asm_src=$CWD/asm
+
+setup_asm_generator() {
+	rm -fr $asm_src
+	cp -a $libcrypto_src $asm_src
+}
+
+setup_asm_generator_patched() {
+	setup_asm_generator
+	for i in `ls -1 patches/asm/*.patch | sort -n`; do
+		patch -d $asm_src -p 4 < $i 1> /dev/null 2>/dev/null ;
+	done
+}
+
 gen_asm_stdout() {
 	CC=true perl $asm_src/$2 $1 > crypto/$3.tmp
 	[ $1 = "elf" ] && cat <<-EOF >> crypto/$3.tmp
@@ -236,6 +249,8 @@ gen_asm() {
 	fi
 }

+setup_asm_generator
+
 echo generating mips ASM source for elf
 gen_asm_mips o32 aes aes-mips    aes-mips
 gen_asm_mips o32 bn  mips        bn-mips
@@ -265,6 +280,14 @@ $CP $libcrypto_src/arch/arm/arm_arch.h crypto

 for abi in elf macosx masm mingw64; do
 	echo generating x86_64 ASM source for $abi
+
+	# use patched generators for non-elf targets
+	if [ $abi = "elf" ]; then
+		setup_asm_generator
+	else
+		setup_asm_generator_patched
+	fi
+
 	gen_asm_stdout $abi aes/asm/aes-x86_64.pl        aes/aes-$abi-x86_64.S
 	gen_asm_stdout $abi aes/asm/vpaes-x86_64.pl      aes/vpaes-$abi-x86_64.S
 	gen_asm_stdout $abi aes/asm/bsaes-x86_64.pl      aes/bsaes-$abi-x86_64.S
Author	SHA1	Message	Date
torque	0e1bc3a222	build: out-kludge the installed header include kludge This is a, erm, beautiful(?) mess. I feel like there probably ought to be a better way to handle this use case, but the way that the includes are handled in this specific codebase are extremely weird (how many times have you actually seen #include_next get used?). It may be worth making this a more natural path to take, though.	2024-06-18 20:41:00 -07:00
torque	bb0e7bc98c	build: update for zig-0.13.0 release Deprecated LazyPath fields were removed. This would have been the correct non-lazy (irony intended?) way of updating for zig 0.12 as well, and indeed this build works with zig-0.12.1.	2024-06-17 23:16:44 -07:00
torque	a2e9a8301d	build: update for zig-0.12.0 release Minor fixes for the header installation.	2024-05-12 23:42:59 -07:00
torque	9679f074d2	build: update for zig-0.12.0-dev.2208+4debd4338 Incorporate various build API changes. Hopefully there won't be any other major API changes before the 0.12.0 release.	2024-01-15 15:38:06 -08:00
torque	c673c25fc9	readme: update	2024-01-15 15:38:06 -08:00
torque	7940593eb8	build: remove unused code	2024-01-15 15:30:20 -08:00
torque	e68d5f484b	build: handle architecture include more gracefully The "openssl/opensslconf.h" header is copied from an architecture-specific source file, which means that specific path is not valid within the source tree. I previously hacked around this by copying the file within the source tree, but that had the major downside of invalidating various cache layers after the copy was performed. Since we install this header with the right name, a slightly better solution, hopefully, is to add the header install path as an include directory. In theory, this will not invalidate any caching and improve the build process slightly.	2024-01-15 15:28:44 -08:00
torque	e2db88c634	build.zig: update for 3.8.2 I had a big thing written here about how including opensslconf.h broke but then I found out I had accidentally committed an arch-specific opensslconf in the source tree somehow in the other branches. Whoops. Anyway, the build system copies this around now so it should work even better (???).	2023-11-06 23:58:01 -08:00
torque	c06f268a16	build.zig: fix copy-paste error in header search logic This didn't cause problems because the only file excluded this way has its full name provided, so it matches either way.	2023-11-06 22:36:24 -08:00
torque	9f96f4f711	build.zig: update for v3.8.1	2023-11-06 22:36:24 -08:00
torque	e85e51738d	add build.zig	2023-11-06 22:36:24 -08:00
torque	bbf2737c2b	move upstream readme	2023-11-06 22:36:24 -08:00
Brent Cook	2553853c96	changelog revisions	2023-11-02 04:41:13 -05:00
Brent Cook	79fe4adf48	Revert "Link x509_algor test to build" This reverts commit `04fa997f54`.	2023-11-01 21:33:40 -05:00
Brent Cook	f075fe34bf	update 3.8.2 changelog	2023-11-01 21:17:55 -05:00
Brent Cook	2652fb2f1e	Land #924 , Allow disabling warning about WINCRYPT overrides	2023-11-01 20:51:11 -05:00
Brent Cook	ef83583d88	Land #923 , enable system arc4random on FreeBSD 12+	2023-11-01 20:50:51 -05:00
Brent Cook	1a5be425a9	Land #922 , build fixes for various platforms	2023-11-01 20:50:15 -05:00
Brent Cook	18f5064a9d	Land #913 , CMake build fixes	2023-11-01 20:49:49 -05:00
Pierre Wendling	f06374e731	MSVC: Enable building ocspcheck. - Add `STDIN_FILENO` to compat unistd header. - Use quotes to include compat getopt header in the compat unistd. - Export additional symbols needed by ocspcheck (optarg, optind, ftruncate)	2023-11-01 20:49:34 -05:00
Brent Cook	60f4156d76	Land #909 , Fix processor detection with Cmake	2023-11-01 20:48:51 -05:00
Theo Buehler	eed367e19c	Allow disabling warning about WINCRYPT overrides Fixes #919	2023-11-01 13:21:25 +01:00
Brent Cook	124e0192c8	enable system arc4random on FreeBSD 12+	2023-11-01 06:43:41 -05:00
Brent Cook	548b3d0485	restrict patches to windows / macos platforms	2023-10-31 09:25:23 -05:00
Brent Cook	9bca15bad5	reenable assembly for MSVC	2023-10-30 22:57:33 -05:00
Brent Cook	dd1d96f643	fix cross-compilation on Windows 11 Arm64 signal.h is less populated in this environment, remove stub signal handlers	2023-10-30 22:57:33 -05:00
Brent Cook	98a5122bc6	portable asm generator patches for portable This reverses changes from the 3.8.x upstream that are causing issues on a few different platforms, including macOS x64, Windows, and older Linux/FreeBSD.	2023-10-30 22:55:29 -05:00
Brent Cook	1fd73818df	adjust how sizeof time_t is set, the current way causes issues with MSVC 2022's preprocessor	2023-10-29 16:52:28 -05:00
Brent Cook	ce79c96489	Land #913 , CMake build fixes	2023-10-29 12:34:01 -05:00
Pierre Wendling	c4bb6b79ea	MSVC: Enable building ocspcheck. - Add `STDIN_FILENO` to compat unistd header. - Use quotes to include compat getopt header in the compat unistd. - Export additional symbols needed by ocspcheck (optarg, optind, ftruncate)	2023-10-29 12:28:44 -05:00
Brent Cook	8048941622	Land #909 , Fix processor detection with Cmake	2023-10-29 12:01:49 -05:00
Brent Cook	321fa56d9a	disable MSVC x64 asm	2023-10-29 11:20:18 -05:00
Brent Cook	01e3b10f50	remove conflicting align directives for MASM	2023-10-29 11:18:52 -05:00
Brent Cook	fca20b23d6	remove unneeded switch for MSVC, cleanup comment alignment	2023-10-29 11:17:00 -05:00
Theo Buehler	fe731f3db0	Update ChangeLog	2023-10-19 06:01:07 -06:00
Brent Cook	5319ff3b17	create OpenBSD 7.4 branch	2023-10-18 04:08:21 -05:00
Theo Buehler	04fa997f54	Link x509_algor test to build	2023-10-11 09:56:40 -06:00
Theo Buehler	b112e37275	Update ChangeLog	2023-10-03 10:46:50 -06:00
Theo Buehler	8e4af3b18b	Update ChangeLog	2023-10-02 06:39:11 -06:00
Brent Cook	1defa3baa5	package getopt compat files	2023-10-01 21:11:11 -05:00
Theo Buehler	c923880fb9	Update ChangeLog	2023-10-01 17:24:14 -06:00
Theo Buehler	e56ec2ae95	Update man links	2023-09-29 10:57:53 -06:00
Theo Buehler	70db97f5a6	ChangeLog	2023-09-29 10:23:51 -06:00
Theo Buehler	f3c946b03f	Update man links	2023-09-28 07:52:48 -06:00
Theo Buehler	dbf729b46e	Update changelog	2023-09-28 07:50:19 -06:00
Theo Buehler	9e5971d828	Update ChangeLog	2023-09-24 14:26:34 -06:00
Theo Buehler	ef5867b4e6	Update man links	2023-09-18 13:03:12 -06:00
Marc Aldorasi	c90e80d21e	Properly check components	2023-09-12 15:08:44 -04:00
Marc Aldorasi	4663543082	Consistently use CMAKE_CURRENT_BINARY_DIR	2023-09-12 15:07:51 -04:00
Theo Buehler	ccaec87950	update man links	2023-09-10 13:30:20 -06:00
Theo Buehler	34f45b6cd7	Update man links	2023-09-07 11:51:21 -06:00
Jiajie Chen	70688874f8	Fix processor detection in CMakeLists.txt	2023-09-04 09:34:44 +08:00
Theo Buehler	a6bd25d3bd	Rebase rust-openssl patch	2023-09-02 04:02:03 -06:00
Theo Buehler	8fa9337f65	Prepare 3.8.2 ChangeLog	2023-08-31 10:13:29 -06:00