NetBSD Problem Report #60511

From wiz@netbsd.org  Mon Jul 27 15:40:07 2026
Return-Path: <wiz@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits)
	 client-signature RSA-PSS (2048 bits))
	(Client CN "mail.netbsd.org", Issuer "YR2" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id D02B51A923B
	for <gnats-bugs@gnats.NetBSD.org>; Mon, 27 Jul 2026 15:40:07 +0000 (UTC)
Message-Id: <20260727154007.88C2884D77@mail.netbsd.org>
Date: Mon, 27 Jul 2026 15:40:07 +0000 (UTC)
From: wiz@NetBSD.org
Reply-To: wiz@NetBSD.org
To: gnats-bugs@NetBSD.org
Subject: openssl set lists differences to pkgsrc
X-Send-Pr-Version: 3.95
X-From4GNATS: "wiz@NetBSD.org via gnats" <gnats-admin@NetBSD.org>

>Number:         60511
>Notify-List:    christos, martin, nia
>Category:       lib
>Synopsis:       openssl set lists differences to pkgsrc
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    lib-bug-people
>State:          closed
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Jul 27 15:45:00 +0000 2026
>Closed-Date:    Thu Jul 30 13:07:35 +0000 2026
>Last-Modified:  Thu Jul 30 13:07:35 +0000 2026
>Originator:     Thomas Klausner
>Release:        NetBSD 11.99.7
>Organization:

>Environment:


Architecture: x86_64
Machine: amd64
>Description:
libssh 0.12 wants to use include/openssl/ml_kem.h, but NetBSD does not provide this.

I compared the pkgsrc PLIST with the source set lists and found the following differences:

Only pkgsrc (openssl 3.6.3, but this didn't change since 3.5.3) installs:

include/openssl/byteorder.h
include/openssl/hpke.h
include/openssl/ml_kem.h

Only NetBSD (openssl 3.5.7) installs:

include/openssl/asn1_mac.h
include/openssl/cmp.h
include/openssl/cmp_util.h
include/openssl/cmperr.h
include/openssl/configuration.h
include/openssl/conftypes.h
include/openssl/core.h
include/openssl/core_dispatch.h
include/openssl/core_names.h
include/openssl/core_object.h
include/openssl/crmf.h
include/openssl/crmferr.h
include/openssl/cryptoerr_legacy.h
include/openssl/decoder.h
include/openssl/decodererr.h
include/openssl/encoder.h
include/openssl/encodererr.h
include/openssl/ess.h
include/openssl/esserr.h
include/openssl/fips_names.h
include/openssl/fipskey.h
include/openssl/http.h
include/openssl/httperr.h
include/openssl/macros.h
include/openssl/param_build.h
include/openssl/params.h
include/openssl/prov_ssl.h
include/openssl/proverr.h
include/openssl/provider.h
include/openssl/rand_drbg.h
include/openssl/self_test.h
include/openssl/sslerr_legacy.h
include/openssl/trace.h
include/openssl/types.h

There is one extra special case:
include/openssl/asn1_mac.h
was installed with 1.1 and 3.0, and is not installed with the current 3.5.7,
but it's not marked as obsolete in the set list.

>How-To-Repeat:
Try compiling libssh 0.12.1, compare set lists and PLIST.
>Fix:
I suggest:

- install the three missing files
- stop installing the many other files that pkgsrc doesn't install
- add asn1_mac.h as obsolete for openssl 3.5

I can do the change but wanted confirmation first that others agree.

>Release-Note:

>Audit-Trail:

From: Taylor R Campbell <riastradh@NetBSD.org>
To: Thomas Klausner <wiz@NetBSD.org>
Cc: gnats-bugs@NetBSD.org, netbsd-bugs@NetBSD.org,
	christos@NetBSD.org, martin@NetBSD.org, nia@NetBSD.org
Subject: Re: lib/60511: openssl set lists differences to pkgsrc
Date: Wed, 29 Jul 2026 13:15:39 +0000

 > Date: Mon Jul 27 15:45:00 +0000 2026
 > From: Thomas Klausner <wiz@NetBSD.org>
 >=20
 > I compared the pkgsrc PLIST with the source set lists and found the
 > following differences:
 >=20
 > Only pkgsrc (openssl 3.6.3, but this didn't change since 3.5.3)
 > installs:
 >=20
 > include/openssl/byteorder.h
 > include/openssl/hpke.h
 > include/openssl/ml_kem.h

 We should double-check the list of installed header files from the
 same version of OpenSSL as in src (3.5.7).

 This is going to be a big pain for the 11.x branch because package
 builds depend on what we have in 11.0, and missing files will start to
 break things.  So either we'll have to fix it in 11.0 (hi martin!) or
 put in some kind of shim package which affects the build of all
 packages using OpenSSL anyway.

 > Only NetBSD (openssl 3.5.7) installs:

 I checked your list and the only ones I found missing from
 security/openssl/PLIST are

 include/openssl/asn1_mac.h
 include/openssl/rand_drbg.h

 which both appear to be stale in your objdir; neither one exists in
 our source tree any more (that is, crypto/external/apache2/openssl/;
 crypto/external/bsd/openssl/ and crypto/external/bsd/openssl.old/ --
 why do we still have both of those? -- still have asn1_mac.h, and
 openssl.old still has rand_drbg.h).

 Actually, rand_drbg.h has an obsolete entry, so I'm not sure why you
 found it at all:

 ./usr/include/openssl/asn1_mac.h                comp-c-include          ope=
 nssl=3D11
 ./usr/include/openssl/asn1_mac.h                comp-c-include          ope=
 nssl=3D30
 ...
 ./usr/include/openssl/rand_drbg.h               comp-c-include  openssl=3D11
 ./usr/include/openssl/rand_drbg.h               comp-obsolete   obsolete,op=
 enssl=3D30
 ./usr/include/openssl/rand_drbg.h               comp-obsolete   obsolete,op=
 enssl=3D35

From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60511 CVS commit: src
Date: Wed, 29 Jul 2026 20:22:27 +0000

 Module Name:	src
 Committed By:	riastradh
 Date:		Wed Jul 29 20:22:26 UTC 2026

 Modified Files:
 	src/crypto/external/apache2/openssl/lib/libcrypto: Makefile
 	src/distrib/sets/lists/comp: mi

 Log Message:
 openssl: Install byteorder.h, hpke.h, and ml_kem.h.

 Sort INCS and format it to make detecting changes a little easier by
 diff from:

 ls ../../dist/include/openssl | sed -E -e 's,(\.in)?$, \\,'

 Nix separate sections for IDEA/MDC2/RC5; the patents on these have
 long since expired so it's not worth mentioning them separately.
 (The algorithms are also all obsolete, but if OpenSSL ships the
 header files, we should do so too.)

 PR lib/60511: openssl set lists differences to pkgsrc


 To generate a diff of this commit:
 cvs rdiff -u -r1.3 -r1.4 \
     src/crypto/external/apache2/openssl/lib/libcrypto/Makefile
 cvs rdiff -u -r1.2527 -r1.2528 src/distrib/sets/lists/comp/mi

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: Thomas Klausner <wiz@netbsd.org>
To: Taylor R Campbell <riastradh@netbsd.org>
Cc: gnats-bugs@netbsd.org
Subject: Re: lib/60511: openssl set lists differences to pkgsrc
Date: Thu, 30 Jul 2026 09:10:35 +0200

 Thanks for installing the additional headers, and for
 cross-checking. I generated the lists using sed on the set lists, but
 I probably didn't take enough care about the three sets of openssl
 versioned entries (why are there so many of them? And why do we still
 support openssl 1.1?).
  Thomas

From: "Martin Husemann" <martin@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60511 CVS commit: [netbsd-11] src
Date: Thu, 30 Jul 2026 10:54:46 +0000

 Module Name:	src
 Committed By:	martin
 Date:		Thu Jul 30 10:54:46 UTC 2026

 Modified Files:
 	src/crypto/external/apache2/openssl/lib/libcrypto [netbsd-11]: Makefile
 	src/distrib/sets/lists/comp [netbsd-11]: mi

 Log Message:
 Pull up following revision(s) (requested by riastradh in ticket #407):

 	distrib/sets/lists/comp/mi: revision 1.2528
 	distrib/sets/lists/comp/mi: revision 1.2529
 	crypto/external/apache2/openssl/lib/libcrypto/Makefile: revision 1.4

 openssl: Install byteorder.h, hpke.h, and ml_kem.h.

 Sort INCS and format it to make detecting changes a little easier by
 diff from:
 ls ../../dist/include/openssl | sed -E -e 's,(\.in)?$, \\,'

 Nix separate sections for IDEA/MDC2/RC5; the patents on these have
 long since expired so it's not worth mentioning them separately.
 (The algorithms are also all obsolete, but if OpenSSL ships the
 header files, we should do so too.)

 PR lib/60511: openssl set lists differences to pkgsrc
 add openssl hpke.h header to set list

 untested, but should fix the build breakage - new header is now installed


 To generate a diff of this commit:
 cvs rdiff -u -r1.1.2.2 -r1.1.2.3 \
     src/crypto/external/apache2/openssl/lib/libcrypto/Makefile
 cvs rdiff -u -r1.2497.2.7 -r1.2497.2.8 src/distrib/sets/lists/comp/mi

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

State-Changed-From-To: open->closed
State-Changed-By: riastradh@NetBSD.org
State-Changed-When: Thu, 30 Jul 2026 13:07:35 +0000
State-Changed-Why:
fixed in HEAD, pulled up to 11, inapplicable <11


>Unformatted:

Home	PR Database Search