From 87c0c5e50cc5252a609a3e2445b7e67a8c822dff Mon Sep 17 00:00:00 2001
From: Markus Theil <theil.markus@gmail.com>
Date: Wed, 1 Oct 2025 13:18:18 +0200
Subject: [PATCH] openssl: 3.5.2 -> 3.6.0

Changelog (security fixes):
https://github.com/openssl/openssl/blob/openssl-3.5/CHANGES.md#changes-between-353-and-354-30-sep-2025

Changelog (features):
https://github.com/openssl/openssl/blob/openssl-3.6/CHANGES.md#changes-between-35-and-360-1-oct-2025

Notably:
- more work on PQC algorithms (LMS)
- performance improvements for some assembly implementations

Fixed CVEs:
- CVE-2025-9230
- CVE-2025-9231
- CVE-2025-9232

Signed-off-by: Markus Theil <theil.markus@gmail.com>
---
 pkgs/development/libraries/openssl/default.nix | 6 +++---
 pkgs/top-level/all-packages.nix                | 4 ++--
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index 963e223858b0..02805a54003b 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -396,9 +396,9 @@ in
     };
   };
 
-  openssl_3_5 = common {
-    version = "3.5.2";
-    hash = "sha256-xTpH5eRByTDDkoz3v2+wDl0Sm2MOCqhzsIJYZW5zRew=";
+  openssl_3_6 = common {
+    version = "3.6.0";
+    hash = "sha256-tqX0S362nj+jXb8VUkQFtEg3pIHUPYHa3d4/8h/LuOk=";
 
     patches = [
       # Support for NIX_SSL_CERT_FILE, motivation:
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 24b72e37e98c..3976f2e5cf6f 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -8462,7 +8462,7 @@ with pkgs;
 
   libressl = libressl_4_1;
 
-  openssl = openssl_3_5;
+  openssl = openssl_3_6;
 
   openssl_legacy = openssl.override {
     conf = ../development/libraries/openssl/3.0/legacy.cnf;
@@ -8471,7 +8471,7 @@ with pkgs;
   inherit (callPackages ../development/libraries/openssl { })
     openssl_1_1
     openssl_3
-    openssl_3_5
+    openssl_3_6
     ;
 
   pcre = callPackage ../development/libraries/pcre { };