From 96e5424f74a91b44c0d5ca3c02d59de802501ddf Mon Sep 17 00:00:00 2001 From: Silvan Mosberger Date: Mon, 15 Sep 2025 17:22:40 +0200 Subject: [PATCH 1/4] openssl: Enable tests Makes the build take about 13 instead of 5 minutes --- pkgs/development/libraries/openssl/default.nix | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix index 05207dd04f10..58550c8b4676 100644 --- a/pkgs/development/libraries/openssl/default.nix +++ b/pkgs/development/libraries/openssl/default.nix @@ -246,6 +246,11 @@ let enableParallelBuilding = true; + doCheck = true; + preCheck = '' + patchShebangs util + ''; + postInstall = ( if static then From 1453647d2294bdaa8942aa9ace7256ff4fa230af Mon Sep 17 00:00:00 2001 From: Silvan Mosberger Date: Mon, 15 Sep 2025 17:23:37 +0200 Subject: [PATCH 2/4] openssl: Add missing comments for patches Markus Theil: Changed reference to NIX_SSL_CERT_FILE commit --- pkgs/development/libraries/openssl/default.nix | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix index 58550c8b4676..1d114d12996c 100644 --- a/pkgs/development/libraries/openssl/default.nix +++ b/pkgs/development/libraries/openssl/default.nix @@ -375,12 +375,15 @@ in hash = "sha256-39135OobV/86bb3msL3D8x21rJnn/dTq+eH7tuwtuM4="; patches = [ + # Support for NIX_SSL_CERT_FILE, motivation: + # https://github.com/NixOS/nixpkgs/commit/942dbf89c6120cb5b52fb2ab456855d1fbf2994e ./3.0/nix-ssl-cert-file.patch # openssl will only compile in KTLS if the current kernel supports it. # This patch disables build-time detection. ./3.0/openssl-disable-kernel-detection.patch + # Look up SSL certificates in /etc rather than the immutable installation directory ( if stdenv.hostPlatform.isDarwin then ./use-etc-ssl-certs-darwin.patch else ./use-etc-ssl-certs.patch ) @@ -398,12 +401,15 @@ in hash = "sha256-xTpH5eRByTDDkoz3v2+wDl0Sm2MOCqhzsIJYZW5zRew="; patches = [ + # Support for NIX_SSL_CERT_FILE, motivation: + # https://github.com/NixOS/nixpkgs/commit/942dbf89c6120cb5b52fb2ab456855d1fbf2994e ./3.0/nix-ssl-cert-file.patch # openssl will only compile in KTLS if the current kernel supports it. # This patch disables build-time detection. ./3.0/openssl-disable-kernel-detection.patch + # Look up SSL certificates in /etc rather than the immutable installation directory ( if stdenv.hostPlatform.isDarwin then ./3.5/use-etc-ssl-certs-darwin.patch From 9e4cf668a33a2478058b4b64b8e4ec1a88876645 Mon Sep 17 00:00:00 2001 From: Markus Theil Date: Wed, 1 Oct 2025 13:18:01 +0200 Subject: [PATCH 3/4] openssl_3: 3.0.17 -> 3.0.18 Changelog: https://github.com/openssl/openssl/blob/openssl-3.0/CHANGES.md#changes-between-3017-and-3018-30-sep-2025 Fixed CVEs: - CVE-2025-9230 - CVE-2025-9232 Signed-off-by: Markus Theil --- pkgs/development/libraries/openssl/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix index 1d114d12996c..963e223858b0 100644 --- a/pkgs/development/libraries/openssl/default.nix +++ b/pkgs/development/libraries/openssl/default.nix @@ -371,8 +371,8 @@ in }; openssl_3 = common { - version = "3.0.17"; - hash = "sha256-39135OobV/86bb3msL3D8x21rJnn/dTq+eH7tuwtuM4="; + version = "3.0.18"; + hash = "sha256-2Aw09c+QLczx8bXfXruG0DkuNwSeXXPfGzq65y5P/os="; patches = [ # Support for NIX_SSL_CERT_FILE, motivation: From 87c0c5e50cc5252a609a3e2445b7e67a8c822dff Mon Sep 17 00:00:00 2001 From: Markus Theil Date: Wed, 1 Oct 2025 13:18:18 +0200 Subject: [PATCH 4/4] openssl: 3.5.2 -> 3.6.0 Changelog (security fixes): https://github.com/openssl/openssl/blob/openssl-3.5/CHANGES.md#changes-between-353-and-354-30-sep-2025 Changelog (features): https://github.com/openssl/openssl/blob/openssl-3.6/CHANGES.md#changes-between-35-and-360-1-oct-2025 Notably: - more work on PQC algorithms (LMS) - performance improvements for some assembly implementations Fixed CVEs: - CVE-2025-9230 - CVE-2025-9231 - CVE-2025-9232 Signed-off-by: Markus Theil --- pkgs/development/libraries/openssl/default.nix | 6 +++--- pkgs/top-level/all-packages.nix | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix index 963e223858b0..02805a54003b 100644 --- a/pkgs/development/libraries/openssl/default.nix +++ b/pkgs/development/libraries/openssl/default.nix @@ -396,9 +396,9 @@ in }; }; - openssl_3_5 = common { - version = "3.5.2"; - hash = "sha256-xTpH5eRByTDDkoz3v2+wDl0Sm2MOCqhzsIJYZW5zRew="; + openssl_3_6 = common { + version = "3.6.0"; + hash = "sha256-tqX0S362nj+jXb8VUkQFtEg3pIHUPYHa3d4/8h/LuOk="; patches = [ # Support for NIX_SSL_CERT_FILE, motivation: diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 24b72e37e98c..3976f2e5cf6f 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -8462,7 +8462,7 @@ with pkgs; libressl = libressl_4_1; - openssl = openssl_3_5; + openssl = openssl_3_6; openssl_legacy = openssl.override { conf = ../development/libraries/openssl/3.0/legacy.cnf; @@ -8471,7 +8471,7 @@ with pkgs; inherit (callPackages ../development/libraries/openssl { }) openssl_1_1 openssl_3 - openssl_3_5 + openssl_3_6 ; pcre = callPackage ../development/libraries/pcre { };