Repository navigation
Update openssl to 3.6.5 (in-series security fix, replaces #811) - #816
Conversation
…0.3) Clears the 13 CVEs (4 HIGH) auto-fix opened #811 for: every range reads >= 3.6.0, < 3.6.5, so the in-series patch fixes them without #811's major, API-breaking jump to 4.0.3. Source is OpenSSL's official release tarball (sha256 a2157c28... equal to the published .sha256; VERSION.dat 3.6.5, 29 Sep 2026), mirrored no-clobber at the same gs:// path. Its top dir is openssl-3.6.5/, not the tag archive's openssl-openssl-3.6.5/, hence the strip_prefix change. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Warning Review limit reached
This review includes 1 billable file and costs up to $0.25.
Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing. Or wait 39 minutes for your next included review. View limit detailsLimit details: You’ve used all 4 included reviews currently available. Your 39 included PR review attempts over the past 7 days set your current allowance at 4 reviews per hour. Review configuration: ⚙️ Run configuration
📒 Files selected for processing (1)
Comment |
There was a problem hiding this comment.
Verified: declared sha256 equals the official release asset, its .sha256 sidecar, the GitHub asset digest, and the gs:// mirror copy. CHANGES.md 3.6.4→3.6.5 lists exactly the 13 CVEs #811 claimed. VERSION.dat SHLIB_VERSION=3 on both versions, so libssl.so.3/libcrypto.so.3 are unchanged for the 46 reverse deps. #811 confirmed closed in favour of this. strip_prefix change is required by the release-tarball top dir and checked.
Informational: strip_prefix now assumes the mirror holds release tarballs (openssl-<ver>/). If pkgmgr still mirrors tag archives for openssl the next auto-bump fails loudly on strip_prefix, which is the right failure mode.
In-series security bump openssl 3.6.4 → 3.6.5, replacing #811's 3.6.4 → 4.0.3.
Clears the same 13 CVEs #811 listed (4 HIGH: CVE-2026-54873, -72897, -84782, -84784; plus 5 MEDIUM and 4 LOW). Every range there reads
>= 3.6.0, < 3.6.5, so the patch release fixes them all without a major jump. OpenSSL 4.0 removes deprecated APIs and would rebuild, and likely break, much of the tree.Source. OpenSSL's official release tarball (
gh release download openssl-3.6.5):a2157c28…df98, equal to the publishedopenssl-3.6.5.tar.gz.sha256;VERSION.datsays 3.6.5, released 29 Sep 2026;gs://minimal-staging-archives/openssl/openssl/openssl-3.6.5.tar.gz, and the bucket copy re-downloads to the same sha256;.ascsignature (no gpg on the host).strip_prefixchange. The release tarball's top directory isopenssl-3.6.5/; the previous mirror (3.6.4) was GitHub's tag archive,openssl-openssl-3.6.4/. That mismatch is also exactly why #811 failed (strip prefix error): its 4.0.3 mirror was a release tarball under the old prefix.Related. pkgmgr-rs#929 makes auto-fix pick the in-series release itself, as
updatealready did, so it won't propose 4.0.3 again. #811 should be closed: with it open at a higher version, the next run would treat openssl as already in flight.Needs a human reviewer; build + tests are the merge gate. openssl sits low in the graph, so expect a long rebuild.
🤖 Generated with Claude Code