Make the build succeed on s390x

baselibs.conf

@@ -1,9 +1,9 @@
-libcrypto56
-libssl59
-libtls32
+libcrypto57
+libssl60
+libtls33
 libressl-devel
 	requires -libressl-<targettype>
-	requires "libcrypto56-<targettype> = <version>"
-	requires "libssl59-<targettype> = <version>"
-	requires "libtls32-<targettype> = <version>"
+	requires "libcrypto57-<targettype> = <version>"
+	requires "libssl60-<targettype> = <version>"
+	requires "libtls33-<targettype> = <version>"
 	conflicts "libopenssl-devel-<targettype>"

extra-symver.diff

@@ -23,12 +23,12 @@ b) the dynamic loader is required to look for SSL_CTX_new@@LIBRESSL
  tls/Makefile.am    |    6 +++++-
  3 files changed, 15 insertions(+), 3 deletions(-)
 
-Index: libressl-3.8.2/crypto/Makefile.am
+Index: libressl-4.2.0/crypto/Makefile.am
 ===================================================================
---- libressl-3.8.2.orig/crypto/Makefile.am
-+++ libressl-3.8.2/crypto/Makefile.am
-@@ -62,8 +62,11 @@ libcrypto_la_objects.mk: Makefile
- 	  | sed 's/compat\// $$\(abs_top_builddir\)\/crypto\/&/g' \
+--- libressl-4.2.0.orig/crypto/Makefile.am
++++ libressl-4.2.0/crypto/Makefile.am
+@@ -81,8 +81,11 @@ libcrypto_la_objects.mk: Makefile
+ 	  | sed 's/compat\// $$\(top_builddir\)\/crypto\/&/g' \
  	  >> libcrypto_la_objects.mk
  
 -libcrypto_la_LDFLAGS = -version-info @LIBCRYPTO_VERSION@ -no-undefined -export-symbols crypto_portable.sym
@@ -41,11 +41,11 @@ Index: libressl-3.8.2/crypto/Makefile.am
  EXTRA_libcrypto_la_DEPENDENCIES += libcrypto_la_objects.mk
  libcrypto_la_LIBADD = libcompat.la
  if !HAVE_EXPLICIT_BZERO
-Index: libressl-3.8.2/ssl/Makefile.am
+Index: libressl-4.2.0/ssl/Makefile.am
 ===================================================================
---- libressl-3.8.2.orig/ssl/Makefile.am
-+++ libressl-3.8.2/ssl/Makefile.am
-@@ -35,6 +35,11 @@ remove_bs_objects: libssl.la
+--- libressl-4.2.0.orig/ssl/Makefile.am
++++ libressl-4.2.0/ssl/Makefile.am
+@@ -51,6 +51,11 @@ remove_bs_objects: libssl.la
  
  libssl_la_CPPFLAGS = -I$(top_srcdir)/ssl/hidden ${AM_CPPFLAGS}
  libssl_la_LDFLAGS = -version-info @LIBSSL_VERSION@ -no-undefined -export-symbols $(top_srcdir)/ssl/ssl.sym
@@ -57,12 +57,12 @@ Index: libressl-3.8.2/ssl/Makefile.am
  libssl_la_LIBADD = $(abs_top_builddir)/crypto/libcrypto.la $(PLATFORM_LDADD)
  libssl_la_LIBADD += $(libcompat_la_objects)
  libssl_la_LIBADD += $(libcompatnoopt_la_objects)
-Index: libressl-3.8.2/tls/Makefile.am
+Index: libressl-4.2.0/tls/Makefile.am
 ===================================================================
---- libressl-3.8.2.orig/tls/Makefile.am
-+++ libressl-3.8.2/tls/Makefile.am
-@@ -19,7 +19,11 @@ libtls_la_objects.mk: Makefile
- 	  | sed -e 's/ *$$//' -e 's/  */ $$\(abs_top_builddir\)\/tls\//g' \
+--- libressl-4.2.0.orig/tls/Makefile.am
++++ libressl-4.2.0/tls/Makefile.am
+@@ -34,7 +34,11 @@ libtls_la_objects.mk: Makefile
+ 	  | sed -e 's/ *$$//' -e 's/  */ $$\(top_builddir\)\/tls\//g' \
  	  > libtls_la_objects.mk
  
 -libtls_la_LDFLAGS = -version-info @LIBTLS_VERSION@ -no-undefined -export-symbols $(top_srcdir)/tls/tls.sym

libressl-4.1.0.tar.gz.asc

@@ -1,16 +0,0 @@
------BEGIN PGP SIGNATURE-----
-
-iQIzBAABCAAdFiEEb2dSLsWWwCWyRUmRH/qgsktwj5YFAmgRyIgACgkQH/qgsktw
-j5bDhw/9EgnMOkKYx7qgPsRVDq7aDFCp/UeNUjRUNtyr1lQnnp5htz06UPXu6692
-tUs0flgNcT71hrYWJwyYSYUcXBvfjWe/vAwpSHAjXFvmFj19d7MriA2v/OKd+fqI
-VJ1oGF85kOZ9QcBI5mQsJ/RxKiDG03sfrvRL0cyFJjujz4ap+oE/tS/kbgbx3zgl
-Sq5QEnXI0nUlCmRc8uUDoAGcMRuv6O/1ruYW5wVc4yY9wDfz+c5mM1U/73vxpRUz
-CH+ydqYh8NclLO4SBZIVywHA63YFya9VKm7RE2rGU0gZl7Z7NRKK3lKchwa2bw6N
-J2dQc2i9tP69tnZgNUhnLsyNj0FFpXrx1FUf5PsULyER6XHu8Qmbq3PT1dzpCYdx
-oBl9vTcbzKEAtPqrpY72NYcDrmLa9yGvj4vU/ym8itmHc0iKnIZq86m20OlXzwww
-2kVH/zuE+Dzbhv9FW/6+DCwOovp14CWDtuWmbhZ4tFFcUWhKAQlQ7odxAkraLBSX
-qwk9kkiWmrlcp3BFNHyMlY71HWM4en5mEzEl0chIf95DT5a4sSfL0xyrnwZ5f4YJ
-QVsVawmRffLLHZ9tMhs5Ohgje79x5uNCQFipqlly8AYYnz2Uq/FohcmCUY663zQ/
-6WSWh5A29AtxmtfTT3lq+LWeBTcPRbG/D7JOdO3p9XUizg3oOtU=
-=8rG0
------END PGP SIGNATURE-----

libressl-4.2.1.tar.gz.asc

@@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABCAAdFiEEb2dSLsWWwCWyRUmRH/qgsktwj5YFAmkDVIQACgkQH/qgsktw
+j5ZPMA/+JO3os83rNh1t19qpZ0x/qsbVcV0xVox7csfpNqhvtRDviXijNSWGKLUv
+V3vlHV0oTmOfkmiqwR7mhiRkh5BGYwM2cTLpLtmCqrFoCVM4dfCAl8bASwv+MEZ/
++OAdFPSvzLN3NpKIiruA8xU6uKMe2bbYtpfxPKYpkch8vJZh8dtuuXUOaDNxu7QL
+oDeWtpyAUOEl8DYYRPtr6u8qSWr4xxe+wU2/o3sTYZMVTxvk4JqNJt9TP/tcT8iB
+367fjmf1ZoSgwQhcXfda8SnN9W4d7si3XEnm7HeAUc2GzI/Q8QHoLt4+yM0JJ/Cn
+aCL7fH112igzLhJD240qoAy9xPlpWLkXVV6lLhGUuJX1oUfdXtCYmS4sirpSI3I0
+p/T5US+vxRNi+HSBelbQLLsGAtU1baeWNLh2P2MXGkcHLAgid1+lQvTe/7S5+doI
+Hg6C24v81FizG5srIaML82WzDWUf4/5IhwUyTZqIRdQWOBOQxBKZuNZwhaRPxITm
+Bbckg5NMMYEwezIHww2kbC0/TEp3fec/eHafHWV23+LBqBV/d9tgb7n+gonSMbEa
+4wTfdo1nADUudXU3byzDdF+hpb2253g1nZyrPk5iqrsPXt9X6BXzZGQEWSX9hvm9
+qA+YDhImhu+ZWxUfmx8urGSeVUrjruPFtru2pKb+cCpWeH0/JGk=
+=2F18
+-----END PGP SIGNATURE-----

libressl.changes

@@ -1,3 +1,37 @@
+-------------------------------------------------------------------
+Fri Jan 30 21:26:20 UTC 2026 - Jan Engelhardt <jengelh@inai.de>
+
+- Make the build succeed on s390x.
+
+-------------------------------------------------------------------
+Wed Jan 28 10:14:04 UTC 2026 - Jan Engelhardt <jengelh@inai.de>
+
+- Update to release 4.2.1
+  * Ensure the group selected by a TLSv1.3 server for a
+    HelloRetryRequest is not one for which the client has already
+    sent a key share.
+
+-------------------------------------------------------------------
+Wed Oct 15 10:27:46 UTC 2025 - Jan Engelhardt <jengelh@inai.de>
+
+- Update to release 4.2.0
+  * Removed the -msie_hack option from the openssl(1) ca
+    subcommand.
+  * Removed parameters of the 239-bit prime curves from X9.62,
+    H.5.2: prime239v1, prime239v2, prime239v3.
+  * Increased default MAC salt length used by PKCS12_set_mac(3) to
+    16 per recommendation of NIST SP 800-132.
+  * Encrypted PKCS#8 key files now use a default password-based key
+    derivation function that is acceptable in the present
+    millenium.
+  * const corrected EVP_PKEY_get{0,1}_{DH,DSA,EC_KEY,RSA}().
+  * X509_CRL_verify() now checks that the AlgorithmIdentifiers in
+    the signature and the tbsCertList are identical.
+  * Of the old *err() only PEMerr(), RSAerr(), and SSLerr() remain.
+  * Removed BIO_s_log(), X509_PKEY_{new,free}(),
+    PEM_X509_INFO_read() and PEM_X509_INFO_write_bio().
+  * Re-expose the ASN.1 Boolean template items.
+
 -------------------------------------------------------------------
 Mon Sep  1 13:13:02 UTC 2025 - Jan Engelhardt <jengelh@inai.de>
 

libressl.spec

@@ -16,7 +16,7 @@
 #
 
 Name:           libressl
-Version:        4.1.0
+Version:        4.2.1
 Release:        0
 Summary:        An SSL/TLS protocol implementation
 License:        OpenSSL
@@ -45,31 +45,31 @@ LibreSSL is an implementation of the Secure Sockets Layer (SSL) and
 Transport Layer Security (TLS) protocols. It derives from OpenSSL,
 with refactorings.
 
-%package -n libcrypto56
+%package -n libcrypto57
 Summary:        An SSL/TLS protocol implementation
 Group:          System/Libraries
 
-%description -n libcrypto56
+%description -n libcrypto57
 The "crypto" library implements a wide range of cryptographic
 algorithms used in various Internet standards. The services provided
 by this library are used by the LibreSSL implementations of SSL, TLS
 and S/MIME, and they have also been used to implement SSH, OpenPGP,
 and other cryptographic standards.
 
-%package -n libssl59
+%package -n libssl60
 Summary:        An SSL/TLS protocol implementation
 Group:          System/Libraries
 
-%description -n libssl59
+%description -n libssl60
 LibreSSL is an implementation of the Secure Sockets Layer (SSL) and
 Transport Layer Security (TLS) protocols. It derives from OpenSSL,
 with refactorings.
 
-%package -n libtls32
+%package -n libtls33
 Summary:        A simplified interface for the OpenSSL/LibreSSL TLS protocol implementation
 Group:          System/Libraries
 
-%description -n libtls32
+%description -n libtls33
 LibreSSL is an implementation of the Secure Sockets Layer (SSL) and
 Transport Layer Security (TLS) protocols. It derives from OpenSSL,
 with refactorings.
@@ -80,9 +80,9 @@ libssl) for secure client and server communications.
 %package devel
 Summary:        Development files for LibreSSL, an SSL/TLS protocol implementation
 Group:          Development/Libraries/C and C++
-Requires:       libcrypto56 = %version
-Requires:       libssl59 = %version
-Requires:       libtls32 = %version
+Requires:       libcrypto57 = %version
+Requires:       libssl60 = %version
+Requires:       libtls33 = %version
 Conflicts:      ssl-devel
 Provides:       ssl-devel
 
@@ -118,6 +118,15 @@ This subpackage contains the manpages to the LibreSSL API.
 cp %_sourcedir/unavail* .
 
 %build
+%ifarch s390x
+# libressl can work without any arch-specific code whatsoever. The makefiles
+# contain a bunch of `if PPC64 { CPPFLAGS+=-Icrypto/arch/ppc64 }`-style lines,
+# for various archs, but no "else" clause, so there is no functioning fallback.
+# The following adds this fallback.
+#
+touch crypto/crypto_arch.h crypto/bn/bn_arch.h
+%endif
+
 autoreconf -fi
 %configure --enable-libtls --with-openssldir="%_sysconfdir/libressl"
 %make_build
@@ -140,6 +149,8 @@ done
 rm -v "%buildroot/%_sysconfdir/libressl/cert.pem"
 rm -fv "%buildroot/%_libdir"/*.a "%buildroot/%_libdir"/*.la
 
+find "%buildroot/%_mandir" -type l -exec perl -e 'for (@ARGV) { next if(!-l $_); $t=readlink$_; unlink if(!-e $t); }' '{}' '+'
+
 %check
 if ! %make_build check; then
 	cat tests/test-suite.log
@@ -147,9 +158,9 @@ if ! %make_build check; then
 	#exit 1
 fi
 
-%ldconfig_scriptlets -n libcrypto56
-%ldconfig_scriptlets -n libssl59
-%ldconfig_scriptlets -n libtls32
+%ldconfig_scriptlets -n libcrypto57
+%ldconfig_scriptlets -n libssl60
+%ldconfig_scriptlets -n libtls33
 
 %files
 # openssl's config (syntax) is incompatible with libressl,
@@ -164,13 +175,13 @@ fi
 %_mandir/man8/*.8*
 %doc COPYING
 
-%files -n libcrypto56
+%files -n libcrypto57
 %_libdir/libcrypto.so.*
 
-%files -n libssl59
+%files -n libssl60
 %_libdir/libssl.so.*
 
-%files -n libtls32
+%files -n libtls33
 %_libdir/libtls.so.*
 
 %files devel