From e4344aae05cc9a733b4c5589c2abf67fac315c2d Mon Sep 17 00:00:00 2001 From: Mark Atwood Date: Thu, 16 Jul 2026 12:10:50 -0700 Subject: [PATCH] fix(debian): bump libssl3 dep floor to 3.0.8 The 3.0.3 floor was arbitrary. OpenSSL releases before 3.0.8 have two defects that break wolfProvider in ways we do not support: - Legacy-to-provider EC key export hardcodes compressed point format (fixed upstream in 999509c, first in 3.0.8). The provider rejects the compressed point and EVP silently falls back to built-in ECDSA for any d2i-loaded EC key, bypassing wolfCrypt. - Provider init re-enters libcrypto RAND when wolfProvider is built with --enable-seed-src and loaded during libcrypto initialization, failing the DSO load and crashing 'openssl list -providers'. 3.0.8+ made RAND/provider init re-entrancy safe. Require libssl3 >= 3.0.8 so the package cannot install onto a runtime where these silent-bypass/crash behaviors exist. --- debian/control | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/debian/control b/debian/control index 83262682..31a4810d 100644 --- a/debian/control +++ b/debian/control @@ -14,7 +14,7 @@ Build-Depends: Package: libwolfprov Architecture: any Multi-Arch: same -Depends: ${shlibs:Depends}, ${misc:Depends}, libssl3 (>= 3.0.3), libwolfssl (>= 5.8.2) +Depends: ${shlibs:Depends}, ${misc:Depends}, libssl3 (>= 3.0.8), libwolfssl (>= 5.8.2) Recommends: openssl Provides: ${variant:provides} XB-Variant: ${variant}