Skip to content

Comments

Revert GOST provider related docs#29286

Closed
jogme wants to merge 63 commits intoopenssl:masterfrom
jogme:revert_gost_engine
Closed

Revert GOST provider related docs#29286
jogme wants to merge 63 commits intoopenssl:masterfrom
jogme:revert_gost_engine

Conversation

@jogme
Copy link
Contributor

@jogme jogme commented Dec 2, 2025

GOST provider is in a good shape already, so keep the mentions rewritten
to provider instead of the engine.

Resolves: openssl/project#1733

Checklist
  • documentation is added or updated
  • tests are added or updated

jogme and others added 30 commits December 1, 2025 13:48
As we can't do every change in one big PR (and we also don't want),
therefore there always will be failing tests until everything is
resolved/cleaned up. This way we silence the CI about engine tests and
later we can reenable them to see what else needs to be fixed.

Resolves: openssl/project#1371

Signed-off-by: Norbert Pocs <[email protected]>

Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Richard Levitte <[email protected]>
Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from openssl#28440)
Signed-off-by: Norbert Pocs <[email protected]>

Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Richard Levitte <[email protected]>
Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from openssl#28440)
Signed-off-by: Norbert Pocs <[email protected]>

Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Richard Levitte <[email protected]>
Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
(Merged from openssl#28440)
This patch removes apps/engine.c and associated man pages.

Resolves: openssl/project#1370

Signed-off-by: Milan Broz <[email protected]>

Reviewed-by: Dmitry Belyavskiy <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Richard Levitte <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from openssl#28481)
Signed-off-by: Norbert Pocs <[email protected]>

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Dmitry Belyavskiy <[email protected]>
(Merged from openssl#28384)
Signed-off-by: Norbert Pocs <[email protected]>

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Dmitry Belyavskiy <[email protected]>
(Merged from openssl#28384)
Resolves: openssl/project#1354

Signed-off-by: Norbert Pocs <[email protected]>

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Dmitry Belyavskiy <[email protected]>
(Merged from openssl#28384)
Signed-off-by: Norbert Pocs <[email protected]>

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Dmitry Belyavskiy <[email protected]>
(Merged from openssl#28384)
Signed-off-by: Norbert Pocs <[email protected]>

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Dmitry Belyavskiy <[email protected]>
(Merged from openssl#28384)
Signed-off-by: Norbert Pocs <[email protected]>

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Dmitry Belyavskiy <[email protected]>
(Merged from openssl#28384)
Signed-off-by: Norbert Pocs <[email protected]>

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Dmitry Belyavskiy <[email protected]>
(Merged from openssl#28384)
Signed-off-by: Norbert Pocs <[email protected]>

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Dmitry Belyavskiy <[email protected]>
(Merged from openssl#28384)
Signed-off-by: Norbert Pocs <[email protected]>

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Dmitry Belyavskiy <[email protected]>
(Merged from openssl#28384)
Signed-off-by: Norbert Pocs <[email protected]>

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Dmitry Belyavskiy <[email protected]>
(Merged from openssl#28384)
Most of the ifdefs were removed, but we want to rewrite the dasync
engine to a provider. Therefore that code was not removed; instead a new
temporary macro was added named TODO_REWRITE_ME_DASYNC_PROVIDER.

Resolves: openssl/project#1363

Signed-off-by: Norbert Pocs <[email protected]>

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Dmitry Belyavskiy <[email protected]>
(Merged from openssl#28384)
Resolves: openssl/project#1364

Signed-off-by: Norbert Pocs <[email protected]>

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Dmitry Belyavskiy <[email protected]>
(Merged from openssl#28384)
Resolves: openssl/project#1352
Resolves: openssl/project#1353

Signed-off-by: Milan Broz <[email protected]>

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Dmitry Belyavskiy <[email protected]>
(Merged from openssl#28384)
Resolves: openssl/project#1368

Signed-off-by: Milan Broz <[email protected]>

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Dmitry Belyavskiy <[email protected]>
(Merged from openssl#28384)
Signed-off-by: Norbert Pocs <[email protected]>

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Dmitry Belyavskiy <[email protected]>
(Merged from openssl#28384)
With ENGINES going away we need to remove these trace catagories

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from openssl#28556)
As the subject indicates, with these trace categories gone, we shouldn't
reference them in the docs anymore.

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from openssl#28556)
Resolves: openssl/project#1437

Signed-off-by: Norbert Pocs <[email protected]>

Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from openssl#28560)
Resolves: openssl/project#1616

Signed-off-by: Milan Broz <[email protected]>

Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from openssl#28618)
Resolves: openssl/project#1614

Signed-off-by: Norbert Pocs <[email protected]>

Reviewed-by: Richard Levitte <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Neil Horman <[email protected]>
(Merged from openssl#28566)
Resolves: openssl/project#1615

Signed-off-by: Norbert Pocs <[email protected]>

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from openssl#28570)
For compatibility reasons, OPENSSL_ENGINES_DIR and OPENSSL_INFO_ENGINES_DIR
are still supported but return values like with engines disabled.

The OPENSSL_ENGINES environment variable will be removed with engine
removal later.

Resolves: openssl/project#1425

Signed-off-by: Milan Broz <[email protected]>

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Saša Nedvědický <[email protected]>
(Merged from openssl#28702)
The evp_extra_test code makes use of the dasync engine to ensure that we
can do evp operations (signatures and ciphers) with an engine.

The dasync engine is used for this purpose, but it does not exercize any
specific pipeline functionality.

Given that engines are getting removed, the engine tests here I think
can just be removed.

Reviewed-by: Richard Levitte <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from openssl#28525)
With the impending engine removal, we don't have a need to test engine
functionality in these tests anymore, so remove the test cases that make
use of the dasync engine here.

Reviewed-by: Richard Levitte <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from openssl#28525)
It seems like it wasn't ever needed before, so with the removal of
engines, just get rid of it.

Reviewed-by: Richard Levitte <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from openssl#28525)
We have a specific test suite that exercizes the afalg engine, that is
becoming useless with engine removal.

I had considered that we should perhaps convert this into a provider,
but having looked at the engine itself, it only offers implementations
for AES-128, AES-192 and AES-256.  Given that the default provider
offers these algorithms with hardware acceleration via the aesni
instruction set (or comparable instructions on non-x86 arches), it seems
like the only advantage the afalg engine offers is acceleration of these
ciphers on platforms that have off-cpu accelerators and no cpu based
acceleration support.

given that:
a) Most cpus have instruction based acceleration
b) We don't test with any platforms that use external accelerators

It seems like alot of investment to get no real advantage, so just
remove the test, allowing us to delete the engine entirely in another
PR.

Reviewed-by: Richard Levitte <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from openssl#28525)
Engines can be removed safely from static and internal functions
clearing out our codebase.

Resolves: openssl/project#1625

Signed-off-by: Norbert Pocs <[email protected]>

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Eugene Syromiatnikov <[email protected]>
Reviewed-by: Saša Nedvědický <[email protected]>
(Merged from openssl#28629)
t-j-h
t-j-h previously approved these changes Dec 3, 2025
@jogme jogme added approval: done This pull request has the required number of approvals and removed approval: review pending This pull request needs review by a committer labels Dec 3, 2025
@Sashan Sashan mentioned this pull request Dec 3, 2025
@jogme jogme force-pushed the revert_gost_engine branch from 0e724f5 to b0df85b Compare December 4, 2025 08:45
@jogme jogme force-pushed the revert_gost_engine branch from b0df85b to 4deaf73 Compare December 4, 2025 08:56
GOST provider is in a good shape already, so keep the mentions rewritten
to provider instead of the engine.

Resolves: openssl/project#1733

Signed-off-by: Norbert Pocs <[email protected]>
@jogme jogme force-pushed the revert_gost_engine branch from 4deaf73 to faf5fb0 Compare December 4, 2025 08:58
t8m
t8m previously approved these changes Dec 4, 2025
vdukhovni
vdukhovni previously approved these changes Dec 4, 2025
and B<gost2012_512:>I<filename> generate GOST R 34.10-2001 and GOST R 34.10-2012
keys with a 256 and 512 bit modulus respectively (these require the B<gostprov>
provider). If just B<gost2001> is specified, a parameter set should be specified
by B<-pkeyopt> I<paramset:X>.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
by B<-pkeyopt> I<paramset:X>.
via B<-pkeyopt> I<paramset:X>.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think by works good enough here. 😁

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think by works good enough here. 😁

I did approve the PR, yes "by" is quite close, though somewhat unnatural. Better would be "via" or "with the use of" or "by using", ... or just leave it slightly stilted. Whatever...

@openssl-machine openssl-machine added approval: ready to merge The 24 hour grace period has passed, ready to merge and removed approval: done This pull request has the required number of approvals labels Dec 4, 2025
@openssl-machine
Copy link
Collaborator

This pull request is ready to merge

@t8m t8m changed the base branch from feature/engineremoval to master December 5, 2025 16:31
@t8m t8m dismissed stale reviews from vdukhovni, t-j-h, esyr, and themself December 5, 2025 16:31

The base branch was changed.

@t8m
Copy link
Member

t8m commented Dec 5, 2025

Merged to the master branch via cherry-pick. Thank you.

@t8m t8m closed this Dec 5, 2025
@t8m t8m added branch: master Applies to master branch and removed branch: feature The issue or PR is relevant only to one of the feature branches. labels Dec 5, 2025
openssl-machine pushed a commit that referenced this pull request Dec 5, 2025
GOST provider is in a good shape already, so keep the mentions rewritten
to provider instead of the engine.

Resolves: openssl/project#1733

Signed-off-by: Norbert Pocs <[email protected]>

Reviewed-by: Viktor Dukhovni <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from #29286)
cxx194832 pushed a commit to cxx194832/openssl that referenced this pull request Dec 12, 2025
GOST provider is in a good shape already, so keep the mentions rewritten
to provider instead of the engine.

Resolves: openssl/project#1733

Signed-off-by: Norbert Pocs <[email protected]>

Reviewed-by: Viktor Dukhovni <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from openssl#29286)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approval: ready to merge The 24 hour grace period has passed, ready to merge branch: master Applies to master branch tests: exempted The PR is exempt from requirements for testing triaged: documentation The issue/pr deals with documentation (errors)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Revert GOST engine related mentions

9 participants