Since gh-138252 ("Add support in SSL module for getting and setting TLS signature algorithms", 3.15+), the _ssl extension no longer compiles against LibreSSL. Modules/_ssl.c calls two functions LibreSSL does not provide:
../Modules/_ssl.c:3867:10: error: call to undeclared function 'SSL_CTX_set1_client_sigalgs_list';
ISO C99 and later do not support implicit function declarations [-Werror,-Wimplicit-function-declaration]
../Modules/_ssl.c:3887:10: error: call to undeclared function 'SSL_CTX_set1_sigalgs_list';
ISO C99 and later do not support implicit function declarations [-Werror,-Wimplicit-function-declaration]
With -Werror=implicit-function-declaration on by default this is fatal, so _ssl (and therefore ssl, hashlib's OpenSSL backend, etc.) is not built at all.
Regression: _ssl builds fine on 3.14 against the same LibreSSL; the two set1_*sigalgs_list calls were added by gh-138252 and are not guarded for LibreSSL, which does not implement these setters (neither is declared in /usr/include/openssl/ssl.h on LibreSSL 4.3.0).
Affected versions: 3.15 and main / 3.16 — both confirmed. Not 3.14.
Environment:
- OpenBSD 7.9/amd64, base LibreSSL 4.3.0 (
ssl.OPENSSL_VERSION) - clang with
-Werror=implicit-function-declaration
Reproduce:
./configure --with-pydebug && make # -> Modules/_ssl.o fails to compile
Note: once _ssl builds, test_ssl on LibreSSL shows the same set of failures on main as on 3.14 (post-handshake auth, test_openssl_version, session tickets, etc. — long-standing LibreSSL divergences), i.e. fixing the compile break introduces no new test failures. The new TLS-signature-algorithm tests should be skipped on LibreSSL since the underlying setters are unavailable.