vyos-build.git/scripts/package-build/openssl/package.toml, branch sever-sever-patch-1VyOS image build scripts (mirror of https://github.com/vyos/vyos-build.git)
https://git.amelek.net/vyos/vyos-build.git/atom?h=sever-sever-patch-12026-07-16T19:23:07+00:00openssl: T9083: fix APT detected package downgrade despite identical versions2026-07-16T19:23:07+00:00Date Huangtjjh89017@hotmail.com2026-07-14T06:10:41+00:00urn:sha1:2a4632a0206084eaf6d8baba082b6f636e57d56a
VyOS rolling APT repo (packages.vyos.net/repositories/rolling) publishing its
own openssl/libssl3 packages, pinned at priority 600 (higher than Debian's 500)
causes a "poisoning" of the APT cache policy inside the chroot:
openssl:
Installed: 3.0.20-1~deb12u2
Candidate: 3.0.20-1~deb12u2
Version table:
* 3.0.20-1~deb12u2 500 <- debian bookworm + bookworm-security
* 3.0.20-1~deb12u2 600 <- packages.vyos.net rolling (same version string, higher pin)
* 3.0.17-1~deb12u2 500 <- bookworm-updates
This results in APT seeing a version-string tie between Debian's build and the
VyOS repo build of the same package and, because of the pin-priority swap,
classifies switching to the VyOS repo copy as a "downgrade".
This is fixed by appending a clear VyOS related marked to the package version,
preventing any possible downgrade detection.
Signed-off-by: Date Huang <tjjh89017@hotmail.com>
Co-authored-by: Christian Breunig <christian@breunig.cc>
T9040: Build FIPS-compliant OpenSSL version2026-07-03T09:29:38+00:00Viacheslav Hletenkov.gletenko@vyos.io2026-07-01T16:48:10+00:00urn:sha1:0f2061f73bf1fb441480918de7be8511f0ab52f2
Build FIPS-compatible OpenSSL binaries
The FIPS provider does not get built and installed automatically.
To enable it, you need to configure OpenSSL using the `enable-fips` option.