Changes between 1.1.1 and 3.0.0 [xx XXX xxxx]
+ *) Introduced a new method type and API, OSSL_SERIALIZER, to
+ represent generic serializers. An implementation is expected to
+ be able to serialize an object associated with a given name (such
+ as an algorithm name for an asymmetric key) into forms given by
+ implementation properties.
+
+ Serializers are primarily used from inside libcrypto, through
+ calls to functions like EVP_PKEY_print_private(),
+ PEM_write_bio_PrivateKey() and similar.
+
+ Serializers are specified in such a way that they can be made to
+ directly handle the provider side portion of an object, if this
+ provider side part comes from the same provider as the serializer
+ itself, but can also be made to handle objects in parametrized
+ form (as an OSSL_PARAM array of data). This allows a provider to
+ offer generic serializers as a service for any other provider.
+ [Richard Levitte]
+
+ *) Added a .pragma directive to the syntax of configuration files, to
+ allow varying behavior in a supported and predictable manner.
+ Currently added pragma:
+
+ .pragma dollarid:on
+
+ This allows dollar signs to be a keyword character unless it's
+ followed by a opening brace or parenthesis. This is useful for
+ platforms where dollar signs are commonly used in names, such as
+ volume names and system directory names on VMS.
+ [Richard Levitte]
+
+ *) Added functionality to create an EVP_PKEY from user data. This
+ is effectively the same as creating a RSA, DH or DSA object and
+ then assigning them to an EVP_PKEY, but directly using algorithm
+ agnostic EVP functions. A benefit is that this should be future
+ proof for public key algorithms to come.
+ [Richard Levitte]
+
+ *) Change the interpretation of the '--api' configuration option to
+ mean that this is a desired API compatibility level with no
+ further meaning. The previous interpretation, that this would
+ also mean to remove all deprecated symbols up to and including
+ the given version, no requires that 'no-deprecated' is also used
+ in the configuration.
+
+ When building applications, the desired API compatibility level
+ can be set with the OPENSSL_API_COMPAT macro like before. For
+ API compatibility version below 3.0, the old style numerical
+ value is valid as before, such as -DOPENSSL_API_COMPAT=0x10100000L.
+ For version 3.0 and on, the value is expected to be the decimal
+ value calculated from the major and minor version like this:
+
+ MAJOR * 10000 + MINOR * 100
+
+ Examples:
+
+ -DOPENSSL_API_COMPAT=30000 For 3.0
+ -DOPENSSL_API_COMPAT=30200 For 3.2
+
+ To hide declarations that are deprecated up to and including the
+ given API compatibility level, -DOPENSSL_NO_DEPRECATED must be
+ given when building the application as well.
+ [Richard Levitte]
+
+ *) Added the X509_LOOKUP_METHOD called X509_LOOKUP_store, to allow
+ access to certificate and CRL stores via URIs and OSSL_STORE
+ loaders.
+
+ This adds the following functions:
+
+ X509_LOOKUP_store()
+ X509_STORE_load_file()
+ X509_STORE_load_path()
+ X509_STORE_load_store()
+ SSL_add_store_cert_subjects_to_stack()
+ SSL_CTX_set_default_verify_store()
+ SSL_CTX_load_verify_file()
+ SSL_CTX_load_verify_dir()
+ SSL_CTX_load_verify_store()
+
+ Also, the following functions are now deprecated:
+
+ - X509_STORE_load_locations() (use X509_STORE_load_file(),
+ X509_STORE_load_path() or X509_STORE_load_store() instead)
+ - SSL_CTX_load_verify_locations() (use SSL_CTX_load_verify_file(),
+ SSL_CTX_load_verify_dir() or SSL_CTX_load_verify_store() instead)
+ [Richard Levitte]
+
+ *) Added a new method to gather entropy on VMS, based on SYS$GET_ENTROPY.
+ The presence of this system service is determined at run-time.
+ [Richard Levitte]
+
+ *) Added functionality to create an EVP_PKEY context based on data
+ for methods from providers. This takes an algorithm name and a
+ property query string and simply stores them, with the intent
+ that any operation that uses this context will use those strings
+ to fetch the needed methods implicitly, thereby making the port
+ of application written for pre-3.0 OpenSSL easier.
+ [Richard Levitte]
+
+ *) The undocumented function NCONF_WIN32() has been deprecated; for
+ conversion details see the HISTORY section of doc/man5/config.pod
+ [Rich Salz]
+
+ *) Introduced the new functions EVP_DigestSignInit_ex() and
+ EVP_DigestVerifyInit_ex(). The macros EVP_DigestSignUpdate() and
+ EVP_DigestVerifyUpdate() have been converted to functions. See the man
+ pages for further details.
+ [Matt Caswell]
+
+ *) Over two thousand fixes were made to the documentation, including:
+ adding missing command flags, better style conformance, documentation
+ of internals, etc.
+ [Rich Salz, Richard Levitte]
+
+ *) s390x assembly pack: add hardware-support for P-256, P-384, P-521,
+ X25519, X448, Ed25519 and Ed448.
+ [Patrick Steuer]
+
+ *) Print all values for a PKCS#12 attribute with 'openssl pkcs12', not just
+ the first value.
+ [Jon Spillett]
+
+ *) Deprecated the public definition of ERR_STATE as well as the function
+ ERR_get_state(). This is done in preparation of making ERR_STATE an
+ opaque type.
+ [Richard Levitte]
+
+ *) Added ERR functionality to give callers access to the stored function
+ names that have replaced the older function code based functions.
+
+ New functions are ERR_get_error_func(), ERR_peek_error_func(),
+ ERR_peek_last_error_func(), ERR_get_error_data(), ERR_peek_error_data(),
+ ERR_peek_last_error_data(), ERR_get_error_all(), ERR_peek_error_all()
+ and ERR_peek_last_error_all().
+
+ These functions have become deprecated: ERR_get_error_line_data(),
+ ERR_peek_error_line_data(), ERR_peek_last_error_line_data() and
+ ERR_func_error_string().
+ [Richard Levitte]
+
*) Extended testing to be verbose for failing tests only. The make variables
VERBOSE_FAILURE or VF can be used to enable this:
*) Change the license to the Apache License v2.0.
[Richard Levitte]
- *) Change the possible version information given with OPENSSL_API_COMPAT.
- It may be a pre-3.0.0 style numerical version number as it was defined
- in 1.1.0, and it may also simply take the major version number.
-
- Because of the version numbering of pre-3.0.0 releases, the values 0,
- 1 and 2 are equivalent to 0x00908000L (0.9.8), 0x10000000L (1.0.0) and
- 0x10100000L (1.1.0), respectively.
- [Richard Levitte]
-
*) Switch to a new version scheme using three numbers MAJOR.MINOR.PATCH.
o Major releases (indicated by incrementing the MAJOR release number)
projects / openssl.git / blobdiff