104 files changed, 1899 insertions, 629 deletions

diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml
index 8d0ad11..ae43398 100644
--- a/.github/workflows/coverity.yml
+++ b/.github/workflows/coverity.yml
@@ -31,7 +31,7 @@ jobs:
           PROJECT: "libressl-portable%2Fportable"
           COVERITY_SCAN_TOKEN: "${{ secrets.COVERITY_SCAN_TOKEN }}"
         run: |
-          wget -c -N https://scan.coverity.com/download/linux64 --post-data "token=$COVERITY_SCAN_TOKEN&project=$PROJECT" -O coverity_tool.tar.gz
+          wget -nv https://scan.coverity.com/download/linux64 --post-data "token=$COVERITY_SCAN_TOKEN&project=$PROJECT" -O coverity_tool.tar.gz
           mkdir coverity_tool
           tar xzf coverity_tool.tar.gz --strip 1 -C coverity_tool
 
diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml
index d57e3bc..8334ae6 100644
--- a/.github/workflows/linux.yml
+++ b/.github/workflows/linux.yml
@@ -23,7 +23,7 @@ jobs:
       fail-fast: false
       matrix:
         os: ["ubuntu-22.04", "ubuntu-24.04"]
-        arch: ["native", "arm32", "arm64", "mingw32", "mingw64", "mips64"]
+        arch: ["native", "arm32", "arm64", "mingw32", "mingw64", "mips32", "mips64"]
         compiler: ["gcc"]
         include:
           - os: "ubuntu-22.04"
@@ -32,12 +32,15 @@ jobs:
           - os: "ubuntu-24.04"
             arch: "native"
             compiler: "clang"
+          - os: "ubuntu-24.04" # loong64
+            arch: "loong64"
+            compiler: "gcc"
     steps:
       - name: "Checkout repository"
         uses: actions/checkout@v4
 
       - name: "Run tests"
-        run: ./scripts/test
+        run: ./scripts/test || (status=$?; cat tests/test-suite.log; exit $status)
         env:
           ARCH: "${{ matrix.arch }}"
           CC: "${{ matrix.compiler }}"
diff --git a/.github/workflows/rust-openssl.yml b/.github/workflows/rust-openssl.yml
index 4ff41c0..d3b2bee 100644
--- a/.github/workflows/rust-openssl.yml
+++ b/.github/workflows/rust-openssl.yml
@@ -34,6 +34,10 @@ jobs:
       - name: "Run rust-openssl tests"
         run: |
           cd rust-openssl
+
+          # apply patch - see #1187
+          curl -L https://raw.githubusercontent.com/openbsd/ports/refs/heads/master/security/rust-openssl-tests/patches/patch-openssl-sys_src_handwritten_evp_rs | patch -p0
+
           # instead of erroring use the last supported version
           ed -s openssl-sys/build/main.rs <<-EOF
           /_ => version_error/-1
diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index c4c7d72..7494a21 100644
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -21,14 +21,15 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: ["windows-2022", "windows-2019"]
+        os: ["windows-2022", "windows-2025"]
         arch: ["ARM64", "x64", "Win32"]
         shared: ["ON", "OFF"]
         include:
           - os: "windows-2022"
             generator: "Visual Studio 17 2022"
-          - os: "windows-2019"
-            generator: "Visual Studio 16 2019"
+          - os: "windows-2025"
+            # XXX - use appropriate value
+            generator: "Visual Studio 17 2022"
     steps:
       - name: "Checkout repository"
         uses: actions/checkout@v4
diff --git a/.gitignore b/.gitignore
index 14917f9..c83a56d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -38,7 +38,7 @@ Makefile
 Makefile.in
 
 # CMake stuff
-build
+build*
 cmake-build-debug/
 
 # Libtool stuff
@@ -133,6 +133,7 @@ tests/tls_ext_alpn*
 tests/tls_prf*
 tests/*test
 tests/tests.h
+tests/test.h
 tests/*test.c
 tests/pbkdf2*
 tests/*.pem
@@ -153,7 +154,7 @@ tests/x509req_ext*
 tests/client.c
 tests/init_pledge.c
 tests/server.c
-tests/util.c
+tests/*util.c
 tests/valid_handshakes_terminate*
 tests/handshake_table*
 
@@ -173,7 +174,6 @@ autom4te.cache
 
 # Libtool adds these, at least sometimes
 INSTALL
-/COPYING
 !m4/check*.m4
 m4/l*
 
@@ -204,6 +204,7 @@ ssl/VERSION
 tls/VERSION
 libtls-standalone/VERSION
 
+crypto/*.mk
 ssl/hidden
 ssl/*.c
 ssl/*.h
@@ -237,33 +238,89 @@ include/openssl/*.h
 !/apps/openssl/apps_win.c
 !/apps/openssl/certhash_win.c
 
-/crypto/*
-!/crypto/Makefile.am.*
-!/crypto/compat/
-/crypto/compat/*
-!/crypto/compat/arc4random.h
-!/crypto/compat/b_win.c
-!/crypto/compat/explicit_bzero_win.c
-!/crypto/compat/freezero.c
-!/crypto/compat/getdelim.c
-!/crypto/compat/getline.c
-!/crypto/compat/getpagesize.c
-!/crypto/compat/posix_win.c
-!/crypto/compat/bsd_asprintf.c
-!/crypto/compat/ui_openssl_win.c
-!/crypto/compat/crypto_lock_win.c
-!/crypto/CMakeLists.txt
-
-!/libtls-standalone/compat/Makefile.am
-/libtls-standalone/include/*.h
-/libtls-standalone/src/*.c
-/libtls-standalone/src/*.h
-/libtls-standalone/src
-/libtls-standalone/tests/test
-/libtls-standalone/compat
-/libtls-standalone/VERSION
-/libtls-standalone/m4
-/libtls-standalone/man
+/crypto/*.c
+/crypto/*.h
+/crypto/aes/
+/crypto/arch/aarch64/crypto_arch.h
+/crypto/arch/aarch64/crypto_cpu_caps.c
+/crypto/arch/alpha/
+/crypto/arch/amd64/
+/crypto/arch/arm/
+/crypto/arch/hppa/
+/crypto/arch/i386/
+/crypto/arch/m88k/
+/crypto/arch/mips64/
+/crypto/arch/powerpc/
+/crypto/arch/powerpc64/
+/crypto/arch/riscv64/
+/crypto/arch/sh/
+/crypto/arch/sparc64/
+/crypto/asn1/
+/crypto/bf/
+/crypto/bio/
+/crypto/bn/*.c
+/crypto/bn/*.h
+/crypto/bn/arch/aarch64/
+/crypto/bn/arch/alpha/
+/crypto/bn/arch/amd64/
+/crypto/bn/arch/arm/
+/crypto/bn/arch/hppa/
+/crypto/bn/arch/i386/
+/crypto/bn/arch/m88k/
+/crypto/bn/arch/mips64/
+/crypto/bn/arch/powerpc/
+/crypto/bn/arch/powerpc64/
+/crypto/bn/arch/riscv64/
+/crypto/bn/arch/sh/
+/crypto/bn/arch/sparc64/
+/crypto/buffer/
+/crypto/bytestring/
+/crypto/camellia/
+/crypto/cast/
+/crypto/chacha/
+/crypto/cmac/
+/crypto/cms/
+/crypto/conf/
+/crypto/ct/
+/crypto/curve25519/
+/crypto/des/
+/crypto/dh/
+/crypto/dsa/
+/crypto/ec/
+/crypto/ecdh/
+/crypto/ecdsa/
+/crypto/engine/
+/crypto/err/
+/crypto/evp/
+/crypto/hidden/
+/crypto/hkdf/
+/crypto/hmac/
+/crypto/idea/
+/crypto/kdf/
+/crypto/lhash/
+/crypto/md4/
+/crypto/md5/
+/crypto/mlkem/
+/crypto/modes/
+/crypto/objects/
+/crypto/ocsp/
+/crypto/pem/
+/crypto/pkcs12/
+/crypto/pkcs7/
+/crypto/poly1305/
+/crypto/rand/
+/crypto/rc2/
+/crypto/rc4/
+/crypto/ripemd/
+/crypto/rsa/
+/crypto/sha/
+/crypto/sm3/
+/crypto/sm4/
+/crypto/stack/
+/crypto/ts/
+/crypto/txt_db/
+/crypto/ui/
+/crypto/x509/
 
 openbsd/
 
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 437570b..17e5a0c 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -1,4 +1,20 @@
+#
+# Copyright (c) 2014 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 cmake_minimum_required (VERSION 3.16.4)
+
 if(MSVC)
         cmake_policy(SET CMP0091 NEW)
 endif()
@@ -72,10 +88,6 @@ endforeach()
 
 set(BUILD_NC true)
 
-if(CMAKE_SYSTEM_NAME MATCHES "Darwin")
-        add_definitions(-fno-common)
-endif()
-
 if(CMAKE_SYSTEM_NAME MATCHES "OpenBSD")
         add_definitions(-DHAVE_ATTRIBUTE__BOUNDED__)
         add_definitions(-DHAVE_ATTRIBUTE__DEAD__)
@@ -131,7 +143,7 @@ add_definitions(-D__END_HIDDEN_DECLS=)
 set(CMAKE_POSITION_INDEPENDENT_CODE true)
 
 if (CMAKE_COMPILER_IS_GNUCC OR CMAKE_C_COMPILER_ID MATCHES "Clang")
-        add_definitions(-Wno-pointer-sign)
+        add_compile_options($<$<COMPILE_LANGUAGE:C>:-Wno-pointer-sign>)
 endif()
 
 if(WIN32)
@@ -366,6 +378,16 @@ if(HAVE_NETINET_IP_H)
         add_definitions(-DHAVE_NETINET_IP_H)
 endif()
 
+check_include_files(resolv.h HAVE_RESOLV_H)
+if(HAVE_RESOLV_H)
+        add_definitions(-DHAVE_RESOLV_H)
+endif()
+
+check_include_files(arpa/nameser.h HAVE_ARPA_NAMESER_H)
+if(HAVE_ARPA_NAMESER_H)
+        add_definitions(-DHAVE_ARPA_NAMESER_H)
+endif()
+
 # This isn't ready for universal binaries yet, since we do conditional
 # compilation based on the architecture, but this makes cross compiling for a
 # single architecture work on macOS at least.
@@ -375,20 +397,27 @@ if(APPLE AND (NOT CMAKE_OSX_ARCHITECTURES STREQUAL ""))
         set(CMAKE_SYSTEM_PROCESSOR "${CMAKE_OSX_ARCHITECTURES}")
 endif()
 
+# CMAKE_SYSTEM_PROCESSOR is not consistently set to the target architecture.
+# https://cmake.org/cmake/help/latest/variable/CMAKE_SYSTEM_PROCESSOR.html
+if (WIN32 AND (NOT CMAKE_GENERATOR_PLATFORM STREQUAL ""))
+        message("CMAKE_SYSTEM_PROCESSOR: ${CMAKE_SYSTEM_PROCESSOR}")
+        message("CMAKE_GENERATOR_PLATFORM: ${CMAKE_GENERATOR_PLATFORM}")
+        set(CMAKE_SYSTEM_PROCESSOR "${CMAKE_GENERATOR_PLATFORM}")
+endif()
+
 if(CMAKE_SYSTEM_PROCESSOR MATCHES "(aarch64|arm64|ARM64)")
         set(HOST_AARCH64 true)
-        if(WIN32)
-                set(ENABLE_ASM false)
-        endif()
 elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "arm")
         set(HOST_ARM true)
 elseif(CMAKE_SYSTEM_NAME STREQUAL "SunOS" AND CMAKE_SYSTEM_PROCESSOR MATCHES "i386")
         set(HOST_X86_64 true)
-elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "(x86_64|amd64|AMD64)")
+elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "(x86_64|x64|amd64|AMD64)")
         set(HOST_X86_64 true)
-elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "(i[3-6]86|[xX]86)")
+elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "(i[3-6]86|[xX]86|Win32)")
         set(ENABLE_ASM false)
         set(HOST_I386 true)
+elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "loongarch64")
+        set(HOST_LOONGARCH64 true)
 elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "mips64")
         set(HOST_MIPS64 true)
 elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "mips")
@@ -409,8 +438,6 @@ if(ENABLE_ASM)
         if(CMAKE_C_COMPILER_ABI STREQUAL "ELF")
                 if(HOST_X86_64)
                         set(HOST_ASM_ELF_X86_64 true)
-                elseif(HOST_ARM)
-                        set(HOST_ASM_ELF_ARMV4 true)
                 elseif(CMAKE_SYSTEM_NAME STREQUAL "SunOS" AND HOST_I386)
                         set(HOST_ASM_ELF_X86_64 true)
                 endif()
diff --git a/COPYING b/COPYING
new file mode 100644
index 0000000..c41ff4d
--- /dev/null
+++ b/COPYING
@@ -0,0 +1,133 @@
+
+  LibreSSL files are retained under the copyright of the authors. New
+  additions are ISC licensed as per OpenBSD's normal licensing policy,
+  or are placed in the public domain.
+
+  The OpenSSL code is distributed under the terms of the original OpenSSL
+  licenses which follow:
+
+  LICENSE ISSUES
+  ==============
+
+  The OpenSSL toolkit stays under a dual license, i.e. both the conditions of
+  the OpenSSL License and the original SSLeay license apply to the toolkit.
+  See below for the actual license texts.  In case of any license issues
+  related to OpenSSL please contact openssl-core@openssl.org.
+
+  OpenSSL License
+  ---------------
+
+/* ====================================================================
+ * Copyright (c) 1998-2011 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+ Original SSLeay License
+ -----------------------
+
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ *
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ *
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+
diff --git a/ChangeLog b/ChangeLog
index 02f448c..1739cfc 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -28,9 +28,54 @@ history is also available from Git.
 
 LibreSSL Portable Release Notes:
 
-4.1.0 - In development
+4.2.0 - In development
 
         * Portable changes
+        * Internal improvements
+          - Cleaned up code implementing block cipher modes of operation.
+            Includes untangling a horrible #ifdef mess and removing a few
+            instances of undefined behavior.
+          - Removed assembly implementations of AES using bit slicing (BS-AES)
+            and vector permutation (VP-AES).
+          - Integrated AES-NI into the AES API.
+          - Removed OPENSSL_SMALL_FOOTPRINT and OPENSSL_FIPSAPI.
+          - Lots of cleanup and removal of code with undefined behavior in
+            the block cipher modes of operation implementations.
+          - Implemented constant time EC field element operations to allow
+            implementing elliptic curve operations without bignum arithmetic.
+          - Implemented an EC method using homogeneous projective coordinates.
+            This allows exception-free elliptic curve arithmetic in constant
+            time.
+          - Started cleaning up the openssl speed implementation.
+          - The last SIGILL-based CPU capability detection was removed.
+            Instead, capabilities are now detected using a constructor on
+            library load, which improves the incomplete coverage by calls
+            to OPENSSL_init_crypto() on various entry points.
+        * Compatibility changes
+          - Removed the -msie_hack option from the openssl(1) ca subcommand.
+          - Removed parameters of the 239-bit prime curves from X9.62, H.5.2:
+            prime239v1, prime239v2, prime239v3.
+          - Increased default MAC salt length used by PKCS12_set_mac(3) to 16 
+            per recommendation of NIST SP 800-132.
+          - Encrypted PKCS#8 key files now use a default password-based key
+            derivation function that is acceptable in the present millenium.
+          - Of the old *err() only PEMerr(), RSAerr(), and SSLerr() remain.
+        * New features
+          - Allow specifying ALPN in nc(1) via -Talpn="http/1.1,http:/1.0".
+        * Bug fixes
+          - Avoid pointer arithmetic on NULL for memory BIOs.
+        * Documentation
+          - Rewrote most of the EC documentation from scratch to be at least
+            somewhat accurate and intelligible.
+        * Testing and proactive security
+          - Added a testing framework that will help deduplicating lots of
+            ad-hoc code in the regression tests.
+
+4.1.0 - Stable release
+
+        * Portable changes
+          - Added initial experimental support for loongarch64.
+          - Fixed compilation for mips32 and reenable CI.
           - Fixed CMake builds on FreeBSD.
           - Fixed the --prefix option for cmake --install.
           - Fixed tests for MinGW due to missing sh(1).
@@ -61,8 +106,11 @@ LibreSSL Portable Release Notes:
           - Replaced combinations of BN_MONT_CTX_new/set with an internal
             BN_MONT_CTX_create().
           - Replaced BN_bn2hex() reimplementation in openssl(1) ca with
-            a poper API call.
+            a proper API call.
           - Fixed integer overflows due to signed shift in obj_dat.c.
+          - Improved some X509_VERIFY_PARAM internals and avoid an out of
+            bounds read from public API.
+          - Imported ML-KEM 768 and 1024 from BoringSSL (not yet public API).
         * Compatibility changes
           - Added an OPENSSL_INIT_NO_ATEXIT flag for OPENSSL_init_crypto().
             It has no effect since LibreSSL doesn't call atexit().
@@ -71,6 +119,9 @@ LibreSSL Portable Release Notes:
           - EC_METHOD is no longer public and the API exposing it has been
             removed. This includes EC_GROUP_new(), EC_GFp_mont_method(),
             EC_GROUP_method_of() and EC_METHOD_get_field_type().
+          - The precomputation stubs for EC_GROUP were removed.
+          - The API setting Jacobian projective coordinates for a point was
+            removed as were EC_POINTs_{mul,make_affine}().
           - All elliptic curves over fields with less than 224 bits and a
             few more were removed from the built-in curves. This includes
             all WTLS curves and P-192.
@@ -79,26 +130,25 @@ LibreSSL Portable Release Notes:
           - Removed the -C option to generate "C code" from the openssl(1)
             dh, dhparam, dsaparam, ecparam, and x509 subcommands.
           - Removed #error in headers when OPENSSL_NO_* is defined.
-          - EC_METHOD is no longer public and all public API directly using
-            it was removed. This includes EC_GROUP_new(), EC_GFp_mont_method()
-            EC_{GROUP,POINT}_method_of() and EC_METHOD_get_field_type().
-          - The precomputation stubs for EC_GROUP were removed.
-          - The API setting Jacobian projective coordinates for a point was
-            removed as were EC_POINTs_{mul,make_affine}().
           - CRYPTO_set_mem_functions() now matches OpenSSL 1.1 and
             CRYPTO_set_mem_ex_functions() was removed.
-          - X509_NAME_print() and X509_OBJECT_up_ref_count() are no longer public.
+          - The tls_session_secret_cb_fn type now matches OpenSSL 1.1.
+          - Unexport X509_NAME_print() and X509_OBJECT_up_ref_count().
           - const corrected UI_OpenSSL() and BN_MONT_CTX_copy().
           - Support OPENSSL_NO_FILENAMES.
           - Support SSL_OP_NO_RENEGOTIATION and SSL_OP_ALLOW_CLIENT_RENEGOTIATION.
+          - Export PKCS12_key_gen_uni() again.
         * New features
           - libtls has a new tls_peer_cert_common_name() API call to retrieve
             the peer's common name without having to inspect the PEM.
-          - Imported ML-KEM 768 and 1024 from BoringSSL (not yet public API).
         * Bug fixes
           - Plugged a leak in eckey_compute_pubkey().
           - Again allow the magic values -1, -2 and -3 for the salt length
             of an RSA-PSS key in the EVP_PKEY_CTX_ctrl_str() interface.
+          - Fixed a few memory leaks in legacy code.
+        * Documentation
+          - The remaining undocumented public EVP API is now documented.
+          - Reorganization of existing documentation for clarity and accuracy.
         * Testing and proactive security
           - Improved regress coverage of the EC code.
 
diff --git a/Makefile.am b/Makefile.am
index 3f62cd9..eca5a27 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -1,3 +1,18 @@
+#
+# Copyright (c) 2014 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 SUBDIRS = include crypto ssl tls apps man
 if ENABLE_TESTS
 SUBDIRS += tests
diff --git a/Makefile.am.common b/Makefile.am.common
index 5405704..4257cf8 100644
--- a/Makefile.am.common
+++ b/Makefile.am.common
@@ -1,3 +1,18 @@
+#
+# Copyright (c) 2014 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 AM_CFLAGS =
 AM_CPPFLAGS = -I$(top_srcdir)/include
 AM_CPPFLAGS += -I$(abs_top_builddir)/include
diff --git a/apps/CMakeLists.txt b/apps/CMakeLists.txt
index 08a5a41..754990a 100644
--- a/apps/CMakeLists.txt
+++ b/apps/CMakeLists.txt
@@ -1,3 +1,18 @@
+#
+# Copyright (c) 2014 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 add_subdirectory(ocspcheck)
 add_subdirectory(openssl)
 add_subdirectory(nc)
diff --git a/apps/nc/CMakeLists.txt b/apps/nc/CMakeLists.txt
index d5f7813..b1eed1b 100644
--- a/apps/nc/CMakeLists.txt
+++ b/apps/nc/CMakeLists.txt
@@ -1,3 +1,18 @@
+#
+# Copyright (c) 2016 Kinichiro Inoguchi
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 if(BUILD_NC)
 
 set(
diff --git a/apps/nc/Makefile.am b/apps/nc/Makefile.am
index aba306e..a3911a2 100644
--- a/apps/nc/Makefile.am
+++ b/apps/nc/Makefile.am
@@ -1,3 +1,18 @@
+#
+# Copyright (c) 2015 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 include $(top_srcdir)/Makefile.am.common
 
 -include $(abs_top_builddir)/crypto/libcrypto_la_objects.mk
diff --git a/apps/ocspcheck/CMakeLists.txt b/apps/ocspcheck/CMakeLists.txt
index 778e837..ed2ec1b 100644
--- a/apps/ocspcheck/CMakeLists.txt
+++ b/apps/ocspcheck/CMakeLists.txt
@@ -1,3 +1,18 @@
+#
+# Copyright (c) 2017 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 set(
         OCSPCHECK_SRC
         http.c
diff --git a/apps/ocspcheck/Makefile.am b/apps/ocspcheck/Makefile.am
index e6f3c54..554bd5c 100644
--- a/apps/ocspcheck/Makefile.am
+++ b/apps/ocspcheck/Makefile.am
@@ -1,3 +1,18 @@
+#
+# Copyright (c) 2017 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 include $(top_srcdir)/Makefile.am.common
 
 -include $(abs_top_builddir)/crypto/libcrypto_la_objects.mk
diff --git a/apps/openssl/CMakeLists.txt b/apps/openssl/CMakeLists.txt
index bca60e1..3040d01 100644
--- a/apps/openssl/CMakeLists.txt
+++ b/apps/openssl/CMakeLists.txt
@@ -1,3 +1,18 @@
+#
+# Copyright (c) 2016 Kinichiro Inoguchi
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 set(
         OPENSSL_SRC
         apps.c
diff --git a/apps/openssl/Makefile.am b/apps/openssl/Makefile.am
index ee1b65b..40804c5 100644
--- a/apps/openssl/Makefile.am
+++ b/apps/openssl/Makefile.am
@@ -1,3 +1,18 @@
+#
+# Copyright (c) 2015 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 include $(top_srcdir)/Makefile.am.common
 
 -include $(abs_top_builddir)/crypto/libcrypto_la_objects.mk
diff --git a/check-release.sh b/check-release.sh
index c5f9c5f..723a051 100755
--- a/check-release.sh
+++ b/check-release.sh
@@ -1,4 +1,19 @@
 #!/bin/sh
+#
+# Copyright (c) 2014 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 set -e
 
 ver=$1
diff --git a/cmake_export_symbol.cmake b/cmake_export_symbol.cmake
index 0883001..9fe61f2 100644
--- a/cmake_export_symbol.cmake
+++ b/cmake_export_symbol.cmake
@@ -1,3 +1,18 @@
+#
+# Copyright (c) 2017 Kinichiro Inoguchi
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 macro(export_symbol TARGET SYMBOLS_PATH)
 
         set(FLAG "")
diff --git a/cmake_uninstall.cmake.in b/cmake_uninstall.cmake.in
index bb8055d..2887382 100644
--- a/cmake_uninstall.cmake.in
+++ b/cmake_uninstall.cmake.in
@@ -1,3 +1,18 @@
+#
+# Copyright (c) 2016 Kinichiro Inoguchi
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 if(NOT EXISTS "@CMAKE_CURRENT_BINARY_DIR@/install_manifest.txt")
         message(FATAL_ERROR "Cannot find install manifest: @CMAKE_CURRENT_BINARY_DIR@/install_manifest.txt")
 endif(NOT EXISTS "@CMAKE_CURRENT_BINARY_DIR@/install_manifest.txt")
diff --git a/configure.ac b/configure.ac
index 864a4ad..8d347b0 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1,3 +1,4 @@
+#
 # Copyright (c) 2014-2015 Brent Cook
 #
 # Permission to use, copy, modify, and distribute this software for any
@@ -86,16 +87,17 @@ AS_CASE([$host_cpu],
 )
 AM_CONDITIONAL([HOST_CPU_IS_INTEL], [test "x$HOSTARCH" = "xintel"])
 
-AM_CONDITIONAL([HOST_AARCH64],   [test "$host_cpu" = "aarch64"])
-AM_CONDITIONAL([HOST_ARM],       [test "$host_cpu" = "arm"])
-AM_CONDITIONAL([HOST_I386],      [test "$host_cpu" = "i386"])
-AM_CONDITIONAL([HOST_MIPS],      [test "$host_cpu" = "mips"])
-AM_CONDITIONAL([HOST_MIPS64],    [test "$host_cpu" = "mips64"])
-AM_CONDITIONAL([HOST_POWERPC],   [test "$host_cpu" = "powerpc"])
-AM_CONDITIONAL([HOST_POWERPC64], [test "$host_cpu" = "ppc64"])
-AM_CONDITIONAL([HOST_RISCV64],   [test "$host_cpu" = "riscv64"])
-AM_CONDITIONAL([HOST_SPARC64],   [test "$host_cpu" = "sparc64"])
-AM_CONDITIONAL([HOST_X86_64],    [test "$host_cpu" = "x86_64"])
+AM_CONDITIONAL([HOST_AARCH64],      [test "$host_cpu" = "aarch64"])
+AM_CONDITIONAL([HOST_ARM],          [test "$host_cpu" = "arm"])
+AM_CONDITIONAL([HOST_I386],         [test "$host_cpu" = "i386"])
+AM_CONDITIONAL([HOST_LOONGARCH64],  [test "$host_cpu" = "loongarch64"])
+AM_CONDITIONAL([HOST_MIPS],         [test "$host_cpu" = "mips"])
+AM_CONDITIONAL([HOST_MIPS64],       [test "$host_cpu" = "mips64"])
+AM_CONDITIONAL([HOST_POWERPC],      [test "$host_cpu" = "powerpc"])
+AM_CONDITIONAL([HOST_POWERPC64],    [test "$host_cpu" = "ppc64"])
+AM_CONDITIONAL([HOST_RISCV64],      [test "$host_cpu" = "riscv64"])
+AM_CONDITIONAL([HOST_SPARC64],      [test "$host_cpu" = "sparc64"])
+AM_CONDITIONAL([HOST_X86_64],       [test "$host_cpu" = "x86_64"])
 
 AC_MSG_CHECKING([if .gnu.warning accepts long strings])
 AC_LINK_IFELSE([AC_LANG_SOURCE([[
@@ -113,8 +115,6 @@ AC_ARG_ENABLE([asm], AS_HELP_STRING([--disable-asm], [Disable assembly]))
 AM_CONDITIONAL([OPENSSL_NO_ASM], [test "x$enable_asm" = "xno"])
 
 # Conditionally enable assembly by default
-AM_CONDITIONAL([HOST_ASM_ELF_ARM],
-    [test "x$HOST_ABI" = "xelf" -a "$host_cpu" = "arm" -a "x$enable_asm" != "xno"])
 AM_CONDITIONAL([HOST_ASM_ELF_MIPS],
     [test "x$HOST_ABI" = "xelf" -a "$host_cpu" = "mips" -a "x$enable_asm" != "xno"])
 AM_CONDITIONAL([HOST_ASM_ELF_MIPS64],
diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt
index e642b01..047c228 100644
--- a/crypto/CMakeLists.txt
+++ b/crypto/CMakeLists.txt
@@ -1,30 +1,28 @@
-add_definitions(-DLIBRESSL_CRYPTO_INTERNAL)
+#
+# Copyright (c) 2014 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
-if(HOST_ASM_ELF_ARMV4)
-        set(
-                ASM_ARMV4_ELF_SRC
-                aes/aes-elf-armv4.S
-                bn/mont-elf-armv4.S
-                sha/sha1-elf-armv4.S
-                sha/sha512-elf-armv4.S
-                sha/sha256-elf-armv4.S
-                modes/ghash-elf-armv4.S
-                armv4cpuid.S
-                armcap.c
-        )
-        add_definitions(-DAES_ASM)
-        add_definitions(-DOPENSSL_BN_ASM_MONT)
-        add_definitions(-DGHASH_ASM)
-        add_definitions(-DOPENSSL_CPUID_OBJ)
-        set(CRYPTO_SRC ${CRYPTO_SRC} ${ASM_ARMV4_ELF_SRC})
-endif()
+add_definitions(-DLIBRESSL_CRYPTO_INTERNAL)
 
 if(HOST_ASM_ELF_X86_64)
+        set(CRYPTO_SRC ${CRYPTO_SRC} aes/aes_amd64.c)
+        set(CRYPTO_SRC ${CRYPTO_SRC} bn/arch/amd64/bn_arch.c)
+        set(CRYPTO_SRC ${CRYPTO_SRC} modes/gcm128_amd64.c)
+
         set(
                 ASM_X86_64_ELF_SRC
                 aes/aes-elf-x86_64.S
-                aes/bsaes-elf-x86_64.S
-                aes/vpaes-elf-x86_64.S
                 aes/aesni-elf-x86_64.S
                 bn/modexp512-elf-x86_64.S
                 bn/mont-elf-x86_64.S
@@ -43,7 +41,6 @@ if(HOST_ASM_ELF_X86_64)
                 bn/arch/amd64/bignum_sqr_8_16_alt.S
                 bn/arch/amd64/bignum_sub.S
                 bn/arch/amd64/word_clz.S
-                bn/arch/amd64/bn_arch.c
         )
         add_definitions(-DAES_ASM)
         add_definitions(-DBSAES_ASM)
@@ -57,11 +54,13 @@ if(HOST_ASM_ELF_X86_64)
 endif()
 
 if(HOST_ASM_MACOSX_X86_64)
+        set(CRYPTO_SRC ${CRYPTO_SRC} aes/aes_amd64.c)
+        set(CRYPTO_SRC ${CRYPTO_SRC} bn/arch/amd64/bn_arch.c)
+        set(CRYPTO_SRC ${CRYPTO_SRC} modes/gcm128_amd64.c)
+
         set(
                 ASM_X86_64_MACOSX_SRC
                 aes/aes-macosx-x86_64.S
-                aes/bsaes-macosx-x86_64.S
-                aes/vpaes-macosx-x86_64.S
                 aes/aesni-macosx-x86_64.S
                 bn/modexp512-macosx-x86_64.S
                 bn/mont-macosx-x86_64.S
@@ -80,7 +79,6 @@ if(HOST_ASM_MACOSX_X86_64)
                 bn/arch/amd64/bignum_sqr_8_16_alt.S
                 bn/arch/amd64/bignum_sub.S
                 bn/arch/amd64/word_clz.S
-                bn/arch/amd64/bn_arch.c
         )
         add_definitions(-DAES_ASM)
         add_definitions(-DBSAES_ASM)
@@ -95,11 +93,12 @@ if(HOST_ASM_MACOSX_X86_64)
 endif()
 
 if(HOST_ASM_MASM_X86_64)
+        set(CRYPTO_SRC ${CRYPTO_SRC} aes/aes_amd64.c)
+        set(CRYPTO_SRC ${CRYPTO_SRC} modes/gcm128_amd64.c)
+
         set(
                 ASM_X86_64_MASM_SRC
                 aes/aes-masm-x86_64.S
-                aes/bsaes-masm-x86_64.S
-                aes/vpaes-masm-x86_64.S
                 aes/aesni-masm-x86_64.S
                 #bn/modexp512-masm-x86_64.S
                 #bn/mont-masm-x86_64.S
@@ -121,11 +120,12 @@ if(HOST_ASM_MASM_X86_64)
 endif()
 
 if(HOST_ASM_MINGW64_X86_64)
+        set(CRYPTO_SRC ${CRYPTO_SRC} aes/aes_amd64.c)
+        set(CRYPTO_SRC ${CRYPTO_SRC} modes/gcm128_amd64.c)
+
         set(
                 ASM_X86_64_MINGW64_SRC
                 aes/aes-mingw64-x86_64.S
-                aes/bsaes-mingw64-x86_64.S
-                aes/vpaes-mingw64-x86_64.S
                 aes/aesni-mingw64-x86_64.S
                 #bn/modexp512-mingw64-x86_64.S
                 #bn/mont-mingw64-x86_64.S
@@ -146,7 +146,17 @@ if(HOST_ASM_MINGW64_X86_64)
 endif()
 
 if(HOST_AARCH64)
-        set(CRYPTO_SRC ${CRYPTO_SRC} arch/aarch64/crypto_cpu_caps.c)
+        if(APPLE)
+                set(CRYPTO_SRC ${CRYPTO_SRC} arch/aarch64/crypto_cpu_caps_darwin.c)
+        elseif(LINUX)
+                set(CRYPTO_SRC ${CRYPTO_SRC} arch/aarch64/crypto_cpu_caps_linux.c)
+        elseif(CMAKE_SYSTEM_NAME STREQUAL "OpenBSD")
+                set(CRYPTO_SRC ${CRYPTO_SRC} arch/aarch64/crypto_cpu_caps.c)
+        elseif(WIN32)
+                set(CRYPTO_SRC ${CRYPTO_SRC} arch/aarch64/crypto_cpu_caps_windows.c)
+        else()
+                set(CRYPTO_SRC ${CRYPTO_SRC} arch/aarch64/crypto_cpu_caps_none.c)
+        endif()
 elseif(HOST_X86_64)
         set(CRYPTO_SRC ${CRYPTO_SRC} arch/amd64/crypto_cpu_caps.c)
 elseif(HOST_I386)
@@ -163,7 +173,6 @@ set(
         crypto_memory.c
         aes/aes.c
         aes/aes_core.c
-        aes/aes_ige.c
         asn1/a_bitstr.c
         asn1/a_enum.c
         asn1/a_int.c
@@ -213,10 +222,8 @@ set(
         asn1/x_bignum.c
         asn1/x_crl.c
         asn1/x_exten.c
-        asn1/x_info.c
         asn1/x_long.c
         asn1/x_name.c
-        asn1/x_pkey.c
         asn1/x_pubkey.c
         asn1/x_req.c
         asn1/x_sig.c
@@ -245,6 +252,7 @@ set(
         bio/bss_null.c
         bio/bss_sock.c
         bn/bn_add.c
+        bn/bn_add_sub.c
         bn/bn_bpsw.c
         bn/bn_const.c
         bn/bn_convert.c
@@ -258,6 +266,7 @@ set(
         bn/bn_lib.c
         bn/bn_mod.c
         bn/bn_mod_sqrt.c
+        bn/bn_mod_words.c
         bn/bn_mont.c
         bn/bn_mul.c
         bn/bn_prime.c
@@ -339,11 +348,13 @@ set(
         ec/ec_convert.c
         ec/ec_curve.c
         ec/ec_err.c
+        ec/ec_field.c
         ec/ec_key.c
         ec/ec_lib.c
         ec/ec_mult.c
         ec/ec_pmeth.c
         ec/eck_prn.c
+        ec/ecp_hp_methods.c
         ec/ecp_methods.c
         ec/ecx_methods.c
         ecdh/ecdh.c
@@ -464,11 +475,7 @@ set(
         rand/rand_err.c
         rand/rand_lib.c
         rand/randfile.c
-        rc2/rc2_cbc.c
-        rc2/rc2_ecb.c
-        rc2/rc2_skey.c
-        rc2/rc2cfb64.c
-        rc2/rc2ofb64.c
+        rc2/rc2.c
         rc4/rc4.c
         ripemd/ripemd.c
         rsa/rsa_ameth.c
@@ -570,17 +577,17 @@ set(
 
 set(COMPAT_SRC empty.c)
 
+set(CRYPTO_UNEXPORT ${CRYPTO_UNEXPORT} BIO_s_log)
+
 if(UNIX)
         set(CRYPTO_SRC ${CRYPTO_SRC} crypto_lock.c)
         set(CRYPTO_SRC ${CRYPTO_SRC} bio/b_posix.c)
-        set(CRYPTO_SRC ${CRYPTO_SRC} bio/bss_log.c)
         set(CRYPTO_SRC ${CRYPTO_SRC} ui/ui_openssl.c)
 endif()
 
 if(WIN32)
         set(CRYPTO_SRC ${CRYPTO_SRC} compat/crypto_lock_win.c)
         set(CRYPTO_SRC ${CRYPTO_SRC} bio/b_win.c)
-        set(CRYPTO_UNEXPORT ${CRYPTO_UNEXPORT} BIO_s_log)
         set(CRYPTO_SRC ${CRYPTO_SRC} ui/ui_openssl_win.c)
 endif()
 
@@ -736,6 +743,7 @@ add_library(crypto_obj OBJECT ${CRYPTO_SRC})
 target_include_directories(crypto_obj
         PRIVATE
                 .
+                aes
                 asn1
                 bio
                 bn
@@ -774,11 +782,14 @@ elseif(HOST_ARM)
 elseif(HOST_I386)
         target_include_directories(crypto_obj PRIVATE arch/i386/)
         target_include_directories(crypto_obj PRIVATE bn/arch/i386/)
+elseif(HOST_LOONGARCH64)
+        target_include_directories(crypto_obj PRIVATE arch/loongarch64)
+        target_include_directories(crypto_obj PRIVATE bn/arch/loongarch64)
 elseif(HOST_MIPS64)
         target_include_directories(crypto_obj PRIVATE arch/mips64)
         target_include_directories(crypto_obj PRIVATE bn/arch/mips64)
 elseif(HOST_MIPS)
-        # XXX - can this go away? the directory doesn't exist...
+        target_include_directories(crypto_obj PRIVATE arch/mips)
         target_include_directories(crypto_obj PRIVATE bn/arch/mips)
 elseif(HOST_POWERPC)
         target_include_directories(crypto_obj PRIVATE arch/powerpc)
diff --git a/crypto/Makefile.am b/crypto/Makefile.am
index 438da8b..ad241ab 100644
--- a/crypto/Makefile.am
+++ b/crypto/Makefile.am
@@ -1,6 +1,22 @@
+#
+# Copyright (c) 2014 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 include $(top_srcdir)/Makefile.am.common
 
 AM_CPPFLAGS += -DLIBRESSL_CRYPTO_INTERNAL
+AM_CPPFLAGS += -I$(top_srcdir)/crypto/aes
 AM_CPPFLAGS += -I$(top_srcdir)/crypto/asn1
 AM_CPPFLAGS += -I$(top_srcdir)/crypto/bio
 AM_CPPFLAGS += -I$(top_srcdir)/crypto/bn
@@ -51,20 +67,18 @@ crypto_portable.sym: crypto.sym  Makefile
         -echo "generating crypto_portable.sym ..."
         -cp $(top_srcdir)/crypto/crypto.sym crypto_portable.sym
         -chmod u+w crypto_portable.sym
-if HOST_WIN
         -grep -v BIO_s_log crypto_portable.sym > crypto_portable.sym.tmp
         -mv crypto_portable.sym.tmp crypto_portable.sym
-endif
 
 libcrypto_la_objects.mk: Makefile
         @echo "libcrypto_la_objects= $(libcrypto_la_OBJECTS)" \
-          | sed 's/  */ $$\(abs_top_builddir\)\/crypto\//g' \
+          | sed 's/  */ $$\(top_builddir\)\/crypto\//g' \
           > libcrypto_la_objects.mk
         @echo "libcompat_la_objects= $(libcompat_la_OBJECTS)" \
-          | sed 's/compat\// $$\(abs_top_builddir\)\/crypto\/&/g' \
+          | sed 's/compat\// $$\(top_builddir\)\/crypto\/&/g' \
           >> libcrypto_la_objects.mk
         @echo "libcompatnoopt_la_objects= $(libcompatnoopt_la_OBJECTS)" \
-          | sed 's/compat\// $$\(abs_top_builddir\)\/crypto\/&/g' \
+          | sed 's/compat\// $$\(top_builddir\)\/crypto\/&/g' \
           >> libcrypto_la_objects.mk
 
 libcrypto_la_LDFLAGS = -version-info @LIBCRYPTO_VERSION@ -no-undefined -export-symbols crypto_portable.sym
@@ -187,7 +201,6 @@ include Makefile.am.arc4random
 libcrypto_la_SOURCES =
 EXTRA_libcrypto_la_SOURCES =
 
-include Makefile.am.elf-arm
 include Makefile.am.elf-mips
 include Makefile.am.elf-mips64
 include Makefile.am.elf-x86_64
@@ -195,7 +208,6 @@ include Makefile.am.macosx-x86_64
 include Makefile.am.masm-x86_64
 include Makefile.am.mingw64-x86_64
 
-if !HOST_ASM_ELF_ARM
 if !HOST_ASM_ELF_MIPS
 if !HOST_ASM_ELF_MIPS64
 if !HOST_ASM_ELF_X86_64
@@ -209,11 +221,23 @@ endif
 endif
 endif
 endif
-endif
 
 if HOST_AARCH64
+if HOST_DARWIN
+libcrypto_la_SOURCES += arch/aarch64/crypto_cpu_caps_darwin.c
+else
+if HOST_LINUX
+libcrypto_la_SOURCES += arch/aarch64/crypto_cpu_caps_linux.c
+else
+if HOST_OPENBSD
 libcrypto_la_SOURCES += arch/aarch64/crypto_cpu_caps.c
+else
+libcrypto_la_SOURCES += arch/aarch64/crypto_cpu_caps_none.c
 endif
+endif
+endif
+endif
+
 if HOST_X86_64
 libcrypto_la_SOURCES += arch/amd64/crypto_cpu_caps.c
 endif
@@ -231,7 +255,6 @@ else
 libcrypto_la_SOURCES += compat/crypto_lock_win.c
 endif
 libcrypto_la_SOURCES += crypto_memory.c
-noinst_HEADERS += arm_arch.h
 noinst_HEADERS += constant_time.h
 noinst_HEADERS += crypto_internal.h
 noinst_HEADERS += crypto_local.h
@@ -240,7 +263,6 @@ noinst_HEADERS += x86_arch.h
 # aes
 libcrypto_la_SOURCES += aes/aes.c
 libcrypto_la_SOURCES += aes/aes_core.c
-libcrypto_la_SOURCES += aes/aes_ige.c
 noinst_HEADERS += aes/aes_local.h
 
 # asn1
@@ -293,10 +315,8 @@ libcrypto_la_SOURCES += asn1/x_attrib.c
 libcrypto_la_SOURCES += asn1/x_bignum.c
 libcrypto_la_SOURCES += asn1/x_crl.c
 libcrypto_la_SOURCES += asn1/x_exten.c
-libcrypto_la_SOURCES += asn1/x_info.c
 libcrypto_la_SOURCES += asn1/x_long.c
 libcrypto_la_SOURCES += asn1/x_name.c
-libcrypto_la_SOURCES += asn1/x_pkey.c
 libcrypto_la_SOURCES += asn1/x_pubkey.c
 libcrypto_la_SOURCES += asn1/x_req.c
 libcrypto_la_SOURCES += asn1/x_sig.c
@@ -334,9 +354,6 @@ libcrypto_la_SOURCES += bio/bss_conn.c
 libcrypto_la_SOURCES += bio/bss_dgram.c
 libcrypto_la_SOURCES += bio/bss_fd.c
 libcrypto_la_SOURCES += bio/bss_file.c
-if !HOST_WIN
-libcrypto_la_SOURCES += bio/bss_log.c
-endif
 libcrypto_la_SOURCES += bio/bss_mem.c
 libcrypto_la_SOURCES += bio/bss_null.c
 libcrypto_la_SOURCES += bio/bss_sock.c
@@ -344,6 +361,7 @@ noinst_HEADERS += bio/bio_local.h
 
 # bn
 libcrypto_la_SOURCES += bn/bn_add.c
+libcrypto_la_SOURCES += bn/bn_add_sub.c
 libcrypto_la_SOURCES += bn/bn_bpsw.c
 libcrypto_la_SOURCES += bn/bn_const.c
 libcrypto_la_SOURCES += bn/bn_convert.c
@@ -357,6 +375,7 @@ libcrypto_la_SOURCES += bn/bn_kron.c
 libcrypto_la_SOURCES += bn/bn_lib.c
 libcrypto_la_SOURCES += bn/bn_mod.c
 libcrypto_la_SOURCES += bn/bn_mod_sqrt.c
+libcrypto_la_SOURCES += bn/bn_mod_words.c
 libcrypto_la_SOURCES += bn/bn_mont.c
 libcrypto_la_SOURCES += bn/bn_mul.c
 libcrypto_la_SOURCES += bn/bn_prime.c
@@ -396,10 +415,18 @@ endif
 noinst_HEADERS += arch/i386/crypto_arch.h
 noinst_HEADERS += bn/arch/i386/bn_arch.h
 
-# XXX - do we still need this?
+if HOST_LOONGARCH64
+libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/loongarch64/
+libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/bn/arch/loongarch64/
+endif
+noinst_HEADERS += arch/loongarch64/crypto_arch.h
+noinst_HEADERS += bn/arch/loongarch64/bn_arch.h
+
 if HOST_MIPS
+libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/mips/
 libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/bn/arch/mips/
 endif
+noinst_HEADERS += arch/mips/crypto_arch.h
 noinst_HEADERS += bn/arch/mips/bn_arch.h
 
 if HOST_MIPS64
@@ -554,13 +581,16 @@ libcrypto_la_SOURCES += ec/ec_asn1.c
 libcrypto_la_SOURCES += ec/ec_convert.c
 libcrypto_la_SOURCES += ec/ec_curve.c
 libcrypto_la_SOURCES += ec/ec_err.c
+libcrypto_la_SOURCES += ec/ec_field.c
 libcrypto_la_SOURCES += ec/ec_key.c
 libcrypto_la_SOURCES += ec/ec_lib.c
 libcrypto_la_SOURCES += ec/ec_mult.c
 libcrypto_la_SOURCES += ec/ec_pmeth.c
 libcrypto_la_SOURCES += ec/eck_prn.c
+libcrypto_la_SOURCES += ec/ecp_hp_methods.c
 libcrypto_la_SOURCES += ec/ecp_methods.c
 libcrypto_la_SOURCES += ec/ecx_methods.c
+noinst_HEADERS += ec/ec_internal.h
 noinst_HEADERS += ec/ec_local.h
 
 # ecdh
@@ -792,11 +822,7 @@ libcrypto_la_SOURCES += rand/rand_lib.c
 libcrypto_la_SOURCES += rand/randfile.c
 
 # rc2
-libcrypto_la_SOURCES += rc2/rc2_cbc.c
-libcrypto_la_SOURCES += rc2/rc2_ecb.c
-libcrypto_la_SOURCES += rc2/rc2_skey.c
-libcrypto_la_SOURCES += rc2/rc2cfb64.c
-libcrypto_la_SOURCES += rc2/rc2ofb64.c
+libcrypto_la_SOURCES += rc2/rc2.c
 noinst_HEADERS += rc2/rc2_local.h
 
 # rc4
diff --git a/crypto/Makefile.am.elf-arm b/crypto/Makefile.am.elf-arm
deleted file mode 100644
index 6a9fa50..0000000
--- a/crypto/Makefile.am.elf-arm
+++ /dev/null
@@ -1,18 +0,0 @@
-ASM_ARM_ELF = aes/aes-elf-armv4.S
-ASM_ARM_ELF += bn/mont-elf-armv4.S
-ASM_ARM_ELF += sha/sha1-elf-armv4.S
-ASM_ARM_ELF += sha/sha512-elf-armv4.S
-ASM_ARM_ELF += sha/sha256-elf-armv4.S
-ASM_ARM_ELF += modes/ghash-elf-armv4.S
-ASM_ARM_ELF += armv4cpuid.S
-ASM_ARM_ELF += armcap.c
-
-EXTRA_DIST += $(ASM_ARM_ELF)
-
-if HOST_ASM_ELF_ARM
-libcrypto_la_CPPFLAGS += -DAES_ASM
-libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT
-libcrypto_la_CPPFLAGS += -DGHASH_ASM
-libcrypto_la_CPPFLAGS += -DOPENSSL_CPUID_OBJ
-libcrypto_la_SOURCES += $(ASM_ARM_ELF)
-endif
diff --git a/crypto/Makefile.am.elf-x86_64 b/crypto/Makefile.am.elf-x86_64
index c62662c..ad49787 100644
--- a/crypto/Makefile.am.elf-x86_64
+++ b/crypto/Makefile.am.elf-x86_64
@@ -1,7 +1,5 @@
 
 ASM_X86_64_ELF = aes/aes-elf-x86_64.S
-ASM_X86_64_ELF += aes/bsaes-elf-x86_64.S
-ASM_X86_64_ELF += aes/vpaes-elf-x86_64.S
 ASM_X86_64_ELF += aes/aesni-elf-x86_64.S
 ASM_X86_64_ELF += bn/modexp512-elf-x86_64.S
 ASM_X86_64_ELF += bn/mont-elf-x86_64.S
@@ -20,11 +18,14 @@ ASM_X86_64_ELF += bn/arch/amd64/bignum_sqr_4_8_alt.S
 ASM_X86_64_ELF += bn/arch/amd64/bignum_sqr_8_16_alt.S
 ASM_X86_64_ELF += bn/arch/amd64/bignum_sub.S
 ASM_X86_64_ELF += bn/arch/amd64/word_clz.S
-ASM_X86_64_ELF += bn/arch/amd64/bn_arch.c
 
 EXTRA_DIST += $(ASM_X86_64_ELF)
 
 if HOST_ASM_ELF_X86_64
+libcrypto_la_SOURCES += aes/aes_amd64.c
+libcrypto_la_SOURCES += bn/arch/amd64/bn_arch.c
+libcrypto_la_SOURCES += modes/gcm128_amd64.c
+
 libcrypto_la_CPPFLAGS += -DAES_ASM
 libcrypto_la_CPPFLAGS += -DBSAES_ASM
 libcrypto_la_CPPFLAGS += -DVPAES_ASM
diff --git a/crypto/Makefile.am.macosx-x86_64 b/crypto/Makefile.am.macosx-x86_64
index 010e3be..bbccfd6 100644
--- a/crypto/Makefile.am.macosx-x86_64
+++ b/crypto/Makefile.am.macosx-x86_64
@@ -1,7 +1,5 @@
 
 ASM_X86_64_MACOSX = aes/aes-macosx-x86_64.S
-ASM_X86_64_MACOSX += aes/bsaes-macosx-x86_64.S
-ASM_X86_64_MACOSX += aes/vpaes-macosx-x86_64.S
 ASM_X86_64_MACOSX += aes/aesni-macosx-x86_64.S
 ASM_X86_64_MACOSX += bn/modexp512-macosx-x86_64.S
 ASM_X86_64_MACOSX += bn/mont-macosx-x86_64.S
@@ -20,11 +18,14 @@ ASM_X86_64_MACOSX += bn/arch/amd64/bignum_sqr_4_8_alt.S
 ASM_X86_64_MACOSX += bn/arch/amd64/bignum_sqr_8_16_alt.S
 ASM_X86_64_MACOSX += bn/arch/amd64/bignum_sub.S
 ASM_X86_64_MACOSX += bn/arch/amd64/word_clz.S
-ASM_X86_64_MACOSX += bn/arch/amd64/bn_arch.c
 
 EXTRA_DIST += $(ASM_X86_64_MACOSX)
 
 if HOST_ASM_MACOSX_X86_64
+libcrypto_la_SOURCES += aes/aes_amd64.c
+libcrypto_la_SOURCES += bn/arch/amd64/bn_arch.c
+libcrypto_la_SOURCES += modes/gcm128_amd64.c
+
 libcrypto_la_CPPFLAGS += -DAES_ASM
 libcrypto_la_CPPFLAGS += -DBSAES_ASM
 libcrypto_la_CPPFLAGS += -DVPAES_ASM
diff --git a/crypto/Makefile.am.masm-x86_64 b/crypto/Makefile.am.masm-x86_64
index 2ef7e1b..bb94e3a 100644
--- a/crypto/Makefile.am.masm-x86_64
+++ b/crypto/Makefile.am.masm-x86_64
@@ -1,7 +1,5 @@
 
 ASM_X86_64_MASM = aes/aes-masm-x86_64.S
-ASM_X86_64_MASM += aes/bsaes-masm-x86_64.S
-ASM_X86_64_MASM += aes/vpaes-masm-x86_64.S
 ASM_X86_64_MASM += aes/aesni-masm-x86_64.S
 ASM_X86_64_MASM += bn/modexp512-masm-x86_64.S
 ASM_X86_64_MASM += bn/mont-masm-x86_64.S
@@ -12,6 +10,9 @@ ASM_X86_64_MASM += rc4/rc4-masm-x86_64.S
 EXTRA_DIST += $(ASM_X86_64_MASM)
 
 if HOST_ASM_MASM_X86_64
+libcrypto_la_SOURCES += aes/aes_amd64.c
+libcrypto_la_SOURCES += modes/gcm128_amd64.c
+
 libcrypto_la_CPPFLAGS += -DAES_ASM
 libcrypto_la_CPPFLAGS += -DBSAES_ASM
 libcrypto_la_CPPFLAGS += -DVPAES_ASM
diff --git a/crypto/Makefile.am.mingw64-x86_64 b/crypto/Makefile.am.mingw64-x86_64
index 8e39e9f..efe2643 100644
--- a/crypto/Makefile.am.mingw64-x86_64
+++ b/crypto/Makefile.am.mingw64-x86_64
@@ -1,7 +1,5 @@
 
 ASM_X86_64_MINGW64 = aes/aes-mingw64-x86_64.S
-ASM_X86_64_MINGW64 += aes/bsaes-mingw64-x86_64.S
-ASM_X86_64_MINGW64 += aes/vpaes-mingw64-x86_64.S
 ASM_X86_64_MINGW64 += aes/aesni-mingw64-x86_64.S
 #ASM_X86_64_MINGW64 += bn/modexp512-mingw64-x86_64.S
 #ASM_X86_64_MINGW64 += bn/mont-mingw64-x86_64.S
@@ -12,6 +10,9 @@ ASM_X86_64_MINGW64 += rc4/rc4-mingw64-x86_64.S
 EXTRA_DIST += $(ASM_X86_64_MINGW64)
 
 if HOST_ASM_MINGW64_X86_64
+libcrypto_la_SOURCES += aes/aes_amd64.c
+libcrypto_la_SOURCES += modes/gcm128_amd64.c
+
 libcrypto_la_CPPFLAGS += -Dendbr32=endbr64
 libcrypto_la_CPPFLAGS += -DAES_ASM
 libcrypto_la_CPPFLAGS += -DBSAES_ASM
diff --git a/crypto/arch/aarch64/crypto_cpu_caps_darwin.c b/crypto/arch/aarch64/crypto_cpu_caps_darwin.c
new file mode 100644
index 0000000..1dd91b2
--- /dev/null
+++ b/crypto/arch/aarch64/crypto_cpu_caps_darwin.c
@@ -0,0 +1,60 @@
+/* $OpenBSD: crypto_cpu_caps.c,v 1.2 2024/11/12 13:52:31 jsing Exp $ */
+/*
+ * Copyright (c) 2025 Brent Cook <bcook@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <sys/sysctl.h>
+
+#include "crypto_arch.h"
+
+/* Machine dependent CPU capabilities. */
+uint64_t crypto_cpu_caps_aarch64;
+
+static uint64_t
+check_cpu_cap(const char *cap_name, uint64_t cap_flag)
+{
+        int has_cap = 0;
+        size_t len = sizeof(has_cap);
+
+        sysctlbyname(cap_name, &has_cap, &len, NULL, 0);
+
+        return has_cap ? cap_flag : 0;
+}
+
+void
+crypto_cpu_caps_init(void)
+{
+        crypto_cpu_caps_aarch64 = 0;
+
+        /* from https://developer.apple.com/documentation/kernel/1387446-sysctlbyname/determining_instruction_set_characteristics#3918855 */
+
+        crypto_cpu_caps_aarch64 |= check_cpu_cap("hw.optional.arm.FEAT_AES",
+                CRYPTO_CPU_CAPS_AARCH64_AES);
+
+        crypto_cpu_caps_aarch64 |= check_cpu_cap("hw.optional.arm.FEAT_PMULL",
+                CRYPTO_CPU_CAPS_AARCH64_PMULL);
+
+        crypto_cpu_caps_aarch64 |= check_cpu_cap("hw.optional.arm.FEAT_SHA1",
+                CRYPTO_CPU_CAPS_AARCH64_SHA1);
+
+        crypto_cpu_caps_aarch64 |= check_cpu_cap("hw.optional.arm.FEAT_SHA256",
+                CRYPTO_CPU_CAPS_AARCH64_SHA2);
+
+        crypto_cpu_caps_aarch64 |= check_cpu_cap("hw.optional.arm.FEAT_SHA512",
+                CRYPTO_CPU_CAPS_AARCH64_SHA512);
+
+        crypto_cpu_caps_aarch64 |= check_cpu_cap("hw.optional.arm.FEAT_SHA3",
+                CRYPTO_CPU_CAPS_AARCH64_SHA3);
+}
diff --git a/crypto/arch/aarch64/crypto_cpu_caps_linux.c b/crypto/arch/aarch64/crypto_cpu_caps_linux.c
new file mode 100644
index 0000000..ae28120
--- /dev/null
+++ b/crypto/arch/aarch64/crypto_cpu_caps_linux.c
@@ -0,0 +1,62 @@
+/* $OpenBSD: crypto_cpu_caps.c,v 1.2 2024/11/12 13:52:31 jsing Exp $ */
+/*
+ * Copyright (c) 2025 Brent Cook <bcook@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <sys/auxv.h>
+
+/* from arch/arm64/include/uapi/asm/hwcap.h */
+#define HWCAP_AES       (1 << 3)
+#define HWCAP_PMULL     (1 << 4)
+#define HWCAP_SHA1      (1 << 5)
+#define HWCAP_SHA2      (1 << 6)
+#define HWCAP_CRC32     (1 << 7)
+#define HWCAP_SHA3      (1 << 17)
+#define HWCAP_SHA512    (1 << 21)
+
+#include "crypto_arch.h"
+
+/* Machine dependent CPU capabilities. */
+uint64_t crypto_cpu_caps_aarch64;
+
+static uint64_t
+check_cpu_cap(unsigned long hwcap, uint64_t cap_flag)
+{
+        return (getauxval(AT_HWCAP) & hwcap) ? cap_flag : 0;
+}
+
+void
+crypto_cpu_caps_init(void)
+{
+        crypto_cpu_caps_aarch64 = 0;
+
+        crypto_cpu_caps_aarch64 |= check_cpu_cap(HWCAP_AES,
+                CRYPTO_CPU_CAPS_AARCH64_AES);
+
+        crypto_cpu_caps_aarch64 |= check_cpu_cap(HWCAP_PMULL,
+                CRYPTO_CPU_CAPS_AARCH64_PMULL);
+
+        crypto_cpu_caps_aarch64 |= check_cpu_cap(HWCAP_SHA1,
+                CRYPTO_CPU_CAPS_AARCH64_SHA1);
+
+        crypto_cpu_caps_aarch64 |= check_cpu_cap(HWCAP_SHA2,
+                CRYPTO_CPU_CAPS_AARCH64_SHA2);
+
+        crypto_cpu_caps_aarch64 |= check_cpu_cap(HWCAP_SHA512,
+                CRYPTO_CPU_CAPS_AARCH64_SHA512);
+
+        crypto_cpu_caps_aarch64 |= check_cpu_cap(HWCAP_SHA3,
+                CRYPTO_CPU_CAPS_AARCH64_SHA3);
+}
diff --git a/crypto/arch/aarch64/crypto_cpu_caps_none.c b/crypto/arch/aarch64/crypto_cpu_caps_none.c
new file mode 100644
index 0000000..dcd96b7
--- /dev/null
+++ b/crypto/arch/aarch64/crypto_cpu_caps_none.c
@@ -0,0 +1,26 @@
+/*
+ * Copyright (c) 2025 Brent Cook <bcook@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "crypto_arch.h"
+
+/* Machine dependent CPU capabilities. */
+uint64_t crypto_cpu_caps_aarch64;
+
+void
+crypto_cpu_caps_init(void)
+{
+        crypto_cpu_caps_aarch64 = 0;
+}
diff --git a/crypto/arch/aarch64/crypto_cpu_caps_windows.c b/crypto/arch/aarch64/crypto_cpu_caps_windows.c
new file mode 100644
index 0000000..e7cdded
--- /dev/null
+++ b/crypto/arch/aarch64/crypto_cpu_caps_windows.c
@@ -0,0 +1,36 @@
+/* $OpenBSD: crypto_cpu_caps.c,v 1.2 2024/11/12 13:52:31 jsing Exp $ */
+/*
+ * Copyright (c) 2025 Brent Cook <bcook@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <windows.h>
+
+#include "crypto_arch.h"
+
+/* Machine dependent CPU capabilities. */
+uint64_t crypto_cpu_caps_aarch64;
+
+void
+crypto_cpu_caps_init(void)
+{
+        crypto_cpu_caps_aarch64 = 0;
+
+        if (IsProcessorFeaturePresent(PF_ARM_V8_CRYPTO_INSTRUCTIONS_AVAILABLE)) {
+                crypto_cpu_caps_aarch64 |= CRYPTO_CPU_CAPS_AARCH64_AES;
+                crypto_cpu_caps_aarch64 |= CRYPTO_CPU_CAPS_AARCH64_PMULL;
+                crypto_cpu_caps_aarch64 |= CRYPTO_CPU_CAPS_AARCH64_SHA1;
+                crypto_cpu_caps_aarch64 |= CRYPTO_CPU_CAPS_AARCH64_SHA2;
+        }
+}
diff --git a/crypto/arch/loongarch64/crypto_arch.h b/crypto/arch/loongarch64/crypto_arch.h
new file mode 100644
index 0000000..a3dd98d
--- /dev/null
+++ b/crypto/arch/loongarch64/crypto_arch.h
@@ -0,0 +1,21 @@
+/*      $OpenBSD: crypto_arch.h,v 1.1 2024/08/11 13:02:39 jsing Exp $ */
+/*
+ * Copyright (c) 2024 Joel Sing <jsing@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef HEADER_CRYPTO_ARCH_H
+#define HEADER_CRYPTO_ARCH_H
+
+#endif
diff --git a/crypto/arch/mips/crypto_arch.h b/crypto/arch/mips/crypto_arch.h
new file mode 100644
index 0000000..274879c
--- /dev/null
+++ b/crypto/arch/mips/crypto_arch.h
@@ -0,0 +1,21 @@
+/*      $OpenBSD$ */
+/*
+ * Copyright (c) 2024 Joel Sing <jsing@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef HEADER_CRYPTO_ARCH_H
+#define HEADER_CRYPTO_ARCH_H
+
+#endif
diff --git a/crypto/bn/arch/loongarch64/bn_arch.h b/crypto/bn/arch/loongarch64/bn_arch.h
new file mode 100644
index 0000000..672ac12
--- /dev/null
+++ b/crypto/bn/arch/loongarch64/bn_arch.h
@@ -0,0 +1,23 @@
+/*      $OpenBSD: bn_arch.h,v 1.7 2023/07/09 10:37:32 jsing Exp $ */
+/*
+ * Copyright (c) 2023 Joel Sing <jsing@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <openssl/bn.h>
+
+#ifndef HEADER_BN_ARCH_H
+#define HEADER_BN_ARCH_H
+
+#endif
diff --git a/crypto/compat/.gitignore b/crypto/compat/.gitignore
new file mode 100644
index 0000000..7f05049
--- /dev/null
+++ b/crypto/compat/.gitignore
@@ -0,0 +1,31 @@
+arc4random.c
+arc4random_aix.h
+arc4random_freebsd.h
+arc4random_hpux.h
+arc4random_linux.h
+arc4random_netbsd.h
+arc4random_osx.h
+arc4random_solaris.h
+arc4random_uniform.c
+arc4random_win.h
+chacha_private.h
+explicit_bzero.c
+getentropy_aix.c
+getentropy_freebsd.c
+getentropy_hpux.c
+getentropy_linux.c
+getentropy_netbsd.c
+getentropy_osx.c
+getentropy_solaris.c
+getentropy_win.c
+reallocarray.c
+recallocarray.c
+strcasecmp.c
+strlcat.c
+strlcpy.c
+strndup.c
+strnlen.c
+strsep.c
+strtonum.c
+timingsafe_bcmp.c
+timingsafe_memcmp.c
diff --git a/crypto/compat/b_win.c b/crypto/compat/b_win.c
index e261cd2..45af839 100644
--- a/crypto/compat/b_win.c
+++ b/crypto/compat/b_win.c
@@ -8,7 +8,8 @@
 #include <ws2tcpip.h>
 
 #include <openssl/bio.h>
-#include <openssl/err.h>
+
+#include "err_local.h"
 
 int
 BIO_sock_init(void)
@@ -29,7 +30,7 @@ BIO_sock_init(void)
                 }
                 wsa_init_done = 1;
         }
-        return (1);
+        return (1);
 }
 
 void
diff --git a/crypto/compat/posix_win.c b/crypto/compat/posix_win.c
index 1fbfce1..572e527 100644
--- a/crypto/compat/posix_win.c
+++ b/crypto/compat/posix_win.c
@@ -22,6 +22,25 @@
 #include <string.h>
 #include <unistd.h>
 
+#include <sys/stat.h>
+
+static int
+is_socket(int fd)
+{
+        // Border case: Don't break std* file descriptors
+        if (fd < 3)
+                return 0;
+
+        // All locally-allocated file descriptors will have the high bit set
+        return (fd & 0x80000000) == 0;
+}
+
+static int
+get_real_fd(int fd)
+{
+        return (fd & 0x7fffffff);
+}
+
 void
 posix_perror(const char *s)
 {
@@ -44,6 +63,12 @@ posix_fopen(const char *path, const char *mode)
 }
 
 int
+libressl_fstat(int fd, struct stat *statbuf)
+{
+        return fstat(get_real_fd(fd), statbuf);
+}
+
+int
 posix_open(const char *path, ...)
 {
         va_list ap;
@@ -62,7 +87,11 @@ posix_open(const char *path, ...)
                 flags |= O_NOINHERIT;
         }
         flags &= ~O_NONBLOCK;
-        return open(path, flags, mode);
+
+        const int fh = open(path, flags, mode);
+
+        // Set high bit to mark file descriptor as a file handle
+        return fh + 0x80000000;
 }
 
 char *
@@ -150,52 +179,6 @@ wsa_errno(int err)
         return -1;
 }
 
-/*
- * Employ a similar trick to cpython (pycore_fileutils.h) where the CRT report
- * handler is disabled while checking if a descriptor is a socket or a file
- */
-#if defined _MSC_VER && _MSC_VER >= 1900
-
-#include <crtdbg.h>
-#include <stdlib.h>
-
-static void noop_handler(const wchar_t *expression,     const wchar_t *function,
-    const wchar_t *file, unsigned int line, uintptr_t pReserved)
-{
-        return;
-}
-
-#define BEGIN_SUPPRESS_IPH \
-        const int old_report_mode = _CrtSetReportMode(_CRT_ASSERT, 0); \
-        const _invalid_parameter_handler old_handler = _set_thread_local_invalid_parameter_handler(noop_handler)
-#define END_SUPPRESS_IPH \
-        (void)old_report_mode; /* Silence warning in release mode when _CrtSetReportMode compiles to void. */ \
-        _CrtSetReportMode(_CRT_ASSERT, old_report_mode); \
-        _set_thread_local_invalid_parameter_handler(old_handler)
-
-#else
-
-#define BEGIN_SUPPRESS_IPH
-#define END_SUPPRESS_IPH
-
-#endif
-
-static int
-is_socket(int fd)
-{
-        intptr_t hd;
-
-        BEGIN_SUPPRESS_IPH;
-        hd = _get_osfhandle(fd);
-        END_SUPPRESS_IPH;
-
-        if (hd == (intptr_t)INVALID_HANDLE_VALUE) {
-                return 1; /* fd is not file descriptor */
-        }
-
-        return 0;
-}
-
 int
 posix_connect(int sockfd, const struct sockaddr *addr, socklen_t addrlen)
 {
@@ -209,14 +192,13 @@ int
 posix_close(int fd)
 {
         int rc;
-
         if (is_socket(fd)) {
                 if ((rc = closesocket(fd)) == SOCKET_ERROR) {
                         int err = WSAGetLastError();
                         rc = wsa_errno(err);
                 }
         } else {
-                rc = close(fd);
+                rc = close(get_real_fd(fd));
         }
         return rc;
 }
@@ -225,14 +207,13 @@ ssize_t
 posix_read(int fd, void *buf, size_t count)
 {
         ssize_t rc;
-
         if (is_socket(fd)) {
                 if ((rc = recv(fd, buf, count, 0)) == SOCKET_ERROR) {
                         int err = WSAGetLastError();
                         rc = wsa_errno(err);
                 }
         } else {
-                rc = read(fd, buf, count);
+                rc = read(get_real_fd(fd), buf, count);
         }
         return rc;
 }
@@ -246,7 +227,7 @@ posix_write(int fd, const void *buf, size_t count)
                         rc = wsa_errno(WSAGetLastError());
                 }
         } else {
-                rc = write(fd, buf, count);
+                rc = write(get_real_fd(fd), buf, count);
         }
         return rc;
 }
diff --git a/dist.sh b/dist.sh
index e367038..9c4d35d 100755
--- a/dist.sh
+++ b/dist.sh
@@ -1,4 +1,19 @@
 #!/bin/sh
+#
+# Copyright (c) 2014 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+#
 set -e
 
 rm -f man/*.[35] include/openssl/*.h
diff --git a/gen-coverage-report.sh b/gen-coverage-report.sh
index b11f3f9..6453ecb 100755
--- a/gen-coverage-report.sh
+++ b/gen-coverage-report.sh
@@ -1,3 +1,18 @@
+#
+# Copyright (c) 2014 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+#
 #!/bin/sh
 
 VERSION=$(cat VERSION)
diff --git a/include/CMakeLists.txt b/include/CMakeLists.txt
index 59f5b62..04160af 100644
--- a/include/CMakeLists.txt
+++ b/include/CMakeLists.txt
@@ -1,3 +1,18 @@
+#
+# Copyright (c) 2016 Jeff Davey
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 if(ENABLE_LIBRESSL_INSTALL)
         install(DIRECTORY .
                 DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}
@@ -24,6 +39,8 @@ elseif(HOST_ARM)
         file(READ arch/arm/opensslconf.h OPENSSLCONF)
 elseif(HOST_I386)
         file(READ arch/i386/opensslconf.h OPENSSLCONF)
+elseif(HOST_LOONGARCH64)
+        file(READ arch/loongarch64/opensslconf.h OPENSSLCONF)
 elseif(HOST_MIPS)
         file(READ arch/mips/opensslconf.h OPENSSLCONF)
 elseif(HOST_MIPS64)
diff --git a/include/Makefile.am b/include/Makefile.am
index feaaa60..a3e1c19 100644
--- a/include/Makefile.am
+++ b/include/Makefile.am
@@ -1,3 +1,18 @@
+#
+# Copyright (c) 2014 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 include $(top_srcdir)/Makefile.am.common
 
 EXTRA_DIST = CMakeLists.txt
@@ -52,6 +67,7 @@ noinst_HEADERS += arch/amd64/opensslconf.h
 noinst_HEADERS += arch/arm/opensslconf.h
 noinst_HEADERS += arch/hppa/opensslconf.h
 noinst_HEADERS += arch/i386/opensslconf.h
+noinst_HEADERS += arch/loongarch64/opensslconf.h
 noinst_HEADERS += arch/m88k/opensslconf.h
 noinst_HEADERS += arch/mips/opensslconf.h
 noinst_HEADERS += arch/mips64/opensslconf.h
diff --git a/include/arch/loongarch64/opensslconf.h b/include/arch/loongarch64/opensslconf.h
new file mode 100644
index 0000000..868066c
--- /dev/null
+++ b/include/arch/loongarch64/opensslconf.h
@@ -0,0 +1,23 @@
+#include <openssl/opensslfeatures.h>
+
+#undef OPENSSL_EXPORT_VAR_AS_FUNCTION
+
+#ifndef OPENSSL_FILE
+#ifdef OPENSSL_NO_FILENAMES
+#define OPENSSL_FILE ""
+#define OPENSSL_LINE 0
+#else
+#define OPENSSL_FILE __FILE__
+#define OPENSSL_LINE __LINE__
+#endif
+#endif
+
+#if defined(HEADER_RC4_H)
+#if !defined(RC4_CHUNK)
+/*
+ * This enables code handling data aligned at natural CPU word
+ * boundary. See crypto/rc4/rc4_enc.c for further details.
+ */
+#define RC4_CHUNK unsigned long
+#endif
+#endif
diff --git a/include/arch/mips/opensslconf.h b/include/arch/mips/opensslconf.h
index f17d3d2..dcbe113 100644
--- a/include/arch/mips/opensslconf.h
+++ b/include/arch/mips/opensslconf.h
@@ -1,39 +1,18 @@
 #include <openssl/opensslfeatures.h>
-/* crypto/opensslconf.h.in */
-
-#if defined(HEADER_CRYPTLIB_H) && !defined(OPENSSLDIR)
-#define OPENSSLDIR "/etc/ssl"
-#endif
-
-#undef OPENSSL_UNISTD
-#define OPENSSL_UNISTD <unistd.h>
 
 #undef OPENSSL_EXPORT_VAR_AS_FUNCTION
 
-#if defined(HEADER_IDEA_H) && !defined(IDEA_INT)
-#define IDEA_INT unsigned int
-#endif
-
-#if defined(HEADER_MD2_H) && !defined(MD2_INT)
-#define MD2_INT unsigned int
+#ifndef OPENSSL_FILE
+#ifdef OPENSSL_NO_FILENAMES
+#define OPENSSL_FILE ""
+#define OPENSSL_LINE 0
+#else
+#define OPENSSL_FILE __FILE__
+#define OPENSSL_LINE __LINE__
 #endif
-
-#if defined(HEADER_RC2_H) && !defined(RC2_INT)
-/* I need to put in a mod for the alpha - eay */
-#define RC2_INT unsigned int
 #endif
 
 #if defined(HEADER_RC4_H)
-#if !defined(RC4_INT)
-/* using int types make the structure larger but make the code faster
- * on most boxes I have tested - up to %20 faster. */
-/*
- * I don't know what does "most" mean, but declaring "int" is a must on:
- * - Intel P6 because partial register stalls are very expensive;
- * - elder Alpha because it lacks byte load/store instructions;
- */
-#define RC4_INT unsigned int
-#endif
 #if !defined(RC4_CHUNK)
 /*
  * This enables code handling data aligned at natural CPU word
@@ -42,113 +21,3 @@
 #undef RC4_CHUNK
 #endif
 #endif
-
-#if (defined(HEADER_NEW_DES_H) || defined(HEADER_DES_H)) && !defined(DES_LONG)
-/* If this is set to 'unsigned int' on a DEC Alpha, this gives about a
- * %20 speed up (longs are 8 bytes, int's are 4). */
-#ifndef DES_LONG
-#define DES_LONG unsigned int
-#endif
-#endif
-
-#if defined(HEADER_BN_H) && !defined(CONFIG_HEADER_BN_H)
-#define CONFIG_HEADER_BN_H
-#define BN_LLONG
-
-/* Should we define BN_DIV2W here? */
-
-/* Only one for the following should be defined */
-/* The prime number generation stuff may not work when
- * EIGHT_BIT but I don't care since I've only used this mode
- * for debugging the bignum libraries */
-#undef SIXTY_FOUR_BIT_LONG
-#undef SIXTY_FOUR_BIT
-#define THIRTY_TWO_BIT
-#undef SIXTEEN_BIT
-#undef EIGHT_BIT
-#endif
-
-#if defined(HEADER_RC4_LOCL_H) && !defined(CONFIG_HEADER_RC4_LOCL_H)
-#define CONFIG_HEADER_RC4_LOCL_H
-/* if this is defined data[i] is used instead of *data, this is a %20
- * speedup on x86 */
-#define RC4_INDEX
-#endif
-
-#if defined(HEADER_BF_LOCL_H) && !defined(CONFIG_HEADER_BF_LOCL_H)
-#define CONFIG_HEADER_BF_LOCL_H
-#undef BF_PTR
-#endif /* HEADER_BF_LOCL_H */
-
-#if defined(HEADER_DES_LOCL_H) && !defined(CONFIG_HEADER_DES_LOCL_H)
-#define CONFIG_HEADER_DES_LOCL_H
-#ifndef DES_DEFAULT_OPTIONS
-/* the following is tweaked from a config script, that is why it is a
- * protected undef/define */
-#ifndef DES_PTR
-#undef DES_PTR
-#endif
-
-/* This helps C compiler generate the correct code for multiple functional
- * units.  It reduces register dependencies at the expense of 2 more
- * registers */
-#ifndef DES_RISC1
-#undef DES_RISC1
-#endif
-
-#ifndef DES_RISC2
-#undef DES_RISC2
-#endif
-
-#if defined(DES_RISC1) && defined(DES_RISC2)
-YOU SHOULD NOT HAVE BOTH DES_RISC1 AND DES_RISC2 DEFINED!!!!!
-#endif
-
-/* Unroll the inner loop, this sometimes helps, sometimes hinders.
- * Very much CPU dependent */
-#ifndef DES_UNROLL
-#define DES_UNROLL
-#endif
-
-/* These default values were supplied by
- * Peter Gutman <pgut001@cs.auckland.ac.nz>
- * They are only used if nothing else has been defined */
-#if !defined(DES_PTR) && !defined(DES_RISC1) && !defined(DES_RISC2) && !defined(DES_UNROLL)
-/* Special defines which change the way the code is built depending on the
-   CPU and OS.  For SGI machines you can use _MIPS_SZLONG (32 or 64) to find
-   even newer MIPS CPU's, but at the moment one size fits all for
-   optimization options.  Older Sparc's work better with only UNROLL, but
-   there's no way to tell at compile time what it is you're running on */
- 
-#if defined( sun )              /* Newer Sparc's */
-#  define DES_PTR
-#  define DES_RISC1
-#  define DES_UNROLL
-#elif defined( __ultrix )       /* Older MIPS */
-#  define DES_PTR
-#  define DES_RISC2
-#  define DES_UNROLL
-#elif defined( __osf1__ )       /* Alpha */
-#  define DES_PTR
-#  define DES_RISC2
-#elif defined ( _AIX )          /* RS6000 */
-  /* Unknown */
-#elif defined( __hpux )         /* HP-PA */
-  /* Unknown */
-#elif defined( __aux )          /* 68K */
-  /* Unknown */
-#elif defined( __dgux )         /* 88K (but P6 in latest boxes) */
-#  define DES_UNROLL
-#elif defined( __sgi )          /* Newer MIPS */
-#  define DES_PTR
-#  define DES_RISC2
-#  define DES_UNROLL
-#elif defined(i386) || defined(__i386__)        /* x86 boxes, should be gcc */
-#  define DES_PTR
-#  define DES_RISC1
-#  define DES_UNROLL
-#endif /* Systems-specific speed defines */
-#endif
-
-#endif /* DES_DEFAULT_OPTIONS */
-#endif /* HEADER_DES_LOCL_H */
diff --git a/include/compat/sys/stat.h b/include/compat/sys/stat.h
index b88da1d..57aa521 100644
--- a/include/compat/sys/stat.h
+++ b/include/compat/sys/stat.h
@@ -118,4 +118,12 @@
 
 #endif
 
+#ifdef _WIN32
+int libressl_fstat(int fd, struct stat *statbuf);
+
+#ifndef NO_REDEF_POSIX_FUNCTIONS
+#define fstat(fd, statbuf) libressl_fstat(fd, statbuf)
+#endif
+#endif
+
 #endif
diff --git a/include/openssl/Makefile.am.tpl b/include/openssl/Makefile.am.tpl
index 303d0b9..4bbbd60 100644
--- a/include/openssl/Makefile.am.tpl
+++ b/include/openssl/Makefile.am.tpl
@@ -17,6 +17,9 @@ endif
 if HOST_I386
         -cp $(top_srcdir)/include/arch/i386/opensslconf.h opensslconf.h
 endif
+if HOST_LOONGARCH64
+        -cp $(top_srcdir)/include/arch/loongarch64/opensslconf.h opensslconf.h
+endif
 if HOST_MIPS
         -cp $(top_srcdir)/include/arch/mips/opensslconf.h opensslconf.h
 endif
diff --git a/libcrypto.pc.in b/libcrypto.pc.in
index 11d7ef0..c11fbd3 100644
--- a/libcrypto.pc.in
+++ b/libcrypto.pc.in
@@ -1,3 +1,18 @@
+#
+# Copyright (c) 2014 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+#
 #libcrypto pkg-config source file
 
 prefix=@prefix@
diff --git a/libssl.pc.in b/libssl.pc.in
index 512ec1c..9d0d641 100644
--- a/libssl.pc.in
+++ b/libssl.pc.in
@@ -1,3 +1,18 @@
+#
+# Copyright (c) 2014 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+#
 #libssl pkg-config source file
 
 prefix=@prefix@
diff --git a/libtls.pc.in b/libtls.pc.in
index 3c49391..19c8134 100644
--- a/libtls.pc.in
+++ b/libtls.pc.in
@@ -1,3 +1,18 @@
+#
+# Copyright (c) 2014 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+#
 #libtls pkg-config source file
 
 prefix=@prefix@
diff --git a/m4/check-libc.m4 b/m4/check-libc.m4
index 8cb849b..dadf0da 100644
--- a/m4/check-libc.m4
+++ b/m4/check-libc.m4
@@ -1,3 +1,18 @@
+#
+# Copyright (c) 2014 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 AC_DEFUN([CHECK_LIBC_COMPAT], [
 # Check for libc headers
 AC_CHECK_HEADERS([endian.h machine/endian.h err.h readpassphrase.h])
diff --git a/m4/check-os-options.m4 b/m4/check-os-options.m4
index 2ef4293..fd63d77 100644
--- a/m4/check-os-options.m4
+++ b/m4/check-os-options.m4
@@ -1,3 +1,18 @@
+#
+# Copyright (c) 2014 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 AC_DEFUN([CHECK_OS_OPTIONS], [
 
 CFLAGS="$CFLAGS -Wall -std=gnu99 -fno-strict-aliasing"
@@ -74,14 +89,14 @@ char buf[1]; getentropy(buf, 1);
                 ;;
         *hpux*)
                 HOST_OS=hpux;
-                if test "`echo $host_os | cut -c 1-4`" = "ia64" ; then
-                        if test "`echo $CC | cut -d ' ' -f 1`" = "gcc" ; then
+                if test "echo $host_os | cut -c 1-4" = "ia64" ; then
+                        if test "echo $CC | cut -d ' ' -f 1" = "gcc" ; then
                                 CFLAGS="$CFLAGS -mlp64"
                         else
                                 CFLAGS="+DD64"
                         fi
                 fi
-                if ! test "`echo $CC | cut -d ' ' -f 1`" = "gcc" ; then
+                if ! test "echo $CC | cut -d ' ' -f 1" = "gcc" ; then
                         CFLAGS="-g -O2 +Otype_safety=off $CFLAGS $USER_CFLAGS"
                 fi
                 CPPFLAGS="$CPPFLAGS -D_XOPEN_SOURCE=600 -D__STRICT_ALIGNMENT"
diff --git a/m4/disable-compiler-warnings.m4 b/m4/disable-compiler-warnings.m4
index 2792722..052e8ab 100644
--- a/m4/disable-compiler-warnings.m4
+++ b/m4/disable-compiler-warnings.m4
@@ -1,3 +1,18 @@
+#
+# Copyright (c) 2014 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 AC_DEFUN([DISABLE_COMPILER_WARNINGS], [
 # Clang throws a lot of warnings when it does not understand a flag. Disable
 # this warning for now so other warnings are visible.
diff --git a/man/CMakeLists.txt b/man/CMakeLists.txt
index 462a831..8f1121e 100644
--- a/man/CMakeLists.txt
+++ b/man/CMakeLists.txt
@@ -1,3 +1,18 @@
+#
+# Copyright (c) 2015 Jeff Davey
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 if(ENABLE_LIBRESSL_INSTALL)
         install(DIRECTORY .
             DESTINATION ${CMAKE_INSTALL_MANDIR}/man3
diff --git a/man/links b/man/links
index b1dbf82..37c7b42 100644
--- a/man/links
+++ b/man/links
@@ -185,9 +185,7 @@ BIO_ctrl.3,BIO_set_info_callback.3
 BIO_ctrl.3,BIO_tell.3
 BIO_ctrl.3,BIO_wpending.3
 BIO_ctrl.3,bio_info_cb.3
-BIO_dump.3,BIO_dump_fp.3
 BIO_dump.3,BIO_dump_indent.3
-BIO_dump.3,BIO_dump_indent_fp.3
 BIO_dup_chain.3,BIO_dup_state.3
 BIO_f_buffer.3,BIO_get_buffer_num_lines.3
 BIO_f_buffer.3,BIO_set_buffer_read_data.3
@@ -644,37 +642,33 @@ ECDSA_SIG_new.3,ECDSA_size.3
 ECDSA_SIG_new.3,ECDSA_verify.3
 ECDSA_SIG_new.3,d2i_ECDSA_SIG.3
 ECDSA_SIG_new.3,i2d_ECDSA_SIG.3
-EC_GROUP_copy.3,EC_GROUP_check.3
-EC_GROUP_copy.3,EC_GROUP_check_discriminant.3
-EC_GROUP_copy.3,EC_GROUP_cmp.3
-EC_GROUP_copy.3,EC_GROUP_dup.3
-EC_GROUP_copy.3,EC_GROUP_get0_generator.3
-EC_GROUP_copy.3,EC_GROUP_get0_seed.3
-EC_GROUP_copy.3,EC_GROUP_get_asn1_flag.3
-EC_GROUP_copy.3,EC_GROUP_get_basis_type.3
-EC_GROUP_copy.3,EC_GROUP_get_cofactor.3
-EC_GROUP_copy.3,EC_GROUP_get_curve_name.3
-EC_GROUP_copy.3,EC_GROUP_get_degree.3
-EC_GROUP_copy.3,EC_GROUP_get_order.3
-EC_GROUP_copy.3,EC_GROUP_get_point_conversion_form.3
-EC_GROUP_copy.3,EC_GROUP_get_seed_len.3
-EC_GROUP_copy.3,EC_GROUP_order_bits.3
-EC_GROUP_copy.3,EC_GROUP_set_asn1_flag.3
-EC_GROUP_copy.3,EC_GROUP_set_curve_name.3
-EC_GROUP_copy.3,EC_GROUP_set_generator.3
-EC_GROUP_copy.3,EC_GROUP_set_point_conversion_form.3
-EC_GROUP_copy.3,EC_GROUP_set_seed.3
-EC_GROUP_new.3,EC_GROUP_clear_free.3
-EC_GROUP_new.3,EC_GROUP_free.3
-EC_GROUP_new.3,EC_GROUP_get_curve.3
-EC_GROUP_new.3,EC_GROUP_get_curve_GFp.3
-EC_GROUP_new.3,EC_GROUP_new_by_curve_name.3
-EC_GROUP_new.3,EC_GROUP_new_curve_GFp.3
-EC_GROUP_new.3,EC_GROUP_set_curve.3
-EC_GROUP_new.3,EC_GROUP_set_curve_GFp.3
-EC_GROUP_new.3,EC_curve_nid2nist.3
-EC_GROUP_new.3,EC_curve_nist2nid.3
-EC_GROUP_new.3,EC_get_builtin_curves.3
+EC_GROUP_check.3,EC_GROUP_check_discriminant.3
+EC_GROUP_get_curve_name.3,EC_GROUP_get0_seed.3
+EC_GROUP_get_curve_name.3,EC_GROUP_get_asn1_flag.3
+EC_GROUP_get_curve_name.3,EC_GROUP_get_basis_type.3
+EC_GROUP_get_curve_name.3,EC_GROUP_get_point_conversion_form.3
+EC_GROUP_get_curve_name.3,EC_GROUP_get_seed_len.3
+EC_GROUP_get_curve_name.3,EC_GROUP_set_asn1_flag.3
+EC_GROUP_get_curve_name.3,EC_GROUP_set_curve_name.3
+EC_GROUP_get_curve_name.3,EC_GROUP_set_point_conversion_form.3
+EC_GROUP_get_curve_name.3,EC_GROUP_set_seed.3
+EC_GROUP_new_by_curve_name.3,EC_GROUP_cmp.3
+EC_GROUP_new_by_curve_name.3,EC_GROUP_dup.3
+EC_GROUP_new_by_curve_name.3,EC_GROUP_free.3
+EC_GROUP_new_by_curve_name.3,EC_curve_nid2nist.3
+EC_GROUP_new_by_curve_name.3,EC_curve_nist2nid.3
+EC_GROUP_new_by_curve_name.3,EC_get_builtin_curves.3
+EC_GROUP_new_curve_GFp.3,EC_GROUP_clear_free.3
+EC_GROUP_new_curve_GFp.3,EC_GROUP_get0_generator.3
+EC_GROUP_new_curve_GFp.3,EC_GROUP_get_cofactor.3
+EC_GROUP_new_curve_GFp.3,EC_GROUP_get_curve.3
+EC_GROUP_new_curve_GFp.3,EC_GROUP_get_curve_GFp.3
+EC_GROUP_new_curve_GFp.3,EC_GROUP_get_degree.3
+EC_GROUP_new_curve_GFp.3,EC_GROUP_get_order.3
+EC_GROUP_new_curve_GFp.3,EC_GROUP_order_bits.3
+EC_GROUP_new_curve_GFp.3,EC_GROUP_set_curve.3
+EC_GROUP_new_curve_GFp.3,EC_GROUP_set_curve_GFp.3
+EC_GROUP_new_curve_GFp.3,EC_GROUP_set_generator.3
 EC_KEY_METHOD_new.3,EC_KEY_METHOD_free.3
 EC_KEY_METHOD_new.3,EC_KEY_METHOD_get_compute_key.3
 EC_KEY_METHOD_new.3,EC_KEY_METHOD_get_init.3
@@ -724,23 +718,21 @@ EC_POINT_add.3,EC_POINT_is_at_infinity.3
 EC_POINT_add.3,EC_POINT_is_on_curve.3
 EC_POINT_add.3,EC_POINT_make_affine.3
 EC_POINT_add.3,EC_POINT_mul.3
-EC_POINT_new.3,EC_POINT_bn2point.3
+EC_POINT_get_affine_coordinates.3,EC_POINT_get_affine_coordinates_GFp.3
+EC_POINT_get_affine_coordinates.3,EC_POINT_set_affine_coordinates.3
+EC_POINT_get_affine_coordinates.3,EC_POINT_set_affine_coordinates_GFp.3
+EC_POINT_get_affine_coordinates.3,EC_POINT_set_compressed_coordinates.3
+EC_POINT_get_affine_coordinates.3,EC_POINT_set_compressed_coordinates_GFp.3
+EC_POINT_get_affine_coordinates.3,EC_POINT_set_to_infinity.3
 EC_POINT_new.3,EC_POINT_clear_free.3
 EC_POINT_new.3,EC_POINT_copy.3
 EC_POINT_new.3,EC_POINT_dup.3
 EC_POINT_new.3,EC_POINT_free.3
-EC_POINT_new.3,EC_POINT_get_affine_coordinates.3
-EC_POINT_new.3,EC_POINT_get_affine_coordinates_GFp.3
-EC_POINT_new.3,EC_POINT_hex2point.3
-EC_POINT_new.3,EC_POINT_oct2point.3
-EC_POINT_new.3,EC_POINT_point2bn.3
-EC_POINT_new.3,EC_POINT_point2hex.3
-EC_POINT_new.3,EC_POINT_point2oct.3
-EC_POINT_new.3,EC_POINT_set_affine_coordinates.3
-EC_POINT_new.3,EC_POINT_set_affine_coordinates_GFp.3
-EC_POINT_new.3,EC_POINT_set_compressed_coordinates.3
-EC_POINT_new.3,EC_POINT_set_compressed_coordinates_GFp.3
-EC_POINT_new.3,EC_POINT_set_to_infinity.3
+EC_POINT_point2oct.3,EC_POINT_bn2point.3
+EC_POINT_point2oct.3,EC_POINT_hex2point.3
+EC_POINT_point2oct.3,EC_POINT_oct2point.3
+EC_POINT_point2oct.3,EC_POINT_point2bn.3
+EC_POINT_point2oct.3,EC_POINT_point2hex.3
 ENGINE_new.3,ENGINE_by_id.3
 ENGINE_new.3,ENGINE_cleanup.3
 ENGINE_new.3,ENGINE_ctrl_cmd.3
@@ -1182,11 +1174,6 @@ MD5.3,MD5_Update.3
 NAME_CONSTRAINTS_new.3,GENERAL_SUBTREE_free.3
 NAME_CONSTRAINTS_new.3,GENERAL_SUBTREE_new.3
 NAME_CONSTRAINTS_new.3,NAME_CONSTRAINTS_free.3
-OBJ_NAME_add.3,OBJ_NAME_cleanup.3
-OBJ_NAME_add.3,OBJ_NAME_get.3
-OBJ_NAME_add.3,OBJ_NAME_init.3
-OBJ_NAME_add.3,OBJ_NAME_new_index.3
-OBJ_NAME_add.3,OBJ_NAME_remove.3
 OBJ_create.3,OBJ_add_object.3
 OBJ_create.3,OBJ_cleanup.3
 OBJ_create.3,OBJ_create_objects.3
@@ -1271,7 +1258,6 @@ OPENSSL_VERSION_NUMBER.3,SSLeay.3
 OPENSSL_VERSION_NUMBER.3,SSLeay_version.3
 OPENSSL_config.3,OPENSSL_no_config.3
 OPENSSL_init_crypto.3,OPENSSL_init.3
-OPENSSL_load_builtin_modules.3,ASN1_add_oid_module.3
 OPENSSL_malloc.3,CRYPTO_free.3
 OPENSSL_malloc.3,CRYPTO_malloc.3
 OPENSSL_malloc.3,CRYPTO_strdup.3
@@ -1303,7 +1289,6 @@ OpenSSL_add_all_algorithms.3,OpenSSL_add_all_digests.3
 OpenSSL_add_all_algorithms.3,SSLeay_add_all_algorithms.3
 PEM_ASN1_read.3,PEM_ASN1_read_bio.3
 PEM_ASN1_read.3,d2i_of_void.3
-PEM_X509_INFO_read.3,PEM_X509_INFO_read_bio.3
 PEM_read.3,PEM_def_callback.3
 PEM_read.3,PEM_do_header.3
 PEM_read.3,PEM_get_EVP_CIPHER_INFO.3
@@ -2048,7 +2033,6 @@ X509_OBJECT_get0_X509.3,X509_OBJECT_idx_by_subject.3
 X509_OBJECT_get0_X509.3,X509_OBJECT_new.3
 X509_OBJECT_get0_X509.3,X509_OBJECT_retrieve_by_subject.3
 X509_OBJECT_get0_X509.3,X509_OBJECT_retrieve_match.3
-X509_PKEY_new.3,X509_PKEY_free.3
 X509_PUBKEY_new.3,X509_PUBKEY_free.3
 X509_PUBKEY_new.3,X509_PUBKEY_get.3
 X509_PUBKEY_new.3,X509_PUBKEY_get0.3
diff --git a/patches/aarch64_crypto_arch.h.patch b/patches/aarch64_crypto_arch.h.patch
new file mode 100644
index 0000000..e6a8cbf
--- /dev/null
+++ b/patches/aarch64_crypto_arch.h.patch
@@ -0,0 +1,16 @@
+--- crypto/arch/aarch64/crypto_arch.h.orig      Sun Jun 29 03:49:56 2025
++++ crypto/arch/aarch64/crypto_arch.h   Sun Jun 29 04:00:13 2025
+@@ -34,11 +34,13 @@ extern uint64_t crypto_cpu_caps_aarch64;
+ #define CRYPTO_CPU_CAPS_AARCH64_SHA3   (1ULL << 5)
+ 
+ #ifndef OPENSSL_NO_ASM
++#if 0
+ 
+ #define HAVE_SHA1_BLOCK_DATA_ORDER
+ #define HAVE_SHA256_BLOCK_DATA_ORDER
+ #define HAVE_SHA512_BLOCK_DATA_ORDER
+ 
++#endif
+ #endif
+ 
+ #endif
diff --git a/patches/amd64_crypto_arch.h.patch b/patches/amd64_crypto_arch.h.patch
new file mode 100644
index 0000000..b094100
--- /dev/null
+++ b/patches/amd64_crypto_arch.h.patch
@@ -0,0 +1,18 @@
+--- crypto/arch/amd64/crypto_arch.h.orig        Wed Jul 23 08:15:02 2025
++++ crypto/arch/amd64/crypto_arch.h     Wed Jul 23 08:15:20 2025
+@@ -47,6 +47,7 @@ extern uint64_t crypto_cpu_caps_amd64;
+ #define HAVE_RC4_INTERNAL
+ #define HAVE_RC4_SET_KEY_INTERNAL
+ 
++#if 0
+ #define HAVE_SHA1_BLOCK_DATA_ORDER
+ #define HAVE_SHA1_BLOCK_GENERIC
+ 
+@@ -55,6 +56,7 @@ extern uint64_t crypto_cpu_caps_amd64;
+ 
+ #define HAVE_SHA512_BLOCK_DATA_ORDER
+ #define HAVE_SHA512_BLOCK_GENERIC
++#endif
+ 
+ #endif
+ 
diff --git a/patches/crypto_arch.h.patch b/patches/crypto_arch.h.patch
deleted file mode 100644
index 6c889e5..0000000
--- a/patches/crypto_arch.h.patch
+++ /dev/null
@@ -1,34 +0,0 @@
---- crypto/arch/amd64/crypto_arch.h.orig        Fri Feb 14 06:00:43 2025
-+++ crypto/arch/amd64/crypto_arch.h     Fri Feb 14 06:01:13 2025
-@@ -40,6 +40,7 @@ extern uint64_t crypto_cpu_caps_amd64;
- #define HAVE_RC4_INTERNAL
- #define HAVE_RC4_SET_KEY_INTERNAL
- 
-+#if 0
- #define HAVE_SHA1_BLOCK_DATA_ORDER
- #define HAVE_SHA1_BLOCK_GENERIC
- 
-@@ -48,6 +49,7 @@ extern uint64_t crypto_cpu_caps_amd64;
- 
- #define HAVE_SHA512_BLOCK_DATA_ORDER
- #define HAVE_SHA512_BLOCK_GENERIC
-+#endif
- 
- #endif
- 
---- crypto/arch/aarch64/crypto_arch.h.orig      Thu Mar 13 05:42:37 2025
-+++ crypto/arch/aarch64/crypto_arch.h   Thu Mar 13 05:47:39 2025
-@@ -33,11 +33,13 @@
- #define CRYPTO_CPU_CAPS_AARCH64_SHA512 (1ULL << 4)
- #define CRYPTO_CPU_CAPS_AARCH64_SHA3   (1ULL << 5)
- 
-+#if 0
- #ifndef OPENSSL_NO_ASM
- 
- #define HAVE_SHA256_BLOCK_DATA_ORDER
- #define HAVE_SHA512_BLOCK_DATA_ORDER
- 
-+#endif
- #endif
- 
- #endif
diff --git a/patches/modes_local.h.patch b/patches/modes_local.h.patch
deleted file mode 100644
index 1ff799b..0000000
--- a/patches/modes_local.h.patch
+++ /dev/null
@@ -1,18 +0,0 @@
---- crypto/modes/modes_local.h.orig     Sat Jul  8 14:03:53 2023
-+++ crypto/modes/modes_local.h  Sat Jul  8 14:10:56 2023
-@@ -45,6 +45,7 @@
-                        asm ("bswapl %0"                                \
-                        : "+r"(ret));   ret;            })
- # elif (defined(__arm__) || defined(__arm)) && !defined(__STRICT_ALIGNMENT)
-+#  if (__ARM_ARCH >= 6)
- #  define BSWAP8(x) ({ u32 lo=(u64)(x)>>32,hi=(x);                     \
-                        asm ("rev %0,%0; rev %1,%1"                     \
-                        : "+r"(hi),"+r"(lo));                           \
-@@ -53,6 +54,7 @@
-                        asm ("rev %0,%1"                                \
-                        : "=r"(ret) : "r"((u32)(x)));                   \
-                        ret;                            })
-+#  endif
- # endif
- #endif
- #endif
diff --git a/patches/netcat.c.patch b/patches/netcat.c.patch
index 319aca6..345a170 100644
--- a/patches/netcat.c.patch
+++ b/patches/netcat.c.patch
@@ -1,5 +1,5 @@
---- apps/nc/netcat.c.orig       Sat Aug 17 03:21:05 2024
-+++ apps/nc/netcat.c    Sat Aug 17 03:28:50 2024
+--- apps/nc/netcat.c.orig       Fri Jun 27 12:39:21 2025
++++ apps/nc/netcat.c    Fri Jun 27 12:39:29 2025
 @@ -93,9 +93,13 @@ int  zflag;                                  /* Port Scan Flag */
  int    Dflag;                                  /* sodebug */
  int    Iflag;                                  /* TCP receive buffer size */
@@ -14,7 +14,7 @@
  
  int    usetls;                                 /* use TLS */
  const char    *Cflag;                          /* Public cert file */
-@@ -268,12 +272,14 @@ main(int argc, char *argv[])
+@@ -271,12 +275,14 @@ main(int argc, char *argv[])
                 case 'u':
                         uflag = 1;
                         break;
@@ -29,7 +29,7 @@
                 case 'v':
                         vflag = 1;
                         break;
-@@ -320,9 +326,11 @@ main(int argc, char *argv[])
+@@ -323,9 +329,11 @@ main(int argc, char *argv[])
                 case 'o':
                         oflag = optarg;
                         break;
@@ -41,7 +41,7 @@
                 case 'T':
                         errstr = NULL;
                         errno = 0;
-@@ -346,9 +354,11 @@ main(int argc, char *argv[])
+@@ -349,9 +357,11 @@ main(int argc, char *argv[])
         argc -= optind;
         argv += optind;
  
@@ -53,7 +53,7 @@
  
         /* Cruft to make sure options are clean, and used properly. */
         if (argc == 1 && family == AF_UNIX) {
-@@ -923,7 +933,10 @@ remote_connect(const char *host, const char *port, str
+@@ -928,7 +938,10 @@ remote_connect(const char *host, const char *port, str
      char *ipaddr)
  {
         struct addrinfo *res, *res0;
@@ -65,7 +65,7 @@
  
         if ((error = getaddrinfo(host, port, &hints, &res0)))
                 errx(1, "getaddrinfo for host \"%s\" port %s: %s", host,
-@@ -938,8 +951,10 @@ remote_connect(const char *host, const char *port, str
+@@ -943,8 +956,10 @@ remote_connect(const char *host, const char *port, str
                 if (sflag || pflag) {
                         struct addrinfo ahints, *ares;
  
@@ -76,7 +76,7 @@
                         memset(&ahints, 0, sizeof(struct addrinfo));
                         ahints.ai_family = res->ai_family;
                         ahints.ai_socktype = uflag ? SOCK_DGRAM : SOCK_STREAM;
-@@ -1031,7 +1046,10 @@ int
+@@ -1036,7 +1051,10 @@ int
  local_listen(const char *host, const char *port, struct addrinfo hints)
  {
         struct addrinfo *res, *res0;
@@ -88,7 +88,7 @@
         int error;
  
         /* Allow nodename to be null. */
-@@ -1052,9 +1070,11 @@ local_listen(const char *host, const char *port, struc
+@@ -1057,9 +1075,11 @@ local_listen(const char *host, const char *port, struc
                     res->ai_protocol)) == -1)
                         continue;
  
@@ -100,7 +100,7 @@
  
                 set_common_sockopts(s, res->ai_family);
  
-@@ -1559,11 +1579,13 @@ set_common_sockopts(int s, int af)
+@@ -1564,11 +1584,13 @@ set_common_sockopts(int s, int af)
  {
         int x = 1;
  
@@ -114,7 +114,7 @@
         if (Dflag) {
                 if (setsockopt(s, SOL_SOCKET, SO_DEBUG,
                     &x, sizeof(x)) == -1)
-@@ -1574,9 +1596,16 @@ set_common_sockopts(int s, int af)
+@@ -1579,9 +1601,16 @@ set_common_sockopts(int s, int af)
                     IP_TOS, &Tflag, sizeof(Tflag)) == -1)
                         err(1, "set IP ToS");
  
@@ -131,7 +131,7 @@
         }
         if (Iflag) {
                 if (setsockopt(s, SOL_SOCKET, SO_RCVBUF,
-@@ -1600,13 +1629,17 @@ set_common_sockopts(int s, int af)
+@@ -1605,13 +1634,17 @@ set_common_sockopts(int s, int af)
         }
  
         if (minttl != -1) {
@@ -150,7 +150,7 @@
         }
  }
  
-@@ -1831,15 +1864,19 @@ help(void)
+@@ -1841,15 +1874,19 @@ help(void)
         \t-P proxyuser\tUsername for proxy authentication\n\
         \t-p port\t     Specify local port for remote connects\n\
         \t-R CAfile     CA bundle\n\
@@ -175,4 +175,4 @@
 +       "\t-v           Verbose\n\
         \t-W recvlimit  Terminate after receiving a number of packets\n\
         \t-w timeout    Timeout for connects and final net reads\n\
-        \t-X proto      Proxy protocol: \"4\", \"5\" (SOCKS) or \"connect\"\n\
+        \t-X proto      Proxy protocol: \"4\", \"4A\", \"5\" (SOCKS) or \"connect\"\n\
diff --git a/patches/openssl.c.patch b/patches/openssl.c.patch
index 5ba5ac6..60ea9a7 100644
--- a/patches/openssl.c.patch
+++ b/patches/openssl.c.patch
@@ -1,6 +1,6 @@
---- apps/openssl/openssl.c.orig Thu Jan  2 08:27:54 2025
-+++ apps/openssl/openssl.c      Thu Jan  2 08:28:04 2025
-@@ -344,7 +344,9 @@ BIO *bio_err = NULL;
+--- apps/openssl/openssl.c.orig Sat May 31 03:18:05 2025
++++ apps/openssl/openssl.c      Sat May 31 03:18:17 2025
+@@ -341,7 +341,9 @@ BIO *bio_err = NULL;
  static void
  openssl_startup(void)
  {
diff --git a/patches/opensslfeatures.h.patch b/patches/opensslfeatures.h.patch
index 77df5dc..d370b32 100644
--- a/patches/opensslfeatures.h.patch
+++ b/patches/opensslfeatures.h.patch
@@ -36,3 +36,14 @@
  #include "bytestring.h"
  
  #if defined(__cplusplus)
+--- tests/test.h.orig   Sat May 31 04:48:09 2025
++++ tests/test.h        Sat May 31 04:48:31 2025
+@@ -18,6 +18,8 @@
+ #ifndef HEADER_TEST_H
+ #define HEADER_TEST_H
+ 
++#include <openssl/opensslfeatures.h>
++
+ #include <stddef.h>
+ #include <stdint.h>
+ 
diff --git a/patches/patch-aarch64-crypto-cpu-caps.c.patch b/patches/patch-aarch64-crypto-cpu-caps.c.patch
deleted file mode 100644
index dcfbdc0..0000000
--- a/patches/patch-aarch64-crypto-cpu-caps.c.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-Disable feature detection until we find a more portable way.
-
---- crypto/arch/aarch64/crypto_cpu_caps.c.orig  Sat Dec 14 13:45:16 2024
-+++ crypto/arch/aarch64/crypto_cpu_caps.c       Sat Dec 14 13:54:06 2024
-@@ -16,9 +16,12 @@
-  */
- 
- #include <sys/types.h>
-+
-+#if defined(__OpenBSD__)
- #include <sys/sysctl.h>
- 
- #include <machine/cpu.h>
-+#endif
- 
- #include <stddef.h>
- #include <stdio.h>
-@@ -67,6 +70,7 @@ parse_isar0(uint64_t isar0)
-        return caps;
- }
- 
-+#if defined(__OpenBSD__)
- static int
- read_isar0(uint64_t *isar0)
- {
-@@ -84,6 +88,13 @@ read_isar0(uint64_t *isar0)
- 
-        return 1;
- }
-+#else
-+static int
-+read_isar0(uint64_t *isar0)
-+{
-+       return 0;
-+}
-+#endif
- 
- void
- crypto_cpu_caps_init(void)
diff --git a/patches/patch-i386-crypto-cpu-caps.c.patch b/patches/patch-i386-crypto-cpu-caps.c.patch
index c85e33c..0642582 100644
--- a/patches/patch-i386-crypto-cpu-caps.c.patch
+++ b/patches/patch-i386-crypto-cpu-caps.c.patch
@@ -1,6 +1,6 @@
---- crypto/arch/i386/crypto_cpu_caps.c.orig     Fri Oct 18 17:35:20 2024
-+++ crypto/arch/i386/crypto_cpu_caps.c  Fri Oct 18 17:39:13 2024
-@@ -33,7 +33,7 @@ cpuid(uint32_t eax, uint32_t *out_eax, uint32_t *out_e
+--- crypto/arch/i386/crypto_cpu_caps.c.orig     Mon Jun 16 10:38:27 2025
++++ crypto/arch/i386/crypto_cpu_caps.c  Mon Jun 16 10:38:39 2025
+@@ -37,7 +37,7 @@ cpuid(uint32_t eax, uint32_t *out_eax, uint32_t *out_e
  {
         uint32_t ebx = 0, ecx = 0, edx = 0;
  
@@ -9,7 +9,7 @@
         __asm__ ("cpuid": "+a"(eax), "+b"(ebx), "+c"(ecx), "+d"(edx));
  #else
         eax = 0;
-@@ -54,7 +54,7 @@ xgetbv(uint32_t ecx, uint32_t *out_eax, uint32_t *out_
+@@ -58,7 +58,7 @@ xgetbv(uint32_t ecx, uint32_t *out_eax, uint32_t *out_
  {
         uint32_t eax = 0, edx = 0;
  
diff --git a/patches/speed.c.patch b/patches/speed.c.patch
index e1f1698..32e42b4 100644
--- a/patches/speed.c.patch
+++ b/patches/speed.c.patch
@@ -1,6 +1,6 @@
---- apps/openssl/speed.c.orig   Thu Jan  2 08:04:28 2025
-+++ apps/openssl/speed.c        Thu Jan  2 08:04:38 2025
-@@ -158,7 +158,16 @@ static void
+--- apps/openssl/speed.c.orig   Sat May 31 03:18:05 2025
++++ apps/openssl/speed.c        Sat May 31 03:18:17 2025
+@@ -154,7 +154,16 @@ static void
  pkey_print_message(const char *str, const char *str2,
      long num, int bits, int sec);
  static void print_result(int alg, int run_no, int count, double time_used);
@@ -15,9 +15,9 @@
 +#define alarm(seconds)         speed_alarm((seconds))
 +#endif
  
- #define ALGOR_NUM      32
+ #define ALGOR_NUM      31
  #define SIZE_NUM       5
-@@ -1129,8 +1138,10 @@ speed_main(int argc, char **argv)
+@@ -1087,8 +1096,10 @@ speed_main(int argc, char **argv)
         const EVP_CIPHER *evp_cipher = NULL;
         const EVP_MD *evp_md = NULL;
         int decrypt = 0;
@@ -28,7 +28,7 @@
         const char *errstr = NULL;
  
         if (pledge("stdio proc", NULL) == -1) {
-@@ -1205,6 +1216,7 @@ speed_main(int argc, char **argv)
+@@ -1163,6 +1174,7 @@ speed_main(int argc, char **argv)
                         decrypt = 1;
                         j--;    /* Otherwise, -decrypt gets confused with an
                                  * algorithm. */
@@ -36,7 +36,7 @@
                 } else if (argc > 0 && strcmp(*argv, "-multi") == 0) {
                         argc--;
                         argv++;
-@@ -1219,6 +1231,7 @@ speed_main(int argc, char **argv)
+@@ -1177,6 +1189,7 @@ speed_main(int argc, char **argv)
                         }
                         j--;    /* Otherwise, -multi gets confused with an
                                  * algorithm. */
@@ -44,7 +44,7 @@
                 } else if (argc > 0 && strcmp(*argv, "-unaligned") == 0) {
                         argc--;
                         argv++;
-@@ -1542,7 +1555,9 @@ speed_main(int argc, char **argv)
+@@ -1491,7 +1504,9 @@ speed_main(int argc, char **argv)
                         BIO_printf(bio_err, "-evp e          use EVP e.\n");
                         BIO_printf(bio_err, "-decrypt        time decryption instead of encryption (only EVP).\n");
                         BIO_printf(bio_err, "-mr             produce machine readable output.\n");
@@ -54,7 +54,7 @@
                         BIO_printf(bio_err, "-unaligned n    use buffers with offset n from proper alignment.\n");
                         goto end;
                 }
-@@ -1551,8 +1566,10 @@ speed_main(int argc, char **argv)
+@@ -1500,8 +1515,10 @@ speed_main(int argc, char **argv)
                 j++;
         }
  
@@ -65,7 +65,7 @@
  
         if (j == 0) {
                 for (i = 0; i < ALGOR_NUM; i++) {
-@@ -1624,11 +1641,13 @@ speed_main(int argc, char **argv)
+@@ -1573,11 +1590,13 @@ speed_main(int argc, char **argv)
  #define COND(c)        (run && count<0x7fffffff)
  #define COUNT(d) (count)
  
@@ -79,7 +79,7 @@
  
  #ifndef OPENSSL_NO_MD4
         if (doit[D_MD4]) {
-@@ -2434,7 +2453,9 @@ speed_main(int argc, char **argv)
+@@ -2370,7 +2389,9 @@ speed_main(int argc, char **argv)
                                 ecdh_doit[j] = 0;
                 }
         }
@@ -89,7 +89,7 @@
         if (!mr) {
                 fprintf(stdout, "%s\n", SSLeay_version(SSLEAY_VERSION));
                 fprintf(stdout, "%s\n", SSLeay_version(SSLEAY_BUILT_ON));
-@@ -2590,11 +2611,15 @@ pkey_print_message(const char *str, const char *str2, 
+@@ -2526,11 +2547,15 @@ pkey_print_message(const char *str, const char *str2, 
  static void
  print_result(int alg, int run_no, int count, double time_used)
  {
@@ -105,7 +105,7 @@
  static char *
  sstrsep(char **string, const char *delim)
  {
-@@ -2795,5 +2820,6 @@ do_multi(int multi)
+@@ -2731,5 +2756,6 @@ do_multi(int multi)
         free(fds);
         return 1;
  }
diff --git a/scripts/test b/scripts/test
index 1fb02eb..a93fe90 100755
--- a/scripts/test
+++ b/scripts/test
@@ -132,6 +132,21 @@ elif [ "$ARCH" = "arm32" -o "$ARCH" = "arm64" ]; then
 
         file apps/openssl/.libs/openssl
 
+elif [ "$ARCH" = "loong64" ]; then
+        sudo apt install -y qemu-user-static binfmt-support g++-14-loongarch64-linux-gnu
+        sudo ln -sf /usr/loongarch64-linux-gnu/lib64/ld-linux-loongarch-lp64d.so.1 /lib64
+
+        CC=loongarch64-linux-gnu-gcc-14
+        CXX=loongarch64-linux-gnu++-14
+        AR=loongarch64-linux-gnu-ar
+        STRIP=loongarch64-linux-gnu-strip-14
+        RANLIB=loongarch64-linux-gnu-ranlib
+
+        ./configure --host=loongarch64-linux-gnu
+        LD_LIBRARY_PATH=/usr/loongarch64-linux-gnu/lib make -j 4 check
+
+        file apps/openssl/openssl
+
 elif [ "$ARCH" = "mips32" -o "$ARCH" = "mips64" ]; then
         sudo apt-get install -y qemu-user-static binfmt-support
 
diff --git a/ssl/CMakeLists.txt b/ssl/CMakeLists.txt
index bdcfbb2..637e0f0 100644
--- a/ssl/CMakeLists.txt
+++ b/ssl/CMakeLists.txt
@@ -1,3 +1,18 @@
+#
+# Copyright (c) 2014 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 set(
         SSL_SRC
         bio_ssl.c
@@ -117,10 +132,12 @@ elseif(HOST_ARM)
         target_include_directories(ssl_obj PRIVATE ../crypto/arch/arm/)
 elseif(HOST_I386)
         target_include_directories(ssl_obj PRIVATE ../crypto/arch/i386/)
+elseif(HOST_LOONGARCH64)
+        target_include_directories(ssl_obj PRIVATE ../crypto/arch/loongarch64)
 elseif(HOST_MIPS64)
         target_include_directories(ssl_obj PRIVATE ../crypto/arch/mips64)
 elseif(HOST_MIPS)
-        # XXX - can this go away? the directory doesn't exist...
+        target_include_directories(ssl_obj PRIVATE ../crypto/arch/mips)
 elseif(HOST_POWERPC)
         target_include_directories(ssl_obj PRIVATE ../crypto/arch/powerpc)
 elseif(HOST_POWERPC64)
diff --git a/ssl/Makefile.am b/ssl/Makefile.am
index f9a66a3..3096749 100644
--- a/ssl/Makefile.am
+++ b/ssl/Makefile.am
@@ -1,3 +1,18 @@
+#
+# Copyright (c) 2014 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 include $(top_srcdir)/Makefile.am.common
 
 -include $(abs_top_builddir)/crypto/libcrypto_la_objects.mk
@@ -26,7 +41,7 @@ EXTRA_libssl_la_DEPENDENCIES = libssl_la_objects.mk
 
 libssl_la_objects.mk: Makefile
         @echo "libssl_la_objects= $(libssl_la_OBJECTS)" \
-          | sed 's/  */ $$\(abs_top_builddir\)\/ssl\//g' \
+          | sed 's/  */ $$\(top_builddir\)\/ssl\//g' \
           > libssl_la_objects.mk
 
 .PHONY: remove_bs_objects
@@ -131,9 +146,15 @@ libssl_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/i386/
 endif
 noinst_HEADERS += $(top_srcdir)/crypto/arch/i386/crypto_arch.h
 
-# XXX - do we still need this?
+if HOST_LOONGARCH64
+libssl_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/loongarch64/
+endif
+noinst_HEADERS += $(top_srcdir)/crypto/arch/loongarch64/crypto_arch.h
+
 if HOST_MIPS
+libssl_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/mips/
 endif
+noinst_HEADERS += $(top_srcdir)/crypto/arch/mips/crypto_arch.h
 
 if HOST_MIPS64
 libssl_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/mips64/
diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt
index 8d6fa9d..c497b77 100644
--- a/tests/CMakeLists.txt
+++ b/tests/CMakeLists.txt
@@ -1,3 +1,18 @@
+#
+# Copyright (c) 2015 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 add_definitions(-DLIBRESSL_CRYPTO_INTERNAL)
 
 include_directories(
@@ -28,10 +43,12 @@ elseif(HOST_ARM)
         include_directories(../crypto/arch/arm/)
 elseif(HOST_I386)
         include_directories(../crypto/arch/i386/)
+elseif(HOST_LOONGARCH64)
+        include_directories(../crypto/arch/loongarch64)
 elseif(HOST_MIPS64)
         include_directories(../crypto/arch/mips64)
 elseif(HOST_MIPS)
-        # XXX - can this go away? the directory doesn't exist...
+        include_directories(../crypto/arch/mips)
 elseif(HOST_POWERPC)
         include_directories(../crypto/arch/powerpc)
 elseif(HOST_POWERPC64)
@@ -63,6 +80,9 @@ function(add_platform_test TEST_NAME)
         endif()
 endfunction()
 
+# XXX - should probably be in their own static lib
+set(TEST_HELPER_SRC test.c test_util.c)
+
 # aeadtest
 add_executable(aeadtest aeadtest.c)
 target_link_libraries(aeadtest ${OPENSSL_TEST_LIBS})
@@ -447,6 +467,7 @@ add_platform_test(evptest evptest ${CMAKE_CURRENT_SOURCE_DIR}/evptests.txt)
 # evp_test
 add_executable(evp_test evp_test.c)
 target_link_libraries(evp_test ${OPENSSL_TEST_LIBS})
+prepare_emscripten_test_target(evp_test)
 add_platform_test(evp_test evp_test)
 
 # exdata_test
@@ -534,9 +555,12 @@ prepare_emscripten_test_target(lhash_test)
 add_platform_test(lhash_test lhash_test)
 
 # md_test
-add_executable(md_test md_test.c)
-target_link_libraries(md_test ${OPENSSL_TEST_LIBS})
-add_platform_test(md_test md_test)
+# XXX - ftruncate and mkstemp missing from Windows
+if(NOT WIN32)
+        add_executable(md_test md_test.c ${TEST_HELPER_SRC})
+        target_link_libraries(md_test ${OPENSSL_TEST_LIBS})
+        add_platform_test(md_test md_test)
+endif()
 
 # mlkem_tests
 add_executable(mlkem_tests mlkem_tests.c mlkem_tests_util.c parse_test_file.c)
@@ -618,13 +642,7 @@ add_platform_test(policy policy)
 # pq_test
 add_executable(pq_test pq_test.c)
 target_link_libraries(pq_test ${OPENSSL_TEST_LIBS})
-if(NOT WIN32)
-        add_test(NAME pq_test COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/pq_test.sh)
-else()
-        add_test(NAME pq_test COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/pq_test.bat
-                $<TARGET_FILE:pq_test>)
-endif()
-set_tests_properties(pq_test PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}")
+add_platform_test(pq_test pq_test)
 
 # quictest
 set(QUICTEST_SRC quictest.c)
@@ -722,9 +740,12 @@ endif()
 set_tests_properties(servertest PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}")
 
 # sha_test
-add_executable(sha_test sha_test.c)
-target_link_libraries(sha_test ${OPENSSL_TEST_LIBS})
-add_platform_test(sha_test sha_test)
+# XXX - ftruncate and mkstemp missing from Windows
+if(NOT WIN32)
+        add_executable(sha_test sha_test.c ${TEST_HELPER_SRC})
+        target_link_libraries(sha_test ${OPENSSL_TEST_LIBS})
+        add_platform_test(sha_test sha_test)
+endif()
 
 # shutdowntest
 set(SHUTDOWNTEST_SRC shutdowntest.c)
@@ -936,11 +957,6 @@ add_executable(x509_name_test x509_name_test.c)
 target_link_libraries(x509_name_test ${OPENSSL_TEST_LIBS})
 add_platform_test(x509_name_test x509_name_test)
 
-# x509name
-add_executable(x509name x509name.c)
-target_link_libraries(x509name ${OPENSSL_TEST_LIBS})
-add_platform_test(x509name x509name)
-
 # x509req_ext
 add_executable(x509req_ext x509req_ext.c)
 target_link_libraries(x509req_ext ${OPENSSL_TEST_LIBS})
diff --git a/tests/Makefile.am b/tests/Makefile.am
index 8153fc9..914b1e5 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -1,3 +1,18 @@
+#
+# Copyright (c) 2015 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 include $(top_srcdir)/Makefile.am.common
 
 -include $(abs_top_builddir)/crypto/libcrypto_la_objects.mk
@@ -19,6 +34,7 @@ AM_CPPFLAGS += -I $(top_srcdir)/crypto/modes
 AM_CPPFLAGS += -I $(top_srcdir)/crypto/sha
 AM_CPPFLAGS += -I $(top_srcdir)/crypto/x509
 AM_CPPFLAGS += -I $(top_srcdir)/ssl
+AM_CPPFLAGS += -I $(top_srcdir)/tests
 AM_CPPFLAGS += -I $(top_srcdir)/apps/openssl
 AM_CPPFLAGS += -I $(top_srcdir)/apps/openssl/compat
 AM_CPPFLAGS += -D_PATH_SSL_CA_FILE=\"$(top_srcdir)/cert.pem\"
@@ -36,8 +52,12 @@ if HOST_I386
 AM_CPPFLAGS += -I$(top_srcdir)/crypto/arch/i386/
 endif
 
-# XXX - do we still need this?
+if HOST_LOONGARCH64
+AM_CPPFLAGS += -I$(top_srcdir)/crypto/arch/loongarch64/
+endif
+
 if HOST_MIPS
+AM_CPPFLAGS += -I$(top_srcdir)/crypto/arch/mips/
 endif
 
 if HOST_MIPS64
@@ -82,6 +102,11 @@ check_PROGRAMS =
 EXTRA_DIST = CMakeLists.txt
 DISTCLEANFILES = pidwraptest.txt
 
+# XXX - should probably be in their own static lib
+TEST_HELPER_SRC = test.c test_util.c
+noinst_HEADERS = test.h
+EXTRA_DIST += $(TEST_HELPER_SRC)
+
 # aeadtest
 TESTS += aeadtest.sh
 check_PROGRAMS += aeadtest
@@ -334,7 +359,7 @@ chachatest_SOURCES = chachatest.c
 TESTS += cipher_list
 check_PROGRAMS += cipher_list
 cipher_list_SOURCES = cipher_list.c
-noinst_HEADERS = tests.h
+noinst_HEADERS += tests.h
 
 # cipherstest
 TESTS += cipherstest
@@ -544,7 +569,7 @@ lhash_test_SOURCES = lhash_test.c
 # md_test
 TESTS += md_test
 check_PROGRAMS += md_test
-md_test_SOURCES = md_test.c
+md_test_SOURCES = md_test.c $(TEST_HELPER_SRC)
 
 noinst_HEADERS += mlkem_tests_util.h
 noinst_HEADERS += parse_test_file.h
@@ -652,11 +677,9 @@ EXTRA_DIST += policy_root2.pem
 EXTRA_DIST += policy_root_cross_inhibit_mapping.pem
 
 # pq_test
-TESTS += pq_test.sh
+TESTS += pq_test
 check_PROGRAMS += pq_test
 pq_test_SOURCES = pq_test.c
-EXTRA_DIST += pq_test.sh pq_test.bat
-EXTRA_DIST += pq_expected.txt
 
 # quictest
 TESTS += quictest.sh
@@ -743,7 +766,7 @@ EXTRA_DIST += servertest.sh servertest.bat
 # sha_test
 TESTS += sha_test
 check_PROGRAMS += sha_test
-sha_test_SOURCES = sha_test.c
+sha_test_SOURCES = sha_test.c $(TEST_HELPER_SRC)
 
 # shutdowntest
 TESTS += shutdowntest.sh
@@ -915,11 +938,6 @@ TESTS += x509_name_test
 check_PROGRAMS += x509_name_test
 x509_name_test_SOURCES = x509_name_test.c
 
-# x509name
-TESTS += x509name
-check_PROGRAMS += x509name
-x509name_SOURCES = x509name.c
-
 # x509req_ext
 TESTS += x509req_ext
 check_PROGRAMS += x509req_ext
diff --git a/tests/aeadtest.sh b/tests/aeadtest.sh
index 212e354..bb09df2 100755
--- a/tests/aeadtest.sh
+++ b/tests/aeadtest.sh
@@ -1,4 +1,19 @@
 #!/bin/sh
+#
+# Copyright (c) 2014 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 set -e
 TEST=./aeadtest
 if [ -e ./aeadtest.exe ]; then
diff --git a/tests/arc4randomforktest.sh b/tests/arc4randomforktest.sh
index fe03068..bbe7641 100755
--- a/tests/arc4randomforktest.sh
+++ b/tests/arc4randomforktest.sh
@@ -1,4 +1,19 @@
 #!/bin/sh
+#
+# Copyright (c) 2014 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 set -e
 ./arc4randomforktest
 ./arc4randomforktest -b
diff --git a/tests/cmake/CMakeLists.txt b/tests/cmake/CMakeLists.txt
index 956fbfd..c3b7c4f 100644
--- a/tests/cmake/CMakeLists.txt
+++ b/tests/cmake/CMakeLists.txt
@@ -1,3 +1,18 @@
+#
+# Copyright (c) 2023 Pierre Wendling
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 cmake_minimum_required(VERSION 3.5)
 
 project(LibreSSL_Consumer LANGUAGES C)
diff --git a/tests/compat/pipe2.c b/tests/compat/pipe2.c
index 7600783..c27a858 100644
--- a/tests/compat/pipe2.c
+++ b/tests/compat/pipe2.c
@@ -35,6 +35,22 @@ static int setfl(int fd, int flag)
         return rc;
 }
 
+/*
+ * Have open() temporarily use up file descriptors until reaching beyond the
+ * allocated sockets, then leak the ones conflicting with any of the latter.
+ */
+static void create_issue_1069_sentinels(int socket_vector[2])
+{
+        int fd = open("CONIN$", O_RDONLY);
+        if (fd == -1 || fd > socket_vector[0] && fd > socket_vector[1]) {
+                return;
+        }
+        create_issue_1069_sentinels(socket_vector);
+        if (fd != socket_vector[0] && fd != socket_vector[1]) {
+                close(fd);
+        }
+}
+
 int socketpair(int domain, int type, int protocol, int socket_vector[2])
 {
         if (domain != AF_UNIX || !(type & SOCK_STREAM) || protocol != PF_UNSPEC)
@@ -85,6 +101,9 @@ int socketpair(int domain, int type, int protocol, int socket_vector[2])
                 goto err;
 
         closesocket(listener);
+
+        create_issue_1069_sentinels(socket_vector);
+
         return 0;
 
 err:
diff --git a/tests/dtlstest.sh b/tests/dtlstest.sh
index 8f9b229..f0b7161 100755
--- a/tests/dtlstest.sh
+++ b/tests/dtlstest.sh
@@ -1,4 +1,19 @@
 #!/bin/sh
+#
+# Copyright (c) 2021 Kinichiro Inoguchi
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 set -e
 
 dtlstest_bin=./dtlstest
diff --git a/tests/evptest.sh b/tests/evptest.sh
index ba44d75..ddd7445 100755
--- a/tests/evptest.sh
+++ b/tests/evptest.sh
@@ -1,4 +1,19 @@
 #!/bin/sh
+#
+# Copyright (c) 2014 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 set -e
 TEST=./evptest
 if [ -e ./evptest.exe ]; then
diff --git a/tests/keypairtest.sh b/tests/keypairtest.sh
index 8bb7d9f..f2c20c4 100755
--- a/tests/keypairtest.sh
+++ b/tests/keypairtest.sh
@@ -1,4 +1,19 @@
 #!/bin/sh
+#
+# Copyright (c) 2018 Kinichiro Inoguchi
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 set -e
 TEST=./keypairtest
 if [ -e ./keypairtest.exe ]; then
diff --git a/tests/mlkem_tests.sh b/tests/mlkem_tests.sh
index 2a9856e..cbc0f0b 100755
--- a/tests/mlkem_tests.sh
+++ b/tests/mlkem_tests.sh
@@ -1,4 +1,19 @@
 #!/bin/sh
+#
+# Copyright (c) 2024 Theo Buehler
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 set -e
 
 TEST=./mlkem_tests
diff --git a/tests/ocsptest.bat b/tests/ocsptest.bat
index 2b6b66b..8d44ee0 100644
--- a/tests/ocsptest.bat
+++ b/tests/ocsptest.bat
@@ -1,6 +1,19 @@
 @echo off

 setlocal enabledelayedexpansion

-REM     ocspocsp_test_bin.bat

+

+:: Copyright (c) 2016 Kinichiro Inoguchi

+::

+:: Permission to use, copy, modify, and distribute this software for any

+:: purpose with or without fee is hereby granted, provided that the above

+:: copyright notice and this permission notice appear in all copies.

+::

+:: THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES

+:: WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF

+:: MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR

+:: ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES

+:: WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN

+:: ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF

+:: OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

 

 set ocsp_test_bin=%1

 set ocsp_test_bin=%ocsp_test_bin:/=\%

diff --git a/tests/ocsptest.sh b/tests/ocsptest.sh
index a1c266d..71c975e 100755
--- a/tests/ocsptest.sh
+++ b/tests/ocsptest.sh
@@ -1,4 +1,19 @@
 #!/bin/sh
+#
+# Copyright (c) 2016 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 set -e
 TEST=./ocsp_test
 if [ -e ./ocsp_test.exe ]; then
diff --git a/tests/pidwraptest.sh b/tests/pidwraptest.sh
index 04fb5c4..d5a2f71 100755
--- a/tests/pidwraptest.sh
+++ b/tests/pidwraptest.sh
@@ -1,4 +1,19 @@
 #!/bin/sh
+#
+# Copyright (c) 2014 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 ./pidwraptest > pidwraptest.txt
 while read a b;
 do
diff --git a/tests/pq_test.bat b/tests/pq_test.bat
deleted file mode 100644
index 084f06d..0000000
--- a/tests/pq_test.bat
+++ /dev/null
@@ -1,15 +0,0 @@
-@echo off

-setlocal enabledelayedexpansion

-REM     pq_test.bat

-

-set pq_test_bin=%1

-set pq_test_bin=%pq_test_bin:/=\%

-if not exist %pq_test_bin% exit /b 1

-

-set pq_output=pq_output.txt

-if exist %pq_output% del %pq_output%

-

-%pq_test_bin% > %pq_output%

-fc /b %pq_output% %srcdir%\pq_expected.txt

-

-endlocal

diff --git a/tests/pq_test.sh b/tests/pq_test.sh
deleted file mode 100755
index eab6f3c..0000000
--- a/tests/pq_test.sh
+++ /dev/null
@@ -1,9 +0,0 @@
-#!/bin/sh
-set -e
-TEST=./pq_test
-if [ -e ./pq_test.exe ]; then
-        TEST=./pq_test.exe
-elif [ -e ./pq_test.js ]; then
-        TEST="node ./pq_test.js"
-fi
-$TEST | diff -b $srcdir/pq_expected.txt -
diff --git a/tests/quictest.bat b/tests/quictest.bat
index 645fc2f..be731c8 100644
--- a/tests/quictest.bat
+++ b/tests/quictest.bat
@@ -1,6 +1,19 @@
 @echo off

 setlocal enabledelayedexpansion

-REM     quictest.bat

+

+:: Copyright (c) 2022 Brent Cook

+::

+:: Permission to use, copy, modify, and distribute this software for any

+:: purpose with or without fee is hereby granted, provided that the above

+:: copyright notice and this permission notice appear in all copies.

+::

+:: THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES

+:: WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF

+:: MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR

+:: ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES

+:: WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN

+:: ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF

+:: OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

 

 set quictest_bin=%1

 set quictest_bin=%quictest_bin:/=\%

diff --git a/tests/quictest.sh b/tests/quictest.sh
index 23561ad..407a66b 100755
--- a/tests/quictest.sh
+++ b/tests/quictest.sh
@@ -1,4 +1,19 @@
 #!/bin/sh
+#
+# Copyright (c) 2022 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 set -e
 
 quictest_bin=./quictest
diff --git a/tests/renegotiation_test.bat b/tests/renegotiation_test.bat
index 0086046..6691a39 100644
--- a/tests/renegotiation_test.bat
+++ b/tests/renegotiation_test.bat
@@ -1,6 +1,19 @@
 @echo off

 setlocal enabledelayedexpansion

-REM     renegotiation_test.bat

+

+:: Copyright (c) 2025 Theo Beuhler

+::

+:: Permission to use, copy, modify, and distribute this software for any

+:: purpose with or without fee is hereby granted, provided that the above

+:: copyright notice and this permission notice appear in all copies.

+::

+:: THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES

+:: WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF

+:: MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR

+:: ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES

+:: WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN

+:: ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF

+:: OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

 

 set renegotiation_test_bin=%1

 set renegotiation_test_bin=%renegotiation_test_bin:/=\%

diff --git a/tests/renegotiation_test.sh b/tests/renegotiation_test.sh
index bbf27c8..8d963a2 100755
--- a/tests/renegotiation_test.sh
+++ b/tests/renegotiation_test.sh
@@ -1,4 +1,19 @@
 #!/bin/sh
+#
+# Copyright (c) 2025 Theo Buehler
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 set -e
 
 renegotiation_test_bin=./renegotiation_test
diff --git a/tests/servertest.bat b/tests/servertest.bat
index c0bfaa4..d72d8de 100644
--- a/tests/servertest.bat
+++ b/tests/servertest.bat
@@ -1,6 +1,19 @@
 @echo off

 setlocal enabledelayedexpansion

-REM     servertest.bat

+

+:: Copyright (c) 2017 Kinichiro Inoguchi

+::

+:: Permission to use, copy, modify, and distribute this software for any

+:: purpose with or without fee is hereby granted, provided that the above

+:: copyright notice and this permission notice appear in all copies.

+::

+:: THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES

+:: WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF

+:: MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR

+:: ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES

+:: WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN

+:: ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF

+:: OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

 

 set servertest_bin=%1

 set servertest_bin=%servertest_bin:/=\%

diff --git a/tests/servertest.sh b/tests/servertest.sh
index 1662332..4770e4b 100755
--- a/tests/servertest.sh
+++ b/tests/servertest.sh
@@ -1,4 +1,19 @@
 #!/bin/sh
+#
+# Copyright (c) 2017 Kinichiro Inoguchi
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 set -e
 
 servertest_bin=./servertest
diff --git a/tests/shutdowntest.bat b/tests/shutdowntest.bat
index f087dbb..d722fa0 100644
--- a/tests/shutdowntest.bat
+++ b/tests/shutdowntest.bat
@@ -1,6 +1,19 @@
 @echo off

 setlocal enabledelayedexpansion

-REM     shutdowntest.bat

+

+:: Copyright (c) 2024 Theo Beuhler

+::

+:: Permission to use, copy, modify, and distribute this software for any

+:: purpose with or without fee is hereby granted, provided that the above

+:: copyright notice and this permission notice appear in all copies.

+::

+:: THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES

+:: WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF

+:: MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR

+:: ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES

+:: WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN

+:: ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF

+:: OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

 

 set shutdowntest_bin=%1

 set shutdowntest_bin=%shutdowntest_bin:/=\%

diff --git a/tests/shutdowntest.sh b/tests/shutdowntest.sh
index d3ae472..b3c98da 100755
--- a/tests/shutdowntest.sh
+++ b/tests/shutdowntest.sh
@@ -1,4 +1,19 @@
 #!/bin/sh
+#
+# Copyright (c) 2024 Theo Buehler
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 set -e
 
 shutdowntest_bin=./shutdowntest
diff --git a/tests/ssltest.bat b/tests/ssltest.bat
index 5dda6bc..17f912f 100644
--- a/tests/ssltest.bat
+++ b/tests/ssltest.bat
@@ -1,6 +1,19 @@
 @echo off

 setlocal enabledelayedexpansion

-REM     ssltest.bat

+

+:: Copyright (c) 2016 Kinichiro Inoguchi

+::

+:: Permission to use, copy, modify, and distribute this software for any

+:: purpose with or without fee is hereby granted, provided that the above

+:: copyright notice and this permission notice appear in all copies.

+::

+:: THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES

+:: WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF

+:: MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR

+:: ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES

+:: WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN

+:: ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF

+:: OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

 

 set ssltest_bin=%1

 set ssltest_bin=%ssltest_bin:/=\%

diff --git a/tests/ssltest.sh b/tests/ssltest.sh
index 29ea0b0..4ec4884 100755
--- a/tests/ssltest.sh
+++ b/tests/ssltest.sh
@@ -1,4 +1,19 @@
 #!/bin/sh
+#
+# Copyright (c) 2014 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 set -e
 
 ssltest_bin=./ssltest
diff --git a/tests/testdsa.bat b/tests/testdsa.bat
index 898ded8..df53305 100644
--- a/tests/testdsa.bat
+++ b/tests/testdsa.bat
@@ -1,9 +1,21 @@
 @echo off

 setlocal enabledelayedexpansion

-REM     testdsa.bat

 

-

-REM # Test DSA certificate generation of openssl

+:: Copyright (c) 2016 Kinichiro Inoguchi

+::

+:: Permission to use, copy, modify, and distribute this software for any

+:: purpose with or without fee is hereby granted, provided that the above

+:: copyright notice and this permission notice appear in all copies.

+::

+:: THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES

+:: WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF

+:: MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR

+:: ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES

+:: WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN

+:: ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF

+:: OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

+

+:: Test DSA certificate generation of openssl

 

 set openssl_bin=%1

 set openssl_bin=%openssl_bin:/=\%

diff --git a/tests/testdsa.sh b/tests/testdsa.sh
index 7ecb8ef..230a1f8 100755
--- a/tests/testdsa.sh
+++ b/tests/testdsa.sh
@@ -1,6 +1,18 @@
 #!/bin/sh
-#       $OpenBSD: testdsa.sh,v 1.1 2014/08/26 17:50:07 jsing Exp $
-
+#
+# Copyright (c) 2015 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
 #Test DSA certificate generation of openssl
 
diff --git a/tests/testenc.bat b/tests/testenc.bat
index 84f48f2..fa14620 100644
--- a/tests/testenc.bat
+++ b/tests/testenc.bat
@@ -1,6 +1,19 @@
 @echo off

 setlocal enabledelayedexpansion

-REM     testenc.bat

+

+:: Copyright (c) 2016 Kinichiro Inoguchi

+::

+:: Permission to use, copy, modify, and distribute this software for any

+:: purpose with or without fee is hereby granted, provided that the above

+:: copyright notice and this permission notice appear in all copies.

+::

+:: THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES

+:: WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF

+:: MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR

+:: ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES

+:: WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN

+:: ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF

+:: OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

 

 set test=P

 

diff --git a/tests/testenc.sh b/tests/testenc.sh
index 63bce34..418e48d 100755
--- a/tests/testenc.sh
+++ b/tests/testenc.sh
@@ -1,5 +1,18 @@
 #!/bin/sh
-#       $OpenBSD: testenc.sh,v 1.1 2014/08/26 17:50:07 jsing Exp $
+#
+# Copyright (c) 2015 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
 test=p
 if [ -d ../apps/openssl ]; then
diff --git a/tests/testrsa.bat b/tests/testrsa.bat
index 59c3b5d..af59aad 100644
--- a/tests/testrsa.bat
+++ b/tests/testrsa.bat
@@ -1,9 +1,21 @@
 @echo off

 setlocal enabledelayedexpansion

-REM     testrsa.bat

 

-

-REM # Test RSA certificate generation of openssl

+:: Copyright (c) 2016 Kinichiro Inoguchi

+::

+:: Permission to use, copy, modify, and distribute this software for any

+:: purpose with or without fee is hereby granted, provided that the above

+:: copyright notice and this permission notice appear in all copies.

+::

+:: THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES

+:: WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF

+:: MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR

+:: ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES

+:: WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN

+:: ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF

+:: OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

+

+:: Test RSA certificate generation of openssl

 

 set openssl_bin=%1

 set openssl_bin=%openssl_bin:/=\%

diff --git a/tests/testrsa.sh b/tests/testrsa.sh
index e644999..afbc610 100755
--- a/tests/testrsa.sh
+++ b/tests/testrsa.sh
@@ -1,6 +1,18 @@
 #!/bin/sh
-#       $OpenBSD: testrsa.sh,v 1.1 2014/08/26 17:50:07 jsing Exp $
-
+#
+# Copyright (c) 2015 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
 #Test RSA certificate generation of openssl
 
diff --git a/tests/testssl.bat b/tests/testssl.bat
index c4e6286..35a789a 100644
--- a/tests/testssl.bat
+++ b/tests/testssl.bat
@@ -1,6 +1,19 @@
 @echo on

 setlocal enabledelayedexpansion

-REM     testssl.bat

+

+:: Copyright (c) 2016 Kinichiro Inoguchi

+::

+:: Permission to use, copy, modify, and distribute this software for any

+:: purpose with or without fee is hereby granted, provided that the above

+:: copyright notice and this permission notice appear in all copies.

+::

+:: THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES

+:: WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF

+:: MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR

+:: ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES

+:: WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN

+:: ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF

+:: OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

 

 set key=%1

 set cert=%2

diff --git a/tests/tlstest.bat b/tests/tlstest.bat
index 5f5f6a6..204201b 100644
--- a/tests/tlstest.bat
+++ b/tests/tlstest.bat
@@ -1,6 +1,19 @@
 @echo off

 setlocal enabledelayedexpansion

-REM     tlstest.bat

+

+:: Copyright (c) 2017 Brent Cook

+::

+:: Permission to use, copy, modify, and distribute this software for any

+:: purpose with or without fee is hereby granted, provided that the above

+:: copyright notice and this permission notice appear in all copies.

+::

+:: THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES

+:: WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF

+:: MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR

+:: ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES

+:: WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN

+:: ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF

+:: OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

 

 set tlstest_bin=%1

 set tlstest_bin=%tlstest_bin:/=\%

diff --git a/tests/tlstest.sh b/tests/tlstest.sh
index 4024007..4a5aff6 100755
--- a/tests/tlstest.sh
+++ b/tests/tlstest.sh
@@ -1,4 +1,19 @@
 #!/bin/sh
+#
+# Copyright (c) 2015 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 set -e
 
 tlstest_bin=./tlstest
diff --git a/tls/CMakeLists.txt b/tls/CMakeLists.txt
index c81bbb0..6475245 100644
--- a/tls/CMakeLists.txt
+++ b/tls/CMakeLists.txt
@@ -1,3 +1,18 @@
+#
+# Copyright (c) 2014 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 set(
         TLS_SRC
         tls.c
diff --git a/tls/Makefile.am b/tls/Makefile.am
index 22f3222..2a7b089 100644
--- a/tls/Makefile.am
+++ b/tls/Makefile.am
@@ -1,3 +1,18 @@
+#
+# Copyright (c) 2014 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 include $(top_srcdir)/Makefile.am.common
 
 -include $(abs_top_builddir)/crypto/libcrypto_la_objects.mk
@@ -16,7 +31,7 @@ EXTRA_libtls_la_DEPENDENCIES = libtls_la_objects.mk
 
 libtls_la_objects.mk: Makefile
         @echo "libtls_la_objects= $(libtls_la_OBJECTS)" \
-          | sed -e 's/ *$$//' -e 's/  */ $$\(abs_top_builddir\)\/tls\//g' \
+          | sed -e 's/ *$$//' -e 's/  */ $$\(top_builddir\)\/tls\//g' \
           > libtls_la_objects.mk
 
 libtls_la_LDFLAGS = -version-info @LIBTLS_VERSION@ -no-undefined -export-symbols $(top_srcdir)/tls/tls.sym
diff --git a/update.sh b/update.sh
index 9636ee7..e8b0566 100755
--- a/update.sh
+++ b/update.sh
@@ -1,4 +1,19 @@
 #!/bin/sh
+#
+# Copyright (c) 2014 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 set -e
 
 openbsd_branch=`cat OPENBSD_BRANCH`
@@ -83,8 +98,6 @@ if [ -x /opt/csw/bin/ggrep ]; then
         GREP='/opt/csw/bin/ggrep'
 fi
 
-$CP $libssl_src/LICENSE COPYING
-
 $CP $libcrypto_src/opensslfeatures.h include/openssl
 $CP $libssl_src/pqueue.h include
 
@@ -166,6 +179,11 @@ for i in `awk '/SOURCES|HEADERS/ { print $3 }' crypto/Makefile.am` ; do
         fi
 done
 
+for arch in amd64 i386; do
+        $CP $libcrypto_src/aes/aes_${arch}.c crypto/aes/
+        $CP $libcrypto_src/modes/gcm128_${arch}.c crypto/modes/
+done
+
 for i in $libcrypto_src/arch/*; do
         arch=`basename $i`
         mkdir -p include/arch/$arch
@@ -210,6 +228,7 @@ gen_asm_stdout() {
         EOF
         if [ $1 = "masm" ]; then
                 fixup_masm crypto/$3.tmp crypto/$3
+                rm crypto/$3.tmp
         else
                 $MV crypto/$3.tmp crypto/$3
         fi
@@ -238,6 +257,7 @@ gen_asm() {
         EOF
         if [ $1 = "masm" ]; then
                 fixup_masm crypto/$3.tmp crypto/$3
+                rm crypto/$3.tmp
         else
                 $MV crypto/$3.tmp crypto/$3
         fi
@@ -259,23 +279,10 @@ gen_asm_mips 64 sha sha1-mips   sha1-mips64
 gen_asm_mips 64 sha sha512-mips sha256-mips64
 gen_asm_mips 64 sha sha512-mips sha512-mips64
 
-echo generating arm ASM source for elf
-gen_asm_stdout elf aes/asm/aes-armv4.pl        aes/aes-elf-armv4.S
-gen_asm_stdout elf bn/asm/armv4-mont.pl        bn/mont-elf-armv4.S
-gen_asm_stdout elf sha/asm/sha1-armv4-large.pl sha/sha1-elf-armv4.S
-gen_asm_stdout elf sha/asm/sha256-armv4.pl     sha/sha256-elf-armv4.S
-gen_asm_stdout elf sha/asm/sha512-armv4.pl     sha/sha512-elf-armv4.S
-gen_asm_stdout elf modes/asm/ghash-armv4.pl    modes/ghash-elf-armv4.S
-$CP $libcrypto_src/arch/arm/armv4cpuid.S crypto
-$CP $libcrypto_src/arch/arm/armcap.c crypto
-$CP $libcrypto_src/arch/arm/arm_arch.h crypto
-
 for abi in elf macosx masm mingw64; do
         echo generating x86_64 ASM source for $abi
 
         gen_asm_stdout $abi aes/asm/aes-x86_64.pl        aes/aes-$abi-x86_64.S
-        gen_asm_stdout $abi aes/asm/vpaes-x86_64.pl      aes/vpaes-$abi-x86_64.S
-        gen_asm_stdout $abi aes/asm/bsaes-x86_64.pl      aes/bsaes-$abi-x86_64.S
         gen_asm_stdout $abi aes/asm/aesni-x86_64.pl      aes/aesni-$abi-x86_64.S
         gen_asm_stdout $abi bn/asm/modexp512-x86_64.pl   bn/modexp512-$abi-x86_64.S
         gen_asm_stdout $abi bn/asm/x86_64-mont.pl        bn/mont-$abi-x86_64.S
@@ -376,7 +383,6 @@ done
 $CP $libssl_regress/unit/tests.h tests
 $CP $libssl_regress/certs/*.pem tests
 $CP $libssl_regress/certs/*.crl tests
-$CP $libssl_regress/pqueue/expected.txt tests/pq_expected.txt
 
 # copy libtls tests
 for i in `find $libtls_regress -name '*.c'`; do