133 files changed, 3358 insertions, 1347 deletions

diff --git a/.github/workflows/android.yml b/.github/workflows/android.yml
index d095d6d..976f2d3 100644
--- a/.github/workflows/android.yml
+++ b/.github/workflows/android.yml
@@ -10,7 +10,7 @@ concurrency:
 jobs:
   test:
     name: "Test ${{ matrix.name }}"
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     permissions:
       contents: read
     strategy:
@@ -25,7 +25,7 @@ jobs:
             max-nal: 30
     steps:
       - name: "Checkout repository"
-        uses: actions/checkout@v4
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: "Run CI script"
         run: ./scripts/test
diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml
index 966d92a..eaa0681 100644
--- a/.github/workflows/cifuzz.yml
+++ b/.github/workflows/cifuzz.yml
@@ -9,7 +9,7 @@ concurrency:
 
 jobs:
   Fuzzing:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
     - name: Build Fuzzers
       id: build
@@ -26,7 +26,7 @@ jobs:
         dry-run: false
         language: c++
     - name: Upload Crash
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
       if: failure() && steps.build.outcome == 'success'
       with:
         name: artifacts
diff --git a/.github/workflows/cmake-config.yml b/.github/workflows/cmake-config.yml
new file mode 100644
index 0000000..0de7b4f
--- /dev/null
+++ b/.github/workflows/cmake-config.yml
@@ -0,0 +1,98 @@
+# GitHub Actions workflow to check CMake config.
+name: "CMake Check"
+
+on:
+  push: {}
+  pull_request: {}
+
+concurrency:
+  group: "${{ github.workflow }}-${{ github.event.number || github.ref }}"
+  cancel-in-progress: true
+
+jobs:
+  check:
+    name: "${{ matrix.os }}"
+    runs-on: "${{ matrix.os }}"
+    strategy:
+      fail-fast: true
+      matrix:
+        os: [ "windows-2022", "macos-14", "ubuntu-24.04" ]
+    defaults:
+      run:
+        shell: "bash"
+    permissions:
+      contents: read
+    steps:
+      - name: "Checkout repository"
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+
+      - name: "Setup Windows dependencies"
+        if: runner.os == 'Windows'
+        uses: msys2/setup-msys2@4f806de0a5a7294ffabaff804b38a9b435a73bda # v2.30.0
+        with:
+          update: true
+          install: >-
+            autoconf
+            automake
+            diffutils
+            libtool
+            gcc
+            git
+            patch
+            perl
+
+      - name: "Setup macOS dependencies"
+        if: runner.os == 'macOS'
+        run: brew install automake libtool
+
+      - name: "Prepare source tree for build (Windows)"
+        if: runner.os == 'Windows'
+        shell: "msys2 {0}"
+        run: ./autogen.sh
+
+      - name: "Prepare source tree for build (Unix)"
+        if: runner.os != 'Windows'
+        run: ./autogen.sh
+
+      - name: "Configure"
+        run: |
+          cmake -S . \
+            -B build \
+            -D CMAKE_BUILD_TYPE=Release \
+            -D CMAKE_INSTALL_PREFIX=$GITHUB_WORKSPACE/../local
+
+      - name: "Build"
+        run: cmake --build build --config Release --verbose
+
+      - name: "Install"
+        run: cmake --install build --config Release
+
+      - name: "Consume from the build directory - Configure"
+        run: |
+          cmake -S tests/cmake \
+            -B consumer-build \
+            -D CMAKE_BUILD_TYPE=Release \
+            -D LibreSSL_DIR=$GITHUB_WORKSPACE/build
+
+      - name: "Consume from the build directory - Build"
+        run: cmake --build consumer-build --config Release --verbose
+
+      - name: "Consume from the install directory (CMAKE_PREFIX_PATH) - Configure"
+        run: |
+          cmake -S tests/cmake \
+            -B consumer-install-prefix \
+            -D CMAKE_BUILD_TYPE=Release \
+            -D CMAKE_PREFIX_PATH=$GITHUB_WORKSPACE/../local
+
+      - name: "Consume from the install directory (CMAKE_PREFIX_PATH) - Build"
+        run: cmake --build consumer-install-prefix --config Release --verbose
+
+      - name: "Consume from the install directory (LibreSSL_DIR) - Configure"
+        run: |
+          cmake -S tests/cmake \
+            -B consumer-install-dir \
+            -D CMAKE_BUILD_TYPE=Release \
+            -D LibreSSL_DIR=$GITHUB_WORKSPACE/../local/lib/cmake/LibreSSL
+
+      - name: "Consume from the install directory (LibreSSL_DIR) - Build"
+        run: cmake --build consumer-install-dir --config Release --verbose
diff --git a/.github/workflows/cmake_config.yml b/.github/workflows/cmake_config.yml
deleted file mode 100644
index be9f114..0000000
--- a/.github/workflows/cmake_config.yml
+++ /dev/null
@@ -1,89 +0,0 @@
-name: cmake_config
-
-on: [push, pull_request]
-
-concurrency:
-  group: "${{ github.workflow }}-${{ github.event.number || github.ref }}"
-  cancel-in-progress: true
-
-jobs:
-  cmake-check:
-    defaults:
-      run:
-        shell: bash
-    strategy:
-      matrix:
-        os: [windows-latest, macos-latest, ubuntu-latest]
-    runs-on: ${{ matrix.os }}
-    continue-on-error: false
-    name: ${{ matrix.os }}
-    steps:
-      - name: Setup Windows dependencies
-        if: runner.os == 'Windows'
-        uses: msys2/setup-msys2@v2
-        with:
-          update: true
-          install: >-
-            autoconf
-            automake
-            diffutils
-            libtool
-            gcc
-            git
-            patch
-            perl
-
-      - name: Setup macOS dependencies
-        if: runner.os == 'macOS'
-        run: brew install automake libtool
-
-      - uses: actions/checkout@main
-
-      - name: Prepare source tree for build (Windows)
-        if: runner.os == 'Windows'
-        run: ./autogen.sh
-        shell: msys2 {0}
-
-      - name: Prepare source tree for build (Unix)
-        if: runner.os != 'Windows'
-        run: ./autogen.sh
-
-      - name: Configure
-        run: |
-          cmake -S . \
-                -B build \
-                -D CMAKE_BUILD_TYPE=Release \
-                -D CMAKE_INSTALL_PREFIX=$GITHUB_WORKSPACE/../local
-
-      - name: Build
-        run: cmake --build build --config Release --verbose
-
-      - name: Install
-        run: cmake --install build --config Release
-
-      - name: Consume from the build directory - Configure
-        run: |
-          cmake -S tests/cmake \
-                -B consumer-build \
-                -D CMAKE_BUILD_TYPE=Release \
-                -D LibreSSL_DIR=$GITHUB_WORKSPACE/build
-      - name: Consume from the build directory - Build
-        run: cmake --build consumer-build --config Release --verbose
-
-      - name: Consume from the install directory (CMAKE_PREFIX_PATH) - Configure
-        run: |
-          cmake -S tests/cmake \
-            -B consumer-install-prefix \
-            -D CMAKE_BUILD_TYPE=Release \
-            -D CMAKE_PREFIX_PATH=$GITHUB_WORKSPACE/../local
-      - name: Consume from the install directory (CMAKE_PREFIX_PATH) - Build
-        run: cmake --build consumer-install-prefix --config Release --verbose
-
-      - name: Consume from the install directory (LibreSSL_DIR) - Configure
-        run: |
-          cmake -S tests/cmake \
-                -B consumer-install-dir \
-                -D CMAKE_BUILD_TYPE=Release \
-                -D LibreSSL_DIR=$GITHUB_WORKSPACE/../local/lib/cmake/LibreSSL
-      - name: Consume from the install directory (LibreSSL_DIR) - Build
-        run: cmake --build consumer-install-dir --config Release --verbose
diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml
index 112678f..3cc0560 100644
--- a/.github/workflows/coverity.yml
+++ b/.github/workflows/coverity.yml
@@ -13,13 +13,13 @@ concurrency:
 jobs:
   scan:
     name: "Scan"
-    runs-on: "ubuntu-latest"
+    runs-on: "ubuntu-24.04"
     if: github.repository_owner == 'libressl' # Prevent running on forks
     permissions:
       contents: read
     steps:
       - name: "Checkout repository"
-        uses: actions/checkout@v4
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: "Install dependencies"
         run: |
@@ -31,7 +31,7 @@ jobs:
           PROJECT: "libressl-portable%2Fportable"
           COVERITY_SCAN_TOKEN: "${{ secrets.COVERITY_SCAN_TOKEN }}"
         run: |
-          wget -c -N https://scan.coverity.com/download/linux64 --post-data "token=$COVERITY_SCAN_TOKEN&project=$PROJECT" -O coverity_tool.tar.gz
+          wget -nv https://scan.coverity.com/download/linux64 --post-data "token=$COVERITY_SCAN_TOKEN&project=$PROJECT" -O coverity_tool.tar.gz
           mkdir coverity_tool
           tar xzf coverity_tool.tar.gz --strip 1 -C coverity_tool
 
diff --git a/.github/workflows/emscripten.yml b/.github/workflows/emscripten.yml
index 07f140d..2de51e0 100644
--- a/.github/workflows/emscripten.yml
+++ b/.github/workflows/emscripten.yml
@@ -14,16 +14,16 @@ concurrency:
 jobs:
   test:
     name: "Emscripten"
-    runs-on: "ubuntu-latest"
+    runs-on: "ubuntu-24.04"
     if: ${{ github.repository_owner == 'libressl' || github.event_name != 'schedule' }}
     permissions:
       contents: read
     steps:
       - name: "Checkout repository"
-        uses: actions/checkout@v4
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: "Setup emsdk"
-        uses: mymindstorm/setup-emsdk@v14
+        uses: mymindstorm/setup-emsdk@6ab9eb1bda2574c4ddb79809fc9247783eaf9021 # v14
         with:
           version: "3.1.60"
 
@@ -42,16 +42,16 @@ jobs:
   # Test ASAN with and without ASM enabled.
   test-asan:
     name: "ASAN (no-asm)"
-    runs-on: "ubuntu-latest"
+    runs-on: "ubuntu-24.04"
     if: ${{ github.repository_owner == 'libressl' || github.event_name != 'schedule' }}
     permissions:
       contents: read
     steps:
       - name: "Checkout repository"
-        uses: actions/checkout@v4
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: "Setup emsdk"
-        uses: mymindstorm/setup-emsdk@v14
+        uses: mymindstorm/setup-emsdk@6ab9eb1bda2574c4ddb79809fc9247783eaf9021 # v14
         with:
           version: "3.1.60"
 
diff --git a/.github/workflows/fedora-rawhide.yml b/.github/workflows/fedora-rawhide.yml
index ec3c63d..fbcf055 100644
--- a/.github/workflows/fedora-rawhide.yml
+++ b/.github/workflows/fedora-rawhide.yml
@@ -18,15 +18,15 @@ jobs:
       matrix:
         cc: [ gcc, clang ]
     name: ${{ matrix.cc }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     if: ${{ github.repository_owner == 'libressl' || github.event_name != 'schedule' }}
     container:
       image: fedora:rawhide
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
     - name: Install dependencies
       run: |
-        dnf -y install git make clang cmake ninja-build autoconf automake libtool diffutils patch
+        dnf -y install git make clang cmake ninja-build autoconf automake libtool diffutils patch gawk
     - name: Pull upstream source
       run: |
         ./update.sh
diff --git a/.github/workflows/freebsd.yml b/.github/workflows/freebsd.yml
new file mode 100644
index 0000000..fe6c258
--- /dev/null
+++ b/.github/workflows/freebsd.yml
@@ -0,0 +1,71 @@
+# GitHub Actions workflow to run tests on a FreeBSD VM.
+name: "FreeBSD"
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "0 0 * * *" # At 00:00 daily.
+
+concurrency:
+  group: "${{ github.workflow }}-${{ github.event.number || github.ref }}"
+  cancel-in-progress: true
+
+env:
+  FREEBSD_VERSION: "14.1"
+
+jobs:
+  autoconf:
+    name: "autoconf"
+    runs-on: ubuntu-24.04
+    if: github.repository_owner == 'libressl' || github.event_name != 'schedule'
+    permissions:
+      contents: read
+    steps:
+      - name: "Checkout repository"
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+
+      - name: "Setup"
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y automake autoconf libtool
+          ./autogen.sh
+
+      - name: "Build on VM"
+        uses: vmactions/freebsd-vm@670398e4236735b8b65805c3da44b7a511fb8b27 # v1.3.0
+        with:
+          release: "${{ env.FREEBSD_VERSION }}"
+          copyback: false
+          prepare: |
+            pkg install -y autoconf automake libtool
+          run: |
+            ./configure
+            make -j2 check || (cat tests/test-suite.log && exit 1)
+
+  cmake:
+    name: "cmake"
+    runs-on: ubuntu-24.04
+    if: github.repository_owner == 'libressl' || github.event_name != 'schedule'
+    permissions:
+      contents: read
+    steps:
+      - name: "Checkout repository"
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+
+      - name: "Setup"
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y automake autoconf libtool
+          ./autogen.sh
+
+      - name: "Build on VM"
+        uses: vmactions/freebsd-vm@670398e4236735b8b65805c3da44b7a511fb8b27 # v1.3.0
+        with:
+          release: "${{ env.FREEBSD_VERSION }}"
+          copyback: false
+          prepare: |
+            pkg install -y cmake ninja
+          run: |
+            export CTEST_OUTPUT_ON_FAILURE=1
+            cmake -G Ninja -B build
+            ninja -C build
+            ninja -C build test
diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml
index 5c85d4b..d901cf9 100644
--- a/.github/workflows/linux.yml
+++ b/.github/workflows/linux.yml
@@ -22,30 +22,40 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: ["ubuntu-20.04", "ubuntu-22.04", "ubuntu-24.04"]
+        os: ["ubuntu-22.04", "ubuntu-24.04"]
         arch: ["native", "arm32", "arm64", "mingw32", "mingw64", "mips32", "mips64"]
         compiler: ["gcc"]
         include:
-          - os: "ubuntu-20.04"
+          - os: "ubuntu-22.04"
             arch: "native"
             compiler: "clang"
-          - os: "ubuntu-22.04"
+          - os: "ubuntu-24.04"
+            arch: "native"
+            compiler: "clang"
+          - os: "ubuntu-24.04" # loong64
+            arch: "loong64"
+            compiler: "gcc"
+          - os: "ubuntu-24.04-arm"
+            arch: "native"
+            compiler: "gcc"
+          - os: "ubuntu-24.04-arm"
             arch: "native"
             compiler: "clang"
+
     steps:
       - name: "Checkout repository"
-        uses: actions/checkout@v4
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: "Run tests"
-        run: ./scripts/test
+        run: ./scripts/test || (status=$?; cat tests/test-suite.log; exit $status)
         env:
           ARCH: "${{ matrix.arch }}"
           CC: "${{ matrix.compiler }}"
 
   # Test ASAN with and without ASM enabled.
   test-asan:
-    name: "ASAN (${{ matrix.asm == 'ON' && 'asm' || 'no-asm' }})"
-    runs-on: "ubuntu-latest"
+    name: "${{ matrix.os }} - ASAN (${{ matrix.asm == 'ON' && 'asm' || 'no-asm' }})"
+    runs-on: "${{ matrix.os }}"
     if: ${{ github.repository_owner == 'libressl' || github.event_name != 'schedule' }}
     permissions:
       contents: read
@@ -53,9 +63,10 @@ jobs:
       fail-fast: false
       matrix:
         asm: [ON, OFF]
+        os: ["ubuntu-24.04", "ubuntu-24.04-arm"]
     steps:
       - name: "Checkout repository"
-        uses: actions/checkout@v4
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: "Run tests"
         run: ./scripts/test
diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml
index d5dd3eb..dad91e3 100644
--- a/.github/workflows/macos.yml
+++ b/.github/workflows/macos.yml
@@ -21,14 +21,14 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: ["macos-14", "macos-13", "macos-12"]
+        os: ["macos-15", "macos-14"]
         arch: ["arm64", "x86_64"]
     steps:
     - name: "Install required packages"
       run: brew install automake libtool
 
     - name: "Checkout repository"
-      uses: actions/checkout@v4
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
     - name: "Run tests"
       run: ./scripts/test
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c2e94b8..a20bf7d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -15,12 +15,12 @@ permissions:
 jobs:
   release:
     name: "Release"
-    runs-on: "ubuntu-latest"
+    runs-on: "ubuntu-24.04"
     outputs:
       upload_url: "${{ steps.create_release.outputs.upload_url }}"
     steps:
       - name: "Checkout repository"
-        uses: actions/checkout@v4
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: "Generate version changelog"
         run: .github/scripts/changelog.sh "$VERSION" > release-changelog.txt
@@ -29,7 +29,7 @@ jobs:
 
       - name: "Create GitHub release"
         id: create_release
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0
         with:
           body_path: "${{ github.workspace }}/release-changelog.txt"
 
@@ -43,10 +43,10 @@ jobs:
         arch: [ "Win32", "x64", "ARM64" ]
     steps:
       - name: "Checkout repository"
-        uses: actions/checkout@v4
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: "Setup MSYS2"
-        uses: msys2/setup-msys2@v2
+        uses: msys2/setup-msys2@4f806de0a5a7294ffabaff804b38a9b435a73bda # v2.30.0
         with:
           update: true
           install: >-
@@ -72,14 +72,10 @@ jobs:
         run: cmake --install build --config Release
 
       - shell: pwsh
-        run: Compress-Archive -Path local\* local.zip
+        run: Compress-Archive -Path local\* "libressl_${{ github.ref_name }}_windows_${{ matrix.arch }}.zip"
 
       - name: "Upload release artifact"
-        uses: actions/upload-release-asset@v1
-        env:
-          GITHUB_TOKEN: "${{ github.token }}"
+        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0
         with:
-          upload_url: "${{ needs.release.outputs.upload_url }}"
-          asset_path: "local.zip"
-          asset_name: "libressl_${{ github.ref_name }}_windows_${{ matrix.arch }}.zip"
-          asset_content_type: "application/zip"
+          files: |
+            libressl_${{ github.ref_name }}_windows_${{ matrix.arch }}.zip
diff --git a/.github/workflows/rust-openssl.yml b/.github/workflows/rust-openssl.yml
index b707c4b..ed77dbb 100644
--- a/.github/workflows/rust-openssl.yml
+++ b/.github/workflows/rust-openssl.yml
@@ -13,13 +13,13 @@ concurrency:
 jobs:
   test:
     name: "Test"
-    runs-on: "ubuntu-latest"
+    runs-on: "ubuntu-24.04"
     if: ${{ github.repository_owner == 'libressl' || github.event_name != 'schedule' }}
     permissions:
       contents: read
     steps:
       - name: "Checkout repository"
-        uses: actions/checkout@v4
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: "Build LibreSSL"
         run: |
diff --git a/.github/workflows/solaris.yml b/.github/workflows/solaris.yml
index f68a2aa..a4355d0 100644
--- a/.github/workflows/solaris.yml
+++ b/.github/workflows/solaris.yml
@@ -13,13 +13,13 @@ concurrency:
 jobs:
   test:
     name: "Solaris"
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     if: ${{ github.repository_owner == 'libressl' || github.event_name != 'schedule' }}
     permissions:
       contents: read
     steps:
       - name: "Checkout repository"
-        uses: actions/checkout@v4
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: "Setup"
         run: |
@@ -28,7 +28,7 @@ jobs:
           ./autogen.sh
 
       - name: "Build on VM"
-        uses: vmactions/solaris-vm@v1
+        uses: vmactions/solaris-vm@47bea106d03acaf91084e52548ee460556011602 # v1.1.8
         with:
           prepare: |
             pkg install gcc make
diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index 6aca153..3880a7b 100644
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -21,20 +21,21 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: ["windows-2022", "windows-2019"]
+        os: ["windows-2022", "windows-2025"]
         arch: ["ARM64", "x64", "Win32"]
         shared: ["ON", "OFF"]
         include:
           - os: "windows-2022"
             generator: "Visual Studio 17 2022"
-          - os: "windows-2019"
-            generator: "Visual Studio 16 2019"
+          - os: "windows-2025"
+            # XXX - use appropriate value
+            generator: "Visual Studio 17 2022"
     steps:
       - name: "Checkout repository"
-        uses: actions/checkout@v4
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: "Setup MSYS2"
-        uses: msys2/setup-msys2@v2
+        uses: msys2/setup-msys2@4f806de0a5a7294ffabaff804b38a9b435a73bda # v2.30.0
         with:
           update: true
           install: >-
@@ -50,7 +51,7 @@ jobs:
 
       - name: "Configure CMake"
         shell: cmd
-        run: cmake -Bbuild -G "${{ matrix.generator }}" -A ${{ matrix.arch }} DBUILD_SHARED_LIBS=${{ matrix.shared }} -DCMAKE_INSTALL_PREFIX=../local
+        run: cmake -Bbuild -G "${{ matrix.generator }}" -A ${{ matrix.arch }} -D BUILD_SHARED_LIBS=${{ matrix.shared }} -D CMAKE_INSTALL_PREFIX=../local
 
       - name: "Build"
         shell: cmd
@@ -63,7 +64,7 @@ jobs:
 
       - name: "Upload build artifacts"
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: "${{ matrix.os }}-${{ matrix.arch }}${{ matrix.shared == 'ON' && '-shared' || '' }}-build-results"
           path: "build"
diff --git a/.gitignore b/.gitignore
index 4f4cf89..5db07be 100644
--- a/.gitignore
+++ b/.gitignore
@@ -38,7 +38,8 @@ Makefile
 Makefile.in
 
 # CMake stuff
-build
+build*
+cmake-build-debug/
 
 # Libtool stuff
 .libs
@@ -86,6 +87,7 @@ tests/bn_add_sub*
 tests/bn_bits*
 tests/bn_cmp*
 tests/bn_convert*
+tests/bn_ffdh*
 tests/bn_gcd*
 tests/bn_isqrt*
 tests/bn_mod_exp*
@@ -107,17 +109,20 @@ tests/constraints*
 tests/crypto_test*
 tests/ctlog.conf
 tests/*.crt
+tests/ec_arithmetic*
 tests/ec_point_conversion*
 tests/ecc_cdh*
-tests/evp_pkey_check*
 tests/evp_pkey_cleanup*
 tests/explicit_bzero*
 tests/freenull*
 tests/gost2814789t*
 tests/key_schedule*
 tests/lhash_test*
+tests/mlkem*
 tests/mont*
+tests/parse*
 tests/policy*
+tests/renegotiation_test*
 tests/rfc3779*
 tests/rfc5280time*
 tests/ssl_get_shared_ciphers*
@@ -130,6 +135,7 @@ tests/tls_ext_alpn*
 tests/tls_prf*
 tests/*test
 tests/tests.h
+tests/test.h
 tests/*test.c
 tests/pbkdf2*
 tests/*.pem
@@ -141,6 +147,7 @@ tests/x509_algor*
 tests/x509_asn1*
 tests/x509_extensions_test*
 tests/x509_info*
+tests/x509_name_test*
 tests/x509attribute*
 tests/x509name*
 tests/x509req_ext*
@@ -149,7 +156,7 @@ tests/x509req_ext*
 tests/client.c
 tests/init_pledge.c
 tests/server.c
-tests/util.c
+tests/*util.c
 tests/valid_handshakes_terminate*
 tests/handshake_table*
 
@@ -169,7 +176,6 @@ autom4te.cache
 
 # Libtool adds these, at least sometimes
 INSTALL
-/COPYING
 !m4/check*.m4
 m4/l*
 
@@ -200,6 +206,7 @@ ssl/VERSION
 tls/VERSION
 libtls-standalone/VERSION
 
+crypto/*.mk
 ssl/hidden
 ssl/*.c
 ssl/*.h
@@ -233,29 +240,89 @@ include/openssl/*.h
 !/apps/openssl/apps_win.c
 !/apps/openssl/certhash_win.c
 
-/crypto/*
-!/crypto/Makefile.am.*
-!/crypto/compat/arc4random.h
-!/crypto/compat/b_win.c
-!/crypto/compat/explicit_bzero_win.c
-!/crypto/compat/freezero.c
-!/crypto/compat/getpagesize.c
-!/crypto/compat/posix_win.c
-!/crypto/compat/bsd_asprintf.c
-!/crypto/compat/ui_openssl_win.c
-!/crypto/compat/crypto_lock_win.c
-!/crypto/CMakeLists.txt
-
-!/libtls-standalone/compat/Makefile.am
-/libtls-standalone/include/*.h
-/libtls-standalone/src/*.c
-/libtls-standalone/src/*.h
-/libtls-standalone/src
-/libtls-standalone/tests/test
-/libtls-standalone/compat
-/libtls-standalone/VERSION
-/libtls-standalone/m4
-/libtls-standalone/man
+/crypto/*.c
+/crypto/*.h
+/crypto/aes/
+/crypto/arch/aarch64/crypto_arch.h
+/crypto/arch/aarch64/crypto_cpu_caps.c
+/crypto/arch/alpha/
+/crypto/arch/amd64/
+/crypto/arch/arm/
+/crypto/arch/hppa/
+/crypto/arch/i386/
+/crypto/arch/m88k/
+/crypto/arch/mips64/
+/crypto/arch/powerpc/
+/crypto/arch/powerpc64/
+/crypto/arch/riscv64/
+/crypto/arch/sh/
+/crypto/arch/sparc64/
+/crypto/asn1/
+/crypto/bf/
+/crypto/bio/
+/crypto/bn/*.c
+/crypto/bn/*.h
+/crypto/bn/arch/aarch64/
+/crypto/bn/arch/alpha/
+/crypto/bn/arch/amd64/
+/crypto/bn/arch/arm/
+/crypto/bn/arch/hppa/
+/crypto/bn/arch/i386/
+/crypto/bn/arch/m88k/
+/crypto/bn/arch/mips64/
+/crypto/bn/arch/powerpc/
+/crypto/bn/arch/powerpc64/
+/crypto/bn/arch/riscv64/
+/crypto/bn/arch/sh/
+/crypto/bn/arch/sparc64/
+/crypto/buffer/
+/crypto/bytestring/
+/crypto/camellia/
+/crypto/cast/
+/crypto/chacha/
+/crypto/cmac/
+/crypto/cms/
+/crypto/conf/
+/crypto/ct/
+/crypto/curve25519/
+/crypto/des/
+/crypto/dh/
+/crypto/dsa/
+/crypto/ec/
+/crypto/ecdh/
+/crypto/ecdsa/
+/crypto/engine/
+/crypto/err/
+/crypto/evp/
+/crypto/hidden/
+/crypto/hkdf/
+/crypto/hmac/
+/crypto/idea/
+/crypto/kdf/
+/crypto/lhash/
+/crypto/md4/
+/crypto/md5/
+/crypto/mlkem/
+/crypto/modes/
+/crypto/objects/
+/crypto/ocsp/
+/crypto/pem/
+/crypto/pkcs12/
+/crypto/pkcs7/
+/crypto/poly1305/
+/crypto/rand/
+/crypto/rc2/
+/crypto/rc4/
+/crypto/ripemd/
+/crypto/rsa/
+/crypto/sha/
+/crypto/sm3/
+/crypto/sm4/
+/crypto/stack/
+/crypto/ts/
+/crypto/txt_db/
+/crypto/ui/
+/crypto/x509/
 
 openbsd/
 
diff --git a/CMakeLists.txt b/CMakeLists.txt
index c496ad9..7ab04ab 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -1,9 +1,25 @@
+#
+# Copyright (c) 2014 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 cmake_minimum_required (VERSION 3.16.4)
+
 if(MSVC)
         cmake_policy(SET CMP0091 NEW)
 endif()
 
-project (LibreSSL C ASM)
+project(LibreSSL LANGUAGES C ASM)
 
 include(CheckFunctionExists)
 include(CheckSymbolExists)
@@ -72,10 +88,6 @@ endforeach()
 
 set(BUILD_NC true)
 
-if(CMAKE_SYSTEM_NAME MATCHES "Darwin")
-        add_definitions(-fno-common)
-endif()
-
 if(CMAKE_SYSTEM_NAME MATCHES "OpenBSD")
         add_definitions(-DHAVE_ATTRIBUTE__BOUNDED__)
         add_definitions(-DHAVE_ATTRIBUTE__DEAD__)
@@ -89,6 +101,10 @@ if(CMAKE_SYSTEM_NAME MATCHES "Linux")
         set(PLATFORM_LIBS ${PLATFORM_LIBS} pthread)
 endif()
 
+if(CMAKE_SYSTEM_NAME MATCHES "FreeBSD")
+        set(PLATFORM_LIBS ${PLATFORM_LIBS} pthread)
+endif()
+
 if(WIN32)
         set(BUILD_NC false)
         if(MINGW)
@@ -127,7 +143,7 @@ add_definitions(-D__END_HIDDEN_DECLS=)
 set(CMAKE_POSITION_INDEPENDENT_CODE true)
 
 if (CMAKE_COMPILER_IS_GNUCC OR CMAKE_C_COMPILER_ID MATCHES "Clang")
-        add_definitions(-Wno-pointer-sign)
+        add_compile_options($<$<COMPILE_LANGUAGE:C>:-Wno-pointer-sign>)
 endif()
 
 if(WIN32)
@@ -158,17 +174,21 @@ if(MSVC)
                 set(MSVC_DISABLED_WARNINGS_LIST
                         "C4018" # 'expression' : signed/unsigned mismatch
                         "C4057" # 'operator' : 'identifier1' indirection to
-                                # slightly different base types from 'identifier2'
+                                # slightly different base types from 'identifier2'
                         "C4100" # 'identifier' : unreferenced formal parameter
                         "C4127" # conditional expression is constant
+                        "C4132" # 'object' : const object should be initialized
                         "C4146" # unary minus operator applied to unsigned type,
                                 # result still unsigned
+                        "C4206" # nonstandard extension used : translation unit is empty
                         "C4244" # 'argument' : conversion from 'type1' to 'type2',
                                 # possible loss of data
                         "C4245" # 'conversion' : conversion from 'type1' to 'type2',
                                 # signed/unsigned mismatch
                         "C4267" # 'var' : conversion from 'size_t' to 'type',
                                 # possible loss of data
+                        "C4295" # 'array' : array is too small to include a terminating
+                                # null character
                         "C4389" # 'operator' : signed/unsigned mismatch
                         "C4706" # assignment within conditional expression
                         "C4996" # The POSIX name for this item is deprecated.
@@ -200,21 +220,38 @@ else()
         set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wall")
 endif()
 
+# XXX - needs _GNU_SOURCE on linux
 check_function_exists(asprintf HAVE_ASPRINTF)
 if(HAVE_ASPRINTF)
         add_definitions(-DHAVE_ASPRINTF)
 endif()
 
-check_function_exists(getopt HAVE_GETOPT)
+check_symbol_exists(ftruncate "unistd.h" HAVE_FTRUNCATE)
+if(HAVE_FTRUNCATE)
+        add_definitions(-DHAVE_FTRUNCATE)
+endif()
+
+check_symbol_exists(getdelim "stdio.h" HAVE_GETDELIM)
+if(HAVE_GETDELIM)
+        add_definitions(-DHAVE_GETDELIM)
+endif()
+
+check_symbol_exists(getline "stdio.h" HAVE_GETLINE)
+if(HAVE_GETLINE)
+        add_definitions(-DHAVE_GETLINE)
+endif()
+
+check_symbol_exists(getopt "unistd.h" HAVE_GETOPT)
 if(HAVE_GETOPT)
         add_definitions(-DHAVE_GETOPT)
 endif()
 
-check_function_exists(reallocarray HAVE_REALLOCARRAY)
+check_symbol_exists(reallocarray "stdlib.h" HAVE_REALLOCARRAY)
 if(HAVE_REALLOCARRAY)
         add_definitions(-DHAVE_REALLOCARRAY)
 endif()
 
+# XXX strcasecmp() is in strings.h which isn't available everywhere
 check_function_exists(strcasecmp HAVE_STRCASECMP)
 if(HAVE_STRCASECMP)
         add_definitions(-DHAVE_STRCASECMP)
@@ -222,18 +259,18 @@ endif()
 
 # Emscripten's strlcat and strlcpy triggers ASAN errors
 if(NOT EMSCRIPTEN)
-        check_function_exists(strlcat HAVE_STRLCAT)
+        check_symbol_exists(strlcat "string.h" HAVE_STRLCAT)
         if(HAVE_STRLCAT)
                 add_definitions(-DHAVE_STRLCAT)
         endif()
 
-        check_function_exists(strlcpy HAVE_STRLCPY)
+        check_symbol_exists(strlcpy "string.h" HAVE_STRLCPY)
         if(HAVE_STRLCPY)
                 add_definitions(-DHAVE_STRLCPY)
         endif()
 endif()
 
-check_function_exists(strndup HAVE_STRNDUP)
+check_symbol_exists(strndup "string.h" HAVE_STRNDUP)
 if(HAVE_STRNDUP)
         add_definitions(-DHAVE_STRNDUP)
 endif()
@@ -242,62 +279,64 @@ if(WIN32)
         set(HAVE_STRNLEN true)
         add_definitions(-DHAVE_STRNLEN)
 else()
-        check_function_exists(strnlen HAVE_STRNLEN)
+        check_symbol_exists(strnlen "string.h" HAVE_STRNLEN)
         if(HAVE_STRNLEN)
                 add_definitions(-DHAVE_STRNLEN)
         endif()
 endif()
 
-check_function_exists(strsep HAVE_STRSEP)
+check_symbol_exists(strsep "string.h" HAVE_STRSEP)
 if(HAVE_STRSEP)
         add_definitions(-DHAVE_STRSEP)
 endif()
 
-check_function_exists(strtonum HAVE_STRTONUM)
+check_symbol_exists(strtonum "stdlib.h" HAVE_STRTONUM)
 if(HAVE_STRTONUM)
         add_definitions(-DHAVE_STRTONUM)
 endif()
 
-check_function_exists(arc4random_buf HAVE_ARC4RANDOM_BUF)
+check_symbol_exists(arc4random_buf "stdlib.h" HAVE_ARC4RANDOM_BUF)
 if(HAVE_ARC4RANDOM_BUF)
         add_definitions(-DHAVE_ARC4RANDOM_BUF)
 endif()
 
-check_function_exists(arc4random_uniform HAVE_ARC4RANDOM_UNIFORM)
+check_symbol_exists(arc4random_uniform "stdlib.h" HAVE_ARC4RANDOM_UNIFORM)
 if(HAVE_ARC4RANDOM_UNIFORM)
         add_definitions(-DHAVE_ARC4RANDOM_UNIFORM)
 endif()
 
-check_function_exists(explicit_bzero HAVE_EXPLICIT_BZERO)
+check_symbol_exists(explicit_bzero "string.h" HAVE_EXPLICIT_BZERO)
 if(HAVE_EXPLICIT_BZERO)
         add_definitions(-DHAVE_EXPLICIT_BZERO)
 endif()
 
-check_function_exists(getauxval HAVE_GETAUXVAL)
+check_symbol_exists(getauxval "sys/auxv.h" HAVE_GETAUXVAL)
 if(HAVE_GETAUXVAL)
         add_definitions(-DHAVE_GETAUXVAL)
 endif()
 
+# XXX macos fails to find getentropy with check_symbol_exists()
 check_function_exists(getentropy HAVE_GETENTROPY)
 if(HAVE_GETENTROPY)
         add_definitions(-DHAVE_GETENTROPY)
 endif()
 
-check_symbol_exists(getpagesize unistd.h HAVE_GETPAGESIZE)
+check_symbol_exists(getpagesize "unistd.h" HAVE_GETPAGESIZE)
 if(HAVE_GETPAGESIZE)
         add_definitions(-DHAVE_GETPAGESIZE)
 endif()
 
-check_function_exists(getprogname HAVE_GETPROGNAME)
+check_symbol_exists(getprogname "stdlib.h" HAVE_GETPROGNAME)
 if(HAVE_GETPROGNAME)
         add_definitions(-DHAVE_GETPROGNAME)
 endif()
 
-check_function_exists(syslog_r HAVE_SYSLOG_R)
+check_symbol_exists(syslog_r "syslog.h;stdarg.h" HAVE_SYSLOG_R)
 if(HAVE_SYSLOG_R)
         add_definitions(-DHAVE_SYSLOG_R)
 endif()
 
+# XXX - needs _GNU_SOURCE on linux
 check_function_exists(syslog HAVE_SYSLOG)
 if(HAVE_SYSLOG)
         add_definitions(-DHAVE_SYSLOG)
@@ -308,16 +347,17 @@ if(HAVE_TIMESPECSUB)
         add_definitions(-DHAVE_TIMESPECSUB)
 endif()
 
-check_function_exists(timingsafe_bcmp HAVE_TIMINGSAFE_BCMP)
+check_symbol_exists(timingsafe_bcmp "string.h" HAVE_TIMINGSAFE_BCMP)
 if(HAVE_TIMINGSAFE_BCMP)
         add_definitions(-DHAVE_TIMINGSAFE_BCMP)
 endif()
 
-check_function_exists(timingsafe_memcmp HAVE_TIMINGSAFE_MEMCMP)
+check_symbol_exists(timingsafe_memcmp "string.h" HAVE_TIMINGSAFE_MEMCMP)
 if(HAVE_TIMINGSAFE_MEMCMP)
         add_definitions(-DHAVE_TIMINGSAFE_MEMCMP)
 endif()
 
+# XXX - needs _GNU_SOURCE on linux
 check_function_exists(memmem HAVE_MEMMEM)
 if(HAVE_MEMMEM)
         add_definitions(-DHAVE_MEMMEM)
@@ -343,6 +383,16 @@ if(HAVE_NETINET_IP_H)
         add_definitions(-DHAVE_NETINET_IP_H)
 endif()
 
+check_include_files(resolv.h HAVE_RESOLV_H)
+if(HAVE_RESOLV_H)
+        add_definitions(-DHAVE_RESOLV_H)
+endif()
+
+check_include_files(arpa/nameser.h HAVE_ARPA_NAMESER_H)
+if(HAVE_ARPA_NAMESER_H)
+        add_definitions(-DHAVE_ARPA_NAMESER_H)
+endif()
+
 # This isn't ready for universal binaries yet, since we do conditional
 # compilation based on the architecture, but this makes cross compiling for a
 # single architecture work on macOS at least.
@@ -352,20 +402,30 @@ if(APPLE AND (NOT CMAKE_OSX_ARCHITECTURES STREQUAL ""))
         set(CMAKE_SYSTEM_PROCESSOR "${CMAKE_OSX_ARCHITECTURES}")
 endif()
 
+# CMAKE_SYSTEM_PROCESSOR is not consistently set to the target architecture.
+# https://cmake.org/cmake/help/latest/variable/CMAKE_SYSTEM_PROCESSOR.html
+if (WIN32 AND (NOT CMAKE_GENERATOR_PLATFORM STREQUAL ""))
+        message("CMAKE_SYSTEM_PROCESSOR: ${CMAKE_SYSTEM_PROCESSOR}")
+        message("CMAKE_GENERATOR_PLATFORM: ${CMAKE_GENERATOR_PLATFORM}")
+        set(CMAKE_SYSTEM_PROCESSOR "${CMAKE_GENERATOR_PLATFORM}")
+endif()
+
 if(CMAKE_SYSTEM_PROCESSOR MATCHES "(aarch64|arm64|ARM64)")
         set(HOST_AARCH64 true)
-        if(WIN32)
-                set(ENABLE_ASM false)
-        endif()
 elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "arm")
         set(HOST_ARM true)
+        if(APPLE)
+                set(ENABLE_ASM false)
+        endif()
 elseif(CMAKE_SYSTEM_NAME STREQUAL "SunOS" AND CMAKE_SYSTEM_PROCESSOR MATCHES "i386")
         set(HOST_X86_64 true)
-elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "(x86_64|amd64|AMD64)")
+elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "(x86_64|x64|amd64|AMD64)")
         set(HOST_X86_64 true)
-elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "(i[3-6]86|[xX]86)")
+elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "(i[3-6]86|[xX]86|Win32)")
         set(ENABLE_ASM false)
         set(HOST_I386 true)
+elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "loongarch64")
+        set(HOST_LOONGARCH64 true)
 elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "mips64")
         set(HOST_MIPS64 true)
 elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "mips")
@@ -373,7 +433,7 @@ elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "mips")
 elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "powerpc")
         set(HOST_POWERPC true)
 elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "ppc64")
-        set(HOST_PPC64 true)
+        set(HOST_POWERPC64 true)
 elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "riscv64")
         set(HOST_RISCV64 true)
 elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "sparc64")
@@ -384,21 +444,18 @@ endif()
 
 if(ENABLE_ASM)
         if(CMAKE_C_COMPILER_ABI STREQUAL "ELF")
-                if(CMAKE_SYSTEM_PROCESSOR MATCHES "(x86_64|amd64)")
+                if(HOST_X86_64)
                         set(HOST_ASM_ELF_X86_64 true)
-                elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "arm" AND
-                       NOT CMAKE_SYSTEM_PROCESSOR MATCHES "arm64")
-                        set(HOST_ASM_ELF_ARMV4 true)
-                elseif(CMAKE_SYSTEM_NAME STREQUAL "SunOS" AND CMAKE_SYSTEM_PROCESSOR MATCHES "i386")
+                elseif(CMAKE_SYSTEM_NAME STREQUAL "SunOS" AND HOST_I386)
                         set(HOST_ASM_ELF_X86_64 true)
                 endif()
                 add_definitions(-DHAVE_GNU_STACK)
-        elseif(APPLE AND CMAKE_SYSTEM_PROCESSOR MATCHES "x86_64")
+        elseif(APPLE AND HOST_X86_64)
                 set(HOST_ASM_MACOSX_X86_64 true)
         elseif(MSVC AND (CMAKE_GENERATOR MATCHES "Win64" OR CMAKE_GENERATOR_PLATFORM STREQUAL "x64"))
                 set(HOST_ASM_MASM_X86_64 true)
                 ENABLE_LANGUAGE(ASM_MASM)
-        elseif(MINGW AND CMAKE_SYSTEM_PROCESSOR MATCHES "x86_64")
+        elseif(MINGW AND HOST_X86_64)
                 set(HOST_ASM_MINGW64_X86_64 true)
         endif()
 endif()
@@ -441,10 +498,10 @@ if(OPENSSLDIR STREQUAL "")
         if(WIN32)
                 set(OPENSSLDIR "C:/Windows/libressl/ssl")
         else()
-                set(OPENSSLDIR "${CMAKE_INSTALL_PREFIX}/etc/ssl")
+                set(OPENSSLDIR "${CMAKE_INSTALL_SYSCONFDIR}/ssl")
         endif()
 
-        set(CONF_DIR "${CMAKE_INSTALL_PREFIX}/etc/ssl")
+        set(CONF_DIR "${CMAKE_INSTALL_SYSCONFDIR}/ssl")
 else()
         set(CONF_DIR "${OPENSSLDIR}")
 endif()
@@ -512,8 +569,16 @@ if(ENABLE_LIBRESSL_INSTALL)
                 # Create pkgconfig files.
                 set(prefix      ${CMAKE_INSTALL_PREFIX})
                 set(exec_prefix \${prefix})
-                set(libdir      \${exec_prefix}/${CMAKE_INSTALL_LIBDIR})
-                set(includedir  \${prefix}/include)
+                if(IS_ABSOLUTE ${CMAKE_INSTALL_LIBDIR})
+                        set(libdir      ${CMAKE_INSTALL_LIBDIR})
+                else()
+                        set(libdir      \${exec_prefix}/${CMAKE_INSTALL_LIBDIR})
+                endif()
+                if(IS_ABSOLUTE ${CMAKE_INSTALL_INCLUDEDIR})
+                        set(includedir  ${CMAKE_INSTALL_INCLUDEDIR})
+                else()
+                        set(includedir  \${prefix}/${CMAKE_INSTALL_INCLUDEDIR})
+                endif()
                 if(PLATFORM_LIBS)
                         string(REGEX REPLACE ";" " -l" PLATFORM_LDADD ";${PLATFORM_LIBS}")
                 endif()
diff --git a/COPYING b/COPYING
new file mode 100644
index 0000000..c41ff4d
--- /dev/null
+++ b/COPYING
@@ -0,0 +1,133 @@
+
+  LibreSSL files are retained under the copyright of the authors. New
+  additions are ISC licensed as per OpenBSD's normal licensing policy,
+  or are placed in the public domain.
+
+  The OpenSSL code is distributed under the terms of the original OpenSSL
+  licenses which follow:
+
+  LICENSE ISSUES
+  ==============
+
+  The OpenSSL toolkit stays under a dual license, i.e. both the conditions of
+  the OpenSSL License and the original SSLeay license apply to the toolkit.
+  See below for the actual license texts.  In case of any license issues
+  related to OpenSSL please contact openssl-core@openssl.org.
+
+  OpenSSL License
+  ---------------
+
+/* ====================================================================
+ * Copyright (c) 1998-2011 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+ Original SSLeay License
+ -----------------------
+
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ *
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ *
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+
diff --git a/ChangeLog b/ChangeLog
index c03ff15..cf77c2a 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,7 +1,7 @@
 Because this project is maintained both in the OpenBSD tree using CVS and in
 Git, it can be confusing following all of the changes.
 
-Most of the libssl and libcrypto source code is is here in OpenBSD CVS:
+Most of the libssl and libcrypto source code is here in OpenBSD CVS:
 
         https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/lib/libssl/
 
@@ -28,12 +28,181 @@ history is also available from Git.
 
 LibreSSL Portable Release Notes:
 
-4.0.0 - In development
+4.3.0 - In development
+
+        * Internal improvements
+          - Remove the unused sequence number from X509_REVOKED.
+          - Replace a call to atoi() with strtonum() in nc(1) and replace a
+            misleading use of ntohs() with htons().
+        * Compatibility changes
+          - Expose X509_VERIFY_PARAM_set_hostflags() as a public symbol.
+          - Provide SSL_SESSION_dup().
+        * New features: support for MLKEM768_X25519 keyshare in TLS.
+          https://datatracker.ietf.org/doc/draft-ietf-tls-ecdhe-mlkem/
+        * Bug fixes
+          - Ensure the group selected by a TLSv1.3 server for a
+            HelloRetryRequest is not one for which the client has
+            already sent a key share.
+
+4.2.0 - Stable release
+
+        * Portable changes
+          - Added explicit OpenBSD/ISC license to build system / scripts.
+          - Fixed compilation on more CPU targets by removing architecture-specific
+            definitions from header files.
+          - Fixed builds in deep paths by using relative paths for linking.
+          - Fixed Windows builds with Clang and CMake.
+          - Fixed Windows error handling accepting connections with nc.
+          - Fixed 32-bit ARM builds on Darwin.
+        * Internal improvements
+          - Cleaned up code implementing block cipher modes of operation.
+            Includes untangling a horrible #ifdef mess and removing a few
+            instances of undefined behavior.
+          - Removed assembly implementations of AES using bit slicing (BS-AES)
+            and vector permutation (VP-AES).
+          - Removed OPENSSL_SMALL_FOOTPRINT and OPENSSL_FIPSAPI.
+          - Implemented constant time EC field element operations to allow
+            elliptic curve operations without bignum arithmetic.
+          - Implemented an EC method using homogeneous projective coordinates.
+            This will allow exception-free elliptic curve arithmetic in
+            constant time in future releases.
+          - Started cleaning up the openssl speed implementation.
+          - The last SIGILL-based CPU capability detection was removed.
+            Instead, capabilities are now detected using a constructor on
+            library load, which improves the incomplete coverage by calls
+            to OPENSSL_init_crypto() on various entry points.
+          - Rework and simplify AES handling in EVP. In particular, AES-NI
+            is now handled in the AES internal code and no longer requires
+            the use of EVP.
+          - Added a public API for ML-KEM. This is not yet documented in a
+            manpage and may not be in its final form. This will be used to
+            support X25519MLKEM768 in libssl.
+        * Compatibility changes
+          - Removed the -msie_hack option from the openssl(1) ca subcommand.
+          - Removed parameters of the 239-bit prime curves from X9.62, H.5.2:
+            prime239v1, prime239v2, prime239v3.
+          - Increased default MAC salt length used by PKCS12_set_mac(3) to 16 
+            per recommendation of NIST SP 800-132.
+          - Encrypted PKCS#8 key files now use a default password-based key
+            derivation function that is acceptable in the present millenium.
+          - const corrected EVP_PKEY_get{0,1}_{DH,DSA,EC_KEY,RSA}().
+          - X509_CRL_verify() now checks that the AlgorithmIdentifiers in the
+            signature and the tbsCertList are identical.
+          - Of the old *err() only PEMerr(), RSAerr(), and SSLerr() remain.
+          - Removed BIO_s_log(), X509_PKEY_{new,free}(), PEM_X509_INFO_read()
+            and PEM_X509_INFO_write_bio().
+          - Re-expose the ASN.1 Boolean template items.
+          - opensslconf.h is now machine-independent.
+        * New features
+          - Allow specifying ALPN in nc(1) via -Talpn="http/1.1,http:/1.0".
+        * Bug fixes
+          - Avoid pointer arithmetic on NULL for memory BIOs.
+          - Fix leaks and use-after-frees in PKCS7 attribute handling.
+          - Ensure p and q in RSA private key have a minimum distance of
+            2^(bits/2 - 100) as specified in NIST SP 800-56B Revision 2.
+        * Security fixes
+          - Fix out-of-bounds read and write, memory leaks and incorrect
+            error check for CMS enveloped data.
+        * Documentation
+          - Rewrote most of the EC documentation from scratch to be at least
+            somewhat accurate and intelligible.
+          - Updated documentation for SMIME_{read,write}* to match reality.
+        * Testing and proactive security
+          - Added a testing framework that will help deduplicating lots of
+            ad-hoc code in the regression tests.
+          - Converted the Wycheproof testing framework to use testvectors_v1.
+            This in combination with a few new tests significantly increases
+            regress coverage.
+
+4.1.0 - Stable release
 
         * Portable changes
-          - Added initial Emscripten support in CMake builds
+          - Added initial experimental support for loongarch64.
+          - Fixed compilation for mips32 and reenable CI.
+          - Fixed CMake builds on FreeBSD.
+          - Fixed the --prefix option for cmake --install.
+          - Fixed tests for MinGW due to missing sh(1).
+        * Internal improvements
+          - Cleaned up the error implementation.
+          - Many bug fixes and simplifications in the EC ASN.1 code.
+          - Corrected DER encoding for EC keys and parameters.
+          - Polished EC_POINT_{oct2point,point2oct}() internals.
+          - Rewrote the wNAF code for fast ECDSA verification.
+          - Improved the code setting compressed coordinates for EC points.
+          - Reworked CPU capabilities detection for amd64 and aarch64.
+          - New SHA-1, SHA-256 and SHA-512 assembly implementations for amd64.
+            These make use of the SHA-NI instruction if it is available and
+            replace the perl-generated assembly optimized for museum pieces.
+            These are not yet enabled in libressl-portable.
+          - New SHA-256 and SHA-512 assembly implementations for aarch64
+            making use of the ARM Cryptographic Extension (CE). Not yet
+            enabled in libressl-portable.
+          - New simplified, readable MD5 implementation for amd64.
+          - Rewrote BN_bn2binpad() and its lebin siblings.
+          - The BIGNUMs in EC_GROUP and EC_POINT are now heap allocated.
+          - Rewrote TS_ASN1_INTEGER_print_bio().
+          - Improved bit counter handling in MD5.
+          - Simplified and cleaned up the BN_RECP_CTX internals.
+          - Improved SM4 to match other symmetric ciphers more closely.
+          - Rewrote X509_NAME_oneline() and X509_NAME_print() using CBS/CBB.
+          - CRLs are now cached in the issuer cache like certificates.
+          - Replaced combinations of BN_MONT_CTX_new/set with an internal
+            BN_MONT_CTX_create().
+          - Replaced BN_bn2hex() reimplementation in openssl(1) ca with
+            a proper API call.
+          - Fixed integer overflows due to signed shift in obj_dat.c.
+          - Improved some X509_VERIFY_PARAM internals and avoid an out of
+            bounds read from public API.
+          - Imported ML-KEM 768 and 1024 from BoringSSL (not yet public API).
+        * Compatibility changes
+          - Added an OPENSSL_INIT_NO_ATEXIT flag for OPENSSL_init_crypto().
+            It has no effect since LibreSSL doesn't call atexit().
+          - Elliptic curve parameters are only accepted if they encode a
+            built-in curve.
+          - EC_METHOD is no longer public and the API exposing it has been
+            removed. This includes EC_GROUP_new(), EC_GFp_mont_method(),
+            EC_GROUP_method_of() and EC_METHOD_get_field_type().
+          - The precomputation stubs for EC_GROUP were removed.
+          - The API setting Jacobian projective coordinates for a point was
+            removed as were EC_POINTs_{mul,make_affine}().
+          - All elliptic curves over fields with less than 224 bits and a
+            few more were removed from the built-in curves. This includes
+            all WTLS curves and P-192.
+          - It is no longer necessary to set RSA_FLAG_SIGN_VER to use the
+            sign and verify handlers set with RSA_meth_set_{sign,verify}.
+          - Removed the -C option to generate "C code" from the openssl(1)
+            dh, dhparam, dsaparam, ecparam, and x509 subcommands.
+          - Removed #error in headers when OPENSSL_NO_* is defined.
+          - CRYPTO_set_mem_functions() now matches OpenSSL 1.1 and
+            CRYPTO_set_mem_ex_functions() was removed.
+          - The tls_session_secret_cb_fn type now matches OpenSSL 1.1.
+          - Unexport X509_NAME_print() and X509_OBJECT_up_ref_count().
+          - const corrected UI_OpenSSL() and BN_MONT_CTX_copy().
+          - Support OPENSSL_NO_FILENAMES.
+          - Support SSL_OP_NO_RENEGOTIATION and SSL_OP_ALLOW_CLIENT_RENEGOTIATION.
+          - Export PKCS12_key_gen_uni() again.
+        * New features
+          - libtls has a new tls_peer_cert_common_name() API call to retrieve
+            the peer's common name without having to inspect the PEM.
+        * Bug fixes
+          - Plugged a leak in eckey_compute_pubkey().
+          - Again allow the magic values -1, -2 and -3 for the salt length
+            of an RSA-PSS key in the EVP_PKEY_CTX_ctrl_str() interface.
+          - Fixed a few memory leaks in legacy code.
+        * Documentation
+          - The remaining undocumented public EVP API is now documented.
+          - Reorganization of existing documentation for clarity and accuracy.
+        * Testing and proactive security
+          - Improved regress coverage of the EC code.
+
+4.0.0 - Stable release
+
+        * Portable changes
+          - Added initial Emscripten support in CMake builds.
           - Removed timegm() compatibility layer since all uses were replaced
             with OPENSSL_timegm(). Cleaned up the corresponding test harness.
+          - The mips32 platform is no longer actively supported.
+          - Fixed Windows support for dates beyond 2038.
         * Internal improvements
           - Cleaned up parts of the conf directory. Simplified some logic,
             fixed memory leaks.
@@ -66,29 +235,68 @@ LibreSSL Portable Release Notes:
           - Made most error string tables const.
           - Removed handling for SSLv2 client hello messages.
           - Improvements in the openssl(1) speed app's signal handler.
-          - Added support for TLS PRF in the EVP KDF API.
+          - Cleaned up various X509v3_* extension API.
+          - Unified the X.509v3 extension methods.
+          - Cleaned up cipher handling in SSL_SESSION.
+          - Removed get_cipher from SSL_METHOD.
+          - Rewrote CRYPTO_EX_DATA from scratch. The only intentional change of
+            behavior is that there is now a hard limit on the number of indexes
+            that can be allocated.
+          - Removed bogus connect() call from netcat.
+          - Uses of atoi() and strtol() in libcrypto were replaced with
+            strtonum().
+          - Introduced crypto_arch.h which will contain the architecture
+            dependent code and defines rather than the public opensslconf.h.
+          - OPENSSL_cpu_caps() is now architecture independent.
+          - Reorganized the DES implementation to use fewer files and removed
+            optimizations for ancient processors and compilers.
+        * New features
+          - Added CRLfile option to the cms command of openssl(1) to specify
+            additional CRLs for use during verification.
         * Documentation improvements
           - Removed documentation of no longer existing API.
+          - Unified the description of the obsolete ENGINE parameter that
+            needs to remain in many functions and should always be NULL.
         * Testing and proactive security
           - Switched the remaining tests to new certs.
         * Compatibility changes
+          - Protocol parsing in libtls was changed. The unsupported TLSv1.1
+            and TLSv1.0 protocols are ignored and no longer enable or disable
+            TLSv1.2 in surprising ways.
+          - The dangerous EVP_PKEY*_check(3) family of functions was removed.
+            The openssl(1) pkey and pkeyparam commands no longer support the
+            -check and -pubcheck flags.
           - The one-step hashing functions, MD4(), MD5(), RIPEMD160(), SHA1(),
             all SHA-2, and HMAC() no longer support returning a static buffer.
             Callers must pass in a correctly sized buffer.
+          - Support for Whirlpool was removed. Applications still using this
+            should honor OPENSSL_NO_WHIRLPOOL.
           - Removed workaround for F5 middle boxes.
           - Removed the useless pem2.h, a public header that was added since
-            it was too hard to add a prototype to one file.
+            it was too hard to add a single prototype to one file.
+          - Removed conf_api.h and the public API therein.
+          - Removed ssl2.h, ssl23.h and ui_compat.h.
+          - Numerous conf and attribute functions were removed. Some unused
+            types were removed, others were made opaque.
+          - Removed the deprecated HMAC_Init() function.
+          - Removed OPENSSL_load_builtin_modules().
+          - Removed X509_REQ_{get,set}_extension_nids().
+          - X509_check_trust() and was removed, X509_VAL was made opaque.
           - Only specified versions can be set on certs, CRLs and CSRs.
-          - Prepared X509_REQ_{get,set}_extension_nids() for removal.
           - Removed unused PEM_USER and PEM_CTX types from pem.h.
           - Removed typdefs for COMP_CTX, COMP_METHOD, X509_CRL_METHOD, STORE,
             STORE_METHOD, and SSL_AEAD_CTX.
           - i2d_ASN1_OBJECT() now returns -1 on error like most other i2d_*.
-          - SPKAC support was removed from openssl(1)
+          - SPKAC support was removed from openssl(1).
           - Added TLS1-PRF support to the EVP interface.
-          - Cleaned up various X509v3_* extension API.
-          - Unified the X.509v3 extension methods.
-          - Removed ssl2.h and ssl23.h.
+          - Support for attributes in EVP_PKEYs was removed.
+          - The X509at_* API is no longer public.
+          - SSL_CTX_set1_cert_store() and SSL_CIPHER_get_handshake_digest()
+            were added to libssl.
+          - The completely broken UI_UTIL password API was removed.
+          - The OpenSSL pkcs12 command and PKCS12_create() no longer support
+            setting the Microsoft-specific Local Key Set and Cryptographic
+            Service Provider attributes.
         * Bug fixes
           - Made ASN1_TIME_set_string() and ASN1_TIME_set_string_X509() match
             their documentation. They always set an RFC 5280 conformant time.
@@ -115,6 +323,20 @@ LibreSSL Portable Release Notes:
             ALPN callback.
           - Avoid pushing a spurious error onto the error stack in
             ssl_sigalg_select().
+          - Made fatal alerts fatal in QUIC.
+
+3.9.2 - Stable release
+
+        * Bugfixes
+          - OpenBSD 7.5 errata 003. A missing bounds check could lead to a crash
+            due to dereferencing a zero-sized allocation.
+
+3.9.1 - Stable release
+
+        * Portable changes
+          - Updated tests with expiring certificates
+          - CET-related build fixes for Windows and macOS targets
+          - update libtls linker script to include libssl and libcrypto again
 
 3.9.0 - Development release
 
@@ -193,6 +415,13 @@ LibreSSL Portable Release Notes:
             stack.
           - Made in-place decryption work for EVP_chacha20_poly1305().
 
+3.8.4 - Stable release
+
+        * Portable changes
+          - Updated tests with expiring certificates
+          - CET-related build fixes for Windows and macOS targets
+          - update libtls linker script to include libssl and libcrypto again
+
 3.8.3 - Stable release
 
         * Portable changes
diff --git a/FindLibreSSL.cmake b/FindLibreSSL.cmake
index 6bdc069..6779371 100644
--- a/FindLibreSSL.cmake
+++ b/FindLibreSSL.cmake
@@ -81,6 +81,11 @@ if (WIN32)
         "${_programfiles}/LibreSSL"
     )
     unset(_programfiles)
+elseif(APPLE)
+    # Homebrew installs LibreSSL here
+    set(_LIBRESSL_ROOT_PATHS
+        "/usr/local/opt/libressl"
+    )
 else()
     set(_LIBRESSL_ROOT_PATHS
         "/usr/local/"
diff --git a/Makefile.am b/Makefile.am
index 3f62cd9..eca5a27 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -1,3 +1,18 @@
+#
+# Copyright (c) 2014 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 SUBDIRS = include crypto ssl tls apps man
 if ENABLE_TESTS
 SUBDIRS += tests
diff --git a/Makefile.am.common b/Makefile.am.common
index 5405704..4257cf8 100644
--- a/Makefile.am.common
+++ b/Makefile.am.common
@@ -1,3 +1,18 @@
+#
+# Copyright (c) 2014 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 AM_CFLAGS =
 AM_CPPFLAGS = -I$(top_srcdir)/include
 AM_CPPFLAGS += -I$(abs_top_builddir)/include
diff --git a/apps/CMakeLists.txt b/apps/CMakeLists.txt
index 08a5a41..754990a 100644
--- a/apps/CMakeLists.txt
+++ b/apps/CMakeLists.txt
@@ -1,3 +1,18 @@
+#
+# Copyright (c) 2014 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 add_subdirectory(ocspcheck)
 add_subdirectory(openssl)
 add_subdirectory(nc)
diff --git a/apps/nc/CMakeLists.txt b/apps/nc/CMakeLists.txt
index 7bbdb02..b1eed1b 100644
--- a/apps/nc/CMakeLists.txt
+++ b/apps/nc/CMakeLists.txt
@@ -1,3 +1,18 @@
+#
+# Copyright (c) 2016 Kinichiro Inoguchi
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 if(BUILD_NC)
 
 set(
@@ -22,7 +37,7 @@ else()
         set(NC_SRC ${NC_SRC} compat/accept4.c)
 endif()
 
-check_function_exists(readpassphrase HAVE_READPASSPHRASE)
+check_symbol_exists(readpassphrase "readpassphrase.h" HAVE_READPASSPHRASE)
 if(HAVE_READPASSPHRASE)
         add_definitions(-DHAVE_READPASSPHRASE)
 else()
diff --git a/apps/nc/Makefile.am b/apps/nc/Makefile.am
index aba306e..a3911a2 100644
--- a/apps/nc/Makefile.am
+++ b/apps/nc/Makefile.am
@@ -1,3 +1,18 @@
+#
+# Copyright (c) 2015 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 include $(top_srcdir)/Makefile.am.common
 
 -include $(abs_top_builddir)/crypto/libcrypto_la_objects.mk
diff --git a/apps/nc/compat/accept4.c b/apps/nc/compat/accept4.c
index 278198b..dca42e9 100644
--- a/apps/nc/compat/accept4.c
+++ b/apps/nc/compat/accept4.c
@@ -6,10 +6,10 @@ accept4(int s, struct sockaddr *addr, socklen_t *addrlen, int flags)
 {
         int rets = accept(s, addr, addrlen);
         if (rets == -1)
-                return s;
+                return rets;
 
         if (flags & SOCK_CLOEXEC) {
-                flags = fcntl(s, F_GETFD);
+                flags = fcntl(rets, F_GETFD);
                 fcntl(rets, F_SETFD, flags | FD_CLOEXEC);
         }
 
diff --git a/apps/ocspcheck/CMakeLists.txt b/apps/ocspcheck/CMakeLists.txt
index 778e837..ed2ec1b 100644
--- a/apps/ocspcheck/CMakeLists.txt
+++ b/apps/ocspcheck/CMakeLists.txt
@@ -1,3 +1,18 @@
+#
+# Copyright (c) 2017 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 set(
         OCSPCHECK_SRC
         http.c
diff --git a/apps/ocspcheck/Makefile.am b/apps/ocspcheck/Makefile.am
index e6f3c54..554bd5c 100644
--- a/apps/ocspcheck/Makefile.am
+++ b/apps/ocspcheck/Makefile.am
@@ -1,3 +1,18 @@
+#
+# Copyright (c) 2017 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 include $(top_srcdir)/Makefile.am.common
 
 -include $(abs_top_builddir)/crypto/libcrypto_la_objects.mk
diff --git a/apps/openssl/CMakeLists.txt b/apps/openssl/CMakeLists.txt
index bca60e1..3040d01 100644
--- a/apps/openssl/CMakeLists.txt
+++ b/apps/openssl/CMakeLists.txt
@@ -1,3 +1,18 @@
+#
+# Copyright (c) 2016 Kinichiro Inoguchi
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 set(
         OPENSSL_SRC
         apps.c
diff --git a/apps/openssl/Makefile.am b/apps/openssl/Makefile.am
index 810408d..40804c5 100644
--- a/apps/openssl/Makefile.am
+++ b/apps/openssl/Makefile.am
@@ -1,3 +1,18 @@
+#
+# Copyright (c) 2015 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 include $(top_srcdir)/Makefile.am.common
 
 -include $(abs_top_builddir)/crypto/libcrypto_la_objects.mk
@@ -88,11 +103,6 @@ endif
 endif
 
 noinst_HEADERS = apps.h
-noinst_HEADERS += progs.h
-noinst_HEADERS += s_apps.h
-noinst_HEADERS += testdsa.h
-noinst_HEADERS += testrsa.h
-noinst_HEADERS += timeouts.h
 
 EXTRA_DIST = CMakeLists.txt
 
diff --git a/apps/openssl/compat/poll_win.c b/apps/openssl/compat/poll_win.c
index c9422b9..30f6b60 100644
--- a/apps/openssl/compat/poll_win.c
+++ b/apps/openssl/compat/poll_win.c
@@ -248,12 +248,12 @@ poll(struct pollfd *pfds, nfds_t nfds, int timeout_ms)
         timespent_ms = 0;
         wait_rc = WAIT_FAILED;
 
-        if (timeout_ms < 0)
+        looptime_ms = (timeout_ms > 100 || timeout_ms == -1) ? 100 : timeout_ms;
+        if (timeout_ms == -1)
                 timeout_ms = INFINITE;
-        looptime_ms = timeout_ms > 100 ? 100 : timeout_ms;
 
         do {
-                struct timeval tv;
+                TIMEVAL tv;
                 tv.tv_sec = 0;
                 tv.tv_usec = looptime_ms * 1000;
                 int handle_signaled = 0;
diff --git a/check-release.sh b/check-release.sh
index c5f9c5f..723a051 100755
--- a/check-release.sh
+++ b/check-release.sh
@@ -1,4 +1,19 @@
 #!/bin/sh
+#
+# Copyright (c) 2014 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 set -e
 
 ver=$1
diff --git a/cmake_export_symbol.cmake b/cmake_export_symbol.cmake
index 0883001..9fe61f2 100644
--- a/cmake_export_symbol.cmake
+++ b/cmake_export_symbol.cmake
@@ -1,3 +1,18 @@
+#
+# Copyright (c) 2017 Kinichiro Inoguchi
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 macro(export_symbol TARGET SYMBOLS_PATH)
 
         set(FLAG "")
diff --git a/cmake_uninstall.cmake.in b/cmake_uninstall.cmake.in
index bb8055d..2887382 100644
--- a/cmake_uninstall.cmake.in
+++ b/cmake_uninstall.cmake.in
@@ -1,3 +1,18 @@
+#
+# Copyright (c) 2016 Kinichiro Inoguchi
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 if(NOT EXISTS "@CMAKE_CURRENT_BINARY_DIR@/install_manifest.txt")
         message(FATAL_ERROR "Cannot find install manifest: @CMAKE_CURRENT_BINARY_DIR@/install_manifest.txt")
 endif(NOT EXISTS "@CMAKE_CURRENT_BINARY_DIR@/install_manifest.txt")
diff --git a/configure.ac b/configure.ac
index 87a80cc..eb2b9ce 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1,3 +1,4 @@
+#
 # Copyright (c) 2014-2015 Brent Cook
 #
 # Permission to use, copy, modify, and distribute this software for any
@@ -32,10 +33,6 @@ LT_INIT([pic-only])
 
 CHECK_OS_OPTIONS
 
-if test "$HOST_OS" = "unsupported"; then
-        AC_MSG_ERROR([unsupported platform: $host_os])
-fi
-
 CHECK_C_HARDENING_OPTIONS
 
 DISABLE_AS_EXECUTABLE_STACK
@@ -90,16 +87,17 @@ AS_CASE([$host_cpu],
 )
 AM_CONDITIONAL([HOST_CPU_IS_INTEL], [test "x$HOSTARCH" = "xintel"])
 
-AM_CONDITIONAL([HOST_AARCH64],   [test "$host_cpu" = "aarch64"])
-AM_CONDITIONAL([HOST_ARM],       [test "$host_cpu" = "arm"])
-AM_CONDITIONAL([HOST_I386],      [test "$host_cpu" = "i386"])
-AM_CONDITIONAL([HOST_MIPS],      [test "$host_cpu" = "mips"])
-AM_CONDITIONAL([HOST_MIPS64],    [test "$host_cpu" = "mips64"])
-AM_CONDITIONAL([HOST_POWERPC],   [test "$host_cpu" = "powerpc"])
-AM_CONDITIONAL([HOST_POWERPC64], [test "$host_cpu" = "ppc64"])
-AM_CONDITIONAL([HOST_RISCV64],   [test "$host_cpu" = "riscv64"])
-AM_CONDITIONAL([HOST_SPARC64],   [test "$host_cpu" = "sparc64"])
-AM_CONDITIONAL([HOST_X86_64],    [test "$host_cpu" = "x86_64"])
+AM_CONDITIONAL([HOST_AARCH64],      [test "$host_cpu" = "aarch64"])
+AM_CONDITIONAL([HOST_ARM],          [test "$host_cpu" = "arm"])
+AM_CONDITIONAL([HOST_I386],         [test "$host_cpu" = "i386"])
+AM_CONDITIONAL([HOST_LOONGARCH64],  [test "$host_cpu" = "loongarch64"])
+AM_CONDITIONAL([HOST_MIPS],         [test "$host_cpu" = "mips"])
+AM_CONDITIONAL([HOST_MIPS64],       [test "$host_cpu" = "mips64"])
+AM_CONDITIONAL([HOST_POWERPC],      [test "$host_cpu" = "powerpc"])
+AM_CONDITIONAL([HOST_POWERPC64],    [test "$host_cpu" = "ppc64"])
+AM_CONDITIONAL([HOST_RISCV64],      [test "$host_cpu" = "riscv64"])
+AM_CONDITIONAL([HOST_SPARC64],      [test "$host_cpu" = "sparc64"])
+AM_CONDITIONAL([HOST_X86_64],       [test "$host_cpu" = "x86_64"])
 
 AC_MSG_CHECKING([if .gnu.warning accepts long strings])
 AC_LINK_IFELSE([AC_LANG_SOURCE([[
@@ -117,8 +115,8 @@ AC_ARG_ENABLE([asm], AS_HELP_STRING([--disable-asm], [Disable assembly]))
 AM_CONDITIONAL([OPENSSL_NO_ASM], [test "x$enable_asm" = "xno"])
 
 # Conditionally enable assembly by default
-AM_CONDITIONAL([HOST_ASM_ELF_ARM],
-    [test "x$HOST_ABI" = "xelf" -a "$host_cpu" = "arm" -a "x$enable_asm" != "xno"])
+AM_CONDITIONAL([HOST_ASM_ELF_AARCH64],
+    [test "x$HOST_ABI" = "xelf" -a "$host_cpu" = "aarch64" -a "x$enable_asm" != "xno"])
 AM_CONDITIONAL([HOST_ASM_ELF_MIPS],
     [test "x$HOST_ABI" = "xelf" -a "$host_cpu" = "mips" -a "x$enable_asm" != "xno"])
 AM_CONDITIONAL([HOST_ASM_ELF_MIPS64],
@@ -163,3 +161,7 @@ AM_CONDITIONAL([ENABLE_LIBTLS_ONLY], [test "x$enable_libtls_only" = xyes])
 AC_REQUIRE_AUX_FILE([tap-driver.sh])
 
 AC_OUTPUT
+
+if test "$HOST_OS" = "unsupported"; then
+       AC_MSG_WARN([unsupported platform: $host_os])
+fi
diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt
index 5ee20ff..d566182 100644
--- a/crypto/CMakeLists.txt
+++ b/crypto/CMakeLists.txt
@@ -1,236 +1,210 @@
+#
+# Copyright (c) 2014 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 add_definitions(-DLIBRESSL_CRYPTO_INTERNAL)
 
-if(HOST_ASM_ELF_ARMV4)
+if(HOST_ASM_ELF_AARCH64)
+        set(CRYPTO_SRC ${CRYPTO_SRC} sha/sha1_aarch64.c sha/sha256_aarch64.c sha/sha512_aarch64.c)
+
         set(
-                ASM_ARMV4_ELF_SRC
-                aes/aes-elf-armv4.S
-                bn/mont-elf-armv4.S
-                sha/sha1-elf-armv4.S
-                sha/sha512-elf-armv4.S
-                sha/sha256-elf-armv4.S
-                modes/ghash-elf-armv4.S
-                armv4cpuid.S
-                armcap.c
+                ASM_AARCH64_ELF_SRC
+                sha/sha1_aarch64_ce.S
+                sha/sha256_aarch64_ce.S
+                sha/sha256_aarch64_ce.S
         )
-        add_definitions(-DAES_ASM)
-        add_definitions(-DOPENSSL_BN_ASM_MONT)
-        add_definitions(-DGHASH_ASM)
-        add_definitions(-DSHA1_ASM)
-        add_definitions(-DSHA256_ASM)
-        add_definitions(-DSHA512_ASM)
-        add_definitions(-DOPENSSL_CPUID_OBJ)
-        set_property(SOURCE ${ASM_ARMV4_ELF_SRC} PROPERTY LANGUAGE C)
-        set(CRYPTO_SRC ${CRYPTO_SRC} ${ASM_ARMV4_ELF_SRC})
+        set(CRYPTO_SRC ${CRYPTO_SRC} ${ASM_AARCH64_ELF_SRC})
 endif()
 
 if(HOST_ASM_ELF_X86_64)
+        set(CRYPTO_SRC ${CRYPTO_SRC} aes/aes_amd64.c)
+        set(CRYPTO_SRC ${CRYPTO_SRC} bn/arch/amd64/bn_arch.c)
+        set(CRYPTO_SRC ${CRYPTO_SRC} modes/gcm128_amd64.c)
+        set(CRYPTO_SRC ${CRYPTO_SRC} sha/sha1_amd64.c sha/sha256_amd64.c sha/sha512_amd64.c)
+
         set(
                 ASM_X86_64_ELF_SRC
                 aes/aes-elf-x86_64.S
-                aes/bsaes-elf-x86_64.S
-                aes/vpaes-elf-x86_64.S
                 aes/aesni-elf-x86_64.S
                 bn/modexp512-elf-x86_64.S
                 bn/mont-elf-x86_64.S
                 bn/mont5-elf-x86_64.S
-                md5/md5-elf-x86_64.S
                 modes/ghash-elf-x86_64.S
                 rc4/rc4-elf-x86_64.S
-                sha/sha1-elf-x86_64.S
-                sha/sha256-elf-x86_64.S
-                sha/sha512-elf-x86_64.S
-                cpuid-elf-x86_64.S
 
                 bn/arch/amd64/bignum_add.S
                 bn/arch/amd64/bignum_cmadd.S
                 bn/arch/amd64/bignum_cmul.S
+                bn/arch/amd64/bignum_modadd.S
+                bn/arch/amd64/bignum_modsub.S
                 bn/arch/amd64/bignum_mul.S
+                bn/arch/amd64/bignum_mul_4_8.S
                 bn/arch/amd64/bignum_mul_4_8_alt.S
+                bn/arch/amd64/bignum_mul_6_12.S
+                bn/arch/amd64/bignum_mul_6_12_alt.S
+                bn/arch/amd64/bignum_mul_8_16.S
                 bn/arch/amd64/bignum_mul_8_16_alt.S
                 bn/arch/amd64/bignum_sqr.S
+                bn/arch/amd64/bignum_sqr_4_8.S
                 bn/arch/amd64/bignum_sqr_4_8_alt.S
+                bn/arch/amd64/bignum_sqr_6_12.S
+                bn/arch/amd64/bignum_sqr_6_12_alt.S
+                bn/arch/amd64/bignum_sqr_8_16.S
                 bn/arch/amd64/bignum_sqr_8_16_alt.S
                 bn/arch/amd64/bignum_sub.S
                 bn/arch/amd64/word_clz.S
-                bn/arch/amd64/bn_arch.c
+
+                sha/sha1_amd64_shani.S
+                sha/sha1_amd64_generic.S
+                sha/sha256_amd64_generic.S
+                sha/sha256_amd64_shani.S
+                sha/sha512_amd64_generic.S
         )
-        add_definitions(-DAES_ASM)
-        add_definitions(-DBSAES_ASM)
-        add_definitions(-DVPAES_ASM)
-        add_definitions(-DHAVE_AES_CBC_ENCRYPT_INTERNAL)
-        add_definitions(-DHAVE_AES_SET_ENCRYPT_KEY_INTERNAL)
-        add_definitions(-DHAVE_AES_SET_DECRYPT_KEY_INTERNAL)
-        add_definitions(-DHAVE_AES_ENCRYPT_INTERNAL)
-        add_definitions(-DHAVE_AES_DECRYPT_INTERNAL)
-        add_definitions(-DOPENSSL_IA32_SSE2)
+        add_definitions(-DLIBRESSL_USE_AES_ASSEMBLY)
+        add_definitions(-DLIBRESSL_USE_BN_ASSEMBLY)
+        add_definitions(-DLIBRESSL_USE_GCM_ASSEMBLY)
+        add_definitions(-DLIBRESSL_USE_RC4_ASSEMBLY)
+        add_definitions(-DLIBRESSL_USE_SHA_ASSEMBLY)
         add_definitions(-DOPENSSL_BN_ASM_MONT)
         add_definitions(-DOPENSSL_BN_ASM_MONT5)
-        add_definitions(-DMD5_ASM)
-        add_definitions(-DGHASH_ASM)
-        add_definitions(-DRSA_ASM)
-        add_definitions(-DSHA1_ASM)
-        add_definitions(-DSHA256_ASM)
-        add_definitions(-DSHA512_ASM)
-        add_definitions(-DWHIRLPOOL_ASM)
-        add_definitions(-DOPENSSL_CPUID_OBJ)
         set(CRYPTO_SRC ${CRYPTO_SRC} ${ASM_X86_64_ELF_SRC})
-        set_property(SOURCE ${ASM_X86_64_ELF_SRC} PROPERTY LANGUAGE C)
 endif()
 
 if(HOST_ASM_MACOSX_X86_64)
+        set(CRYPTO_SRC ${CRYPTO_SRC} aes/aes_amd64.c)
+        set(CRYPTO_SRC ${CRYPTO_SRC} bn/arch/amd64/bn_arch.c)
+        set(CRYPTO_SRC ${CRYPTO_SRC} modes/gcm128_amd64.c)
+
         set(
                 ASM_X86_64_MACOSX_SRC
                 aes/aes-macosx-x86_64.S
-                aes/bsaes-macosx-x86_64.S
-                aes/vpaes-macosx-x86_64.S
                 aes/aesni-macosx-x86_64.S
                 bn/modexp512-macosx-x86_64.S
                 bn/mont-macosx-x86_64.S
                 bn/mont5-macosx-x86_64.S
-                md5/md5-macosx-x86_64.S
                 modes/ghash-macosx-x86_64.S
                 rc4/rc4-macosx-x86_64.S
-                sha/sha1-macosx-x86_64.S
-                sha/sha256-macosx-x86_64.S
-                sha/sha512-macosx-x86_64.S
-                cpuid-macosx-x86_64.S
 
                 bn/arch/amd64/bignum_add.S
                 bn/arch/amd64/bignum_cmadd.S
                 bn/arch/amd64/bignum_cmul.S
+                bn/arch/amd64/bignum_modadd.S
+                bn/arch/amd64/bignum_modsub.S
                 bn/arch/amd64/bignum_mul.S
+                bn/arch/amd64/bignum_mul_4_8.S
                 bn/arch/amd64/bignum_mul_4_8_alt.S
+                bn/arch/amd64/bignum_mul_6_12.S
+                bn/arch/amd64/bignum_mul_6_12_alt.S
+                bn/arch/amd64/bignum_mul_8_16.S
                 bn/arch/amd64/bignum_mul_8_16_alt.S
                 bn/arch/amd64/bignum_sqr.S
+                bn/arch/amd64/bignum_sqr_4_8.S
                 bn/arch/amd64/bignum_sqr_4_8_alt.S
+                bn/arch/amd64/bignum_sqr_6_12.S
+                bn/arch/amd64/bignum_sqr_6_12_alt.S
+                bn/arch/amd64/bignum_sqr_8_16.S
                 bn/arch/amd64/bignum_sqr_8_16_alt.S
                 bn/arch/amd64/bignum_sub.S
                 bn/arch/amd64/word_clz.S
-                bn/arch/amd64/bn_arch.c
         )
-        add_definitions(-DAES_ASM)
-        add_definitions(-DBSAES_ASM)
-        add_definitions(-DVPAES_ASM)
-        add_definitions(-DHAVE_AES_CBC_ENCRYPT_INTERNAL)
-        add_definitions(-DHAVE_AES_SET_ENCRYPT_KEY_INTERNAL)
-        add_definitions(-DHAVE_AES_SET_DECRYPT_KEY_INTERNAL)
-        add_definitions(-DHAVE_AES_ENCRYPT_INTERNAL)
-        add_definitions(-DHAVE_AES_DECRYPT_INTERNAL)
-        add_definitions(-DOPENSSL_IA32_SSE2)
+        add_definitions(-DLIBRESSL_USE_AES_ASSEMBLY)
+        add_definitions(-DLIBRESSL_USE_BN_ASSEMBLY)
+        add_definitions(-DLIBRESSL_USE_GCM_ASSEMBLY)
+        add_definitions(-DLIBRESSL_USE_RC4_ASSEMBLY)
         add_definitions(-DOPENSSL_BN_ASM_MONT)
         add_definitions(-DOPENSSL_BN_ASM_MONT5)
-        add_definitions(-DMD5_ASM)
-        add_definitions(-DGHASH_ASM)
-        add_definitions(-DRSA_ASM)
-        add_definitions(-DSHA1_ASM)
-        add_definitions(-DSHA256_ASM)
-        add_definitions(-DSHA512_ASM)
-        add_definitions(-DWHIRLPOOL_ASM)
-        add_definitions(-DOPENSSL_CPUID_OBJ)
         set(CRYPTO_SRC ${CRYPTO_SRC} ${ASM_X86_64_MACOSX_SRC})
-        set_property(SOURCE ${ASM_X86_64_MACOSX_SRC} PROPERTY LANGUAGE C)
         set_property(SOURCE ${ASM_X86_64_MACOSX_SRC} PROPERTY XCODE_EXPLICIT_FILE_TYPE "sourcecode.asm")
 endif()
 
 if(HOST_ASM_MASM_X86_64)
+        set(CRYPTO_SRC ${CRYPTO_SRC} aes/aes_amd64.c)
+        set(CRYPTO_SRC ${CRYPTO_SRC} modes/gcm128_amd64.c)
+
         set(
                 ASM_X86_64_MASM_SRC
                 aes/aes-masm-x86_64.S
-                aes/bsaes-masm-x86_64.S
-                aes/vpaes-masm-x86_64.S
                 aes/aesni-masm-x86_64.S
                 #bn/modexp512-masm-x86_64.S
                 #bn/mont-masm-x86_64.S
                 #bn/mont5-masm-x86_64.S
-                md5/md5-masm-x86_64.S
                 modes/ghash-masm-x86_64.S
                 rc4/rc4-masm-x86_64.S
-                sha/sha1-masm-x86_64.S
-                sha/sha256-masm-x86_64.S
-                sha/sha512-masm-x86_64.S
-                cpuid-masm-x86_64.S
         )
         add_definitions(-Dendbr64=)
-        add_definitions(-DAES_ASM)
-        add_definitions(-DBSAES_ASM)
-        add_definitions(-DVPAES_ASM)
-        add_definitions(-DHAVE_AES_CBC_ENCRYPT_INTERNAL)
-        add_definitions(-DHAVE_AES_SET_ENCRYPT_KEY_INTERNAL)
-        add_definitions(-DHAVE_AES_SET_DECRYPT_KEY_INTERNAL)
-        add_definitions(-DHAVE_AES_ENCRYPT_INTERNAL)
-        add_definitions(-DHAVE_AES_DECRYPT_INTERNAL)
-        add_definitions(-DOPENSSL_IA32_SSE2)
+        add_definitions(-DLIBRESSL_USE_AES_ASSEMBLY)
+        #add_definitions(-DLIBRESSL_USE_BN_ASSEMBLY)
+        add_definitions(-DLIBRESSL_USE_GCM_ASSEMBLY)
+        add_definitions(-DLIBRESSL_USE_RC4_ASSEMBLY)
         #add_definitions(-DOPENSSL_BN_ASM_MONT)
         #add_definitions(-DOPENSSL_BN_ASM_MONT5)
-        add_definitions(-DMD5_ASM)
-        add_definitions(-DGHASH_ASM)
-        add_definitions(-DRSA_ASM)
-        add_definitions(-DSHA1_ASM)
-        add_definitions(-DSHA256_ASM)
-        add_definitions(-DSHA512_ASM)
-        add_definitions(-DWHIRLPOOL_ASM)
-        add_definitions(-DOPENSSL_CPUID_OBJ)
         set(CRYPTO_SRC ${CRYPTO_SRC} ${ASM_X86_64_MASM_SRC})
         set_property(SOURCE ${ASM_X86_64_MASM_SRC} PROPERTY LANGUAGE ASM_MASM)
 endif()
 
 if(HOST_ASM_MINGW64_X86_64)
+        set(CRYPTO_SRC ${CRYPTO_SRC} aes/aes_amd64.c)
+        set(CRYPTO_SRC ${CRYPTO_SRC} modes/gcm128_amd64.c)
+
         set(
                 ASM_X86_64_MINGW64_SRC
                 aes/aes-mingw64-x86_64.S
-                aes/bsaes-mingw64-x86_64.S
-                aes/vpaes-mingw64-x86_64.S
                 aes/aesni-mingw64-x86_64.S
                 #bn/modexp512-mingw64-x86_64.S
                 #bn/mont-mingw64-x86_64.S
                 #bn/mont5-mingw64-x86_64.S
-                md5/md5-mingw64-x86_64.S
                 modes/ghash-mingw64-x86_64.S
                 rc4/rc4-mingw64-x86_64.S
-                sha/sha1-mingw64-x86_64.S
-                sha/sha256-mingw64-x86_64.S
-                sha/sha512-mingw64-x86_64.S
-                cpuid-mingw64-x86_64.S
         )
         add_definitions(-Dendbr32=endbr64)
-        add_definitions(-DAES_ASM)
-        add_definitions(-DBSAES_ASM)
-        add_definitions(-DVPAES_ASM)
-        add_definitions(-DHAVE_AES_CBC_ENCRYPT_INTERNAL)
-        add_definitions(-DHAVE_AES_SET_ENCRYPT_KEY_INTERNAL)
-        add_definitions(-DHAVE_AES_SET_DECRYPT_KEY_INTERNAL)
-        add_definitions(-DHAVE_AES_ENCRYPT_INTERNAL)
-        add_definitions(-DHAVE_AES_DECRYPT_INTERNAL)
-        add_definitions(-DOPENSSL_IA32_SSE2)
+        add_definitions(-DLIBRESSL_USE_AES_ASSEMBLY)
+        #add_definitions(-DLIBRESSL_USE_BN_ASSEMBLY)
+        add_definitions(-DLIBRESSL_USE_GCM_ASSEMBLY)
+        add_definitions(-DLIBRESSL_USE_RC4_ASSEMBLY)
         #add_definitions(-DOPENSSL_BN_ASM_MONT)
         #add_definitions(-DOPENSSL_BN_ASM_MONT5)
-        add_definitions(-DMD5_ASM)
-        add_definitions(-DGHASH_ASM)
-        add_definitions(-DRSA_ASM)
-        add_definitions(-DSHA1_ASM)
-        add_definitions(-DSHA256_ASM)
-        add_definitions(-DSHA512_ASM)
-        add_definitions(-DWHIRLPOOL_ASM)
-        add_definitions(-DOPENSSL_CPUID_OBJ)
         set(CRYPTO_SRC ${CRYPTO_SRC} ${ASM_X86_64_MINGW64_SRC})
-        set_property(SOURCE ${ASM_X86_64_MINGW64_SRC} PROPERTY LANGUAGE C)
+endif()
+
+if(HOST_AARCH64)
+        if(APPLE)
+                set(CRYPTO_SRC ${CRYPTO_SRC} arch/aarch64/crypto_cpu_caps_darwin.c)
+        elseif(LINUX)
+                set(CRYPTO_SRC ${CRYPTO_SRC} arch/aarch64/crypto_cpu_caps_linux.c)
+        elseif(CMAKE_SYSTEM_NAME STREQUAL "OpenBSD")
+                set(CRYPTO_SRC ${CRYPTO_SRC} arch/aarch64/crypto_cpu_caps.c)
+        elseif(WIN32)
+                set(CRYPTO_SRC ${CRYPTO_SRC} arch/aarch64/crypto_cpu_caps_windows.c)
+        else()
+                set(CRYPTO_SRC ${CRYPTO_SRC} arch/aarch64/crypto_cpu_caps_none.c)
+        endif()
+elseif(HOST_X86_64)
+        set(CRYPTO_SRC ${CRYPTO_SRC} arch/amd64/crypto_cpu_caps.c)
+elseif(HOST_I386)
+        set(CRYPTO_SRC ${CRYPTO_SRC} arch/i386/crypto_cpu_caps.c)
 endif()
 
 set(
         CRYPTO_SRC
         ${CRYPTO_SRC}
-        cpt_err.c
-        cryptlib.c
+        crypto_err.c
+        crypto_ex_data.c
         crypto_init.c
-        cversion.c
-        ex_data.c
-        malloc-wrapper.c
-        mem_clr.c
-        mem_dbg.c
-        o_fips.c
+        crypto_legacy.c
+        crypto_memory.c
         aes/aes.c
         aes/aes_core.c
-        aes/aes_ige.c
         asn1/a_bitstr.c
         asn1/a_enum.c
         asn1/a_int.c
@@ -280,10 +254,8 @@ set(
         asn1/x_bignum.c
         asn1/x_crl.c
         asn1/x_exten.c
-        asn1/x_info.c
         asn1/x_long.c
         asn1/x_name.c
-        asn1/x_pkey.c
         asn1/x_pubkey.c
         asn1/x_req.c
         asn1/x_sig.c
@@ -312,6 +284,7 @@ set(
         bio/bss_null.c
         bio/bss_sock.c
         bn/bn_add.c
+        bn/bn_add_sub.c
         bn/bn_bpsw.c
         bn/bn_const.c
         bn/bn_convert.c
@@ -325,6 +298,7 @@ set(
         bn/bn_lib.c
         bn/bn_mod.c
         bn/bn_mod_sqrt.c
+        bn/bn_mod_words.c
         bn/bn_mont.c
         bn/bn_mul.c
         bn/bn_prime.c
@@ -364,7 +338,6 @@ set(
         conf/conf_def.c
         conf/conf_err.c
         conf/conf_lib.c
-        conf/conf_mall.c
         conf/conf_mod.c
         conf/conf_sap.c
         ct/ct_b64.c
@@ -379,26 +352,11 @@ set(
         ct/ct_x509v3.c
         curve25519/curve25519-generic.c
         curve25519/curve25519.c
-        des/cbc_cksm.c
-        des/cbc_enc.c
-        des/cfb64ede.c
-        des/cfb64enc.c
-        des/cfb_enc.c
+        des/des.c
+        des/des_cksum.c
         des/des_enc.c
-        des/ecb3_enc.c
-        des/ecb_enc.c
-        des/ede_cbcm_enc.c
-        des/enc_read.c
-        des/fcrypt.c
-        des/fcrypt_b.c
-        des/ofb64ede.c
-        des/ofb64enc.c
-        des/ofb_enc.c
-        des/pcbc_enc.c
-        des/qud_cksm.c
-        des/set_key.c
-        des/str2key.c
-        des/xcbc_enc.c
+        des/des_fcrypt.c
+        des/des_key.c
         dh/dh_ameth.c
         dh/dh_asn1.c
         dh/dh_check.c
@@ -419,21 +377,17 @@ set(
         dsa/dsa_prn.c
         ec/ec_ameth.c
         ec/ec_asn1.c
-        ec/ec_check.c
+        ec/ec_convert.c
         ec/ec_curve.c
-        ec/ec_cvt.c
         ec/ec_err.c
+        ec/ec_field.c
         ec/ec_key.c
-        ec/ec_kmeth.c
         ec/ec_lib.c
         ec/ec_mult.c
-        ec/ec_oct.c
         ec/ec_pmeth.c
-        ec/ec_print.c
         ec/eck_prn.c
-        ec/ecp_mont.c
-        ec/ecp_oct.c
-        ec/ecp_smpl.c
+        ec/ecp_hp_methods.c
+        ec/ecp_methods.c
         ec/ecx_methods.c
         ecdh/ecdh.c
         ecdsa/ecdsa.c
@@ -476,7 +430,6 @@ set(
         evp/m_sha3.c
         evp/m_sigver.c
         evp/m_sm3.c
-        evp/m_wp.c
         evp/p_legacy.c
         evp/p_lib.c
         evp/p_sign.c
@@ -495,6 +448,9 @@ set(
         lhash/lhash.c
         md4/md4.c
         md5/md5.c
+        mlkem/mlkem.c
+        mlkem/mlkem_internal.c
+        mlkem/mlkem_key.c
         modes/cbc128.c
         modes/ccm128.c
         modes/cfb128.c
@@ -552,11 +508,7 @@ set(
         rand/rand_err.c
         rand/rand_lib.c
         rand/randfile.c
-        rc2/rc2_cbc.c
-        rc2/rc2_ecb.c
-        rc2/rc2_skey.c
-        rc2/rc2cfb64.c
-        rc2/rc2ofb64.c
+        rc2/rc2.c
         rc4/rc4.c
         ripemd/ripemd.c
         rsa/rsa_ameth.c
@@ -599,8 +551,6 @@ set(
         ui/ui_err.c
         ui/ui_lib.c
         ui/ui_null.c
-        ui/ui_util.c
-        whrlpool/whirlpool.c
         x509/by_dir.c
         x509/by_file.c
         x509/by_mem.c
@@ -641,6 +591,7 @@ set(
         x509/x509_r2x.c
         x509/x509_req.c
         x509/x509_set.c
+        x509/x509_siginfo.c
         x509/x509_skey.c
         x509/x509_trs.c
         x509/x509_txt.c
@@ -659,17 +610,17 @@ set(
 
 set(COMPAT_SRC empty.c)
 
+set(CRYPTO_UNEXPORT ${CRYPTO_UNEXPORT} BIO_s_log)
+
 if(UNIX)
         set(CRYPTO_SRC ${CRYPTO_SRC} crypto_lock.c)
         set(CRYPTO_SRC ${CRYPTO_SRC} bio/b_posix.c)
-        set(CRYPTO_SRC ${CRYPTO_SRC} bio/bss_log.c)
         set(CRYPTO_SRC ${CRYPTO_SRC} ui/ui_openssl.c)
 endif()
 
 if(WIN32)
         set(CRYPTO_SRC ${CRYPTO_SRC} compat/crypto_lock_win.c)
         set(CRYPTO_SRC ${CRYPTO_SRC} bio/b_win.c)
-        set(CRYPTO_UNEXPORT ${CRYPTO_UNEXPORT} BIO_s_log)
         set(CRYPTO_SRC ${CRYPTO_SRC} ui/ui_openssl_win.c)
 endif()
 
@@ -685,6 +636,18 @@ if(NOT HAVE_FREEZERO)
         set(COMPAT_SRC ${COMPAT_SRC} compat/freezero.c)
 endif()
 
+if(NOT HAVE_FTRUNCATE)
+        set(COMPAT_SRC ${COMPAT_SRC} compat/ftruncate.c)
+endif()
+
+if(NOT HAVE_GETDELIM)
+        set(COMPAT_SRC ${COMPAT_SRC} compat/getdelim.c)
+endif()
+
+if(NOT HAVE_GETLINE)
+        set(COMPAT_SRC ${COMPAT_SRC} compat/getline.c)
+endif()
+
 if(NOT HAVE_GETOPT)
         set(COMPAT_SRC ${COMPAT_SRC} compat/getopt_long.c)
 endif()
@@ -817,10 +780,12 @@ add_library(crypto_obj OBJECT ${CRYPTO_SRC})
 target_include_directories(crypto_obj
         PRIVATE
                 .
+                aes
                 asn1
                 bio
                 bn
                 bytestring
+                conf
                 dh
                 dsa
                 curve25519
@@ -832,6 +797,7 @@ target_include_directories(crypto_obj
                 hidden
                 hmac
                 lhash
+                mlkem
                 modes
                 ocsp
                 pkcs12
@@ -845,41 +811,65 @@ target_include_directories(crypto_obj
                 ${CMAKE_BINARY_DIR}/include)
 
 if(HOST_AARCH64)
+        target_include_directories(crypto_obj PRIVATE arch/aarch64/)
         target_include_directories(crypto_obj PRIVATE bn/arch/aarch64/)
 elseif(HOST_ARM)
+        target_include_directories(crypto_obj PRIVATE arch/arm/)
         target_include_directories(crypto_obj PRIVATE bn/arch/arm/)
 elseif(HOST_I386)
+        target_include_directories(crypto_obj PRIVATE arch/i386/)
         target_include_directories(crypto_obj PRIVATE bn/arch/i386/)
+elseif(HOST_LOONGARCH64)
+        target_include_directories(crypto_obj PRIVATE arch/loongarch64)
+        target_include_directories(crypto_obj PRIVATE bn/arch/loongarch64)
 elseif(HOST_MIPS64)
+        target_include_directories(crypto_obj PRIVATE arch/mips64)
         target_include_directories(crypto_obj PRIVATE bn/arch/mips64)
 elseif(HOST_MIPS)
+        target_include_directories(crypto_obj PRIVATE arch/mips)
         target_include_directories(crypto_obj PRIVATE bn/arch/mips)
 elseif(HOST_POWERPC)
+        target_include_directories(crypto_obj PRIVATE arch/powerpc)
         target_include_directories(crypto_obj PRIVATE bn/arch/powerpc)
 elseif(HOST_POWERPC64)
+        target_include_directories(crypto_obj PRIVATE arch/powerpc64)
         target_include_directories(crypto_obj PRIVATE bn/arch/powerpc64)
 elseif(HOST_RISCV64)
+        target_include_directories(crypto_obj PRIVATE arch/riscv64)
         target_include_directories(crypto_obj PRIVATE bn/arch/riscv64)
 elseif(HOST_SPARC64)
+        target_include_directories(crypto_obj PRIVATE arch/sparc64)
         target_include_directories(crypto_obj PRIVATE bn/arch/sparc64)
 elseif(HOST_X86_64)
+        target_include_directories(crypto_obj PRIVATE arch/amd64)
         target_include_directories(crypto_obj PRIVATE bn/arch/amd64)
 endif()
 
+if(MSVC)
+        # "C4701" - Potentially uninitialized local variable 'name' used
+        set_source_files_properties(bn/bn_convert.c pem/pem_lib.c PROPERTIES
+                COMPILE_OPTIONS /wd4701
+        )
+        # "C4702" - unreachable code
+        set_source_files_properties(pkcs7/pk7_doit.c PROPERTIES
+                COMPILE_OPTIONS /wd4702
+        )
+endif()
+
 add_library(crypto $<TARGET_OBJECTS:crypto_obj> $<TARGET_OBJECTS:compat_obj> empty.c)
 
 export_symbol(crypto ${CMAKE_CURRENT_BINARY_DIR}/crypto_p.sym)
 target_link_libraries(crypto ${PLATFORM_LIBS})
-if (WIN32)
-        set(CRYPTO_POSTFIX -${CRYPTO_MAJOR_VERSION} PARENT_SCOPE)
-endif()
 set_target_properties(crypto PROPERTIES
-        OUTPUT_NAME crypto${CRYPTO_POSTFIX}
-        ARCHIVE_OUTPUT_NAME crypto${CRYPTO_POSTFIX}
+        OUTPUT_NAME crypto
+        ARCHIVE_OUTPUT_NAME crypto
         EXPORT_NAME Crypto
         VERSION ${CRYPTO_VERSION}
         SOVERSION ${CRYPTO_MAJOR_VERSION}
 )
+if(NOT CMAKE_VERSION VERSION_LESS 3.27.0)
+        set_target_properties(crypto PROPERTIES DLL_NAME_WITH_SOVERSION TRUE)
+endif()
 
 target_include_directories(
         crypto
@@ -919,4 +909,3 @@ if(BUILD_SHARED_LIBS)
         add_library(crypto-static STATIC $<TARGET_OBJECTS:crypto_obj>)
         target_link_libraries(crypto-static ${PLATFORM_LIBS})
 endif()
-
diff --git a/crypto/Makefile.am b/crypto/Makefile.am
index 6e1e975..b03347a 100644
--- a/crypto/Makefile.am
+++ b/crypto/Makefile.am
@@ -1,10 +1,27 @@
+#
+# Copyright (c) 2014 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 include $(top_srcdir)/Makefile.am.common
 
 AM_CPPFLAGS += -DLIBRESSL_CRYPTO_INTERNAL
+AM_CPPFLAGS += -I$(top_srcdir)/crypto/aes
 AM_CPPFLAGS += -I$(top_srcdir)/crypto/asn1
 AM_CPPFLAGS += -I$(top_srcdir)/crypto/bio
 AM_CPPFLAGS += -I$(top_srcdir)/crypto/bn
 AM_CPPFLAGS += -I$(top_srcdir)/crypto/bytestring
+AM_CPPFLAGS += -I$(top_srcdir)/crypto/conf
 AM_CPPFLAGS += -I$(top_srcdir)/crypto/curve25519
 AM_CPPFLAGS += -I$(top_srcdir)/crypto/dh
 AM_CPPFLAGS += -I$(top_srcdir)/crypto/dsa
@@ -15,6 +32,7 @@ AM_CPPFLAGS += -I$(top_srcdir)/crypto/err
 AM_CPPFLAGS += -I$(top_srcdir)/crypto/evp
 AM_CPPFLAGS += -I$(top_srcdir)/crypto/hmac
 AM_CPPFLAGS += -I$(top_srcdir)/crypto/lhash
+AM_CPPFLAGS += -I$(top_srcdir)/crypto/mlkem
 AM_CPPFLAGS += -I$(top_srcdir)/crypto/modes
 AM_CPPFLAGS += -I$(top_srcdir)/crypto/ocsp
 AM_CPPFLAGS += -I$(top_srcdir)/crypto/pkcs12
@@ -49,20 +67,18 @@ crypto_portable.sym: crypto.sym  Makefile
         -echo "generating crypto_portable.sym ..."
         -cp $(top_srcdir)/crypto/crypto.sym crypto_portable.sym
         -chmod u+w crypto_portable.sym
-if HOST_WIN
         -grep -v BIO_s_log crypto_portable.sym > crypto_portable.sym.tmp
         -mv crypto_portable.sym.tmp crypto_portable.sym
-endif
 
 libcrypto_la_objects.mk: Makefile
         @echo "libcrypto_la_objects= $(libcrypto_la_OBJECTS)" \
-          | sed 's/  */ $$\(abs_top_builddir\)\/crypto\//g' \
+          | sed 's/  */ $$\(top_builddir\)\/crypto\//g' \
           > libcrypto_la_objects.mk
         @echo "libcompat_la_objects= $(libcompat_la_OBJECTS)" \
-          | sed 's/compat\// $$\(abs_top_builddir\)\/crypto\/&/g' \
+          | sed 's/compat\// $$\(top_builddir\)\/crypto\/&/g' \
           >> libcrypto_la_objects.mk
         @echo "libcompatnoopt_la_objects= $(libcompatnoopt_la_OBJECTS)" \
-          | sed 's/compat\// $$\(abs_top_builddir\)\/crypto\/&/g' \
+          | sed 's/compat\// $$\(top_builddir\)\/crypto\/&/g' \
           >> libcrypto_la_objects.mk
 
 libcrypto_la_LDFLAGS = -version-info @LIBCRYPTO_VERSION@ -no-undefined -export-symbols crypto_portable.sym
@@ -132,6 +148,18 @@ if !HAVE_FREEZERO
 libcompat_la_SOURCES += compat/freezero.c
 endif
 
+if !HAVE_FTRUNCATE
+libcompat_la_SOURCES += compat/ftruncate.c
+endif
+
+if !HAVE_GETDELIM
+libcompat_la_SOURCES += compat/getdelim.c
+endif
+
+if !HAVE_GETLINE
+libcompat_la_SOURCES += compat/getline.c
+endif
+
 if !HAVE_GETPAGESIZE
 libcompat_la_SOURCES += compat/getpagesize.c
 endif
@@ -177,7 +205,7 @@ include Makefile.am.arc4random
 libcrypto_la_SOURCES =
 EXTRA_libcrypto_la_SOURCES =
 
-include Makefile.am.elf-arm
+include Makefile.am.elf-aarch64
 include Makefile.am.elf-mips
 include Makefile.am.elf-mips64
 include Makefile.am.elf-x86_64
@@ -185,7 +213,7 @@ include Makefile.am.macosx-x86_64
 include Makefile.am.masm-x86_64
 include Makefile.am.mingw64-x86_64
 
-if !HOST_ASM_ELF_ARM
+if !HOST_ASM_ELF_AARCH64
 if !HOST_ASM_ELF_MIPS
 if !HOST_ASM_ELF_MIPS64
 if !HOST_ASM_ELF_X86_64
@@ -201,23 +229,44 @@ endif
 endif
 endif
 
-libcrypto_la_SOURCES += cpt_err.c
-libcrypto_la_SOURCES += cryptlib.c
+if HOST_AARCH64
+if HOST_DARWIN
+libcrypto_la_SOURCES += arch/aarch64/crypto_cpu_caps_darwin.c
+else
+if HOST_LINUX
+libcrypto_la_SOURCES += arch/aarch64/crypto_cpu_caps_linux.c
+else
+if HOST_WIN
+libcrypto_la_SOURCES += arch/aarch64/crypto_cpu_caps_windows.c
+else
+if HOST_OPENBSD
+libcrypto_la_SOURCES += arch/aarch64/crypto_cpu_caps.c
+else
+libcrypto_la_SOURCES += arch/aarch64/crypto_cpu_caps_none.c
+endif
+endif
+endif
+endif
+endif
+
+if HOST_X86_64
+libcrypto_la_SOURCES += arch/amd64/crypto_cpu_caps.c
+endif
+if HOST_I386
+libcrypto_la_SOURCES += arch/i386/crypto_cpu_caps.c
+endif
+
+libcrypto_la_SOURCES += crypto_err.c
+libcrypto_la_SOURCES += crypto_ex_data.c
 libcrypto_la_SOURCES += crypto_init.c
+libcrypto_la_SOURCES += crypto_legacy.c
 if !HOST_WIN
 libcrypto_la_SOURCES += crypto_lock.c
 else
 libcrypto_la_SOURCES += compat/crypto_lock_win.c
 endif
-libcrypto_la_SOURCES += cversion.c
-libcrypto_la_SOURCES += ex_data.c
-libcrypto_la_SOURCES += malloc-wrapper.c
-libcrypto_la_SOURCES += mem_clr.c
-libcrypto_la_SOURCES += mem_dbg.c
-libcrypto_la_SOURCES += o_fips.c
-noinst_HEADERS += arm_arch.h
+libcrypto_la_SOURCES += crypto_memory.c
 noinst_HEADERS += constant_time.h
-noinst_HEADERS += cryptlib.h
 noinst_HEADERS += crypto_internal.h
 noinst_HEADERS += crypto_local.h
 noinst_HEADERS += x86_arch.h
@@ -225,7 +274,6 @@ noinst_HEADERS += x86_arch.h
 # aes
 libcrypto_la_SOURCES += aes/aes.c
 libcrypto_la_SOURCES += aes/aes_core.c
-libcrypto_la_SOURCES += aes/aes_ige.c
 noinst_HEADERS += aes/aes_local.h
 
 # asn1
@@ -278,10 +326,8 @@ libcrypto_la_SOURCES += asn1/x_attrib.c
 libcrypto_la_SOURCES += asn1/x_bignum.c
 libcrypto_la_SOURCES += asn1/x_crl.c
 libcrypto_la_SOURCES += asn1/x_exten.c
-libcrypto_la_SOURCES += asn1/x_info.c
 libcrypto_la_SOURCES += asn1/x_long.c
 libcrypto_la_SOURCES += asn1/x_name.c
-libcrypto_la_SOURCES += asn1/x_pkey.c
 libcrypto_la_SOURCES += asn1/x_pubkey.c
 libcrypto_la_SOURCES += asn1/x_req.c
 libcrypto_la_SOURCES += asn1/x_sig.c
@@ -319,9 +365,6 @@ libcrypto_la_SOURCES += bio/bss_conn.c
 libcrypto_la_SOURCES += bio/bss_dgram.c
 libcrypto_la_SOURCES += bio/bss_fd.c
 libcrypto_la_SOURCES += bio/bss_file.c
-if !HOST_WIN
-libcrypto_la_SOURCES += bio/bss_log.c
-endif
 libcrypto_la_SOURCES += bio/bss_mem.c
 libcrypto_la_SOURCES += bio/bss_null.c
 libcrypto_la_SOURCES += bio/bss_sock.c
@@ -329,6 +372,7 @@ noinst_HEADERS += bio/bio_local.h
 
 # bn
 libcrypto_la_SOURCES += bn/bn_add.c
+libcrypto_la_SOURCES += bn/bn_add_sub.c
 libcrypto_la_SOURCES += bn/bn_bpsw.c
 libcrypto_la_SOURCES += bn/bn_const.c
 libcrypto_la_SOURCES += bn/bn_convert.c
@@ -342,6 +386,7 @@ libcrypto_la_SOURCES += bn/bn_kron.c
 libcrypto_la_SOURCES += bn/bn_lib.c
 libcrypto_la_SOURCES += bn/bn_mod.c
 libcrypto_la_SOURCES += bn/bn_mod_sqrt.c
+libcrypto_la_SOURCES += bn/bn_mod_words.c
 libcrypto_la_SOURCES += bn/bn_mont.c
 libcrypto_la_SOURCES += bn/bn_mul.c
 libcrypto_la_SOURCES += bn/bn_prime.c
@@ -359,55 +404,82 @@ noinst_HEADERS += bn/bn_prime.h
 noinst_HEADERS += bn/s2n_bignum.h
 noinst_HEADERS += bn/s2n_bignum_internal.h
 
-# bn/arch
+# arch, bn/arch
 if HOST_AARCH64
+libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/aarch64/
 libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/bn/arch/aarch64/
 endif
+noinst_HEADERS += arch/aarch64/crypto_arch.h
 noinst_HEADERS += bn/arch/aarch64/bn_arch.h
 
 if HOST_ARM
+libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/arm/
 libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/bn/arch/arm/
 endif
+noinst_HEADERS += arch/arm/crypto_arch.h
 noinst_HEADERS += bn/arch/arm/bn_arch.h
 
 if HOST_I386
+libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/i386/
 libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/bn/arch/i386/
 endif
+noinst_HEADERS += arch/i386/crypto_arch.h
 noinst_HEADERS += bn/arch/i386/bn_arch.h
 
+if HOST_LOONGARCH64
+libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/loongarch64/
+libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/bn/arch/loongarch64/
+endif
+noinst_HEADERS += arch/loongarch64/crypto_arch.h
+noinst_HEADERS += bn/arch/loongarch64/bn_arch.h
+
 if HOST_MIPS
+libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/mips/
 libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/bn/arch/mips/
 endif
+noinst_HEADERS += arch/mips/crypto_arch.h
 noinst_HEADERS += bn/arch/mips/bn_arch.h
 
 if HOST_MIPS64
+libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/mips64/
 libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/bn/arch/mips64/
 endif
+noinst_HEADERS += arch/mips64/crypto_arch.h
 noinst_HEADERS += bn/arch/mips64/bn_arch.h
 
 if HOST_POWERPC
+libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/powerpc/
 libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/bn/arch/powerpc/
 endif
+noinst_HEADERS += arch/powerpc/crypto_arch.h
 noinst_HEADERS += bn/arch/powerpc/bn_arch.h
 
 if HOST_POWERPC64
+libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/powerpc64/
 libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/bn/arch/powerpc64/
 endif
+noinst_HEADERS += arch/powerpc64/crypto_arch.h
 noinst_HEADERS += bn/arch/powerpc64/bn_arch.h
 
 if HOST_RISCV64
+libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/riscv64/
 libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/bn/arch/riscv64/
 endif
+noinst_HEADERS += arch/riscv64/crypto_arch.h
 noinst_HEADERS += bn/arch/riscv64/bn_arch.h
 
 if HOST_SPARC64
+libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/sparc64/
 libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/bn/arch/sparc64/
 endif
+noinst_HEADERS += arch/sparc64/crypto_arch.h
 noinst_HEADERS += bn/arch/sparc64/bn_arch.h
 
 if HOST_X86_64
+libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/amd64/
 libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/bn/arch/amd64/
 endif
+noinst_HEADERS += arch/amd64/crypto_arch.h
 noinst_HEADERS += bn/arch/amd64/bn_arch.h
 
 # buffer
@@ -458,10 +530,10 @@ libcrypto_la_SOURCES += conf/conf_api.c
 libcrypto_la_SOURCES += conf/conf_def.c
 libcrypto_la_SOURCES += conf/conf_err.c
 libcrypto_la_SOURCES += conf/conf_lib.c
-libcrypto_la_SOURCES += conf/conf_mall.c
 libcrypto_la_SOURCES += conf/conf_mod.c
 libcrypto_la_SOURCES += conf/conf_sap.c
 noinst_HEADERS += conf/conf_def.h
+noinst_HEADERS += conf/conf_local.h
 
 # ct
 libcrypto_la_SOURCES += ct/ct_b64.c
@@ -483,29 +555,12 @@ noinst_HEADERS += curve25519/curve25519_internal.h
 
 
 # des
-libcrypto_la_SOURCES += des/cbc_cksm.c
-libcrypto_la_SOURCES += des/cbc_enc.c
-libcrypto_la_SOURCES += des/cfb64ede.c
-libcrypto_la_SOURCES += des/cfb64enc.c
-libcrypto_la_SOURCES += des/cfb_enc.c
+libcrypto_la_SOURCES += des/des.c
+libcrypto_la_SOURCES += des/des_cksum.c
 libcrypto_la_SOURCES += des/des_enc.c
-libcrypto_la_SOURCES += des/ecb3_enc.c
-libcrypto_la_SOURCES += des/ecb_enc.c
-libcrypto_la_SOURCES += des/ede_cbcm_enc.c
-libcrypto_la_SOURCES += des/enc_read.c
-libcrypto_la_SOURCES += des/fcrypt.c
-libcrypto_la_SOURCES += des/fcrypt_b.c
-EXTRA_libcrypto_la_SOURCES += des/ncbc_enc.c
-libcrypto_la_SOURCES += des/ofb64ede.c
-libcrypto_la_SOURCES += des/ofb64enc.c
-libcrypto_la_SOURCES += des/ofb_enc.c
-libcrypto_la_SOURCES += des/pcbc_enc.c
-libcrypto_la_SOURCES += des/qud_cksm.c
-libcrypto_la_SOURCES += des/set_key.c
-libcrypto_la_SOURCES += des/str2key.c
-libcrypto_la_SOURCES += des/xcbc_enc.c
+libcrypto_la_SOURCES += des/des_fcrypt.c
+libcrypto_la_SOURCES += des/des_key.c
 noinst_HEADERS += des/des_local.h
-noinst_HEADERS += des/spr.h
 
 # dh
 libcrypto_la_SOURCES += dh/dh_ameth.c
@@ -534,22 +589,19 @@ noinst_HEADERS += dsa/dsa_local.h
 # ec
 libcrypto_la_SOURCES += ec/ec_ameth.c
 libcrypto_la_SOURCES += ec/ec_asn1.c
-libcrypto_la_SOURCES += ec/ec_check.c
+libcrypto_la_SOURCES += ec/ec_convert.c
 libcrypto_la_SOURCES += ec/ec_curve.c
-libcrypto_la_SOURCES += ec/ec_cvt.c
 libcrypto_la_SOURCES += ec/ec_err.c
+libcrypto_la_SOURCES += ec/ec_field.c
 libcrypto_la_SOURCES += ec/ec_key.c
-libcrypto_la_SOURCES += ec/ec_kmeth.c
 libcrypto_la_SOURCES += ec/ec_lib.c
 libcrypto_la_SOURCES += ec/ec_mult.c
-libcrypto_la_SOURCES += ec/ec_oct.c
 libcrypto_la_SOURCES += ec/ec_pmeth.c
-libcrypto_la_SOURCES += ec/ec_print.c
 libcrypto_la_SOURCES += ec/eck_prn.c
-libcrypto_la_SOURCES += ec/ecp_mont.c
-libcrypto_la_SOURCES += ec/ecp_oct.c
-libcrypto_la_SOURCES += ec/ecp_smpl.c
+libcrypto_la_SOURCES += ec/ecp_hp_methods.c
+libcrypto_la_SOURCES += ec/ecp_methods.c
 libcrypto_la_SOURCES += ec/ecx_methods.c
+noinst_HEADERS += ec/ec_internal.h
 noinst_HEADERS += ec/ec_local.h
 
 # ecdh
@@ -604,7 +656,6 @@ libcrypto_la_SOURCES += evp/m_sha1.c
 libcrypto_la_SOURCES += evp/m_sha3.c
 libcrypto_la_SOURCES += evp/m_sigver.c
 libcrypto_la_SOURCES += evp/m_sm3.c
-libcrypto_la_SOURCES += evp/m_wp.c
 libcrypto_la_SOURCES += evp/p_legacy.c
 libcrypto_la_SOURCES += evp/p_lib.c
 libcrypto_la_SOURCES += evp/p_sign.c
@@ -629,7 +680,6 @@ noinst_HEADERS += hidden/openssl/chacha.h
 noinst_HEADERS += hidden/openssl/cmac.h
 noinst_HEADERS += hidden/openssl/cms.h
 noinst_HEADERS += hidden/openssl/conf.h
-noinst_HEADERS += hidden/openssl/conf_api.h
 noinst_HEADERS += hidden/openssl/crypto.h
 noinst_HEADERS += hidden/openssl/ct.h
 noinst_HEADERS += hidden/openssl/curve25519.h
@@ -646,6 +696,7 @@ noinst_HEADERS += hidden/openssl/idea.h
 noinst_HEADERS += hidden/openssl/lhash.h
 noinst_HEADERS += hidden/openssl/md4.h
 noinst_HEADERS += hidden/openssl/md5.h
+noinst_HEADERS += hidden/openssl/mlkem.h
 noinst_HEADERS += hidden/openssl/modes.h
 noinst_HEADERS += hidden/openssl/objects.h
 noinst_HEADERS += hidden/openssl/ocsp.h
@@ -666,7 +717,6 @@ noinst_HEADERS += hidden/openssl/stack.h
 noinst_HEADERS += hidden/openssl/ts.h
 noinst_HEADERS += hidden/openssl/txt_db.h
 noinst_HEADERS += hidden/openssl/ui.h
-noinst_HEADERS += hidden/openssl/whrlpool.h
 noinst_HEADERS += hidden/openssl/x509.h
 noinst_HEADERS += hidden/openssl/x509_vfy.h
 noinst_HEADERS += hidden/openssl/x509v3.h
@@ -698,6 +748,12 @@ libcrypto_la_SOURCES += md4/md4.c
 # md5
 libcrypto_la_SOURCES += md5/md5.c
 
+# mlkem
+libcrypto_la_SOURCES += mlkem/mlkem.c
+libcrypto_la_SOURCES += mlkem/mlkem_internal.c
+libcrypto_la_SOURCES += mlkem/mlkem_key.c
+noinst_HEADERS += mlkem/mlkem_internal.h
+
 # modes
 libcrypto_la_SOURCES += modes/cbc128.c
 libcrypto_la_SOURCES += modes/ccm128.c
@@ -777,11 +833,7 @@ libcrypto_la_SOURCES += rand/rand_lib.c
 libcrypto_la_SOURCES += rand/randfile.c
 
 # rc2
-libcrypto_la_SOURCES += rc2/rc2_cbc.c
-libcrypto_la_SOURCES += rc2/rc2_ecb.c
-libcrypto_la_SOURCES += rc2/rc2_skey.c
-libcrypto_la_SOURCES += rc2/rc2cfb64.c
-libcrypto_la_SOURCES += rc2/rc2ofb64.c
+libcrypto_la_SOURCES += rc2/rc2.c
 noinst_HEADERS += rc2/rc2_local.h
 
 # rc4
@@ -856,12 +908,8 @@ endif
 if HOST_WIN
 libcrypto_la_SOURCES += ui/ui_openssl_win.c
 endif
-libcrypto_la_SOURCES += ui/ui_util.c
 noinst_HEADERS += ui/ui_local.h
 
-# whrlpool
-libcrypto_la_SOURCES += whrlpool/whirlpool.c
-
 # x509
 libcrypto_la_SOURCES += x509/by_dir.c
 libcrypto_la_SOURCES += x509/by_file.c
@@ -903,6 +951,7 @@ libcrypto_la_SOURCES += x509/x509_purp.c
 libcrypto_la_SOURCES += x509/x509_r2x.c
 libcrypto_la_SOURCES += x509/x509_req.c
 libcrypto_la_SOURCES += x509/x509_set.c
+libcrypto_la_SOURCES += x509/x509_siginfo.c
 libcrypto_la_SOURCES += x509/x509_skey.c
 libcrypto_la_SOURCES += x509/x509_trs.c
 libcrypto_la_SOURCES += x509/x509_txt.c
diff --git a/crypto/Makefile.am.elf-aarch64 b/crypto/Makefile.am.elf-aarch64
new file mode 100644
index 0000000..650e6c6
--- /dev/null
+++ b/crypto/Makefile.am.elf-aarch64
@@ -0,0 +1,15 @@
+ASM_AARCH64_ELF = sha/sha1_aarch64_ce.S
+ASM_AARCH64_ELF += sha/sha256_aarch64_ce.S
+ASM_AARCH64_ELF += sha/sha512_aarch64_ce.S
+
+EXTRA_DIST += $(ASM_AARCH64_ELF)
+
+if HOST_ASM_ELF_AARCH64
+libcrypto_la_SOURCES += sha/sha1_aarch64.c
+libcrypto_la_SOURCES += sha/sha256_aarch64.c
+libcrypto_la_SOURCES += sha/sha512_aarch64.c
+
+libcrypto_la_CPPFLAGS += -DLIBRESSL_USE_SHA_ASSEMBLY
+
+libcrypto_la_SOURCES += $(ASM_AARCH64_ELF)
+endif
diff --git a/crypto/Makefile.am.elf-arm b/crypto/Makefile.am.elf-arm
deleted file mode 100644
index 4f88994..0000000
--- a/crypto/Makefile.am.elf-arm
+++ /dev/null
@@ -1,21 +0,0 @@
-ASM_ARM_ELF = aes/aes-elf-armv4.S
-ASM_ARM_ELF += bn/mont-elf-armv4.S
-ASM_ARM_ELF += sha/sha1-elf-armv4.S
-ASM_ARM_ELF += sha/sha512-elf-armv4.S
-ASM_ARM_ELF += sha/sha256-elf-armv4.S
-ASM_ARM_ELF += modes/ghash-elf-armv4.S
-ASM_ARM_ELF += armv4cpuid.S
-ASM_ARM_ELF += armcap.c
-
-EXTRA_DIST += $(ASM_ARM_ELF)
-
-if HOST_ASM_ELF_ARM
-libcrypto_la_CPPFLAGS += -DAES_ASM
-libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT
-libcrypto_la_CPPFLAGS += -DGHASH_ASM
-libcrypto_la_CPPFLAGS += -DSHA1_ASM
-libcrypto_la_CPPFLAGS += -DSHA256_ASM
-libcrypto_la_CPPFLAGS += -DSHA512_ASM
-libcrypto_la_CPPFLAGS += -DOPENSSL_CPUID_OBJ
-libcrypto_la_SOURCES += $(ASM_ARM_ELF)
-endif
diff --git a/crypto/Makefile.am.elf-mips b/crypto/Makefile.am.elf-mips
index ea0a730..2276991 100644
--- a/crypto/Makefile.am.elf-mips
+++ b/crypto/Makefile.am.elf-mips
@@ -8,10 +8,11 @@ ASM_MIPS_ELF += sha/sha256-mips.S
 EXTRA_DIST += $(ASM_MIPS_ELF)
 
 if HOST_ASM_ELF_MIPS
-libcrypto_la_CPPFLAGS += -DAES_ASM
+libcrypto_la_CPPFLAGS += -DLIBRESSL_USE_AES_ASSEMBLY
+libcrypto_la_CPPFLAGS += -DLIBRESSL_USE_BN_ASSEMBLY
+libcrypto_la_CPPFLAGS += -DLIBRESSL_USE_SHA_ASSEMBLY
+
 libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT
-libcrypto_la_CPPFLAGS += -DSHA1_ASM
-libcrypto_la_CPPFLAGS += -DSHA256_ASM
-libcrypto_la_CPPFLAGS += -DSHA512_ASM
+
 libcrypto_la_SOURCES += $(ASM_MIPS_ELF)
 endif
diff --git a/crypto/Makefile.am.elf-mips64 b/crypto/Makefile.am.elf-mips64
index 8f851f3..c6727b3 100644
--- a/crypto/Makefile.am.elf-mips64
+++ b/crypto/Makefile.am.elf-mips64
@@ -8,10 +8,11 @@ ASM_MIPS64_ELF += sha/sha256-mips.S
 EXTRA_DIST += $(ASM_MIPS64_ELF)
 
 if HOST_ASM_ELF_MIPS64
-libcrypto_la_CPPFLAGS += -DAES_ASM
+libcrypto_la_CPPFLAGS += -DLIBRESSL_USE_AES_ASSEMBLY
+libcrypto_la_CPPFLAGS += -DLIBRESSL_USE_BN_ASSEMBLY
+libcrypto_la_CPPFLAGS += -DLIBRESSL_USE_SHA_ASSEMBLY
+
 libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT
-libcrypto_la_CPPFLAGS += -DSHA1_ASM
-libcrypto_la_CPPFLAGS += -DSHA256_ASM
-libcrypto_la_CPPFLAGS += -DSHA512_ASM
+
 libcrypto_la_SOURCES += $(ASM_MIPS64_ELF)
 endif
diff --git a/crypto/Makefile.am.elf-x86_64 b/crypto/Makefile.am.elf-x86_64
index 6933a11..450e96a 100644
--- a/crypto/Makefile.am.elf-x86_64
+++ b/crypto/Makefile.am.elf-x86_64
@@ -1,53 +1,58 @@
 
 ASM_X86_64_ELF = aes/aes-elf-x86_64.S
-ASM_X86_64_ELF += aes/bsaes-elf-x86_64.S
-ASM_X86_64_ELF += aes/vpaes-elf-x86_64.S
 ASM_X86_64_ELF += aes/aesni-elf-x86_64.S
 ASM_X86_64_ELF += bn/modexp512-elf-x86_64.S
 ASM_X86_64_ELF += bn/mont-elf-x86_64.S
 ASM_X86_64_ELF += bn/mont5-elf-x86_64.S
-ASM_X86_64_ELF += md5/md5-elf-x86_64.S
 ASM_X86_64_ELF += modes/ghash-elf-x86_64.S
 ASM_X86_64_ELF += rc4/rc4-elf-x86_64.S
-ASM_X86_64_ELF += sha/sha1-elf-x86_64.S
-ASM_X86_64_ELF += sha/sha256-elf-x86_64.S
-ASM_X86_64_ELF += sha/sha512-elf-x86_64.S
-ASM_X86_64_ELF += cpuid-elf-x86_64.S
 
 ASM_X86_64_ELF += bn/arch/amd64/bignum_add.S
 ASM_X86_64_ELF += bn/arch/amd64/bignum_cmadd.S
 ASM_X86_64_ELF += bn/arch/amd64/bignum_cmul.S
+ASM_X86_64_ELF += bn/arch/amd64/bignum_modadd.S
+ASM_X86_64_ELF += bn/arch/amd64/bignum_modsub.S
 ASM_X86_64_ELF += bn/arch/amd64/bignum_mul.S
+ASM_X86_64_ELF += bn/arch/amd64/bignum_mul_4_8.S
 ASM_X86_64_ELF += bn/arch/amd64/bignum_mul_4_8_alt.S
+ASM_X86_64_ELF += bn/arch/amd64/bignum_mul_6_12.S
+ASM_X86_64_ELF += bn/arch/amd64/bignum_mul_6_12_alt.S
+ASM_X86_64_ELF += bn/arch/amd64/bignum_mul_8_16.S
 ASM_X86_64_ELF += bn/arch/amd64/bignum_mul_8_16_alt.S
 ASM_X86_64_ELF += bn/arch/amd64/bignum_sqr.S
+ASM_X86_64_ELF += bn/arch/amd64/bignum_sqr_4_8.S
 ASM_X86_64_ELF += bn/arch/amd64/bignum_sqr_4_8_alt.S
+ASM_X86_64_ELF += bn/arch/amd64/bignum_sqr_6_12.S
+ASM_X86_64_ELF += bn/arch/amd64/bignum_sqr_6_12_alt.S
+ASM_X86_64_ELF += bn/arch/amd64/bignum_sqr_8_16.S
 ASM_X86_64_ELF += bn/arch/amd64/bignum_sqr_8_16_alt.S
 ASM_X86_64_ELF += bn/arch/amd64/bignum_sub.S
 ASM_X86_64_ELF += bn/arch/amd64/word_clz.S
-ASM_X86_64_ELF += bn/arch/amd64/bn_arch.c
+
+ASM_X86_64_ELF += sha/sha1_amd64_generic.S
+ASM_X86_64_ELF += sha/sha1_amd64_shani.S
+ASM_X86_64_ELF += sha/sha256_amd64_generic.S
+ASM_X86_64_ELF += sha/sha256_amd64_shani.S
+ASM_X86_64_ELF += sha/sha512_amd64_generic.S
 
 EXTRA_DIST += $(ASM_X86_64_ELF)
 
 if HOST_ASM_ELF_X86_64
-libcrypto_la_CPPFLAGS += -DAES_ASM
-libcrypto_la_CPPFLAGS += -DBSAES_ASM
-libcrypto_la_CPPFLAGS += -DVPAES_ASM
-libcrypto_la_CPPFLAGS += -DHAVE_AES_CBC_ENCRYPT_INTERNAL
-libcrypto_la_CPPFLAGS += -DHAVE_AES_SET_ENCRYPT_KEY_INTERNAL
-libcrypto_la_CPPFLAGS += -DHAVE_AES_SET_DECRYPT_KEY_INTERNAL
-libcrypto_la_CPPFLAGS += -DHAVE_AES_ENCRYPT_INTERNAL
-libcrypto_la_CPPFLAGS += -DHAVE_AES_DECRYPT_INTERNAL
-libcrypto_la_CPPFLAGS += -DOPENSSL_IA32_SSE2
+libcrypto_la_SOURCES += aes/aes_amd64.c
+libcrypto_la_SOURCES += bn/arch/amd64/bn_arch.c
+libcrypto_la_SOURCES += modes/gcm128_amd64.c
+libcrypto_la_SOURCES += sha/sha1_amd64.c
+libcrypto_la_SOURCES += sha/sha256_amd64.c
+libcrypto_la_SOURCES += sha/sha512_amd64.c
+
+libcrypto_la_CPPFLAGS += -DLIBRESSL_USE_AES_ASSEMBLY
+libcrypto_la_CPPFLAGS += -DLIBRESSL_USE_BN_ASSEMBLY
+libcrypto_la_CPPFLAGS += -DLIBRESSL_USE_GCM_ASSEMBLY
+libcrypto_la_CPPFLAGS += -DLIBRESSL_USE_RC4_ASSEMBLY
+libcrypto_la_CPPFLAGS += -DLIBRESSL_USE_SHA_ASSEMBLY
+
 libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT
 libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT5
-libcrypto_la_CPPFLAGS += -DMD5_ASM
-libcrypto_la_CPPFLAGS += -DGHASH_ASM
-libcrypto_la_CPPFLAGS += -DRSA_ASM
-libcrypto_la_CPPFLAGS += -DSHA1_ASM
-libcrypto_la_CPPFLAGS += -DSHA256_ASM
-libcrypto_la_CPPFLAGS += -DSHA512_ASM
-libcrypto_la_CPPFLAGS += -DWHIRLPOOL_ASM
-libcrypto_la_CPPFLAGS += -DOPENSSL_CPUID_OBJ
+
 libcrypto_la_SOURCES += $(ASM_X86_64_ELF)
 endif
diff --git a/crypto/Makefile.am.macosx-x86_64 b/crypto/Makefile.am.macosx-x86_64
index 1020567..7a26649 100644
--- a/crypto/Makefile.am.macosx-x86_64
+++ b/crypto/Makefile.am.macosx-x86_64
@@ -1,53 +1,48 @@
 
 ASM_X86_64_MACOSX = aes/aes-macosx-x86_64.S
-ASM_X86_64_MACOSX += aes/bsaes-macosx-x86_64.S
-ASM_X86_64_MACOSX += aes/vpaes-macosx-x86_64.S
 ASM_X86_64_MACOSX += aes/aesni-macosx-x86_64.S
 ASM_X86_64_MACOSX += bn/modexp512-macosx-x86_64.S
 ASM_X86_64_MACOSX += bn/mont-macosx-x86_64.S
 ASM_X86_64_MACOSX += bn/mont5-macosx-x86_64.S
-ASM_X86_64_MACOSX += md5/md5-macosx-x86_64.S
 ASM_X86_64_MACOSX += modes/ghash-macosx-x86_64.S
 ASM_X86_64_MACOSX += rc4/rc4-macosx-x86_64.S
-ASM_X86_64_MACOSX += sha/sha1-macosx-x86_64.S
-ASM_X86_64_MACOSX += sha/sha256-macosx-x86_64.S
-ASM_X86_64_MACOSX += sha/sha512-macosx-x86_64.S
-ASM_X86_64_MACOSX += cpuid-macosx-x86_64.S
 
 ASM_X86_64_MACOSX += bn/arch/amd64/bignum_add.S
 ASM_X86_64_MACOSX += bn/arch/amd64/bignum_cmadd.S
 ASM_X86_64_MACOSX += bn/arch/amd64/bignum_cmul.S
+ASM_X86_64_MACOSX += bn/arch/amd64/bignum_modadd.S
+ASM_X86_64_MACOSX += bn/arch/amd64/bignum_modsub.S
 ASM_X86_64_MACOSX += bn/arch/amd64/bignum_mul.S
+ASM_X86_64_MACOSX += bn/arch/amd64/bignum_mul_4_8.S
 ASM_X86_64_MACOSX += bn/arch/amd64/bignum_mul_4_8_alt.S
+ASM_X86_64_MACOSX += bn/arch/amd64/bignum_mul_6_12.S
+ASM_X86_64_MACOSX += bn/arch/amd64/bignum_mul_6_12_alt.S
+ASM_X86_64_MACOSX += bn/arch/amd64/bignum_mul_8_16.S
 ASM_X86_64_MACOSX += bn/arch/amd64/bignum_mul_8_16_alt.S
 ASM_X86_64_MACOSX += bn/arch/amd64/bignum_sqr.S
+ASM_X86_64_MACOSX += bn/arch/amd64/bignum_sqr_4_8.S
 ASM_X86_64_MACOSX += bn/arch/amd64/bignum_sqr_4_8_alt.S
+ASM_X86_64_MACOSX += bn/arch/amd64/bignum_sqr_6_12.S
+ASM_X86_64_MACOSX += bn/arch/amd64/bignum_sqr_6_12_alt.S
+ASM_X86_64_MACOSX += bn/arch/amd64/bignum_sqr_8_16.S
 ASM_X86_64_MACOSX += bn/arch/amd64/bignum_sqr_8_16_alt.S
 ASM_X86_64_MACOSX += bn/arch/amd64/bignum_sub.S
 ASM_X86_64_MACOSX += bn/arch/amd64/word_clz.S
-ASM_X86_64_MACOSX += bn/arch/amd64/bn_arch.c
 
 EXTRA_DIST += $(ASM_X86_64_MACOSX)
 
 if HOST_ASM_MACOSX_X86_64
-libcrypto_la_CPPFLAGS += -DAES_ASM
-libcrypto_la_CPPFLAGS += -DBSAES_ASM
-libcrypto_la_CPPFLAGS += -DVPAES_ASM
-libcrypto_la_CPPFLAGS += -DHAVE_AES_CBC_ENCRYPT_INTERNAL
-libcrypto_la_CPPFLAGS += -DHAVE_AES_SET_ENCRYPT_KEY_INTERNAL
-libcrypto_la_CPPFLAGS += -DHAVE_AES_SET_DECRYPT_KEY_INTERNAL
-libcrypto_la_CPPFLAGS += -DHAVE_AES_ENCRYPT_INTERNAL
-libcrypto_la_CPPFLAGS += -DHAVE_AES_DECRYPT_INTERNAL
-libcrypto_la_CPPFLAGS += -DOPENSSL_IA32_SSE2
+libcrypto_la_SOURCES += aes/aes_amd64.c
+libcrypto_la_SOURCES += bn/arch/amd64/bn_arch.c
+libcrypto_la_SOURCES += modes/gcm128_amd64.c
+
+libcrypto_la_CPPFLAGS += -DLIBRESSL_USE_AES_ASSEMBLY
+libcrypto_la_CPPFLAGS += -DLIBRESSL_USE_BN_ASSEMBLY
+libcrypto_la_CPPFLAGS += -DLIBRESSL_USE_GCM_ASSEMBLY
+libcrypto_la_CPPFLAGS += -DLIBRESSL_USE_RC4_ASSEMBLY
+
 libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT
 libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT5
-libcrypto_la_CPPFLAGS += -DMD5_ASM
-libcrypto_la_CPPFLAGS += -DGHASH_ASM
-libcrypto_la_CPPFLAGS += -DRSA_ASM
-libcrypto_la_CPPFLAGS += -DSHA1_ASM
-libcrypto_la_CPPFLAGS += -DSHA256_ASM
-libcrypto_la_CPPFLAGS += -DSHA512_ASM
-libcrypto_la_CPPFLAGS += -DWHIRLPOOL_ASM
-libcrypto_la_CPPFLAGS += -DOPENSSL_CPUID_OBJ
+
 libcrypto_la_SOURCES += $(ASM_X86_64_MACOSX)
 endif
diff --git a/crypto/Makefile.am.masm-x86_64 b/crypto/Makefile.am.masm-x86_64
index 7da3cc2..249f86b 100644
--- a/crypto/Makefile.am.masm-x86_64
+++ b/crypto/Makefile.am.masm-x86_64
@@ -1,40 +1,25 @@
 
 ASM_X86_64_MASM = aes/aes-masm-x86_64.S
-ASM_X86_64_MASM += aes/bsaes-masm-x86_64.S
-ASM_X86_64_MASM += aes/vpaes-masm-x86_64.S
 ASM_X86_64_MASM += aes/aesni-masm-x86_64.S
 ASM_X86_64_MASM += bn/modexp512-masm-x86_64.S
 ASM_X86_64_MASM += bn/mont-masm-x86_64.S
 ASM_X86_64_MASM += bn/mont5-masm-x86_64.S
-ASM_X86_64_MASM += md5/md5-masm-x86_64.S
 ASM_X86_64_MASM += modes/ghash-masm-x86_64.S
 ASM_X86_64_MASM += rc4/rc4-masm-x86_64.S
-ASM_X86_64_MASM += sha/sha1-masm-x86_64.S
-ASM_X86_64_MASM += sha/sha256-masm-x86_64.S
-ASM_X86_64_MASM += sha/sha512-masm-x86_64.S
-ASM_X86_64_MASM += cpuid-masm-x86_64.S
 
 EXTRA_DIST += $(ASM_X86_64_MASM)
 
 if HOST_ASM_MASM_X86_64
-libcrypto_la_CPPFLAGS += -DAES_ASM
-libcrypto_la_CPPFLAGS += -DBSAES_ASM
-libcrypto_la_CPPFLAGS += -DVPAES_ASM
-libcrypto_la_CPPFLAGS += -DHAVE_AES_CBC_ENCRYPT_INTERNAL
-libcrypto_la_CPPFLAGS += -DHAVE_AES_SET_ENCRYPT_KEY_INTERNAL
-libcrypto_la_CPPFLAGS += -DHAVE_AES_SET_DECRYPT_KEY_INTERNAL
-libcrypto_la_CPPFLAGS += -DHAVE_AES_ENCRYPT_INTERNAL
-libcrypto_la_CPPFLAGS += -DHAVE_AES_DECRYPT_INTERNAL
-libcrypto_la_CPPFLAGS += -DOPENSSL_IA32_SSE2
+libcrypto_la_SOURCES += aes/aes_amd64.c
+libcrypto_la_SOURCES += modes/gcm128_amd64.c
+
+libcrypto_la_CPPFLAGS += -DLIBRESSL_USE_AES_ASSEMBLY
+libcrypto_la_CPPFLAGS += -DLIBRESSL_USE_BN_ASSEMBLY
+libcrypto_la_CPPFLAGS += -DLIBRESSL_USE_GCM_ASSEMBLY
+libcrypto_la_CPPFLAGS += -DLIBRESSL_USE_RC4_ASSEMBLY
+
 libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT
 libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT5
-libcrypto_la_CPPFLAGS += -DMD5_ASM
-libcrypto_la_CPPFLAGS += -DGHASH_ASM
-libcrypto_la_CPPFLAGS += -DRSA_ASM
-libcrypto_la_CPPFLAGS += -DSHA1_ASM
-libcrypto_la_CPPFLAGS += -DSHA256_ASM
-libcrypto_la_CPPFLAGS += -DSHA512_ASM
-libcrypto_la_CPPFLAGS += -DWHIRLPOOL_ASM
-libcrypto_la_CPPFLAGS += -DOPENSSL_CPUID_OBJ
+
 libcrypto_la_SOURCES += $(ASM_X86_64_MASM)
 endif
diff --git a/crypto/Makefile.am.mingw64-x86_64 b/crypto/Makefile.am.mingw64-x86_64
index 7d0d3f7..e725a05 100644
--- a/crypto/Makefile.am.mingw64-x86_64
+++ b/crypto/Makefile.am.mingw64-x86_64
@@ -1,41 +1,27 @@
 
 ASM_X86_64_MINGW64 = aes/aes-mingw64-x86_64.S
-ASM_X86_64_MINGW64 += aes/bsaes-mingw64-x86_64.S
-ASM_X86_64_MINGW64 += aes/vpaes-mingw64-x86_64.S
 ASM_X86_64_MINGW64 += aes/aesni-mingw64-x86_64.S
 #ASM_X86_64_MINGW64 += bn/modexp512-mingw64-x86_64.S
 #ASM_X86_64_MINGW64 += bn/mont-mingw64-x86_64.S
 #ASM_X86_64_MINGW64 += bn/mont5-mingw64-x86_64.S
-ASM_X86_64_MINGW64 += md5/md5-mingw64-x86_64.S
 ASM_X86_64_MINGW64 += modes/ghash-mingw64-x86_64.S
 ASM_X86_64_MINGW64 += rc4/rc4-mingw64-x86_64.S
-ASM_X86_64_MINGW64 += sha/sha1-mingw64-x86_64.S
-ASM_X86_64_MINGW64 += sha/sha256-mingw64-x86_64.S
-ASM_X86_64_MINGW64 += sha/sha512-mingw64-x86_64.S
-ASM_X86_64_MINGW64 += cpuid-mingw64-x86_64.S
 
 EXTRA_DIST += $(ASM_X86_64_MINGW64)
 
 if HOST_ASM_MINGW64_X86_64
+libcrypto_la_SOURCES += aes/aes_amd64.c
+libcrypto_la_SOURCES += modes/gcm128_amd64.c
+
 libcrypto_la_CPPFLAGS += -Dendbr32=endbr64
-libcrypto_la_CPPFLAGS += -DAES_ASM
-libcrypto_la_CPPFLAGS += -DBSAES_ASM
-libcrypto_la_CPPFLAGS += -DVPAES_ASM
-libcrypto_la_CPPFLAGS += -DHAVE_AES_CBC_ENCRYPT_INTERNAL
-libcrypto_la_CPPFLAGS += -DHAVE_AES_SET_ENCRYPT_KEY_INTERNAL
-libcrypto_la_CPPFLAGS += -DHAVE_AES_SET_DECRYPT_KEY_INTERNAL
-libcrypto_la_CPPFLAGS += -DHAVE_AES_ENCRYPT_INTERNAL
-libcrypto_la_CPPFLAGS += -DHAVE_AES_DECRYPT_INTERNAL
-libcrypto_la_CPPFLAGS += -DOPENSSL_IA32_SSE2
+
+libcrypto_la_CPPFLAGS += -DLIBRESSL_USE_AES_ASSEMBLY
+libcrypto_la_CPPFLAGS += -DLIBRESSL_USE_BN_ASSEMBLY
+libcrypto_la_CPPFLAGS += -DLIBRESSL_USE_GCM_ASSEMBLY
+libcrypto_la_CPPFLAGS += -DLIBRESSL_USE_RC4_ASSEMBLY
+
 #libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT
 #libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT5
-libcrypto_la_CPPFLAGS += -DMD5_ASM
-libcrypto_la_CPPFLAGS += -DGHASH_ASM
-libcrypto_la_CPPFLAGS += -DRSA_ASM
-libcrypto_la_CPPFLAGS += -DSHA1_ASM
-libcrypto_la_CPPFLAGS += -DSHA256_ASM
-libcrypto_la_CPPFLAGS += -DSHA512_ASM
-libcrypto_la_CPPFLAGS += -DWHIRLPOOL_ASM
-libcrypto_la_CPPFLAGS += -DOPENSSL_CPUID_OBJ
+
 libcrypto_la_SOURCES += $(ASM_X86_64_MINGW64)
 endif
diff --git a/crypto/arch/aarch64/crypto_cpu_caps_darwin.c b/crypto/arch/aarch64/crypto_cpu_caps_darwin.c
new file mode 100644
index 0000000..1dd91b2
--- /dev/null
+++ b/crypto/arch/aarch64/crypto_cpu_caps_darwin.c
@@ -0,0 +1,60 @@
+/* $OpenBSD: crypto_cpu_caps.c,v 1.2 2024/11/12 13:52:31 jsing Exp $ */
+/*
+ * Copyright (c) 2025 Brent Cook <bcook@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <sys/sysctl.h>
+
+#include "crypto_arch.h"
+
+/* Machine dependent CPU capabilities. */
+uint64_t crypto_cpu_caps_aarch64;
+
+static uint64_t
+check_cpu_cap(const char *cap_name, uint64_t cap_flag)
+{
+        int has_cap = 0;
+        size_t len = sizeof(has_cap);
+
+        sysctlbyname(cap_name, &has_cap, &len, NULL, 0);
+
+        return has_cap ? cap_flag : 0;
+}
+
+void
+crypto_cpu_caps_init(void)
+{
+        crypto_cpu_caps_aarch64 = 0;
+
+        /* from https://developer.apple.com/documentation/kernel/1387446-sysctlbyname/determining_instruction_set_characteristics#3918855 */
+
+        crypto_cpu_caps_aarch64 |= check_cpu_cap("hw.optional.arm.FEAT_AES",
+                CRYPTO_CPU_CAPS_AARCH64_AES);
+
+        crypto_cpu_caps_aarch64 |= check_cpu_cap("hw.optional.arm.FEAT_PMULL",
+                CRYPTO_CPU_CAPS_AARCH64_PMULL);
+
+        crypto_cpu_caps_aarch64 |= check_cpu_cap("hw.optional.arm.FEAT_SHA1",
+                CRYPTO_CPU_CAPS_AARCH64_SHA1);
+
+        crypto_cpu_caps_aarch64 |= check_cpu_cap("hw.optional.arm.FEAT_SHA256",
+                CRYPTO_CPU_CAPS_AARCH64_SHA2);
+
+        crypto_cpu_caps_aarch64 |= check_cpu_cap("hw.optional.arm.FEAT_SHA512",
+                CRYPTO_CPU_CAPS_AARCH64_SHA512);
+
+        crypto_cpu_caps_aarch64 |= check_cpu_cap("hw.optional.arm.FEAT_SHA3",
+                CRYPTO_CPU_CAPS_AARCH64_SHA3);
+}
diff --git a/crypto/arch/aarch64/crypto_cpu_caps_linux.c b/crypto/arch/aarch64/crypto_cpu_caps_linux.c
new file mode 100644
index 0000000..ae28120
--- /dev/null
+++ b/crypto/arch/aarch64/crypto_cpu_caps_linux.c
@@ -0,0 +1,62 @@
+/* $OpenBSD: crypto_cpu_caps.c,v 1.2 2024/11/12 13:52:31 jsing Exp $ */
+/*
+ * Copyright (c) 2025 Brent Cook <bcook@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <sys/auxv.h>
+
+/* from arch/arm64/include/uapi/asm/hwcap.h */
+#define HWCAP_AES       (1 << 3)
+#define HWCAP_PMULL     (1 << 4)
+#define HWCAP_SHA1      (1 << 5)
+#define HWCAP_SHA2      (1 << 6)
+#define HWCAP_CRC32     (1 << 7)
+#define HWCAP_SHA3      (1 << 17)
+#define HWCAP_SHA512    (1 << 21)
+
+#include "crypto_arch.h"
+
+/* Machine dependent CPU capabilities. */
+uint64_t crypto_cpu_caps_aarch64;
+
+static uint64_t
+check_cpu_cap(unsigned long hwcap, uint64_t cap_flag)
+{
+        return (getauxval(AT_HWCAP) & hwcap) ? cap_flag : 0;
+}
+
+void
+crypto_cpu_caps_init(void)
+{
+        crypto_cpu_caps_aarch64 = 0;
+
+        crypto_cpu_caps_aarch64 |= check_cpu_cap(HWCAP_AES,
+                CRYPTO_CPU_CAPS_AARCH64_AES);
+
+        crypto_cpu_caps_aarch64 |= check_cpu_cap(HWCAP_PMULL,
+                CRYPTO_CPU_CAPS_AARCH64_PMULL);
+
+        crypto_cpu_caps_aarch64 |= check_cpu_cap(HWCAP_SHA1,
+                CRYPTO_CPU_CAPS_AARCH64_SHA1);
+
+        crypto_cpu_caps_aarch64 |= check_cpu_cap(HWCAP_SHA2,
+                CRYPTO_CPU_CAPS_AARCH64_SHA2);
+
+        crypto_cpu_caps_aarch64 |= check_cpu_cap(HWCAP_SHA512,
+                CRYPTO_CPU_CAPS_AARCH64_SHA512);
+
+        crypto_cpu_caps_aarch64 |= check_cpu_cap(HWCAP_SHA3,
+                CRYPTO_CPU_CAPS_AARCH64_SHA3);
+}
diff --git a/crypto/arch/aarch64/crypto_cpu_caps_none.c b/crypto/arch/aarch64/crypto_cpu_caps_none.c
new file mode 100644
index 0000000..dcd96b7
--- /dev/null
+++ b/crypto/arch/aarch64/crypto_cpu_caps_none.c
@@ -0,0 +1,26 @@
+/*
+ * Copyright (c) 2025 Brent Cook <bcook@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "crypto_arch.h"
+
+/* Machine dependent CPU capabilities. */
+uint64_t crypto_cpu_caps_aarch64;
+
+void
+crypto_cpu_caps_init(void)
+{
+        crypto_cpu_caps_aarch64 = 0;
+}
diff --git a/crypto/arch/aarch64/crypto_cpu_caps_windows.c b/crypto/arch/aarch64/crypto_cpu_caps_windows.c
new file mode 100644
index 0000000..e7cdded
--- /dev/null
+++ b/crypto/arch/aarch64/crypto_cpu_caps_windows.c
@@ -0,0 +1,36 @@
+/* $OpenBSD: crypto_cpu_caps.c,v 1.2 2024/11/12 13:52:31 jsing Exp $ */
+/*
+ * Copyright (c) 2025 Brent Cook <bcook@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <windows.h>
+
+#include "crypto_arch.h"
+
+/* Machine dependent CPU capabilities. */
+uint64_t crypto_cpu_caps_aarch64;
+
+void
+crypto_cpu_caps_init(void)
+{
+        crypto_cpu_caps_aarch64 = 0;
+
+        if (IsProcessorFeaturePresent(PF_ARM_V8_CRYPTO_INSTRUCTIONS_AVAILABLE)) {
+                crypto_cpu_caps_aarch64 |= CRYPTO_CPU_CAPS_AARCH64_AES;
+                crypto_cpu_caps_aarch64 |= CRYPTO_CPU_CAPS_AARCH64_PMULL;
+                crypto_cpu_caps_aarch64 |= CRYPTO_CPU_CAPS_AARCH64_SHA1;
+                crypto_cpu_caps_aarch64 |= CRYPTO_CPU_CAPS_AARCH64_SHA2;
+        }
+}
diff --git a/crypto/arch/loongarch64/crypto_arch.h b/crypto/arch/loongarch64/crypto_arch.h
new file mode 100644
index 0000000..a3dd98d
--- /dev/null
+++ b/crypto/arch/loongarch64/crypto_arch.h
@@ -0,0 +1,21 @@
+/*      $OpenBSD: crypto_arch.h,v 1.1 2024/08/11 13:02:39 jsing Exp $ */
+/*
+ * Copyright (c) 2024 Joel Sing <jsing@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef HEADER_CRYPTO_ARCH_H
+#define HEADER_CRYPTO_ARCH_H
+
+#endif
diff --git a/crypto/arch/mips/crypto_arch.h b/crypto/arch/mips/crypto_arch.h
new file mode 100644
index 0000000..274879c
--- /dev/null
+++ b/crypto/arch/mips/crypto_arch.h
@@ -0,0 +1,21 @@
+/*      $OpenBSD$ */
+/*
+ * Copyright (c) 2024 Joel Sing <jsing@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef HEADER_CRYPTO_ARCH_H
+#define HEADER_CRYPTO_ARCH_H
+
+#endif
diff --git a/crypto/bn/arch/loongarch64/bn_arch.h b/crypto/bn/arch/loongarch64/bn_arch.h
new file mode 100644
index 0000000..672ac12
--- /dev/null
+++ b/crypto/bn/arch/loongarch64/bn_arch.h
@@ -0,0 +1,23 @@
+/*      $OpenBSD: bn_arch.h,v 1.7 2023/07/09 10:37:32 jsing Exp $ */
+/*
+ * Copyright (c) 2023 Joel Sing <jsing@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <openssl/bn.h>
+
+#ifndef HEADER_BN_ARCH_H
+#define HEADER_BN_ARCH_H
+
+#endif
diff --git a/crypto/compat/.gitignore b/crypto/compat/.gitignore
new file mode 100644
index 0000000..7f05049
--- /dev/null
+++ b/crypto/compat/.gitignore
@@ -0,0 +1,31 @@
+arc4random.c
+arc4random_aix.h
+arc4random_freebsd.h
+arc4random_hpux.h
+arc4random_linux.h
+arc4random_netbsd.h
+arc4random_osx.h
+arc4random_solaris.h
+arc4random_uniform.c
+arc4random_win.h
+chacha_private.h
+explicit_bzero.c
+getentropy_aix.c
+getentropy_freebsd.c
+getentropy_hpux.c
+getentropy_linux.c
+getentropy_netbsd.c
+getentropy_osx.c
+getentropy_solaris.c
+getentropy_win.c
+reallocarray.c
+recallocarray.c
+strcasecmp.c
+strlcat.c
+strlcpy.c
+strndup.c
+strnlen.c
+strsep.c
+strtonum.c
+timingsafe_bcmp.c
+timingsafe_memcmp.c
diff --git a/crypto/compat/b_win.c b/crypto/compat/b_win.c
index e261cd2..45af839 100644
--- a/crypto/compat/b_win.c
+++ b/crypto/compat/b_win.c
@@ -8,7 +8,8 @@
 #include <ws2tcpip.h>
 
 #include <openssl/bio.h>
-#include <openssl/err.h>
+
+#include "err_local.h"
 
 int
 BIO_sock_init(void)
@@ -29,7 +30,7 @@ BIO_sock_init(void)
                 }
                 wsa_init_done = 1;
         }
-        return (1);
+        return (1);
 }
 
 void
diff --git a/tls/compat/ftruncate.c b/crypto/compat/ftruncate.c
index e825e50..e825e50 100644
--- a/tls/compat/ftruncate.c
+++ b/crypto/compat/ftruncate.c
diff --git a/crypto/compat/getdelim.c b/crypto/compat/getdelim.c
new file mode 100644
index 0000000..caec3f2
--- /dev/null
+++ b/crypto/compat/getdelim.c
@@ -0,0 +1,78 @@
+/*-
+ * Copyright (c) 2011 The NetBSD Foundation, Inc.
+ * All rights reserved.
+ *
+ * This code is derived from software contributed to The NetBSD Foundation
+ * by Christos Zoulas.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
+ * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+
+#ifndef HAVE_GETDELIM
+
+ssize_t
+getdelim(char **buf, size_t *bufsiz, int delimiter, FILE *fp)
+{
+        char *ptr, *eptr;
+
+
+        if (*buf == NULL || *bufsiz == 0) {
+                *bufsiz = BUFSIZ;
+                if ((*buf = malloc(*bufsiz)) == NULL)
+                        return -1;
+        }
+
+        for (ptr = *buf, eptr = *buf + *bufsiz;;) {
+                int c = fgetc(fp);
+                if (c == -1) {
+                        if (feof(fp)) {
+                                ssize_t diff = (ssize_t)(ptr - *buf);
+                                if (diff != 0) {
+                                        *ptr = '\0';
+                                        return diff;
+                                }
+                        }
+                        return -1;
+                }
+                *ptr++ = c;
+                if (c == delimiter) {
+                        *ptr = '\0';
+                        return ptr - *buf;
+                }
+                if (ptr + 2 >= eptr) {
+                        char *nbuf;
+                        size_t nbufsiz = *bufsiz * 2;
+                        ssize_t d = ptr - *buf;
+                        if ((nbuf = realloc(*buf, nbufsiz)) == NULL)
+                                return -1;
+                        *buf = nbuf;
+                        *bufsiz = nbufsiz;
+                        eptr = nbuf + nbufsiz;
+                        ptr = nbuf + d;
+                }
+        }
+}
+
+#endif /* HAVE_GETDELIM */
diff --git a/crypto/compat/getline.c b/crypto/compat/getline.c
new file mode 100644
index 0000000..e6ecde0
--- /dev/null
+++ b/crypto/compat/getline.c
@@ -0,0 +1,40 @@
+/*-
+ * Copyright (c) 2011 The NetBSD Foundation, Inc.
+ * All rights reserved.
+ *
+ * This code is derived from software contributed to The NetBSD Foundation
+ * by Christos Zoulas.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
+ * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <stdio.h>
+
+#ifndef HAVE_GETLINE
+
+ssize_t
+getline(char **buf, size_t *bufsiz, FILE *fp)
+{
+        return getdelim(buf, bufsiz, '\n', fp);
+}
+
+#endif /* HAVE_GETLINE */
diff --git a/crypto/compat/posix_win.c b/crypto/compat/posix_win.c
index bb3e653..572e527 100644
--- a/crypto/compat/posix_win.c
+++ b/crypto/compat/posix_win.c
@@ -9,6 +9,8 @@
 
 #define NO_REDEF_POSIX_FUNCTIONS
 
+#include <sys/time.h>
+
 #include <ws2tcpip.h>
 #include <windows.h>
 
@@ -20,6 +22,25 @@
 #include <string.h>
 #include <unistd.h>
 
+#include <sys/stat.h>
+
+static int
+is_socket(int fd)
+{
+        // Border case: Don't break std* file descriptors
+        if (fd < 3)
+                return 0;
+
+        // All locally-allocated file descriptors will have the high bit set
+        return (fd & 0x80000000) == 0;
+}
+
+static int
+get_real_fd(int fd)
+{
+        return (fd & 0x7fffffff);
+}
+
 void
 posix_perror(const char *s)
 {
@@ -42,6 +63,12 @@ posix_fopen(const char *path, const char *mode)
 }
 
 int
+libressl_fstat(int fd, struct stat *statbuf)
+{
+        return fstat(get_real_fd(fd), statbuf);
+}
+
+int
 posix_open(const char *path, ...)
 {
         va_list ap;
@@ -60,7 +87,11 @@ posix_open(const char *path, ...)
                 flags |= O_NOINHERIT;
         }
         flags &= ~O_NONBLOCK;
-        return open(path, flags, mode);
+
+        const int fh = open(path, flags, mode);
+
+        // Set high bit to mark file descriptor as a file handle
+        return fh + 0x80000000;
 }
 
 char *
@@ -148,52 +179,6 @@ wsa_errno(int err)
         return -1;
 }
 
-/*
- * Employ a similar trick to cpython (pycore_fileutils.h) where the CRT report
- * handler is disabled while checking if a descriptor is a socket or a file
- */
-#if defined _MSC_VER && _MSC_VER >= 1900
-
-#include <crtdbg.h>
-#include <stdlib.h>
-
-static void noop_handler(const wchar_t *expression,     const wchar_t *function,
-    const wchar_t *file, unsigned int line, uintptr_t pReserved)
-{
-        return;
-}
-
-#define BEGIN_SUPPRESS_IPH \
-        const int old_report_mode = _CrtSetReportMode(_CRT_ASSERT, 0); \
-        const _invalid_parameter_handler old_handler = _set_thread_local_invalid_parameter_handler(noop_handler)
-#define END_SUPPRESS_IPH \
-        (void)old_report_mode; /* Silence warning in release mode when _CrtSetReportMode compiles to void. */ \
-        _CrtSetReportMode(_CRT_ASSERT, old_report_mode); \
-        _set_thread_local_invalid_parameter_handler(old_handler)
-
-#else
-
-#define BEGIN_SUPPRESS_IPH
-#define END_SUPPRESS_IPH
-
-#endif
-
-static int
-is_socket(int fd)
-{
-        intptr_t hd;
-
-        BEGIN_SUPPRESS_IPH;
-        hd = _get_osfhandle(fd);
-        END_SUPPRESS_IPH;
-
-        if (hd == (intptr_t)INVALID_HANDLE_VALUE) {
-                return 1; /* fd is not file descriptor */
-        }
-
-        return 0;
-}
-
 int
 posix_connect(int sockfd, const struct sockaddr *addr, socklen_t addrlen)
 {
@@ -207,14 +192,13 @@ int
 posix_close(int fd)
 {
         int rc;
-
         if (is_socket(fd)) {
                 if ((rc = closesocket(fd)) == SOCKET_ERROR) {
                         int err = WSAGetLastError();
                         rc = wsa_errno(err);
                 }
         } else {
-                rc = close(fd);
+                rc = close(get_real_fd(fd));
         }
         return rc;
 }
@@ -223,14 +207,13 @@ ssize_t
 posix_read(int fd, void *buf, size_t count)
 {
         ssize_t rc;
-
         if (is_socket(fd)) {
                 if ((rc = recv(fd, buf, count, 0)) == SOCKET_ERROR) {
                         int err = WSAGetLastError();
                         rc = wsa_errno(err);
                 }
         } else {
-                rc = read(fd, buf, count);
+                rc = read(get_real_fd(fd), buf, count);
         }
         return rc;
 }
@@ -244,7 +227,7 @@ posix_write(int fd, const void *buf, size_t count)
                         rc = wsa_errno(WSAGetLastError());
                 }
         } else {
-                rc = write(fd, buf, count);
+                rc = write(get_real_fd(fd), buf, count);
         }
         return rc;
 }
@@ -289,7 +272,7 @@ uid_t getuid(void)
 
 #ifdef _MSC_VER
 struct timezone;
-int gettimeofday(struct timeval * tp, struct timezone * tzp)
+int gettimeofday(struct timeval *tp, void *tzp)
 {
         /*
          * Note: some broken versions only have 8 trailing zero's, the correct
@@ -306,7 +289,7 @@ int gettimeofday(struct timeval * tp, struct timezone * tzp)
         time = ((uint64_t)file_time.dwLowDateTime);
         time += ((uint64_t)file_time.dwHighDateTime) << 32;
 
-        tp->tv_sec = (long)((time - EPOCH) / 10000000L);
+        tp->tv_sec = (long long)((time - EPOCH) / 10000000L);
         tp->tv_usec = (long)(system_time.wMilliseconds * 1000);
         return 0;
 }
diff --git a/crypto/compat/ui_openssl_win.c b/crypto/compat/ui_openssl_win.c
index 09705e4..4ae2c5d 100644
--- a/crypto/compat/ui_openssl_win.c
+++ b/crypto/compat/ui_openssl_win.c
@@ -146,7 +146,7 @@ static int echo_console(UI *ui);
 static int noecho_console(UI *ui);
 static int close_console(UI *ui);
 
-static UI_METHOD ui_openssl = {
+static const UI_METHOD ui_openssl = {
         .name = "OpenSSL default user interface",
         .ui_open_session = open_console,
         .ui_write_string = write_string,
@@ -155,7 +155,7 @@ static UI_METHOD ui_openssl = {
 };
 
 /* The method with all the built-in thingies */
-UI_METHOD *
+const UI_METHOD *
 UI_OpenSSL(void)
 {
         return &ui_openssl;
diff --git a/dist.sh b/dist.sh
index e367038..9c4d35d 100755
--- a/dist.sh
+++ b/dist.sh
@@ -1,4 +1,19 @@
 #!/bin/sh
+#
+# Copyright (c) 2014 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+#
 set -e
 
 rm -f man/*.[35] include/openssl/*.h
diff --git a/gen-coverage-report.sh b/gen-coverage-report.sh
index b11f3f9..6453ecb 100755
--- a/gen-coverage-report.sh
+++ b/gen-coverage-report.sh
@@ -1,3 +1,18 @@
+#
+# Copyright (c) 2014 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+#
 #!/bin/sh
 
 VERSION=$(cat VERSION)
diff --git a/include/CMakeLists.txt b/include/CMakeLists.txt
index 9d015cd..4802d13 100644
--- a/include/CMakeLists.txt
+++ b/include/CMakeLists.txt
@@ -1,13 +1,25 @@
+#
+# Copyright (c) 2016 Jeff Davey
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 if(ENABLE_LIBRESSL_INSTALL)
         install(DIRECTORY .
                 DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}
                 PATTERN "CMakeLists.txt" EXCLUDE
                 PATTERN "compat" EXCLUDE
                 PATTERN "pqueue.h" EXCLUDE
-                PATTERN "Makefile*" EXCLUDE
-                PATTERN "arch" EXCLUDE)
-        install(FILES ${CMAKE_BINARY_DIR}/include/openssl/opensslconf.h
-                DESTINATION "${CMAKE_INSTALL_INCLUDEDIR}/openssl")
+                PATTERN "Makefile*" EXCLUDE)
 endif(ENABLE_LIBRESSL_INSTALL)
 
 file(COPY .
@@ -17,26 +29,3 @@ file(COPY .
         PATTERN "pqueue.h" EXCLUDE
         PATTERN "Makefile*" EXCLUDE
         PATTERN "arch" EXCLUDE)
-
-if(HOST_AARCH64)
-        file(READ arch/aarch64/opensslconf.h OPENSSLCONF)
-elseif(HOST_ARM)
-        file(READ arch/arm/opensslconf.h OPENSSLCONF)
-elseif(HOST_I386)
-        file(READ arch/i386/opensslconf.h OPENSSLCONF)
-elseif(HOST_MIPS)
-        file(READ arch/mips/opensslconf.h OPENSSLCONF)
-elseif(HOST_MIPS64)
-        file(READ arch/mips64/opensslconf.h OPENSSLCONF)
-elseif(HOST_POWERPC)
-        file(READ arch/powerpc/opensslconf.h OPENSSLCONF)
-elseif(HOST_POWERPC64)
-        file(READ arch/powerpc64/opensslconf.h OPENSSLCONF)
-elseif(HOST_RISCV64)
-        file(READ arch/riscv64/opensslconf.h OPENSSLCONF)
-elseif(HOST_SPARC64)
-        file(READ arch/sparc64/opensslconf.h OPENSSLCONF)
-elseif(HOST_X86_64)
-        file(READ arch/amd64/opensslconf.h OPENSSLCONF)
-endif()
-file(WRITE ${CMAKE_BINARY_DIR}/include/openssl/opensslconf.h "${OPENSSLCONF}")
diff --git a/include/Makefile.am b/include/Makefile.am
index feaaa60..04c9ea2 100644
--- a/include/Makefile.am
+++ b/include/Makefile.am
@@ -1,3 +1,18 @@
+#
+# Copyright (c) 2014 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 include $(top_srcdir)/Makefile.am.common
 
 EXTRA_DIST = CMakeLists.txt
@@ -46,19 +61,4 @@ noinst_HEADERS += compat/sys/time.h
 noinst_HEADERS += compat/sys/types.h
 noinst_HEADERS += compat/sys/uio.h
 
-noinst_HEADERS += arch/aarch64/opensslconf.h
-noinst_HEADERS += arch/alpha/opensslconf.h
-noinst_HEADERS += arch/amd64/opensslconf.h
-noinst_HEADERS += arch/arm/opensslconf.h
-noinst_HEADERS += arch/hppa/opensslconf.h
-noinst_HEADERS += arch/i386/opensslconf.h
-noinst_HEADERS += arch/m88k/opensslconf.h
-noinst_HEADERS += arch/mips/opensslconf.h
-noinst_HEADERS += arch/mips64/opensslconf.h
-noinst_HEADERS += arch/powerpc/opensslconf.h
-noinst_HEADERS += arch/powerpc64/opensslconf.h
-noinst_HEADERS += arch/riscv64/opensslconf.h
-noinst_HEADERS += arch/sh/opensslconf.h
-noinst_HEADERS += arch/sparc64/opensslconf.h
-
 include_HEADERS = tls.h
diff --git a/include/arch/mips/opensslconf.h b/include/arch/mips/opensslconf.h
deleted file mode 100644
index f17d3d2..0000000
--- a/include/arch/mips/opensslconf.h
+++ /dev/null
@@ -1,154 +0,0 @@
-#include <openssl/opensslfeatures.h>
-/* crypto/opensslconf.h.in */
-
-#if defined(HEADER_CRYPTLIB_H) && !defined(OPENSSLDIR)
-#define OPENSSLDIR "/etc/ssl"
-#endif
-
-#undef OPENSSL_UNISTD
-#define OPENSSL_UNISTD <unistd.h>
-
-#undef OPENSSL_EXPORT_VAR_AS_FUNCTION
-
-#if defined(HEADER_IDEA_H) && !defined(IDEA_INT)
-#define IDEA_INT unsigned int
-#endif
-
-#if defined(HEADER_MD2_H) && !defined(MD2_INT)
-#define MD2_INT unsigned int
-#endif
-
-#if defined(HEADER_RC2_H) && !defined(RC2_INT)
-/* I need to put in a mod for the alpha - eay */
-#define RC2_INT unsigned int
-#endif
-
-#if defined(HEADER_RC4_H)
-#if !defined(RC4_INT)
-/* using int types make the structure larger but make the code faster
- * on most boxes I have tested - up to %20 faster. */
-/*
- * I don't know what does "most" mean, but declaring "int" is a must on:
- * - Intel P6 because partial register stalls are very expensive;
- * - elder Alpha because it lacks byte load/store instructions;
- */
-#define RC4_INT unsigned int
-#endif
-#if !defined(RC4_CHUNK)
-/*
- * This enables code handling data aligned at natural CPU word
- * boundary. See crypto/rc4/rc4_enc.c for further details.
- */
-#undef RC4_CHUNK
-#endif
-#endif
-
-#if (defined(HEADER_NEW_DES_H) || defined(HEADER_DES_H)) && !defined(DES_LONG)
-/* If this is set to 'unsigned int' on a DEC Alpha, this gives about a
- * %20 speed up (longs are 8 bytes, int's are 4). */
-#ifndef DES_LONG
-#define DES_LONG unsigned int
-#endif
-#endif
-
-#if defined(HEADER_BN_H) && !defined(CONFIG_HEADER_BN_H)
-#define CONFIG_HEADER_BN_H
-#define BN_LLONG
-
-/* Should we define BN_DIV2W here? */
-
-/* Only one for the following should be defined */
-/* The prime number generation stuff may not work when
- * EIGHT_BIT but I don't care since I've only used this mode
- * for debugging the bignum libraries */
-#undef SIXTY_FOUR_BIT_LONG
-#undef SIXTY_FOUR_BIT
-#define THIRTY_TWO_BIT
-#undef SIXTEEN_BIT
-#undef EIGHT_BIT
-#endif
-
-#if defined(HEADER_RC4_LOCL_H) && !defined(CONFIG_HEADER_RC4_LOCL_H)
-#define CONFIG_HEADER_RC4_LOCL_H
-/* if this is defined data[i] is used instead of *data, this is a %20
- * speedup on x86 */
-#define RC4_INDEX
-#endif
-
-#if defined(HEADER_BF_LOCL_H) && !defined(CONFIG_HEADER_BF_LOCL_H)
-#define CONFIG_HEADER_BF_LOCL_H
-#undef BF_PTR
-#endif /* HEADER_BF_LOCL_H */
-
-#if defined(HEADER_DES_LOCL_H) && !defined(CONFIG_HEADER_DES_LOCL_H)
-#define CONFIG_HEADER_DES_LOCL_H
-#ifndef DES_DEFAULT_OPTIONS
-/* the following is tweaked from a config script, that is why it is a
- * protected undef/define */
-#ifndef DES_PTR
-#undef DES_PTR
-#endif
-
-/* This helps C compiler generate the correct code for multiple functional
- * units.  It reduces register dependencies at the expense of 2 more
- * registers */
-#ifndef DES_RISC1
-#undef DES_RISC1
-#endif
-
-#ifndef DES_RISC2
-#undef DES_RISC2
-#endif
-
-#if defined(DES_RISC1) && defined(DES_RISC2)
-YOU SHOULD NOT HAVE BOTH DES_RISC1 AND DES_RISC2 DEFINED!!!!!
-#endif
-
-/* Unroll the inner loop, this sometimes helps, sometimes hinders.
- * Very much CPU dependent */
-#ifndef DES_UNROLL
-#define DES_UNROLL
-#endif
-
-/* These default values were supplied by
- * Peter Gutman <pgut001@cs.auckland.ac.nz>
- * They are only used if nothing else has been defined */
-#if !defined(DES_PTR) && !defined(DES_RISC1) && !defined(DES_RISC2) && !defined(DES_UNROLL)
-/* Special defines which change the way the code is built depending on the
-   CPU and OS.  For SGI machines you can use _MIPS_SZLONG (32 or 64) to find
-   even newer MIPS CPU's, but at the moment one size fits all for
-   optimization options.  Older Sparc's work better with only UNROLL, but
-   there's no way to tell at compile time what it is you're running on */
- 
-#if defined( sun )              /* Newer Sparc's */
-#  define DES_PTR
-#  define DES_RISC1
-#  define DES_UNROLL
-#elif defined( __ultrix )       /* Older MIPS */
-#  define DES_PTR
-#  define DES_RISC2
-#  define DES_UNROLL
-#elif defined( __osf1__ )       /* Alpha */
-#  define DES_PTR
-#  define DES_RISC2
-#elif defined ( _AIX )          /* RS6000 */
-  /* Unknown */
-#elif defined( __hpux )         /* HP-PA */
-  /* Unknown */
-#elif defined( __aux )          /* 68K */
-  /* Unknown */
-#elif defined( __dgux )         /* 88K (but P6 in latest boxes) */
-#  define DES_UNROLL
-#elif defined( __sgi )          /* Newer MIPS */
-#  define DES_PTR
-#  define DES_RISC2
-#  define DES_UNROLL
-#elif defined(i386) || defined(__i386__)        /* x86 boxes, should be gcc */
-#  define DES_PTR
-#  define DES_RISC1
-#  define DES_UNROLL
-#endif /* Systems-specific speed defines */
-#endif
-
-#endif /* DES_DEFAULT_OPTIONS */
-#endif /* HEADER_DES_LOCL_H */
diff --git a/include/compat/endian.h b/include/compat/endian.h
index 5376c1a..af3664d 100644
--- a/include/compat/endian.h
+++ b/include/compat/endian.h
@@ -62,7 +62,7 @@
 #endif
 #endif
 
-#if defined(__APPLE__) && !defined(HAVE_ENDIAN_H)
+#if defined(__APPLE__)
 #include <libkern/OSByteOrder.h>
 #define be16toh(x) OSSwapBigToHostInt16((x))
 #define htobe16(x) OSSwapHostToBigInt16((x))
@@ -74,7 +74,7 @@
 #define htobe64(x) OSSwapHostToBigInt64(x)
 #define le64toh(x) OSSwapLittleToHostInt64(x)
 #define be64toh(x) OSSwapBigToHostInt64(x)
-#endif /* __APPLE__ && !HAVE_ENDIAN_H */
+#endif /* __APPLE__ */
 
 #if defined(_WIN32) && !defined(HAVE_ENDIAN_H)
 #include <winsock2.h>
@@ -101,6 +101,8 @@
 #endif
 
 #define htobe64(x) ntohll((x))
+#define htole64(x) (x)
+#define le64toh(x) (x)
 #endif /* _WIN32 && !HAVE_ENDIAN_H */
 
 #ifdef __linux__
@@ -151,6 +153,8 @@
 #define htole32(x) LE_32(x)
 #define htobe32(x) BE_32(x)
 #define be64toh(x) BE_64(x)
+#define le64toh(x) LE_64(x)
+#define htole64(x) LE_64(x)
 #define htobe64(x) BE_64(x)
 #endif
 
diff --git a/include/compat/netinet/ip.h b/include/compat/netinet/ip.h
index 29f17f3..100e006 100644
--- a/include/compat/netinet/ip.h
+++ b/include/compat/netinet/ip.h
@@ -44,6 +44,10 @@
 #define IPTOS_DSCP_AF43         0x98
 #endif
 
+#ifndef IPTOS_DSCP_VA
+#define IPTOS_DSCP_VA           0xb0
+#endif
+
 #ifndef IPTOS_DSCP_EF
 #define IPTOS_DSCP_EF           0xb8
 #endif
diff --git a/include/compat/stdio.h b/include/compat/stdio.h
index 2af8f3e..2ccdeeb 100644
--- a/include/compat/stdio.h
+++ b/include/compat/stdio.h
@@ -18,6 +18,18 @@
 #include_next <stdio.h>
 #endif
 
+#ifndef HAVE_GETDELIM
+#include <sys/types.h>
+#define getdelim libressl_getdelim
+ssize_t getdelim(char **buf, size_t *bufsiz, int delimiter, FILE *fp);
+#endif
+
+#ifndef HAVE_GETLINE
+#include <sys/types.h>
+#define getline libressl_getline
+ssize_t getline(char **buf, size_t *bufsiz, FILE *fp);
+#endif
+
 #ifndef HAVE_ASPRINTF
 #include <stdarg.h>
 #define vasprintf libressl_vasprintf
diff --git a/include/compat/sys/stat.h b/include/compat/sys/stat.h
index b88da1d..57aa521 100644
--- a/include/compat/sys/stat.h
+++ b/include/compat/sys/stat.h
@@ -118,4 +118,12 @@
 
 #endif
 
+#ifdef _WIN32
+int libressl_fstat(int fd, struct stat *statbuf);
+
+#ifndef NO_REDEF_POSIX_FUNCTIONS
+#define fstat(fd, statbuf) libressl_fstat(fd, statbuf)
+#endif
+#endif
+
 #endif
diff --git a/include/compat/sys/time.h b/include/compat/sys/time.h
index 76428c1..2448969 100644
--- a/include/compat/sys/time.h
+++ b/include/compat/sys/time.h
@@ -8,6 +8,15 @@
 
 #ifdef _MSC_VER
 #include <winsock2.h>
+
+#define timeval libressl_timeval
+#define gettimeofday libressl_gettimeofday
+
+struct timeval {
+        long long       tv_sec;
+        long            tv_usec;
+};
+
 int gettimeofday(struct timeval *tp, void *tzp);
 #else
 #include_next <sys/time.h>
diff --git a/include/compat/unistd.h b/include/compat/unistd.h
index 63c07fc..544cb27 100644
--- a/include/compat/unistd.h
+++ b/include/compat/unistd.h
@@ -45,6 +45,8 @@ static inline unsigned int sleep(unsigned int seconds)
        Sleep(seconds * 1000);
        return seconds;
 }
+
+int mkstemp(char *template);
 #endif
 
 int ftruncate(int fd, off_t length);
diff --git a/include/openssl/Makefile.am.tpl b/include/openssl/Makefile.am.tpl
index 303d0b9..1bea34d 100644
--- a/include/openssl/Makefile.am.tpl
+++ b/include/openssl/Makefile.am.tpl
@@ -3,40 +3,4 @@ include $(top_srcdir)/Makefile.am.common
 if !ENABLE_LIBTLS_ONLY
 opensslincludedir=$(includedir)/openssl
 
-BUILT_SOURCES = opensslconf.h
-CLEANFILES = opensslconf.h
-
-opensslconf.h: Makefile
-        -echo "generating opensslconf.h ..."
-if HOST_AARCH64
-        -cp $(top_srcdir)/include/arch/aarch64/opensslconf.h opensslconf.h
-endif
-if HOST_ARM
-        -cp $(top_srcdir)/include/arch/arm/opensslconf.h opensslconf.h
-endif
-if HOST_I386
-        -cp $(top_srcdir)/include/arch/i386/opensslconf.h opensslconf.h
-endif
-if HOST_MIPS
-        -cp $(top_srcdir)/include/arch/mips/opensslconf.h opensslconf.h
-endif
-if HOST_MIPS64
-        -cp $(top_srcdir)/include/arch/mips64/opensslconf.h opensslconf.h
-endif
-if HOST_POWERPC
-        -cp $(top_srcdir)/include/arch/powerpc/opensslconf.h opensslconf.h
-endif
-if HOST_POWERPC64
-        -cp $(top_srcdir)/include/arch/powerpc64/opensslconf.h opensslconf.h
-endif
-if HOST_RISCV64
-        -cp $(top_srcdir)/include/arch/riscv64/opensslconf.h opensslconf.h
-endif
-if HOST_SPARC64
-        -cp $(top_srcdir)/include/arch/sparc64/opensslconf.h opensslconf.h
-endif
-if HOST_X86_64
-        -cp $(top_srcdir)/include/arch/amd64/opensslconf.h opensslconf.h
-endif
-
-opensslinclude_HEADERS = opensslconf.h
+opensslinclude_HEADERS =
diff --git a/libcrypto.pc.in b/libcrypto.pc.in
index 11d7ef0..c11fbd3 100644
--- a/libcrypto.pc.in
+++ b/libcrypto.pc.in
@@ -1,3 +1,18 @@
+#
+# Copyright (c) 2014 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+#
 #libcrypto pkg-config source file
 
 prefix=@prefix@
diff --git a/libssl.pc.in b/libssl.pc.in
index 512ec1c..9d0d641 100644
--- a/libssl.pc.in
+++ b/libssl.pc.in
@@ -1,3 +1,18 @@
+#
+# Copyright (c) 2014 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+#
 #libssl pkg-config source file
 
 prefix=@prefix@
diff --git a/libtls.pc.in b/libtls.pc.in
index 3c49391..19c8134 100644
--- a/libtls.pc.in
+++ b/libtls.pc.in
@@ -1,3 +1,18 @@
+#
+# Copyright (c) 2014 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+#
 #libtls pkg-config source file
 
 prefix=@prefix@
diff --git a/m4/check-libc.m4 b/m4/check-libc.m4
index 40df15b..eec3cb3 100644
--- a/m4/check-libc.m4
+++ b/m4/check-libc.m4
@@ -1,3 +1,18 @@
+#
+# Copyright (c) 2014 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 AC_DEFUN([CHECK_LIBC_COMPAT], [
 # Check for libc headers
 AC_CHECK_HEADERS([endian.h machine/endian.h err.h readpassphrase.h])
@@ -7,7 +22,7 @@ AC_CHECK_HEADERS([netinet/ip.h], [], [],
 ])
 AC_HEADER_RESOLV
 # Check for general libc functions
-AC_CHECK_FUNCS([asprintf freezero memmem])
+AC_CHECK_FUNCS([asprintf freezero ftruncate getdelim getline memmem])
 AC_CHECK_FUNCS([readpassphrase reallocarray recallocarray])
 AC_CHECK_FUNCS([strcasecmp strlcat strlcpy strndup strnlen strsep strtonum])
 AC_CHECK_FUNCS([timegm _mkgmtime timespecsub])
@@ -24,6 +39,9 @@ AC_CACHE_CHECK([for getpagesize], ac_cv_func_getpagesize, [
 ])
 AM_CONDITIONAL([HAVE_ASPRINTF], [test "x$ac_cv_func_asprintf" = xyes])
 AM_CONDITIONAL([HAVE_FREEZERO], [test "x$ac_cv_func_freezero" = xyes])
+AM_CONDITIONAL([HAVE_FTRUNCATE], [test "x$ac_cv_func_ftruncate" = xyes])
+AM_CONDITIONAL([HAVE_GETDELIM], [test "x$ac_cv_func_getdelim" = xyes])
+AM_CONDITIONAL([HAVE_GETLINE], [test "x$ac_cv_func_getline" = xyes])
 AM_CONDITIONAL([HAVE_GETPAGESIZE], [test "x$ac_cv_func_getpagesize" = xyes])
 AM_CONDITIONAL([HAVE_GETOPT], [test "x$ac_cv_func_getopt" = xyes])
 AM_CONDITIONAL([HAVE_MEMMEM], [test "x$ac_cv_func_memmem" = xyes])
diff --git a/m4/check-os-options.m4 b/m4/check-os-options.m4
index 91c3021..99f142e 100644
--- a/m4/check-os-options.m4
+++ b/m4/check-os-options.m4
@@ -1,3 +1,18 @@
+#
+# Copyright (c) 2014 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 AC_DEFUN([CHECK_OS_OPTIONS], [
 
 CFLAGS="$CFLAGS -Wall -std=gnu99 -fno-strict-aliasing"
@@ -133,6 +148,7 @@ char buf[1]; getentropy(buf, 1);
                 ;;
         *)
                 HOST_OS=unsupported
+                HOST_ABI=elf
                 ;;
 esac
 
diff --git a/m4/disable-compiler-warnings.m4 b/m4/disable-compiler-warnings.m4
index 2792722..052e8ab 100644
--- a/m4/disable-compiler-warnings.m4
+++ b/m4/disable-compiler-warnings.m4
@@ -1,3 +1,18 @@
+#
+# Copyright (c) 2014 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 AC_DEFUN([DISABLE_COMPILER_WARNINGS], [
 # Clang throws a lot of warnings when it does not understand a flag. Disable
 # this warning for now so other warnings are visible.
diff --git a/man/CMakeLists.txt b/man/CMakeLists.txt
index 462a831..8f1121e 100644
--- a/man/CMakeLists.txt
+++ b/man/CMakeLists.txt
@@ -1,3 +1,18 @@
+#
+# Copyright (c) 2015 Jeff Davey
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 if(ENABLE_LIBRESSL_INSTALL)
         install(DIRECTORY .
             DESTINATION ${CMAKE_INSTALL_MANDIR}/man3
diff --git a/man/links b/man/links
index c07d534..8af5588 100644
--- a/man/links
+++ b/man/links
@@ -185,9 +185,7 @@ BIO_ctrl.3,BIO_set_info_callback.3
 BIO_ctrl.3,BIO_tell.3
 BIO_ctrl.3,BIO_wpending.3
 BIO_ctrl.3,bio_info_cb.3
-BIO_dump.3,BIO_dump_fp.3
 BIO_dump.3,BIO_dump_indent.3
-BIO_dump.3,BIO_dump_indent_fp.3
 BIO_dup_chain.3,BIO_dup_state.3
 BIO_f_buffer.3,BIO_get_buffer_num_lines.3
 BIO_f_buffer.3,BIO_set_buffer_read_data.3
@@ -514,12 +512,6 @@ CONF_modules_free.3,CONF_modules_finish.3
 CONF_modules_free.3,CONF_modules_unload.3
 CONF_modules_load_file.3,CONF_modules_load.3
 CONF_modules_load_file.3,X509_get_default_cert_area.3
-CRYPTO_get_mem_functions.3,CRYPTO_MEM_LEAK_CB.3
-CRYPTO_get_mem_functions.3,CRYPTO_mem_ctrl.3
-CRYPTO_get_mem_functions.3,CRYPTO_mem_leaks.3
-CRYPTO_get_mem_functions.3,CRYPTO_mem_leaks_cb.3
-CRYPTO_get_mem_functions.3,CRYPTO_mem_leaks_fp.3
-CRYPTO_get_mem_functions.3,CRYPTO_set_mem_functions.3
 CRYPTO_lock.3,CRYPTO_add.3
 CRYPTO_lock.3,CRYPTO_r_lock.3
 CRYPTO_lock.3,CRYPTO_r_unlock.3
@@ -532,6 +524,11 @@ CRYPTO_set_ex_data.3,CRYPTO_free_ex_data.3
 CRYPTO_set_ex_data.3,CRYPTO_get_ex_data.3
 CRYPTO_set_ex_data.3,CRYPTO_get_ex_new_index.3
 CRYPTO_set_ex_data.3,CRYPTO_new_ex_data.3
+CRYPTO_set_mem_functions.3,CRYPTO_MEM_LEAK_CB.3
+CRYPTO_set_mem_functions.3,CRYPTO_mem_ctrl.3
+CRYPTO_set_mem_functions.3,CRYPTO_mem_leaks.3
+CRYPTO_set_mem_functions.3,CRYPTO_mem_leaks_cb.3
+CRYPTO_set_mem_functions.3,CRYPTO_mem_leaks_fp.3
 ChaCha.3,CRYPTO_chacha_20.3
 ChaCha.3,CRYPTO_hchacha_20.3
 ChaCha.3,CRYPTO_xchacha_20.3
@@ -645,40 +642,33 @@ ECDSA_SIG_new.3,ECDSA_size.3
 ECDSA_SIG_new.3,ECDSA_verify.3
 ECDSA_SIG_new.3,d2i_ECDSA_SIG.3
 ECDSA_SIG_new.3,i2d_ECDSA_SIG.3
-EC_GFp_simple_method.3,EC_GFp_mont_method.3
-EC_GFp_simple_method.3,EC_METHOD_get_field_type.3
-EC_GROUP_copy.3,EC_GROUP_check.3
-EC_GROUP_copy.3,EC_GROUP_check_discriminant.3
-EC_GROUP_copy.3,EC_GROUP_cmp.3
-EC_GROUP_copy.3,EC_GROUP_dup.3
-EC_GROUP_copy.3,EC_GROUP_get0_generator.3
-EC_GROUP_copy.3,EC_GROUP_get0_seed.3
-EC_GROUP_copy.3,EC_GROUP_get_asn1_flag.3
-EC_GROUP_copy.3,EC_GROUP_get_basis_type.3
-EC_GROUP_copy.3,EC_GROUP_get_cofactor.3
-EC_GROUP_copy.3,EC_GROUP_get_curve_name.3
-EC_GROUP_copy.3,EC_GROUP_get_degree.3
-EC_GROUP_copy.3,EC_GROUP_get_order.3
-EC_GROUP_copy.3,EC_GROUP_get_point_conversion_form.3
-EC_GROUP_copy.3,EC_GROUP_get_seed_len.3
-EC_GROUP_copy.3,EC_GROUP_method_of.3
-EC_GROUP_copy.3,EC_GROUP_order_bits.3
-EC_GROUP_copy.3,EC_GROUP_set_asn1_flag.3
-EC_GROUP_copy.3,EC_GROUP_set_curve_name.3
-EC_GROUP_copy.3,EC_GROUP_set_generator.3
-EC_GROUP_copy.3,EC_GROUP_set_point_conversion_form.3
-EC_GROUP_copy.3,EC_GROUP_set_seed.3
-EC_GROUP_new.3,EC_GROUP_clear_free.3
-EC_GROUP_new.3,EC_GROUP_free.3
-EC_GROUP_new.3,EC_GROUP_get_curve.3
-EC_GROUP_new.3,EC_GROUP_get_curve_GFp.3
-EC_GROUP_new.3,EC_GROUP_new_by_curve_name.3
-EC_GROUP_new.3,EC_GROUP_new_curve_GFp.3
-EC_GROUP_new.3,EC_GROUP_set_curve.3
-EC_GROUP_new.3,EC_GROUP_set_curve_GFp.3
-EC_GROUP_new.3,EC_curve_nid2nist.3
-EC_GROUP_new.3,EC_curve_nist2nid.3
-EC_GROUP_new.3,EC_get_builtin_curves.3
+EC_GROUP_check.3,EC_GROUP_check_discriminant.3
+EC_GROUP_get_curve_name.3,EC_GROUP_get0_seed.3
+EC_GROUP_get_curve_name.3,EC_GROUP_get_asn1_flag.3
+EC_GROUP_get_curve_name.3,EC_GROUP_get_basis_type.3
+EC_GROUP_get_curve_name.3,EC_GROUP_get_point_conversion_form.3
+EC_GROUP_get_curve_name.3,EC_GROUP_get_seed_len.3
+EC_GROUP_get_curve_name.3,EC_GROUP_set_asn1_flag.3
+EC_GROUP_get_curve_name.3,EC_GROUP_set_curve_name.3
+EC_GROUP_get_curve_name.3,EC_GROUP_set_point_conversion_form.3
+EC_GROUP_get_curve_name.3,EC_GROUP_set_seed.3
+EC_GROUP_new_by_curve_name.3,EC_GROUP_cmp.3
+EC_GROUP_new_by_curve_name.3,EC_GROUP_dup.3
+EC_GROUP_new_by_curve_name.3,EC_GROUP_free.3
+EC_GROUP_new_by_curve_name.3,EC_curve_nid2nist.3
+EC_GROUP_new_by_curve_name.3,EC_curve_nist2nid.3
+EC_GROUP_new_by_curve_name.3,EC_get_builtin_curves.3
+EC_GROUP_new_curve_GFp.3,EC_GROUP_clear_free.3
+EC_GROUP_new_curve_GFp.3,EC_GROUP_get0_generator.3
+EC_GROUP_new_curve_GFp.3,EC_GROUP_get_cofactor.3
+EC_GROUP_new_curve_GFp.3,EC_GROUP_get_curve.3
+EC_GROUP_new_curve_GFp.3,EC_GROUP_get_curve_GFp.3
+EC_GROUP_new_curve_GFp.3,EC_GROUP_get_degree.3
+EC_GROUP_new_curve_GFp.3,EC_GROUP_get_order.3
+EC_GROUP_new_curve_GFp.3,EC_GROUP_order_bits.3
+EC_GROUP_new_curve_GFp.3,EC_GROUP_set_curve.3
+EC_GROUP_new_curve_GFp.3,EC_GROUP_set_curve_GFp.3
+EC_GROUP_new_curve_GFp.3,EC_GROUP_set_generator.3
 EC_KEY_METHOD_new.3,EC_KEY_METHOD_free.3
 EC_KEY_METHOD_new.3,EC_KEY_METHOD_get_compute_key.3
 EC_KEY_METHOD_new.3,EC_KEY_METHOD_get_init.3
@@ -721,8 +711,6 @@ EC_KEY_new.3,EC_KEY_set_private_key.3
 EC_KEY_new.3,EC_KEY_set_public_key.3
 EC_KEY_new.3,EC_KEY_set_public_key_affine_coordinates.3
 EC_KEY_new.3,EC_KEY_up_ref.3
-EC_POINT_add.3,EC_GROUP_have_precompute_mult.3
-EC_POINT_add.3,EC_GROUP_precompute_mult.3
 EC_POINT_add.3,EC_POINT_cmp.3
 EC_POINT_add.3,EC_POINT_dbl.3
 EC_POINT_add.3,EC_POINT_invert.3
@@ -730,28 +718,21 @@ EC_POINT_add.3,EC_POINT_is_at_infinity.3
 EC_POINT_add.3,EC_POINT_is_on_curve.3
 EC_POINT_add.3,EC_POINT_make_affine.3
 EC_POINT_add.3,EC_POINT_mul.3
-EC_POINT_add.3,EC_POINTs_make_affine.3
-EC_POINT_add.3,EC_POINTs_mul.3
-EC_POINT_new.3,EC_POINT_bn2point.3
+EC_POINT_get_affine_coordinates.3,EC_POINT_get_affine_coordinates_GFp.3
+EC_POINT_get_affine_coordinates.3,EC_POINT_set_affine_coordinates.3
+EC_POINT_get_affine_coordinates.3,EC_POINT_set_affine_coordinates_GFp.3
+EC_POINT_get_affine_coordinates.3,EC_POINT_set_compressed_coordinates.3
+EC_POINT_get_affine_coordinates.3,EC_POINT_set_compressed_coordinates_GFp.3
+EC_POINT_get_affine_coordinates.3,EC_POINT_set_to_infinity.3
 EC_POINT_new.3,EC_POINT_clear_free.3
 EC_POINT_new.3,EC_POINT_copy.3
 EC_POINT_new.3,EC_POINT_dup.3
 EC_POINT_new.3,EC_POINT_free.3
-EC_POINT_new.3,EC_POINT_get_Jprojective_coordinates_GFp.3
-EC_POINT_new.3,EC_POINT_get_affine_coordinates.3
-EC_POINT_new.3,EC_POINT_get_affine_coordinates_GFp.3
-EC_POINT_new.3,EC_POINT_hex2point.3
-EC_POINT_new.3,EC_POINT_method_of.3
-EC_POINT_new.3,EC_POINT_oct2point.3
-EC_POINT_new.3,EC_POINT_point2bn.3
-EC_POINT_new.3,EC_POINT_point2hex.3
-EC_POINT_new.3,EC_POINT_point2oct.3
-EC_POINT_new.3,EC_POINT_set_Jprojective_coordinates_GFp.3
-EC_POINT_new.3,EC_POINT_set_affine_coordinates.3
-EC_POINT_new.3,EC_POINT_set_affine_coordinates_GFp.3
-EC_POINT_new.3,EC_POINT_set_compressed_coordinates.3
-EC_POINT_new.3,EC_POINT_set_compressed_coordinates_GFp.3
-EC_POINT_new.3,EC_POINT_set_to_infinity.3
+EC_POINT_point2oct.3,EC_POINT_bn2point.3
+EC_POINT_point2oct.3,EC_POINT_hex2point.3
+EC_POINT_point2oct.3,EC_POINT_oct2point.3
+EC_POINT_point2oct.3,EC_POINT_point2bn.3
+EC_POINT_point2oct.3,EC_POINT_point2hex.3
 ENGINE_new.3,ENGINE_by_id.3
 ENGINE_new.3,ENGINE_cleanup.3
 ENGINE_new.3,ENGINE_ctrl_cmd.3
@@ -791,8 +772,6 @@ ERR_load_strings.3,ERR_PACK.3
 ERR_load_strings.3,ERR_get_next_error_library.3
 ERR_print_errors.3,ERR_print_errors_cb.3
 ERR_print_errors.3,ERR_print_errors_fp.3
-ERR_put_error.3,ERR_add_error_data.3
-ERR_put_error.3,ERR_add_error_vdata.3
 ERR_remove_state.3,ERR_remove_thread_state.3
 ERR_set_mark.3,ERR_pop_to_mark.3
 ESS_SIGNING_CERT_new.3,ESS_CERT_ID_free.3
@@ -938,13 +917,6 @@ EVP_EncryptInit.3,EVP_idea_cfb.3
 EVP_EncryptInit.3,EVP_idea_cfb64.3
 EVP_EncryptInit.3,EVP_idea_ecb.3
 EVP_EncryptInit.3,EVP_idea_ofb.3
-EVP_EncryptInit.3,EVP_rc2_40_cbc.3
-EVP_EncryptInit.3,EVP_rc2_64_cbc.3
-EVP_EncryptInit.3,EVP_rc2_cbc.3
-EVP_EncryptInit.3,EVP_rc2_cfb.3
-EVP_EncryptInit.3,EVP_rc2_cfb64.3
-EVP_EncryptInit.3,EVP_rc2_ecb.3
-EVP_EncryptInit.3,EVP_rc2_ofb.3
 EVP_MD_CTX_ctrl.3,EVP_MD_CTX_clear_flags.3
 EVP_MD_CTX_ctrl.3,EVP_MD_CTX_md_data.3
 EVP_MD_CTX_ctrl.3,EVP_MD_CTX_pkey_ctx.3
@@ -992,32 +964,13 @@ EVP_PKEY_CTX_set_hkdf_md.3,EVP_PKEY_CTX_add1_hkdf_info.3
 EVP_PKEY_CTX_set_hkdf_md.3,EVP_PKEY_CTX_hkdf_mode.3
 EVP_PKEY_CTX_set_hkdf_md.3,EVP_PKEY_CTX_set1_hkdf_key.3
 EVP_PKEY_CTX_set_hkdf_md.3,EVP_PKEY_CTX_set1_hkdf_salt.3
-EVP_PKEY_add1_attr.3,EVP_PKEY_add1_attr_by_NID.3
-EVP_PKEY_add1_attr.3,EVP_PKEY_add1_attr_by_OBJ.3
-EVP_PKEY_add1_attr.3,EVP_PKEY_add1_attr_by_txt.3
-EVP_PKEY_add1_attr.3,EVP_PKEY_delete_attr.3
-EVP_PKEY_add1_attr.3,EVP_PKEY_get_attr.3
-EVP_PKEY_add1_attr.3,EVP_PKEY_get_attr_by_NID.3
-EVP_PKEY_add1_attr.3,EVP_PKEY_get_attr_by_OBJ.3
-EVP_PKEY_add1_attr.3,EVP_PKEY_get_attr_count.3
+EVP_PKEY_CTX_set_tls1_prf_md.3,EVP_PKEY_CTX_add1_tls1_prf_seed.3
+EVP_PKEY_CTX_set_tls1_prf_md.3,EVP_PKEY_CTX_set1_tls1_prf_secret.3
 EVP_PKEY_asn1_get_count.3,EVP_PKEY_asn1_find.3
 EVP_PKEY_asn1_get_count.3,EVP_PKEY_asn1_find_str.3
 EVP_PKEY_asn1_get_count.3,EVP_PKEY_asn1_get0.3
 EVP_PKEY_asn1_get_count.3,EVP_PKEY_asn1_get0_info.3
 EVP_PKEY_asn1_get_count.3,EVP_PKEY_get0_asn1.3
-EVP_PKEY_asn1_new.3,EVP_PKEY_asn1_copy.3
-EVP_PKEY_asn1_new.3,EVP_PKEY_asn1_free.3
-EVP_PKEY_asn1_new.3,EVP_PKEY_asn1_set_check.3
-EVP_PKEY_asn1_new.3,EVP_PKEY_asn1_set_ctrl.3
-EVP_PKEY_asn1_new.3,EVP_PKEY_asn1_set_free.3
-EVP_PKEY_asn1_new.3,EVP_PKEY_asn1_set_param.3
-EVP_PKEY_asn1_new.3,EVP_PKEY_asn1_set_param_check.3
-EVP_PKEY_asn1_new.3,EVP_PKEY_asn1_set_private.3
-EVP_PKEY_asn1_new.3,EVP_PKEY_asn1_set_public.3
-EVP_PKEY_asn1_new.3,EVP_PKEY_asn1_set_public_check.3
-EVP_PKEY_asn1_new.3,EVP_PKEY_asn1_set_security_bits.3
-EVP_PKEY_check.3,EVP_PKEY_param_check.3
-EVP_PKEY_check.3,EVP_PKEY_public_check.3
 EVP_PKEY_cmp.3,EVP_PKEY_cmp_parameters.3
 EVP_PKEY_cmp.3,EVP_PKEY_copy_parameters.3
 EVP_PKEY_cmp.3,EVP_PKEY_missing_parameters.3
@@ -1028,41 +981,19 @@ EVP_PKEY_derive.3,EVP_PKEY_derive_set_peer.3
 EVP_PKEY_encrypt.3,EVP_PKEY_encrypt_init.3
 EVP_PKEY_keygen.3,EVP_PKEY_CTX_get_app_data.3
 EVP_PKEY_keygen.3,EVP_PKEY_CTX_get_cb.3
+EVP_PKEY_keygen.3,EVP_PKEY_CTX_get_data.3
 EVP_PKEY_keygen.3,EVP_PKEY_CTX_get_keygen_info.3
 EVP_PKEY_keygen.3,EVP_PKEY_CTX_set0_keygen_info.3
 EVP_PKEY_keygen.3,EVP_PKEY_CTX_set_app_data.3
 EVP_PKEY_keygen.3,EVP_PKEY_CTX_set_cb.3
+EVP_PKEY_keygen.3,EVP_PKEY_CTX_set_data.3
 EVP_PKEY_keygen.3,EVP_PKEY_gen_cb.3
 EVP_PKEY_keygen.3,EVP_PKEY_keygen_init.3
 EVP_PKEY_keygen.3,EVP_PKEY_paramgen.3
 EVP_PKEY_keygen.3,EVP_PKEY_paramgen_init.3
-EVP_PKEY_meth_new.3,EVP_PKEY_CTX_get_data.3
-EVP_PKEY_meth_new.3,EVP_PKEY_CTX_set_data.3
-EVP_PKEY_meth_new.3,EVP_PKEY_meth_add0.3
-EVP_PKEY_meth_new.3,EVP_PKEY_meth_copy.3
-EVP_PKEY_meth_new.3,EVP_PKEY_meth_find.3
-EVP_PKEY_meth_new.3,EVP_PKEY_meth_free.3
-EVP_PKEY_meth_new.3,EVP_PKEY_meth_set_check.3
-EVP_PKEY_meth_new.3,EVP_PKEY_meth_set_cleanup.3
-EVP_PKEY_meth_new.3,EVP_PKEY_meth_set_copy.3
-EVP_PKEY_meth_new.3,EVP_PKEY_meth_set_ctrl.3
-EVP_PKEY_meth_new.3,EVP_PKEY_meth_set_decrypt.3
-EVP_PKEY_meth_new.3,EVP_PKEY_meth_set_derive.3
-EVP_PKEY_meth_new.3,EVP_PKEY_meth_set_encrypt.3
-EVP_PKEY_meth_new.3,EVP_PKEY_meth_set_init.3
-EVP_PKEY_meth_new.3,EVP_PKEY_meth_set_keygen.3
-EVP_PKEY_meth_new.3,EVP_PKEY_meth_set_param_check.3
-EVP_PKEY_meth_new.3,EVP_PKEY_meth_set_paramgen.3
-EVP_PKEY_meth_new.3,EVP_PKEY_meth_set_public_check.3
-EVP_PKEY_meth_new.3,EVP_PKEY_meth_set_sign.3
-EVP_PKEY_meth_new.3,EVP_PKEY_meth_set_signctx.3
-EVP_PKEY_meth_new.3,EVP_PKEY_meth_set_verify.3
-EVP_PKEY_meth_new.3,EVP_PKEY_meth_set_verify_recover.3
-EVP_PKEY_meth_new.3,EVP_PKEY_meth_set_verifyctx.3
 EVP_PKEY_new.3,EVP_PKEY_free.3
 EVP_PKEY_new.3,EVP_PKEY_get_raw_private_key.3
 EVP_PKEY_new.3,EVP_PKEY_get_raw_public_key.3
-EVP_PKEY_new.3,EVP_PKEY_new_CMAC_key.3
 EVP_PKEY_new.3,EVP_PKEY_new_mac_key.3
 EVP_PKEY_new.3,EVP_PKEY_new_raw_private_key.3
 EVP_PKEY_new.3,EVP_PKEY_new_raw_public_key.3
@@ -1106,41 +1037,39 @@ EVP_VerifyInit.3,EVP_VerifyFinal.3
 EVP_VerifyInit.3,EVP_VerifyInit_ex.3
 EVP_VerifyInit.3,EVP_VerifyUpdate.3
 EVP_aes_128_cbc.3,EVP_aes_128_cbc_hmac_sha1.3
-EVP_aes_128_cbc.3,EVP_aes_128_ccm.3
 EVP_aes_128_cbc.3,EVP_aes_128_cfb.3
 EVP_aes_128_cbc.3,EVP_aes_128_cfb1.3
 EVP_aes_128_cbc.3,EVP_aes_128_cfb128.3
 EVP_aes_128_cbc.3,EVP_aes_128_cfb8.3
 EVP_aes_128_cbc.3,EVP_aes_128_ctr.3
 EVP_aes_128_cbc.3,EVP_aes_128_ecb.3
-EVP_aes_128_cbc.3,EVP_aes_128_gcm.3
 EVP_aes_128_cbc.3,EVP_aes_128_ofb.3
 EVP_aes_128_cbc.3,EVP_aes_128_wrap.3
 EVP_aes_128_cbc.3,EVP_aes_128_xts.3
 EVP_aes_128_cbc.3,EVP_aes_192_cbc.3
-EVP_aes_128_cbc.3,EVP_aes_192_ccm.3
 EVP_aes_128_cbc.3,EVP_aes_192_cfb.3
 EVP_aes_128_cbc.3,EVP_aes_192_cfb1.3
 EVP_aes_128_cbc.3,EVP_aes_192_cfb128.3
 EVP_aes_128_cbc.3,EVP_aes_192_cfb8.3
 EVP_aes_128_cbc.3,EVP_aes_192_ctr.3
 EVP_aes_128_cbc.3,EVP_aes_192_ecb.3
-EVP_aes_128_cbc.3,EVP_aes_192_gcm.3
 EVP_aes_128_cbc.3,EVP_aes_192_ofb.3
 EVP_aes_128_cbc.3,EVP_aes_192_wrap.3
 EVP_aes_128_cbc.3,EVP_aes_256_cbc.3
 EVP_aes_128_cbc.3,EVP_aes_256_cbc_hmac_sha1.3
-EVP_aes_128_cbc.3,EVP_aes_256_ccm.3
 EVP_aes_128_cbc.3,EVP_aes_256_cfb.3
 EVP_aes_128_cbc.3,EVP_aes_256_cfb1.3
 EVP_aes_128_cbc.3,EVP_aes_256_cfb128.3
 EVP_aes_128_cbc.3,EVP_aes_256_cfb8.3
 EVP_aes_128_cbc.3,EVP_aes_256_ctr.3
 EVP_aes_128_cbc.3,EVP_aes_256_ecb.3
-EVP_aes_128_cbc.3,EVP_aes_256_gcm.3
 EVP_aes_128_cbc.3,EVP_aes_256_ofb.3
 EVP_aes_128_cbc.3,EVP_aes_256_wrap.3
 EVP_aes_128_cbc.3,EVP_aes_256_xts.3
+EVP_aes_128_ccm.3,EVP_aes_192_ccm.3
+EVP_aes_128_ccm.3,EVP_aes_256_ccm.3
+EVP_aes_128_gcm.3,EVP_aes_192_gcm.3
+EVP_aes_128_gcm.3,EVP_aes_256_gcm.3
 EVP_camellia_128_cbc.3,EVP_camellia_128_cfb.3
 EVP_camellia_128_cbc.3,EVP_camellia_128_cfb1.3
 EVP_camellia_128_cbc.3,EVP_camellia_128_cfb128.3
@@ -1183,6 +1112,12 @@ EVP_des_cbc.3,EVP_des_ede_ecb.3
 EVP_des_cbc.3,EVP_des_ede_ofb.3
 EVP_des_cbc.3,EVP_des_ofb.3
 EVP_des_cbc.3,EVP_desx_cbc.3
+EVP_rc2_cbc.3,EVP_rc2_40_cbc.3
+EVP_rc2_cbc.3,EVP_rc2_64_cbc.3
+EVP_rc2_cbc.3,EVP_rc2_cfb.3
+EVP_rc2_cbc.3,EVP_rc2_cfb64.3
+EVP_rc2_cbc.3,EVP_rc2_ecb.3
+EVP_rc2_cbc.3,EVP_rc2_ofb.3
 EVP_rc4.3,EVP_rc4_40.3
 EVP_rc4.3,EVP_rc4_hmac_md5.3
 EVP_sha1.3,EVP_md4.3
@@ -1211,7 +1146,6 @@ HMAC.3,HMAC_CTX_new.3
 HMAC.3,HMAC_CTX_reset.3
 HMAC.3,HMAC_CTX_set_flags.3
 HMAC.3,HMAC_Final.3
-HMAC.3,HMAC_Init.3
 HMAC.3,HMAC_Init_ex.3
 HMAC.3,HMAC_Update.3
 HMAC.3,HMAC_size.3
@@ -1240,11 +1174,6 @@ MD5.3,MD5_Update.3
 NAME_CONSTRAINTS_new.3,GENERAL_SUBTREE_free.3
 NAME_CONSTRAINTS_new.3,GENERAL_SUBTREE_new.3
 NAME_CONSTRAINTS_new.3,NAME_CONSTRAINTS_free.3
-OBJ_NAME_add.3,OBJ_NAME_cleanup.3
-OBJ_NAME_add.3,OBJ_NAME_get.3
-OBJ_NAME_add.3,OBJ_NAME_init.3
-OBJ_NAME_add.3,OBJ_NAME_new_index.3
-OBJ_NAME_add.3,OBJ_NAME_remove.3
 OBJ_create.3,OBJ_add_object.3
 OBJ_create.3,OBJ_cleanup.3
 OBJ_create.3,OBJ_create_objects.3
@@ -1329,7 +1258,6 @@ OPENSSL_VERSION_NUMBER.3,SSLeay.3
 OPENSSL_VERSION_NUMBER.3,SSLeay_version.3
 OPENSSL_config.3,OPENSSL_no_config.3
 OPENSSL_init_crypto.3,OPENSSL_init.3
-OPENSSL_load_builtin_modules.3,ASN1_add_oid_module.3
 OPENSSL_malloc.3,CRYPTO_free.3
 OPENSSL_malloc.3,CRYPTO_malloc.3
 OPENSSL_malloc.3,CRYPTO_strdup.3
@@ -1361,7 +1289,6 @@ OpenSSL_add_all_algorithms.3,OpenSSL_add_all_digests.3
 OpenSSL_add_all_algorithms.3,SSLeay_add_all_algorithms.3
 PEM_ASN1_read.3,PEM_ASN1_read_bio.3
 PEM_ASN1_read.3,d2i_of_void.3
-PEM_X509_INFO_read.3,PEM_X509_INFO_read_bio.3
 PEM_read.3,PEM_def_callback.3
 PEM_read.3,PEM_do_header.3
 PEM_read.3,PEM_get_EVP_CIPHER_INFO.3
@@ -1522,6 +1449,12 @@ RAND_load_file.3,RAND_file_name.3
 RAND_load_file.3,RAND_write_file.3
 RAND_set_rand_method.3,RAND_SSLeay.3
 RAND_set_rand_method.3,RAND_get_rand_method.3
+RC2_encrypt.3,RC2_cbc_encrypt.3
+RC2_encrypt.3,RC2_cfb64_encrypt.3
+RC2_encrypt.3,RC2_decrypt.3
+RC2_encrypt.3,RC2_ecb_encrypt.3
+RC2_encrypt.3,RC2_ofb64_encrypt.3
+RC2_encrypt.3,RC2_set_key.3
 RC4.3,RC4_set_key.3
 RIPEMD160.3,RIPEMD160_Final.3
 RIPEMD160.3,RIPEMD160_Init.3
@@ -1651,6 +1584,7 @@ SSL_CIPHER_get_name.3,SSL_CIPHER_get_auth_nid.3
 SSL_CIPHER_get_name.3,SSL_CIPHER_get_bits.3
 SSL_CIPHER_get_name.3,SSL_CIPHER_get_cipher_nid.3
 SSL_CIPHER_get_name.3,SSL_CIPHER_get_digest_nid.3
+SSL_CIPHER_get_name.3,SSL_CIPHER_get_handshake_digest.3
 SSL_CIPHER_get_name.3,SSL_CIPHER_get_id.3
 SSL_CIPHER_get_name.3,SSL_CIPHER_get_kx_nid.3
 SSL_CIPHER_get_name.3,SSL_CIPHER_get_version.3
@@ -1739,6 +1673,7 @@ SSL_CTX_set_alpn_select_cb.3,SSL_get0_alpn_selected.3
 SSL_CTX_set_alpn_select_cb.3,SSL_select_next_proto.3
 SSL_CTX_set_alpn_select_cb.3,SSL_set_alpn_protos.3
 SSL_CTX_set_cert_store.3,SSL_CTX_get_cert_store.3
+SSL_CTX_set_cert_store.3,SSL_CTX_set1_cert_store.3
 SSL_CTX_set_cipher_list.3,SSL_set_cipher_list.3
 SSL_CTX_set_client_CA_list.3,SSL_CTX_add_client_CA.3
 SSL_CTX_set_client_CA_list.3,SSL_add_client_CA.3
@@ -1859,6 +1794,7 @@ SSL_SESSION_get_time.3,SSL_get_timeout.3
 SSL_SESSION_get_time.3,SSL_set_time.3
 SSL_SESSION_get_time.3,SSL_set_timeout.3
 SSL_SESSION_has_ticket.3,SSL_SESSION_get_ticket_lifetime_hint.3
+SSL_SESSION_new.3,SSL_SESSION_dup.3
 SSL_SESSION_print.3,SSL_SESSION_print_fp.3
 SSL_SESSION_set1_id_context.3,SSL_SESSION_get0_id_context.3
 SSL_alert_type_string.3,SSL_alert_desc_string.3
@@ -1947,7 +1883,6 @@ TS_REQ_new.3,TS_STATUS_INFO_free.3
 TS_REQ_new.3,TS_STATUS_INFO_new.3
 TS_REQ_new.3,TS_TST_INFO_free.3
 TS_REQ_new.3,TS_TST_INFO_new.3
-UI_UTIL_read_pw.3,UI_UTIL_read_pw_string.3
 UI_create_method.3,UI_destroy_method.3
 UI_create_method.3,UI_method_get_closer.3
 UI_create_method.3,UI_method_get_flusher.3
@@ -1998,6 +1933,7 @@ X25519.3,ED25519_sign.3
 X25519.3,ED25519_verify.3
 X25519.3,X25519_keypair.3
 X509V3_EXT_get_nid.3,X509V3_EXT_get.3
+X509V3_EXT_print.3,X509V3_EXT_print_fp.3
 X509V3_get_d2i.3,X509V3_EXT_d2i.3
 X509V3_get_d2i.3,X509V3_EXT_i2d.3
 X509V3_get_d2i.3,X509V3_add1_i2d.3
@@ -2011,6 +1947,7 @@ X509V3_get_d2i.3,X509_add1_ext_i2d.3
 X509V3_get_d2i.3,X509_get0_extensions.3
 X509V3_get_d2i.3,X509_get0_uids.3
 X509V3_get_d2i.3,X509_get_ext_d2i.3
+X509V3_parse_list.3,X509V3_conf_free.3
 X509_ALGOR_dup.3,X509_ALGOR_cmp.3
 X509_ALGOR_dup.3,X509_ALGOR_free.3
 X509_ALGOR_dup.3,X509_ALGOR_get0.3
@@ -2051,6 +1988,7 @@ X509_EXTENSION_set_object.3,X509_EXTENSION_get_object.3
 X509_EXTENSION_set_object.3,X509_EXTENSION_new.3
 X509_EXTENSION_set_object.3,X509_EXTENSION_set_critical.3
 X509_EXTENSION_set_object.3,X509_EXTENSION_set_data.3
+X509_EXTENSION_set_object.3,X509_supported_extension.3
 X509_INFO_new.3,X509_INFO_free.3
 X509_LOOKUP_hash_dir.3,X509_LOOKUP_file.3
 X509_LOOKUP_hash_dir.3,X509_LOOKUP_mem.3
@@ -2088,18 +2026,14 @@ X509_NAME_hash.3,X509_subject_name_hash.3
 X509_NAME_hash.3,X509_subject_name_hash_old.3
 X509_NAME_new.3,X509_NAME_free.3
 X509_NAME_print_ex.3,X509_NAME_oneline.3
-X509_NAME_print_ex.3,X509_NAME_print.3
 X509_NAME_print_ex.3,X509_NAME_print_ex_fp.3
 X509_OBJECT_get0_X509.3,X509_OBJECT_free.3
-X509_OBJECT_get0_X509.3,X509_OBJECT_free_contents.3
 X509_OBJECT_get0_X509.3,X509_OBJECT_get0_X509_CRL.3
 X509_OBJECT_get0_X509.3,X509_OBJECT_get_type.3
 X509_OBJECT_get0_X509.3,X509_OBJECT_idx_by_subject.3
 X509_OBJECT_get0_X509.3,X509_OBJECT_new.3
 X509_OBJECT_get0_X509.3,X509_OBJECT_retrieve_by_subject.3
 X509_OBJECT_get0_X509.3,X509_OBJECT_retrieve_match.3
-X509_OBJECT_get0_X509.3,X509_OBJECT_up_ref_count.3
-X509_PKEY_new.3,X509_PKEY_free.3
 X509_PUBKEY_new.3,X509_PUBKEY_free.3
 X509_PUBKEY_new.3,X509_PUBKEY_get.3
 X509_PUBKEY_new.3,X509_PUBKEY_get0.3
@@ -2134,9 +2068,7 @@ X509_REQ_add1_attr.3,X509_REQ_get_attr_by_OBJ.3
 X509_REQ_add1_attr.3,X509_REQ_get_attr_count.3
 X509_REQ_add_extensions.3,X509_REQ_add_extensions_nid.3
 X509_REQ_add_extensions.3,X509_REQ_extension_nid.3
-X509_REQ_add_extensions.3,X509_REQ_get_extension_nids.3
 X509_REQ_add_extensions.3,X509_REQ_get_extensions.3
-X509_REQ_add_extensions.3,X509_REQ_set_extension_nids.3
 X509_REQ_new.3,X509_REQ_INFO_free.3
 X509_REQ_new.3,X509_REQ_INFO_new.3
 X509_REQ_new.3,X509_REQ_dup.3
@@ -2226,14 +2158,6 @@ X509_STORE_set1_param.3,X509_STORE_set_purpose.3
 X509_STORE_set1_param.3,X509_STORE_set_trust.3
 X509_STORE_set_verify_cb_func.3,X509_STORE_get_verify_cb.3
 X509_STORE_set_verify_cb_func.3,X509_STORE_set_verify_cb.3
-X509_TRUST_set.3,X509_TRUST_add.3
-X509_TRUST_set.3,X509_TRUST_cleanup.3
-X509_TRUST_set.3,X509_TRUST_get0.3
-X509_TRUST_set.3,X509_TRUST_get0_name.3
-X509_TRUST_set.3,X509_TRUST_get_by_id.3
-X509_TRUST_set.3,X509_TRUST_get_count.3
-X509_TRUST_set.3,X509_TRUST_get_flags.3
-X509_TRUST_set.3,X509_TRUST_get_trust.3
 X509_VERIFY_PARAM_new.3,X509_VERIFY_PARAM_add0_table.3
 X509_VERIFY_PARAM_new.3,X509_VERIFY_PARAM_free.3
 X509_VERIFY_PARAM_new.3,X509_VERIFY_PARAM_get0.3
@@ -2249,6 +2173,7 @@ X509_VERIFY_PARAM_set_flags.3,X509_VERIFY_PARAM_get0_name.3
 X509_VERIFY_PARAM_set_flags.3,X509_VERIFY_PARAM_get0_peername.3
 X509_VERIFY_PARAM_set_flags.3,X509_VERIFY_PARAM_get_depth.3
 X509_VERIFY_PARAM_set_flags.3,X509_VERIFY_PARAM_get_flags.3
+X509_VERIFY_PARAM_set_flags.3,X509_VERIFY_PARAM_get_hostflags.3
 X509_VERIFY_PARAM_set_flags.3,X509_VERIFY_PARAM_get_time.3
 X509_VERIFY_PARAM_set_flags.3,X509_VERIFY_PARAM_set1_email.3
 X509_VERIFY_PARAM_set_flags.3,X509_VERIFY_PARAM_set1_host.3
@@ -2269,7 +2194,6 @@ X509_check_host.3,X509_check_email.3
 X509_check_host.3,X509_check_ip.3
 X509_check_host.3,X509_check_ip_asc.3
 X509_check_private_key.3,X509_REQ_check_private_key.3
-X509_check_trust.3,X509_TRUST_set_default.3
 X509_cmp.3,X509_CRL_cmp.3
 X509_cmp.3,X509_CRL_match.3
 X509_cmp.3,X509_NAME_cmp.3
@@ -2309,6 +2233,7 @@ X509_get0_signature.3,X509_CRL_get_signature_nid.3
 X509_get0_signature.3,X509_REQ_get0_signature.3
 X509_get0_signature.3,X509_REQ_get_signature_nid.3
 X509_get0_signature.3,X509_get0_tbs_sigalg.3
+X509_get0_signature.3,X509_get_signature_info.3
 X509_get0_signature.3,X509_get_signature_nid.3
 X509_get0_signature.3,X509_get_signature_type.3
 X509_get1_email.3,X509_email_free.3
@@ -2361,14 +2286,6 @@ X509_sign.3,X509_REQ_verify.3
 X509_sign.3,X509_sign_ctx.3
 X509_sign.3,X509_verify.3
 X509_signature_dump.3,X509_signature_print.3
-X509at_add1_attr.3,X509at_add1_attr_by_NID.3
-X509at_add1_attr.3,X509at_add1_attr_by_OBJ.3
-X509at_add1_attr.3,X509at_add1_attr_by_txt.3
-X509at_add1_attr.3,X509at_delete_attr.3
-X509at_get_attr.3,X509at_get0_data_by_OBJ.3
-X509at_get_attr.3,X509at_get_attr_by_NID.3
-X509at_get_attr.3,X509at_get_attr_by_OBJ.3
-X509at_get_attr.3,X509at_get_attr_count.3
 X509v3_addr_add_inherit.3,X509v3_addr_add_prefix.3
 X509v3_addr_add_inherit.3,X509v3_addr_add_range.3
 X509v3_addr_add_inherit.3,X509v3_addr_canonize.3
@@ -2409,19 +2326,8 @@ X509v3_get_ext_by_NID.3,X509v3_get_ext.3
 X509v3_get_ext_by_NID.3,X509v3_get_ext_by_OBJ.3
 X509v3_get_ext_by_NID.3,X509v3_get_ext_by_critical.3
 X509v3_get_ext_by_NID.3,X509v3_get_ext_count.3
-bn_dump.3,bn_add_words.3
-bn_dump.3,bn_div_words.3
-bn_dump.3,bn_expand.3
-bn_dump.3,bn_mul_add_words.3
-bn_dump.3,bn_mul_comba4.3
-bn_dump.3,bn_mul_comba8.3
-bn_dump.3,bn_mul_normal.3
-bn_dump.3,bn_mul_words.3
-bn_dump.3,bn_sqr_comba4.3
-bn_dump.3,bn_sqr_comba8.3
-bn_dump.3,bn_sqr_words.3
-bn_dump.3,bn_sub_words.3
-bn_dump.3,bn_wexpand.3
+a2i_ipadd.3,a2i_IPADDRESS.3
+a2i_ipadd.3,a2i_IPADDRESS_NC.3
 d2i_ASN1_NULL.3,i2d_ASN1_NULL.3
 d2i_ASN1_OBJECT.3,OBJ_get0_data.3
 d2i_ASN1_OBJECT.3,OBJ_length.3
@@ -2790,6 +2696,7 @@ tls_conn_version.3,tls_conn_cipher_strength.3
 tls_conn_version.3,tls_conn_servername.3
 tls_conn_version.3,tls_conn_session_resumed.3
 tls_conn_version.3,tls_peer_cert_chain_pem.3
+tls_conn_version.3,tls_peer_cert_common_name.3
 tls_conn_version.3,tls_peer_cert_contains_name.3
 tls_conn_version.3,tls_peer_cert_hash.3
 tls_conn_version.3,tls_peer_cert_issuer.3
@@ -2841,6 +2748,7 @@ tls_read.3,tls_close.3
 tls_read.3,tls_error.3
 tls_read.3,tls_handshake.3
 tls_read.3,tls_write.3
+v2i_ASN1_BIT_STRING.3,i2v_ASN1_BIT_STRING.3
 x509_verify.3,x509_verify_ctx_chain.3
 x509_verify.3,x509_verify_ctx_error_depth.3
 x509_verify.3,x509_verify_ctx_error_string.3
diff --git a/patches/crypto_namespace.h.patch b/patches/crypto_namespace.h.patch
deleted file mode 100644
index c18f0da..0000000
--- a/patches/crypto_namespace.h.patch
+++ /dev/null
@@ -1,22 +0,0 @@
---- crypto/hidden/crypto_namespace.h.orig       2024-04-09 10:12:22.320737957 +0200
-+++ crypto/hidden/crypto_namespace.h    2024-04-11 09:09:31.163350515 +0200
-@@ -24,6 +24,12 @@
-  * external calls use the latter name.
-  */
- 
-+#ifdef _MSC_VER
-+# define LCRYPTO_UNUSED(x)
-+# define LCRYPTO_USED(x)
-+# define LCRYPTO_ALIAS1(pre, x)
-+# define LCRYPTO_ALIAS(x)
-+#else
- #ifdef LIBRESSL_NAMESPACE
- #ifdef LIBRESSL_CRYPTO_NAMESPACE
- #  define LCRYPTO_UNUSED(x)    __attribute__((deprecated))             \
-@@ -43,5 +49,6 @@
- # define LCRYPTO_ALIAS1(pre,x)
- # define LCRYPTO_ALIAS(x)      asm("")
- #endif
-+#endif /* _MSC_VER */
- 
- #endif /* _LIBCRYPTO_CRYPTO_NAMESPACE_H_ */
diff --git a/patches/mlkem_internal.h.patch b/patches/mlkem_internal.h.patch
new file mode 100644
index 0000000..ee25521
--- /dev/null
+++ b/patches/mlkem_internal.h.patch
@@ -0,0 +1,11 @@
+--- crypto/mlkem/mlkem_internal.h.orig  Fri Oct 24 07:06:10 2025
++++ crypto/mlkem/mlkem_internal.h       Fri Oct 24 07:06:22 2025
+@@ -20,7 +20,7 @@
+ #define OPENSSL_HEADER_CRYPTO_MLKEM_INTERNAL_H
+ 
+ #include "bytestring.h"
+-#include "mlkem.h"
++#include <openssl/mlkem.h>
+ 
+ #if defined(__cplusplus)
+ extern "C" {
diff --git a/patches/modes_local.h.patch b/patches/modes_local.h.patch
deleted file mode 100644
index 1ff799b..0000000
--- a/patches/modes_local.h.patch
+++ /dev/null
@@ -1,18 +0,0 @@
---- crypto/modes/modes_local.h.orig     Sat Jul  8 14:03:53 2023
-+++ crypto/modes/modes_local.h  Sat Jul  8 14:10:56 2023
-@@ -45,6 +45,7 @@
-                        asm ("bswapl %0"                                \
-                        : "+r"(ret));   ret;            })
- # elif (defined(__arm__) || defined(__arm)) && !defined(__STRICT_ALIGNMENT)
-+#  if (__ARM_ARCH >= 6)
- #  define BSWAP8(x) ({ u32 lo=(u64)(x)>>32,hi=(x);                     \
-                        asm ("rev %0,%0; rev %1,%1"                     \
-                        : "+r"(hi),"+r"(lo));                           \
-@@ -53,6 +54,7 @@
-                        asm ("rev %0,%1"                                \
-                        : "=r"(ret) : "r"((u32)(x)));                   \
-                        ret;                            })
-+#  endif
- # endif
- #endif
- #endif
diff --git a/patches/netcat.c.patch b/patches/netcat.c.patch
index 9c3a450..c6b9f68 100644
--- a/patches/netcat.c.patch
+++ b/patches/netcat.c.patch
@@ -1,5 +1,5 @@
---- apps/nc/netcat.c.orig       Tue Aug 15 15:17:28 2023
-+++ apps/nc/netcat.c    Tue Aug 15 15:17:54 2023
+--- apps/nc/netcat.c.orig       Fri Oct 24 07:06:13 2025
++++ apps/nc/netcat.c    Fri Oct 24 07:06:22 2025
 @@ -93,9 +93,13 @@ int  zflag;                                  /* Port Scan Flag */
  int    Dflag;                                  /* sodebug */
  int    Iflag;                                  /* TCP receive buffer size */
@@ -14,7 +14,7 @@
  
  int    usetls;                                 /* use TLS */
  const char    *Cflag;                          /* Public cert file */
-@@ -268,12 +272,14 @@ main(int argc, char *argv[])
+@@ -271,12 +275,14 @@ main(int argc, char *argv[])
                 case 'u':
                         uflag = 1;
                         break;
@@ -29,7 +29,7 @@
                 case 'v':
                         vflag = 1;
                         break;
-@@ -320,9 +326,11 @@ main(int argc, char *argv[])
+@@ -323,9 +329,11 @@ main(int argc, char *argv[])
                 case 'o':
                         oflag = optarg;
                         break;
@@ -41,7 +41,7 @@
                 case 'T':
                         errstr = NULL;
                         errno = 0;
-@@ -346,9 +354,11 @@ main(int argc, char *argv[])
+@@ -349,9 +357,11 @@ main(int argc, char *argv[])
         argc -= optind;
         argv += optind;
  
@@ -53,7 +53,7 @@
  
         /* Cruft to make sure options are clean, and used properly. */
         if (argc == 1 && family == AF_UNIX) {
-@@ -927,7 +937,10 @@ remote_connect(const char *host, const char *port, str
+@@ -928,7 +938,10 @@ remote_connect(const char *host, const char *port, str
      char *ipaddr)
  {
         struct addrinfo *res, *res0;
@@ -65,7 +65,7 @@
  
         if ((error = getaddrinfo(host, port, &hints, &res0)))
                 errx(1, "getaddrinfo for host \"%s\" port %s: %s", host,
-@@ -942,8 +955,10 @@ remote_connect(const char *host, const char *port, str
+@@ -943,8 +956,10 @@ remote_connect(const char *host, const char *port, str
                 if (sflag || pflag) {
                         struct addrinfo ahints, *ares;
  
@@ -76,7 +76,7 @@
                         memset(&ahints, 0, sizeof(struct addrinfo));
                         ahints.ai_family = res->ai_family;
                         ahints.ai_socktype = uflag ? SOCK_DGRAM : SOCK_STREAM;
-@@ -1035,7 +1050,10 @@ int
+@@ -1036,7 +1051,10 @@ int
  local_listen(const char *host, const char *port, struct addrinfo hints)
  {
         struct addrinfo *res, *res0;
@@ -88,7 +88,7 @@
         int error;
  
         /* Allow nodename to be null. */
-@@ -1056,9 +1074,11 @@ local_listen(const char *host, const char *port, struc
+@@ -1057,9 +1075,11 @@ local_listen(const char *host, const char *port, struc
                     res->ai_protocol)) == -1)
                         continue;
  
@@ -100,7 +100,7 @@
  
                 set_common_sockopts(s, res->ai_family);
  
-@@ -1563,11 +1583,13 @@ set_common_sockopts(int s, int af)
+@@ -1569,11 +1589,13 @@ set_common_sockopts(int s, int af)
  {
         int x = 1;
  
@@ -114,7 +114,7 @@
         if (Dflag) {
                 if (setsockopt(s, SOL_SOCKET, SO_DEBUG,
                     &x, sizeof(x)) == -1)
-@@ -1578,9 +1600,16 @@ set_common_sockopts(int s, int af)
+@@ -1584,9 +1606,16 @@ set_common_sockopts(int s, int af)
                     IP_TOS, &Tflag, sizeof(Tflag)) == -1)
                         err(1, "set IP ToS");
  
@@ -131,7 +131,7 @@
         }
         if (Iflag) {
                 if (setsockopt(s, SOL_SOCKET, SO_RCVBUF,
-@@ -1604,13 +1633,17 @@ set_common_sockopts(int s, int af)
+@@ -1610,13 +1639,17 @@ set_common_sockopts(int s, int af)
         }
  
         if (minttl != -1) {
@@ -150,7 +150,7 @@
         }
  }
  
-@@ -1835,15 +1868,19 @@ help(void)
+@@ -1846,15 +1879,19 @@ help(void)
         \t-P proxyuser\tUsername for proxy authentication\n\
         \t-p port\t     Specify local port for remote connects\n\
         \t-R CAfile     CA bundle\n\
@@ -175,4 +175,4 @@
 +       "\t-v           Verbose\n\
         \t-W recvlimit  Terminate after receiving a number of packets\n\
         \t-w timeout    Timeout for connects and final net reads\n\
-        \t-X proto      Proxy protocol: \"4\", \"5\" (SOCKS) or \"connect\"\n\
+        \t-X proto      Proxy protocol: \"4\", \"4A\", \"5\" (SOCKS) or \"connect\"\n\
diff --git a/patches/openssl.c.patch b/patches/openssl.c.patch
index 15afb78..60ea9a7 100644
--- a/patches/openssl.c.patch
+++ b/patches/openssl.c.patch
@@ -1,6 +1,6 @@
---- apps/openssl/openssl.c.orig Mon Mar  4 13:39:56 2024
-+++ apps/openssl/openssl.c      Mon Mar  4 13:40:15 2024
-@@ -348,7 +348,9 @@
+--- apps/openssl/openssl.c.orig Sat May 31 03:18:05 2025
++++ apps/openssl/openssl.c      Sat May 31 03:18:17 2025
+@@ -341,7 +341,9 @@ BIO *bio_err = NULL;
  static void
  openssl_startup(void)
  {
diff --git a/patches/opensslfeatures.h.patch b/patches/opensslfeatures.h.patch
index 618de73..d370b32 100644
--- a/patches/opensslfeatures.h.patch
+++ b/patches/opensslfeatures.h.patch
@@ -14,3 +14,36 @@
  #define OPENSSL_THREADS
  
  #define OPENSSL_NO_BUF_FREELISTS
+--- crypto/crypto_internal.h.orig       Sat Dec 14 14:15:39 2024
++++ crypto/crypto_internal.h    Sat Dec 14 14:15:52 2024
+@@ -15,6 +15,8 @@
+  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+  */
+ 
++#include <openssl/opensslfeatures.h>
++
+ #include <endian.h>
+ #include <stddef.h>
+ #include <stdint.h>
+--- tests/parse_test_file.h.orig        Thu Dec 26 01:13:00 2024
++++ tests/parse_test_file.h     Thu Dec 26 01:13:27 2024
+@@ -22,6 +22,8 @@
+ #include <stdint.h>
+ #include <stdio.h>
+ 
++#include <openssl/opensslfeatures.h>
++
+ #include "bytestring.h"
+ 
+ #if defined(__cplusplus)
+--- tests/test.h.orig   Sat May 31 04:48:09 2025
++++ tests/test.h        Sat May 31 04:48:31 2025
+@@ -18,6 +18,8 @@
+ #ifndef HEADER_TEST_H
+ #define HEADER_TEST_H
+ 
++#include <openssl/opensslfeatures.h>
++
+ #include <stddef.h>
+ #include <stdint.h>
+ 
diff --git a/patches/patch-amd64-crypto-cpu-caps.c.patch b/patches/patch-amd64-crypto-cpu-caps.c.patch
new file mode 100644
index 0000000..5fd7524
--- /dev/null
+++ b/patches/patch-amd64-crypto-cpu-caps.c.patch
@@ -0,0 +1,20 @@
+--- crypto/arch/amd64/crypto_cpu_caps.c.orig    Sat Dec 14 13:45:16 2024
++++ crypto/arch/amd64/crypto_cpu_caps.c Sat Dec 14 13:54:06 2024
+@@ -37,7 +37,7 @@ cpuid(uint32_t eax, uint32_t *out_eax, uint32_t *out_e
+ {
+        uint32_t ebx = 0, ecx = 0, edx = 0;
+ 
+-#ifndef OPENSSL_NO_ASM
++#if defined(__GNUC__) && !defined(OPENSSL_NO_ASM)
+        __asm__ ("cpuid": "+a"(eax), "+b"(ebx), "+c"(ecx), "+d"(edx));
+ #else
+        eax = 0;
+@@ -58,7 +58,7 @@ xgetbv(uint32_t ecx, uint32_t *out_eax, uint32_t *out_
+ {
+        uint32_t eax = 0, edx = 0;
+ 
+-#ifndef OPENSSL_NO_ASM
++#if defined(__GNUC__) && !defined(OPENSSL_NO_ASM)
+        __asm__ ("xgetbv": "+a"(eax), "+c"(ecx), "+d"(edx));
+ #endif
+ 
diff --git a/patches/patch-i386-crypto-cpu-caps.c.patch b/patches/patch-i386-crypto-cpu-caps.c.patch
new file mode 100644
index 0000000..0642582
--- /dev/null
+++ b/patches/patch-i386-crypto-cpu-caps.c.patch
@@ -0,0 +1,20 @@
+--- crypto/arch/i386/crypto_cpu_caps.c.orig     Mon Jun 16 10:38:27 2025
++++ crypto/arch/i386/crypto_cpu_caps.c  Mon Jun 16 10:38:39 2025
+@@ -37,7 +37,7 @@ cpuid(uint32_t eax, uint32_t *out_eax, uint32_t *out_e
+ {
+        uint32_t ebx = 0, ecx = 0, edx = 0;
+ 
+-#ifndef OPENSSL_NO_ASM
++#if defined(__GNUC__) && !defined(OPENSSL_NO_ASM)
+        __asm__ ("cpuid": "+a"(eax), "+b"(ebx), "+c"(ecx), "+d"(edx));
+ #else
+        eax = 0;
+@@ -58,7 +58,7 @@ xgetbv(uint32_t ecx, uint32_t *out_eax, uint32_t *out_
+ {
+        uint32_t eax = 0, edx = 0;
+ 
+-#ifndef OPENSSL_NO_ASM
++#if defined(__GNUC__) && !defined(OPENSSL_NO_ASM)
+        __asm__ ("xgetbv": "+a"(eax), "+c"(ecx), "+d"(edx));
+ #endif
+ 
diff --git a/patches/speed.c.patch b/patches/speed.c.patch
index c29ef4d..0f29358 100644
--- a/patches/speed.c.patch
+++ b/patches/speed.c.patch
@@ -1,8 +1,8 @@
---- apps/openssl/speed.c.orig   Sat Jul 13 11:02:51 2024
-+++ apps/openssl/speed.c        Sat Jul 13 10:27:25 2024
-@@ -161,7 +161,16 @@
+--- apps/openssl/speed.c.orig   Thu Dec 18 07:45:00 2025
++++ apps/openssl/speed.c        Thu Dec 18 07:45:12 2025
+@@ -154,7 +154,16 @@ static void
  pkey_print_message(const char *str, const char *str2,
-     long num, int bits, int sec);
+     int bits, int sec);
  static void print_result(int alg, int run_no, int count, double time_used);
 +#ifndef _WIN32
  static int do_multi(int multi);
@@ -15,9 +15,9 @@
 +#define alarm(seconds)         speed_alarm((seconds))
 +#endif
  
- #define ALGOR_NUM      32
  #define SIZE_NUM       5
-@@ -430,8 +439,10 @@
+ #define MAX_ECDH_SIZE  256
+@@ -1089,8 +1098,10 @@ speed_main(int argc, char **argv)
         const EVP_CIPHER *evp_cipher = NULL;
         const EVP_MD *evp_md = NULL;
         int decrypt = 0;
@@ -28,7 +28,7 @@
         const char *errstr = NULL;
  
         if (pledge("stdio proc", NULL) == -1) {
-@@ -506,6 +517,7 @@
+@@ -1164,6 +1175,7 @@ speed_main(int argc, char **argv)
                         decrypt = 1;
                         j--;    /* Otherwise, -decrypt gets confused with an
                                  * algorithm. */
@@ -36,7 +36,7 @@
                 } else if (argc > 0 && strcmp(*argv, "-multi") == 0) {
                         argc--;
                         argv++;
-@@ -520,6 +532,7 @@
+@@ -1178,6 +1190,7 @@ speed_main(int argc, char **argv)
                         }
                         j--;    /* Otherwise, -multi gets confused with an
                                  * algorithm. */
@@ -44,7 +44,7 @@
                 } else if (argc > 0 && strcmp(*argv, "-unaligned") == 0) {
                         argc--;
                         argv++;
-@@ -851,7 +864,9 @@
+@@ -1492,7 +1505,9 @@ speed_main(int argc, char **argv)
                         BIO_printf(bio_err, "-evp e          use EVP e.\n");
                         BIO_printf(bio_err, "-decrypt        time decryption instead of encryption (only EVP).\n");
                         BIO_printf(bio_err, "-mr             produce machine readable output.\n");
@@ -54,7 +54,7 @@
                         BIO_printf(bio_err, "-unaligned n    use buffers with offset n from proper alignment.\n");
                         goto end;
                 }
-@@ -860,8 +875,10 @@
+@@ -1501,8 +1516,10 @@ speed_main(int argc, char **argv)
                 j++;
         }
  
@@ -65,8 +65,8 @@
  
         if (j == 0) {
                 for (i = 0; i < ALGOR_NUM; i++) {
-@@ -933,11 +950,13 @@
- #define COND(c)        (run && count<0x7fffffff)
+@@ -1573,11 +1590,13 @@ speed_main(int argc, char **argv)
+ #define COND   (run && count<0x7fffffff)
  #define COUNT(d) (count)
  
 +#ifndef _WIN32
@@ -79,7 +79,7 @@
  
  #ifndef OPENSSL_NO_MD4
         if (doit[D_MD4]) {
-@@ -1743,7 +1762,9 @@
+@@ -2362,7 +2381,9 @@ speed_main(int argc, char **argv)
                                 ecdh_doit[j] = 0;
                 }
         }
@@ -89,7 +89,7 @@
         if (!mr) {
                 fprintf(stdout, "%s\n", SSLeay_version(SSLEAY_VERSION));
                 fprintf(stdout, "%s\n", SSLeay_version(SSLEAY_BUILT_ON));
-@@ -1899,11 +1920,15 @@
+@@ -2518,11 +2539,15 @@ pkey_print_message(const char *str, const char *str2,
  static void
  print_result(int alg, int run_no, int count, double time_used)
  {
@@ -105,9 +105,10 @@
  static char *
  sstrsep(char **string, const char *delim)
  {
-@@ -2104,4 +2129,5 @@
+@@ -2723,5 +2748,6 @@ do_multi(int multi)
         free(fds);
         return 1;
  }
 +#endif
- #endif
+ 
+ #endif /* OPENSSL_NO_SPEED */
diff --git a/patches/ssl_namespace.h.patch b/patches/ssl_namespace.h.patch
deleted file mode 100644
index 758f8dc..0000000
--- a/patches/ssl_namespace.h.patch
+++ /dev/null
@@ -1,21 +0,0 @@
---- openbsd/src/lib/libssl/hidden/ssl_namespace.h       2023-03-15 11:41:52.481641800 -0600
-+++ ssl/hidden/ssl_namespace.h  2023-03-15 17:28:04.685309300 -0600
-@@ -23,6 +23,11 @@
-  * and we alias that to the normal name.
-  */
- 
-+#ifdef _MSC_VER
-+#define LSSL_UNUSED(x)
-+#define LSSL_USED(x)
-+#define LSSL_ALIAS(x)
-+#else
- #ifdef LIBRESSL_NAMESPACE
- #define LSSL_UNUSED(x)         typeof(x) x __attribute__((deprecated))
- #define LSSL_USED(x)           __attribute__((visibility("hidden")))   \
-@@ -33,5 +38,6 @@
- #define LSSL_USED(x)
- #define LSSL_ALIAS(x)          asm("")
- #endif
-+#endif /* _MSC_VER */
- 
- #endif /* _LIBSSL_SSL_NAMESPACE_H_ */
diff --git a/patches/test.c.patch b/patches/test.c.patch
new file mode 100644
index 0000000..7e80e1f
--- /dev/null
+++ b/patches/test.c.patch
@@ -0,0 +1,11 @@
+--- tests/test.c.orig   2025-10-07 09:57:42.853015505 -0500
++++ tests/test.c        2025-10-07 09:58:08.872499852 -0500
+@@ -67,7 +67,7 @@
+                return t;
+ 
+        /* Create a temporary file for logging in non-verbose mode */
+-       if ((tmp_file = strdup("/tmp/libressl-test.XXXXXXXX")) == NULL)
++       if ((tmp_file = strdup("libressl-test.XXXXXXXX")) == NULL)
+                err(1, "strdup");
+        if ((out_fd = mkstemp(tmp_file)) == -1)
+                err(1, "mkstemp");
diff --git a/patches/tls_config.c.patch b/patches/tls_config.c.patch
new file mode 100644
index 0000000..1342a60
--- /dev/null
+++ b/patches/tls_config.c.patch
@@ -0,0 +1,15 @@
+uid_t can be 64-bit
+
+--- tls/tls_config.c.orig       2024-11-02 21:19:47.090322191 +0100
++++ tls/tls_config.c    2024-11-02 21:38:22.527071689 +0100
+@@ -742,8 +742,8 @@
+ 
+        if (sb.st_uid != getuid()) {
+                tls_config_set_errorx(config, TLS_ERROR_UNKNOWN,
+-                   "session file has incorrect owner (uid %u != %u)",
+-                   sb.st_uid, getuid());
++                   "session file has incorrect owner (uid %llu != %llu)",
++                   (unsigned long long)sb.st_uid, (unsigned long long)getuid());
+                return (-1);
+        }
+        mugo = sb.st_mode & (S_IRWXU|S_IRWXG|S_IRWXO);
diff --git a/patches/win32_amd64_bn_arch.h.patch b/patches/win32_amd64_bn_arch.h.patch
index b7926e3..a6a5ee9 100644
--- a/patches/win32_amd64_bn_arch.h.patch
+++ b/patches/win32_amd64_bn_arch.h.patch
@@ -1,8 +1,8 @@
 We should consider a OPENSSL_NO_BN_ASM if we can't figure
 out how to fix BIGNUM on this OS
 
---- crypto/bn/arch/amd64/bn_arch.h.orig Wed Mar 27 22:17:03 2024
-+++ crypto/bn/arch/amd64/bn_arch.h      Wed Mar 27 22:17:31 2024
+--- crypto/bn/arch/amd64/bn_arch.h.orig Fri Oct 24 07:06:10 2025
++++ crypto/bn/arch/amd64/bn_arch.h      Fri Oct 24 07:06:22 2025
 @@ -20,8 +20,14 @@
  #ifndef HEADER_BN_ARCH_H
  #define HEADER_BN_ARCH_H
@@ -18,7 +18,7 @@ out how to fix BIGNUM on this OS
  #define HAVE_BN_ADD
  #define HAVE_BN_ADD_WORDS
  
-@@ -104,6 +110,7 @@ bn_subw(BN_ULONG a, BN_ULONG b, BN_ULONG *out_borrow, 
+@@ -110,6 +116,7 @@ bn_subw(BN_ULONG a, BN_ULONG b, BN_ULONG *out_borrow, 
  }
  
  #endif /* __GNUC__ */
diff --git a/scripts/test b/scripts/test
index e389728..2148d52 100755
--- a/scripts/test
+++ b/scripts/test
@@ -2,9 +2,45 @@
 set -e
 set -x
 
-unset CC
+if [ "$ARCH" = "" ]; then
+        ARCH=`uname -m`
+fi
+
+if [ "$ARCH" = "mingw32" -o "$ARCH" = "mingw64" -o "$ARCH" = "arm32" ]; then
+        unset CC
+fi
+
 ENABLE_ASM="${ENABLE_ASM:=ON}"
 
+# setup_cross_compiler sets up environment variables for cross-compilation with the given prefix.
+setup_cross_compiler() {
+        cross_prefix=$1
+
+        CC=${cross_prefix}-gcc
+        CXX=${cross_prefix}-g++
+        AR=${cross_prefix}-ar
+        STRIP=${cross_prefix}-strip
+        RANLIB=${cross_prefix}-ranlib
+
+        # If the unversioned symlink for gcc doesn't exist, find versioned binary.
+        if ! command -v "$CC" >/dev/null 2>&1; then
+                gcc_ver=$(find /usr/bin -name "${CC}-[0-9]*" -prune 2>/dev/null \
+                        | sed "s/.*${CC}-//" | sort -n | tail -n 1)
+                CC=${CC}-${gcc_ver}
+                CXX=${CXX}-${gcc_ver}
+        fi
+
+        # Check all binaries actually exist.
+        for c in "$CC" "$CXX" "$AR" "$STRIP" "$RANLIB"; do
+                if ! command -v "$c" >/dev/null 2>&1; then
+                        echo "##### Error: $c not found"
+                        exit 1
+                fi
+        done
+
+        echo "##### Using $($CC --version | head -n 1)"
+}
+
 if type apt-get >/dev/null 2>&1; then
         sudo apt-get update
         sudo apt-get install -y cmake ninja-build
@@ -15,10 +51,6 @@ fi
 
 VERSION=`cat VERSION`
 
-if [ "$ARCH" = "" ]; then
-        ARCH=`uname -m`
-fi
-
 # test macOS
 if [ `uname` = "Darwin" ]; then
         # test autotools
@@ -84,7 +116,7 @@ elif [ "$ARCH" = "native" ]; then
                 ninja test
         )
 
-elif [ "$ARCH" = "mingw32" -o "$ARCH" = "mingw64" ]; then
+elif [ "$ARCH" = "mingw32" ] || [ "$ARCH" = "mingw64" ]; then
         CPU=i686
         if [ "$ARCH" = "mingw64" ]; then
                 CPU=x86_64
@@ -112,39 +144,57 @@ elif [ "$ARCH" = "mingw32" -o "$ARCH" = "mingw64" ]; then
          ninja -j 4
         )
 
-elif [ "$ARCH" = "arm32" -o "$ARCH" = "arm64" ]; then
+elif [ "$ARCH" = "arm32" ] || [ "$ARCH" = "arm64" ]; then
         sudo apt-get install -y qemu-user-static binfmt-support
 
         if [ "$ARCH" = "arm32" ]; then
                 sudo apt-get install -y g++-arm-linux-gnueabihf
                 sudo ln -sf /usr/arm-linux-gnueabihf/lib/ld-linux-armhf.so.3 /lib/
+                setup_cross_compiler arm-linux-gnueabihf
+
                 ./configure --host=arm-linux-gnueabihf
                 LD_LIBRARY_PATH=/usr/arm-linux-gnueabihf/lib make -j 4 check
         else
                 sudo apt-get install -y g++-aarch64-linux-gnu
                 sudo ln -sf /usr/aarch64-linux-gnu/lib/ld-linux-aarch64.so.1 /lib/
+                setup_cross_compiler aarch64-linux-gnu
+
                 ./configure --host=aarch64-linux-gnu
                 LD_LIBRARY_PATH=/usr/aarch64-linux-gnu/lib make -j 4 check
         fi
 
-        file apps/openssl/.libs/openssl
+        file apps/openssl/openssl
 
-elif [ "$ARCH" = "mips32" -o "$ARCH" = "mips64" ]; then
+elif [ "$ARCH" = "loong64" ]; then
+        sudo apt install -y qemu-user-static binfmt-support g++-14-loongarch64-linux-gnu
+        sudo ln -sf /usr/loongarch64-linux-gnu/lib64/ld-linux-loongarch-lp64d.so.1 /lib64
+        setup_cross_compiler loongarch64-linux-gnu
+
+        ./configure --host=loongarch64-linux-gnu
+        LD_LIBRARY_PATH=/usr/loongarch64-linux-gnu/lib make -j 4 check
+
+        file apps/openssl/openssl
+
+elif [ "$ARCH" = "mips32" ] || [ "$ARCH" = "mips64" ]; then
         sudo apt-get install -y qemu-user-static binfmt-support
 
         if [ "$ARCH" = "mips32" ]; then
                 sudo apt-get install -y g++-mips-linux-gnu
-                sudo ln -sf /usr/mipsel-linux-gnu/lib/ld.so.1 /lib/
-                ./configure --host=mipsel-linux-gnu
-                LD_LIBRARY_PATH=/usr/mipsel-linux-gnu/lib make -j 4 check
+                sudo ln -sf /usr/mips-linux-gnu/lib/ld.so.1 /lib/
+                setup_cross_compiler mips-linux-gnu
+
+                ./configure --host=mips-linux-gnu
+                LD_LIBRARY_PATH=/usr/mips-linux-gnu/lib make -j 4 check
         else
                 sudo apt-get install -y g++-mips64el-linux-gnuabi64
                 sudo ln -sf /usr/mips64el-linux-gnuabi64/lib64/ld.so.1 /lib64
+                setup_cross_compiler mips64el-linux-gnuabi64
+
                 ./configure --host=mips64el-linux-gnuabi64
                 LD_LIBRARY_PATH=/usr/mips64el-linux-gnuabi64/lib make -j 4 check
         fi
 
-        file apps/openssl/.libs/openssl
+        file apps/openssl/openssl
 
 elif [ "$ARCH" = "android" ]; then
         export TC_FILE=$ANDROID_NDK_HOME/build/cmake/android.toolchain.cmake
@@ -173,7 +223,7 @@ elif [ "$ARCH" = "android" ]; then
 
                 (
                  build_dir=build-$NAL_$ABI
-                 rm -fr $build_dir include/openssl/opensslconf.h
+                 rm -fr $build_dir
                  mkdir $build_dir
                  cd $build_dir
                  echo "##### cmake -GNinja -DCMAKE_MAKE_PROGRAM=ninja -DANDROID_NDK=$ANDROID_NDK_HOME -DCMAKE_TOOLCHAIN_FILE=$TC_FILE -DANDROID_ABI=$ABI -DANDROID_NATIVE_API_LEVEL=$NAL .."
diff --git a/ssl/CMakeLists.txt b/ssl/CMakeLists.txt
index e2eeab5..637e0f0 100644
--- a/ssl/CMakeLists.txt
+++ b/ssl/CMakeLists.txt
@@ -1,3 +1,18 @@
+#
+# Copyright (c) 2014 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 set(
         SSL_SRC
         bio_ssl.c
@@ -72,6 +87,13 @@ target_include_directories(ssl_obj
                 ../include
                 ${CMAKE_BINARY_DIR}/include)
 
+if(MSVC)
+        # "C4702" - unreachable code
+        set_source_files_properties(d1_pkt.c s3_cbc.c PROPERTIES
+                COMPILE_OPTIONS /wd4702
+        )
+endif()
+
 add_library(bs_obj OBJECT ${BS_SRC})
 target_include_directories(bs_obj
         PRIVATE
@@ -86,16 +108,16 @@ endif()
 
 export_symbol(ssl ${CMAKE_CURRENT_SOURCE_DIR}/ssl.sym)
 target_link_libraries(ssl crypto ${PLATFORM_LIBS})
-if (WIN32)
-        set(SSL_POSTFIX -${SSL_MAJOR_VERSION} PARENT_SCOPE)
-endif()
 set_target_properties(ssl PROPERTIES
-        OUTPUT_NAME ssl${SSL_POSTFIX}
-        ARCHIVE_OUTPUT_NAME ssl${SSL_POSTFIX}
+        OUTPUT_NAME ssl
+        ARCHIVE_OUTPUT_NAME ssl
         EXPORT_NAME SSL
         VERSION ${SSL_VERSION}
         SOVERSION ${SSL_MAJOR_VERSION}
 )
+if(NOT CMAKE_VERSION VERSION_LESS 3.27.0)
+        set_target_properties(ssl PROPERTIES DLL_NAME_WITH_SOVERSION TRUE)
+endif()
 
 target_include_directories(
         ssl
@@ -104,6 +126,30 @@ target_include_directories(
         $<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}>
 )
 
+if(HOST_AARCH64)
+        target_include_directories(ssl_obj PRIVATE ../crypto/arch/aarch64/)
+elseif(HOST_ARM)
+        target_include_directories(ssl_obj PRIVATE ../crypto/arch/arm/)
+elseif(HOST_I386)
+        target_include_directories(ssl_obj PRIVATE ../crypto/arch/i386/)
+elseif(HOST_LOONGARCH64)
+        target_include_directories(ssl_obj PRIVATE ../crypto/arch/loongarch64)
+elseif(HOST_MIPS64)
+        target_include_directories(ssl_obj PRIVATE ../crypto/arch/mips64)
+elseif(HOST_MIPS)
+        target_include_directories(ssl_obj PRIVATE ../crypto/arch/mips)
+elseif(HOST_POWERPC)
+        target_include_directories(ssl_obj PRIVATE ../crypto/arch/powerpc)
+elseif(HOST_POWERPC64)
+        target_include_directories(ssl_obj PRIVATE ../crypto/arch/powerpc64)
+elseif(HOST_RISCV64)
+        target_include_directories(ssl_obj PRIVATE ../crypto/arch/riscv64)
+elseif(HOST_SPARC64)
+        target_include_directories(ssl_obj PRIVATE ../crypto/arch/sparc64)
+elseif(HOST_X86_64)
+        target_include_directories(ssl_obj PRIVATE ../crypto/arch/amd64)
+endif()
+
 install(
         TARGETS ssl
         EXPORT SSL-target
@@ -135,4 +181,3 @@ if(BUILD_SHARED_LIBS)
         add_library(ssl-static STATIC $<TARGET_OBJECTS:ssl_obj>)
         target_link_libraries(ssl-static crypto-static ${PLATFORM_LIBS})
 endif()
-
diff --git a/ssl/Makefile.am b/ssl/Makefile.am
index a7a7d72..3096749 100644
--- a/ssl/Makefile.am
+++ b/ssl/Makefile.am
@@ -1,3 +1,18 @@
+#
+# Copyright (c) 2014 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 include $(top_srcdir)/Makefile.am.common
 
 -include $(abs_top_builddir)/crypto/libcrypto_la_objects.mk
@@ -26,7 +41,7 @@ EXTRA_libssl_la_DEPENDENCIES = libssl_la_objects.mk
 
 libssl_la_objects.mk: Makefile
         @echo "libssl_la_objects= $(libssl_la_OBJECTS)" \
-          | sed 's/  */ $$\(abs_top_builddir\)\/ssl\//g' \
+          | sed 's/  */ $$\(top_builddir\)\/ssl\//g' \
           > libssl_la_objects.mk
 
 .PHONY: remove_bs_objects
@@ -114,3 +129,59 @@ noinst_HEADERS += tls12_internal.h
 noinst_HEADERS += tls13_internal.h
 noinst_HEADERS += tls13_handshake.h
 noinst_HEADERS += tls13_record.h
+
+# arch
+if HOST_AARCH64
+libssl_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/aarch64/
+endif
+noinst_HEADERS += $(top_srcdir)/crypto/arch/aarch64/crypto_arch.h
+
+if HOST_ARM
+libssl_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/arm/
+endif
+noinst_HEADERS += $(top_srcdir)/crypto/arch/arm/crypto_arch.h
+
+if HOST_I386
+libssl_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/i386/
+endif
+noinst_HEADERS += $(top_srcdir)/crypto/arch/i386/crypto_arch.h
+
+if HOST_LOONGARCH64
+libssl_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/loongarch64/
+endif
+noinst_HEADERS += $(top_srcdir)/crypto/arch/loongarch64/crypto_arch.h
+
+if HOST_MIPS
+libssl_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/mips/
+endif
+noinst_HEADERS += $(top_srcdir)/crypto/arch/mips/crypto_arch.h
+
+if HOST_MIPS64
+libssl_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/mips64/
+endif
+noinst_HEADERS += $(top_srcdir)/crypto/arch/mips64/crypto_arch.h
+
+if HOST_POWERPC
+libssl_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/powerpc/
+endif
+noinst_HEADERS += $(top_srcdir)/crypto/arch/powerpc/crypto_arch.h
+
+if HOST_POWERPC64
+libssl_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/powerpc64/
+endif
+noinst_HEADERS += $(top_srcdir)/crypto/arch/powerpc64/crypto_arch.h
+
+if HOST_RISCV64
+libssl_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/riscv64/
+endif
+noinst_HEADERS += $(top_srcdir)/crypto/arch/riscv64/crypto_arch.h
+
+if HOST_SPARC64
+libssl_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/sparc64/
+endif
+noinst_HEADERS += $(top_srcdir)/crypto/arch/sparc64/crypto_arch.h
+
+if HOST_X86_64
+libssl_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/amd64/
+endif
+noinst_HEADERS += $(top_srcdir)/crypto/arch/amd64/crypto_arch.h
diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt
index 480d893..eaf4ed1 100644
--- a/tests/CMakeLists.txt
+++ b/tests/CMakeLists.txt
@@ -1,3 +1,18 @@
+#
+# Copyright (c) 2015 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 add_definitions(-DLIBRESSL_CRYPTO_INTERNAL)
 
 include_directories(
@@ -6,9 +21,13 @@ include_directories(
         ../crypto/asn1
         ../crypto/bio
         ../crypto/bn
+        ../crypto/bytestring
         ../crypto/curve25519
+        ../crypto/ec
         ../crypto/evp
+        ../crypto/mlkem
         ../crypto/modes
+        ../crypto/sha
         ../crypto/x509
         ../ssl
         ../apps/openssl
@@ -18,6 +37,30 @@ include_directories(
         ../include/compat
 )
 
+if(HOST_AARCH64)
+        include_directories(../crypto/arch/aarch64/)
+elseif(HOST_ARM)
+        include_directories(../crypto/arch/arm/)
+elseif(HOST_I386)
+        include_directories(../crypto/arch/i386/)
+elseif(HOST_LOONGARCH64)
+        include_directories(../crypto/arch/loongarch64)
+elseif(HOST_MIPS64)
+        include_directories(../crypto/arch/mips64)
+elseif(HOST_MIPS)
+        include_directories(../crypto/arch/mips)
+elseif(HOST_POWERPC)
+        include_directories(../crypto/arch/powerpc)
+elseif(HOST_POWERPC64)
+        include_directories(../crypto/arch/powerpc64)
+elseif(HOST_RISCV64)
+        include_directories(../crypto/arch/riscv64)
+elseif(HOST_SPARC64)
+        include_directories(../crypto/arch/sparc64)
+elseif(HOST_X86_64)
+        include_directories(../crypto/arch/amd64)
+endif()
+
 add_definitions(-D_PATH_SSL_CA_FILE=\"${CMAKE_CURRENT_SOURCE_DIR}/../cert.pem\")
 
 file(TO_NATIVE_PATH ${CMAKE_CURRENT_SOURCE_DIR} TEST_SOURCE_DIR)
@@ -37,6 +80,12 @@ function(add_platform_test TEST_NAME)
         endif()
 endfunction()
 
+# XXX - should probably be in their own static lib
+set(TEST_HELPER_SRC test.c test_util.c)
+if(WIN32)
+        set(TEST_HELPER_SRC ${TEST_HELPER_SRC} compat/mkstemp.c)
+endif()
+
 # aeadtest
 add_executable(aeadtest aeadtest.c)
 target_link_libraries(aeadtest ${OPENSSL_TEST_LIBS})
@@ -194,8 +243,13 @@ add_executable(bn_convert bn_convert.c)
 target_link_libraries(bn_convert ${OPENSSL_TEST_LIBS})
 add_platform_test(bn_convert bn_convert)
 
+# bn_ffdh
+add_executable(bn_ffdh bn_ffdh.c)
+target_link_libraries(bn_ffdh ${OPENSSL_TEST_LIBS})
+add_platform_test(bn_ffdh bn_ffdh)
+
 # bn_gcd
-add_executable(bn_gcd bn_cmp.c)
+add_executable(bn_gcd bn_gcd.c)
 target_link_libraries(bn_gcd ${OPENSSL_TEST_LIBS})
 add_platform_test(bn_gcd bn_gcd)
 
@@ -303,9 +357,10 @@ target_link_libraries(cipherstest ${OPENSSL_TEST_LIBS})
 add_platform_test(cipherstest cipherstest)
 
 ## clienttest
-#add_executable(clienttest clienttest.c)
-#target_link_libraries(clienttest ${OPENSSL_TEST_LIBS})
-#add_platform_test(clienttest clienttest)
+add_executable(clienttest clienttest.c)
+target_link_libraries(clienttest ${OPENSSL_TEST_LIBS})
+prepare_emscripten_test_target(clienttest)
+add_platform_test(clienttest clienttest)
 
 # cmstest
 add_executable(cmstest cmstest.c)
@@ -368,6 +423,7 @@ add_platform_test(ecc_cdh ecc_cdh)
 # ec_asn1_test
 add_executable(ec_asn1_test ec_asn1_test.c)
 target_link_libraries(ec_asn1_test ${OPENSSL_TEST_LIBS})
+prepare_emscripten_test_target(ec_asn1_test)
 add_platform_test(ec_asn1_test ec_asn1_test)
 
 # ec_point_conversion
@@ -396,16 +452,16 @@ add_executable(ed25519test ed25519test.c)
 target_link_libraries(ed25519test ${OPENSSL_TEST_LIBS})
 add_platform_test(ed25519test ed25519test)
 
+# err_test
+add_executable(err_test err_test.c)
+target_link_libraries(err_test ${OPENSSL_TEST_LIBS})
+add_platform_test(err_test err_test)
+
 # evp_ecx_test
 add_executable(evp_ecx_test evp_ecx_test.c)
 target_link_libraries(evp_ecx_test ${OPENSSL_TEST_LIBS})
 add_platform_test(evp_ecx_test evp_ecx_test)
 
-# evp_pkey_check
-add_executable(evp_pkey_check evp_pkey_check.c)
-target_link_libraries(evp_pkey_check ${OPENSSL_TEST_LIBS})
-add_platform_test(evp_pkey_check evp_pkey_check)
-
 # evp_pkey_cleanup
 add_executable(evp_pkey_cleanup evp_pkey_cleanup.c)
 target_link_libraries(evp_pkey_cleanup ${OPENSSL_TEST_LIBS})
@@ -420,6 +476,7 @@ add_platform_test(evptest evptest ${CMAKE_CURRENT_SOURCE_DIR}/evptests.txt)
 # evp_test
 add_executable(evp_test evp_test.c)
 target_link_libraries(evp_test ${OPENSSL_TEST_LIBS})
+prepare_emscripten_test_target(evp_test)
 add_platform_test(evp_test evp_test)
 
 # exdata_test
@@ -507,10 +564,34 @@ prepare_emscripten_test_target(lhash_test)
 add_platform_test(lhash_test lhash_test)
 
 # md_test
-add_executable(md_test md_test.c)
+add_executable(md_test md_test.c ${TEST_HELPER_SRC})
 target_link_libraries(md_test ${OPENSSL_TEST_LIBS})
 add_platform_test(md_test md_test)
 
+# mlkem_tests
+add_executable(mlkem_tests mlkem_tests.c parse_test_file.c)
+target_link_libraries(mlkem_tests ${OPENSSL_TEST_LIBS})
+prepare_emscripten_test_target(mlkem_tests)
+if(NOT MSVC)
+        add_test(NAME mlkem_tests COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/mlkem_tests.sh)
+        set_tests_properties(mlkem_tests PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}")
+else()
+        add_test(NAME mlkem_tests COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/mlkem_tests.bat $<TARGET_FILE:mlkem_tests>)
+endif()
+set_tests_properties(mlkem_tests PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}")
+
+# mlkem_iteration_tests
+add_executable(mlkem_iteration_tests mlkem_iteration_tests.c mlkem_tests_util.c)
+target_link_libraries(mlkem_iteration_tests ${OPENSSL_TEST_LIBS})
+prepare_emscripten_test_target(mlkem_iteration_tests)
+add_platform_test(mlkem_iteration_tests mlkem_iteration_tests)
+
+# mlkem_unittest
+add_executable(mlkem_unittest mlkem_unittest.c mlkem_tests_util.c)
+target_link_libraries(mlkem_unittest ${OPENSSL_TEST_LIBS})
+prepare_emscripten_test_target(mlkem_unittest)
+add_platform_test(mlkem_unittest mlkem_unittest)
+
 # objectstest
 add_executable(objectstest objectstest.c)
 target_link_libraries(objectstest ${OPENSSL_TEST_LIBS})
@@ -520,7 +601,7 @@ add_platform_test(objectstest objectstest)
 if(ENABLE_EXTRATESTS)
         add_executable(ocsp_test ocsp_test.c)
         target_link_libraries(ocsp_test ${OPENSSL_TEST_LIBS})
-        if(NOT MSVC)
+        if(NOT WIN32)
                 add_test(NAME ocsptest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/ocsptest.sh)
         else()
                 add_test(NAME ocsptest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/ocsptest.bat $<TARGET_FILE:ocsp_test>)
@@ -569,20 +650,14 @@ add_platform_test(policy policy)
 # pq_test
 add_executable(pq_test pq_test.c)
 target_link_libraries(pq_test ${OPENSSL_TEST_LIBS})
-if(NOT MSVC)
-        add_test(NAME pq_test COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/pq_test.sh)
-else()
-        add_test(NAME pq_test COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/pq_test.bat
-                $<TARGET_FILE:pq_test>)
-endif()
-set_tests_properties(pq_test PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}")
+add_platform_test(pq_test pq_test)
 
 # quictest
 set(QUICTEST_SRC quictest.c)
 add_executable(quictest ${QUICTEST_SRC})
 target_link_libraries(quictest ${OPENSSL_TEST_LIBS})
 prepare_emscripten_test_target(quictest)
-if(NOT MSVC)
+if(NOT WIN32)
         add_test(NAME quictest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/quictest.sh)
 else()
         add_test(NAME quictest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/quictest.bat $<TARGET_FILE:quictest>)
@@ -614,6 +689,18 @@ add_executable(record_layer_test record_layer_test.c)
 target_link_libraries(record_layer_test ${OPENSSL_TEST_LIBS})
 add_platform_test(record_layer_test record_layer_test)
 
+# renegotiation_test
+set(RENEGOTIATION_TEST_SRC renegotiation_test.c)
+add_executable(renegotiation_test ${RENEGOTIATION_TEST_SRC})
+target_link_libraries(renegotiation_test ${OPENSSL_TEST_LIBS})
+prepare_emscripten_test_target(renegotiation_test)
+if(NOT MSVC)
+        add_test(NAME renegotiation_test COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/renegotiation_test.sh)
+else()
+        add_test(NAME renegotiation_test COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/renegotiation_test.bat $<TARGET_FILE:renegotiation_test>)
+endif()
+set_tests_properties(renegotiation_test PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}")
+
 # rfc3779
 add_executable(rfc3779 rfc3779.c)
 target_link_libraries(rfc3779 ${OPENSSL_TEST_LIBS})
@@ -632,6 +719,11 @@ add_executable(rmd_test rmd_test.c)
 target_link_libraries(rmd_test ${OPENSSL_TEST_LIBS})
 add_platform_test(rmd_test rmd_test)
 
+# rsa_method_test
+add_executable(rsa_method_test rsa_method_test.c)
+target_link_libraries(rsa_method_test ${OPENSSL_TEST_LIBS})
+add_platform_test(rsa_method_test rsa_method_test)
+
 # rsa_padding_test
 add_executable(rsa_padding_test rsa_padding_test.c)
 target_link_libraries(rsa_padding_test ${OPENSSL_TEST_LIBS})
@@ -648,7 +740,7 @@ add_platform_test(rsa_test rsa_test)
 add_executable(servertest servertest.c)
 target_link_libraries(servertest ${OPENSSL_TEST_LIBS})
 prepare_emscripten_test_target(servertest)
-if(NOT MSVC)
+if(NOT WIN32)
         add_test(NAME servertest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/servertest.sh)
 else()
         add_test(NAME servertest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/servertest.bat $<TARGET_FILE:servertest>)
@@ -656,7 +748,7 @@ endif()
 set_tests_properties(servertest PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}")
 
 # sha_test
-add_executable(sha_test sha_test.c)
+add_executable(sha_test sha_test.c ${TEST_HELPER_SRC})
 target_link_libraries(sha_test ${OPENSSL_TEST_LIBS})
 add_platform_test(sha_test sha_test)
 
@@ -665,7 +757,7 @@ set(SHUTDOWNTEST_SRC shutdowntest.c)
 add_executable(shutdowntest ${SHUTDOWNTEST_SRC})
 target_link_libraries(shutdowntest ${OPENSSL_TEST_LIBS})
 prepare_emscripten_test_target(shutdowntest)
-if(NOT MSVC)
+if(NOT WIN32)
         add_test(NAME shutdowntest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/shutdowntest.sh)
 else()
         add_test(NAME shutdowntest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/shutdowntest.bat $<TARGET_FILE:shutdowntest>)
@@ -676,7 +768,7 @@ set_tests_properties(shutdowntest PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_D
 # Emscripten does not support socketpair syscall.
 if(NOT (CMAKE_SYSTEM_NAME MATCHES "WindowsStore" OR EMSCRIPTEN))
         set(SIGNERTEST_SRC signertest.c)
-        check_function_exists(pipe2 HAVE_PIPE2)
+        check_symbol_exists(pipe2 "fcntl.h;unistd.h" HAVE_PIPE2)
         if(HAVE_PIPE2)
                 add_definitions(-DHAVE_PIPE2)
         else()
@@ -737,7 +829,7 @@ add_platform_test(ssl_versions ssl_versions)
 add_executable(ssltest ssltest.c)
 target_link_libraries(ssltest ${OPENSSL_TEST_LIBS})
 prepare_emscripten_test_target(ssltest)
-if(NOT MSVC)
+if(NOT WIN32)
         add_test(NAME ssltest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/ssltest.sh)
 else()
         add_test(NAME ssltest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/ssltest.bat $<TARGET_FILE:ssltest> $<TARGET_FILE:openssl>)
@@ -748,7 +840,7 @@ set_tests_properties(ssltest PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}")
 # access various files for IO. Adding such files to --preload-file is infeasible.
 if(NOT EMSCRIPTEN)
         # testdsa
-        if(NOT MSVC)
+        if(NOT WIN32)
                 add_test(NAME testdsa COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/testdsa.sh)
         else()
                 add_test(NAME testdsa COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/testdsa.bat $<TARGET_FILE:openssl>)
@@ -756,7 +848,7 @@ if(NOT EMSCRIPTEN)
         set_tests_properties(testdsa PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}")
 
         # testenc
-        if(NOT MSVC)
+        if(NOT WIN32)
                 add_test(NAME testenc COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/testenc.sh)
         else()
                 add_test(NAME testenc COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/testenc.bat $<TARGET_FILE:openssl>)
@@ -764,7 +856,7 @@ if(NOT EMSCRIPTEN)
         set_tests_properties(testenc PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}")
 
         # testrsa
-        if(NOT MSVC)
+        if(NOT WIN32)
                 add_test(NAME testrsa COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/testrsa.sh)
         else()
                 add_test(NAME testrsa COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/testrsa.bat $<TARGET_FILE:openssl>)
@@ -792,7 +884,7 @@ add_platform_test(tlslegacytest tlslegacytest)
 # Emscripten does not support socketpair syscall.
 if(NOT (CMAKE_SYSTEM_NAME MATCHES "WindowsStore" OR EMSCRIPTEN))
         set(TLSTEST_SRC tlstest.c)
-        check_function_exists(pipe2 HAVE_PIPE2)
+        check_symbol_exists(pipe2 "fcntl.h;unistd.h" HAVE_PIPE2)
         if(HAVE_PIPE2)
                 add_definitions(-DHAVE_PIPE2)
         else()
@@ -801,7 +893,7 @@ if(NOT (CMAKE_SYSTEM_NAME MATCHES "WindowsStore" OR EMSCRIPTEN))
 
         add_executable(tlstest ${TLSTEST_SRC})
         target_link_libraries(tlstest ${LIBTLS_TEST_LIBS})
-        if(NOT MSVC)
+        if(NOT WIN32)
                 add_test(NAME tlstest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/tlstest.sh)
         else()
                 add_test(NAME tlstest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/tlstest.bat $<TARGET_FILE:tlstest>)
@@ -834,11 +926,6 @@ add_executable(verifytest verifytest.c)
 target_link_libraries(verifytest ${LIBTLS_TEST_LIBS})
 add_platform_test(verifytest verifytest)
 
-# whirlpool_test
-add_executable(whirlpool_test whirlpool_test.c)
-target_link_libraries(whirlpool_test ${OPENSSL_TEST_LIBS})
-add_platform_test(whirlpool_test whirlpool_test)
-
 # x25519test
 add_executable(x25519test x25519test.c)
 target_link_libraries(x25519test ${OPENSSL_TEST_LIBS})
@@ -870,10 +957,10 @@ add_executable(x509_info x509_info.c)
 target_link_libraries(x509_info ${OPENSSL_TEST_LIBS})
 add_platform_test(x509_info x509_info)
 
-# x509name
-add_executable(x509name x509name.c)
-target_link_libraries(x509name ${OPENSSL_TEST_LIBS})
-add_platform_test(x509name x509name)
+# x509_name_test
+add_executable(x509_name_test x509_name_test.c)
+target_link_libraries(x509_name_test ${OPENSSL_TEST_LIBS})
+add_platform_test(x509_name_test x509_name_test)
 
 # x509req_ext
 add_executable(x509req_ext x509req_ext.c)
diff --git a/tests/Makefile.am b/tests/Makefile.am
index 76ed83a..22e3dee 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -1,3 +1,18 @@
+#
+# Copyright (c) 2015 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 include $(top_srcdir)/Makefile.am.common
 
 -include $(abs_top_builddir)/crypto/libcrypto_la_objects.mk
@@ -10,15 +25,65 @@ AM_CPPFLAGS += -I $(top_srcdir)/crypto/
 AM_CPPFLAGS += -I $(top_srcdir)/crypto/asn1
 AM_CPPFLAGS += -I $(top_srcdir)/crypto/bio
 AM_CPPFLAGS += -I $(top_srcdir)/crypto/bn
+AM_CPPFLAGS += -I $(top_srcdir)/crypto/bytestring
 AM_CPPFLAGS += -I $(top_srcdir)/crypto/curve25519
+AM_CPPFLAGS += -I $(top_srcdir)/crypto/ec
 AM_CPPFLAGS += -I $(top_srcdir)/crypto/evp
+AM_CPPFLAGS += -I $(top_srcdir)/crypto/mlkem
 AM_CPPFLAGS += -I $(top_srcdir)/crypto/modes
+AM_CPPFLAGS += -I $(top_srcdir)/crypto/sha
 AM_CPPFLAGS += -I $(top_srcdir)/crypto/x509
 AM_CPPFLAGS += -I $(top_srcdir)/ssl
+AM_CPPFLAGS += -I $(top_srcdir)/tests
 AM_CPPFLAGS += -I $(top_srcdir)/apps/openssl
 AM_CPPFLAGS += -I $(top_srcdir)/apps/openssl/compat
 AM_CPPFLAGS += -D_PATH_SSL_CA_FILE=\"$(top_srcdir)/cert.pem\"
 
+# arch
+if HOST_AARCH64
+AM_CPPFLAGS += -I$(top_srcdir)/crypto/arch/aarch64/
+endif
+
+if HOST_ARM
+AM_CPPFLAGS += -I$(top_srcdir)/crypto/arch/arm/
+endif
+
+if HOST_I386
+AM_CPPFLAGS += -I$(top_srcdir)/crypto/arch/i386/
+endif
+
+if HOST_LOONGARCH64
+AM_CPPFLAGS += -I$(top_srcdir)/crypto/arch/loongarch64/
+endif
+
+if HOST_MIPS
+AM_CPPFLAGS += -I$(top_srcdir)/crypto/arch/mips/
+endif
+
+if HOST_MIPS64
+AM_CPPFLAGS += -I$(top_srcdir)/crypto/arch/mips64/
+endif
+
+if HOST_POWERPC
+AM_CPPFLAGS += -I$(top_srcdir)/crypto/arch/powerpc/
+endif
+
+if HOST_POWERPC64
+AM_CPPFLAGS += -I$(top_srcdir)/crypto/arch/powerpc64/
+endif
+
+if HOST_RISCV64
+AM_CPPFLAGS += -I$(top_srcdir)/crypto/arch/riscv64/
+endif
+
+if HOST_SPARC64
+AM_CPPFLAGS += -I$(top_srcdir)/crypto/arch/sparc64/
+endif
+
+if HOST_X86_64
+AM_CPPFLAGS += -I$(top_srcdir)/crypto/arch/amd64/
+endif
+
 noinst_LTLIBRARIES = libtest.la
 libtest_la_LIBADD = $(libcrypto_la_objects)
 libtest_la_LIBADD += $(libcompat_la_objects)
@@ -37,6 +102,13 @@ check_PROGRAMS =
 EXTRA_DIST = CMakeLists.txt
 DISTCLEANFILES = pidwraptest.txt
 
+# XXX - should probably be in their own static lib
+TEST_HELPER_SRC = test.c test_util.c
+noinst_HEADERS = test.h
+EXTRA_DIST += $(TEST_HELPER_SRC)
+# Needed by test helper on MSVC
+EXTRA_DIST += compat/mkstemp.c
+
 # aeadtest
 TESTS += aeadtest.sh
 check_PROGRAMS += aeadtest
@@ -193,6 +265,11 @@ TESTS += bn_convert
 check_PROGRAMS += bn_convert
 bn_convert_SOURCES = bn_convert.c
 
+# bn_ffdh
+TESTS += bn_ffdh
+check_PROGRAMS += bn_ffdh
+bn_ffdh_SOURCES = bn_ffdh.c
+
 # bn_gcd
 TESTS += bn_gcd
 check_PROGRAMS += bn_gcd
@@ -289,7 +366,7 @@ chachatest_SOURCES = chachatest.c
 TESTS += cipher_list
 check_PROGRAMS += cipher_list
 cipher_list_SOURCES = cipher_list.c
-noinst_HEADERS = tests.h
+noinst_HEADERS += tests.h
 
 # cipherstest
 TESTS += cipherstest
@@ -297,9 +374,9 @@ check_PROGRAMS += cipherstest
 cipherstest_SOURCES = cipherstest.c
 
 ## clienttest
-#TESTS += clienttest
-#check_PROGRAMS += clienttest
-#clienttest_SOURCES = clienttest.c
+TESTS += clienttest
+check_PROGRAMS += clienttest
+clienttest_SOURCES = clienttest.c
 
 # cmstest
 TESTS += cmstest
@@ -389,16 +466,16 @@ TESTS += ed25519test
 check_PROGRAMS += ed25519test
 ed25519test_SOURCES = ed25519test.c
 
+# err_test
+TESTS += err_test
+check_PROGRAMS += err_test
+err_test_SOURCES = err_test.c
+
 # evp_ecx_test
 TESTS += evp_ecx_test
 check_PROGRAMS += evp_ecx_test
 evp_ecx_test_SOURCES = evp_ecx_test.c
 
-# evp_pkey_check
-TESTS += evp_pkey_check
-check_PROGRAMS += evp_pkey_check
-evp_pkey_check_SOURCES = evp_pkey_check.c
-
 # evp_pkey_cleanup
 TESTS += evp_pkey_cleanup
 check_PROGRAMS += evp_pkey_cleanup
@@ -499,7 +576,36 @@ lhash_test_SOURCES = lhash_test.c
 # md_test
 TESTS += md_test
 check_PROGRAMS += md_test
-md_test_SOURCES = md_test.c
+md_test_SOURCES = md_test.c $(TEST_HELPER_SRC)
+
+noinst_HEADERS += mlkem_tests_util.h
+noinst_HEADERS += parse_test_file.h
+
+# mlkem_tests
+TESTS += mlkem_tests.sh
+check_PROGRAMS += mlkem_tests
+mlkem_tests_SOURCES = mlkem_tests.c parse_test_file.c
+EXTRA_DIST += mlkem_tests.sh mlkem_tests.bat
+EXTRA_DIST += mlkem768_decap_tests.txt
+EXTRA_DIST += mlkem768_encap_tests.txt
+EXTRA_DIST += mlkem768_keygen_tests.txt
+EXTRA_DIST += mlkem768_nist_decap_tests.txt
+EXTRA_DIST += mlkem768_nist_keygen_tests.txt
+EXTRA_DIST += mlkem1024_decap_tests.txt
+EXTRA_DIST += mlkem1024_encap_tests.txt
+EXTRA_DIST += mlkem1024_keygen_tests.txt
+EXTRA_DIST += mlkem1024_nist_decap_tests.txt
+EXTRA_DIST += mlkem1024_nist_keygen_tests.txt
+
+# mlkem_iteration_tests
+TESTS += mlkem_iteration_tests
+check_PROGRAMS += mlkem_iteration_tests
+mlkem_iteration_tests_SOURCES = mlkem_iteration_tests.c mlkem_tests_util.c
+
+# mlkem_unittest
+TESTS += mlkem_unittest
+check_PROGRAMS += mlkem_unittest
+mlkem_unittest_SOURCES = mlkem_unittest.c mlkem_tests_util.c
 
 # objectstest
 TESTS += objectstest
@@ -578,11 +684,9 @@ EXTRA_DIST += policy_root2.pem
 EXTRA_DIST += policy_root_cross_inhibit_mapping.pem
 
 # pq_test
-TESTS += pq_test.sh
+TESTS += pq_test
 check_PROGRAMS += pq_test
 pq_test_SOURCES = pq_test.c
-EXTRA_DIST += pq_test.sh pq_test.bat
-EXTRA_DIST += pq_expected.txt
 
 # quictest
 TESTS += quictest.sh
@@ -615,6 +719,12 @@ TESTS += record_layer_test
 check_PROGRAMS += record_layer_test
 record_layer_test_SOURCES = record_layer_test.c
 
+# renegotiation_test
+TESTS += renegotiation_test.sh
+check_PROGRAMS += renegotiation_test
+renegotiation_test_SOURCES = renegotiation_test.c
+EXTRA_DIST += renegotiation_test.sh renegotiation_test.bat
+
 # rfc3779
 TESTS += rfc3779
 rfc3779_CPPFLAGS = $(AM_CPPFLAGS)
@@ -637,6 +747,11 @@ TESTS += rmd_test
 check_PROGRAMS += rmd_test
 rmd_test_SOURCES = rmd_test.c
 
+# rsa_method_test
+TESTS += rsa_method_test
+check_PROGRAMS += rsa_method_test
+rsa_method_test_SOURCES = rsa_method_test.c
+
 # rsa_padding_test
 TESTS += rsa_padding_test
 check_PROGRAMS += rsa_padding_test
@@ -658,7 +773,7 @@ EXTRA_DIST += servertest.sh servertest.bat
 # sha_test
 TESTS += sha_test
 check_PROGRAMS += sha_test
-sha_test_SOURCES = sha_test.c
+sha_test_SOURCES = sha_test.c $(TEST_HELPER_SRC)
 
 # shutdowntest
 TESTS += shutdowntest.sh
@@ -795,11 +910,6 @@ TESTS += verifytest
 check_PROGRAMS += verifytest
 verifytest_SOURCES = verifytest.c
 
-# whirlpool
-TESTS += whirlpool_test
-check_PROGRAMS += whirlpool_test
-whirlpool_test_SOURCES = whirlpool_test.c
-
 # x25519test
 TESTS += x25519test
 check_PROGRAMS += x25519test
@@ -830,10 +940,10 @@ TESTS += x509_info
 check_PROGRAMS += x509_info
 x509_info_SOURCES = x509_info.c
 
-# x509name
-TESTS += x509name
-check_PROGRAMS += x509name
-x509name_SOURCES = x509name.c
+# x509_name_test
+TESTS += x509_name_test
+check_PROGRAMS += x509_name_test
+x509_name_test_SOURCES = x509_name_test.c
 
 # x509req_ext
 TESTS += x509req_ext
diff --git a/tests/aeadtest.sh b/tests/aeadtest.sh
index 212e354..bb09df2 100755
--- a/tests/aeadtest.sh
+++ b/tests/aeadtest.sh
@@ -1,4 +1,19 @@
 #!/bin/sh
+#
+# Copyright (c) 2014 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 set -e
 TEST=./aeadtest
 if [ -e ./aeadtest.exe ]; then
diff --git a/tests/arc4randomforktest.sh b/tests/arc4randomforktest.sh
index fe03068..bbe7641 100755
--- a/tests/arc4randomforktest.sh
+++ b/tests/arc4randomforktest.sh
@@ -1,4 +1,19 @@
 #!/bin/sh
+#
+# Copyright (c) 2014 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 set -e
 ./arc4randomforktest
 ./arc4randomforktest -b
diff --git a/tests/cmake/CMakeLists.txt b/tests/cmake/CMakeLists.txt
index 956fbfd..c3b7c4f 100644
--- a/tests/cmake/CMakeLists.txt
+++ b/tests/cmake/CMakeLists.txt
@@ -1,3 +1,18 @@
+#
+# Copyright (c) 2023 Pierre Wendling
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 cmake_minimum_required(VERSION 3.5)
 
 project(LibreSSL_Consumer LANGUAGES C)
diff --git a/tests/compat/mkstemp.c b/tests/compat/mkstemp.c
new file mode 100644
index 0000000..fe3d15a
--- /dev/null
+++ b/tests/compat/mkstemp.c
@@ -0,0 +1,52 @@
+/*
+musl as a whole is licensed under the following standard MIT license:
+
+----------------------------------------------------------------------
+Copyright © 2005-2020 Rich Felker, et al.
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+----------------------------------------------------------------------
+*/
+
+#include <string.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <limits.h>
+#include <errno.h>
+
+#include <io.h>
+
+int mkstemp(char *template)
+{
+        int fd;
+retry:
+        if (!_mktemp(template)) return -1;
+        fd = open(template, O_RDWR | O_CREAT | O_EXCL, 0600);
+        if (fd >= 0) return fd;
+        if (errno == EEXIST) {
+                /* this is safe because mktemp verified
+                 * that we have a valid template string */
+                strcpy(template+strlen(template)-6, "XXXXXX");
+                goto retry;
+        }
+        return -1;
+}
diff --git a/tests/compat/pipe2.c b/tests/compat/pipe2.c
index c27a858..d7b4062 100644
--- a/tests/compat/pipe2.c
+++ b/tests/compat/pipe2.c
@@ -42,7 +42,7 @@ static int setfl(int fd, int flag)
 static void create_issue_1069_sentinels(int socket_vector[2])
 {
         int fd = open("CONIN$", O_RDONLY);
-        if (fd == -1 || fd > socket_vector[0] && fd > socket_vector[1]) {
+        if (fd == -1 || (fd > socket_vector[0] && fd > socket_vector[1])) {
                 return;
         }
         create_issue_1069_sentinels(socket_vector);
diff --git a/tests/dtlstest.sh b/tests/dtlstest.sh
index 8f9b229..f0b7161 100755
--- a/tests/dtlstest.sh
+++ b/tests/dtlstest.sh
@@ -1,4 +1,19 @@
 #!/bin/sh
+#
+# Copyright (c) 2021 Kinichiro Inoguchi
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 set -e
 
 dtlstest_bin=./dtlstest
diff --git a/tests/evptest.sh b/tests/evptest.sh
index ba44d75..ddd7445 100755
--- a/tests/evptest.sh
+++ b/tests/evptest.sh
@@ -1,4 +1,19 @@
 #!/bin/sh
+#
+# Copyright (c) 2014 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 set -e
 TEST=./evptest
 if [ -e ./evptest.exe ]; then
diff --git a/tests/keypairtest.sh b/tests/keypairtest.sh
index 8bb7d9f..f2c20c4 100755
--- a/tests/keypairtest.sh
+++ b/tests/keypairtest.sh
@@ -1,4 +1,19 @@
 #!/bin/sh
+#
+# Copyright (c) 2018 Kinichiro Inoguchi
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 set -e
 TEST=./keypairtest
 if [ -e ./keypairtest.exe ]; then
diff --git a/tests/mlkem_tests.bat b/tests/mlkem_tests.bat
new file mode 100644
index 0000000..618c9e0
--- /dev/null
+++ b/tests/mlkem_tests.bat
@@ -0,0 +1,63 @@
+@echo off

+setlocal enabledelayedexpansion

+

+:: Copyright (c) 2025 Theo Beuhler

+::

+:: Permission to use, copy, modify, and distribute this software for any

+:: purpose with or without fee is hereby granted, provided that the above

+:: copyright notice and this permission notice appear in all copies.

+::

+:: THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES

+:: WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF

+:: MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR

+:: ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES

+:: WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN

+:: ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF

+:: OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

+

+set mlkem_tests_bin=%1

+set mlkem_tests_bin=%mlkem_tests_bin:/=\%

+if not exist %mlkem_tests_bin% exit /b 1

+

+%mlkem_tests_bin% mlkem768_decap_tests          %srcdir%\mlkem768_decap_tests.txt

+if !errorlevel! neq 0 (

+        exit /b 1

+)

+%mlkem_tests_bin% mlkem768_encap_tests          %srcdir%\mlkem768_encap_tests.txt

+if !errorlevel! neq 0 (

+        exit /b 1

+)

+%mlkem_tests_bin% mlkem768_keygen_tests         %srcdir%\mlkem768_keygen_tests.txt

+if !errorlevel! neq 0 (

+        exit /b 1

+)

+%mlkem_tests_bin% mlkem768_nist_decap_tests     %srcdir%\mlkem768_nist_decap_tests.txt

+if !errorlevel! neq 0 (

+        exit /b 1

+)

+%mlkem_tests_bin% mlkem768_nist_keygen_tests    %srcdir%\mlkem768_nist_keygen_tests.txt

+if !errorlevel! neq 0 (

+        exit /b 1

+)

+%mlkem_tests_bin% mlkem1024_decap_tests         %srcdir%\mlkem1024_decap_tests.txt

+if !errorlevel! neq 0 (

+        exit /b 1

+)

+%mlkem_tests_bin% mlkem1024_encap_tests         %srcdir%\mlkem1024_encap_tests.txt

+if !errorlevel! neq 0 (

+        exit /b 1

+)

+%mlkem_tests_bin% mlkem1024_keygen_tests        %srcdir%\mlkem1024_keygen_tests.txt

+if !errorlevel! neq 0 (

+        exit /b 1

+)

+%mlkem_tests_bin% mlkem1024_nist_decap_tests    %srcdir%\mlkem1024_nist_decap_tests.txt

+if !errorlevel! neq 0 (

+        exit /b 1

+)

+%mlkem_tests_bin% mlkem1024_nist_keygen_tests   %srcdir%\mlkem1024_nist_keygen_tests.txt

+if !errorlevel! neq 0 (

+        exit /b 1

+)

+

+endlocal

diff --git a/tests/mlkem_tests.sh b/tests/mlkem_tests.sh
new file mode 100755
index 0000000..cbc0f0b
--- /dev/null
+++ b/tests/mlkem_tests.sh
@@ -0,0 +1,39 @@
+#!/bin/sh
+#
+# Copyright (c) 2024 Theo Buehler
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+set -e
+
+TEST=./mlkem_tests
+if [ -e ./mlkem_tests.exe ]; then
+        TEST=./mlkem_tests.exe
+elif [ -e ./mlkem_tests.js ]; then
+        TEST="node ./mlkem_tests.js"
+fi
+
+if [ -z $srcdir ]; then
+        srcdir=.
+fi
+
+$TEST mlkem768_decap_tests              $srcdir/mlkem768_decap_tests.txt
+$TEST mlkem768_encap_tests              $srcdir/mlkem768_encap_tests.txt
+$TEST mlkem768_keygen_tests             $srcdir/mlkem768_keygen_tests.txt
+$TEST mlkem768_nist_decap_tests         $srcdir/mlkem768_nist_decap_tests.txt
+$TEST mlkem768_nist_keygen_tests        $srcdir/mlkem768_nist_keygen_tests.txt
+$TEST mlkem1024_decap_tests             $srcdir/mlkem1024_decap_tests.txt
+$TEST mlkem1024_encap_tests             $srcdir/mlkem1024_encap_tests.txt
+$TEST mlkem1024_keygen_tests            $srcdir/mlkem1024_keygen_tests.txt
+$TEST mlkem1024_nist_decap_tests        $srcdir/mlkem1024_nist_decap_tests.txt
+$TEST mlkem1024_nist_keygen_tests       $srcdir/mlkem1024_nist_keygen_tests.txt
diff --git a/tests/ocsptest.bat b/tests/ocsptest.bat
index 2b6b66b..8d44ee0 100644
--- a/tests/ocsptest.bat
+++ b/tests/ocsptest.bat
@@ -1,6 +1,19 @@
 @echo off

 setlocal enabledelayedexpansion

-REM     ocspocsp_test_bin.bat

+

+:: Copyright (c) 2016 Kinichiro Inoguchi

+::

+:: Permission to use, copy, modify, and distribute this software for any

+:: purpose with or without fee is hereby granted, provided that the above

+:: copyright notice and this permission notice appear in all copies.

+::

+:: THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES

+:: WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF

+:: MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR

+:: ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES

+:: WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN

+:: ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF

+:: OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

 

 set ocsp_test_bin=%1

 set ocsp_test_bin=%ocsp_test_bin:/=\%

diff --git a/tests/ocsptest.sh b/tests/ocsptest.sh
index a1c266d..71c975e 100755
--- a/tests/ocsptest.sh
+++ b/tests/ocsptest.sh
@@ -1,4 +1,19 @@
 #!/bin/sh
+#
+# Copyright (c) 2016 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 set -e
 TEST=./ocsp_test
 if [ -e ./ocsp_test.exe ]; then
diff --git a/tests/pidwraptest.sh b/tests/pidwraptest.sh
index 04fb5c4..d5a2f71 100755
--- a/tests/pidwraptest.sh
+++ b/tests/pidwraptest.sh
@@ -1,4 +1,19 @@
 #!/bin/sh
+#
+# Copyright (c) 2014 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 ./pidwraptest > pidwraptest.txt
 while read a b;
 do
diff --git a/tests/pq_test.bat b/tests/pq_test.bat
deleted file mode 100644
index 084f06d..0000000
--- a/tests/pq_test.bat
+++ /dev/null
@@ -1,15 +0,0 @@
-@echo off

-setlocal enabledelayedexpansion

-REM     pq_test.bat

-

-set pq_test_bin=%1

-set pq_test_bin=%pq_test_bin:/=\%

-if not exist %pq_test_bin% exit /b 1

-

-set pq_output=pq_output.txt

-if exist %pq_output% del %pq_output%

-

-%pq_test_bin% > %pq_output%

-fc /b %pq_output% %srcdir%\pq_expected.txt

-

-endlocal

diff --git a/tests/pq_test.sh b/tests/pq_test.sh
deleted file mode 100755
index eab6f3c..0000000
--- a/tests/pq_test.sh
+++ /dev/null
@@ -1,9 +0,0 @@
-#!/bin/sh
-set -e
-TEST=./pq_test
-if [ -e ./pq_test.exe ]; then
-        TEST=./pq_test.exe
-elif [ -e ./pq_test.js ]; then
-        TEST="node ./pq_test.js"
-fi
-$TEST | diff -b $srcdir/pq_expected.txt -
diff --git a/tests/quictest.bat b/tests/quictest.bat
index 645fc2f..be731c8 100644
--- a/tests/quictest.bat
+++ b/tests/quictest.bat
@@ -1,6 +1,19 @@
 @echo off

 setlocal enabledelayedexpansion

-REM     quictest.bat

+

+:: Copyright (c) 2022 Brent Cook

+::

+:: Permission to use, copy, modify, and distribute this software for any

+:: purpose with or without fee is hereby granted, provided that the above

+:: copyright notice and this permission notice appear in all copies.

+::

+:: THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES

+:: WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF

+:: MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR

+:: ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES

+:: WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN

+:: ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF

+:: OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

 

 set quictest_bin=%1

 set quictest_bin=%quictest_bin:/=\%

diff --git a/tests/quictest.sh b/tests/quictest.sh
index 23561ad..407a66b 100755
--- a/tests/quictest.sh
+++ b/tests/quictest.sh
@@ -1,4 +1,19 @@
 #!/bin/sh
+#
+# Copyright (c) 2022 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 set -e
 
 quictest_bin=./quictest
diff --git a/tests/renegotiation_test.bat b/tests/renegotiation_test.bat
new file mode 100644
index 0000000..6691a39
--- /dev/null
+++ b/tests/renegotiation_test.bat
@@ -0,0 +1,27 @@
+@echo off

+setlocal enabledelayedexpansion

+

+:: Copyright (c) 2025 Theo Beuhler

+::

+:: Permission to use, copy, modify, and distribute this software for any

+:: purpose with or without fee is hereby granted, provided that the above

+:: copyright notice and this permission notice appear in all copies.

+::

+:: THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES

+:: WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF

+:: MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR

+:: ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES

+:: WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN

+:: ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF

+:: OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

+

+set renegotiation_test_bin=%1

+set renegotiation_test_bin=%renegotiation_test_bin:/=\%

+if not exist %renegotiation_test_bin% exit /b 1

+

+%renegotiation_test_bin% %srcdir%\server1-rsa.pem %srcdir%\server1-rsa-chain.pem %srcdir%\ca-root-rsa.pem

+if !errorlevel! neq 0 (

+        exit /b 1

+)

+

+endlocal

diff --git a/tests/renegotiation_test.sh b/tests/renegotiation_test.sh
new file mode 100755
index 0000000..8d963a2
--- /dev/null
+++ b/tests/renegotiation_test.sh
@@ -0,0 +1,30 @@
+#!/bin/sh
+#
+# Copyright (c) 2025 Theo Buehler
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+set -e
+
+renegotiation_test_bin=./renegotiation_test
+if [ -e ./renegotiation_test.exe ]; then
+        renegotiation_test_bin=./renegotiation_test.exe
+elif [ -e ./renegotiation_test.js ]; then
+        renegotiation_test_bin="node ./renegotiation_test.js"
+fi
+
+if [ -z $srcdir ]; then
+        srcdir=.
+fi
+
+$renegotiation_test_bin $srcdir/server1-rsa.pem $srcdir/server1-rsa-chain.pem $srcdir/ca-root-rsa.pem
diff --git a/tests/servertest.bat b/tests/servertest.bat
index c0bfaa4..d72d8de 100644
--- a/tests/servertest.bat
+++ b/tests/servertest.bat
@@ -1,6 +1,19 @@
 @echo off

 setlocal enabledelayedexpansion

-REM     servertest.bat

+

+:: Copyright (c) 2017 Kinichiro Inoguchi

+::

+:: Permission to use, copy, modify, and distribute this software for any

+:: purpose with or without fee is hereby granted, provided that the above

+:: copyright notice and this permission notice appear in all copies.

+::

+:: THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES

+:: WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF

+:: MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR

+:: ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES

+:: WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN

+:: ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF

+:: OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

 

 set servertest_bin=%1

 set servertest_bin=%servertest_bin:/=\%

diff --git a/tests/servertest.sh b/tests/servertest.sh
index 1662332..4770e4b 100755
--- a/tests/servertest.sh
+++ b/tests/servertest.sh
@@ -1,4 +1,19 @@
 #!/bin/sh
+#
+# Copyright (c) 2017 Kinichiro Inoguchi
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 set -e
 
 servertest_bin=./servertest
diff --git a/tests/shutdowntest.bat b/tests/shutdowntest.bat
index f087dbb..d722fa0 100644
--- a/tests/shutdowntest.bat
+++ b/tests/shutdowntest.bat
@@ -1,6 +1,19 @@
 @echo off

 setlocal enabledelayedexpansion

-REM     shutdowntest.bat

+

+:: Copyright (c) 2024 Theo Beuhler

+::

+:: Permission to use, copy, modify, and distribute this software for any

+:: purpose with or without fee is hereby granted, provided that the above

+:: copyright notice and this permission notice appear in all copies.

+::

+:: THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES

+:: WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF

+:: MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR

+:: ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES

+:: WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN

+:: ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF

+:: OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

 

 set shutdowntest_bin=%1

 set shutdowntest_bin=%shutdowntest_bin:/=\%

diff --git a/tests/shutdowntest.sh b/tests/shutdowntest.sh
index d3ae472..b3c98da 100755
--- a/tests/shutdowntest.sh
+++ b/tests/shutdowntest.sh
@@ -1,4 +1,19 @@
 #!/bin/sh
+#
+# Copyright (c) 2024 Theo Buehler
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 set -e
 
 shutdowntest_bin=./shutdowntest
diff --git a/tests/ssltest.bat b/tests/ssltest.bat
index 5dda6bc..17f912f 100644
--- a/tests/ssltest.bat
+++ b/tests/ssltest.bat
@@ -1,6 +1,19 @@
 @echo off

 setlocal enabledelayedexpansion

-REM     ssltest.bat

+

+:: Copyright (c) 2016 Kinichiro Inoguchi

+::

+:: Permission to use, copy, modify, and distribute this software for any

+:: purpose with or without fee is hereby granted, provided that the above

+:: copyright notice and this permission notice appear in all copies.

+::

+:: THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES

+:: WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF

+:: MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR

+:: ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES

+:: WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN

+:: ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF

+:: OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

 

 set ssltest_bin=%1

 set ssltest_bin=%ssltest_bin:/=\%

diff --git a/tests/ssltest.sh b/tests/ssltest.sh
index 29ea0b0..4ec4884 100755
--- a/tests/ssltest.sh
+++ b/tests/ssltest.sh
@@ -1,4 +1,19 @@
 #!/bin/sh
+#
+# Copyright (c) 2014 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 set -e
 
 ssltest_bin=./ssltest
diff --git a/tests/testdsa.bat b/tests/testdsa.bat
index 898ded8..df53305 100644
--- a/tests/testdsa.bat
+++ b/tests/testdsa.bat
@@ -1,9 +1,21 @@
 @echo off

 setlocal enabledelayedexpansion

-REM     testdsa.bat

 

-

-REM # Test DSA certificate generation of openssl

+:: Copyright (c) 2016 Kinichiro Inoguchi

+::

+:: Permission to use, copy, modify, and distribute this software for any

+:: purpose with or without fee is hereby granted, provided that the above

+:: copyright notice and this permission notice appear in all copies.

+::

+:: THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES

+:: WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF

+:: MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR

+:: ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES

+:: WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN

+:: ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF

+:: OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

+

+:: Test DSA certificate generation of openssl

 

 set openssl_bin=%1

 set openssl_bin=%openssl_bin:/=\%

diff --git a/tests/testdsa.sh b/tests/testdsa.sh
index 7ecb8ef..230a1f8 100755
--- a/tests/testdsa.sh
+++ b/tests/testdsa.sh
@@ -1,6 +1,18 @@
 #!/bin/sh
-#       $OpenBSD: testdsa.sh,v 1.1 2014/08/26 17:50:07 jsing Exp $
-
+#
+# Copyright (c) 2015 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
 #Test DSA certificate generation of openssl
 
diff --git a/tests/testenc.bat b/tests/testenc.bat
index 84f48f2..fa14620 100644
--- a/tests/testenc.bat
+++ b/tests/testenc.bat
@@ -1,6 +1,19 @@
 @echo off

 setlocal enabledelayedexpansion

-REM     testenc.bat

+

+:: Copyright (c) 2016 Kinichiro Inoguchi

+::

+:: Permission to use, copy, modify, and distribute this software for any

+:: purpose with or without fee is hereby granted, provided that the above

+:: copyright notice and this permission notice appear in all copies.

+::

+:: THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES

+:: WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF

+:: MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR

+:: ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES

+:: WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN

+:: ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF

+:: OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

 

 set test=P

 

diff --git a/tests/testenc.sh b/tests/testenc.sh
index 63bce34..418e48d 100755
--- a/tests/testenc.sh
+++ b/tests/testenc.sh
@@ -1,5 +1,18 @@
 #!/bin/sh
-#       $OpenBSD: testenc.sh,v 1.1 2014/08/26 17:50:07 jsing Exp $
+#
+# Copyright (c) 2015 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
 test=p
 if [ -d ../apps/openssl ]; then
diff --git a/tests/testrsa.bat b/tests/testrsa.bat
index 59c3b5d..af59aad 100644
--- a/tests/testrsa.bat
+++ b/tests/testrsa.bat
@@ -1,9 +1,21 @@
 @echo off

 setlocal enabledelayedexpansion

-REM     testrsa.bat

 

-

-REM # Test RSA certificate generation of openssl

+:: Copyright (c) 2016 Kinichiro Inoguchi

+::

+:: Permission to use, copy, modify, and distribute this software for any

+:: purpose with or without fee is hereby granted, provided that the above

+:: copyright notice and this permission notice appear in all copies.

+::

+:: THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES

+:: WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF

+:: MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR

+:: ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES

+:: WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN

+:: ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF

+:: OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

+

+:: Test RSA certificate generation of openssl

 

 set openssl_bin=%1

 set openssl_bin=%openssl_bin:/=\%

diff --git a/tests/testrsa.sh b/tests/testrsa.sh
index e644999..afbc610 100755
--- a/tests/testrsa.sh
+++ b/tests/testrsa.sh
@@ -1,6 +1,18 @@
 #!/bin/sh
-#       $OpenBSD: testrsa.sh,v 1.1 2014/08/26 17:50:07 jsing Exp $
-
+#
+# Copyright (c) 2015 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
 #Test RSA certificate generation of openssl
 
diff --git a/tests/testssl.bat b/tests/testssl.bat
index c4e6286..35a789a 100644
--- a/tests/testssl.bat
+++ b/tests/testssl.bat
@@ -1,6 +1,19 @@
 @echo on

 setlocal enabledelayedexpansion

-REM     testssl.bat

+

+:: Copyright (c) 2016 Kinichiro Inoguchi

+::

+:: Permission to use, copy, modify, and distribute this software for any

+:: purpose with or without fee is hereby granted, provided that the above

+:: copyright notice and this permission notice appear in all copies.

+::

+:: THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES

+:: WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF

+:: MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR

+:: ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES

+:: WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN

+:: ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF

+:: OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

 

 set key=%1

 set cert=%2

diff --git a/tests/tlstest.bat b/tests/tlstest.bat
index 5f5f6a6..204201b 100644
--- a/tests/tlstest.bat
+++ b/tests/tlstest.bat
@@ -1,6 +1,19 @@
 @echo off

 setlocal enabledelayedexpansion

-REM     tlstest.bat

+

+:: Copyright (c) 2017 Brent Cook

+::

+:: Permission to use, copy, modify, and distribute this software for any

+:: purpose with or without fee is hereby granted, provided that the above

+:: copyright notice and this permission notice appear in all copies.

+::

+:: THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES

+:: WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF

+:: MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR

+:: ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES

+:: WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN

+:: ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF

+:: OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

 

 set tlstest_bin=%1

 set tlstest_bin=%tlstest_bin:/=\%

diff --git a/tests/tlstest.sh b/tests/tlstest.sh
index 4024007..4a5aff6 100755
--- a/tests/tlstest.sh
+++ b/tests/tlstest.sh
@@ -1,4 +1,19 @@
 #!/bin/sh
+#
+# Copyright (c) 2015 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 set -e
 
 tlstest_bin=./tlstest
diff --git a/tls/CMakeLists.txt b/tls/CMakeLists.txt
index 919b1fa..a1b244a 100644
--- a/tls/CMakeLists.txt
+++ b/tls/CMakeLists.txt
@@ -1,3 +1,18 @@
+#
+# Copyright (c) 2014 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 set(
         TLS_SRC
         tls.c
@@ -22,7 +37,6 @@ if(WIN32)
                 ${TLS_SRC}
         )
 
-        set(TLS_COMPAT_SRC ${TLS_COMPAT_SRC} compat/ftruncate.c)
         set(TLS_COMPAT_SRC ${TLS_COMPAT_SRC} compat/pread.c)
         set(TLS_COMPAT_SRC ${TLS_COMPAT_SRC} compat/pwrite.c)
 endif()
@@ -58,16 +72,16 @@ endif()
 
 export_symbol(tls ${CMAKE_CURRENT_BINARY_DIR}/tls.sym)
 target_link_libraries(tls ${OPENSSL_LIBS})
-if (WIN32)
-        set(TLS_POSTFIX -${TLS_MAJOR_VERSION} PARENT_SCOPE)
-endif()
 set_target_properties(tls PROPERTIES
-        OUTPUT_NAME tls${TLS_POSTFIX}
-        ARCHIVE_OUTPUT_NAME tls${TLS_POSTFIX}
+        OUTPUT_NAME tls
+        ARCHIVE_OUTPUT_NAME tls
         EXPORT_NAME TLS
         VERSION ${TLS_VERSION}
         SOVERSION ${TLS_MAJOR_VERSION}
 )
+if(NOT CMAKE_VERSION VERSION_LESS 3.27.0)
+        set_target_properties(tls PROPERTIES DLL_NAME_WITH_SOVERSION TRUE)
+endif()
 
 target_include_directories(
         tls
diff --git a/tls/Makefile.am b/tls/Makefile.am
index 22f3222..03824b4 100644
--- a/tls/Makefile.am
+++ b/tls/Makefile.am
@@ -1,3 +1,18 @@
+#
+# Copyright (c) 2014 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 include $(top_srcdir)/Makefile.am.common
 
 -include $(abs_top_builddir)/crypto/libcrypto_la_objects.mk
@@ -16,7 +31,7 @@ EXTRA_libtls_la_DEPENDENCIES = libtls_la_objects.mk
 
 libtls_la_objects.mk: Makefile
         @echo "libtls_la_objects= $(libtls_la_OBJECTS)" \
-          | sed -e 's/ *$$//' -e 's/  */ $$\(abs_top_builddir\)\/tls\//g' \
+          | sed -e 's/ *$$//' -e 's/  */ $$\(top_builddir\)\/tls\//g' \
           > libtls_la_objects.mk
 
 libtls_la_LDFLAGS = -version-info @LIBTLS_VERSION@ -no-undefined -export-symbols $(top_srcdir)/tls/tls.sym
@@ -55,7 +70,6 @@ libtls_la_SOURCES += tls_verify.c
 noinst_HEADERS = tls_internal.h
 
 if HOST_WIN
-libtls_la_SOURCES += compat/ftruncate.c
 libtls_la_SOURCES += compat/pread.c
 libtls_la_SOURCES += compat/pwrite.c
 endif
diff --git a/update.sh b/update.sh
index 514da89..f27e3ec 100755
--- a/update.sh
+++ b/update.sh
@@ -1,4 +1,19 @@
 #!/bin/sh
+#
+# Copyright (c) 2014 Brent Cook
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 set -e
 
 openbsd_branch=`cat OPENBSD_BRANCH`
@@ -83,8 +98,7 @@ if [ -x /opt/csw/bin/ggrep ]; then
         GREP='/opt/csw/bin/ggrep'
 fi
 
-$CP $libssl_src/LICENSE COPYING
-
+$CP $libcrypto_src/opensslconf.h include/openssl
 $CP $libcrypto_src/opensslfeatures.h include/openssl
 $CP $libssl_src/pqueue.h include
 
@@ -129,13 +143,13 @@ copy_hdrs $libcrypto_src "stack/stack.h lhash/lhash.h stack/safestack.h
         ossl_typ.h err/err.h crypto.h comp/comp.h x509/x509.h buffer/buffer.h
         objects/objects.h asn1/asn1.h asn1/posix_time.h bn/bn.h ec/ec.h ecdsa/ecdsa.h
         ecdh/ecdh.h rsa/rsa.h sha/sha.h x509/x509_vfy.h pkcs7/pkcs7.h pem/pem.h
-        hkdf/hkdf.h hmac/hmac.h rand/rand.h md5/md5.h
+        hkdf/hkdf.h hmac/hmac.h rand/rand.h md5/md5.h mlkem/mlkem.h
         x509/x509v3.h conf/conf.h ocsp/ocsp.h
         aes/aes.h modes/modes.h asn1/asn1t.h bf/blowfish.h
-        bio/bio.h cast/cast.h cmac/cmac.h cms/cms.h conf/conf_api.h des/des.h dh/dh.h
+        bio/bio.h cast/cast.h cmac/cmac.h cms/cms.h des/des.h dh/dh.h
         dsa/dsa.h engine/engine.h ui/ui.h pkcs12/pkcs12.h ts/ts.h
-        md4/md4.h ripemd/ripemd.h whrlpool/whrlpool.h idea/idea.h
-        rc2/rc2.h rc4/rc4.h ui/ui_compat.h txt_db/txt_db.h
+        md4/md4.h ripemd/ripemd.h idea/idea.h
+        rc2/rc2.h rc4/rc4.h txt_db/txt_db.h
         sm3/sm3.h sm4/sm4.h chacha/chacha.h evp/evp.h poly1305/poly1305.h
         camellia/camellia.h curve25519/curve25519.h
         ct/ct.h kdf/kdf.h"
@@ -156,32 +170,21 @@ echo "LibreSSL version `cat VERSION`"
 echo copying libcrypto source
 rm -f crypto/*.c crypto/*.h
 touch crypto/empty.c
-for i in `awk '/SOURCES|HEADERS/ { print $3 }' crypto/Makefile.am` ; do
+crypto_files=`awk '/^ASM|SOURCES|HEADERS/ { print $3 }' crypto/Makefile.am* | grep -v '^\$(' | sort | uniq`
+for i in $crypto_files; do
         dir=`dirname $i`
         mkdir -p crypto/$dir
         if [ $dir != "compat" ]; then
-                if [ -e $libcrypto_src/$i ]; then
+                if [ -f $libcrypto_src/$i ]; then
                         $CP $libcrypto_src/$i crypto/$i
                 fi
         fi
 done
 
-for i in $libcrypto_src/arch/*; do
-        arch=`basename $i`
-        mkdir -p include/arch/$arch
-        $CP $libcrypto_src/arch/$arch/opensslconf.h include/arch/$arch/
-done
-
-for i in $libcrypto_src/bn/arch/*; do
-        arch=`basename $i`
-        mkdir -p crypto/bn/arch/$arch
-        $CP $libcrypto_src/bn/arch/$arch/* crypto/bn/arch/$arch/
-done
-
 $CP crypto/compat/b_win.c crypto/bio
 $CP crypto/compat/ui_openssl_win.c crypto/ui
 # add the libcrypto symbol export list
-$GREP -v OPENSSL_ia32cap_P $libcrypto_src/Symbols.list | $GREP '^[A-Za-z0-9_]' > crypto/crypto.sym
+$GREP '^[A-Za-z0-9_]' $libcrypto_src/Symbols.list > crypto/crypto.sym
 
 fixup_masm() {
         cpp -I./crypto -I./include/compat -D_MSC_VER -U__CET__ $1 \
@@ -204,6 +207,7 @@ gen_asm_stdout() {
         EOF
         if [ $1 = "masm" ]; then
                 fixup_masm crypto/$3.tmp crypto/$3
+                rm crypto/$3.tmp
         else
                 $MV crypto/$3.tmp crypto/$3
         fi
@@ -232,6 +236,7 @@ gen_asm() {
         EOF
         if [ $1 = "masm" ]; then
                 fixup_masm crypto/$3.tmp crypto/$3
+                rm crypto/$3.tmp
         else
                 $MV crypto/$3.tmp crypto/$3
         fi
@@ -253,34 +258,16 @@ gen_asm_mips 64 sha sha1-mips   sha1-mips64
 gen_asm_mips 64 sha sha512-mips sha256-mips64
 gen_asm_mips 64 sha sha512-mips sha512-mips64
 
-echo generating arm ASM source for elf
-gen_asm_stdout elf aes/asm/aes-armv4.pl        aes/aes-elf-armv4.S
-gen_asm_stdout elf bn/asm/armv4-mont.pl        bn/mont-elf-armv4.S
-gen_asm_stdout elf sha/asm/sha1-armv4-large.pl sha/sha1-elf-armv4.S
-gen_asm_stdout elf sha/asm/sha256-armv4.pl     sha/sha256-elf-armv4.S
-gen_asm_stdout elf sha/asm/sha512-armv4.pl     sha/sha512-elf-armv4.S
-gen_asm_stdout elf modes/asm/ghash-armv4.pl    modes/ghash-elf-armv4.S
-$CP $libcrypto_src/arch/arm/armv4cpuid.S crypto
-$CP $libcrypto_src/arch/arm/armcap.c crypto
-$CP $libcrypto_src/arch/arm/arm_arch.h crypto
-
 for abi in elf macosx masm mingw64; do
         echo generating x86_64 ASM source for $abi
 
         gen_asm_stdout $abi aes/asm/aes-x86_64.pl        aes/aes-$abi-x86_64.S
-        gen_asm_stdout $abi aes/asm/vpaes-x86_64.pl      aes/vpaes-$abi-x86_64.S
-        gen_asm_stdout $abi aes/asm/bsaes-x86_64.pl      aes/bsaes-$abi-x86_64.S
         gen_asm_stdout $abi aes/asm/aesni-x86_64.pl      aes/aesni-$abi-x86_64.S
         gen_asm_stdout $abi bn/asm/modexp512-x86_64.pl   bn/modexp512-$abi-x86_64.S
         gen_asm_stdout $abi bn/asm/x86_64-mont.pl        bn/mont-$abi-x86_64.S
         gen_asm_stdout $abi bn/asm/x86_64-mont5.pl       bn/mont5-$abi-x86_64.S
-        gen_asm_stdout $abi md5/asm/md5-x86_64.pl        md5/md5-$abi-x86_64.S
         gen_asm_stdout $abi modes/asm/ghash-x86_64.pl    modes/ghash-$abi-x86_64.S
         gen_asm_stdout $abi rc4/asm/rc4-x86_64.pl        rc4/rc4-$abi-x86_64.S
-        gen_asm_stdout $abi sha/asm/sha1-x86_64.pl       sha/sha1-$abi-x86_64.S
-        gen_asm        $abi sha/asm/sha512-x86_64.pl     sha/sha256-$abi-x86_64.S
-        gen_asm        $abi sha/asm/sha512-x86_64.pl     sha/sha512-$abi-x86_64.S
-        gen_asm        $abi x86_64cpuid.pl               cpuid-$abi-x86_64.S
 done
 
 # copy libtls source
@@ -333,7 +320,7 @@ done
 echo "copying libssl source"
 rm -f ssl/*.c ssl/*.h
 touch ssl/empty.c
-for i in `awk '/SOURCES|HEADERS/ { print $3 }' ssl/Makefile.am` ; do
+for i in `awk '/SOURCES|HEADERS/ { if ($3 !~ /.*crypto_arch.*/) print $3 }' ssl/Makefile.am` ; do
         dir=`dirname $i`
         mkdir -p ssl/$dir
         $CP $libssl_src/$i ssl/$i
@@ -344,7 +331,7 @@ $GREP '^[A-Za-z0-9_]' < $libssl_src/Symbols.list > ssl/ssl.sym
 # copy libcrypto tests
 echo "copying tests"
 touch tests/empty.c
-for i in `find $libcrypto_regress -name '*.c'`; do
+for i in `find $libcrypto_regress -name '*.[ch]'`; do
          $CP "$i" tests
 done
 $CP $libcrypto_regress/evp/evptests.txt tests
@@ -352,6 +339,7 @@ $CP $libcrypto_regress/aead/*.txt tests
 $CP $libcrypto_regress/ct/ctlog.conf tests
 $CP $libcrypto_regress/ct/*.crt tests
 $CP $libcrypto_regress/x509/policy/*.pem tests
+$CP $libcrypto_regress/mlkem/*.txt tests
 
 # generate libcrypto freenull.c
 awk -f $libcrypto_regress/free/freenull.awk \
@@ -374,7 +362,6 @@ done
 $CP $libssl_regress/unit/tests.h tests
 $CP $libssl_regress/certs/*.pem tests
 $CP $libssl_regress/certs/*.crl tests
-$CP $libssl_regress/pqueue/expected.txt tests/pq_expected.txt
 
 # copy libtls tests
 for i in `find $libtls_regress -name '*.c'`; do