From 2f9fdfa5ae2749f10d9ebc805e388ab9962d9faa Mon Sep 17 00:00:00 2001 From: Dimitri Staessens Date: Thu, 2 Jul 2026 00:57:58 +0200 Subject: build: Fix OpenSSL version check for PQC ML-KEM, ML-DSA and SLH-DSA all landed in OpenSSL 3.5.0, not 3.4.0. ML-KEM+ML-DSA and SLH-DSA can be disabled by DISABLE_ML / DISABLE_SLH. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders --- cmake/dependencies/crypt/openssl.cmake | 51 ++++++++++++---------------------- 1 file changed, 17 insertions(+), 34 deletions(-) (limited to 'cmake/dependencies/crypt/openssl.cmake') diff --git a/cmake/dependencies/crypt/openssl.cmake b/cmake/dependencies/crypt/openssl.cmake index 38eb826f..b0fa8d11 100644 --- a/cmake/dependencies/crypt/openssl.cmake +++ b/cmake/dependencies/crypt/openssl.cmake @@ -25,49 +25,32 @@ message(STATUS "OpenSSL support enabled, found version ${OPENSSL_VERSION}") set(HAVE_OPENSSL TRUE CACHE INTERNAL "OpenSSL cryptography support available") -if(OPENSSL_VERSION VERSION_GREATER_EQUAL "3.4.0") - set(DISABLE_ML_KEM FALSE CACHE BOOL - "Disable ML-KEM support") - set(DISABLE_ML_DSA FALSE CACHE BOOL - "Disable ML-DSA support") - if(NOT DISABLE_ML_KEM) - set(HAVE_OPENSSL_ML_KEM TRUE CACHE INTERNAL - "OpenSSL ML-KEM available") - message(STATUS "OpenSSL ML-KEM support enabled") - else() - message(STATUS "OpenSSL ML-KEM support disabled") - unset(HAVE_OPENSSL_ML_KEM CACHE) - endif() - if(NOT DISABLE_ML_DSA) - set(HAVE_OPENSSL_ML_DSA TRUE CACHE INTERNAL - "OpenSSL ML-DSA available") - message(STATUS "OpenSSL ML-DSA support enabled") - else() - message(STATUS "OpenSSL ML-DSA support disabled") - unset(HAVE_OPENSSL_ML_DSA CACHE) - endif() -else() - message(STATUS - "Install OpenSSL >= 3.4.0 for ML-KEM/ML-DSA") - unset(HAVE_OPENSSL_ML_KEM CACHE) - unset(HAVE_OPENSSL_ML_DSA CACHE) -endif() - if(OPENSSL_VERSION VERSION_GREATER_EQUAL "3.5.0") - set(DISABLE_SLH_DSA FALSE CACHE BOOL + set(DISABLE_ML FALSE CACHE BOOL + "Disable ML-KEM/ML-DSA support") + set(DISABLE_SLH FALSE CACHE BOOL "Disable SLH-DSA support") - if(NOT DISABLE_SLH_DSA) - set(HAVE_OPENSSL_SLH_DSA TRUE CACHE INTERNAL + if(NOT DISABLE_ML) + set(HAVE_ML TRUE CACHE INTERNAL + "OpenSSL ML-KEM/ML-DSA available") + message(STATUS "OpenSSL ML-KEM/ML-DSA support enabled") + else() + message(STATUS "OpenSSL ML-KEM/ML-DSA support disabled") + unset(HAVE_ML CACHE) + endif() + if(NOT DISABLE_SLH) + set(HAVE_SLH TRUE CACHE INTERNAL "OpenSSL SLH-DSA available") message(STATUS "OpenSSL SLH-DSA support enabled") else() message(STATUS "OpenSSL SLH-DSA support disabled") - unset(HAVE_OPENSSL_SLH_DSA CACHE) + unset(HAVE_SLH CACHE) endif() else() message(STATUS - "Install OpenSSL >= 3.5.0 for SLH-DSA") - unset(HAVE_OPENSSL_SLH_DSA CACHE) + "Install OpenSSL >= 3.5.0 for PQC (ML-KEM/ML-DSA/SLH-DSA)") + unset(HAVE_ML CACHE) + unset(HAVE_SLH CACHE) endif() # Secure memory options are in cmake/config/global.cmake -- cgit v1.2.3