_ssl fails to compile against LibreSSL (3.15+): SSL_CTX_set1_sigalgs_list / SSL_CTX_set1_client_sigalgs_list undeclared

[serhiy-storchaka]

Since gh-138252 ("Add support in SSL module for getting and setting TLS signature algorithms", 3.15+), the _ssl extension no longer compiles against LibreSSL. Modules/_ssl.c calls two functions LibreSSL does not provide:

../Modules/_ssl.c:3867:10: error: call to undeclared function 'SSL_CTX_set1_client_sigalgs_list';
    ISO C99 and later do not support implicit function declarations [-Werror,-Wimplicit-function-declaration]
../Modules/_ssl.c:3887:10: error: call to undeclared function 'SSL_CTX_set1_sigalgs_list';
    ISO C99 and later do not support implicit function declarations [-Werror,-Wimplicit-function-declaration]

With -Werror=implicit-function-declaration on by default this is fatal, so _ssl (and therefore ssl, hashlib's OpenSSL backend, etc.) is not built at all.

Regression: _ssl builds fine on 3.14 against the same LibreSSL; the two set1_*sigalgs_list calls were added by gh-138252 and are not guarded for LibreSSL, which does not implement these setters (neither is declared in /usr/include/openssl/ssl.h on LibreSSL 4.3.0).

Affected versions: 3.15 and main / 3.16 — both confirmed. Not 3.14.

Environment:

• OpenBSD 7.9/amd64, base LibreSSL 4.3.0 (ssl.OPENSSL_VERSION)
• clang with -Werror=implicit-function-declaration

Reproduce:

./configure --with-pydebug && make
# -> Modules/_ssl.o fails to compile

Note: once _ssl builds, test_ssl on LibreSSL shows the same set of failures on main as on 3.14 (post-handshake auth, test_openssl_version, session tickets, etc. — long-standing LibreSSL divergences), i.e. fixing the compile break introduces no new test failures. The new TLS-signature-algorithm tests should be skipped on LibreSSL since the underlying setters are unavailable.

Linked PRs

• gh-154053: Fix compilation of the ssl module against LibreSSL #154054
• [3.15] gh-154053: Fix compilation of the ssl module against LibreSSL (GH-154054) #154075