Commit f9fbb82f1e for openssl.org

commit f9fbb82f1e252a8e769d326f4b6880e43493ca19
Author: Dmitry Belyavskiy <beldmit@gmail.com>
Date:   Mon Aug 31 18:26:24 2026 +0200

    We don't need linking s_lib into FIPS provider

    Reviewed-by: Igor Ustinov <igus@openssl.foundation>
    Reviewed-by: Paul Dale <paul.dale@oracle.com>
    Reviewed-by: Simo Sorce <simo@redhat.com>
    MergeDate: Wed Sep  2 15:04:35 2026
    (Merged from https://github.com/openssl/openssl/pull/32626)

diff --git a/crypto/evp/build.info b/crypto/evp/build.info
index 5897acd943..4849f3dfa1 100644
--- a/crypto/evp/build.info
+++ b/crypto/evp/build.info
@@ -2,7 +2,7 @@ LIBS=../../libcrypto
 $COMMON=digest.c evp_enc.c evp_lib.c evp_fetch.c evp_utils.c \
         mac_lib.c mac_meth.c keymgmt_meth.c keymgmt_lib.c kdf_lib.c kdf_meth.c \
         skeymgmt_meth.c \
-        pmeth_lib.c signature.c p_lib.c s_lib.c pmeth_gn.c exchange.c \
+        pmeth_lib.c signature.c p_lib.c pmeth_gn.c exchange.c \
         evp_rand.c asymcipher.c kem.c dh_support.c ec_support.c pmeth_check.c \
         evp_pkey_type.c

@@ -20,7 +20,7 @@ SOURCE[../../libcrypto]=$COMMON\
         e_aes_cbc_hmac_sha1.c e_aes_cbc_hmac_sha256.c e_rc4_hmac_md5.c \
         e_chacha20_poly1305.c \
         legacy_sha.c ctrl_params_translate.c \
-        m_sigver.c
+        m_sigver.c s_lib.c

 # Diverse type specific ctrl functions.  They are kinda sorta legacy, kinda
 # sorta not.
diff --git a/crypto/evp/evp_enc.c b/crypto/evp/evp_enc.c
index d20ee204f9..4b3fdc6375 100644
--- a/crypto/evp/evp_enc.c
+++ b/crypto/evp/evp_enc.c
@@ -254,6 +254,7 @@ static int evp_cipher_init_internal(EVP_CIPHER_CTX *ctx,
         params);
 }

+#ifndef FIPS_MODULE
 /*
  * This function is basically evp_cipher_init_internal without ENGINE support.
  * They should be combined when engines are not supported any longer.
@@ -389,6 +390,7 @@ int EVP_CipherInit_SKEY(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
 {
     return evp_cipher_init_skey_internal(ctx, cipher, skey, iv, iv_len, enc, params);
 }
+#endif /* !FIPS_MODULE */

 int EVP_CipherInit_ex2(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
     const unsigned char *key, const unsigned char *iv,
diff --git a/crypto/evp/exchange.c b/crypto/evp/exchange.c
index 8718726076..23c838d43a 100644
--- a/crypto/evp/exchange.c
+++ b/crypto/evp/exchange.c
@@ -485,6 +485,7 @@ int EVP_PKEY_derive(EVP_PKEY_CTX *ctx, unsigned char *key, size_t *pkeylen)
     return ret;
 }

+#ifndef FIPS_MODULE
 EVP_SKEY *EVP_PKEY_derive_SKEY(EVP_PKEY_CTX *ctx, EVP_SKEYMGMT *mgmt,
     const char *key_type, const char *propquery,
     size_t keylen, const OSSL_PARAM params[])
@@ -580,6 +581,7 @@ cleanup:
         EVP_SKEYMGMT_free(skeymgmt);
     return ret;
 }
+#endif /* !FIPS_MODULE */

 int evp_keyexch_get_number(const EVP_KEYEXCH *keyexch)
 {
diff --git a/crypto/evp/kdf_lib.c b/crypto/evp/kdf_lib.c
index 67351044fb..4edbd85a15 100644
--- a/crypto/evp/kdf_lib.c
+++ b/crypto/evp/kdf_lib.c
@@ -159,6 +159,7 @@ int EVP_KDF_derive(EVP_KDF_CTX *ctx, unsigned char *key, size_t keylen,
     return ctx->meth->derive(ctx->algctx, key, keylen, params);
 }

+#ifndef FIPS_MODULE
 struct convert_key {
     const char *name;
     OSSL_PARAM *param;
@@ -295,6 +296,7 @@ EVP_SKEY *EVP_KDF_derive_SKEY(EVP_KDF_CTX *ctx, EVP_SKEYMGMT *mgmt,
         EVP_SKEYMGMT_free(skeymgmt);
     return ret;
 }
+#endif /* !FIPS_MODULE */

 /*
  * The {get,set}_params functions return 1 if there is no corresponding
diff --git a/providers/fips.module.sources b/providers/fips.module.sources
index f6c46d0129..a00ada997b 100644
--- a/providers/fips.module.sources
+++ b/providers/fips.module.sources
@@ -235,7 +235,6 @@ crypto/evp/p_lib.c
 crypto/evp/pmeth_check.c
 crypto/evp/pmeth_gn.c
 crypto/evp/pmeth_lib.c
-crypto/evp/s_lib.c
 crypto/evp/signature.c
 crypto/evp/skeymgmt_meth.c
 crypto/ex_data.c