Fun facts

A short tour of curiosities that come up when you spend time in the OpenSSL repository.

The repo predates Y2K — and still has the SSLeay tags

The first commit, ec96f926b9, is dated 1998-12-21 and reads "Import of old SSLeay release: SSLeay 0.8.1b". The very first tags in the repo are SSLeay_0_8_1b, SSLeay_0_9_0b, SSLeay_0_9_1b — all from that same day in December 1998 — followed by OpenSSL_0_9_1c two days later on 1998-12-23 and OpenSSL_0_9_2b in March 1999. The OpenSSL Project effectively forked SSLeay into git on the day SSLeay's last release was imported.

This is also why several files still carry Eric A. Young, Tim J. Hudson as copyright holders alongside the OpenSSL Project Authors.

The two biggest C files are not code

crypto/ec/ecp_nistz256_table.c (14,923 lines) and crypto/ec/ecp_sm2p256_table.c (16,387 lines) are the largest C files in the tree. Both are precomputed scalar-multiplication lookup tables for elliptic-curve point operations — wall-to-wall hex constants, no functions. The actual code that uses them is a few hundred lines elsewhere in crypto/ec/.

ssl/ssl_lib.c is 8,538 lines

The single largest hand-written C file (ssl/ssl_lib.c) contains the bulk of the public SSL_* and SSL_CTX_* API surface. Its header ssl/ssl_local.h is itself 113 KB. The matching pair ssl/s3_lib.c (5,688) and ssl/t1_lib.c (5,139) are not far behind.

Sixteen years of FIXMEs

The oldest still-living "FIXME" comments are in crypto/asn1/tasn_enc.c and crypto/asn1/tasn_utl.c — the ASN.1 encoder/utility files. Examples:

/* FIXME: check for errors in enhanced version */
/* FIXME: error code here */
/* FIXME: need to search application table too */
/* FIXME: should log the value or OID of unsupported type */

There is also /* FIXME: WHY IS kari->pctx freed here? /RL */ in crypto/cms/cms_kari.c — a /RL suffix is Richard Levitte's hand-signature on a comment.

There are exactly 125 TODO/FIXME/HACK/XXX markers across crypto/, ssl/, providers/, and apps/, which is remarkably low for a 630k-line C codebase.

OpenSSL has 32 GitHub Actions workflows

Stored in .github/workflows/, including os-zoo.yml (a nightly build across many operating systems), compiler-zoo.yml (a nightly build across many compilers), cross-compiles.yml plus aarch64 and RISC-V variants, provider-compatibility.yml (cross-version FIPS provider compatibility), run_quic_interop.yml (QUIC interop), valgrind-daily.yml, fuzz-checker.yml, and oss-fuzz.yml. The CI matrix is one of the project's largest.

The .github/CODEOWNERS file is one line: /.github/workflows/ @quarckster. Everywhere else, ownership is implicit — derived from git log.

The configure system is bigger than most projects

Configure (the top-level Perl script) is 145,177 bytes — by itself larger than many small open-source libraries. It reads Configurations/ (which contains 50+ .conf and .tmpl files for every supported target), interprets enable-* / no-* flags, picks an assembly back-end per architecture, and generates Makefile plus configdata.pm. See reference/build-system.

OpenSSL ships nine never-completed external test integrations

external/, cloudflare-quiche/, gost-engine/, krb5/, oqs-provider/, pkcs11-provider/, pyca-cryptography/, python-ecdsa/, tlsfuzzer/, tlslite-ng/, wycheproof/ — these are all empty or near-empty submodule mount points. They are filled in via git submodule update to run third-party conformance and interop suites against the just-built OpenSSL. make test will skip them when the submodules aren't checked out.

Andy Polyakov's perlasm

crypto/perlasm/ and the per-architecture crypto/{aes,sha,bn,modes,...}/asm/*.pl files are mostly Andy Polyakov's work. They are Perl scripts that, given a target architecture, emit assembly. The same aes-x86_64.pl produces NASM, GAS, or MASM output depending on $flavour. There are 287 .pl files in the tree and 271,530 lines of Perl — most of it perlasm code generators.

Five 256-block LTS branches are alive at once

The visible tags include openssl-3.0.20, openssl-3.3.7, openssl-3.4.5, openssl-3.5.6, openssl-3.6.2, plus openssl-4.0.0. Six release branches are simultaneously back-port targets, which is why CHANGES.md weighs in at 868 KB. (For comparison, that's a third of a megabyte just listing what changed in each release.)

Eight OS-specific notes files

NOTES-ANDROID.md, NOTES-C99.md, NOTES-DJGPP.md (DOS!), NOTES-NONSTOP.md (HPE NonStop), NOTES-PERL.md, NOTES-POSIX.md, NOTES-UNIX.md, NOTES-VALGRIND.md, NOTES-VMS.md, NOTES-WINDOWS.md. OpenSSL still officially supports OpenVMS — the VMS/ directory and crypto/LPdir_vms.c are not historical curiosities. There are also platform-specific tweaks for HPE NonStop and DJGPP-on-DOS in the Configurations/ matrix.