Development workflow

Branch and clone

Active development is on master. Release branches (openssl-3.0, openssl-3.3, openssl-3.4, openssl-3.5, openssl-3.6, openssl-4.0) only receive bug fixes; new features go to master.

git clone https://github.com/<your-fork>/openssl.git
cd openssl
git remote add upstream https://github.com/openssl/openssl.git
git fetch upstream
git checkout -b feature-branch upstream/master

Configure and build

A debug build with strict warnings, suitable for development:

./Configure --strict-warnings --debug
make -j"$(nproc)"

Append the sanitizers when you suspect memory or undefined-behavior bugs:

./Configure --strict-warnings --debug enable-asan enable-ubsan

For deeper memory leak hunts, see debugging and NOTES-VALGRIND.md.

Make changes, then keep these regenerated files in sync

After certain kinds of changes, run make update and commit the resulting diffs:

You changed…	…make update regenerates
Added a public function	util/libcrypto.num, util/libssl.num (the symbol-ordinal lists used by the linker map)
Added a new error reason or function	The *err.h and *_err.c files in the relevant directory; util/other.syms
Added an OSSL_PARAM or function-id	Relevant core_names.h, core_dispatch.h re-emission
Modified crypto/objects/objects.txt	crypto/objects/obj_dat.h, crypto/objects/obj_xref.h, include/openssl/obj_mac.h
Touched a POD file	The intermediate .pod checks; final .1/.3/.5/.7 files are generated only at install time

Run make doc-nits whenever you touch doc/man*/. It catches missing sections, unknown links, and other style issues.

Commit messages

Recent representative subject lines on master:

Update description of OSSL_HTTP_adapt_proxy()
Add test for empty proxy server adaptation
Add check for empty server host in http_lib.c
change EVP_MD_size() return value from size_t to int.
ssl/quic/quic_record_tx.c: refactor qtx->cons obtaining
Workaround Uplink compilation for MINGW 32bit
Fix always false comparison in asn1/a_strex.c

Conventions, as documented in CONTRIBUTING.md:

• Subject 50–70 characters when possible.
• Optional path prefix (ssl/quic/quic_record_tx.c:) when the change is contained.
• Body explains the why. Long descriptions are encouraged.
• Self-contained: a reader should not need to chase issue links to understand the change.
• Add Fixes #NNN when the PR addresses a tracked issue.
• For trivial fixes that don't need a CLA, append CLA: trivial on its own line.

Fixup commits

When a reviewer asks for changes, do not amend earlier commits or rebase the visible history. Use:

git add path/to/changed-file
git commit --fixup <commit-id>
git push           # NOT --force

Fixup commits carry a fixup! subject line; they are squashed automatically when the PR is merged. Force-pushes during review are discouraged because they break GitHub review threading.

Adding a new file

Every source file must start with the OpenSSL copyright notice:

/*
 * Copyright 2026 The OpenSSL Project Authors. All Rights Reserved.
 *
 * Licensed under the Apache License 2.0 (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
 */

Update the relevant build.info to list the new file. New public symbols must be added to a header in include/openssl/ (or its .h.in template), declared with the proper OSSL_DEPRECATED* macros if they are pre-deprecation, and tracked by make update.

Adding a new error code

OpenSSL error codes are organized per-library. The flow is:

1. Add the reason code in the relevant *err.h. For libcrypto-internal codes, edit crypto/err/openssl.txt.
2. Run make errors (or make update).
3. Use it: ERR_raise(ERR_LIB_…, …_R_…); or the legacy …err() function.

Helper documentation lives in crypto/err/README.md.

Adding a new test

Tests come in two parts:

• A C test program in test/foo_test.c, listed in test/build.info.
• A Perl recipe in test/recipes/NN-test_foo.t, where NN is a two-digit group number that controls ordering and parallelization.

The numbering convention (from test/recipes/):

Group	Purpose
00–09	Sanity, framework
10–14	Build / config / fundamental
15–29	Per-algorithm crypto
30–39	EVP/encoder/decoder/store
40–49	X.509 / CMS / PKCS / OCSP / CRL / TS
50–69	TLS, DTLS
70–89	Higher-level (CMP, HTTP, fuzz corpora, etc.)
90	Slow recipes
95	External submodules
99	The slow group

See testing for how to run them.

Submitting

git push origin feature-branch
gh pr create --base master   # or use the GitHub web UI

Fill in the PULL_REQUEST_TEMPLATE (it auto-populates) and let CI run. Two committer approvals are required.