Dependencies

OpenSSL has very few mandatory dependencies. The toolkit is meant to drop into hosts that may have minimal libraries available, including embedded targets.

Mandatory at build time

• A C compiler with C99-ish support (gcc, clang, cl.exe, IBM XLC, Sun Studio, …).
• Perl 5.10+. Used for Configure, the templates, perlasm, error/symbol generation.
• A make implementation: GNU Make, BSD Make, Microsoft NMAKE, IBM XLF make. The build templates handle each.
• An assembler if asm modules are enabled (default): GAS, Apple AS, NASM (Windows), MASM (Windows), or the host's native assembler. no-asm disables this entirely (with a meaningful performance hit).

Mandatory at run time

• A libc (POSIX or Windows or VMS). OpenSSL does not require pthreads — no-threads is a supported configuration.
• An OS-supplied entropy source for the DRBG seed:
  • Linux: getrandom or /dev/urandom.
  • macOS, OpenBSD: getentropy.
  • Windows: BCryptGenRandom / RtlGenRandom.
  • VMS, VxWorks, UEFI: per-platform sources (crypto/rand/rand_vms.c, _vxworks.c, _uefi.c).
  • With enable-fips-jitter, an internal jitter entropy source is shipped.

Optional at build time

• pkg-config — used by some enable-zlib/enable-zstd/enable-brotli paths to discover compression libraries.
• A symbol versioning linker (GNU ld, Solaris ld, Apple ld) for libcrypto.so / libssl.so SONAMEs and version maps.
• Documentation tooling for make build_docs:
  • pod2man, pod2html from the Perl distribution.

Optional at run time

These are conditional on Configure flags. If you enable-<x> then the corresponding library must be present at link/run time.

Feature flag	Library	Used by
enable-zlib (default off)	zlib	TLS / CMS compression
enable-zstd (default off)	libzstd	TLS compression
enable-brotli (default off)	libbrotlidec, libbrotlicommon	TLS certificate compression (RFC 8879)
enable-md4 etc.	(none — algorithm flags)	per-algorithm
enable-engine (default on)	dlopen / LoadLibrary	Engine loading
enable-static-engine	(none — linker)	Engines compiled into the library
enable-fuzz-libfuzzer	libFuzzer	Fuzzers under fuzz/
enable-fuzz-afl	AFL	AFL fuzzers
enable-asan / enable-msan / enable-ubsan	sanitizer runtime	sanitized builds

enable-zlib-dynamic, enable-zstd-dynamic, enable-brotli-dynamic link the compression library only on first use (via dlopen), keeping libssl runnable on systems without those libs even if compiled with the option.

In-tree submodules

.gitmodules lists git submodules used by the test suite (and one source dependency):

Submodule	Path	Purpose
oqs-provider	oqs-provider/	External post-quantum provider used by external-test-oqs.
pkcs11-provider	pkcs11-provider/	External PKCS#11 provider used by external-test-pkcs11.
pyca-cryptography	pyca-cryptography/	The Python cryptography library's own test suite, run against the build via external-test-pyca.
gost-engine	gost-engine/	GOST suite via the legacy Engine path.
external/perl/Text-Template-1.56	external/perl/Text-Template-1.56/	A vendored copy of Text::Template for environments without it on @INC. This one is a real source-tree dependency, not a test-only one.
krb5	krb5/	MIT Kerberos source tree, used only by external-test-krb5.

Submodules are not initialised by default. The make external_test_* targets pull them in.

Toolchain peculiarities

• Windows: builds against Visual Studio 2017+ and clang-cl. NASM is the asm of choice (faster build, broader feature coverage than MASM).
• macOS: requires Xcode command-line tools. darwin64-arm64-cc is the canonical Apple Silicon target.
• Linux: gcc 4.8+ or clang 6+. Most distributions ship a working set out of the box.
• AIX / Solaris: native compilers (XLC, Sun Studio) work; gcc also works.
• Cross-compile: pass the cross compiler via CC, CXX, AR, RANLIB, plus --cross-compile-prefix=.

Linking against libcrypto / libssl

The pkg-config metadata shipped at ${prefix}/lib/pkgconfig/openssl.pc (and libcrypto.pc, libssl.pc) points to the install. Typical:

gcc app.c $(pkg-config --cflags --libs openssl)

For loadable provider modules, build with -fPIC and link against libcrypto:

gcc -shared -fPIC -o myprovider.so myprovider.c -lcrypto

Versions and SONAMEs

VERSION.dat holds the canonical version (currently MAJOR=3, MINOR=6, PATCH=0). The SONAME is libcrypto.so.3 / libssl.so.3 — held stable across the 3.x series so that ABI-compatible drop-in replacements work. The corresponding .pc files declare Requires.private for any compression library actually linked in.

Documentation

• INSTALL.md — top-level user guide.
• NOTES-*.md — per-platform notes (NOTES-WINDOWS.md, NOTES-MACOS.md, NOTES-ANDROID.md, NOTES-VMS.md, NOTES-VALGRIND.md, NOTES-PERL.md, NOTES-NONSTOP.md).