Add OpenSSL 3.5 LTS to chip-build Docker image (project-chip#71586)

* Add OpenSSL 3.5 LTS to chip-build Docker image

Build and install OpenSSL 3.5.0 from source into /usr/local in the
chip-build base image. Ubuntu 24.04 ships OpenSSL 3.0.x which remains
installed for apt dependency resolution; the 3.5 install takes
precedence for pkg-config based builds (chip-cert, CHIPCryptoPALOpenSSL).

OpenSSL 3.5 LTS (released April 2025, supported until October 2030)
adds native ML-DSA, ML-KEM, and SLH-DSA support in the default provider,
required for upcoming post-quantum cryptography (PQC) work in Matter.

* Add SHA256 verification and fix CA trust for OpenSSL 3.5

Address review feedback:
- Pin tarball SHA256 hash to prevent supply-chain tampering
- Use --openssldir=/etc/ssl to reuse system CA trust store instead of
  an empty /usr/local/ssl directory
- Drop install_ssldirs (no longer needed with system openssldir)

* Add OpenSSL 3.5 to chip-build-minimal and chip-cert-bins images

Apply the same OpenSSL 3.5 build layer to the two standalone Docker
images that do not inherit from chip-build. Both install libssl-dev
independently and are used for Matter builds that link against OpenSSL.

* Remove dead OpenSSL 1.1.1f build from install_packages.sh

This script is a CircleCI-era artifact (references clang-9, python3.8,
circleci user, ~/project/ paths). Current CI uses Docker images.
The OpenSSL 1.1.1f block is dead code — 1.1.1 reached EOL Sept 2023.

* Bump docker file revision

* Cleanup based on review comments

* [pre-commit.ci] auto fixes from pre-commit.com hooks

for more information, see https://pre-commit.ci

* Undo request from LLM: we already use openssldir argument

---------

Co-authored-by: Andrei Litvin <andreilitvin@google.com>
Co-authored-by: Andrei Litvin <andy314@gmail.com>
Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>

Author: 4 people

integrations/docker/images/base/chip-build-minimal/Dockerfile

@@ -17,4 +17,22 @@ RUN set -x \
 # CHIP build dependencies
 RUN set -x \
     && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
-    libssl-dev libglib2.0-dev
+    libssl-dev \
+    libglib2.0-dev \
+    wget
+
+# Build and install OpenSSL 3.5 LTS (post-quantum ML-DSA / ML-KEM support)
+ARG OPENSSL_VERSION=3.5.0
+ARG OPENSSL_SHA256=344d0a79f1a9b08029b0744e2cc401a43f9c90acd1044d09a530b4885a8e9fc0
+RUN set -x \
+    && cd /tmp \
+    && wget -q https://github.com/openssl/openssl/releases/download/openssl-${OPENSSL_VERSION}/openssl-${OPENSSL_VERSION}.tar.gz \
+    && echo "${OPENSSL_SHA256}  openssl-${OPENSSL_VERSION}.tar.gz" | sha256sum -c - \
+    && tar xzf openssl-${OPENSSL_VERSION}.tar.gz \
+    && cd openssl-${OPENSSL_VERSION} \
+    && ./Configure --prefix=/usr/local --openssldir=/etc/ssl --libdir=lib \
+    && make -j$(nproc) \
+    && make install_sw \
+    && ldconfig \
+    && cd / && rm -rf /tmp/openssl-${OPENSSL_VERSION}* \
+    && : # last line

integrations/docker/images/base/chip-build/Dockerfile

@@ -206,3 +206,26 @@ RUN set -x \
     libgirepository1.0-dev \
     && rm -rf /var/lib/apt/lists/ \
     && : # last line
+
+# Build and install OpenSSL 3.5 LTS from source.
+# Ubuntu 24.04 ships OpenSSL 3.0.x via libssl-dev (kept for apt dependency
+# resolution). Installing 3.5 into /usr/local makes it the default for
+# pkg-config based builds (e.g. chip-cert, CHIPCryptoPALOpenSSL) while the
+# system libssl-3 continues to satisfy runtime dependencies of other
+# apt-installed packages.
+# OpenSSL 3.5 is required for native ML-DSA / ML-KEM (post-quantum) support
+# in the default provider (FIPS 204 / FIPS 203).
+ARG OPENSSL_VERSION=3.5.0
+ARG OPENSSL_SHA256=344d0a79f1a9b08029b0744e2cc401a43f9c90acd1044d09a530b4885a8e9fc0
+RUN set -x \
+    && cd /tmp \
+    && wget -q https://github.com/openssl/openssl/releases/download/openssl-${OPENSSL_VERSION}/openssl-${OPENSSL_VERSION}.tar.gz \
+    && echo "${OPENSSL_SHA256}  openssl-${OPENSSL_VERSION}.tar.gz" | sha256sum -c - \
+    && tar xzf openssl-${OPENSSL_VERSION}.tar.gz \
+    && cd openssl-${OPENSSL_VERSION} \
+    && ./Configure --prefix=/usr/local --openssldir=/etc/ssl --libdir=lib \
+    && make -j$(nproc) \
+    && make install_sw \
+    && ldconfig \
+    && cd / && rm -rf /tmp/openssl-${OPENSSL_VERSION}* \
+    && : # last line

integrations/docker/images/base/chip-build/version

@@ -1 +1 @@
-197 : [crosscompile] Bump {armhf,aarch64} sysroot tag to `version:build-2026.05.14`
+198 : [chip-build] Add openssl 3.5

integrations/docker/images/chip-cert-bins/Dockerfile

@@ -123,6 +123,22 @@ RUN set -x \
     && rm -rf bloaty \
     && : # last line
 
+# Build and install OpenSSL 3.5 LTS (post-quantum ML-DSA / ML-KEM support)
+ARG OPENSSL_VERSION=3.5.0
+ARG OPENSSL_SHA256=344d0a79f1a9b08029b0744e2cc401a43f9c90acd1044d09a530b4885a8e9fc0
+RUN set -x \
+    && cd /tmp \
+    && wget -q https://github.com/openssl/openssl/releases/download/openssl-${OPENSSL_VERSION}/openssl-${OPENSSL_VERSION}.tar.gz \
+    && echo "${OPENSSL_SHA256}  openssl-${OPENSSL_VERSION}.tar.gz" | sha256sum -c - \
+    && tar xzf openssl-${OPENSSL_VERSION}.tar.gz \
+    && cd openssl-${OPENSSL_VERSION} \
+    && ./Configure --prefix=/usr/local --openssldir=/etc/ssl --libdir=lib \
+    && make -j$(nproc) \
+    && make install_sw \
+    && ldconfig \
+    && cd / && rm -rf /tmp/openssl-${OPENSSL_VERSION}* \
+    && : # last line
+
 # Stage 1.5: Bootstrap Matter.
 RUN echo "Cloning at commit: ${COMMITHASH}" \
     && git clone https://github.com/project-chip/connectedhomeip.git /root/connectedhomeip \

scripts/setup/linux/install_packages.sh

@@ -43,24 +43,3 @@ apt-get install -fy \
     libmbedtls-dev \
     python3.8-dev \
     python3.8-venv
-
-if [[ ! -f 'ci-cache-persistent/openssl/open_ssl_1.1.1f_installed' ]]; then
-    mkdir -p ci-cache-persistent/openssl
-    cd ci-cache-persistent/openssl || exit
-    wget https://github.com/openssl/openssl/archive/OpenSSL_1_1_1f.zip
-    mkdir openssl
-    cd openssl || exit
-    unzip ../OpenSSL_1_1_1f.zip
-    cd openssl-OpenSSL_1_1_1f || exit
-    ./config
-    make
-
-    rm -rf ../OpenSSL_1_1_1f.zip
-
-    cd ~/project || exit
-    touch ci-cache-persistent/openssl/open_ssl_1.1.1f_installed
-    chown -R circleci:circleci build
-fi
-
-cd ~/project/ci-cache-persistent/openssl/openssl/openssl-OpenSSL_1_1_1f || exit
-make install_sw install_ssldirs

src/python_testing/TC_IDM_4_3.py

@@ -172,7 +172,7 @@ def on_empty_report():
         max_wait = sub_timeout_sec + 1
         try:
             await asyncio.wait_for(empty_report_event.wait(), timeout=max_wait)
-        except asyncio.TimeoutError:
+        except TimeoutError:
             asserts.fail("Empty report was not received")
 
         asserts.assert_is_not_none(empty_report_time, "Empty report timing not captured")