Vendored dependencies

Archives are retained under dist/ alongside their unpacked source trees. OpenSSL’s checksum was compared with the upstream release checksum. These immutable sources are the build inputs; dependency updates must be explicit changes to the archives, source trees, checksums, and build policy together.

Source locations:

• https://github.com/openssl/openssl/releases/tag/openssl-4.1.0
• https://pyyaml.org/download/libyaml/yaml-0.2.5.tar.gz

SOURCE_SHA256SUMS records every unpacked source input. The build verifies both archives and the exact source inventory before building, rejecting extra files or directories, missing files, symlinks, special files, noncanonical paths, duplicate manifest entries, and checksum mismatches before running Configure or a compiler. The verifier explicitly lists eight optional empty OpenSSL scaffold directories present in the authenticated release archive but absent from Git checkouts: cloudflare-quiche, fuzz/corpora, oqs-provider, pkcs11-provider, python-ecdsa, tlsfuzzer, tlslite-ng, and wycheproof. These directories must be real and empty when present; their contents, links, and special entries are never allowed. The inventory verifier uses Python 3’s standard library (already installed in the test VM). Intentional source changes must update this manifest as part of their review. Keep source trees unchanged during verification and building; use a clean build after a dependency update.

tools/build/deps.sh verifies release archives and sources, compiles out of tree, and installs static libraries into the project’s build directory. It disables unused OpenSSL applications, tests, QUIC, legacy protocols/providers, dynamic modules, and compression. It does not download anything or use system crypto libraries.

Upstream source formatting, attribution, and license files are preserved.