android build: bump openssl (1.1.1w -> 3.0.18)
What the developer wrote
Authored by SomberNight
android build: bump openssl (1.1.1w -> 3.0.18)
What changed, and why it matters
This commit updates the version of OpenSSL used to build the Electrum Android app from an older 1.1.1 series to the newer 3.0.18 series. OpenSSL is the widely used encryption library that secures network connections. The older 1.1.1 branch reached its official end-of-life in September 2023, meaning it no longer receives security fixes. Moving to a supported 3.0.x release is a routine maintenance step that reduces long-term security risk, but the commit itself does not claim to fix any specific known vulnerability.
Treat this as a proactive hardening update. Verify that the new OpenSSL 3.0.18 build recipe and the referenced python-for-android commit build correctly on all supported Android targets, and run the usual regression tests for TLS/SSL connectivity. No immediate incident response is warranted unless additional information links this bump to an active exploit.
Security signals we found
Dependency version bump of a critical cryptographic library
OpenSSL 1.1.1 is end-of-life and no longer receives security updates
No explicit CVE or vulnerability is mentioned in the commit
Build-only change; no runtime code paths are altered
Evidence from the diff
The patch pins the Android build to python-for-android commit e91310fbf88857b2fbd9f9a5f591300ae5da90b5 and overrides the bundled OpenSSL recipe to use OpenSSL 3.0.18 with a new SHA-512 checksum. The previous pinned version was 1.1.1w, the final release of the OpenSSL 1.1.1 branch, which is now end-of-life. The change is purely a dependency bump in build recipes; no application code is modified.
Changed components
contrib/android/Dockerfilecontrib/android/p4a_recipes/openssl/__init__.pyAndroid build pipelinepython-for-android OpenSSL recipeInspect captured patch +5 / −5
diff --git a/contrib/android/Dockerfile b/contrib/android/Dockerfile
index 74f5392..b0efecc 100644
--- a/contrib/android/Dockerfile
+++ b/contrib/android/Dockerfile
@@ -207,8 +207,8 @@ RUN cd /opt \
&& /opt/venv/bin/python3 -m pip install --no-build-isolation --no-dependencies -e .
# install python-for-android
-ENV P4A_CHECKOUT_COMMIT="003451604321deb1f10d879b63450ec76db4a758"
-# ^ from branch electrum_20240930_android_16kb_page_alignment (note: careful with force-pushing! see #8162)
+ENV P4A_CHECKOUT_COMMIT="e91310fbf88857b2fbd9f9a5f591300ae5da90b5"
+# ^ from branch electrum_20251211 (note: careful with force-pushing! see #8162)
RUN cd /opt \
&& git clone https://github.com/spesmilo/python-for-android \
&& cd python-for-android \
diff --git a/contrib/android/p4a_recipes/openssl/__init__.py b/contrib/android/p4a_recipes/openssl/__init__.py
index 3746e8c..fdbb7d6 100644
--- a/contrib/android/p4a_recipes/openssl/__init__.py
+++ b/contrib/android/p4a_recipes/openssl/__init__.py
@@ -6,14 +6,14 @@ from pythonforandroid.util import load_source
util = load_source('util', os.path.join(os.path.dirname(os.path.dirname(__file__)), 'util.py'))
-assert OpenSSLRecipe._version == "1.1"
+assert OpenSSLRecipe._version == "3.0.18"
assert OpenSSLRecipe.depends == []
assert OpenSSLRecipe.python_depends == []
class OpenSSLRecipePinned(util.InheritedRecipeMixin, OpenSSLRecipe):
- url_version = "1.1.1w"
- sha512sum = "b4c625fe56a4e690b57b6a011a225ad0cb3af54bd8fb67af77b5eceac55cc7191291d96a660c5b568a08a2fbf62b4612818e7cca1bb95b2b6b4fc649b0552b6d"
+ version = "3.0.18"
+ sha512sum = "6bdd16f33b83ae2a12777230c4ff00d0595bbc00253ac8c3ac31e1375e818fc74d7f491bd2e507ff33cab9f0498cfb28fa8690f75a98663568d40901523cdf3c"
recipe = OpenSSLRecipePinned()
Why this scored 47/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.