From eeef8b15341513b45910b499c8d227c89bfd6f81 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Mon, 13 Jul 2026 08:04:38 +0000
Subject: [PATCH 01/13] Updated dependency 'apache' from version 2.4.67 to
 2.4.68

---
 deps-packaging/apache/cfbuild-apache.spec | 2 +-
 deps-packaging/apache/distfiles           | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/deps-packaging/apache/cfbuild-apache.spec b/deps-packaging/apache/cfbuild-apache.spec
index c2a6cf283..c5bd708ae 100644
--- a/deps-packaging/apache/cfbuild-apache.spec
+++ b/deps-packaging/apache/cfbuild-apache.spec
@@ -1,4 +1,4 @@
-%define apache_version 2.4.67
+%define apache_version 2.4.68
 %global __os_install_post %{nil}
 
 Summary: CFEngine Build Automation -- apache
diff --git a/deps-packaging/apache/distfiles b/deps-packaging/apache/distfiles
index e2962e04d..8801b00aa 100644
--- a/deps-packaging/apache/distfiles
+++ b/deps-packaging/apache/distfiles
@@ -1 +1 @@
-10a578d199c3930250534fac629995f34ef7571709a7c88c45239e1fdc88cf77  httpd-2.4.67.tar.gz
+ed9a9d4500fb48bb28eaffb3ba71d06ccf86d498fa13ab9f781da010cc488498  httpd-2.4.68.tar.gz

From 9cbe6d0192b5a4be8286b5c36033bb543c86952b Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Mon, 13 Jul 2026 08:04:54 +0000
Subject: [PATCH 02/13] Updated dependency 'git' from version 2.54.0 to 2.55.0

---
 deps-packaging/git/cfbuild-git.spec | 2 +-
 deps-packaging/git/distfiles        | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/deps-packaging/git/cfbuild-git.spec b/deps-packaging/git/cfbuild-git.spec
index fd024694e..532b885bb 100644
--- a/deps-packaging/git/cfbuild-git.spec
+++ b/deps-packaging/git/cfbuild-git.spec
@@ -1,4 +1,4 @@
-%define git_version 2.54.0
+%define git_version 2.55.0
 
 Summary: CFEngine Build Automation -- git
 Name: cfbuild-git
diff --git a/deps-packaging/git/distfiles b/deps-packaging/git/distfiles
index b02e4b46a..02b67c815 100644
--- a/deps-packaging/git/distfiles
+++ b/deps-packaging/git/distfiles
@@ -1 +1 @@
-45e8107643a44e3ce46f5665beb35af3932fb0d70017687905ab5d4e3aafa8eb  git-2.54.0.tar.gz
+0842dc384a23ac33ba3e570c4f3a8ded85963ee4713b1cd21153c3db41813d1e  git-2.55.0.tar.gz

From bf87d19ffc664ba91fd8b7a031177b3b40624a50 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Mon, 13 Jul 2026 08:04:56 +0000
Subject: [PATCH 03/13] Updated dependency 'libacl' from version 2.3.2 to 2.4.0

---
 deps-packaging/libacl/cfbuild-libacl.spec | 2 +-
 deps-packaging/libacl/distfiles           | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/deps-packaging/libacl/cfbuild-libacl.spec b/deps-packaging/libacl/cfbuild-libacl.spec
index 3203c1310..e952c7107 100644
--- a/deps-packaging/libacl/cfbuild-libacl.spec
+++ b/deps-packaging/libacl/cfbuild-libacl.spec
@@ -1,4 +1,4 @@
-%define acl_version 2.3.2
+%define acl_version 2.4.0
 
 Summary: CFEngine Build Automation -- libacl
 Name: cfbuild-libacl
diff --git a/deps-packaging/libacl/distfiles b/deps-packaging/libacl/distfiles
index 52b29d6b3..e2f6bcd6c 100644
--- a/deps-packaging/libacl/distfiles
+++ b/deps-packaging/libacl/distfiles
@@ -1 +1 @@
-5f2bdbad629707aa7d85c623f994aa8a1d2dec55a73de5205bac0bf6058a2f7c  acl-2.3.2.tar.gz
+73c853c3d44e1f693e5a96a986f1bd19d3d0dac2c7d453e796177774bc4e5f6a  acl-2.4.0.tar.gz

From b06155dbe36af152ac473e774ec68699c5ac07ef Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Mon, 13 Jul 2026 08:04:57 +0000
Subject: [PATCH 04/13] Updated dependency 'libattr' from version 2.5.2 to
 2.6.0

---
 deps-packaging/libattr/cfbuild-libattr.spec | 2 +-
 deps-packaging/libattr/distfiles            | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/deps-packaging/libattr/cfbuild-libattr.spec b/deps-packaging/libattr/cfbuild-libattr.spec
index e594af1b5..9a0217ee7 100644
--- a/deps-packaging/libattr/cfbuild-libattr.spec
+++ b/deps-packaging/libattr/cfbuild-libattr.spec
@@ -1,4 +1,4 @@
-%define attr_version 2.5.2
+%define attr_version 2.6.0
 
 Summary: CFEngine Build Automation -- libattr
 Name: cfbuild-libattr
diff --git a/deps-packaging/libattr/distfiles b/deps-packaging/libattr/distfiles
index f1227f1e2..2c86d2e1f 100644
--- a/deps-packaging/libattr/distfiles
+++ b/deps-packaging/libattr/distfiles
@@ -1 +1 @@
-39bf67452fa41d0948c2197601053f48b3d78a029389734332a6309a680c6c87  attr-2.5.2.tar.gz
+d42fa374513180bb48cb11a46696f488240e5124ff1e6ad88b0abff706985612  attr-2.6.0.tar.gz

From 07c356afa1cf38756f1b3cd302bf1159c4486983 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Mon, 13 Jul 2026 08:04:58 +0000
Subject: [PATCH 05/13] Updated dependency 'libcurl' from version 8.17.0 to
 8.21.0

---
 deps-packaging/libcurl/cfbuild-libcurl.spec | 2 +-
 deps-packaging/libcurl/distfiles            | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/deps-packaging/libcurl/cfbuild-libcurl.spec b/deps-packaging/libcurl/cfbuild-libcurl.spec
index 634c854b4..09c569b0f 100644
--- a/deps-packaging/libcurl/cfbuild-libcurl.spec
+++ b/deps-packaging/libcurl/cfbuild-libcurl.spec
@@ -1,4 +1,4 @@
-%define curl_version 8.17.0
+%define curl_version 8.21.0
 
 Summary: CFEngine Build Automation -- libcurl
 Name: cfbuild-libcurl
diff --git a/deps-packaging/libcurl/distfiles b/deps-packaging/libcurl/distfiles
index 06c2470ca..99e2a1bd5 100644
--- a/deps-packaging/libcurl/distfiles
+++ b/deps-packaging/libcurl/distfiles
@@ -1 +1 @@
-e8e74cdeefe5fb78b3ae6e90cd542babf788fa9480029cfcee6fd9ced42b7910  curl-8.17.0.tar.gz
+d9b327997999045a24cda50f3983e69e51c516bd8be6ef9842fc7f99135e33bb  curl-8.21.0.tar.gz

From 638a7b17f04efa3d32bd9370110d94fd5e1e889a Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Mon, 13 Jul 2026 08:04:58 +0000
Subject: [PATCH 06/13] Updated dependency 'libcurl-hub' from version 8.17.0 to
 8.21.0

---
 deps-packaging/libcurl-hub/cfbuild-libcurl-hub.spec | 2 +-
 deps-packaging/libcurl-hub/distfiles                | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/deps-packaging/libcurl-hub/cfbuild-libcurl-hub.spec b/deps-packaging/libcurl-hub/cfbuild-libcurl-hub.spec
index bc9a1045d..817ea754f 100644
--- a/deps-packaging/libcurl-hub/cfbuild-libcurl-hub.spec
+++ b/deps-packaging/libcurl-hub/cfbuild-libcurl-hub.spec
@@ -1,4 +1,4 @@
-%define curl_version 8.17.0
+%define curl_version 8.21.0
 
 Summary: CFEngine Build Automation -- libcurl
 Name: cfbuild-libcurl-hub
diff --git a/deps-packaging/libcurl-hub/distfiles b/deps-packaging/libcurl-hub/distfiles
index 06c2470ca..99e2a1bd5 100644
--- a/deps-packaging/libcurl-hub/distfiles
+++ b/deps-packaging/libcurl-hub/distfiles
@@ -1 +1 @@
-e8e74cdeefe5fb78b3ae6e90cd542babf788fa9480029cfcee6fd9ced42b7910  curl-8.17.0.tar.gz
+d9b327997999045a24cda50f3983e69e51c516bd8be6ef9842fc7f99135e33bb  curl-8.21.0.tar.gz

From f83be869376ebee6e262a04482766bc00135db17 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Mon, 13 Jul 2026 08:04:58 +0000
Subject: [PATCH 07/13] Updated dependency 'libexpat' from version 2.8.1 to
 2.8.2

---
 deps-packaging/libexpat/cfbuild-libexpat.spec | 2 +-
 deps-packaging/libexpat/distfiles             | 2 +-
 deps-packaging/libexpat/source                | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/deps-packaging/libexpat/cfbuild-libexpat.spec b/deps-packaging/libexpat/cfbuild-libexpat.spec
index e3e0d80f8..0021aa4b0 100644
--- a/deps-packaging/libexpat/cfbuild-libexpat.spec
+++ b/deps-packaging/libexpat/cfbuild-libexpat.spec
@@ -1,4 +1,4 @@
-%define expat_version 2.8.1
+%define expat_version 2.8.2
 
 Summary: CFEngine Build Automation -- libexpat
 Name: cfbuild-libexpat
diff --git a/deps-packaging/libexpat/distfiles b/deps-packaging/libexpat/distfiles
index c2bb242b7..ef8b42fa2 100644
--- a/deps-packaging/libexpat/distfiles
+++ b/deps-packaging/libexpat/distfiles
@@ -1 +1 @@
-10b195ee78160a908388180a8fe3603d4e9a12f4755fbf5f3816b23a9d750da0  expat-2.8.1.tar.xz
+3ad89b8588e6644bd4e49981480d48b21289eebbcd4f0a1a4afb1c29f99b6ab4  expat-2.8.2.tar.xz
diff --git a/deps-packaging/libexpat/source b/deps-packaging/libexpat/source
index 9d573df43..af4c6bfc3 100644
--- a/deps-packaging/libexpat/source
+++ b/deps-packaging/libexpat/source
@@ -1 +1 @@
-https://github.com/libexpat/libexpat/releases/download/R_2_8_1/
+https://github.com/libexpat/libexpat/releases/download/R_2_8_2/

From 2ec47c9f2a588d5636baa89d6e7dc087491beab9 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Mon, 13 Jul 2026 08:05:01 +0000
Subject: [PATCH 08/13] Updated dependency 'openssl' from version 3.6.2 to
 3.6.3

---
 deps-packaging/openssl/cfbuild-openssl.spec | 2 +-
 deps-packaging/openssl/distfiles            | 2 +-
 deps-packaging/openssl/source               | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/deps-packaging/openssl/cfbuild-openssl.spec b/deps-packaging/openssl/cfbuild-openssl.spec
index d42326cfc..c8d38083c 100644
--- a/deps-packaging/openssl/cfbuild-openssl.spec
+++ b/deps-packaging/openssl/cfbuild-openssl.spec
@@ -1,4 +1,4 @@
-%define openssl_version 3.6.2
+%define openssl_version 3.6.3
 
 Summary: CFEngine Build Automation -- openssl
 Name: cfbuild-openssl
diff --git a/deps-packaging/openssl/distfiles b/deps-packaging/openssl/distfiles
index 7757c3c4a..c44c5e0ee 100644
--- a/deps-packaging/openssl/distfiles
+++ b/deps-packaging/openssl/distfiles
@@ -1 +1 @@
-aaf51a1fe064384f811daeaeb4ec4dce7340ec8bd893027eee676af31e83a04f  openssl-3.6.2.tar.gz
+243a86649cf6f23eeb6a2ff2456e09e5d77dd9018a54d3d96b0c6bdd6ba6c7f1  openssl-3.6.3.tar.gz
diff --git a/deps-packaging/openssl/source b/deps-packaging/openssl/source
index 325946a65..f36cdd0b3 100644
--- a/deps-packaging/openssl/source
+++ b/deps-packaging/openssl/source
@@ -1 +1 @@
-https://github.com/openssl/openssl/releases/download/openssl-3.6.2/
+https://github.com/openssl/openssl/releases/download/openssl-3.6.3/

From c8aa8016f400f1daea3f817e07b5fa909df7913c Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Mon, 13 Jul 2026 08:05:03 +0000
Subject: [PATCH 09/13] Updated dependency 'php' from version 8.3.31 to 8.3.32

---
 deps-packaging/php/cfbuild-php.spec | 2 +-
 deps-packaging/php/distfiles        | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/deps-packaging/php/cfbuild-php.spec b/deps-packaging/php/cfbuild-php.spec
index 46fac0f11..5b5036d9f 100644
--- a/deps-packaging/php/cfbuild-php.spec
+++ b/deps-packaging/php/cfbuild-php.spec
@@ -1,4 +1,4 @@
-%define php_version 8.3.31
+%define php_version 8.3.32
 
 Summary: CFEngine Build Automation -- php
 Name: cfbuild-php
diff --git a/deps-packaging/php/distfiles b/deps-packaging/php/distfiles
index a509cf177..aaf49063f 100644
--- a/deps-packaging/php/distfiles
+++ b/deps-packaging/php/distfiles
@@ -1 +1 @@
-4e7baaf0a690e954a20e7ced3dd633ce8cb8094e2b6b612a55e703ecbbdcbf4f  php-8.3.31.tar.gz
+8e1f03eea0b07bc29e1f94d3cfcf0532b0421ec63c1792346b58c3ad8e40fc9b  php-8.3.32.tar.gz

From 457d6cf5ebdea7e4758a71e9e723464086210530 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Mon, 13 Jul 2026 08:05:06 +0000
Subject: [PATCH 10/13] Updated dependency 'rsync' from version 3.4.3 to 3.4.4

---
 deps-packaging/rsync/cfbuild-rsync.spec | 2 +-
 deps-packaging/rsync/distfiles          | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/deps-packaging/rsync/cfbuild-rsync.spec b/deps-packaging/rsync/cfbuild-rsync.spec
index cfe5de28d..d6a13998b 100644
--- a/deps-packaging/rsync/cfbuild-rsync.spec
+++ b/deps-packaging/rsync/cfbuild-rsync.spec
@@ -1,4 +1,4 @@
-%define rsync_version 3.4.3
+%define rsync_version 3.4.4
 
 Summary: CFEngine Build Automation -- rsync
 Name: cfbuild-rsync
diff --git a/deps-packaging/rsync/distfiles b/deps-packaging/rsync/distfiles
index 2d0543c64..0424dd772 100644
--- a/deps-packaging/rsync/distfiles
+++ b/deps-packaging/rsync/distfiles
@@ -1 +1 @@
-c72e63ca3021cbc80ba86ec30102773f4c5631fbc492b52e773b3958f82a53d3  rsync-3.4.3.tar.gz
+bd88cf82fa653da32314fb229136407c5c90f80d1758d8f4b091767877d8fa96  rsync-3.4.4.tar.gz

From 9ecd500dd3139d6a26b37694fc5b3f2048469904 Mon Sep 17 00:00:00 2001
From: Ihor Aleksandrychiev <ihor.aleksandrychiev@northern.tech>
Date: Tue, 14 Jul 2026 11:03:14 +0300
Subject: [PATCH 11/13] Build Git without an experimental Rust libgitcore

Signed-off-by: Ihor Aleksandrychiev <ihor.aleksandrychiev@northern.tech>
(cherry picked from commit b72a8429d6bff9d86937b85b9ba1f1c904e17fd4)
---
 deps-packaging/git/cfbuild-git.spec | 7 +++++--
 deps-packaging/git/debian/rules     | 7 +++++--
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/deps-packaging/git/cfbuild-git.spec b/deps-packaging/git/cfbuild-git.spec
index 532b885bb..97b1d5f4a 100644
--- a/deps-packaging/git/cfbuild-git.spec
+++ b/deps-packaging/git/cfbuild-git.spec
@@ -39,12 +39,15 @@ esac
 # On RHEL the macro PATH_MAX is in linux/limits.h, not limits.h
 patch -p1 < %{_topdir}/SOURCES/fixed-undeclared-identifier-PATH_MAX.patch
 
-make CURL_LDFLAGS="-lcurl"
+# git 2.55+ builds an experimental Rust libgitcore by default (needs cargo).
+# We bundle git only as a dependency and don't use those features, so disable
+# Rust to keep the pre-2.55 behavior and avoid requiring cargo in the build env.
+make NO_RUST=YesPlease CURL_LDFLAGS="-lcurl"
 
 %install
 rm -rf ${RPM_BUILD_ROOT}
 
-make install DESTDIR=${RPM_BUILD_ROOT}
+make NO_RUST=YesPlease install DESTDIR=${RPM_BUILD_ROOT}
 
 # Removing unused files
 
diff --git a/deps-packaging/git/debian/rules b/deps-packaging/git/debian/rules
index a69615d76..395c1cc42 100755
--- a/deps-packaging/git/debian/rules
+++ b/deps-packaging/git/debian/rules
@@ -13,7 +13,10 @@ build-stamp:
 	dh_testdir
 
 	./configure --prefix=$(PREFIX) --with-openssl=$(PREFIX) --without-iconv --with-gitconfig=$(PREFIX)/config/gitconfig --with-gitattributes=$(PREFIX)/config/gitattributes --with-zlib=$(PREFIX) --with-curl=$(PREFIX) --libexecdir=$(PREFIX)/lib
-	make CURL_LDFLAGS="-lcurl"
+	# git 2.55+ builds an experimental Rust libgitcore by default (needs cargo).
+	# We bundle git only as a dependency and don't use those features, so disable
+	# Rust to keep the pre-2.55 behavior and avoid requiring cargo in the build env.
+	make NO_RUST=YesPlease CURL_LDFLAGS="-lcurl"
 
 	touch build-stamp
 
@@ -23,7 +26,7 @@ install: build
 	dh_clean -k
 	dh_installdirs
 
-	$(MAKE) install DESTDIR=$(CURDIR)/debian/tmp
+	$(MAKE) NO_RUST=YesPlease install DESTDIR=$(CURDIR)/debian/tmp
 
 	rm -rf $(CURDIR)/debian/tmp$(PREFIX)/lib/perl*
 	rm -rf $(CURDIR)/debian/tmp$(PREFIX)/lib/python*

From 4653555c1ac8445c6cd14f03a7b299e5aa615874 Mon Sep 17 00:00:00 2001
From: Craig Comstock <craig.comstock@northern.tech>
Date: Fri, 15 May 2026 16:31:58 -0500
Subject: [PATCH 12/13] Changed all rhel-based packages to use vendored openssl

Previous issues with libpam modules linking to a different openssl version/api are no longer an issue.
Ticket: ENT-13750
Changelog: title

(cherry picked from commit 0e1f4e3b1ebc0323dcf1a2b7944f681d86d03cc7)

 Conflicts:
	README.md
	build-scripts/compile-options
	build-scripts/package
	ci/fix-buildhost.sh
	deps-packaging/libcurl/cfbuild-libcurl.spec
	packaging/cfengine-nova/cfengine-nova.spec.in

Many conflicts, some due to big refactor of scripts in master.
---
 build-scripts/compile-options                 | 28 ++++++-------------
 build-scripts/package                         |  6 ----
 ci/cfengine-build-host-setup.cf               |  4 ---
 ci/fix-buildhost.sh                           |  6 ++--
 .../libcurl-hub/cfbuild-libcurl-hub.spec      |  5 ----
 deps-packaging/libcurl/cfbuild-libcurl.spec   |  2 +-
 deps-packaging/openldap/cfbuild-openldap.spec |  5 ----
 deps-packaging/pkg-build-rpm                  |  1 -
 .../cfengine-nova-hub.spec.in                 | 26 -----------------
 packaging/cfengine-nova/cfengine-nova.spec.in | 15 ----------
 10 files changed, 13 insertions(+), 85 deletions(-)

diff --git a/build-scripts/compile-options b/build-scripts/compile-options
index 39a3f20cb..830fef567 100644
--- a/build-scripts/compile-options
+++ b/build-scripts/compile-options
@@ -34,20 +34,9 @@ export PROJECT
 # When running manually, you can just export this variable.
 # It's a flag: if it's set to 1 - then we use system OpenSSL.
 # Otherwise, we build it.
-if [ x"$SYSTEM_SSL" = x ]
-then
-    # default to using cfengine openssl
-    SYSTEM_SSL=0
-    # We don't bundle OpenSSL on some redhat-derived systems due to incompatability with libpam and our openssl.
-    _OS_MAJOR_VERSION="$(echo "$OS_VERSION" | cut -d. -f1)"
-    if [ "$OS" = "rhel" ] && expr "$_OS_MAJOR_VERSION" ">=" "8" >/dev/null
-    then
-        SYSTEM_SSL=1
-    fi
-    if [ "$OS" = "opensuse" ] || [ "$OS" = "sles" ]
-    then
-        if expr "$_OS_MAJOR_VERSION" ">=" "15"
-        then
+if [ -z "$SYSTEM_SSL" ]; then
+    if [ "$OS" = "opensuse" ] || [ "$OS" = "sles" ]; then
+        if [ "$OS_VERSION_MAJOR" -ge "15" ]; then
             SYSTEM_SSL=1
         fi
     fi
@@ -119,12 +108,13 @@ case "$OS_FAMILY" in
 esac
 
 var_append DEPS "$EMBEDDED_DB pcre2"
+if [ "$SYSTEM_SSL" != 1 ]; then
+    # zlib is a compression library which is a dependency of OpenSSL.
+    # TODO: can we remove zlib dependency? (CFE-4013)
+    var_append DEPS "zlib"
 
-if ! [ x"$SYSTEM_SSL" = x1 ]
-then
-  # FIXME: Why do we need zlib?
-  # ANSWER: Openssl uses it optionally, TODO DISABLE
-  var_append DEPS "zlib openssl"
+    # A toolkit for TLS
+    var_append DEPS "openssl"
 fi
 
 # libsasl needed for solaris
diff --git a/build-scripts/package b/build-scripts/package
index a6589179b..578e6be0b 100755
--- a/build-scripts/package
+++ b/build-scripts/package
@@ -149,18 +149,12 @@ case "$PACKAGING" in
             echo "error: unable to determine selinux-policy package version"
             exit 1
         fi
-        OPENSSL_VERSION=$(rpm -q --provides openssl-libs | grep OPENSSL_ | sed 's/^.*_\([0-9.]*\).*$/\1/' | sort -n | tail -1)
-        if [ -z "$OPENSSL_VERSION" ]; then
-            echo "error: unable to determine openssl package version"
-            exit 1
-        fi
     fi
 
     sed \
         -e "s/@@VERSION@@/$RPM_VERSION/g" \
         -e "s/@@RELEASE@@/$safe_prefix$RPM_RELEASE/g" \
         -e "s/@@SELINUX_POLICY_VERSION@@/$SELINUX_POLICY_VERSION/g" \
-        -e "s/@@OPENSSL_VERSION@@/$OPENSSL_VERSION/g" \
         -e "/^%pre\$/r $PREINSTALL" \
         -e "/^%post\$/r $POSTINSTALL" \
         -e "/^%preun\$/r $PREREMOVE" \
diff --git a/ci/cfengine-build-host-setup.cf b/ci/cfengine-build-host-setup.cf
index 2672f0ab9..e37f64391 100644
--- a/ci/cfengine-build-host-setup.cf
+++ b/ci/cfengine-build-host-setup.cf
@@ -123,9 +123,6 @@ bundle agent cfengine_build_host_setup
       "platform-python-devel" -> { "cfbs shebang", "ENT-11338" }
         comment => "py3_shebang_fix macro needs /usr/bin/pathfix.py from platform-python-devel package";
 
-    suse_15::
-      "libopenssl-devel" -> { "ENT-12528" }
-        comment => "like redhat, suse 15+ needs to build with system openssl.";
 
     (redhat_8|centos_8|redhat_9).(yum_dnf_conf_ok)::
       "java-1.8.0-openjdk-headless" package_policy => "delete",
@@ -133,7 +130,6 @@ bundle agent cfengine_build_host_setup
       "java-17-openjdk";
       "pkgconf" comment => "pkgconfig renamed to pkgconf in rhel8";
       "selinux-policy-devel" comment => "maybe add to _7 and _6?";
-      "openssl-devel";
 
     (redhat_9).(yum_dnf_conf_ok)::
       "perl-Sys-Hostname" comment => "Needed by __04_examples_outputs_check_outputs_cf";
diff --git a/ci/fix-buildhost.sh b/ci/fix-buildhost.sh
index 2569da40f..af7cfcdcc 100755
--- a/ci/fix-buildhost.sh
+++ b/ci/fix-buildhost.sh
@@ -15,10 +15,10 @@ if [ "$(uname)" = "HP-UX" ] || [ "$(uname)" = "SunOS" ]; then
   fi
 fi
 
-# while ENT-13750 is in progress we need to ensure that OTHER builds include openssl devel packages on redhat-based platforms
+# ENT-13750 we return to vendored openssl on rpm platforms so remove possibly installed development packages
 if command -v zypper >/dev/null 2>/dev/null; then
-  sudo zypper install -y libopenssl-devel || true
+  sudo zypper remove -y libopenssl-devel || true
 fi
 if command -v yum >/dev/null 2>/dev/null; then
-  sudo yum install -y openssl-devel || true
+  sudo yum erase -y openssl-devel || true
 fi
diff --git a/deps-packaging/libcurl-hub/cfbuild-libcurl-hub.spec b/deps-packaging/libcurl-hub/cfbuild-libcurl-hub.spec
index 817ea754f..aa90997a6 100644
--- a/deps-packaging/libcurl-hub/cfbuild-libcurl-hub.spec
+++ b/deps-packaging/libcurl-hub/cfbuild-libcurl-hub.spec
@@ -18,12 +18,7 @@ AutoReqProv: no
 mkdir -p %{_builddir}
 %setup -q -n curl-%{curl_version}
 
-# we don't bundle OpenSSL on RHEL 8 (and newer in the future)
-%if %{?rhel}%{!?rhel:0} > 7
-%define ssl_prefix /usr
-%else
 %define ssl_prefix %{prefix}
-%endif
 
 ./configure \
     --with-sysroot=%{prefix} \
diff --git a/deps-packaging/libcurl/cfbuild-libcurl.spec b/deps-packaging/libcurl/cfbuild-libcurl.spec
index 09c569b0f..854ac4ef5 100644
--- a/deps-packaging/libcurl/cfbuild-libcurl.spec
+++ b/deps-packaging/libcurl/cfbuild-libcurl.spec
@@ -18,7 +18,7 @@ AutoReqProv: no
 mkdir -p %{_builddir}
 %setup -q -n curl-%{curl_version}
 
-%if "%{_system_ssl}" == "1"
+%if 0%{?SYSTEM_SSL}
 %define ssl_prefix /usr
 %else
 %define ssl_prefix %{prefix}
diff --git a/deps-packaging/openldap/cfbuild-openldap.spec b/deps-packaging/openldap/cfbuild-openldap.spec
index 91ba0ddef..bc8fc15ac 100644
--- a/deps-packaging/openldap/cfbuild-openldap.spec
+++ b/deps-packaging/openldap/cfbuild-openldap.spec
@@ -21,12 +21,7 @@ mkdir -p %{_builddir}
 
 %patch0 -p0
 
-# we don't bundle OpenSSL on RHEL 8 (and newer in the future)
-%if %{?rhel}%{!?rhel:0} > 7
-CPPFLAGS=-I%{buildprefix}/include:/usr/include
-%else
 CPPFLAGS=-I%{buildprefix}/include
-%endif
 
 #
 # glibc-2.8 errorneously hides peercred(3) under #ifdef __USE_GNU.
diff --git a/deps-packaging/pkg-build-rpm b/deps-packaging/pkg-build-rpm
index 6f55e0317..5dc898dad 100755
--- a/deps-packaging/pkg-build-rpm
+++ b/deps-packaging/pkg-build-rpm
@@ -123,7 +123,6 @@ fi
 # Here we only want to specify this one flag: 0x0002. Sadly these scripts run on POSIX shell (especially e.g. aix71 runs as /bin/sh which is ksh) so no bitwise operators. Add them together manually to a decimal integer.
 export QA_RPATHS=2 # 0x0002 all by itself, no &(ands)
 eval $RPMBUILD_CMD -bb \
-  --define "'_system_ssl $SYSTEM_SSL'" \
   --define "'_topdir $BASEDIR/$PKGNAME'" \
   --define "'version $VERSION'" \
   --define "'buildprefix $BUILDPREFIX'" \
diff --git a/packaging/cfengine-nova-hub/cfengine-nova-hub.spec.in b/packaging/cfengine-nova-hub/cfengine-nova-hub.spec.in
index a50e5a865..d0327bfaf 100644
--- a/packaging/cfengine-nova-hub/cfengine-nova-hub.spec.in
+++ b/packaging/cfengine-nova-hub/cfengine-nova-hub.spec.in
@@ -27,23 +27,6 @@ Requires(post): /usr/sbin/usermod, /bin/sed
 Requires: selinux-policy >= @@SELINUX_POLICY_VERSION@@
 %endif
 
-# we don't bundle OpenSSL on RHEL 8 (and newer in the future)
-%if %{?rhel}%{!?rhel:0} == 8
-Requires: libssl.so.1.1()(64bit) libssl.so.1.1(OPENSSL_1_1_0)(64bit) libssl.so.1.1(OPENSSL_1_1_1)(64bit)
-Requires: libcrypto.so.1.1()(64bit) libcrypto.so.1.1(OPENSSL_1_1_0)(64bit)
-Requires: openssl
-%endif
-
-# We build against systems with the latest available dependencies such as OpenSSL.
-# We use rpm -q --provides to determine the highest API present in OpenSSL and then use that as a Requires.
-# OPENSSL_VERSION is determined in build-scripts/package script.
-# This should ensure that when packages are installed with yum/dnf any required OpenSSL package upgrades will be performed or the installation will fail.
-%if %{?rhel}%{!?rhel:0} > 8
-Requires: libcrypto.so.3()(64bit) libcrypto.so.3(OPENSSL_@@OPENSSL_VERSION@@)(64bit)
-Requires: libssl.so.3()(64bit) libssl.so.3(OPENSSL_@@OPENSSL_VERSION@@)(64bit)
-Requires: openssl
-%endif
-
 # cfbs/Build requires Python 3.5+ (not available on RHEL 6)
 %if %{?rhel}%{!?rhel:0} == 7
 Requires: python3 >= 3.5
@@ -100,10 +83,6 @@ rm -f %{prefix}/ssl/misc/tsget
 rm -f %{prefix}/ssl/openssl.cnf.dist
 rm -f %{prefix}/ssl/misc/tsget.pl
 
-# Add an openssl symlink if openssl binary doesn't exist
-if ! [ -f $RPM_BUILD_ROOT%{prefix}/bin/openssl ]; then
-  ln -s `which openssl` $RPM_BUILD_ROOT%{prefix}/bin/openssl
-fi
 
 # Hub does not need cf-upgrade, it is only present in host packages
 rm -f $RPM_BUILD_ROOT%{prefix}/bin/cf-upgrade
@@ -237,16 +216,11 @@ exit 0
 # init.d script enterprise part
 %{prefix}/bin/cfengine3-nova-hub-init-d.sh
 
-# OpenSSL tools (we don't bundle OpenSSL on RHEL 8)
-# Note that prefix/bin/openssl is outside of `if`, since
-# on RHEL8 it's a symlink to a system-wide openssl binary
 %{prefix}/bin/openssl
-%if %{?rhel}%{!?rhel:0} <= 7
 %dir %{prefix}/ssl
 %{prefix}/ssl/openssl.cnf
 %{prefix}/ssl/ct_log_list.cnf
 %{prefix}/ssl/ct_log_list.cnf.dist
-%endif
 
 %prefix/bin/git
 %prefix/bin/gitk
diff --git a/packaging/cfengine-nova/cfengine-nova.spec.in b/packaging/cfengine-nova/cfengine-nova.spec.in
index 3f5e417c2..21a788e6e 100644
--- a/packaging/cfengine-nova/cfengine-nova.spec.in
+++ b/packaging/cfengine-nova/cfengine-nova.spec.in
@@ -23,21 +23,6 @@ Recommends: gzip
 Requires: selinux-policy >= @@SELINUX_POLICY_VERSION@@
 %endif
 
-# we don't bundle OpenSSL on RHEL 8 (and newer in the future)
-%if %{?rhel}%{!?rhel:0} == 8
-Requires: libssl.so.1.1()(64bit) libssl.so.1.1(OPENSSL_1_1_0)(64bit) libssl.so.1.1(OPENSSL_1_1_1)(64bit)
-Requires: libcrypto.so.1.1()(64bit) libcrypto.so.1.1(OPENSSL_1_1_0)(64bit)
-%endif
-
-# We build against systems with the latest available dependencies such as OpenSSL.
-# We use rpm -q --provides to determine the highest API present in OpenSSL and then use that as a Requires.
-# OPENSSL_VERSION is determined in build-scripts/package script.
-# This should ensure that when packages are installed with yum/dnf any required OpenSSL package upgrades will be performed or the installation will fail.
-%if %{?rhel}%{!?rhel:0} > 8
-Requires: libcrypto.so.3()(64bit) libcrypto.so.3(OPENSSL_@@OPENSSL_VERSION@@)(64bit)
-Requires: libssl.so.3()(64bit) libssl.so.3(OPENSSL_@@OPENSSL_VERSION@@)(64bit)
-%endif
-
 AutoReqProv: no
 
 %if %{?with_debugsym}%{!?with_debugsym:0}

From d9f425befce27218919408f67ae2be6272bf1820 Mon Sep 17 00:00:00 2001
From: Craig Comstock <craig.comstock@northern.tech>
Date: Fri, 17 Jul 2026 07:21:03 -0500
Subject: [PATCH 13/13] Removed suse >= 15 from platforms using system provided
 OpenSSL

cherry-picked from 1cb8d235a146d225faa007a3934d33ef84b6ba19 which is not yet merged but should be soon.

Ticket: ENT-13750
Changelog: none
---
 build-scripts/compile-options | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/build-scripts/compile-options b/build-scripts/compile-options
index 830fef567..ab3682115 100644
--- a/build-scripts/compile-options
+++ b/build-scripts/compile-options
@@ -35,11 +35,6 @@ export PROJECT
 # It's a flag: if it's set to 1 - then we use system OpenSSL.
 # Otherwise, we build it.
 if [ -z "$SYSTEM_SSL" ]; then
-    if [ "$OS" = "opensuse" ] || [ "$OS" = "sles" ]; then
-        if [ "$OS_VERSION_MAJOR" -ge "15" ]; then
-            SYSTEM_SSL=1
-        fi
-    fi
     # Detect using system ssl when running a Jenkins job
     if expr x"$label" ":" ".*systemssl" >/dev/null
     then