From a0ae2a3ef43d2d3b29e51bf7745fdc68b2d4ed31 Mon Sep 17 00:00:00 2001 From: Timofey Vasenin Date: Tue, 27 Oct 2026 06:37:22 +0700 Subject: [PATCH 1/4] Build own OpenSSL on manylinux_2_28 instead of using system package Fixes FIPS SELFTEST FAILURE on FIPS-enabled non-RHEL systems (#1191) --- docker/manylinux_2_28/Dockerfile_aarch64 | 15 ++++++++++++++- docker/manylinux_2_28/Dockerfile_x86_64 | 15 ++++++++++++++- 2 files changed, 28 insertions(+), 2 deletions(-) diff --git a/docker/manylinux_2_28/Dockerfile_aarch64 b/docker/manylinux_2_28/Dockerfile_aarch64 index f8a82ffa..cfd8e123 100644 --- a/docker/manylinux_2_28/Dockerfile_aarch64 +++ b/docker/manylinux_2_28/Dockerfile_aarch64 @@ -7,6 +7,7 @@ ARG FFMPEG_VERSION=8.1.3 ARG FREETYPE_VERSION=2.15.0 ARG LIBPNG_VERSION=1.6.59 ARG VPX_VERSION=v1.15.2 +ARG OPENSSL_VERSION=1_1_1w ARG QT_VERSION=5.15.19 ARG AOM_VERSION=v3.15.3 ARG AVIF_VERSION=v1.4.2 @@ -16,7 +17,7 @@ ENV LD_LIBRARY_PATH /usr/local/lib:$LD_LIBRARY_PATH # epel-release need for aarch64 to get openblas packages RUN yum install zlib-devel curl-devel xcb-util-renderutil-devel xcb-util-devel xcb-util-image-devel xcb-util-keysyms-devel xcb-util-wm-devel mesa-libGL-devel libxkbcommon-devel libxkbcommon-x11-devel libXi-devel lapack-devel epel-release meson -y && \ - yum install openblas-devel dejavu-sans-fonts ccache yasm nasm ninja-build openssl openssl-devel -y && \ + yum install openblas-devel dejavu-sans-fonts ccache yasm nasm ninja-build -y && \ yum mark install dejavu-sans-fonts && \ # libpng will be built from source yum remove libpng -y @@ -56,6 +57,18 @@ RUN curl -O -L https://download.qt.io/archive/qt/5.15/${QT_VERSION}/single/qt-ev ENV QTDIR /opt/Qt${QT_VERSION} ENV PATH "$QTDIR/bin:$PATH" +RUN mkdir ~/openssl_sources && \ + cd ~/openssl_sources && \ + curl -O -L https://github.com/openssl/openssl/archive/OpenSSL_${OPENSSL_VERSION}.tar.gz && \ + tar -xf OpenSSL_${OPENSSL_VERSION}.tar.gz && \ + cd openssl-OpenSSL_${OPENSSL_VERSION} && \ + ./config --prefix="/ffmpeg_build" --openssldir="/ffmpeg_build" no-pinshared shared zlib && \ + make -j$(getconf _NPROCESSORS_ONLN) && \ + # skip installing documentation + make install_sw && \ + cd .. && \ + rm -rf ~/openssl_build ~/openssl_sources + RUN mkdir ~/libvpx_sources && \ cd ~/libvpx_sources && \ git clone --depth 1 -b ${VPX_VERSION} https://chromium.googlesource.com/webm/libvpx.git && \ diff --git a/docker/manylinux_2_28/Dockerfile_x86_64 b/docker/manylinux_2_28/Dockerfile_x86_64 index 3f3b0f2a..d79e7bf4 100644 --- a/docker/manylinux_2_28/Dockerfile_x86_64 +++ b/docker/manylinux_2_28/Dockerfile_x86_64 @@ -7,6 +7,7 @@ ARG FFMPEG_VERSION=8.1.3 ARG FREETYPE_VERSION=2.15.0 ARG LIBPNG_VERSION=1.6.59 ARG VPX_VERSION=v1.15.2 +ARG OPENSSL_VERSION=1_1_1w ARG QT_VERSION=5.15.19 ARG AOM_VERSION=v3.15.3 ARG AVIF_VERSION=v1.4.2 @@ -16,7 +17,7 @@ ENV LD_LIBRARY_PATH /usr/local/lib:$LD_LIBRARY_PATH # epel-release need for aarch64 to get openblas packages RUN yum install zlib-devel curl-devel xcb-util-renderutil-devel xcb-util-devel xcb-util-image-devel xcb-util-keysyms-devel xcb-util-wm-devel mesa-libGL-devel libxkbcommon-devel libxkbcommon-x11-devel libXi-devel lapack-devel epel-release meson -y && \ - yum install openblas-devel dejavu-sans-fonts ccache yasm nasm ninja-build openssl openssl-devel -y && \ + yum install openblas-devel dejavu-sans-fonts ccache yasm nasm ninja-build -y && \ yum mark install dejavu-sans-fonts && \ # libpng will be built from source yum remove libpng -y @@ -56,6 +57,18 @@ RUN curl -O -L https://download.qt.io/archive/qt/5.15/${QT_VERSION}/single/qt-ev ENV QTDIR /opt/Qt${QT_VERSION} ENV PATH "$QTDIR/bin:$PATH" +RUN mkdir ~/openssl_sources && \ + cd ~/openssl_sources && \ + curl -O -L https://github.com/openssl/openssl/archive/OpenSSL_${OPENSSL_VERSION}.tar.gz && \ + tar -xf OpenSSL_${OPENSSL_VERSION}.tar.gz && \ + cd openssl-OpenSSL_${OPENSSL_VERSION} && \ + ./config --prefix="/ffmpeg_build" --openssldir="/ffmpeg_build" no-pinshared shared zlib && \ + make -j$(getconf _NPROCESSORS_ONLN) && \ + # skip installing documentation + make install_sw && \ + cd .. && \ + rm -rf ~/openssl_build ~/openssl_sources + RUN mkdir ~/libvpx_sources && \ cd ~/libvpx_sources && \ git clone --depth 1 -b ${VPX_VERSION} https://chromium.googlesource.com/webm/libvpx.git && \ From c59f0637e2446acaaf870fbcd14c7711d7448b60 Mon Sep 17 00:00:00 2001 From: avdivan Date: Wed, 11 Nov 2026 12:09:24 +0200 Subject: [PATCH 2/4] Update FFmpeg to 9.0.2, Docker images to 20261111 --- .github/workflows/build_wheels_manylinux.yml | 10 +++++----- docker/manylinux2014/Dockerfile_aarch64 | 4 ++-- docker/manylinux2014/Dockerfile_x86_64 | 4 ++-- docker/manylinux_2_28/Dockerfile_aarch64 | 4 ++-- docker/manylinux_2_28/Dockerfile_x86_64 | 4 ++-- docker/musllinux_1_2/Dockerfile_aarch64 | 4 ++-- docker/musllinux_1_2/Dockerfile_x86_64 | 4 ++-- 7 files changed, 17 insertions(+), 17 deletions(-) diff --git a/.github/workflows/build_wheels_manylinux.yml b/.github/workflows/build_wheels_manylinux.yml index d614c28a..8012e700 100644 --- a/.github/workflows/build_wheels_manylinux.yml +++ b/.github/workflows/build_wheels_manylinux.yml @@ -33,16 +33,16 @@ jobs: include: - platform: aarch64 manylinux: 2014 - DOCKER_IMAGE: quay.io/opencv-ci/opencv-python-manylinux2014-aarch64:20261110 + DOCKER_IMAGE: quay.io/opencv-ci/opencv-python-manylinux2014-aarch64:20261111 - platform: x86_64 manylinux: 2014 - DOCKER_IMAGE: quay.io/opencv-ci/opencv-python-manylinux2014-x86-64:20261110 + DOCKER_IMAGE: quay.io/opencv-ci/opencv-python-manylinux2014-x86-64:20261111 - platform: x86_64 manylinux: 2_28 - DOCKER_IMAGE: quay.io/opencv-ci/opencv-python-manylinux_2_28-x86-64:20261110 + DOCKER_IMAGE: quay.io/opencv-ci/opencv-python-manylinux_2_28-x86-64:20261111 - platform: aarch64 manylinux: 2_28 - DOCKER_IMAGE: quay.io/opencv-ci/opencv-python-manylinux_2_28-aarch64:20261110 + DOCKER_IMAGE: quay.io/opencv-ci/opencv-python-manylinux_2_28-aarch64:20261111 env: ACTIONS_ALLOW_UNSECURE_COMMANDS: true @@ -165,7 +165,7 @@ jobs: NP_TEST_DEP: numpy==1.19.4 TRAVIS_BUILD_DIR: ${{ github.workspace }} CONFIG_PATH: travis_config.sh - DOCKER_IMAGE: quay.io/opencv-ci/opencv-python-manylinux2014-x86-64:20261110 + DOCKER_IMAGE: quay.io/opencv-ci/opencv-python-manylinux2014-x86-64:20261111 USE_CCACHE: 1 UNICODE_WIDTH: 32 SDIST: ${{ matrix.build_sdist || 0 }} diff --git a/docker/manylinux2014/Dockerfile_aarch64 b/docker/manylinux2014/Dockerfile_aarch64 index b99c7362..74bcdc80 100644 --- a/docker/manylinux2014/Dockerfile_aarch64 +++ b/docker/manylinux2014/Dockerfile_aarch64 @@ -1,10 +1,10 @@ -# Version: 20261110 +# Version: 20261111 # Image name: quay.io/opencv-ci/opencv-python-manylinux2014-aarch64 FROM quay.io/pypa/manylinux2014_aarch64:latest ARG CCACHE_VERSION=4.14.3 -ARG FFMPEG_VERSION=8.1.3 +ARG FFMPEG_VERSION=9.0.2 ARG FREETYPE_VERSION=2.15.0 ARG LIBPNG_VERSION=1.6.59 ARG VPX_VERSION=v1.15.2 diff --git a/docker/manylinux2014/Dockerfile_x86_64 b/docker/manylinux2014/Dockerfile_x86_64 index 71dc87d7..44f39bf9 100644 --- a/docker/manylinux2014/Dockerfile_x86_64 +++ b/docker/manylinux2014/Dockerfile_x86_64 @@ -1,10 +1,10 @@ -# Version: 20261110 +# Version: 20261111 # Image name: quay.io/opencv-ci/opencv-python-manylinux2014-x86-64 FROM quay.io/pypa/manylinux2014_x86_64:latest ARG CCACHE_VERSION=4.14.3 -ARG FFMPEG_VERSION=8.1.3 +ARG FFMPEG_VERSION=9.0.2 ARG FREETYPE_VERSION=2.15.0 ARG LIBPNG_VERSION=1.6.59 ARG VPX_VERSION=v1.15.2 diff --git a/docker/manylinux_2_28/Dockerfile_aarch64 b/docker/manylinux_2_28/Dockerfile_aarch64 index cfd8e123..742355f8 100644 --- a/docker/manylinux_2_28/Dockerfile_aarch64 +++ b/docker/manylinux_2_28/Dockerfile_aarch64 @@ -1,9 +1,9 @@ -# Version: 20261110 +# Version: 20261111 # Image name: quay.io/opencv-ci/opencv-python-manylinux_2_28-aarch64 FROM quay.io/pypa/manylinux_2_28_aarch64:latest -ARG FFMPEG_VERSION=8.1.3 +ARG FFMPEG_VERSION=9.0.2 ARG FREETYPE_VERSION=2.15.0 ARG LIBPNG_VERSION=1.6.59 ARG VPX_VERSION=v1.15.2 diff --git a/docker/manylinux_2_28/Dockerfile_x86_64 b/docker/manylinux_2_28/Dockerfile_x86_64 index d79e7bf4..263e78c2 100644 --- a/docker/manylinux_2_28/Dockerfile_x86_64 +++ b/docker/manylinux_2_28/Dockerfile_x86_64 @@ -1,9 +1,9 @@ -# Version: 20261110 +# Version: 20261111 # Image name: quay.io/opencv-ci/opencv-python-manylinux_2_28-x86-64 FROM quay.io/pypa/manylinux_2_28_x86_64:latest -ARG FFMPEG_VERSION=8.1.3 +ARG FFMPEG_VERSION=9.0.2 ARG FREETYPE_VERSION=2.15.0 ARG LIBPNG_VERSION=1.6.59 ARG VPX_VERSION=v1.15.2 diff --git a/docker/musllinux_1_2/Dockerfile_aarch64 b/docker/musllinux_1_2/Dockerfile_aarch64 index 7ba002c8..36caf703 100644 --- a/docker/musllinux_1_2/Dockerfile_aarch64 +++ b/docker/musllinux_1_2/Dockerfile_aarch64 @@ -1,9 +1,9 @@ -# version: 20261110 +# version: 20261111 # Image name: quay.io/opencv-ci/opencv-python-musllinux_1_2-aarch64 FROM quay.io/pypa/musllinux_1_2_aarch64:latest ARG CCACHE_VERSION=4.14.3 -ARG FFMPEG_VERSION=8.1.3 +ARG FFMPEG_VERSION=9.0.2 ARG FREETYPE_VERSION=2.15.0 ARG LIBPNG_VERSION=1.6.59 ARG VPX_VERSION=v1.15.2 diff --git a/docker/musllinux_1_2/Dockerfile_x86_64 b/docker/musllinux_1_2/Dockerfile_x86_64 index afc29ee2..353af822 100644 --- a/docker/musllinux_1_2/Dockerfile_x86_64 +++ b/docker/musllinux_1_2/Dockerfile_x86_64 @@ -1,9 +1,9 @@ -# version: 20261110 +# version: 20261111 # Image name: quay.io/opencv-ci/opencv-python-musllinux_1_2-x86-64 FROM quay.io/pypa/musllinux_1_2_x86_64:latest ARG CCACHE_VERSION=4.14.3 -ARG FFMPEG_VERSION=8.1.3 +ARG FFMPEG_VERSION=9.0.2 ARG FREETYPE_VERSION=2.15.0 ARG LIBPNG_VERSION=1.6.59 ARG VPX_VERSION=v1.15.2 From b103b9753941ffb8a6437acd1b22496cec87995f Mon Sep 17 00:00:00 2001 From: avdivan Date: Wed, 11 Nov 2026 16:35:54 +0200 Subject: [PATCH 3/4] Link OpenSSL statically into FFmpeg on manylinux_2_28 A shared libcrypto.so.1.1 in /ffmpeg_build/lib (registered via ldconfig) shadowed the system Red Hat OpenSSL with the same soname, breaking system tools: git-remote-https failed with 'undefined symbol: EVP_KDF_ctrl' in libk5crypto.so.3. Static linking keeps the system OpenSSL intact and still avoids bundling the Red Hat FIPS libcrypto into wheels (#1191). --- docker/manylinux_2_28/Dockerfile_aarch64 | 6 ++++-- docker/manylinux_2_28/Dockerfile_x86_64 | 6 ++++-- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/docker/manylinux_2_28/Dockerfile_aarch64 b/docker/manylinux_2_28/Dockerfile_aarch64 index 742355f8..9cba65b5 100644 --- a/docker/manylinux_2_28/Dockerfile_aarch64 +++ b/docker/manylinux_2_28/Dockerfile_aarch64 @@ -57,12 +57,14 @@ RUN curl -O -L https://download.qt.io/archive/qt/5.15/${QT_VERSION}/single/qt-ev ENV QTDIR /opt/Qt${QT_VERSION} ENV PATH "$QTDIR/bin:$PATH" +# OpenSSL is linked statically into FFmpeg: a shared libcrypto.so.1.1 in /ffmpeg_build/lib +# would shadow the system one (Red Hat build) for system tools like git/curl via ldconfig RUN mkdir ~/openssl_sources && \ cd ~/openssl_sources && \ curl -O -L https://github.com/openssl/openssl/archive/OpenSSL_${OPENSSL_VERSION}.tar.gz && \ tar -xf OpenSSL_${OPENSSL_VERSION}.tar.gz && \ cd openssl-OpenSSL_${OPENSSL_VERSION} && \ - ./config --prefix="/ffmpeg_build" --openssldir="/ffmpeg_build" no-pinshared shared zlib && \ + ./config --prefix="/ffmpeg_build" --openssldir="/ffmpeg_build" no-shared zlib -fPIC && \ make -j$(getconf _NPROCESSORS_ONLN) && \ # skip installing documentation make install_sw && \ @@ -111,7 +113,7 @@ RUN mkdir ~/ffmpeg_sources && \ tar -xf ffmpeg-${FFMPEG_VERSION}.tar.gz && \ cd ffmpeg-${FFMPEG_VERSION} && \ PATH=~/bin:$PATH && \ - PKG_CONFIG_PATH="/ffmpeg_build/lib/pkgconfig" ./configure --prefix="/ffmpeg_build" --extra-cflags="-I/ffmpeg_build/include" --extra-ldflags="-L/ffmpeg_build/lib" --enable-openssl --enable-libvpx --enable-shared --enable-pic --enable-libdav1d --bindir="$HOME/bin" && \ + PKG_CONFIG_PATH="/ffmpeg_build/lib/pkgconfig" ./configure --prefix="/ffmpeg_build" --extra-cflags="-I/ffmpeg_build/include" --extra-ldflags="-L/ffmpeg_build/lib" --pkg-config-flags="--static" --enable-openssl --enable-libvpx --enable-shared --enable-pic --enable-libdav1d --bindir="$HOME/bin" && \ make -j$(getconf _NPROCESSORS_ONLN) && \ make install && \ echo "/ffmpeg_build/lib/" >> /etc/ld.so.conf && \ diff --git a/docker/manylinux_2_28/Dockerfile_x86_64 b/docker/manylinux_2_28/Dockerfile_x86_64 index 263e78c2..986a9a5b 100644 --- a/docker/manylinux_2_28/Dockerfile_x86_64 +++ b/docker/manylinux_2_28/Dockerfile_x86_64 @@ -57,12 +57,14 @@ RUN curl -O -L https://download.qt.io/archive/qt/5.15/${QT_VERSION}/single/qt-ev ENV QTDIR /opt/Qt${QT_VERSION} ENV PATH "$QTDIR/bin:$PATH" +# OpenSSL is linked statically into FFmpeg: a shared libcrypto.so.1.1 in /ffmpeg_build/lib +# would shadow the system one (Red Hat build) for system tools like git/curl via ldconfig RUN mkdir ~/openssl_sources && \ cd ~/openssl_sources && \ curl -O -L https://github.com/openssl/openssl/archive/OpenSSL_${OPENSSL_VERSION}.tar.gz && \ tar -xf OpenSSL_${OPENSSL_VERSION}.tar.gz && \ cd openssl-OpenSSL_${OPENSSL_VERSION} && \ - ./config --prefix="/ffmpeg_build" --openssldir="/ffmpeg_build" no-pinshared shared zlib && \ + ./config --prefix="/ffmpeg_build" --openssldir="/ffmpeg_build" no-shared zlib -fPIC && \ make -j$(getconf _NPROCESSORS_ONLN) && \ # skip installing documentation make install_sw && \ @@ -111,7 +113,7 @@ RUN mkdir ~/ffmpeg_sources && \ tar -xf ffmpeg-${FFMPEG_VERSION}.tar.gz && \ cd ffmpeg-${FFMPEG_VERSION} && \ PATH=~/bin:$PATH && \ - PKG_CONFIG_PATH="/ffmpeg_build/lib/pkgconfig" ./configure --prefix="/ffmpeg_build" --extra-cflags="-I/ffmpeg_build/include" --extra-ldflags="-L/ffmpeg_build/lib" --enable-openssl --enable-libvpx --enable-shared --enable-pic --enable-libdav1d --bindir="$HOME/bin" && \ + PKG_CONFIG_PATH="/ffmpeg_build/lib/pkgconfig" ./configure --prefix="/ffmpeg_build" --extra-cflags="-I/ffmpeg_build/include" --extra-ldflags="-L/ffmpeg_build/lib" --pkg-config-flags="--static" --enable-openssl --enable-libvpx --enable-shared --enable-pic --enable-libdav1d --bindir="$HOME/bin" && \ make -j$(getconf _NPROCESSORS_ONLN) && \ make install && \ echo "/ffmpeg_build/lib/" >> /etc/ld.so.conf && \ From fb38d6ae417896c7e13fc041a3a4884052c56684 Mon Sep 17 00:00:00 2001 From: Alexander Smorkalov Date: Fri, 13 Nov 2026 20:48:26 +0300 Subject: [PATCH 4/4] Update OpenCV submodules to current 4.x to get FFmpeg 9.x support. --- opencv | 2 +- opencv_contrib | 2 +- opencv_extra | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/opencv b/opencv index 0654a42e..0dd4bf36 160000 --- a/opencv +++ b/opencv @@ -1 +1 @@ -Subproject commit 0654a42e19215ef25b1d367d822f3c630447e7c7 +Subproject commit 0dd4bf367e491dc036a814559265caae4403208b diff --git a/opencv_contrib b/opencv_contrib index a8e9acd6..2f5266f0 160000 --- a/opencv_contrib +++ b/opencv_contrib @@ -1 +1 @@ -Subproject commit a8e9acd62cabd30419dba83007f2ac0d07de5e2c +Subproject commit 2f5266f0489c8d32f23ce6d564a67ea7b2278a35 diff --git a/opencv_extra b/opencv_extra index f202151d..ebf9366b 160000 --- a/opencv_extra +++ b/opencv_extra @@ -1 +1 @@ -Subproject commit f202151dfb4734e47399ddf6581183d423da74b4 +Subproject commit ebf9366b3845efe1e54bf2440cf238fd68905bab