Mbedtls to openssl not complete in 25.12.5

i've been deploying openmwrt with openssl replacing mbedtls for a couple years on many devices. recently, cant get rid of mbedtls.this topic has come up periodically but i have not found a definitive solution in the forum.

for device MX4300: i've built using online firmware selector with the following custom commands:


-apk-mbedtls apk-openssl
-libustream-mbedtls libustream-openssl
-wpad-basic-mbedtls wpad-openssl


kmod-usb-printer luci-app-p910nd
irqbalance luci-app-irqbalance
owut luci-app-attendedsysupgrade
luci-app-advanced-reboot
collectd collectd-mod-ping luci-app-statistics
luci-app-uhttpd


when i log into the cli, there is no assertion of replacement for the defalult mbedtls packages:

Default package analysis:
  Default                        Provided-by
  apk-mbedtls                    not installed
  libustream-mbedtls             not installed
  nftables                       nftables-json
  wpad-basic-mbedtls             not installed

at this point, there are no mbedtls modules installed. but if i try to install curl, or if another package requires curl (in my case, openwisp), the libmbedtls module is installed:

apk list --installed |grep mbed
libmbedtls21-3.6.6-r2 aarch64_cortex-a53 {feeds/base/libs/mbedtls} (GPL-2.0-or-later) [installed]

the whole apk info list is here:

apk-openssl
ath11k-firmware-ipq8074
attendedsysupgrade-common
base-files
busybox
ca-bundle
ca-certificates
cgi-io
collectd
collectd-mod-cpu
collectd-mod-interface
collectd-mod-iwinfo
collectd-mod-load
collectd-mod-memory
collectd-mod-network
collectd-mod-ping
collectd-mod-rrdtool
curl
dnsmasq
dropbear
e2fsprogs
firewall4
fstools
fwtool
getrandom
hostapd-common
ipq-wifi-linksys_mx4200
irqbalance
iw
jansson4
jshn
jsonfilter
kernel
kmod-ath
kmod-ath11k
kmod-ath11k-ahb
kmod-cfg80211
kmod-crypto-aead
kmod-crypto-ccm
kmod-crypto-cmac
kmod-crypto-crc32c
kmod-crypto-ctr
kmod-crypto-gcm
kmod-crypto-geniv
kmod-crypto-gf128
kmod-crypto-ghash
kmod-crypto-hash
kmod-crypto-hmac
kmod-crypto-manager
kmod-crypto-michael-mic
kmod-crypto-null
kmod-crypto-rng
kmod-crypto-seqiv
kmod-crypto-sha3
kmod-crypto-sha512
kmod-fs-ext4
kmod-gpio-button-hotplug
kmod-hwmon-core
kmod-i2c-core
kmod-leds-gpio
kmod-leds-pca963x
kmod-lib-crc-ccitt
kmod-lib-crc-itu-t
kmod-lib-crc16
kmod-lib-crc32c
kmod-libphy
kmod-mac80211
kmod-nf-conntrack
kmod-nf-conntrack6
kmod-nf-flow
kmod-nf-log
kmod-nf-log6
kmod-nf-nat
kmod-nf-reject
kmod-nf-reject6
kmod-nfnetlink
kmod-nft-core
kmod-nft-fib
kmod-nft-nat
kmod-nft-offload
kmod-nls-base
kmod-phy-aquantia
kmod-ppp
kmod-pppoe
kmod-pppox
kmod-qca-nss-dp
kmod-qca-ssdk
kmod-qcom-qmi-helpers
kmod-qrtr
kmod-qrtr-smd
kmod-slhc
kmod-thermal
kmod-usb-common
kmod-usb-core
kmod-usb-dwc3
kmod-usb-dwc3-qcom
kmod-usb-printer
kmod-usb-roles
kmod-usb-xhci-hcd
kmod-usb3
libblkid1
libblobmsg-json20260213
libc
libcomerr0
libcurl4
libe2p2
libext2fs2
libgcc1
libiwinfo-data
libiwinfo20230701
libjson-c5
libjson-script20260213
libltdl7
liblua5.1.5
liblucihttp-ucode
liblucihttp0
libmbedtls21
libmnl0
libnftnl11
libnghttp2-14
libnl-tiny1
libopenssl-conf
libopenssl-legacy
libopenssl3
liboping
libpthread
librrd1
librt
libsmartcols1
libss2
libubox20260213
libubus20251202
libuci-lua
libuci20250120
libuclient20201210
libucode20230711
libudebug
libustream-openssl20201210
libuuid1
logd
losetup
lua
luafilesystem
luci
luci-app-advanced-reboot
luci-app-attendedsysupgrade
luci-app-firewall
luci-app-irqbalance
luci-app-openwisp
luci-app-p910nd
luci-app-package-manager
luci-app-statistics
luci-app-uhttpd
luci-base
luci-lib-nixio
luci-lib-uqr
luci-light
luci-mod-admin-full
luci-mod-network
luci-mod-status
luci-mod-system
luci-proto-ipv6
luci-proto-ppp
luci-theme-bootstrap
mtd
netifd
nftables-json
odhcp6c
odhcpd-ipv6only
openwisp-config
openwrt-keyring
owut
p910nd
ppp
ppp-mod-pppoe
procd
procd-seccomp
procd-ujail
rpcd
rpcd-mod-file
rpcd-mod-iwinfo
rpcd-mod-luci
rpcd-mod-rpcsys
rpcd-mod-rrdns
rpcd-mod-ucode
rrdtool1
ubi-utils
uboot-envtools
ubox
ubus
ubusd
uci
uclient-fetch
ucode
ucode-mod-digest
ucode-mod-fs
ucode-mod-html
ucode-mod-log
ucode-mod-math
ucode-mod-nl80211
ucode-mod-rtnl
ucode-mod-ubus
ucode-mod-uci
ucode-mod-uclient
ucode-mod-uloop
uhttpd
uhttpd-mod-ubus
urandom-seed
urngd
usign
wifi-scripts
wireless-regdb
wpad-openssl
zlib

it seeems that the step to add curl or openwisp (apk add luci-app-openwisp) procedes without recognizing the openssl replacements for libmbedtls.

suggestions?

thank you

.

I also struggled to get rid of mbedtls in favor of openssl

I make my own builds and can remember that for curl I had to choose Libraries > libcurl > openssl

Not sure how you do that for your package selection

The curl library has a declared dependency on libmbedtls:

$ apk query --fields name,depends --format yaml libcurl4
# 1 items
- name: libcurl4
  depends: # 5 items
    - ca-bundle
    - libc
    - libmbedtls21
    - libnghttp2-14
    - zlib

You'll need to modify the Makefile (https://github.com/openwrt/packages/blob/master/net/curl/Makefile#L97) and rebuild the curl/libcurl packages to accomplish a removal of the dependency.

yes, there it is - hardwired in curl. seems like unfinshed work.

as to the first question in thedefault package analysis - why are apk-openssl, libustream-openssl, and wpad-openssl not recognized as replacements?

thx

Those packages don't appear in the provides of any other package, so there's no way for owut to find the replacement. Compare these two packages extracted from the default package list:

$ apk query --format yaml --match provides apk-mbedtls
# 0 items

$ apk query --format yaml --fields name,provides --match provides dnsmasq
# 2 items
- name: dnsmasq-dhcpv6
  provides: # 2 items
    - dnsmasq=2.93-r2
    - dnsmasq-dhcpv6-any
- name: dnsmasq-full
  provides: # 2 items
    - dnsmasq=2.93-r2
    - dnsmasq-full-any

If the defaults listed apk instead of specifically apk-mbedtls, then owut could show something different (and likewise for all those other packages).

very clear. thank you.

For some packages, mbedtls <> openssl <> wolfssl is a build-time option (only).

Yeah, it would seem like there should libcurl-mbedtls and libcurl-openssl library packages with base curl dependent on a libcurl virtual, so you could pick one or the other.

It's not always that easy (transitive ABI leakage?).

Second that.
I compile myself seems the only way to get rid of mbedtls completely in favour of openssl