diff --git a/databases/mysql80-client/Makefile b/databases/mysql80-client/Makefile
index 32d382f0c8f9..17516ff51626 100644
--- a/databases/mysql80-client/Makefile
+++ b/databases/mysql80-client/Makefile
@@ -1,54 +1,49 @@
 # Created by: "Mahdi Mokhtari <mokhi64@gmail.com>"
 
 PORTNAME=	mysql
 PORTREVISION=	0
 PKGNAMESUFFIX=	80-client
 
 COMMENT=	Multithreaded SQL database (client)
 
 LICENSE+=	LGPL21
 
 MASTERDIR=	${.CURDIR}/../mysql80-server
 
 PKGMESSAGE=	${.CURDIR}/pkg-message
 PATCHDIR=	${MASTERDIR}/files
 PLIST=		${.CURDIR}/pkg-plist
 
 CONFLICTS_INSTALL=	mysql8[1-9]-client \
 			mysql[0-79][0-9]-client \
 			mariadb[0-9][0-9]-client \
 			percona[0-9][0-9]-client
 
-CMAKE_ARGS+=	-DWITHOUT_SERVER=1 -DINSTALL_SUPPORTFILESDIR=0 -DWITH_AUTHENTICATION_FIDO=ON
+CMAKE_ARGS+=	-DWITHOUT_SERVER=1 -DINSTALL_SUPPORTFILESDIR=0
 
 USE_LDCONFIG+=	${PREFIX}/lib/mysql
 
 MMAN1=		comp_err.1 lz4_decompress.1 mysql.1 mysql_config.1 mysql_config_editor.1 \
 		mysqladmin.1 mysqlbinlog.1 mysqlcheck.1 mysqldump.1 mysqlimport.1 mysqlman.1 \
 		mysqlpump.1 mysqlshow.1 mysqlslap.1 perror.1 zlib_decompress.1
 
 CLIENT_ONLY=	yes
 
 OPTIONS_GROUP+=	PLUGINS
 PLUGINS_DESC=	Default Client Plugins
-OPTIONS_GROUP_PLUGINS=	SASLCLIENT FIDO
+OPTIONS_GROUP_PLUGINS=	SASLCLIENT
 SASLCLIENT_DESC=	SASL client plugin module
 SASLCLIENT_CMAKE_BOOL=	WITH_AUTHENTICATION_LDAP
 SASLCLIENT_LIB_DEPENDS=	libsasl2.so:security/cyrus-sasl2
 SASLCLIENT_USE=		OPENLDAP=yes
 
-FIDO_DESC=		FIDO/U2F support (security/libfido2)
-FIDO_LIB_DEPENDS=   libfido2.so:security/libfido2 \
-			libhidapi.so:comms/hidapi
-FIDO_CMAKE_BOOL=	WITH_AUTHENTICATION_FIDO
-
 OPTIONS_DEFAULT+=	SASLCLIENT
 OPTIONS_SUB=	yes
 
 # issue 166367: adding symlinks for back-compatibility with ${lib}_r
 post-install:
 	@${LN} -s libmysqlclient.a ${STAGEDIR}${PREFIX}/lib/mysql/libmysqlclient_r.a
 	@${LN} -s libmysqlclient.so ${STAGEDIR}${PREFIX}/lib/mysql/libmysqlclient_r.so
 	@${LN} -s libmysqlclient.so.21 ${STAGEDIR}${PREFIX}/lib/mysql/libmysqlclient_r.so.21
 
 .include "${MASTERDIR}/Makefile"
diff --git a/databases/mysql80-client/pkg-plist b/databases/mysql80-client/pkg-plist
index e6d742f49109..f40325bbd618 100644
--- a/databases/mysql80-client/pkg-plist
+++ b/databases/mysql80-client/pkg-plist
@@ -1,226 +1,226 @@
 bin/comp_err
 bin/my_print_defaults
 bin/mysql
 bin/mysql_config
 bin/mysql_config_editor
 bin/mysql_migrate_keyring
 bin/mysqladmin
 bin/mysqlbinlog
 bin/mysqlcheck
 bin/mysqldump
 bin/mysqlimport
 bin/mysqlpump
 bin/mysqlshow
 bin/mysqlslap
 bin/perror
 @comment bin/zlib_decompress
 include/mysql/add_with_saturate.h
 include/mysql/caching_sha2_passwordopt-longopts.h
 include/mysql/caching_sha2_passwordopt-vars.h
 include/mysql/compression.h
 include/mysql/keyring_operations_helper.h
 include/mysql/manifest.h
 include/mysql/mem_root_deque.h
 include/mysql/memory_debugging.h
 include/mysql/my_basename.h
 include/mysql/my_checksum.h
 include/mysql/my_getpwnam.h
 include/mysql/my_hostname.h
 include/mysql/my_rcu_lock.h
 include/mysql/mysql_async.h
 include/mysql/pfs_data_lock_provider.h
 include/mysql/pfs_system_provider.h
 include/mysql/pfs_tls_channel_provider.h
 include/mysql/unhex.h
 include/mysql/unsafe_string_append.h
 include/mysql/base64.h
 include/mysql/big_endian.h
 include/mysql/c_string_less.h
 include/mysql/crypt_genhash_impl.h
 include/mysql/decimal.h
 include/mysql/depth_first_search.h
 include/mysql/dur_prop.h
 include/mysql/errmsg.h
 include/mysql/field_types.h
 include/mysql/ft_global.h
 include/mysql/heap.h
 include/mysql/integer_digits.h
 include/mysql/keycache.h
 include/mysql/lex_string.h
 include/mysql/lf.h
 include/mysql/little_endian.h
 include/mysql/m_ctype.h
 include/mysql/m_string.h
 include/mysql/map_helpers.h
 include/mysql/mf_wcomp.h
 include/mysql/mutex_lock.h
 include/mysql/my_aes.h
 include/mysql/my_alloc.h
 include/mysql/my_atomic.h
 include/mysql/my_base.h
 include/mysql/my_bit.h
 include/mysql/my_bitmap.h
 include/mysql/my_byteorder.h
 include/mysql/my_check_opt.h
 include/mysql/my_command.h
 include/mysql/my_compare.h
 include/mysql/my_compiler.h
 include/mysql/my_compress.h
 include/mysql/my_dbug.h
 include/mysql/my_default.h
 include/mysql/my_dir.h
 include/mysql/my_double2ulonglong.h
 include/mysql/my_getopt.h
 include/mysql/my_hash_combine.h
 include/mysql/my_icp.h
 include/mysql/my_inttypes.h
 include/mysql/my_io.h
 include/mysql/my_list.h
 include/mysql/my_loglevel.h
 include/mysql/my_macros.h
 include/mysql/my_md5.h
 include/mysql/my_md5_size.h
 include/mysql/my_murmur3.h
 include/mysql/my_pointer_arithmetic.h
 include/mysql/my_psi_config.h
 include/mysql/my_rapidjson_size_t.h
 include/mysql/my_rdtsc.h
 include/mysql/my_rnd.h
 include/mysql/my_sharedlib.h
 include/mysql/my_shm_defaults.h
 include/mysql/my_sqlcommand.h
 include/mysql/my_stacktrace.h
 include/mysql/my_sys.h
 include/mysql/my_systime.h
 include/mysql/my_table_map.h
 include/mysql/my_thread.h
 include/mysql/my_thread_local.h
 include/mysql/my_thread_os_id.h
 include/mysql/my_time.h
 include/mysql/my_timer.h
 include/mysql/my_tree.h
 include/mysql/my_uctype.h
 include/mysql/my_user.h
 include/mysql/my_xml.h
 include/mysql/myisam.h
 include/mysql/myisammrg.h
 include/mysql/myisampack.h
 include/mysql/mysql.h
 include/mysql/mysql/client_authentication.h
 include/mysql/mysql/client_plugin.h
 include/mysql/mysql/client_plugin.h.pp
 include/mysql/mysql/com_data.h
 include/mysql/mysql/group_replication_priv.h
 include/mysql/mysql/innodb_priv.h
 include/mysql/mysql/mysql_lex_string.h
 include/mysql/mysql/plugin.h
 include/mysql/mysql/plugin_audit.h
 include/mysql/mysql/plugin_audit.h.pp
 include/mysql/mysql/plugin_auth.h
 include/mysql/mysql/plugin_auth.h.pp
 include/mysql/mysql/plugin_auth_common.h
 include/mysql/mysql/plugin_ftparser.h
 include/mysql/mysql/plugin_ftparser.h.pp
 include/mysql/mysql/plugin_group_replication.h
 include/mysql/mysql/plugin_keyring.h
 include/mysql/mysql/plugin_keyring.h.pp
 include/mysql/mysql/plugin_query_rewrite.h
 include/mysql/mysql/plugin_trace.h
 include/mysql/mysql/plugin_validate_password.h
 include/mysql/mysql/service_command.h
 include/mysql/mysql/service_locking.h
 include/mysql/mysql/service_my_plugin_log.h
 include/mysql/mysql/service_mysql_alloc.h
 include/mysql/mysql/service_mysql_keyring.h
 include/mysql/mysql/service_mysql_password_policy.h
 include/mysql/mysql/service_mysql_string.h
 include/mysql/mysql/service_parser.h
 include/mysql/mysql/service_plugin_registry.h
 include/mysql/mysql/service_rpl_transaction_ctx.h
 include/mysql/mysql/service_rpl_transaction_write_set.h
 include/mysql/mysql/service_rules_table.h
 include/mysql/mysql/service_security_context.h
 include/mysql/mysql/service_srv_session.h
 include/mysql/mysql/service_srv_session_info.h
 include/mysql/mysql/service_ssl_wrapper.h
 include/mysql/mysql/service_thd_alloc.h
 include/mysql/mysql/service_thd_engine_lock.h
 include/mysql/mysql/service_thd_wait.h
 include/mysql/mysql/service_thread_scheduler.h
 include/mysql/mysql/services.h
 include/mysql/mysql/services.h.pp
 include/mysql/mysql/thread_pool_priv.h
 include/mysql/mysql/thread_type.h
 include/mysql/mysql/udf_registration_types.h
 include/mysql/mysql_com.h
 include/mysql/mysql_com_server.h
 include/mysql/mysql_time.h
 include/mysql/mysql_version.h
 include/mysql/mysqld_error.h
 include/mysql/mysys_err.h
 include/mysql/password.h
 include/mysql/pfs_cond_provider.h
 include/mysql/pfs_error_provider.h
 include/mysql/pfs_file_provider.h
 include/mysql/pfs_idle_provider.h
 include/mysql/pfs_memory_provider.h
 include/mysql/pfs_metadata_provider.h
 include/mysql/pfs_mutex_provider.h
 include/mysql/pfs_rwlock_provider.h
 include/mysql/pfs_socket_provider.h
 include/mysql/pfs_stage_provider.h
 include/mysql/pfs_statement_provider.h
 include/mysql/pfs_table_provider.h
 include/mysql/pfs_thread_provider.h
 include/mysql/pfs_transaction_provider.h
 include/mysql/prealloced_array.h
 include/mysql/print_version.h
 include/mysql/priority_queue.h
 include/mysql/rwlock_scoped_lock.h
 include/mysql/scope_guard.h
 include/mysql/service_versions.h
 include/mysql/sha1.h
 include/mysql/sha2.h
 include/mysql/sql_chars.h
 include/mysql/sql_common.h
 include/mysql/sql_string.h
 include/mysql/sslopt-case.h
 include/mysql/sslopt-longopts.h
 include/mysql/sslopt-vars.h
 include/mysql/tables_contained_in.h
 include/mysql/template_utils.h
 include/mysql/thr_cond.h
 include/mysql/thr_lock.h
 include/mysql/thr_mutex.h
 include/mysql/thr_rwlock.h
 include/mysql/typelib.h
 include/mysql/varlen_sort.h
 include/mysql/violite.h
 include/mysql/welcome_copyright_notice.h
 lib/mysql/libmysqlclient.a
 lib/mysql/libmysqlclient.so
 lib/mysql/libmysqlclient.so.21
 lib/mysql/libmysqlclient_r.a
 lib/mysql/libmysqlclient_r.so
 lib/mysql/libmysqlclient_r.so.21
 %%SASLCLIENT%%lib/mysql/plugin/authentication_ldap_sasl_client.so
-%%FIDO%%lib/mysql/plugin/authentication_fido_client.so
-%%FIDO%%lib/mysql/plugin/authentication_oci_client.so
+lib/mysql/plugin/authentication_fido_client.so
+lib/mysql/plugin/authentication_oci_client.so
 libdata/pkgconfig/mysqlclient.pc
 man/man1/comp_err.1.gz
 man/man1/lz4_decompress.1.gz
 man/man1/mysql.1.gz
 man/man1/mysql_config.1.gz
 man/man1/mysql_config_editor.1.gz
 man/man1/mysqladmin.1.gz
 man/man1/mysqlbinlog.1.gz
 man/man1/mysqlcheck.1.gz
 man/man1/mysqldump.1.gz
 man/man1/mysqlimport.1.gz
 man/man1/mysqlman.1.gz
 man/man1/mysqlpump.1.gz
 man/man1/mysqlshow.1.gz
 man/man1/mysqlslap.1.gz
 man/man1/perror.1.gz
 man/man1/zlib_decompress.1.gz
 share/aclocal/mysql.m4
diff --git a/databases/mysql80-server/Makefile b/databases/mysql80-server/Makefile
index 13db1af59e53..781d91f5c3f1 100644
--- a/databases/mysql80-server/Makefile
+++ b/databases/mysql80-server/Makefile
@@ -1,194 +1,200 @@
 # Created by: Mahdi Mokhtari <mokhi64@gmail.com>
 
 PORTNAME?=		mysql
-PORTVERSION=		8.0.27
+PORTVERSION=		8.0.28
 PORTREVISION?=		0
 CATEGORIES=		databases
 MASTER_SITES=		MYSQL/MySQL-8.0
 PKGNAMESUFFIX?=		80-server
 DISTNAME=		${PORTNAME}-boost-${PORTVERSION}${DISTVERSIONSUFFIX}
 
 MAINTAINER=		joneum@FreeBSD.org
 COMMENT?=		Multithreaded SQL database (server)
 
 LICENSE=		GPLv2
 
 WRKSRC=		${WRKDIR}/${PORTNAME}-${PORTVERSION}${DISTVERSIONSUFFIX}
 
 SLAVEDIRS=	databases/mysql80-client
 USES=		bison:build cmake:noninja compiler:c++17-lang cpe \
 		groff:run libedit localbase ncurses perl5 pkgconfig shebangfix ssl
 
 CPE_VENDOR=	oracle
 
 USE_CXXSTD=	c++17
 USE_PERL5=	run
 
 MY_DBDIR=	/var/db/mysql
 MY_SECDIR=	/var/db/mysql_secure
 MY_TMPDIR=	/var/db/mysql_tmpdir
 
 LIB_DEPENDS+=	libcurl.so:ftp/curl \
 		libevent.so:devel/libevent \
 		libicutu.so:devel/icu \
 		liblz4.so:archivers/liblz4 \
 		libzstd.so:archivers/zstd \
 		libprotobuf.so:devel/protobuf \
+		libfido2.so:security/libfido2 \
+		libhidapi.so:comms/hidapi \
 		${LIB_DEPENDS_${ARCH}}
 LIB_DEPENDS_aarch64=	libunwind.so:devel/libunwind
 LIB_DEPENDS_amd64=	libunwind.so:devel/libunwind
 LIB_DEPENDS_armv7=	libunwind.so:devel/libunwind
 LIB_DEPENDS_i386=	libunwind.so:devel/libunwind
 LIB_DEPENDS_powerpc64=		libunwind.so:devel/libunwind
 LIB_DEPENDS_powerpc64le=	libunwind.so:devel/libunwind
 
 BUILD_DEPENDS=	liblz4>0:archivers/liblz4 \
 		${BUILD_DEPENDS_${ARCH}}
 BUILD_DEPENDS_aarch64=	libunwind>0:devel/libunwind
 BUILD_DEPENDS_amd64=	libunwind>0:devel/libunwind
 BUILD_DEPENDS_armv7=	libunwind>0:devel/libunwind
 BUILD_DEPENDS_i386=	libunwind>0:devel/libunwind
 BUILD_DEPENDS_powerpc64=	libunwind>0:devel/libunwind
 BUILD_DEPENDS_powerpc64le=	libunwind>0:devel/libunwind
 
 CMAKE_BUILD_TYPE=	Release
 CFLAGS+=		-fPIC -DNDEBUG -malign-double
 
 CMAKE_ARGS+=	-DINSTALL_LAYOUT=FREEBSD \
 		-DINSTALL_LDCONFIGDIR="${LOCALBASE}/libdata/ldconfig" \
 		-DINSTALL_PKGCONFIGDIR="${LOCALBASE}/libdata/pkgconfig" \
 		-DINSTALL_DOCDIR="share/doc/mysql" \
 		-DINSTALL_DOCREADMEDIR="share/doc/mysql" \
 		-DINSTALL_INCLUDEDIR="include/mysql" \
 		-DINSTALL_INFODIR="${INFO_PATH}" \
 		-DINSTALL_LIBDIR="lib/mysql" \
 		-DINSTALL_MANDIR="man" \
 		-DINSTALL_MYSQLDATADIR="${MY_DBDIR}" \
 		-DINSTALL_MYSQLKEYRINGDIR="etc/mysql/keyring" \
 		-DINSTALL_MYSQLSHAREDIR="share/mysql" \
 		-DINSTALL_MYSQLTESTDIR="" \
 		-DINSTALL_PLUGINDIR="lib/mysql/plugin" \
 		-DINSTALL_SBINDIR="libexec" \
 		-DINSTALL_SCRIPTDIR="bin" \
 		-DINSTALL_SECURE_FILE_PRIVDIR="${MY_SECDIR}" \
 		-DINSTALL_SHAREDIR="share" \
 		-DINSTALL_SUPPORTFILESDIR="share/mysql" \
 		-DMYSQL_KEYRINGDIR="${ETCDIR}/keyring" \
 		-DWITH_BOOST="${WRKSRC}/boost" \
 		-DWITH_SYSTEM_LIBS=1 \
 		-DWITH_EDITLINE=system \
 		-DWITH_LIBEVENT=system \
 		-DWITH_LZ4=system \
 		-DWITH_ICU=system \
 		-DWITH_CURL=system \
 		-DWITH_ZLIB=system \
 		-DWITH_ZSTD=system \
 		-DWITH_PROTOBUF=system \
 		-DWITH_SSL=system \
+		-DWITH_AUTHENTICATION_FIDO=1 \
 		-DBUILD_BUNDLED_ZLIB=0 \
 		-DBUILD_BUNDLED_LZ4=0
 
 # The Mroonga, RocksDB, and TokuDB storage engines are disabled.
 # Mroonga is only buildable on little endian archs.
 # RocksDB is only buildable on little endian archs and requires POSIX timers.
 # TokuDB is only buildable on 64-bit little endian archs.
 CMAKE_ARGS+=	-DWITHOUT_MROONGA_STORAGE_ENGINE=1 \
 		-DWITHOUT_ROCKSDB_STORAGE_ENGINE=1 \
 		-DWITHOUT_TOKUDB_STORAGE_ENGINE=1
 
 SHEBANG_FILES=	scripts/*.pl* scripts/*.sh
 
 .ifdef USE_MYSQL
 IGNORE=		You have `USE_MYSQL' variable defined either in environment or in make(1) arguments. Please undefine and try again.
 .endif
 
 SUB_LIST=	MY_DBDIR=${MY_DBDIR} \
 		MY_SECDIR=${MY_SECDIR} \
 		MY_TMPDIR=${MY_TMPDIR}
 
 PLIST_SUB=	MY_DBDIR=${MY_DBDIR} \
 		MY_SECDIR=${MY_SECDIR} \
 		MY_TMPDIR=${MY_TMPDIR} \
 		MYSQL80_LIBVER=${MYSQL80_LIBVER}
 
 # MySQL-Server part
 .if !defined(CLIENT_ONLY)
 USES+=		mysql:80
 
 CONFLICTS_INSTALL=	mysql*-server \
 			mysqlwsrep*-server \
 			mariadb*-server \
 			percona*-server
 
 USE_RC_SUBR=	mysql-server
 
 SUB_FILES=	my.cnf.sample pkg-message
 
 USERS=		mysql
 GROUPS=		mysql
 
 USE_LDCONFIG+=	${PREFIX}/lib/mysql/plugin
 
 MMAN1=		ibd2sdi.1 innochecksum.1 my_print_defaults.1 myisam_ftdump.1 myisamchk.1 \
 		myisamlog.1 myisampack.1 mysql_secure_installation.1 mysql_ssl_rsa_setup.1 \
 		mysql_tzinfo_to_sql.1 mysql_upgrade.1 mysql.server.1 mysqldumpslow.1 mysqld_multi.1 \
 		mysqld_safe.1 mysqlrouter_passwd.1 mysqlrouter_plugin_info.1 mysqlrouter.1
 MMAN8=		mysqld.8
 
 CMAKE_ARGS+=	-DWITH_EMBEDDED_SERVER="ON"
 CMAKE_ARGS+=	-DWITHOUT_CLIENTLIBS="ON"
+# Disable unit tests, it fails on !amd64 and <13.0 due to c++17 rules
+CMAKE_ARGS+=   -DWITH_UNIT_TESTS="OFF"
 
 OPTIONS_GROUP=		STORAGE
 OPTIONS_GROUP_STORAGE=	ARCHIVE BLACKHOLE EXAMPLE FEDERATED INNOBASE PARTITION PERFSCHEMA
 OPTIONS_SUB=		YES
 STORAGE_DESC=		Permissible "Storage Engines" (to compile statically into the server)
 ARCHIVE_DESC=		Compile "Archive Storage" statically in server
 BLACKHOLE_DESC=		Compile "Blackhole Storage" statically in server
 EXAMPLE_DESC=		Compile "Example Storage" statically in server
 FEDERATED_DESC=		Compile "Federated Storage" statically in server
 INNOBASE_DESC=		Compile "InnoDB Storage" statically in server
 PARTITION_DESC=		Compile "Partitioning support Storage" statically in server
 PERFSCHEMA_DESC=	Compile "Performance Schema Storage" statically in server
 
 ARCHIVE_CMAKE_ON=	-DWITH_ARCHIVE_STORAGE_ENGINE=1
 BLACKHOLE_CMAKE_ON=	-DWITH_BLACKHOLE_STORAGE_ENGINE=1
 EXAMPLE_CMAKE_ON=	-DWITH_EXAMPLE_STORAGE_ENGINE=1
 FEDERATED_CMAKE_ON=	-DWITH_FEDERATED_STORAGE_ENGINE=1
 INNOBASE_CMAKE_ON=	-DWITH_INNOBASE_STORAGE_ENGINE=1
 PARTITION_CMAKE_ON=	-DWITH_PARTITION_STORAGE_ENGINE=1
 PERFSCHEMA_CMAKE_ON=	-DWITH_PERFSCHEMA_STORAGE_ENGINE=1
 
 OPTIONS_GROUP+=		FEATURES
 OPTIONS_GROUP_FEATURES=	PERFSCHM
 FEATURES_DESC=		Default features knobs
 PERFSCHM_DESC=		Enable "Performance Schema" by default (High RAM usage)
 OPTIONS_DEFAULT+=	PERFSCHM
 
 PERFSCHM_SUB_LIST+=		PERFSCHEMRC=""
 PERFSCHM_SUB_LIST_OFF+=		PERFSCHEMRC="--skip-performance-schema"
 FEDERATED_SUB_LIST+=		FEDER="--federated"
 FEDERATED_SUB_LIST_OFF+=	FEDER=""
 .endif
 
 .include <bsd.port.options.mk>
 
 # Since 8.0.20 release innodb engine uses new memory alligned allocator
 # which is broken on i386 due to different size of types and caused a
 # 'static_assert(alignof(T) <= alignof(std::max_align_t))' error
 .if ${ARCH} == i386
-CMAKE_ARGS+=	-DDISABLE_PSI_MEMORY=1
+#CMAKE_ARGS+=	-DDISABLE_PSI_MEMORY=1
+SSP_UNSAFE=	yes
 .endif
 
 post-extract:
 	@${RM} -rv ${WRKSRC}/sql/sql_hints.yy.cc ${WRKSRC}/sql/sql_hints.yy.h
 
 .if !defined(CLIENT_ONLY)
 post-install:
 	${MKDIR} ${STAGEDIR}${ETCDIR}
 	${INSTALL_DATA} ${WRKDIR}/my.cnf.sample ${STAGEDIR}${ETCDIR}/my.cnf.sample
 	${MKDIR} ${STAGEDIR}${ETCDIR}/keyring
 	${MKDIR} ${STAGEDIR}${MY_SECDIR}
 	${MKDIR} ${STAGEDIR}${MY_TMPDIR}
 .endif
 
 .include <bsd.port.mk>
diff --git a/databases/mysql80-server/distinfo b/databases/mysql80-server/distinfo
index 55029d0a7a90..d74c18256ce7 100644
--- a/databases/mysql80-server/distinfo
+++ b/databases/mysql80-server/distinfo
@@ -1,3 +1,3 @@
-TIMESTAMP = 1635786797
-SHA256 (mysql-boost-8.0.27.tar.gz) = 74b5bc6ff88fe225560174a24b7d5ff139f4c17271c43000dbcf3dcc9507b3f9
-SIZE (mysql-boost-8.0.27.tar.gz) = 292184025
+TIMESTAMP = 1642804921
+SHA256 (mysql-boost-8.0.28.tar.gz) = 6dd0303998e70066d36905bd8fef1c01228ea182dbfbabc6c22ebacdbf8b5941
+SIZE (mysql-boost-8.0.28.tar.gz) = 298044027
diff --git a/databases/mysql80-server/files/extra-patch-config.h.cmake b/databases/mysql80-server/files/extra-patch-config.h.cmake
deleted file mode 100644
index 3ac1add1b9ce..000000000000
--- a/databases/mysql80-server/files/extra-patch-config.h.cmake
+++ /dev/null
@@ -1,12 +0,0 @@
---- config.h.cmake.orig	2014-12-05 16:24:02 UTC
-+++ config.h.cmake
-@@ -151,7 +151,8 @@
- #cmakedefine HAVE_FESETROUND 1
- #cmakedefine HAVE_FINITE 1
- #cmakedefine HAVE_FP_EXCEPT 1
--#cmakedefine HAVE_FPSETMASK 1
-+#cmakedefine HAVE_FPSETMASK 0
-+#cmakedefine HAVE_FEDISABLEEXCEPT 1
- #cmakedefine HAVE_FSEEKO 1
- #cmakedefine HAVE_FSYNC 1
- #cmakedefine HAVE_FTIME 1
diff --git a/databases/mysql80-server/files/patch-CMakeLists.txt b/databases/mysql80-server/files/patch-CMakeLists.txt
index 0b4f88bfd853..e977c8863cc0 100644
--- a/databases/mysql80-server/files/patch-CMakeLists.txt
+++ b/databases/mysql80-server/files/patch-CMakeLists.txt
@@ -1,85 +1,85 @@
---- CMakeLists.txt.orig	2021-09-28 11:46:34 UTC
+--- CMakeLists.txt.orig	2021-12-17 16:07:27 UTC
 +++ CMakeLists.txt
-@@ -1647,7 +1647,7 @@ IF(LINUX AND KNOWN_CUSTOM_LIBRARIES)
+@@ -1665,7 +1665,7 @@ IF(LINUX AND KNOWN_CUSTOM_LIBRARIES)
  ENDIF()
  
  IF(WITH_AUTHENTICATION_LDAP)
 -  IF(LINUX AND KNOWN_CUSTOM_LIBRARIES)
 +  IF(LINUX OR FREEBSD AND KNOWN_CUSTOM_LIBRARIES)
      # LDAP / SASL / KERBEROS / SSL must all be "system" or "custom", not a mix.
      IF(WITH_LDAP STREQUAL "system" OR
          WITH_SASL STREQUAL "system" OR
-@@ -1696,10 +1696,10 @@ IF(WITH_AUTHENTICATION_KERBEROS)
+@@ -1714,10 +1714,10 @@ IF(WITH_AUTHENTICATION_KERBEROS)
    ENDIF()
  ENDIF()
  
 -# Add system/bundled editline.
 -MYSQL_CHECK_EDITLINE()
  # Add libevent
 -MYSQL_CHECK_LIBEVENT()
 +IF(NOT WITHOUT_SERVER)
 +  MYSQL_CHECK_LIBEVENT()
 +ENDIF()
  # Add lz4 library
  MYSQL_CHECK_LZ4()
  # Add icu library
-@@ -1869,7 +1869,9 @@ OPTION(WITH_HYPERGRAPH_OPTIMIZER
-   ${WITH_HYPERGRAPH_OPTIMIZER_DEFAULT}
-   )
+@@ -1917,7 +1917,9 @@ ADD_CUSTOM_TARGET(plugin_all)
+ # Utility target to build every target added with MYSQL_ADD_COMPONENT.
+ ADD_CUSTOM_TARGET(component_all)
  
 -ADD_SUBDIRECTORY(include)
 +IF(NOT WITHOUT_CLIENTLIBS)
 +  ADD_SUBDIRECTORY(include)
 +ENDIF(NOT WITHOUT_CLIENTLIBS)
  ADD_SUBDIRECTORY(strings)
  ADD_SUBDIRECTORY(vio)
  ADD_SUBDIRECTORY(mysys)
-@@ -1913,12 +1915,17 @@ IF(WITH_UNIT_TESTS)
+@@ -1962,12 +1964,17 @@ IF(WITH_UNIT_TESTS)
    ADD_SUBDIRECTORY(unittest/mytap/t)
  ENDIF()
  
 -ADD_SUBDIRECTORY(client)
 +IF(NOT WITHOUT_TOOLS)
 +  # Add system/bundled editline
 +  MYSQL_CHECK_EDITLINE()
 +  ADD_SUBDIRECTORY(client)
 +ENDIF(NOT WITHOUT_TOOLS)
 +
  ADD_SUBDIRECTORY(utilities)
 -ADD_SUBDIRECTORY(share)
  ADD_SUBDIRECTORY(libservices)
  
  IF(NOT WITHOUT_SERVER)
 +  ADD_SUBDIRECTORY(share)
    ADD_SUBDIRECTORY(testclients)
    ADD_SUBDIRECTORY(sql)
  ENDIF()
-@@ -1971,11 +1978,11 @@ ENDIF()
+@@ -2020,11 +2027,11 @@ ENDIF()
  # scripts/mysql_config depends on client and server targets loaded above.
  # It is referenced by some of the directories below, so we insert it here.
  ADD_SUBDIRECTORY(scripts)
 +ADD_SUBDIRECTORY(support-files)
  
  IF(NOT WITHOUT_SERVER)
    ADD_SUBDIRECTORY(mysql-test)
    ADD_SUBDIRECTORY(mysql-test/lib/My/SafeProcess)
 -  ADD_SUBDIRECTORY(support-files)
    IF(WITH_INTERNAL)
      ADD_SUBDIRECTORY(internal)
    ENDIF()
-@@ -2084,6 +2091,7 @@ IF(PACK_SEPARATE_COMPONENTS)
+@@ -2134,6 +2141,7 @@ IF(PACK_SEPARATE_COMPONENTS)
    SET(CPACK_COMPONENTS_GROUPING IGNORE)
  ENDIF()
  
 +IF(FALSE)
  IF(UNIX)
    INSTALL(FILES
      Docs/mysql.info
-@@ -2118,6 +2126,7 @@ IF(NOT INSTALL_LAYOUT MATCHES "RPM")
+@@ -2168,6 +2176,7 @@ IF(NOT INSTALL_LAYOUT MATCHES "RPM")
      PATTERN "sp-imp-spec.txt" EXCLUDE
      PATTERN "README.build" EXCLUDE
    )
 +ENDIF()
  ENDIF()
  
  # Now that we're done with all ADD_SUBDIRECTORY and thus all feature tests,
diff --git a/databases/mysql80-server/files/patch-cmake_os_FreeBSD.cmake b/databases/mysql80-server/files/patch-cmake_os_FreeBSD.cmake
index 2f6f488d4abd..90629de01287 100644
--- a/databases/mysql80-server/files/patch-cmake_os_FreeBSD.cmake
+++ b/databases/mysql80-server/files/patch-cmake_os_FreeBSD.cmake
@@ -1,25 +1,25 @@
---- cmake/os/FreeBSD.cmake.orig	2019-09-20 08:30:51 UTC
+--- cmake/os/FreeBSD.cmake.orig	2021-12-17 16:07:27 UTC
 +++ cmake/os/FreeBSD.cmake
-@@ -45,8 +45,20 @@ IF(NOT FORCE_UNSUPPORTED_COMPILER)
-       MESSAGE(FATAL_ERROR
-         "GCC 5.3 or newer is required (-dumpversion says ${GCC_VERSION})")
+@@ -48,8 +48,20 @@ IF(NOT FORCE_UNSUPPORTED_COMPILER)
+     IF(CMAKE_CXX_COMPILER_VERSION VERSION_LESS 7.1)
+       MESSAGE(FATAL_ERROR "GCC 7.1 or newer is required")
      ENDIF()
 -  ELSE()
 -    MESSAGE(FATAL_ERROR "Unsupported compiler!")
 +    CHECK_C_SOURCE_RUNS("
 +      int main()
 +      {
 +        return (__clang_major__ >= 4);
 +      }" I386_ATOMIC_BUILTINS)
 +    IF((CMAKE_SYSTEM_PROCESSOR MATCHES "i386") AND (NOT I386_ATOMIC_BUILTINS))
 +      SET(HAVE_GCC_ATOMIC_BUILTINS CACHE  INTERNAL "")
 +    ENDIF()
 +  ELSEIF(CMAKE_COMPILER_IS_GNUCC)
 +    EXECUTE_PROCESS(COMMAND ${CMAKE_C_COMPILER} -dumpversion
 +                    OUTPUT_VARIABLE GCC_VERSION)
 +    IF(GCC_VERSION VERSION_LESS 4.4)
 +      MESSAGE(FATAL_ERROR "GCC 4.4 or newer is required!")
 +    ENDIF()
    ENDIF()
  ENDIF()
  
diff --git a/databases/mysql80-server/files/patch-cmake_plugin.cmake b/databases/mysql80-server/files/patch-cmake_plugin.cmake
index ecd2598f320e..874c450a4ef2 100644
--- a/databases/mysql80-server/files/patch-cmake_plugin.cmake
+++ b/databases/mysql80-server/files/patch-cmake_plugin.cmake
@@ -1,27 +1,27 @@
---- cmake/plugin.cmake.orig	2019-09-20 08:30:51 UTC
+--- cmake/plugin.cmake.orig	2021-12-17 16:07:27 UTC
 +++ cmake/plugin.cmake
-@@ -230,15 +230,15 @@ MACRO(MYSQL_ADD_PLUGIN plugin_arg)
+@@ -247,15 +247,15 @@ MACRO(MYSQL_ADD_PLUGIN plugin_arg)
  
        # For testing purposes, we need
        # <...>/lib/plugin/debug/authentication_ldap_sasl_client.so
 -      IF(ARG_CLIENT_ONLY)
 -        INSTALL_DEBUG_TARGET(${target}
 -          DESTINATION ${INSTALL_PLUGINDIR}/debug
 -          COMPONENT Test)
 -      ELSE()
 -        INSTALL_DEBUG_TARGET(${target}
 -          DESTINATION ${INSTALL_PLUGINDIR}/debug
 -          COMPONENT ${INSTALL_COMPONENT})
 -      ENDIF()
 +#      IF(ARG_CLIENT_ONLY)
 +#        INSTALL_DEBUG_TARGET(${target}
 +#          DESTINATION ${INSTALL_PLUGINDIR}/debug
 +#          COMPONENT Test)
 +#      ELSE()
 +#        INSTALL_DEBUG_TARGET(${target}
 +#          DESTINATION ${INSTALL_PLUGINDIR}/debug
 +#          COMPONENT ${INSTALL_COMPONENT})
 +#      ENDIF()
      ENDIF()
    ELSE()
      IF(WITHOUT_${plugin})
diff --git a/databases/mysql80-server/files/patch-cmake_ssl.cmake b/databases/mysql80-server/files/patch-cmake_ssl.cmake
index 9173b842a952..9643e476f4eb 100644
--- a/databases/mysql80-server/files/patch-cmake_ssl.cmake
+++ b/databases/mysql80-server/files/patch-cmake_ssl.cmake
@@ -1,29 +1,29 @@
---- cmake/ssl.cmake.orig	2019-09-20 08:30:51 UTC
+--- cmake/ssl.cmake.orig	2021-12-17 16:07:27 UTC
 +++ cmake/ssl.cmake
-@@ -199,7 +199,7 @@ MACRO (MYSQL_CHECK_SSL)
+@@ -211,7 +211,7 @@ MACRO (MYSQL_CHECK_SSL)
        # Encoded as MNNFFPPS: major minor fix patch status
        FILE(STRINGS "${OPENSSL_INCLUDE_DIR}/openssl/opensslv.h"
          OPENSSL_VERSION_NUMBER
 -        REGEX "^#[ ]*define[\t ]+OPENSSL_VERSION_NUMBER[\t ]+0x[0-9].*"
 +        REGEX "^#[\t ]*define[\t ]+OPENSSL_VERSION_NUMBER[\t ]+0x[0-9].*"
          )
        STRING(REGEX REPLACE
          "^.*OPENSSL_VERSION_NUMBER[\t ]+0x([0-9]).*$" "\\1"
-@@ -222,13 +222,14 @@ MACRO (MYSQL_CHECK_SSL)
+@@ -226,13 +226,14 @@ MACRO (MYSQL_CHECK_SSL)
          OPENSSL_FIX_VERSION "${OPENSSL_VERSION_NUMBER}"
          )
      ENDIF()
 -    IF("${OPENSSL_MAJOR_VERSION}.${OPENSSL_MINOR_VERSION}.${OPENSSL_FIX_VERSION}" VERSION_GREATER "1.1.0")
 -       ADD_DEFINITIONS(-DHAVE_TLSv13)
 +    CHECK_SYMBOL_EXISTS(TLS1_3_VERSION "openssl/tls1.h" HAVE_TLS1_3_VERSION)
 +    IF(HAVE_TLS1_3_VERSION)
 +       #ADD_DEFINITIONS(-DHAVE_TLSv13)
      ENDIF()
      IF(OPENSSL_INCLUDE_DIR AND
         OPENSSL_LIBRARY   AND
         CRYPTO_LIBRARY      AND
 -       OPENSSL_MAJOR_VERSION STREQUAL "1"
 +       OPENSSL_MAJOR_VERSION VERSION_GREATER_EQUAL "1"
        )
        SET(OPENSSL_FOUND TRUE)
        FIND_PROGRAM(OPENSSL_EXECUTABLE openssl
diff --git a/databases/mysql80-server/files/patch-include_my__stacktrace.h b/databases/mysql80-server/files/patch-include_my__stacktrace.h
index 372aec242a8d..1654014bd77b 100644
--- a/databases/mysql80-server/files/patch-include_my__stacktrace.h
+++ b/databases/mysql80-server/files/patch-include_my__stacktrace.h
@@ -1,11 +1,11 @@
---- include/my_stacktrace.h.orig	2020-01-23 19:43:07.769584000 +0100
-+++ include/my_stacktrace.h	2020-01-23 19:43:48.684042000 +0100
+--- include/my_stacktrace.h.orig	2021-12-17 16:07:27 UTC
++++ include/my_stacktrace.h
 @@ -43,7 +43,7 @@
    HAVE_BACKTRACE - Linux, FreeBSD, OSX, Solaris
    _WIN32 - Windows
  */
 -#if defined(HAVE_BACKTRACE) || defined(_WIN32)
 +#if (defined(HAVE_BACKTRACE) || defined(_WIN32)) && (defined(__aarch64__) || defined(__amd64__) || defined(__i386__))
  #define HAVE_STACKTRACE 1
  void my_init_stacktrace();
- void my_print_stacktrace(uchar *stack_bottom, ulong thread_stack);
+ void my_print_stacktrace(const uchar *stack_bottom, ulong thread_stack);
diff --git a/databases/mysql80-server/files/patch-include_myisam.h b/databases/mysql80-server/files/patch-include_myisam.h
index b8f3ec7ef519..311c935fc115 100644
--- a/databases/mysql80-server/files/patch-include_myisam.h
+++ b/databases/mysql80-server/files/patch-include_myisam.h
@@ -1,11 +1,11 @@
---- include/myisam.h.orig	2019-09-20 08:30:51 UTC
+--- include/myisam.h.orig	2021-12-17 16:07:27 UTC
 +++ include/myisam.h
-@@ -59,7 +59,7 @@
+@@ -60,7 +60,7 @@
    The following defines can be increased if necessary.
    But beware the dependency of MI_MAX_POSSIBLE_KEY_BUFF and MI_MAX_KEY_LENGTH.
  */
 -#define MI_MAX_KEY_LENGTH 1000 /* Max length in bytes */
 +#define MI_MAX_KEY_LENGTH 4000 /* Max length in bytes */
  #define MI_MAX_KEY_SEG 16      /* Max segments for key */
  
  #define MI_MAX_KEY_BUFF (MI_MAX_KEY_LENGTH + MI_MAX_KEY_SEG * 6 + 8 + 8)
diff --git a/databases/mysql80-server/files/patch-include_violite.h b/databases/mysql80-server/files/patch-include_violite.h
index 78d606a68c6c..00065b6ea59c 100644
--- a/databases/mysql80-server/files/patch-include_violite.h
+++ b/databases/mysql80-server/files/patch-include_violite.h
@@ -1,14 +1,14 @@
---- include/violite.h.orig	2019-09-20 08:30:51 UTC
+--- include/violite.h.orig	2021-12-17 16:07:27 UTC
 +++ include/violite.h
-@@ -269,9 +269,11 @@ struct st_VioSSLFd *new_VioSSLConnectorFd(
+@@ -268,9 +268,11 @@ struct st_VioSSLFd *new_VioSSLConnectorFd(
  
  long process_tls_version(const char *tls_version);
  
 +#ifndef LIBRESSL_VERSION_NUMBER
  int set_fips_mode(const uint fips_mode, char *err_string);
  
  uint get_fips_mode();
 +#endif
  
- struct st_VioSSLFd *new_VioSSLAcceptorFd(
-     const char *key_file, const char *cert_file, const char *ca_file,
+ int test_ssl_fips_mode(char *err_string);
+ 
diff --git a/databases/mysql80-server/files/patch-libmysql_CMakeLists.txt b/databases/mysql80-server/files/patch-libmysql_CMakeLists.txt
index bfc8693d6480..44e1979f8075 100644
--- a/databases/mysql80-server/files/patch-libmysql_CMakeLists.txt
+++ b/databases/mysql80-server/files/patch-libmysql_CMakeLists.txt
@@ -1,68 +1,68 @@
---- libmysql/CMakeLists.txt.orig	2021-07-01 07:53:49 UTC
+--- libmysql/CMakeLists.txt.orig	2021-12-17 16:07:27 UTC
 +++ libmysql/CMakeLists.txt
-@@ -197,6 +197,11 @@ IF (WIN32 AND OPENSSL_APPLINK_C)
+@@ -198,6 +198,11 @@ IF (WIN32 AND OPENSSL_APPLINK_C)
    )
  ENDIF()
  
 +INCLUDE(${MYSQL_CMAKE_SCRIPT_DIR}/compile_flags.cmake)
 +IF (CMAKE_SYSTEM_NAME STREQUAL "FreeBSD")
 +  ADD_COMPILE_FLAGS(${CLIENT_SOURCES} COMPILE_FLAGS "-fPIC")
 +ENDIF()
 +
  #
  # Include protocol tracing infrastructure and the test
  # trace plugin if enabled by build options.
-@@ -270,8 +275,15 @@ IF(WIN32)
+@@ -271,8 +276,15 @@ IF(WIN32)
    LIST(APPEND LIBS_TO_MERGE auth_win_client)
  ENDIF()
  
 -# LDAP authentication SASL client plug-in
 -ADD_SUBDIRECTORY(authentication_ldap)
 +IF(WITHOUT_CLIENTLIBS)
 +  # Merge several convenience libraries into one big mysqlclient
 +  MERGE_CONVENIENCE_LIBRARIES(mysqlclient ${LIBS_TO_MERGE}
 +  COMPONENT Development
 +  SKIP_INSTALL)
 +ELSE(WITHOUT_CLIENTLIBS)
 +  # LDAP authentication SASL client plugin
 +  MESSAGE(STATUS "Creating LDAP authentication SASL client library.")
 +  ADD_SUBDIRECTORY(authentication_ldap)
  
- # authentication kerberos client plug-in
- ADD_SUBDIRECTORY(authentication_kerberos)
-@@ -281,6 +293,7 @@ MERGE_CONVENIENCE_LIBRARIES(mysqlclient ${LIBS_TO_MERG
+ # FIDO authentication client plugin
+ ADD_SUBDIRECTORY(authentication_fido)
+@@ -288,6 +300,7 @@ MERGE_CONVENIENCE_LIBRARIES(mysqlclient ${LIBS_TO_MERG
    COMPONENT Development
    LINK_LIBRARIES ${LIBS_TO_LINK}
    )
 +ENDIF(WITHOUT_CLIENTLIBS)
  
  # Visual Studio users need debug  static library for debug projects
  IF(MSVC)
-@@ -327,17 +340,27 @@ ENDIF()
+@@ -334,17 +347,27 @@ ENDIF()
  
  # Merge several convenience libraries into one big mysqlclient
  # and link them together into shared library.
 +IF(WITHOUT_CLIENTLIBS)
  MERGE_LIBRARIES_SHARED(libmysql ${LIBS_TO_MERGE}
    EXPORTS
    ${CLIENT_API_FUNCTIONS}
    ${CLIENT_API_FUNCTIONS_UNDOCUMENTED}
    ${CLIENT_API_NONBLOCKING_FUNCTIONS}
    COMPONENT SharedLibraries
 +  SKIP_INSTALL )
 +ELSE(WITHOUT_CLIENTLIBS)
 +MERGE_LIBRARIES_SHARED(libmysql ${LIBS_TO_MERGE}
 +  EXPORTS
 +  ${CLIENT_API_FUNCTIONS}
 +  ${CLIENT_API_FUNCTIONS_UNDOCUMENTED}
 +  ${CLIENT_API_NONBLOCKING_FUNCTIONS}
 +  COMPONENT SharedLibraries
    LINK_LIBRARIES ${LIBS_TO_LINK}
    ${UNIX_OUTPUT_NAME}
    ${UNIX_SOVERSION}
    ${UNIX_VERSION}
    )
 +ENDIF(WITHOUT_CLIENTLIBS)
  
- IF(LINUX_STANDALONE AND KERBEROS_CUSTOM_LIBRARY)
-   ADD_DEPENDENCIES(libmysql ${kerberos_target})
+ # Downgrade warning for strncat in my_crypt_genhash.
+ IF((WITH_LTO OR CMAKE_COMPILER_FLAG_WITH_LTO) AND MY_COMPILER_IS_GNU)
diff --git a/databases/mysql80-server/files/patch-libservices_CMakeLists.txt b/databases/mysql80-server/files/patch-libservices_CMakeLists.txt
index 1fa50bdd2bca..95610f261f3a 100644
--- a/databases/mysql80-server/files/patch-libservices_CMakeLists.txt
+++ b/databases/mysql80-server/files/patch-libservices_CMakeLists.txt
@@ -1,12 +1,12 @@
---- libservices/CMakeLists.txt.orig	2019-09-20 08:30:51 UTC
+--- libservices/CMakeLists.txt.orig	2021-12-17 16:07:27 UTC
 +++ libservices/CMakeLists.txt
-@@ -45,7 +45,9 @@ SET(MYSQLSERVICES_SOURCES
+@@ -47,7 +47,9 @@ SET(MYSQLSERVICES_SOURCES
    plugin_registry_service.c)
  
  ADD_LIBRARY(mysqlservices STATIC ${MYSQLSERVICES_SOURCES})
 +IF(FALSE)
  IF(INSTALL_STATIC_LIBRARIES)
    INSTALL(TARGETS mysqlservices
      DESTINATION ${INSTALL_LIBDIR} COMPONENT Development)
 +ENDIF()
  ENDIF()
diff --git a/databases/mysql80-server/files/patch-man_CMakeLists.txt b/databases/mysql80-server/files/patch-man_CMakeLists.txt
index a08c4ce564c0..9c95ebf65a2b 100644
--- a/databases/mysql80-server/files/patch-man_CMakeLists.txt
+++ b/databases/mysql80-server/files/patch-man_CMakeLists.txt
@@ -1,76 +1,76 @@
---- man/CMakeLists.txt.orig	2020-10-20 11:47:42.675974000 +0200
-+++ man/CMakeLists.txt	2020-10-20 13:53:03.993879000 +0200
+--- man/CMakeLists.txt.orig	2021-12-17 16:07:27 UTC
++++ man/CMakeLists.txt
 @@ -23,26 +23,14 @@
  # Copy man pages
  SET(MAN1
    comp_err.1
 -  ibd2sdi.1
 -  innochecksum.1
    lz4_decompress.1
 -  my_print_defaults.1
 -  myisam_ftdump.1
 -  myisamchk.1
 -  myisamlog.1
 -  myisampack.1
    mysql.1
    mysql_config.1
    mysql_config_editor.1
 -  mysql_secure_installation.1
 -  mysql_ssl_rsa_setup.1
 -  mysql_tzinfo_to_sql.1
 -  mysql_upgrade.1
    mysqladmin.1
    mysqlbinlog.1
    mysqlcheck.1
    mysqldump.1
 -  mysqldumpslow.1
    mysqlimport.1
    mysqlman.1
    mysqlpump.1
-@@ -52,13 +41,23 @@ SET(MAN1
+@@ -52,13 +40,23 @@ SET(MAN1
    zlib_decompress.1
    )
  
 -IF(NOT WITH_SYSTEMD)
 -  LIST(APPEND MAN1
 -    mysql.server.1
 -    mysqld_multi.1
 -    mysqld_safe.1
 +SET(MAN1_TOOLS
 +  ibd2sdi.1
 +  innochecksum.1
 +  my_print_defaults.1
 +  myisam_ftdump.1
 +  myisamchk.1
 +  myisamlog.1
 +  myisampack.1
 +  mysql.server.1
 +  mysql_secure_installation.1
 +  mysql_ssl_rsa_setup.1
 +  mysql_tzinfo_to_sql.1
 +  mysql_upgrade.1
 +  mysqldumpslow.1
 +  mysqld_multi.1
 +  mysqld_safe.1
    )
 -ENDIF()
  
  SET(MAN1_NDB
-   ndb-common-options.1
-@@ -105,8 +104,14 @@ SET(MAN8_NDB
+   ndb_blob_tool.1
+@@ -103,8 +101,14 @@ SET(MAN8_NDB
    ndbmtd.8
  )
  
 -INSTALL(FILES ${MAN1} DESTINATION ${INSTALL_MANDIR}/man1 COMPONENT ManPages)
 -INSTALL(FILES ${MAN8} DESTINATION ${INSTALL_MANDIR}/man8 COMPONENT ManPages)
 +IF(NOT WITHOUT_CLIENTLIBS)
 +    INSTALL(FILES ${MAN1} DESTINATION ${INSTALL_MANDIR}/man1 COMPONENT ManPages)
 +ENDIF()
 +
 +IF(NOT WITHOUT_SERVER)
 +    INSTALL(FILES ${MAN1_TOOLS} DESTINATION ${INSTALL_MANDIR}/man1 COMPONENT ManPages)
 +    INSTALL(FILES ${MAN8} DESTINATION ${INSTALL_MANDIR}/man8 COMPONENT ManPages)
 +ENDIF()
  
  IF(WITH_ROUTER)
    INSTALL(FILES ${MAN1_ROUTER}
diff --git a/databases/mysql80-server/files/patch-mysys_my__default.cc b/databases/mysql80-server/files/patch-mysys_my__default.cc
index 6e479597e24a..87b603301f41 100644
--- a/databases/mysql80-server/files/patch-mysys_my__default.cc
+++ b/databases/mysql80-server/files/patch-mysys_my__default.cc
@@ -1,62 +1,62 @@
---- mysys/my_default.cc.orig	2021-11-02 20:29:18.337621000 +0100
-+++ mysys/my_default.cc	2021-11-02 20:57:11.624299000 +0100
+--- mysys/my_default.cc.orig	2021-12-17 16:07:27 UTC
++++ mysys/my_default.cc
 @@ -204,7 +204,7 @@ bool no_defaults = false;
  
  /* Which directories are searched for options (and in which order) */
  
 -#define MAX_DEFAULT_DIRS 6
 +#define MAX_DEFAULT_DIRS 7
  #define DEFAULT_DIRS_SIZE (MAX_DEFAULT_DIRS + 1) /* Terminate with NULL */
  static const char **default_directories = nullptr;
  
 @@ -922,6 +922,14 @@ static int search_default_file_with_ext(Process_option
        return 1; /* Ignore wrong files */
    }
  
 +  if (strstr(name, "/etc") == name)
 +  {
 +    fprintf(stderr,
 +             "error: Config file %s in invalid location, please move to or merge with /usr/local%s\n",
 +	     name,name);
 +      goto err;
 +  }
 +
    while (true) {
      auto fileline = mysql_file_getline(buff, sizeof(buff), fp, is_login_file);
      char *linebuff = fileline.get();
-@@ -1315,7 +1323,8 @@ void my_print_default_files(const char *conf_file) {
+@@ -1311,7 +1319,8 @@ void my_print_default_files(const char *conf_file) {
              end[(strlen(end) - 1)] = ' ';
            else
              strxmov(end, conf_file, *ext, " ", NullS);
 -          fputs(name, stdout);
 +	  if (strstr(name, "/etc") != name)
 +		  fputs(name, stdout);
          }
        }
      }
-@@ -1655,14 +1664,9 @@ static const char **init_default_directories(MEM_ROOT 
+@@ -1651,14 +1660,9 @@ static const char **init_default_directories(MEM_ROOT 
  
  #else
  
 -  errors += add_directory(alloc, "/etc/", dirs);
 -  errors += add_directory(alloc, "/etc/mysql/", dirs);
 +  errors += add_directory(alloc, "/usr/local/etc/", dirs);
 +  errors += add_directory(alloc, "/usr/local/etc/mysql/", dirs);
  
 -#if defined(DEFAULT_SYSCONFDIR)
 -  if (DEFAULT_SYSCONFDIR[0])
 -    errors += add_directory(alloc, DEFAULT_SYSCONFDIR, dirs);
 -#endif /* DEFAULT_SYSCONFDIR */
 -
  #endif
  
    if ((env = getenv("MYSQL_HOME"))) errors += add_directory(alloc, env, dirs);
-@@ -1727,7 +1731,7 @@ int check_file_permissions(const char *file_name, bool
+@@ -1723,7 +1727,7 @@ int check_file_permissions(const char *file_name, bool
  #if !defined(_WIN32)
    MY_STAT stat_info;
  
 -  if (!my_stat(file_name, &stat_info, flags)) return 1;
 +  if (!my_stat(file_name, &stat_info, flags)) return 0;
    /*
      Ignore .mylogin.cnf file if not exclusively readable/writable
      by current user.
diff --git a/databases/mysql80-server/files/patch-plugin_x_CMakeLists.txt b/databases/mysql80-server/files/patch-plugin_x_CMakeLists.txt
index e3ee6f45bb06..58cb6a7922b1 100644
--- a/databases/mysql80-server/files/patch-plugin_x_CMakeLists.txt
+++ b/databases/mysql80-server/files/patch-plugin_x_CMakeLists.txt
@@ -1,11 +1,11 @@
---- plugin/x/CMakeLists.txt.orig	2019-09-20 08:30:51 UTC
+--- plugin/x/CMakeLists.txt.orig	2021-12-17 16:07:27 UTC
 +++ plugin/x/CMakeLists.txt
 @@ -77,6 +77,8 @@ INCLUDE_DIRECTORIES(
    ${MYSQLX_GENERATE_DIR}
    ${MYSQLX_PROTOCOL_INCLUDE_DIR}
    ${MYSQLX_CLIENT_INCLUDE_DIR}
 +  ${OPENSSL_INCLUDE_DIR}
 +  ${BOOST_INCLUDE_DIR}
  )
  
- MY_INCLUDE_SYSTEM_DIRECTORIES(PROTOBUF)
+ MY_INCLUDE_SYSTEM_DIRECTORIES(LIBEVENT)
diff --git a/databases/mysql80-server/files/patch-plugin_x_client_xconnection__impl.cc b/databases/mysql80-server/files/patch-plugin_x_client_xconnection__impl.cc
index df8f2bfd0942..ecd596100e6b 100644
--- a/databases/mysql80-server/files/patch-plugin_x_client_xconnection__impl.cc
+++ b/databases/mysql80-server/files/patch-plugin_x_client_xconnection__impl.cc
@@ -1,33 +1,33 @@
---- plugin/x/client/xconnection_impl.cc.orig	2019-09-20 08:30:51 UTC
+--- plugin/x/client/xconnection_impl.cc.orig	2021-12-17 16:07:27 UTC
 +++ plugin/x/client/xconnection_impl.cc
-@@ -520,6 +520,7 @@ XError Connection_impl::get_ssl_error(const int error_
+@@ -618,6 +618,7 @@ XError Connection_impl::get_ssl_error(const int error_
    return XError(CR_SSL_CONNECTION_ERROR, buffer);
  }
  
 +#ifndef LIBRESSL_VERSION_NUMBER
  /**
    Set fips mode in openssl library,
    When we set fips mode ON/STRICT, it will perform following operations:
-@@ -559,6 +560,7 @@ int set_fips_mode(const uint32_t fips_mode,
+@@ -657,6 +658,7 @@ int set_fips_mode(const uint32_t fips_mode,
  EXIT:
    return rc;
  }
 +#endif
  
  XError Connection_impl::activate_tls() {
    if (nullptr == m_vio) return get_socket_error(SOCKET_ECONNRESET);
-@@ -569,12 +571,14 @@ XError Connection_impl::activate_tls() {
+@@ -667,12 +669,14 @@ XError Connection_impl::activate_tls() {
    if (!m_context->m_ssl_config.is_configured())
      return XError{CR_SSL_CONNECTION_ERROR, ER_TEXT_TLS_NOT_CONFIGURATED, true};
  
 +#ifndef LIBRESSL_VERSION_NUMBER
    char err_string[OPENSSL_ERROR_LENGTH] = {'\0'};
    if (set_fips_mode(
            static_cast<uint32_t>(m_context->m_ssl_config.m_ssl_fips_mode),
            err_string) != 1) {
      return XError{CR_SSL_CONNECTION_ERROR, err_string, true};
    }
 +#endif
    auto ssl_ctx_flags = process_tls_version(
        details::null_when_empty(m_context->m_ssl_config.m_tls_version));
  
diff --git a/databases/mysql80-server/files/patch-router_src_harness_src_CMakeLists.txt b/databases/mysql80-server/files/patch-router_src_harness_src_CMakeLists.txt
index 74d19b39f2d3..65fe02456eec 100644
--- a/databases/mysql80-server/files/patch-router_src_harness_src_CMakeLists.txt
+++ b/databases/mysql80-server/files/patch-router_src_harness_src_CMakeLists.txt
@@ -1,24 +1,24 @@
---- router/src/harness/src/CMakeLists.txt.orig	2019-12-09 19:53:17 UTC
+--- router/src/harness/src/CMakeLists.txt.orig	2021-12-17 16:07:27 UTC
 +++ router/src/harness/src/CMakeLists.txt
-@@ -205,7 +205,6 @@ IF(NOT WIN32)
+@@ -212,7 +212,6 @@ ELSE()
    INSTALL(TARGETS harness-library
      LIBRARY
      DESTINATION ${ROUTER_INSTALL_LIBDIR} COMPONENT Router
 -    NAMELINK_SKIP
      )
- ELSE()
-   INSTALL(TARGETS harness-library
-@@ -240,7 +239,6 @@ INSTALL(TARGETS harness_stdx
+ ENDIF()
+ 
+@@ -243,7 +242,6 @@ INSTALL(TARGETS harness_stdx
    RUNTIME DESTINATION ${ROUTER_INSTALL_BINDIR} COMPONENT Router
    ARCHIVE DESTINATION ${ROUTER_INSTALL_LIBDIR} COMPONENT Router
    LIBRARY DESTINATION ${ROUTER_INSTALL_LIBDIR} COMPONENT Router
 -  NAMELINK_SKIP
    )
  
  ## harness_tls
-@@ -277,5 +275,4 @@ INSTALL(TARGETS harness_tls
+@@ -284,5 +282,4 @@ INSTALL(TARGETS harness_tls
    RUNTIME DESTINATION ${ROUTER_INSTALL_BINDIR} COMPONENT Router
    ARCHIVE DESTINATION ${ROUTER_INSTALL_LIBDIR} COMPONENT Router
    LIBRARY DESTINATION ${ROUTER_INSTALL_LIBDIR} COMPONENT Router
 -  NAMELINK_SKIP
    )
diff --git a/databases/mysql80-server/files/patch-router_src_harness_src_tls__client__context.cc b/databases/mysql80-server/files/patch-router_src_harness_src_tls__client__context.cc
index 3c9c3d70b23f..d4a5ef543b49 100644
--- a/databases/mysql80-server/files/patch-router_src_harness_src_tls__client__context.cc
+++ b/databases/mysql80-server/files/patch-router_src_harness_src_tls__client__context.cc
@@ -1,11 +1,11 @@
---- router/src/harness/src/tls_client_context.cc.orig	2019-09-20 08:30:51 UTC
+--- router/src/harness/src/tls_client_context.cc.orig	2021-12-17 16:07:27 UTC
 +++ router/src/harness/src/tls_client_context.cc
-@@ -54,7 +54,7 @@ void TlsClientContext::verify(TlsVerify verify) {
- 
- void TlsClientContext::cipher_suites(const std::string &ciphers) {
+@@ -61,7 +61,7 @@ stdx::expected<void, std::error_code> TlsClientContext
+ stdx::expected<void, std::error_code> TlsClientContext::cipher_suites(
+     const std::string &ciphers) {
  // TLSv1.3 ciphers are controlled via SSL_CTX_set_ciphersuites()
 -#if OPENSSL_VERSION_NUMBER >= ROUTER_OPENSSL_VERSION(1, 1, 1)
 +#ifdef TLS1_3_VERSION
    if (1 != SSL_CTX_set_ciphersuites(ssl_ctx_.get(), ciphers.c_str())) {
-     throw TlsError("set-cipher-suites");
+     return stdx::make_unexpected(make_tls_error());
    }
diff --git a/databases/mysql80-server/files/patch-router_src_harness_src_tls__context.cc b/databases/mysql80-server/files/patch-router_src_harness_src_tls__context.cc
index 2d5ba1470260..b1d818afe81a 100644
--- a/databases/mysql80-server/files/patch-router_src_harness_src_tls__context.cc
+++ b/databases/mysql80-server/files/patch-router_src_harness_src_tls__context.cc
@@ -1,44 +1,44 @@
---- router/src/harness/src/tls_context.cc.orig	2021-11-04 17:14:44.779135000 +0100
-+++ router/src/harness/src/tls_context.cc	2021-11-04 17:35:31.121070000 +0100
+--- router/src/harness/src/tls_context.cc.orig	2021-12-17 16:07:27 UTC
++++ router/src/harness/src/tls_context.cc
 @@ -241,7 +241,7 @@ static int o11x_version(TlsVersion version) {
        return TLS1_1_VERSION;
      case TlsVersion::TLS_1_2:
        return TLS1_2_VERSION;
 -#if OPENSSL_VERSION_NUMBER >= ROUTER_OPENSSL_VERSION(1, 1, 1)
 +#ifdef TLS1_3_VERSION
      case TlsVersion::TLS_1_3:
        return TLS1_3_VERSION;
  #endif
 @@ -272,9 +272,11 @@ stdx::expected<void, std::error_code> TlsContext::vers
      default:
        // unknown, leave all disabled
        [[fallthrough]];
 +#ifdef TLS1_3_VERSION
      case TlsVersion::TLS_1_3:
        opts |= SSL_OP_NO_TLSv1_2;
        [[fallthrough]];
 +#endif
      case TlsVersion::TLS_1_2:
        opts |= SSL_OP_NO_TLSv1_1;
        [[fallthrough]];
 @@ -322,8 +324,10 @@ TlsVersion TlsContext::min_version() const {
        return TlsVersion::TLS_1_1;
      case TLS1_2_VERSION:
        return TlsVersion::TLS_1_2;
 +#ifdef TLS1_3_VERSION
      case TLS1_3_VERSION:
        return TlsVersion::TLS_1_3;
 +#endif
      case 0:
        return TlsVersion::AUTO;
      default:
 @@ -382,7 +386,8 @@ TlsContext::InfoCallback TlsContext::info_callback() c
  }
  
  int TlsContext::security_level() const {
 -#if OPENSSL_VERSION_NUMBER >= ROUTER_OPENSSL_VERSION(1, 1, 0)
 +#if OPENSSL_VERSION_NUMBER >= ROUTER_OPENSSL_VERSION(1, 1, 0) && \
 +    !defined(LIBRESSL_VERSION_NUMBER)
    return SSL_CTX_get_security_level(ssl_ctx_.get());
  #else
    return 0;
diff --git a/databases/mysql80-server/files/patch-router_src_harness_src_tls__server__context.cc b/databases/mysql80-server/files/patch-router_src_harness_src_tls__server__context.cc
index ac19ffd0c661..e7498ecbfb8a 100644
--- a/databases/mysql80-server/files/patch-router_src_harness_src_tls__server__context.cc
+++ b/databases/mysql80-server/files/patch-router_src_harness_src_tls__server__context.cc
@@ -1,12 +1,12 @@
---- router/src/harness/src/tls_server_context.cc.orig	2019-09-20 08:30:51 UTC
+--- router/src/harness/src/tls_server_context.cc.orig	2021-12-17 16:07:27 UTC
 +++ router/src/harness/src/tls_server_context.cc
-@@ -166,7 +166,8 @@ void TlsServerContext::init_tmp_dh(const std::string &
+@@ -169,7 +169,8 @@ stdx::expected<void, std::error_code> TlsServerContext
      }
  
    } else {
 -#if OPENSSL_VERSION_NUMBER >= ROUTER_OPENSSL_VERSION(1, 1, 0)
 +#if OPENSSL_VERSION_NUMBER >= ROUTER_OPENSSL_VERSION(1, 1, 0) && \
 +    !defined(LIBRESSL_VERSION_NUMBER)
      dh2048.reset(DH_get_2048_256());
  #else
      /*
diff --git a/databases/mysql80-server/files/patch-router_src_http_src_CMakeLists.txt b/databases/mysql80-server/files/patch-router_src_http_src_CMakeLists.txt
index cea2271c20d1..d6d71414449d 100644
--- a/databases/mysql80-server/files/patch-router_src_http_src_CMakeLists.txt
+++ b/databases/mysql80-server/files/patch-router_src_http_src_CMakeLists.txt
@@ -1,26 +1,26 @@
---- router/src/http/src/CMakeLists.txt.orig	2019-12-09 19:53:17 UTC
+--- router/src/http/src/CMakeLists.txt.orig	2021-12-17 16:07:27 UTC
 +++ router/src/http/src/CMakeLists.txt
-@@ -62,7 +62,6 @@ INSTALL(TARGETS http_common
+@@ -58,7 +58,6 @@ INSTALL(TARGETS http_common
    RUNTIME DESTINATION ${ROUTER_INSTALL_BINDIR} COMPONENT Router
    ARCHIVE DESTINATION ${ROUTER_INSTALL_LIBDIR} COMPONENT Router
    LIBRARY DESTINATION ${ROUTER_INSTALL_LIBDIR} COMPONENT Router
 -  NAMELINK_SKIP
    )
  
  ## split library code from the plugin to use them _passwd and tests
-@@ -88,7 +87,6 @@ INSTALL(TARGETS http_auth_backend_lib
+@@ -84,7 +83,6 @@ INSTALL(TARGETS http_auth_backend_lib
    RUNTIME DESTINATION ${ROUTER_INSTALL_BINDIR} COMPONENT Router
    ARCHIVE DESTINATION ${ROUTER_INSTALL_LIBDIR} COMPONENT Router
    LIBRARY DESTINATION ${ROUTER_INSTALL_LIBDIR} COMPONENT Router
 -  NAMELINK_SKIP
    )
  TARGET_INCLUDE_DIRECTORIES(http_auth_backend_lib PUBLIC
    ${CMAKE_CURRENT_SOURCE_DIR}
-@@ -141,7 +139,6 @@ INSTALL(TARGETS http_auth_realm_lib
+@@ -137,7 +135,6 @@ INSTALL(TARGETS http_auth_realm_lib
    RUNTIME DESTINATION ${ROUTER_INSTALL_BINDIR} COMPONENT Router
    ARCHIVE DESTINATION ${ROUTER_INSTALL_LIBDIR} COMPONENT Router
    LIBRARY DESTINATION ${ROUTER_INSTALL_LIBDIR} COMPONENT Router
 -  NAMELINK_SKIP
    )
  ## the rpath for the bundled openssl
  ADD_INSTALL_RPATH_FOR_OPENSSL(http_auth_realm_lib)
diff --git a/databases/mysql80-server/files/patch-router_src_router_src_CMakeLists.txt b/databases/mysql80-server/files/patch-router_src_router_src_CMakeLists.txt
index cee2af2e2f73..ae48964a591e 100644
--- a/databases/mysql80-server/files/patch-router_src_router_src_CMakeLists.txt
+++ b/databases/mysql80-server/files/patch-router_src_router_src_CMakeLists.txt
@@ -1,10 +1,10 @@
---- router/src/router/src/CMakeLists.txt.orig	2019-12-09 19:53:17 UTC
+--- router/src/router/src/CMakeLists.txt.orig	2021-12-17 16:07:27 UTC
 +++ router/src/router/src/CMakeLists.txt
-@@ -119,7 +119,6 @@ INSTALL(TARGETS router_lib
+@@ -124,7 +124,6 @@ INSTALL(TARGETS router_lib
    RUNTIME DESTINATION ${ROUTER_INSTALL_BINDIR} COMPONENT Router
    ARCHIVE DESTINATION ${ROUTER_INSTALL_LIBDIR} COMPONENT Router
    LIBRARY DESTINATION ${ROUTER_INSTALL_LIBDIR} COMPONENT Router
 -  NAMELINK_SKIP
    )
  
  MYSQL_ADD_EXECUTABLE(mysqlrouter_keyring
diff --git a/databases/mysql80-server/files/patch-scripts_CMakeLists.txt b/databases/mysql80-server/files/patch-scripts_CMakeLists.txt
index 976c2397e16d..74acb1291d88 100644
--- a/databases/mysql80-server/files/patch-scripts_CMakeLists.txt
+++ b/databases/mysql80-server/files/patch-scripts_CMakeLists.txt
@@ -1,52 +1,52 @@
---- scripts/CMakeLists.txt.orig	2021-11-04 17:42:29.686664000 +0100
-+++ scripts/CMakeLists.txt	2021-11-04 17:57:49.957200000 +0100
+--- scripts/CMakeLists.txt.orig	2021-12-17 16:07:27 UTC
++++ scripts/CMakeLists.txt
 @@ -323,6 +323,8 @@ MACRO(EXTRACT_LINK_LIBRARIES target var)
          GET_FILENAME_COMPONENT(lib "${lib}" NAME_WE)
          STRING(REGEX REPLACE "^lib" "" lib "${lib}")
          SET(${var} "${${var}}-l${lib} " )
 +        ELSEIF(lib STREQUAL "-pthread")
 +          SET(${var} "${${var}}-pthread " )
        ELSE()
          SET(${var} "${${var}}-l${lib} " )
        ENDIF()
 @@ -396,7 +398,7 @@ ELSE()
      ${CMAKE_CURRENT_BINARY_DIR}/${PKGCONFIG_FILE}
      ESCAPE_QUOTES @ONLY)
  
 -  IF(INSTALL_PKGCONFIGDIR)
 +  IF(INSTALL_PKGCONFIGDIR AND NOT WITHOUT_CLIENTLIBS)
      MESSAGE(STATUS "INSTALL ${PKGCONFIG_FILE} ${INSTALL_PKGCONFIGDIR}")
      INSTALL(FILES
        ${CMAKE_CURRENT_BINARY_DIR}/${PKGCONFIG_FILE}
 @@ -409,23 +411,28 @@ ELSE()
    # mysqld_safe used in mtr even for systemd platforms
    IF(WITH_SYSTEMD)
      SET(BIN_SCRIPTS
 -      mysql_config
        mysqldumpslow
        mysqld_safe
        )
    ELSE()
      SET(BIN_SCRIPTS
 -      mysql_config
        mysqldumpslow
        mysqld_multi
        mysqld_safe
        )
    ENDIF()
  
 +  IF(NOT WITHOUT_CLIENTLIBS)
 +    SET(BIN_SCRIPTS
 +      ${BIN_SCRIPTS}
 +      mysql_config
 +    )
 +  ENDIF(NOT WITHOUT_CLIENTLIBS)
 +
    FOREACH(file ${BIN_SCRIPTS})
      IF(EXISTS ${CMAKE_CURRENT_SOURCE_DIR}/${file}.sh)
        CONFIGURE_FILE(${CMAKE_CURRENT_SOURCE_DIR}/${file}.sh
 -        ${CMAKE_CURRENT_BINARY_DIR}/${file} ESCAPE_QUOTES @ONLY
 +        ${CMAKE_CURRENT_BINARY_DIR}/${file} @ONLY
          )
      ELSEIF(EXISTS ${CMAKE_CURRENT_SOURCE_DIR}/${file}.pl.in)
        CONFIGURE_FILE(${CMAKE_CURRENT_SOURCE_DIR}/${file}.pl.in
diff --git a/databases/mysql80-server/files/patch-scripts_mysqld__safe.txt b/databases/mysql80-server/files/patch-scripts_mysqld__safe.sh
similarity index 84%
rename from databases/mysql80-server/files/patch-scripts_mysqld__safe.txt
rename to databases/mysql80-server/files/patch-scripts_mysqld__safe.sh
index 7da369b97b60..47bc81e3963b 100644
--- a/databases/mysql80-server/files/patch-scripts_mysqld__safe.txt
+++ b/databases/mysql80-server/files/patch-scripts_mysqld__safe.sh
@@ -1,19 +1,19 @@
---- scripts/mysqld_safe.sh.orig	2022-01-07 11:33:53.643546000 +0100
-+++ scripts/mysqld_safe.sh	2022-01-07 11:37:41.505101000 +0100
+--- scripts/mysqld_safe.sh.orig	2022-01-23 11:48:36 UTC
++++ scripts/mysqld_safe.sh
 @@ -360,7 +360,7 @@ mysqld_ld_preload_text() {
  # running mysqld.  See ld.so for details.
  set_malloc_lib() {
    # This list is kept intentionally simple.
 -  malloc_dirs="/usr/lib /usr/lib64 /usr/lib/i386-linux-gnu /usr/lib/x86_64-linux-gnu"
 +  malloc_dirs="/usr/lib /usr/lib64 /usr/lib/i386-linux-gnu /usr/lib/x86_64-linux-gnu /usr/local/lib"
    malloc_lib="$1"
  
    # Allow --malloc-lib='' to override other settings
 @@ -379,6 +379,7 @@ set_malloc_lib() {
          /usr/lib64) ;;
          /usr/lib/i386-linux-gnu) ;;
          /usr/lib/x86_64-linux-gnu) ;;
 +	/usr/local/lib) ;;
          *)
            log_error "--malloc-lib must be located in one of the directories: $malloc_dirs"
            exit 1
diff --git a/databases/mysql80-server/files/patch-sql-common_client.cc b/databases/mysql80-server/files/patch-sql-common_client.cc
index acf9035fb33c..b01beea3686b 100644
--- a/databases/mysql80-server/files/patch-sql-common_client.cc
+++ b/databases/mysql80-server/files/patch-sql-common_client.cc
@@ -1,18 +1,18 @@
---- sql-common/client.cc.orig	2020-03-26 13:31:45 UTC
+--- sql-common/client.cc.orig	2021-12-17 16:07:27 UTC
 +++ sql-common/client.cc
-@@ -7752,6 +7752,7 @@ int STDCALL mysql_options(MYSQL *mysql, enum mysql_opt
+@@ -8301,6 +8301,7 @@ int STDCALL mysql_options(MYSQL *mysql, enum mysql_opt
          return 1;
        break;
      case MYSQL_OPT_SSL_FIPS_MODE: {
 +#if !defined(LIBRESSL_VERSION_NUMBER)
        char ssl_err_string[OPENSSL_ERROR_LENGTH] = {'\0'};
        ENSURE_EXTENSIONS_PRESENT(&mysql->options);
-       mysql->options.extension->ssl_fips_mode = *static_cast<const uint *>(arg);
-@@ -7763,6 +7764,7 @@ int STDCALL mysql_options(MYSQL *mysql, enum mysql_opt
+       mysql->options.extension->ssl_fips_mode =
+@@ -8313,6 +8314,7 @@ int STDCALL mysql_options(MYSQL *mysql, enum mysql_opt
              "Set Fips mode ON/STRICT failed, detail: '%s'.", ssl_err_string);
          return 1;
        }
 +#endif
      } break;
      case MYSQL_OPT_SSL_MODE:
        ENSURE_EXTENSIONS_PRESENT(&mysql->options);
diff --git a/databases/mysql80-server/files/patch-sql_conn__handler_socket__connection.cc b/databases/mysql80-server/files/patch-sql_conn__handler_socket__connection.cc
index edcba63dec28..8f5d99aa45b4 100644
--- a/databases/mysql80-server/files/patch-sql_conn__handler_socket__connection.cc
+++ b/databases/mysql80-server/files/patch-sql_conn__handler_socket__connection.cc
@@ -1,32 +1,32 @@
---- sql/conn_handler/socket_connection.cc.orig	2019-09-20 08:30:51 UTC
+--- sql/conn_handler/socket_connection.cc.orig	2021-12-17 16:07:27 UTC
 +++ sql/conn_handler/socket_connection.cc
-@@ -950,9 +950,11 @@ bool check_connection_refused_by_tcp_wrapper(MYSQL_SOC
+@@ -953,9 +953,11 @@ bool check_connection_refused_by_tcp_wrapper(MYSQL_SOC
    signal(SIGCHLD, SIG_DFL);
    request_init(&req, RQ_DAEMON, libwrap_name, RQ_FILE,
                 mysql_socket_getfd(connect_sock), NULL);
 -  fromhost(&req);
 +  void (*my_fromhost) (void *) = (void (*)(void *)) fromhost;
 +  my_fromhost(&req);
  
 -  if (!hosts_access(&req)) {
 +  int (*my_hosts_access) (void *) = (int (*) (void *)) hosts_access;
 +  if (!my_hosts_access(&req)) {
      /*
        This may be stupid but refuse() includes an exit(0)
        which we surely don't want...
-@@ -964,12 +966,13 @@ bool check_connection_refused_by_tcp_wrapper(MYSQL_SOC
+@@ -967,12 +969,13 @@ bool check_connection_refused_by_tcp_wrapper(MYSQL_SOC
        This is unproblematic as TCP-wrapper is unix specific,
        anyway.
      */
 +    char *(*my_eval_client) (void *) = (char *(*) (void *)) eval_client;
      syslog(LOG_AUTH | LOG_WARNING, "refused connect from %s",
 -           eval_client(&req));
 +           my_eval_client(&req));
  
  #ifdef HAVE_LIBWRAP_PROTOTYPES
      // Some distros have patched tcpd.h to have proper prototypes
 -    if (req.sink) (req.sink)(req.fd);
 +    if (req.sink) ((void (*)(int)) (req.sink))(req.fd);
  #else
      // Some distros have not patched tcpd.h
      if (req.sink) ((void (*)(int))req.sink)(req.fd);
diff --git a/databases/mysql80-server/files/patch-sql_mysqld.cc b/databases/mysql80-server/files/patch-sql_mysqld.cc
index 39a7fb89844a..a8eccb94f647 100644
--- a/databases/mysql80-server/files/patch-sql_mysqld.cc
+++ b/databases/mysql80-server/files/patch-sql_mysqld.cc
@@ -1,26 +1,26 @@
---- sql/mysqld.cc.orig	2019-09-20 08:30:51 UTC
+--- sql/mysqld.cc.orig	2021-12-17 16:07:27 UTC
 +++ sql/mysqld.cc
-@@ -5109,7 +5109,7 @@ static int init_thread_environment() {
+@@ -5285,7 +5285,7 @@ static int init_thread_environment() {
  
  static PSI_memory_key key_memory_openssl = PSI_NOT_INSTRUMENTED;
  
 -#if OPENSSL_VERSION_NUMBER < 0x10100000L
 +#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
  #define FILE_LINE_ARGS
  #else
  #define FILE_LINE_ARGS , const char *, int
-@@ -5143,12 +5143,14 @@ static void init_ssl() {
+@@ -5316,12 +5316,14 @@ static void init_ssl() {
  }
  
  static int init_ssl_communication() {
 +#ifndef LIBRESSL_VERSION_NUMBER
    char ssl_err_string[OPENSSL_ERROR_LENGTH] = {'\0'};
    int ret_fips_mode = set_fips_mode(opt_ssl_fips_mode, ssl_err_string);
    if (ret_fips_mode != 1) {
      LogErr(ERROR_LEVEL, ER_SSL_FIPS_MODE_ERROR, ssl_err_string);
      return 1;
    }
 +#endif /* LIBRESSL_VERSION_NUMBER */
    if (TLS_channel::singleton_init(&mysql_main, mysql_main_channel, opt_use_ssl,
                                    &server_main_callback, opt_initialize))
      return 1;
diff --git a/databases/mysql80-server/files/patch-sql_ssl__init__callback.cc b/databases/mysql80-server/files/patch-sql_ssl__init__callback.cc
new file mode 100644
index 000000000000..33f3d0645524
--- /dev/null
+++ b/databases/mysql80-server/files/patch-sql_ssl__init__callback.cc
@@ -0,0 +1,36 @@
+--- sql/ssl_init_callback.cc.orig	2021-12-17 16:07:27 UTC
++++ sql/ssl_init_callback.cc
+@@ -106,14 +106,14 @@ static Sys_var_charptr Sys_ssl_capath(
+ 
+ static Sys_var_charptr Sys_tls_version(
+     "tls_version",
+-#ifdef HAVE_TLSv13
++#if defined(HAVE_TLSv13) && !defined(LIBRESSL_VERSION_NUMBER)
+     "TLS version, permitted values are TLSv1.2, TLSv1.3",
+ #else
+     "TLS version, permitted values are TLSv1.2",
+ #endif
+     PERSIST_AS_READONLY GLOBAL_VAR(opt_tls_version),
+     CMD_LINE(REQUIRED_ARG, OPT_TLS_VERSION), IN_FS_CHARSET,
+-#ifdef HAVE_TLSv13
++#if defined(HAVE_TLSv13) && !defined(LIBRESSL_VERSION_NUMBER)
+     "TLSv1.2,TLSv1.3",
+ #else
+     "TLSv1.2",
+@@ -175,14 +175,14 @@ static Sys_var_charptr Sys_admin_ssl_capath(
+ 
+ static Sys_var_charptr Sys_admin_tls_version(
+     "admin_tls_version",
+-#ifdef HAVE_TLSv13
++#if defined(HAVE_TLSv13) && !defined(LIBRESSL_VERSION_NUMBER)
+     "TLS version for --admin-port, permitted values are TLSv1.2, TLSv1.3",
+ #else
+     "TLS version for --admin-port, permitted values are TLSv1.2",
+ #endif
+     PERSIST_AS_READONLY GLOBAL_VAR(opt_admin_tls_version),
+     CMD_LINE(REQUIRED_ARG, OPT_TLS_VERSION), IN_FS_CHARSET,
+-#ifdef HAVE_TLSv13
++#if defined(HAVE_TLSv13) && !defined(LIBRESSL_VERSION_NUMBER)
+     "TLSv1.2,TLSv1.3",
+ #else
+     "TLSv1.2",
diff --git a/databases/mysql80-server/files/patch-sql_sys__vars.cc b/databases/mysql80-server/files/patch-sql_sys__vars.cc
index 9c12715fd6df..3bee6a98fbad 100644
--- a/databases/mysql80-server/files/patch-sql_sys__vars.cc
+++ b/databases/mysql80-server/files/patch-sql_sys__vars.cc
@@ -1,70 +1,70 @@
---- sql/sys_vars.cc.orig	2019-09-20 08:30:51 UTC
+--- sql/sys_vars.cc.orig	2021-12-17 16:07:27 UTC
 +++ sql/sys_vars.cc
-@@ -1875,7 +1875,7 @@ static Sys_var_ulong Sys_connect_timeout(
+@@ -1977,7 +1977,7 @@ static Sys_var_ulong Sys_connect_timeout(
      "The number of seconds the mysqld server is waiting for a connect "
      "packet before responding with 'Bad handshake'",
      GLOBAL_VAR(connect_timeout), CMD_LINE(REQUIRED_ARG),
 -    VALID_RANGE(2, LONG_TIMEOUT), DEFAULT(CONNECT_TIMEOUT), BLOCK_SIZE(1));
 +    VALID_RANGE(2, INT_MAX32 / 1000), DEFAULT(CONNECT_TIMEOUT), BLOCK_SIZE(1));
  
  static Sys_var_ulong Sys_information_schema_stats_expiry(
      "information_schema_stats_expiry",
-@@ -2929,7 +2929,7 @@ static Sys_var_ulong Sys_net_read_timeout(
+@@ -3093,7 +3093,7 @@ static Sys_var_ulong Sys_net_read_timeout(
      "Number of seconds to wait for more data from a connection before "
      "aborting the read",
      SESSION_VAR(net_read_timeout), CMD_LINE(REQUIRED_ARG),
 -    VALID_RANGE(1, LONG_TIMEOUT), DEFAULT(NET_READ_TIMEOUT), BLOCK_SIZE(1),
 +    VALID_RANGE(1, INT_MAX32 / 1000), DEFAULT(NET_READ_TIMEOUT), BLOCK_SIZE(1),
      NO_MUTEX_GUARD, NOT_IN_BINLOG, ON_CHECK(nullptr),
      ON_UPDATE(fix_net_read_timeout));
  
-@@ -2950,7 +2950,7 @@ static Sys_var_ulong Sys_net_write_timeout(
+@@ -3114,7 +3114,7 @@ static Sys_var_ulong Sys_net_write_timeout(
      "Number of seconds to wait for a block to be written to a connection "
      "before aborting the write",
      SESSION_VAR(net_write_timeout), CMD_LINE(REQUIRED_ARG),
 -    VALID_RANGE(1, LONG_TIMEOUT), DEFAULT(NET_WRITE_TIMEOUT), BLOCK_SIZE(1),
 +    VALID_RANGE(1, INT_MAX32 / 1000), DEFAULT(NET_WRITE_TIMEOUT), BLOCK_SIZE(1),
      NO_MUTEX_GUARD, NOT_IN_BINLOG, ON_CHECK(nullptr),
      ON_UPDATE(fix_net_write_timeout));
  
-@@ -4459,6 +4459,7 @@ static Sys_var_ulong Sys_max_execution_time(
+@@ -4876,6 +4876,7 @@ static Sys_var_ulong Sys_max_execution_time(
      HINT_UPDATEABLE SESSION_VAR(max_execution_time), CMD_LINE(REQUIRED_ARG),
      VALID_RANGE(0, ULONG_MAX), DEFAULT(0), BLOCK_SIZE(1));
  
 +#ifndef LIBRESSL_VERSION_NUMBER
  static bool update_fips_mode(sys_var *, THD *, enum_var_type) {
    char ssl_err_string[OPENSSL_ERROR_LENGTH] = {'\0'};
    if (set_fips_mode(opt_ssl_fips_mode, ssl_err_string) != 1) {
-@@ -4470,14 +4471,30 @@ static bool update_fips_mode(sys_var *, THD *, enum_va
+@@ -4887,14 +4888,30 @@ static bool update_fips_mode(sys_var *, THD *, enum_va
    }
  }
  
 +#endif
 +
 +#if defined(LIBRESSL_VERSION_NUMBER)
 +static const char *ssl_fips_mode_names[] = {"OFF", 0};
 +#else
  static const char *ssl_fips_mode_names[] = {"OFF", "ON", "STRICT", nullptr};
 +#endif
  static Sys_var_enum Sys_ssl_fips_mode(
      "ssl_fips_mode",
      "SSL FIPS mode (applies only for OpenSSL); "
 -    "permitted values are: OFF, ON, STRICT",
 +#ifndef LIBRESSL_VERSION_NUMBER
 +     "permitted values are: OFF, ON, STRICT",
 +#else
 +    "permitted values are: OFF",
 +#endif
      GLOBAL_VAR(opt_ssl_fips_mode), CMD_LINE(REQUIRED_ARG, OPT_SSL_FIPS_MODE),
      ssl_fips_mode_names, DEFAULT(0), NO_MUTEX_GUARD, NOT_IN_BINLOG,
 -    ON_CHECK(nullptr), ON_UPDATE(update_fips_mode), nullptr);
 +    ON_CHECK(NULL),
 +#ifndef LIBRESSL_VERSION_NUMBER
 +    ON_UPDATE(update_fips_mode),
 +#else
 +    ON_UPDATE(NULL),
 +#endif
 +    NULL);
  
  static Sys_var_bool Sys_auto_generate_certs(
      "auto_generate_certs",
diff --git a/databases/mysql80-server/files/patch-ssl__init__callback.cc b/databases/mysql80-server/files/patch-ssl__init__callback.cc
deleted file mode 100644
index 2d80cf5e6c78..000000000000
--- a/databases/mysql80-server/files/patch-ssl__init__callback.cc
+++ /dev/null
@@ -1,20 +0,0 @@
---- sql/ssl_init_callback.cc.orig	2020-12-11 07:42:20 UTC
-+++ sql/ssl_init_callback.cc
-@@ -88,7 +88,7 @@ static Sys_var_charptr Sys_tls_version(
-     "TLS version, permitted values are TLSv1, TLSv1.1, TLSv1.2, TLSv1.3",
-     PERSIST_AS_READONLY GLOBAL_VAR(opt_tls_version),
-     CMD_LINE(REQUIRED_ARG, OPT_TLS_VERSION), IN_FS_CHARSET,
--#ifdef HAVE_TLSv13
-+#if defined(HAVE_TLSv13) && !defined(LIBRESSL_VERSION_NUMBER)
-     "TLSv1,TLSv1.1,TLSv1.2,TLSv1.3",
- #else
-     "TLSv1,TLSv1.1,TLSv1.2",
-@@ -154,7 +154,7 @@ static Sys_var_charptr Sys_admin_tls_version(
-     "TLSv1.2, TLSv1.3",
-     PERSIST_AS_READONLY GLOBAL_VAR(opt_admin_tls_version),
-     CMD_LINE(REQUIRED_ARG, OPT_TLS_VERSION), IN_FS_CHARSET,
--#ifdef HAVE_TLSv13
-+#if defined(HAVE_TLSv13) && !defined(LIBRESSL_VERSION_NUMBER)
-     "TLSv1,TLSv1.1,TLSv1.2,TLSv1.3",
- #else
-     "TLSv1,TLSv1.1,TLSv1.2",
diff --git a/databases/mysql80-server/files/patch-storage_innobase_include_detail_ut_large__page__alloc-linux.h b/databases/mysql80-server/files/patch-storage_innobase_include_detail_ut_large__page__alloc-linux.h
index 5297a5023741..3898f3653e6e 100644
--- a/databases/mysql80-server/files/patch-storage_innobase_include_detail_ut_large__page__alloc-linux.h
+++ b/databases/mysql80-server/files/patch-storage_innobase_include_detail_ut_large__page__alloc-linux.h
@@ -1,11 +1,11 @@
---- storage/innobase/include/detail/ut/large_page_alloc-linux.h.orig	2021-09-28 11:46:34 UTC
+--- storage/innobase/include/detail/ut/large_page_alloc-linux.h.orig	2021-12-17 16:07:27 UTC
 +++ storage/innobase/include/detail/ut/large_page_alloc-linux.h
-@@ -50,7 +50,7 @@ inline void *large_page_aligned_alloc(size_t n_bytes) 
+@@ -52,7 +52,7 @@ inline void *large_page_aligned_alloc(size_t n_bytes) 
    // mmap will internally round n_bytes to the multiple of huge-page size if it
    // is not already
    void *ptr = mmap(nullptr, n_bytes, PROT_READ | PROT_WRITE,
 -                   MAP_PRIVATE | MAP_ANON | MAP_HUGETLB, -1, 0);
 +                   MAP_PRIVATE | MAP_ANON, -1, 0);
-   return (ptr != (void *)-1) ? ptr : nullptr;
- }
- 
+   if (unlikely(ptr == (void *)-1)) {
+     ib::log_warn(ER_IB_MSG_856) << "large_page_aligned_alloc mmap(" << n_bytes
+                                 << " bytes) failed;"
diff --git a/databases/mysql80-server/files/patch-vio_viossl.cc b/databases/mysql80-server/files/patch-vio_viossl.cc
index e7f2a2a7c952..8fe78ce89f2a 100644
--- a/databases/mysql80-server/files/patch-vio_viossl.cc
+++ b/databases/mysql80-server/files/patch-vio_viossl.cc
@@ -1,30 +1,30 @@
---- vio/viossl.cc.orig	2019-09-20 08:30:51 UTC
+--- vio/viossl.cc.orig	2021-12-17 16:07:27 UTC
 +++ vio/viossl.cc
 @@ -45,7 +45,8 @@
    BIO_set_callback_ex was added in openSSL 1.1.1
    For older openSSL, use the deprecated BIO_set_callback.
  */
 -#if OPENSSL_VERSION_NUMBER >= 0x10101000L
 +#if OPENSSL_VERSION_NUMBER >= 0x10101000L && \
 +    !defined(LIBRESSL_VERSION_NUMBER)
  #define HAVE_BIO_SET_CALLBACK_EX
  #endif
  
-@@ -635,7 +636,7 @@ static int ssl_do(struct st_VioSSLFd *ptr, Vio *vio, l
- #if !defined(DBUG_OFF)
+@@ -640,7 +641,7 @@ static int ssl_do(struct st_VioSSLFd *ptr, Vio *vio, l
+ #if !defined(NDEBUG)
      {
        STACK_OF(SSL_COMP) *ssl_comp_methods = nullptr;
 -      ssl_comp_methods = SSL_COMP_get_compression_methods();
 +      ssl_comp_methods = (STACK_OF(SSL_COMP) *)SSL_COMP_get_compression_methods();
        n = sk_SSL_COMP_num(ssl_comp_methods);
        DBUG_PRINT("info", ("Available compression methods:\n"));
        if (n == 0)
-@@ -643,7 +644,7 @@ static int ssl_do(struct st_VioSSLFd *ptr, Vio *vio, l
+@@ -648,7 +649,7 @@ static int ssl_do(struct st_VioSSLFd *ptr, Vio *vio, l
        else
          for (j = 0; j < n; j++) {
            SSL_COMP *c = sk_SSL_COMP_value(ssl_comp_methods, j);
 -#if OPENSSL_VERSION_NUMBER < 0x10100000L
 +#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
            DBUG_PRINT("info", ("  %d: %s\n", c->id, c->name));
  #else  /* OPENSSL_VERSION_NUMBER < 0x10100000L */
            DBUG_PRINT("info",
diff --git a/databases/mysql80-server/files/patch-vio_viosslfactories.cc b/databases/mysql80-server/files/patch-vio_viosslfactories.cc
index 8c88903163ee..06cc1f909f4f 100644
--- a/databases/mysql80-server/files/patch-vio_viosslfactories.cc
+++ b/databases/mysql80-server/files/patch-vio_viosslfactories.cc
@@ -1,62 +1,62 @@
---- vio/viosslfactories.cc.orig	2021-11-04 18:02:40.921064000 +0100
-+++ vio/viosslfactories.cc	2021-11-04 18:15:24.992676000 +0100
+--- vio/viosslfactories.cc.orig	2021-12-17 16:07:27 UTC
++++ vio/viosslfactories.cc
 @@ -40,6 +40,7 @@
  #include "vio/vio_priv.h"
  
  #include <openssl/dh.h>
 +#include <openssl/crypto.h>
  
  #if OPENSSL_VERSION_NUMBER < 0x10002000L
  #include <openssl/ec.h>
 @@ -472,6 +473,7 @@ void ssl_start() {
    }
  }
  
 +#ifndef LIBRESSL_VERSION_NUMBER
  /**
    Set fips mode in openssl library,
    When we set fips mode ON/STRICT, it will perform following operations:
 @@ -525,6 +527,7 @@ EXIT:
    @returns openssl current fips mode
  */
  uint get_fips_mode() { return FIPS_mode(); }
 +#endif
  
  /**
    Toggle FIPS mode, to see whether it is available with the current SSL library.
 @@ -545,7 +548,7 @@ long process_tls_version(const char *tls_version) {
    const char *separator = ",";
    char *token, *lasts = nullptr;
  
 -#ifdef HAVE_TLSv13
 +#if defined(HAVE_TLSv13) && !defined(LIBRESSL_VERSION_NUMBER)
-   const char *tls_version_name_list[] = {"TLSv1", "TLSv1.1", "TLSv1.2",
-                                          "TLSv1.3"};
-   const char ctx_flag_default[] = "TLSv1,TLSv1.1,TLSv1.2,TLSv1.3";
-@@ -624,7 +627,7 @@ static struct st_VioSSLFd *new_VioSSLFd(
+   const char *tls_version_name_list[] = {"TLSv1.2", "TLSv1.3"};
+   const char ctx_flag_default[] = "TLSv1.2,TLSv1.3";
+   const long tls_ctx_list[] = {SSL_OP_NO_TLSv1_2, SSL_OP_NO_TLSv1_3};
+@@ -623,7 +626,7 @@ static struct st_VioSSLFd *new_VioSSLFd(
    ssl_ctx_options = (ssl_ctx_options | ssl_ctx_flags) &
                      (SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 | SSL_OP_NO_TLSv1 |
                       SSL_OP_NO_TLSv1_1 | SSL_OP_NO_TLSv1_2
 -#ifdef HAVE_TLSv13
 +#if defined(HAVE_TLSv13) && !defined(LIBRESSL_VERSION_NUMBER)
                       | SSL_OP_NO_TLSv1_3
  #endif /* HAVE_TLSv13 */
                       | SSL_OP_NO_TICKET);
-@@ -633,7 +636,7 @@ static struct st_VioSSLFd *new_VioSSLFd(
+@@ -632,7 +635,7 @@ static struct st_VioSSLFd *new_VioSSLFd(
      return nullptr;
  
    if (!(ssl_fd->ssl_context = SSL_CTX_new(is_client ?
 -#ifdef HAVE_TLSv13
 +#if defined(HAVE_TLSv13) && !defined(LIBRESSL_VERSION_NUMBER)
                                                      TLS_client_method()
                                                      : TLS_server_method()
  #else  /* HAVE_TLSv13 */
-@@ -648,7 +651,7 @@ static struct st_VioSSLFd *new_VioSSLFd(
+@@ -647,7 +650,7 @@ static struct st_VioSSLFd *new_VioSSLFd(
      return nullptr;
    }
  
 -#ifdef HAVE_TLSv13
 +#if defined(HAVE_TLSv13) && !defined(LIBRESSL_VERSION_NUMBER)
    /*
      Set OpenSSL TLS v1.3 ciphersuites.
      Note that an empty list is permissible.