[rpms/ocspd] rawhide: Patch "openssl4" for openssl version 4 compatibility.

[rpms/ocspd] rawhide: Patch "openssl4" for openssl version 4 compatibility.

[Patrick Monnerat]

            A new commit has been pushed.

            Repo   : rpms/ocspd
            Branch : rawhide
            Commit : 310257dced8a6fafad4df36d870d86a1cf91a3b9
            Author : Patrick Monnerat <patrick@monnerat.net>
            Date   : 2026-07-21T18:15:52+02:00
            Stats  : +97/-19 in 2 file(s)
            URL    : https://src.fedoraproject.org/rpms/ocspd/c/310257dced8a6fafad4df36d870d86a1cf91a3b9?branch=rawhide

            Log:
            Patch "openssl4" for openssl version 4 compatibility.

Disable openssl engine.

---
diff --git a/ocspd-1.9.0-openssl4.patch b/ocspd-1.9.0-openssl4.patch
new file mode 100644
index 0000000..1a51d7c
--- /dev/null
+++ b/ocspd-1.9.0-openssl4.patch
@@ -0,0 +1,80 @@
+diff -Naurp openca-ocspd-1.9.0.orig/src/hash-db.c openca-ocspd-1.9.0.new/src/hash-db.c
+--- openca-ocspd-1.9.0.orig/src/hash-db.c	2026-07-21 16:41:56.676284779 +0200
++++ openca-ocspd-1.9.0.new/src/hash-db.c	2026-07-21 17:13:25.736828336 +0200
+@@ -15,6 +15,7 @@
+ 
+ #include "general.h"
+ #include "http_client.h"
++#include "openssl-compat.h"
+ 
+ #include <openssl/txt_db.h>
+ #include <openssl/conf.h>
+@@ -693,8 +694,8 @@ STACK_OF(CA_ENTRY_CERTID) *ocspd_CA_ENTR
+ 				STACK_OF(X509)* ca_cert, EVP_MD *digest ) {
+ 
+ 	CA_ENTRY_CERTID *cid = NULL;
+-	X509_NAME *iname = NULL;
+-	ASN1_BIT_STRING *ikey = NULL;
++	const X509_NAME *iname = NULL;
++	const ASN1_BIT_STRING *ikey = NULL;
+ #ifdef _DEBUG
+ 	BIO *bio = NULL;
+ #endif
+@@ -736,7 +737,8 @@ STACK_OF(CA_ENTRY_CERTID) *ocspd_CA_ENTR
+ 			return (NULL);
+ 		};
+ 
+-		EVP_Digest( ikey->data, ikey->length, buff, &i, digest, NULL);
++		EVP_Digest(asn1_string_data(ikey),
++			   asn1_string_length(ikey), buff, &i, digest, NULL);
+ 		if( !(cid->keyHash = ASN1_OCTET_STRING_new()) ||
+ 				!(ASN1_OCTET_STRING_set(cid->keyHash,buff,i))) {
+ 			if( cid ) OPENSSL_free (cid);
+diff -Naurp openca-ocspd-1.9.0.orig/src/openssl-compat.h openca-ocspd-1.9.0.new/src/openssl-compat.h
+--- openca-ocspd-1.9.0.orig/src/openssl-compat.h	1970-01-01 01:00:00.000000000 +0100
++++ openca-ocspd-1.9.0.new/src/openssl-compat.h	2026-07-21 16:57:41.401461447 +0200
+@@ -0,0 +1,14 @@
++#ifndef __OPENSSL_COMPAT_H__
++#define __OPENSSL_COMPAT_H__
++
++#if OPENSSL_VERSION_NUMBER < 0x40000000L
++#define asn1_string_length(p)	((p)->length)
++#define asn1_string_data(p)	((p)->data)
++#define asn1_string_type(p)	((p)->type)
++#else
++#define asn1_string_length(p)	ASN1_STRING_length(p)
++#define asn1_string_data(p)	ASN1_STRING_get0_data(p)
++#define asn1_string_type(p)	ASN1_STRING_type(p)
++#endif
++
++#endif
+diff -Naurp openca-ocspd-1.9.0.orig/src/url.c openca-ocspd-1.9.0.new/src/url.c
+--- openca-ocspd-1.9.0.orig/src/url.c	2009-06-08 19:24:05.000000000 +0200
++++ openca-ocspd-1.9.0.new/src/url.c	2026-07-21 17:17:50.158342483 +0200
+@@ -78,20 +78,20 @@ URL *URL_new ( char *url_s ) {
+ 			tmp_s = tmp_s2+1;
+ 			ret->port = atoi( tmp_s );
+ 		} else {
+-			ret->addr = (char *) malloc ( BUFF_MAX_SIZE );
+-			memset( ret->addr, 0, BUFF_MAX_SIZE );
++			ret->addr = (char *) malloc(BUFF_MAX_SIZE + 1);
++			memset(ret->addr, 0, BUFF_MAX_SIZE + 1);
+ 
+-			strncpy( ret->addr, tmp_s, BUFF_MAX_SIZE);
++			strncpy(ret->addr, tmp_s, BUFF_MAX_SIZE);
+ 			ret->port = DEFAULT_LDAP_PORT;
+ 		}
+ 
+ 	} else if (strncmp( "file://", url_s, 6 ) == 0) {
+ 		ret->port = -1;
+ 		ret->proto = URI_PROTO_FILE;
+-		ret->addr = (char *) malloc ( BUFF_MAX_SIZE );
+-		memset( ret->addr, 0, BUFF_MAX_SIZE );
++		ret->addr = (char *) malloc(BUFF_MAX_SIZE + 1);
++		memset(ret->addr, 0, BUFF_MAX_SIZE + 1);
+ 
+-		strncpy( ret->addr, &url_s[7], BUFF_MAX_SIZE);
++		strncpy(ret->addr, &url_s[7], BUFF_MAX_SIZE);
+ 	} else if( strncmp("http://", url_s, 6 ) == 0) {
+ 		ret->proto = URI_PROTO_HTTP;
+ 		tmp_s = &url_s[7];

diff --git a/ocspd.spec b/ocspd.spec
index d924db8..36c7d81 100644
--- a/ocspd.spec
+++ b/ocspd.spec
@@ -4,7 +4,7 @@
 
 Name:		ocspd
 Version:	1.9.0
-Release:	38%{?alphatag:.}%{?alphatag}%{?dist}
+Release:	39%{?alphatag:.}%{?alphatag}%{?dist}
 Summary:	OpenCA OCSP Daemon
 License:	Apache-1.0
 Source:		http://downloads.sourceforge.net/openca/openca-ocspd-%{version}%{revision}.tar.gz
@@ -22,13 +22,14 @@ Patch10:	ocspd-1.7.0-setgroups.patch
 Patch11:	ocspd-1.9.0-stealthy.patch
 Patch12:	ocspd-1.9.0-noformat.patch
 Patch13:	ocspd-1.9.0-openssl11.patch
+Patch14:	ocspd-1.9.0-openssl4.patch
 URL:		http://www.openca.org/projects/ocspd
 Obsoletes:	openca-ocspd <= %{version}-%{release}
 Provides:	openca-ocspd = %{version}-%{release}
 BuildRequires:	make
 BuildRequires:	gcc
 BuildRequires:	openssl-devel
-%if 0%{?fedora} >= 41
+%if 0%{?fedora} >= 41 && 0%{?fedora} <= 44
 BuildRequires:	openssl-devel-engine
 %endif
 BuildRequires:	openldap-devel
@@ -50,20 +51,7 @@ Mozilla/Firefox/Thunderbird/Apache).
 %prep
 #-------------------------------------------------------------------------------
 
-%setup -q -n openca-ocspd-%{version}%{revision}
-%patch -P1 -p1 -b .bufresponse
-%patch -P2 -p1 -b .misc
-%patch -P3 -p1 -b .openssl
-%patch -P4 -p1 -b .podsyntax
-%patch -P5 -p1 -b .badalgorcast
-%patch -P6 -p1 -b .badcasts
-%patch -P7 -p1 -b .deprecldap
-%patch -P8 -p1 -b .threadinit
-%patch -P9 -p1 -b .config
-%patch -P10 -p1 -b .setgroups
-%patch -P11 -p1 -b .stealthy
-%patch -P12 -p1 -b .noformat
-%patch -P13 -p1 -b .openssl11
+%autosetup -p1 -n openca-ocspd-%{version}%{revision}
 
 #	Create a sysusers.d config file.
 cat > ocspd.sysusers.conf <<EOF
@@ -88,7 +76,13 @@ autoconf
 %endif
 
 
-%configure ${ARCH_FLAGS} --enable-openssl-engine --with-ocspd-group=ocspd
+%configure ${ARCH_FLAGS}						\
+%if 0%{?fedora} <= 44
+	--enable-openssl-engine						\
+%else
+	--disable-openssl-engine					\
+%endif
+	--with-ocspd-group=ocspd
 make %{?_smp_mflags}
 
 
@@ -159,6 +153,12 @@ install -m 644 -D ocspd.sysusers.conf '%{buildroot}%{_sysusersdir}/ocspd.conf'
 
 #-------------------------------------------------------------------------------
 %changelog
+#-------------------------------------------------------------------------------
+
+* Tue Jul 21 2026 Patrick Monnerat <patrick@monnerat.net> 1.9.0-39
+- Patch "openssl4" for openssl version 4 compatibility.
+- Disable openssl engine.
+
 * Thu Jul 16 2026 Fedora Release Engineering <releng@fedoraproject.org> - 1.9.0-38
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
 
@@ -171,8 +171,6 @@ install -m 644 -D ocspd.sysusers.conf '%{buildroot}%{_sysusersdir}/ocspd.conf'
 * Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.9.0-35
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
 
-#-------------------------------------------------------------------------------
-
 * Wed Feb 12 2025 Patrick Monnerat <patrick@monnerat.net> 1.9.0-34
 - Add sysusers.d config file to allow rpm to create users/groups automatically.