public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
* [rpms/sscg] f43: Adapt to OpenSSL 4
@ 2026-09-23 18:45 Stephen Gallagher
0 siblings, 0 replies; only message in thread
From: Stephen Gallagher @ 2026-09-23 18:45 UTC (permalink / raw)
To: git-commits
A new commit has been pushed.
Repo : rpms/sscg
Branch : f43
Commit : a2cb47cde10907597d16ad1a1ff20101762750bc
Author : Stephen Gallagher <sgallagh@redhat.com>
Date : 2026-04-17T14:26:36-04:00
Stats : +185/-0 in 2 file(s)
URL : https://src.fedoraproject.org/rpms/sscg/c/a2cb47cde10907597d16ad1a1ff20101762750bc?branch=f43
Log:
Adapt to OpenSSL 4
Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>
---
diff --git a/0002-Adapt-to-OpenSSL-4.patch b/0002-Adapt-to-OpenSSL-4.patch
new file mode 100644
index 0000000..f6d3507
--- /dev/null
+++ b/0002-Adapt-to-OpenSSL-4.patch
@@ -0,0 +1,181 @@
+From c321549d1eed073f2673326872b2148c0c13bc60 Mon Sep 17 00:00:00 2001
+From: Stephen Gallagher <sgallagh@redhat.com>
+Date: Fri, 17 Apr 2026 11:45:00 -0400
+Subject: [PATCH 2/2] Adapt to OpenSSL 4
+
+OpenSSL returns const pointers for some functions that were previously
+non-const. This also revealed that it was probably a bad idea to be
+modifying the CSR subject name in-place, so we now create a completely
+new X509_NAME object, populate it and then store it into the CSR.
+
+Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>
+---
+ include/x509.h | 5 +++++
+ src/x509.c | 37 ++++++++++++++++++++++++++++---------
+ test/create_ca_test.c | 4 ++--
+ test/create_cert_test.c | 4 ++--
+ 4 files changed, 37 insertions(+), 13 deletions(-)
+
+diff --git a/include/x509.h b/include/x509.h
+index a378c6a7910c75fe7889b75055ac6a39eb08fc70..b4520b932b3d0a8826839fce5fffba27a14c1689 100644
+--- a/include/x509.h
++++ b/include/x509.h
+@@ -70,6 +70,11 @@ struct sscg_x509_req
+ X509_REQ *x509_req;
+ };
+
++struct sscg_x509_name
++{
++ X509_NAME *name;
++};
++
+ struct sscg_x509_cert
+ {
+ X509 *certificate;
+diff --git a/src/x509.c b/src/x509.c
+index cc9503ec968cfc94bd305e80450973bc36b87534..b1e43ad5972bef3d4ff87666b69d200a13aa7d9d 100644
+--- a/src/x509.c
++++ b/src/x509.c
+@@ -135,6 +135,17 @@ _sscg_csr_destructor (TALLOC_CTX *ctx)
+ return 0;
+ }
+
++static int
++_sscg_x509_name_destructor (TALLOC_CTX *ctx)
++{
++ struct sscg_x509_name *subject_name =
++ talloc_get_type_abort (ctx, struct sscg_x509_name);
++
++ X509_NAME_free (subject_name->name);
++
++ return 0;
++}
++
+ int
+ sscg_x509v3_csr_new (TALLOC_CTX *mem_ctx,
+ struct sscg_cert_info *certinfo,
+@@ -143,7 +154,7 @@ sscg_x509v3_csr_new (TALLOC_CTX *mem_ctx,
+ {
+ int ret, sslret;
+ size_t i;
+- X509_NAME *subject;
++ struct sscg_x509_name *subject = NULL;
+ char *alt_name = NULL;
+ char *tmp = NULL;
+ char *san = NULL;
+@@ -173,11 +184,16 @@ sscg_x509v3_csr_new (TALLOC_CTX *mem_ctx,
+ sslret = X509_REQ_set_version (csr->x509_req, 0);
+ CHECK_SSL (sslret, X509_REQ_set_version);
+
+- subject = X509_REQ_get_subject_name (csr->x509_req);
++ subject = talloc_zero (tmp_ctx, struct sscg_x509_name);
++ CHECK_MEM (subject);
++
++ subject->name = X509_NAME_new ();
++ CHECK_MEM (subject->name);
++ talloc_set_destructor ((TALLOC_CTX *)subject, _sscg_x509_name_destructor);
+
+ /* Country */
+ sslret =
+- X509_NAME_add_entry_by_NID (subject,
++ X509_NAME_add_entry_by_NID (subject->name,
+ NID_countryName,
+ MBSTRING_UTF8,
+ (const unsigned char *)certinfo->country,
+@@ -190,7 +206,7 @@ sscg_x509v3_csr_new (TALLOC_CTX *mem_ctx,
+ if (certinfo->state && certinfo->state[0])
+ {
+ sslret =
+- X509_NAME_add_entry_by_NID (subject,
++ X509_NAME_add_entry_by_NID (subject->name,
+ NID_stateOrProvinceName,
+ MBSTRING_UTF8,
+ (const unsigned char *)certinfo->state,
+@@ -204,7 +220,7 @@ sscg_x509v3_csr_new (TALLOC_CTX *mem_ctx,
+ if (certinfo->locality && certinfo->locality[0])
+ {
+ sslret =
+- X509_NAME_add_entry_by_NID (subject,
++ X509_NAME_add_entry_by_NID (subject->name,
+ NID_localityName,
+ MBSTRING_UTF8,
+ (const unsigned char *)certinfo->locality,
+@@ -218,7 +234,7 @@ sscg_x509v3_csr_new (TALLOC_CTX *mem_ctx,
+ if (certinfo->org && certinfo->org[0])
+ {
+ sslret =
+- X509_NAME_add_entry_by_NID (subject,
++ X509_NAME_add_entry_by_NID (subject->name,
+ NID_organizationName,
+ MBSTRING_UTF8,
+ (const unsigned char *)certinfo->org,
+@@ -232,7 +248,7 @@ sscg_x509v3_csr_new (TALLOC_CTX *mem_ctx,
+ if (certinfo->org_unit && certinfo->org_unit[0])
+ {
+ sslret =
+- X509_NAME_add_entry_by_NID (subject,
++ X509_NAME_add_entry_by_NID (subject->name,
+ NID_organizationalUnitName,
+ MBSTRING_UTF8,
+ (const unsigned char *)certinfo->org_unit,
+@@ -243,7 +259,7 @@ sscg_x509v3_csr_new (TALLOC_CTX *mem_ctx,
+ }
+
+ /* Common Name */
+- sslret = X509_NAME_add_entry_by_NID (subject,
++ sslret = X509_NAME_add_entry_by_NID (subject->name,
+ NID_commonName,
+ MBSTRING_UTF8,
+ (const unsigned char *)certinfo->cn,
+@@ -256,7 +272,7 @@ sscg_x509v3_csr_new (TALLOC_CTX *mem_ctx,
+ if (certinfo->email && certinfo->email[0])
+ {
+ sslret =
+- X509_NAME_add_entry_by_NID (subject,
++ X509_NAME_add_entry_by_NID (subject->name,
+ NID_pkcs9_emailAddress,
+ MBSTRING_UTF8,
+ (const unsigned char *)certinfo->email,
+@@ -266,6 +282,9 @@ sscg_x509v3_csr_new (TALLOC_CTX *mem_ctx,
+ CHECK_SSL (sslret, X509_NAME_add_entry_by_NID (Email));
+ }
+
++ sslret = X509_REQ_set_subject_name (csr->x509_req, subject->name);
++ CHECK_SSL (sslret, X509_REQ_set_subject_name);
++
+ /* SubjectAltNames */
+ alt_name = talloc_asprintf (tmp_ctx, "DNS:%s", certinfo->cn);
+ CHECK_MEM (alt_name);
+diff --git a/test/create_ca_test.c b/test/create_ca_test.c
+index ecaa5660986d943d134b0deff96f3d859725fa78..60fbc48de701c21e94ece96c72e9e86f7df3fc9f 100644
+--- a/test/create_ca_test.c
++++ b/test/create_ca_test.c
+@@ -567,8 +567,8 @@ verify_name_constraints (struct sscg_x509_cert *ca_cert,
+ int ret = EOK;
+ TALLOC_CTX *tmp_ctx = NULL;
+ X509 *x509 = ca_cert->certificate;
+- X509_EXTENSION *name_constraints_ext = NULL;
+- ASN1_OCTET_STRING *ext_data = NULL;
++ const X509_EXTENSION *name_constraints_ext = NULL;
++ const ASN1_OCTET_STRING *ext_data = NULL;
+ BIO *bio = NULL;
+ char *ext_str = NULL;
+ char *ext_str_copy = NULL;
+diff --git a/test/create_cert_test.c b/test/create_cert_test.c
+index be28c96b504548b839321fbbe899f4339cf965b5..5389b5b77de4c01be7566c5111ded930c5e0289b 100644
+--- a/test/create_cert_test.c
++++ b/test/create_cert_test.c
+@@ -51,8 +51,8 @@ verify_name_constraints (struct sscg_x509_cert *ca_cert,
+ int ret = EOK;
+ TALLOC_CTX *tmp_ctx = NULL;
+ X509 *x509 = ca_cert->certificate;
+- X509_EXTENSION *name_constraints_ext = NULL;
+- ASN1_OCTET_STRING *ext_data = NULL;
++ const X509_EXTENSION *name_constraints_ext = NULL;
++ const ASN1_OCTET_STRING *ext_data = NULL;
+ BIO *bio = NULL;
+ char *ext_str = NULL;
+ int ext_len = 0;
+--
+2.53.0
+
diff --git a/sscg.spec b/sscg.spec
index 4a60e76..78db950 100644
--- a/sscg.spec
+++ b/sscg.spec
@@ -29,6 +29,10 @@ BuildRequires: help2man
# https://github.com/sgallagher/sscg/commit/0c37e7ace585cfb550a0ffd9d5c331d059fd687f
Patch: 0001-Avoid-segfault-on-receiving-bad-CLI-arguments.patch
+# Upstream patch to support OpenSSL API adjustments without warnings
+# https://github.com/sgallagher/sscg/commit/5547334edbf609ee987157fb19444865f8d351dc
+Patch: 0002-Adapt-to-OpenSSL-4.patch
+
%description
A utility to aid in the creation of more secure "self-signed"
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2026-09-23 18:45 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-23 18:45 [rpms/sscg] f43: Adapt to OpenSSL 4 Stephen Gallagher
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox