ruby.git/ext/openssl/ossl_x509cert.c, branch v3_4_9

[ruby/openssl] Mark variables and functions as static whenever possible

2024-12-07T07:55:47+00:00

https://github.com/ruby/openssl/commit/85d6b7f192

[ruby/openssl] Pass through nil as digest when signing certificates

2024-06-11T17:12:28+00:00

(https://github.com/ruby/openssl/pull/761)

In order to sign certificates with Ed25519 keys, NULL must be passed
as md to X509_sign.  This NULL is then passed
(via ASN1_item_sign_ex) as type to EVP_DigestSignInit.  The
documentation[1] of EVP_DigestSignInit states that type must be NULL
for various key types, including Ed25519.

[1]: https://www.openssl.org/docs/manmaster/man3/EVP_DigestSignInit.html

https://github.com/ruby/openssl/commit/b0fc100091

[ruby/openssl] Fix references to the license text

2024-06-08T10:59:17+00:00

Update the references to the file "LICENCE" with "COPYING".

The file LICENCE doesn't exist in ruby/ruby nor ruby/openssl. This has
been always the case since OpenSSL for Ruby 2 was merged to the ruby
tree as a standard library in 2003.

In OpenSSL for Ruby 2's CVS repository[1], the LICENCE file contained
an old version of the Ruby License, identical to the COPYING file that
was in Ruby's tree at that time (r4128[2]).

[1] http://cvs.savannah.gnu.org/viewvc/rubypki/ossl2/LICENCE?revision=1.1.1.1&view=markup
[2] https://github.com/ruby/ruby/blob/231247c010acba191b78ed2d1310c935e63ad919/COPYING

https://github.com/ruby/openssl/commit/5bccf07d04

[ruby/openssl] Add X509::Certificate#tbs_bytes

2024-06-08T10:57:02+00:00

Ref https://github.com/ruby/openssl/issues/519

This makes verifying embedded certificate transparency signatures
significantly easier, as otherwise the alternative was manipulating the
ASN1 sequence, as in
https://github.com/segiddins/sigstore-cosign-verify/pull/2/commits/656d992fa816613fd9936f53ce30972c2f2f4957

https://github.com/ruby/openssl/commit/99128bea5d

[ruby/openssl] Implement Write Barrier for all OpenSSL types

2023-06-18T16:57:09+00:00

The vast majority have no reference so it's just a matter of setting the flags.

For the couple exception, they have very little references so it's
easy.

https://github.com/ruby/openssl/commit/2c7c6de69e

[ruby/openssl] x509*: fix error queue leak in #extensions= and #attributes= methods

2022-10-17T07:35:35+00:00

X509at_delete_attr() in OpenSSL master puts an error queue entry if
there is no attribute left to delete. We must either clear the error
queue, or try not to call it when the list is already empty.

https://github.com/ruby/openssl/commit/a0c878481f

[ruby/openssl] Strip trailing spaces

2021-07-18T09:04:50+00:00

https://github.com/ruby/openssl/commit/68fa9c86f1

[ruby/openssl] Implement `Certificate.load` to load certificate chain. (https://github.com/ruby/openssl/pull/441)

2021-07-18T08:44:55+00:00

* Add feature for loading the chained certificate into Certificate array.

https://github.com/ruby/openssl/commit/05e1c015d6

Co-authored-by: Sao I Kuan

[ruby/openssl] x509, ssl, pkcs7: try to parse as DER-encoding first

2021-07-18T08:44:54+00:00

Methods that take both PEM-encoding and DER-encoding have not been
consistent in the order in which encoding to attempt to parse.

A DER-encoding may contain a valid PEM block ("\n-----BEGIN ..-----" to
"-----END ...-----") embedded within it. Also, the PEM-encoding parser
allows arbitrary data around the PEM block and silently skips it. As a
result, attempting to parse data in DER-encoding as PEM-encoding first
can incorrectly finds the embedded PEM block instead.

This commit ensures that DER encoding will always be attempted before
PEM encoding. OpenSSL::X509::Certificate is one of the updated classes.
With this, the following will always be true:

    # obj is an OpenSSL::X509::Certificate
    obj == OpenSSL::X509::Certificate.new(obj.to_der)
    obj == OpenSSL::X509::Certificate.new(obj.to_pem)

https://github.com/ruby/openssl/commit/b280eb1fd0

[ruby/openssl] digest, hmac, ts, x509: use IO.binread in examples where appropriate

2021-03-16T10:16:11+00:00

IO.read may mangle line separator, which will corrupt binary data
including DER-encoded X.509 certificates and such.

Fixes: https://github.com/ruby/openssl/issues/243

https://github.com/ruby/openssl/commit/93213b2730