diff options
| author | Jun Aruga <jaruga@redhat.com> | 2023-04-12 17:15:21 +0200 |
|---|---|---|
| committer | Kazuki Yamaguchi <k@rhe.jp> | 2023-06-19 01:57:09 +0900 |
| commit | 2a4834057b30a26c38ece3961b370c0b2ee59380 (patch) | |
| tree | 477ee9bddab06e031a99f89a8016b94357bc9bef /spec/ruby/core/kernel | |
| parent | 1965c09ee50b5202d45462cd8bc6224ca6e45ae9 (diff) | |
[ruby/openssl] Workaround: Fix OpenSSL::PKey.read that cannot parse PKey in the FIPS mode.
This commit is a workaround to avoid the error below that the
`OpenSSL::PKey.read` fails with the OpenSSL 3.0 FIPS mode.
```
$ openssl genrsa -out key.pem 4096
$ ruby -e "require 'openssl'; OpenSSL::PKey.read(File.read('key.pem'))"
-e:1:in `read': Could not parse PKey (OpenSSL::PKey::PKeyError)
from -e:1:in `<main>'
```
The root cause is on the OpenSSL side. The `OSSL_DECODER_CTX_set_selection`
doesn't apply the selection value properly if there are multiple providers, and
a provider (e.g. "base" provider) handles the decoder implementation, and
another provider (e.g. "fips" provider) handles the keys.
The workaround is to create `OSSL_DECODER_CTX` variable each time without using
the `OSSL_DECODER_CTX_set_selection`.
https://github.com/ruby/openssl/commit/5ff4a31621
Diffstat (limited to 'spec/ruby/core/kernel')
0 files changed, 0 insertions, 0 deletions
