summaryrefslogtreecommitdiff
path: root/ext/openssl/extconf.rb
AgeCommit message (Collapse)Author
2025-12-13[ruby/openssl] ossl.c: implement OpenSSL::OpenSSLError#detailed_messageKazuki Yamaguchi
An OpenSSL function sometimes puts more than one error entry into the thread-local OpenSSL error queue. Currently, we use the highest-level entry for generating the exception message and discard the rest. Let ossl_make_error() capture all current OpenSSL error queue contents into OpenSSL::OpenSSLError#errors and extend OpenSSL::OpenSSLError#detailed_message to include the information. An example: $ ruby -Ilib -ropenssl -e'OpenSSL::X509::ExtensionFactory.new.create_ext("a", "b")' -e:1:in 'OpenSSL::X509::ExtensionFactory#create_ext': a = b: error in extension (name=a, value=b) (OpenSSL::X509::ExtensionError) OpenSSL error queue reported 2 errors: error:11000082:X509 V3 routines:do_ext_nconf:unknown extension name error:11000080:X509 V3 routines:X509V3_EXT_nconf_int:error in extension (name=a, value=b) from -e:1:in '<main>' https://github.com/ruby/openssl/commit/d28f7a9a13
2025-10-08[ruby/openssl] ssl: fix extconf.rb check for SSL_CTX_set0_tmp_dh_pkey()Kazuki Yamaguchi
Check for the function we actually use. Both SSL_set0_tmp_dh_pkey() and SSL_CTX_set0_tmp_dh_pkey() were added in OpenSSL 3.0. https://github.com/ruby/openssl/commit/a9b6a64e5f
2025-07-22[ruby/openssl] ssl: add SSLSocket#sigalg, #peer_sigalg, #groupJun Aruga
These methods are useful to test post-quantum cryptography (PQC) cases. https://github.com/ruby/openssl/commit/434ef74452
2025-07-01[ruby/openssl] Run `have_func` with the header providing the declarationsNobuyoshi Nakada
https://github.com/ruby/openssl/commit/b6f56c4540
2025-06-20[ruby/openssl] ssl: add SSLContext#sigalgs= and #client_sigalgs=Kazuki Yamaguchi
Add methods for setting supported signature algorithms, corresponding to SSL_CTX_set1_sigalgs_list() and SSL_CTX_set1_client_sigalgs_list(), respectively. https://github.com/ruby/openssl/commit/6bbe58c492 Co-authored-by: Markus Jung <markus.jung@vivavis.com>
2025-01-23[ruby/openssl] ts: use TS_VERIFY_CTX_set0_{store,certs}() on OpenSSL 3.4Kazuki Yamaguchi
In OpenSSL 3.4, TS_VERIFY_CTX_set_certs() and TS_VERIFY_CTX_set_store() are deprecated in favor of the new functions with "set0" in the names. The new functions have a slightly different behavior. They will free the previous value automatically. Increment the reference counter of X509_STORE before setting it to TS_VERIFY_CTX, and do not try to manually unset it. We avoided doing this to work around a bug that was present in older versions of OpenSSL, which has now been fixed in OpenSSL 1.0.2 by commit https://github.com/openssl/openssl/commit/bff9ce4db38b. https://github.com/ruby/openssl/commit/ce37f7d93a
2025-01-21[ruby/openssl] Require OpenSSL 1.1.1 or laterKazuki Yamaguchi
Drop support for OpenSSL 1.1.0. OpenSSL 1.1.0 was a non-LTS release and it has reached upstream EOL in 2019-12 along with OpenSSL 1.0.2. Distributions that shipped with OpenSSL 1.1.0 include: - Debian 9 (EOL 2022-06) - Ubuntu 18.04 LTS (EOL 2023-04) https://github.com/ruby/openssl/commit/ba83abe920
2025-01-20[ruby/openssl] extconf.rb: remove dir_config("kerberos")Kazuki Yamaguchi
The dir_config was introduced by Ruby trunk r4181. Since support for Kerberos cipher suites has been removed in OpenSSL 1.1.0, it is no longer necessary. Although ruby/openssl did not directly depend on the MIT Kerberos library, it was an optional transitive dependency. Unless it was disabled by a compile-time option, the OpenSSL headers would try to include <krb5.h>. https://github.com/ruby/openssl/commit/78d028c332
2025-01-20[ruby/openssl] Require OpenSSL 1.1.0 or laterKazuki Yamaguchi
Drop support for OpenSSL 1.0.2. It has reached upstream EOL in 2019-12. Most distributions that shipped with OpenSSL 1.0.2 have also reached EOL, or provide a newer version in the package repository: - RHEL 7 (EOL 2024-06) - Ubuntu 16.04 LTS (EOL 2021-04) - Amazon Linux 2 (EOL 2026-06, but OpenSSL 1.1.1 can be installed via the openssl11{,-devel} package) https://github.com/ruby/openssl/commit/38ec6fd50e
2025-01-14[ruby/openssl] engine: remove mention of LibreSSL from OpenSSL::EngineKazuki Yamaguchi
These paths are only reachable when it is compiled against OpenSSL. LibreSSL 3.9 does not support ENGINE and defines OPENSSL_NO_ENGINE. https://github.com/ruby/openssl/commit/e153d6ab47
2025-01-14[ruby/openssl] Require LibreSSL 3.9 or laterKazuki Yamaguchi
Drop support for LibreSSL 3.1-3.8. LibreSSL 3.8 has reached its EOL in 2024-10. https://github.com/ruby/openssl/commit/f33d611f9f
2024-07-24[ruby/openssl] Set time directly on the x509 storeSamuel Giddins
(https://github.com/ruby/openssl/pull/770) Instead of an ivar, so other ossl functions that take a store will use the correct time when verifying https://github.com/ruby/openssl/commit/21aadc66ae
2024-06-08[ruby/openssl] Fix references to the license textKazuki Yamaguchi
Update the references to the file "LICENCE" with "COPYING". The file LICENCE doesn't exist in ruby/ruby nor ruby/openssl. This has been always the case since OpenSSL for Ruby 2 was merged to the ruby tree as a standard library in 2003. In OpenSSL for Ruby 2's CVS repository[1], the LICENCE file contained an old version of the Ruby License, identical to the COPYING file that was in Ruby's tree at that time (r4128[2]). [1] http://cvs.savannah.gnu.org/viewvc/rubypki/ossl2/LICENCE?revision=1.1.1.1&view=markup [2] https://github.com/ruby/ruby/blob/231247c010acba191b78ed2d1310c935e63ad919/COPYING https://github.com/ruby/openssl/commit/5bccf07d04
2024-06-08[ruby/openssl] Add X509::Certificate#tbs_bytesSamuel Giddins
Ref https://github.com/ruby/openssl/issues/519 This makes verifying embedded certificate transparency signatures significantly easier, as otherwise the alternative was manipulating the ASN1 sequence, as in https://github.com/segiddins/sigstore-cosign-verify/pull/2/commits/656d992fa816613fd9936f53ce30972c2f2f4957 https://github.com/ruby/openssl/commit/99128bea5d
2024-03-20[ruby/openssl] Revert "Always respect the openssl prefix chosen by ↵Benoit Daloze
truffle/openssl-prefix on TruffleRuby" * This reverts commit https://github.com/ruby/openssl/commit/ca738e7e1357. * No longer needed since https://github.com/oracle/truffleruby/issues/3170 was fixed. https://github.com/ruby/openssl/commit/1f641a5604
2024-01-17[ruby/openssl] Add support for IO#timeout.Samuel Williams
(https://github.com/ruby/openssl/pull/714) * Add support for IO#timeout. https://github.com/ruby/openssl/commit/3bbf5178a9
2023-09-06[ruby/openssl] Remove OSSL_DEBUG compile-time optionKazuki Yamaguchi
Remove the OSSL_DEBUG flag and OpenSSL.mem_check_start which is only compiled when the flag is given. They are meant purely for development of Ruby/OpenSSL. OpenSSL.mem_check_start helped us find memory leak bugs in past, but it is no longer working with the recent OpenSSL versions. Let's just remove it now. https://github.com/ruby/openssl/commit/8c7a6a17e2
2023-08-16[ruby/openssl] Raise an error when the specified OpenSSL library directory ↵Jun Aruga
doesn't exist. OpenSSL built from the source creates the library directory to the `/path/to/openssl_dir/lib64` as a default. In the case, the `bundle exec rake compile -- --with-openssl-dir=<openssl_dir>` cannot compile with the lib64 directory, and may compile with system OpenSSL's libraries unintentionally. This commit is to check this case to avoid linking with an unintentional library directory. https://github.com/ruby/openssl/commit/ca54087462
2023-07-24[ruby/openssl] Always respect the openssl prefix chosen by ↵Benoit Daloze
truffle/openssl-prefix on TruffleRuby * See https://github.com/ruby/openssl/issues/650#issuecomment-1645699608 https://github.com/ruby/openssl/commit/ca738e7e13
2023-06-19[ruby/openssl] extconf.rb: apply RUBY_OPENSSL_EXT{C,LD}FLAGS after checking ↵Kazuki Yamaguchi
features RUBY_OPENSSL_EXTCFLAGS and RUBY_OPENSSL_EXTLDFLAGS have been added for the primary purpose of appending custom warning flags during development and CI. Since checking programs generated by mkmf may not be completely warning-free, we don't want to apply -Werror that may be supplied from those environment variables. https://github.com/ruby/openssl/commit/2a95b971d5
2023-06-19[ruby/openssl] Append flags from environment variables.Jun Aruga
According to the `mkmf.rb#init_mkmf`, there are command line options below. * `--with-cflags` to set the `cflags` * `--with-ldflags` to set the `ldflags` For example the following command compiles with the specified flags. Note that `MAKEFLAGS` is to print the compiler command lines. ``` $ MAKEFLAGS="V=1" \ bundle exec rake compile -- \ --with-cflags="-Wundef -Werror" \ --with-ldflags="-fstack-protector" ``` However, I couldn't find command line options to append the flags. And this commit is to append the `cflags` and `ldflags` by the environment variables. ``` $ MAKEFLAGS="V=1" \ RUBY_OPENSSL_EXTCFLAGS="-Wundef -Werror" \ RUBY_OPENSSL_EXTLDFLAGS="-fstack-protector" \ bundle exec rake compile ``` https://github.com/ruby/openssl/commit/b551eb86f6
2023-05-29[ruby/openssl] Remove usage of IO internals.Samuel Williams
2022-12-23[ruby/openssl] Suppress deprecation warnings by OpenSSL 3Nobuyoshi Nakada
https://github.com/ruby/openssl/commit/91657a7924
2022-12-23[ruby/openssl] Check for functions with argumentsNobuyoshi Nakada
https://github.com/ruby/openssl/commit/b67aaf925d
2022-12-13We should apply https://github.com/ruby/openssl/pull/576 instead of them:Hiroshi SHIBATA
https://github.com/ruby/ruby/commit/6d8f396f37350b7aa9c85a097929f54a0939448b https://github.com/ruby/ruby/commit/c8b3bd45cc3cae93ae701333202416838ee6a00c
2022-10-17[ruby/openssl] hmac: use EVP_PKEY_new_raw_private_key() if availableKazuki Yamaguchi
Current OpenSSL 3.0.x release has a regression with zero-length MAC keys. While this issue should be fixed in a future release of OpenSSL, we can use EVP_PKEY_new_raw_private_key() in place of the problematic EVP_PKEY_new_mac_key() to avoid the issue. OpenSSL 3.0's man page recommends using it regardless: > EVP_PKEY_new_mac_key() works in the same way as > EVP_PKEY_new_raw_private_key(). New applications should use > EVP_PKEY_new_raw_private_key() instead. Fixes https://github.com/ruby/openssl/issues/369#issuecomment-1224912710 https://github.com/ruby/openssl/commit/4293f18b1f
2022-10-17[ruby/openssl] Pass arguments to check macro presenceAlan Wu
X509_STORE_get_ex_new_index() is a macro, so passing just its name to have_func() doesn't detect it. Pass an example call instead. https://github.com/ruby/openssl/commit/8d264d3e60 Co-authored-by: Nobuyoshi Nakada <nobu@ruby-lang.org>
2022-10-17[ruby/openssl] Check for OpenSSL functions in headersAlan Wu
While building with a custom build of OpenSSL, I noticed in mkmf.log that all the feature detection checks are done using a program lacking an OpenSSL header include. `mkmf` retries using a fallback program when this fails, but that means all the `have_func` calls compile twice when compiling once should suffice. Example log without this commit: have_func: checking for X509_STORE_CTX_get0_cert()... -------------------- yes DYLD_FALLBACK_LIBRARY_PATH=.:../.. "clang -o conftest ... conftest.c:14:57: error: use of undeclared identifier 'X509_STORE_CTX_get0_cert' int t(void) { void ((*volatile p)()); p = (void ((*)()))X509_STORE_CTX_get0_cert; return !p; } ^ 1 error generated. checked program was: /* begin */ 1: #include "ruby.h" 2: 3: /*top*/ 4: extern int t(void); 5: int main(int argc, char **argv) 6: { 7: if (argc > 1000000) { 8: int (* volatile tp)(void)=(int (*)(void))&t; 9: printf("%d", (*tp)()); 10: } 11: 12: return !!argv[argc]; 13: } 14: int t(void) { void ((*volatile p)()); p = (void ((*)()))X509_STORE_CTX_get0_cert; return !p; } /* end */ DYLD_FALLBACK_LIBRARY_PATH=.:../.. "clang -o conftest ... checked program was: /* begin */ 1: #include "ruby.h" 2: 3: /*top*/ 4: extern int t(void); 5: int main(int argc, char **argv) 6: { 7: if (argc > 1000000) { 8: int (* volatile tp)(void)=(int (*)(void))&t; 9: printf("%d", (*tp)()); 10: } 11: 12: return !!argv[argc]; 13: } 14: extern void X509_STORE_CTX_get0_cert(); 15: int t(void) { X509_STORE_CTX_get0_cert(); return 0; } /* end */ The second compilation succeeds. Specify the header for each checked function. https://github.com/ruby/openssl/commit/34ae7d92d0
2022-10-07Simplify default argument specification. (#6507)Samuel Williams
Notes: Merged-By: ioquatix <samuel@codeotaku.com>
2022-10-07Add IO#timeout attribute and use it for blocking IO operations. (#5653)Samuel Williams
Notes: Merged-By: ioquatix <samuel@codeotaku.com>
2022-07-08[ruby/openssl] Add 'ciphersuites=' method to allow setting of TLSv1.3 cipher ↵twkmd12
suites along with some unit tests (https://github.com/ruby/openssl/pull/493) Add OpenSSL::SSL::SSLContext#ciphersuites= method along with unit tests. https://github.com/ruby/openssl/commit/12250c7cef
2022-07-08[ruby/openssl] ignore pkgconfig when any openssl option is specifiedStefan Kaes
https://github.com/ruby/openssl/commit/b23fa75aa3
2022-07-07Fix extconf.rb for OpenSSL 3 without $warnflagsPeter Zhu
On Windows with OpenSSL 3, the gem fails to compile with the following error message: ruby/src/ext/openssl/extconf.rb:188: undefined method \`sub!' for nil:NilClass This is because $warnflags is nil. Notes: Merged: https://github.com/ruby/ruby/pull/6102
2022-03-16Suppress warnings by OpenSSL 3Nobuyoshi Nakada
Notes: Merged: https://github.com/ruby/ruby/pull/5667
2021-12-20[ruby/openssl] pkey: use EVP_PKEY_dup() if availableKazuki Yamaguchi
We can use it to implement OpenSSL::PKey::PKey#initialize_copy. This should work on all key types, not just DH/DSA/EC/RSA types. https://github.com/ruby/openssl/commit/66cd8cbaaf
2021-10-25[ruby/openssl] pkey, ssl: use EVP_PKEY_eq() instead of EVP_PKEY_cmp()Kazuki Yamaguchi
OpenSSL 3.0 renamed EVP_PKEY_cmp() to EVP_PKEY_eq() because that was a confusing name. https://github.com/ruby/openssl/commit/d42bd7fcdb
2021-10-25[ruby/openssl] hmac: use EVP_MD_CTX_get_pkey_ctx() instead of ↵Kazuki Yamaguchi
EVP_MD_CTX_pkey_ctx() OpenSSL 3.0 renamed EVP_MD_CTX_pkey_ctx() to include "get" in the function name. Adjust compatibility macro so that we can use the new function name for all OpenSSL 1.0.2-3.0. https://github.com/ruby/openssl/commit/c106d888c6
2021-10-25[ruby/openssl] digest: use EVP_MD_CTX_get0_md() instead of EVP_MD_CTX_md() ↵Kazuki Yamaguchi
if exists The function was renamed in OpenSSL 3.0 due to the change of the lifetime of EVP_MD objects. They are no longer necessarily statically allocated and can be reference-counted -- when an EVP_MD_CTX is free'd, the associated EVP_MD can also become inaccessible. Currently Ruby/OpenSSL only handles builtin algorithms, so no special handling is needed except for adapting to the rename. https://github.com/ruby/openssl/commit/0a253027e6
2021-10-25[ruby/openssl] bn: use BN_check_prime() in OpenSSL::BN#prime{,_fasttest}?Kazuki Yamaguchi
In OpenSSL 3.0, BN_is_prime_ex() and BN_is_prime_fasttest_ex() are deprecated in favor of BN_check_prime(). https://github.com/ruby/openssl/commit/90d51ef510
2021-10-25[ruby/openssl] ssl: use SSL_CTX_load_verify_{file,dir}() if availableKazuki Yamaguchi
SSL_CTX_load_verify_locations() is deprecated in OpenSSL 3.0 and replaced with those two separate functions. Use them if they exist. https://github.com/ruby/openssl/commit/5375a55ffc
2021-10-25[ruby/openssl] ts: use TS_VERIFY_CTX_set_certs instead of ↵Kazuki Yamaguchi
TS_VERIFY_CTS_set_certs OpenSSL 3.0 fixed the typo in the function name and replaced the current 'CTS' version with a macro. https://github.com/ruby/openssl/commit/2be6779b08
2021-10-25[ruby/openssl] ossl.c: use ERR_get_error_all() if availableKazuki Yamaguchi
OpenSSL 3.0 deprecated ERR_get_error_line_data() in favor of ERR_get_error_all(), as part of the error queue structure changes. https://github.com/ruby/openssl/commit/8e98d2ecc8
2021-10-16[ruby/openssl] ssl: add SSLContext#tmp_dh=Kazuki Yamaguchi
Provide a wrapper of SSL_set0_tmp_dh_pkey()/SSL_CTX_set_tmp_dh(), which sets the DH parameters used for ephemeral DH key exchange. SSLContext#tmp_dh_callback= already exists for this purpose, as a wrapper around SSL_CTX_set_tmp_dh_callback(), but it is considered obsolete and the OpenSSL API is deprecated for future removal. There is no practical use case where an application needs to use different DH parameters nowadays. This was originally introduced to support export grade ciphers. RDoc for #tmp_dh_callback= is updated to recommend the new #tmp_dh=. Note that current versions of OpenSSL support automatic ECDHE curve selection which is enabled by default. SSLContext#tmp_dh= should only be necessary if you must allow ancient clients which don't support ECDHE. https://github.com/ruby/openssl/commit/aa43da4f04
2021-07-18[ruby/openssl] Deprecate and rework old (fd) centric functionsSamuel Williams
[ky: fixed compatibility with older versions of Ruby] (cherry picked from commit ruby/ruby@45e65f302b663b2c6ab69df06d3b6f219c1797b2) https://github.com/ruby/openssl/commit/8d928e0fb9
2021-07-18[ruby/openssl] pkey/dh, pkey/ec: use EVP_PKEY_check() familyKazuki Yamaguchi
Use EVP_PKEY_param_check() instead of DH_check() if available. Also, use EVP_PKEY_public_check() instead of EC_KEY_check_key(). EVP_PKEY_*check() is part of the EVP API and is meant to replace those low-level functions. They were added by OpenSSL 1.1.1. It is currently not provided by LibreSSL. https://github.com/ruby/openssl/commit/797e9f8e08
2021-07-18[ruby/openssl] pkey: remove unused ossl_generate_cb_2() helper functionKazuki Yamaguchi
The previous series of commits re-implemented key generation with the low level API with the EVP API. The BN_GENCB-based callback function is no longer used. https://github.com/ruby/openssl/commit/81027b7463
2021-07-18[ruby/openssl] ossl.c: do not set locking callbacks on LibreSSLKazuki Yamaguchi
Similarly to OpenSSL >= 1.1.0, LibreSSL 2.9.0 ensures thread safety without requiring applications to set locking callbacks and made related functions no-op. https://github.com/ruby/openssl/commit/7276233e1a
2021-07-18[ruby/openssl] require OpenSSL >= 1.0.2 and LibreSSL >= 3.1Kazuki Yamaguchi
Clean up old version guards in preparation for the upcoming OpenSSL 3.0 support. OpenSSL 1.0.1 reached its EOL on 2016-12-31. At that time, we decided to keep 1.0.1 support because many major Linux distributions were still shipped with 1.0.1. Now, nearly 4 years later, most Linux distributions are reaching their EOL and it should be safe to assume nobody uses them anymore. Major ones that were using 1.0.1: - Ubuntu 14.04 is EOL since 2019-04-30 - RHEL 6 will reach EOL on 2020-11-30 LibreSSL 3.0 and older versions are no longer supported by the LibreSSL team as of October 2020. Note that OpenSSL 1.0.2 also reached EOL on 2019-12-31 and 1.1.0 also did on 2018-08-31. https://github.com/ruby/openssl/commit/c055938f4b
2021-03-16[ruby/openssl] ssl: remove SSL::SSLContext#tmp_ecdh_callbackKazuki Yamaguchi
The underlying API SSL_CTX_set_tmp_ecdh_callback() was removed by LibreSSL >= 2.6.1 and OpenSSL >= 1.1.0, in other words, it is not supported by any non-EOL versions of OpenSSL. The wrapper was initially implemented in Ruby 2.3 and has been deprecated since Ruby/OpenSSL 2.0 (bundled with Ruby 2.4) with explicit warning with rb_warn(). https://github.com/ruby/openssl/commit/ee037e1460 Notes: Merged: https://github.com/ruby/ruby/pull/4275
2021-03-16[ruby/openssl] hmac: migrate from the low-level HMAC API to the EVP APIKazuki Yamaguchi
Use the EVP API instead of the low-level HMAC API. Use of the HMAC API has been discouraged and is being marked as deprecated starting from OpenSSL 3.0.0. The two singleton methods OpenSSL::HMAC, HMAC.digest and HMAC.hexdigest are now in lib/openssl/hmac.rb. https://github.com/ruby/openssl/commit/0317e2fc02 Notes: Merged: https://github.com/ruby/ruby/pull/4275
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-13 18:40:44 +0000