From ee6ba41bfdc82110468598467cd10ce850b44f0c Mon Sep 17 00:00:00 2001
From: Kazuki Yamaguchi <k@rhe.jp>
Date: Sun, 14 Dec 2025 19:55:28 +0900
Subject: [ruby/openssl] Freeze more constants for Ractor compatibility

https://github.com/ruby/openssl/commit/695126f582
---
 ext/openssl/ossl.c          |  9 +++++++--
 ext/openssl/ossl_asn1.c     | 18 ++++++++++--------
 ext/openssl/ossl_x509.c     |  3 ++-
 ext/openssl/ossl_x509name.c |  1 +
 4 files changed, 20 insertions(+), 11 deletions(-)

(limited to 'ext')

diff --git a/ext/openssl/ossl.c b/ext/openssl/ossl.c
index 9c63d9451a..b2edafd876 100644
--- a/ext/openssl/ossl.c
+++ b/ext/openssl/ossl.c
@@ -1010,12 +1010,17 @@ Init_openssl(void)
     /*
      * Version of OpenSSL the ruby OpenSSL extension was built with
      */
-    rb_define_const(mOSSL, "OPENSSL_VERSION", rb_str_new2(OPENSSL_VERSION_TEXT));
+    rb_define_const(mOSSL, "OPENSSL_VERSION",
+                    rb_obj_freeze(rb_str_new_cstr(OPENSSL_VERSION_TEXT)));
 
     /*
      * Version of OpenSSL the ruby OpenSSL extension is running with
      */
-    rb_define_const(mOSSL, "OPENSSL_LIBRARY_VERSION", rb_str_new2(OpenSSL_version(OPENSSL_VERSION)));
+    rb_define_const(
+        mOSSL,
+        "OPENSSL_LIBRARY_VERSION",
+        rb_obj_freeze(rb_str_new_cstr(OpenSSL_version(OPENSSL_VERSION)))
+    );
 
     /*
      * Version number of OpenSSL the ruby OpenSSL extension was built with
diff --git a/ext/openssl/ossl_asn1.c b/ext/openssl/ossl_asn1.c
index 628140a75e..71a87f0463 100644
--- a/ext/openssl/ossl_asn1.c
+++ b/ext/openssl/ossl_asn1.c
@@ -1397,8 +1397,6 @@ void
 Init_ossl_asn1(void)
 {
 #undef rb_intern
-    VALUE ary;
-    int i;
 
     sym_UNIVERSAL = ID2SYM(rb_intern_const("UNIVERSAL"));
     sym_CONTEXT_SPECIFIC = ID2SYM(rb_intern_const("CONTEXT_SPECIFIC"));
@@ -1548,17 +1546,20 @@ Init_ossl_asn1(void)
     rb_define_module_function(mASN1, "traverse", ossl_asn1_traverse, 1);
     rb_define_module_function(mASN1, "decode", ossl_asn1_decode, 1);
     rb_define_module_function(mASN1, "decode_all", ossl_asn1_decode_all, 1);
-    ary = rb_ary_new();
 
+    VALUE ary = rb_ary_new_capa(ossl_asn1_info_size);
+    for (int i = 0; i < ossl_asn1_info_size; i++) {
+        const char *name = ossl_asn1_info[i].name;
+        if (name[0] == '[')
+            continue;
+        rb_define_const(mASN1, name, INT2NUM(i));
+        rb_ary_store(ary, i, rb_obj_freeze(rb_str_new_cstr(name)));
+    }
+    rb_obj_freeze(ary);
     /*
      * Array storing tag names at the tag's index.
      */
     rb_define_const(mASN1, "UNIVERSAL_TAG_NAME", ary);
-    for(i = 0; i < ossl_asn1_info_size; i++){
-        if(ossl_asn1_info[i].name[0] == '[') continue;
-        rb_define_const(mASN1, ossl_asn1_info[i].name, INT2NUM(i));
-        rb_ary_store(ary, i, rb_str_new2(ossl_asn1_info[i].name));
-    }
 
     /* Document-class: OpenSSL::ASN1::ASN1Data
      *
@@ -1880,6 +1881,7 @@ do{\
     rb_hash_aset(class_tag_map, cASN1GeneralString, INT2NUM(V_ASN1_GENERALSTRING));
     rb_hash_aset(class_tag_map, cASN1UniversalString, INT2NUM(V_ASN1_UNIVERSALSTRING));
     rb_hash_aset(class_tag_map, cASN1BMPString, INT2NUM(V_ASN1_BMPSTRING));
+    rb_obj_freeze(class_tag_map);
 
     id_each = rb_intern_const("each");
 }
diff --git a/ext/openssl/ossl_x509.c b/ext/openssl/ossl_x509.c
index e341ca1fbb..bc3914fda2 100644
--- a/ext/openssl/ossl_x509.c
+++ b/ext/openssl/ossl_x509.c
@@ -13,7 +13,8 @@ VALUE mX509;
 
 #define DefX509Const(x) rb_define_const(mX509, #x, INT2NUM(X509_##x))
 #define DefX509Default(x,i) \
-    rb_define_const(mX509, "DEFAULT_" #x, rb_str_new2(X509_get_default_##i()))
+    rb_define_const(mX509, "DEFAULT_" #x, \
+                    rb_obj_freeze(rb_str_new_cstr(X509_get_default_##i())))
 
 ASN1_TIME *
 ossl_x509_time_adjust(ASN1_TIME *s, VALUE time)
diff --git a/ext/openssl/ossl_x509name.c b/ext/openssl/ossl_x509name.c
index b91c92c1ff..5b3c3f7261 100644
--- a/ext/openssl/ossl_x509name.c
+++ b/ext/openssl/ossl_x509name.c
@@ -534,6 +534,7 @@ Init_ossl_x509name(void)
     rb_hash_aset(hash, rb_str_new2("DC"), ia5str);
     rb_hash_aset(hash, rb_str_new2("domainComponent"), ia5str);
     rb_hash_aset(hash, rb_str_new2("emailAddress"), ia5str);
+    rb_obj_freeze(hash);
 
     /*
      * The default object type template for name entries.
-- 
cgit v1.2.3