.gitignore

@@ -1 +1 @@
-SOURCES/ruby-2.5.9.tar.xz
+SOURCES/ruby-3.0.4.tar.xz

.ruby.metadata

@@ -1 +1 @@
-7be8dc2e6e534eb36bfdf9f017af512996ec99a6 SOURCES/ruby-2.5.9.tar.xz
+14461adca874d42a06a11851029dec877d9d28de SOURCES/ruby-3.0.4.tar.xz

SOURCES/abrt_prelude.rb

@@ -1,8 +0,0 @@
-if defined?(Gem)
-  require 'rubygems.rb'
-
-  begin
-    require 'abrt'
-  rescue LoadError
-  end
-end

SOURCES/macros.rubygems

@@ -9,6 +9,7 @@
 %gem_cache %{gem_dir}/cache/%{gem_name}-%{version}%{?prerelease}.gem
 %gem_spec %{gem_dir}/specifications/%{gem_name}-%{version}%{?prerelease}.gemspec
 %gem_docdir %{gem_dir}/doc/%{gem_name}-%{version}%{?prerelease}
+%gem_plugin %{gem_dir}/plugins/%{gem_name}_plugin.rb
 
 
 # %gem_install - Install gem into appropriate directory.
@@ -21,7 +22,7 @@
 %gem_install(d:n:) \
 mkdir -p %{-d*}%{!?-d:.%{gem_dir}} \
 \
-CONFIGURE_ARGS="--with-cflags='%{optflags}' $CONFIGURE_ARGS" \\\
+CONFIGURE_ARGS="--with-cflags='%{optflags}' --with-cxxflags='%{optflags}' --with-ldflags='%{build_ldflags}' $CONFIGURE_ARGS" \\\
 gem install \\\
         -V \\\
         --local \\\
@@ -32,16 +33,6 @@ gem install \\\
 %{nil}
 
 
-# For rubygems packages we want to filter out any provides caused by private
-# libs in %%{gem_archdir}.
-#
-# Note that this must be invoked in the spec file, preferably as
-# "%{?rubygems_default_filter}", before any %description block.
-%rubygems_default_filter %{expand: \
-%global __provides_exclude_from %{?__provides_exclude_from:%{__provides_exclude_from}|}^%{gem_extdir_mri}/.*\\\\.so$ \
-}
-
-
 # The 'read' command in %%gemspec_* macros is not essential, but it is usefull
 # to make the sript appear in build log.
 

SOURCES/ruby-1.9.3-mkmf-verbose.patch

@@ -11,7 +11,7 @@ diff --git a/lib/mkmf.rb b/lib/mkmf.rb
 index 682eb46..e6b1445 100644
 --- a/lib/mkmf.rb
 +++ b/lib/mkmf.rb
-@@ -1900,7 +1900,7 @@ def configuration(srcdir)
+@@ -1930,7 +1930,7 @@ def configuration(srcdir)
  SHELL = /bin/sh
  
  # V=0 quiet, V=1 verbose.  other values don't work.

SOURCES/ruby-2.1.0-Allow-to-specify-additional-preludes-by-configuratio.patch

@@ -1,58 +0,0 @@
-From 996012f6abe0ce4d68a2de9f249935c6d5b467bc Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?V=C3=ADt=20Ondruch?= <vondruch@redhat.com>
-Date: Fri, 4 Oct 2013 22:13:11 +0200
-Subject: [PATCH] Allow to specify addition preludes by configuration option.
-
----
- Makefile.in  | 2 ++
- common.mk    | 2 +-
- configure.ac | 7 +++++++
- 3 files changed, 10 insertions(+), 1 deletion(-)
-
-diff --git a/Makefile.in b/Makefile.in
-index 7e8ed82..7916993 100644
---- a/Makefile.in
-+++ b/Makefile.in
-@@ -119,6 +119,8 @@ XRUBY_RUBYLIBDIR = @XRUBY_RUBYLIBDIR@
- XRUBY_RUBYHDRDIR = @XRUBY_RUBYHDRDIR@
- BOOTSTRAPRUBY = @BOOTSTRAPRUBY@
- 
-+OPTIONAL_PRELUDES = @OPTIONAL_PRELUDES@
-+
- #### End of system configuration section. ####
- 
- MAJOR=	@MAJOR@
-diff --git a/common.mk b/common.mk
-index 5cfbc3d..3f0a82e 100644
---- a/common.mk
-+++ b/common.mk
-@@ -147,7 +147,7 @@ ALLOBJS       = $(NORMALMAINOBJ) $(MINIOBJS) $(COMMONOBJS) $(INITOBJS)
- GOLFOBJS      = goruby.$(OBJEXT) golf_prelude.$(OBJEXT)
- 
- DEFAULT_PRELUDES = $(GEM_PRELUDE)
--PRELUDE_SCRIPTS = $(srcdir)/prelude.rb $(DEFAULT_PRELUDES)
-+PRELUDE_SCRIPTS = $(srcdir)/prelude.rb $(DEFAULT_PRELUDES) $(OPTIONAL_PRELUDES)
- GEM_PRELUDE   = $(srcdir)/gem_prelude.rb
- PRELUDES      = {$(srcdir)}prelude.c {$(srcdir)}miniprelude.c
- GOLFPRELUDES  = {$(srcdir)}golf_prelude.c
-diff --git a/configure.ac b/configure.ac
-index 028ef7ca3e..cdeff87871 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -4397,6 +4397,13 @@ AC_SUBST(rubyarchhdrdir)dnl
- AC_SUBST(sitearchhdrdir)dnl
- AC_SUBST(vendorarchhdrdir)dnl
- 
-+AC_ARG_WITH(prelude,
-+		AS_HELP_STRING([--with-prelude=FILE-LIST], [specify additional preludes separated by space]),
-+		[prelude=$withval])
-+if test "$prelude" != ""; then
-+    AC_SUBST(OPTIONAL_PRELUDES, $prelude)
-+fi
-+
- AC_ARG_WITH(mantype,
- 	AS_HELP_STRING([--with-mantype=TYPE], [specify man page type; TYPE is one of man and doc]),
- 		[
--- 
-1.8.3.1
-

SOURCES/ruby-2.1.0-Enable-configuration-of-archlibdir.patch

@@ -8,10 +8,10 @@ Subject: [PATCH] Allow to configure libruby.so placement.
  1 file changed, 5 insertions(+)
 
 diff --git a/configure.ac b/configure.ac
-index 11fc237552..b77e88fc37 100644
+index d261ea57b5..3c13076b82 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -3642,6 +3642,11 @@ AS_IF([test ${multiarch+set}], [
+@@ -3240,6 +3240,11 @@ AS_IF([test ${multiarch+set}], [
  ])
  
  archlibdir='${libdir}/${arch}'
@@ -24,5 +24,5 @@ index 11fc237552..b77e88fc37 100644
  archincludedir='${includedir}/${arch}'
  sitearchincludedir='${includedir}/${sitearch}'
 -- 
-1.8.3.1
+2.22.0
 

SOURCES/ruby-2.1.0-Prevent-duplicated-paths-when-empty-version-string-i.patch

@@ -11,10 +11,10 @@ Subject: [PATCH] Prevent duplicated paths when empty version string is
  3 files changed, 15 insertions(+), 2 deletions(-)
 
 diff --git a/configure.ac b/configure.ac
-index 999e2d6d5d..11fc237552 100644
+index c42436c23d..d261ea57b5 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -4252,7 +4252,8 @@ AS_CASE(["$ruby_version_dir_name"],
+@@ -3886,7 +3886,8 @@ AS_CASE(["$ruby_version_dir_name"],
  ruby_version_dir=/'${ruby_version_dir_name}'
  
  if test -z "${ruby_version_dir_name}"; then
@@ -66,7 +66,7 @@ diff --git a/tool/mkconfig.rb b/tool/mkconfig.rb
 index 07076d4..35e6c3c 100755
 --- a/tool/mkconfig.rb
 +++ b/tool/mkconfig.rb
-@@ -111,7 +111,7 @@
+@@ -114,7 +114,7 @@
      val = val.gsub(/\$(?:\$|\{?(\w+)\}?)/) {$1 ? "$(#{$1})" : $&}.dump
      case name
      when /^prefix$/

SOURCES/ruby-2.1.0-always-use-i386.patch

@@ -8,10 +8,10 @@ Subject: [PATCH] Always use i386.
  1 file changed, 2 insertions(+)
 
 diff --git a/configure.ac b/configure.ac
-index b77e88fc37..6bba453e3c 100644
+index 3c13076b82..93af30321d 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -4316,6 +4316,8 @@ AC_SUBST(vendorarchdir)dnl
+@@ -3950,6 +3950,8 @@ AC_SUBST(vendorarchdir)dnl
  AC_SUBST(CONFIGURE, "`echo $0 | sed 's|.*/||'`")dnl
  AC_SUBST(configure_args, "`echo "${ac_configure_args}" | sed 's/\\$/$$/g'`")dnl
  

SOURCES/ruby-2.1.0-custom-rubygems-location.patch

@@ -8,14 +8,14 @@ Subject: [PATCH] Allow to install RubyGems into custom location, outside of
  configure.ac            |  5 +++++
  loadpath.c              |  4 ++++
  template/verconf.h.tmpl |  3 +++
- tool/rbinstall.rb       | 7 +++++++
- 4 files changed, 19 insertions(+)
+ tool/rbinstall.rb       | 10 ++++++++++
+ 4 files changed, 22 insertions(+)
 
 diff --git a/configure.ac b/configure.ac
-index 6bba453e3c..028ef7ca3e 100644
+index 93af30321d..bc13397e0e 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -4288,6 +4288,10 @@ AC_ARG_WITH(vendorarchdir,
+@@ -3922,6 +3922,10 @@ AC_ARG_WITH(vendorarchdir,
              [vendorarchdir=$withval],
              [vendorarchdir=${multiarch+'${rubysitearchprefix}/vendor_ruby'${ruby_version_dir}}${multiarch-'${vendorlibdir}/${sitearch}'}])
  
@@ -26,7 +26,7 @@ index 6bba453e3c..028ef7ca3e 100644
  AS_IF([test "${LOAD_RELATIVE+set}"], [
      AC_DEFINE_UNQUOTED(LOAD_RELATIVE, $LOAD_RELATIVE)
      RUBY_EXEC_PREFIX=''
-@@ -4312,6 +4316,7 @@ AC_SUBST(sitearchdir)dnl
+@@ -3946,6 +3950,7 @@ AC_SUBST(sitearchdir)dnl
  AC_SUBST(vendordir)dnl
  AC_SUBST(vendorlibdir)dnl
  AC_SUBST(vendorarchdir)dnl
@@ -64,27 +64,30 @@ index 79c003e..34f2382 100644
  % R = {}
  % R["ruby_version"] = '"RUBY_LIB_VERSION"'
 diff --git a/tool/rbinstall.rb b/tool/rbinstall.rb
-index b47b6e1..0b99408 100755
+index e9110a17ca..76a1f0a315 100755
 --- a/tool/rbinstall.rb
 +++ b/tool/rbinstall.rb
-@@ -335,6 +335,7 @@ def CONFIG.[](name, mandatory = false)
+@@ -349,6 +349,7 @@ def CONFIG.[](name, mandatory = false)
    vendorlibdir = CONFIG["vendorlibdir"]
    vendorarchlibdir = CONFIG["vendorarchdir"]
  end
 +rubygemsdir = CONFIG["rubygemsdir"]
  mandir = CONFIG["mandir", true]
  docdir = CONFIG["docdir", true]
- configure_args = Shellwords.shellwords(CONFIG["configure_args"])
-@@ -541,7 +542,13 @@ def install(src, cmd)
+ enable_shared = CONFIG["ENABLE_SHARED"] == 'yes'
+@@ -581,7 +582,16 @@ def stub
  install?(:local, :comm, :lib) do
    prepare "library scripts", rubylibdir
    noinst = %w[*.txt *.rdoc *.gemspec]
-+  noinst += %w[rubygems.rb rubygems/ datadir.rb] if rubygemsdir
++  # Bundler carries "rubygems.rb" file, so it must be specialcased :/
++  noinst += %w[rubygems.rb rubygems/ bundler.rb bundler/] if rubygemsdir
    install_recursive(File.join(srcdir, "lib"), rubylibdir, :no_install => noinst, :mode => $data_mode)
 +  if rubygemsdir
-+    noinst = %w[obsolete.rb]
-+    install_recursive(File.join(srcdir, "lib", "rubygems"), File.join(rubygemsdir, "rubygems"), :mode => $data_mode)
++    noinst = %w[*.txt *.rdoc *.gemspec]
++    install_recursive(File.join(srcdir, "lib", "rubygems"), File.join(rubygemsdir, "rubygems"), :no_install => noinst, :mode => $data_mode)
 +    install(File.join(srcdir, "lib", "rubygems.rb"), File.join(rubygemsdir, "rubygems.rb"), :mode => $data_mode)
++    install_recursive(File.join(srcdir, "lib", "bundler"), File.join(rubylibdir, "bundler"), :no_install => noinst, :mode => $data_mode)
++    install(File.join(srcdir, "lib", "bundler.rb"), rubylibdir, :mode => $data_mode)
 +  end
  end
  

SOURCES/ruby-2.2.3-Generate-preludes-using-miniruby.patch

@@ -1,28 +0,0 @@
-From 07eb5f5e775dec01a92a8b13910eaced9e8ee0cd Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?V=C3=ADt=20Ondruch?= <vondruch@redhat.com>
-Date: Tue, 2 Dec 2014 10:56:58 +0100
-Subject: [PATCH] Generate preludes using miniruby.
-
----
- common.mk | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/common.mk b/common.mk
-index 168dc52..20c218a 100644
---- a/common.mk
-+++ b/common.mk
-@@ -962,9 +962,9 @@ $(MINIPRELUDE_C): $(COMPILE_PRELUDE)
- 		$(srcdir)/template/prelude.c.tmpl
- 
- $(PRELUDE_C): $(COMPILE_PRELUDE) \
--	   $(PRELUDE_SCRIPTS)
-+	   $(PRELUDE_SCRIPTS) $(PREP)
- 	$(ECHO) generating $@
--	$(Q) $(BASERUBY) $(srcdir)/tool/generic_erb.rb -I$(srcdir) -c -o $@ \
-+	$(Q) $(MINIRUBY) $(srcdir)/tool/generic_erb.rb -I$(srcdir) -c -o $@ \
- 		$(srcdir)/template/prelude.c.tmpl $(PRELUDE_SCRIPTS)
- 
- {$(VPATH)}golf_prelude.c: $(COMPILE_PRELUDE) {$(srcdir)}golf_prelude.rb
--- 
-2.6.3
-

SOURCES/ruby-2.3.0-ruby_version.patch

@@ -12,15 +12,15 @@ ruby_version_dir_name now specifies custom version string for versioned
 directories, e.g. instead of default X.Y.Z, you can specify whatever
 string.
 ---
- configure.ac        | 64 ++++++++++++++++++++++++++++-------------------------
+ configure.ac        | 64 ++++++++++++++++++++++++---------------------
  template/ruby.pc.in |  1 +
  2 files changed, 35 insertions(+), 30 deletions(-)
 
 diff --git a/configure.ac b/configure.ac
-index 8ea969412f..a00f2b6776 100644
+index 80b137e380..63cd3b4f8b 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -4203,9 +4203,6 @@ AS_CASE(["$target_os"],
+@@ -3837,9 +3837,6 @@ AS_CASE(["$target_os"],
      rubyw_install_name='$(RUBYW_INSTALL_NAME)'
      ])
  
@@ -30,7 +30,7 @@ index 8ea969412f..a00f2b6776 100644
  rubyarchprefix=${multiarch+'${archlibdir}/${RUBY_BASE_NAME}'}${multiarch-'${rubylibprefix}/${arch}'}
  AC_ARG_WITH(rubyarchprefix,
  	    AS_HELP_STRING([--with-rubyarchprefix=DIR],
-@@ -4228,56 +4225,62 @@ AC_ARG_WITH(ridir,
+@@ -3862,56 +3859,62 @@ AC_ARG_WITH(ridir,
  AC_SUBST(ridir)
  AC_SUBST(RI_BASE_NAME)
  
@@ -120,7 +120,7 @@ index 8ea969412f..a00f2b6776 100644
  
  AS_IF([test "${LOAD_RELATIVE+set}"], [
      AC_DEFINE_UNQUOTED(LOAD_RELATIVE, $LOAD_RELATIVE)
-@@ -4294,6 +4297,7 @@ AC_SUBST(sitearchincludedir)dnl
+@@ -3928,6 +3931,7 @@ AC_SUBST(sitearchincludedir)dnl
  AC_SUBST(arch)dnl
  AC_SUBST(sitearch)dnl
  AC_SUBST(ruby_version)dnl
@@ -165,74 +165,66 @@ index 970cb91..5bf8230 100644
 -  version = RbConfig::CONFIG['ruby_version']
 +  version = RbConfig::CONFIG['ruby_version_dir_name'] || RbConfig::CONFIG['ruby_version']
  
-   BASE    = if RbConfig::CONFIG.key? 'ridir' then
-               File.join RbConfig::CONFIG['ridir'], version
+   BASE    = File.join RbConfig::CONFIG['ridir'], version
+ 
 diff --git a/tool/rbinstall.rb b/tool/rbinstall.rb
 index d4c110e..d39c9a6 100755
 --- a/tool/rbinstall.rb
 +++ b/tool/rbinstall.rb
-@@ -421,7 +421,7 @@ def CONFIG.[](name, mandatory = false)
+@@ -439,7 +439,7 @@ def CONFIG.[](name, mandatory = false)
  
  install?(:doc, :rdoc) do
    if $rdocdir
 -    ridatadir = File.join(CONFIG['ridir'], CONFIG['ruby_version'], "system")
 +    ridatadir = File.join(CONFIG['ridir'], CONFIG['ruby_version_dir_name'] || CONFIG['ruby_version'], "system")
      prepare "rdoc", ridatadir
-     install_recursive($rdocdir, ridatadir, :mode => $data_mode)
+     install_recursive($rdocdir, ridatadir, :no_install => rdoc_noinst, :mode => $data_mode)
    end
 -- 
-2.1.0
+2.23.0
 
 
-From f8d136f9a46d1fe87eba622ab9665935d05e981b Mon Sep 17 00:00:00 2001
+From 9f0ec0233f618cbb862629816b22491c3df79578 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?V=C3=ADt=20Ondruch?= <vondruch@redhat.com>
 Date: Tue, 31 Mar 2015 16:37:44 +0200
 Subject: [PATCH 3/4] Add ruby_version_dir_name support for RubyGems.
 
 ---
- lib/rubygems/defaults.rb  | 11 ++++++-----
+ lib/rubygems/defaults.rb  | 9 +++++----
  test/rubygems/test_gem.rb | 5 +++--
- 2 files changed, 9 insertions(+), 7 deletions(-)
+ 2 files changed, 8 insertions(+), 6 deletions(-)
 
 diff --git a/lib/rubygems/defaults.rb b/lib/rubygems/defaults.rb
-index 55ca080..75eea2b 100644
+index d4ff4a262c..3f9a5bf590 100644
 --- a/lib/rubygems/defaults.rb
 +++ b/lib/rubygems/defaults.rb
-@@ -32,20 +32,20 @@ def self.default_dir
+@@ -38,13 +38,13 @@ def self.default_dir
               [
                 File.dirname(RbConfig::CONFIG['sitedir']),
                 'Gems',
--               RbConfig::CONFIG['ruby_version']
-+               RbConfig::CONFIG['ruby_version_dir_name'] || RbConfig::CONFIG['ruby_version']
-              ]
-            elsif RbConfig::CONFIG['rubylibprefix'] then
-              [
-               RbConfig::CONFIG['rubylibprefix'],
-               'gems',
--              RbConfig::CONFIG['ruby_version']
+-               RbConfig::CONFIG['ruby_version'],
 +               RbConfig::CONFIG['ruby_version_dir_name'] || RbConfig::CONFIG['ruby_version']
               ]
             else
               [
-                RbConfig::CONFIG['libdir'],
-                ruby_engine,
+                RbConfig::CONFIG['rubylibprefix'],
                 'gems',
--               RbConfig::CONFIG['ruby_version']
+-               RbConfig::CONFIG['ruby_version'],
 +               RbConfig::CONFIG['ruby_version_dir_name'] || RbConfig::CONFIG['ruby_version']
               ]
             end
  
-@@ -75,7 +75,8 @@ def self.default_rubygems_dirs
- 
-   def self.user_dir
-     parts = [Gem.user_home, '.gem', ruby_engine]
+@@ -117,7 +117,8 @@ def self.user_dir
+     gem_dir = File.join(Gem.user_home, ".gem")
+     gem_dir = File.join(Gem.data_home, "gem") unless File.exist?(gem_dir)
+     parts = [gem_dir, ruby_engine]
 -    parts << RbConfig::CONFIG['ruby_version'] unless RbConfig::CONFIG['ruby_version'].empty?
 +    ruby_version_dir_name = RbConfig::CONFIG['ruby_version_dir_name'] || RbConfig::CONFIG['ruby_version']
 +    parts << ruby_version_dir_name unless ruby_version_dir_name.empty?
      File.join parts
    end
  
-@@ -172,7 +173,7 @@ def self.vendor_dir # :nodoc:
+@@ -252,7 +253,7 @@ def self.vendor_dir # :nodoc:
      return nil unless RbConfig::CONFIG.key? 'vendordir'
  
      File.join RbConfig::CONFIG['vendordir'], 'gems',
@@ -242,10 +234,10 @@ index 55ca080..75eea2b 100644
  
    ##
 diff --git a/test/rubygems/test_gem.rb b/test/rubygems/test_gem.rb
-index 0428bea..b6e090e 100644
+index b25068405d..e9fef4a311 100644
 --- a/test/rubygems/test_gem.rb
 +++ b/test/rubygems/test_gem.rb
-@@ -1191,7 +1191,8 @@ def test_self_use_paths
+@@ -1440,7 +1440,8 @@ def test_self_use_paths
  
    def test_self_user_dir
      parts = [@userhome, '.gem', Gem.ruby_engine]
@@ -253,10 +245,10 @@ index 0428bea..b6e090e 100644
 +    ruby_version_dir_name = RbConfig::CONFIG['ruby_version_dir_name'] || RbConfig::CONFIG['ruby_version']
 +    parts << ruby_version_dir_name unless ruby_version_dir_name.empty?
  
-     assert_equal File.join(parts), Gem.user_dir
-   end
-@@ -1318,7 +1319,7 @@ def test_self_user_home_user_drive_and_path
-   def test_self_vendor_dir
+     FileUtils.mkdir_p File.join(parts)
+ 
+@@ -1516,7 +1517,7 @@ def test_self_vendor_dir
+     vendordir(File.join(@tempdir, 'vendor')) do
        expected =
          File.join RbConfig::CONFIG['vendordir'], 'gems',
 -                  RbConfig::CONFIG['ruby_version']
@@ -282,15 +274,15 @@ diff --git a/configure.ac b/configure.ac
 index a00f2b6776..999e2d6d5d 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -164,7 +164,7 @@ RUBY_BASE_NAME=`echo ruby | sed "$program_transform_name"`
+@@ -107,7 +107,7 @@ RUBY_BASE_NAME=`echo ruby | sed "$program_transform_name"`
  RUBYW_BASE_NAME=`echo rubyw | sed "$program_transform_name"`
  AC_SUBST(RUBY_BASE_NAME)
  AC_SUBST(RUBYW_BASE_NAME)
 -AC_SUBST(RUBY_VERSION_NAME, '${RUBY_BASE_NAME}-${ruby_version}')
 +AC_SUBST(RUBY_VERSION_NAME, '${RUBY_BASE_NAME}-${ruby_version_dir_name}')
  
- AC_CANONICAL_TARGET
- test x"$target_alias" = x &&
+ dnl checks for alternative programs
+ AC_CANONICAL_BUILD
 -- 
 2.1.0
 

SOURCES/ruby-2.5.0-Add-Gem.operating_system_defaults.patch

@@ -1,80 +0,0 @@
-From 60eb961c25f801ee43ca1be9393ab2f0a0546677 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?V=C3=ADt=20Ondruch?= <vondruch@redhat.com>
-Date: Tue, 19 Dec 2017 14:00:20 +0100
-Subject: [PATCH] Add Gem.operating_system_defaults to allow packagers to
- override defaults.
-
-This change allows Ruby packagers to override defaults and lazily query
-them.
-
-This is very much the same change as #1644 to treat the
-operating_system defaults the same way as platform defaults.
----
- lib/rubygems/config_file.rb |  2 +-
- lib/rubygems/defaults.rb    | 21 ++++++++++++++++++++-
- test/rubygems/test_gem.rb   |  7 +++++++
- 3 files changed, 28 insertions(+), 2 deletions(-)
-
-diff --git a/lib/rubygems/config_file.rb b/lib/rubygems/config_file.rb
-index a4efed0f5a..deee38e6d9 100644
---- a/lib/rubygems/config_file.rb
-+++ b/lib/rubygems/config_file.rb
-@@ -48,7 +48,7 @@ class Gem::ConfigFile
-   # For Ruby packagers to set configuration defaults.  Set in
-   # rubygems/defaults/operating_system.rb
- 
--  OPERATING_SYSTEM_DEFAULTS = {}
-+  OPERATING_SYSTEM_DEFAULTS = Gem.operating_system_defaults
- 
-   ##
-   # For Ruby implementers to set configuration defaults.  Set in
-diff --git a/lib/rubygems/defaults.rb b/lib/rubygems/defaults.rb
-index 43d57fc808..b8222877ae 100644
---- a/lib/rubygems/defaults.rb
-+++ b/lib/rubygems/defaults.rb
-@@ -177,7 +177,26 @@ def self.vendor_dir # :nodoc:
-   end
- 
-   ##
--  # Default options for gem commands.
-+  # Default options for gem commands for Ruby packagers.
-+  #
-+  # The options here should be structured as an array of string "gem"
-+  # command names as keys and a string of the default options as values.
-+  #
-+  # Example:
-+  #
-+  # def self.operating_system_defaults
-+  #   {
-+  #       'install' => '--no-rdoc --no-ri --env-shebang',
-+  #       'update' => '--no-rdoc --no-ri --env-shebang'
-+  #   }
-+  # end
-+
-+  def self.operating_system_defaults
-+    {}
-+  end
-+
-+  ##
-+  # Default options for gem commands for Ruby implementers.
-   #
-   # The options here should be structured as an array of string "gem"
-   # command names as keys and a string of the default options as values.
-diff --git a/test/rubygems/test_gem.rb b/test/rubygems/test_gem.rb
-index 3225a05c6b..62b80c4945 100644
---- a/test/rubygems/test_gem.rb
-+++ b/test/rubygems/test_gem.rb
-@@ -1837,6 +1837,13 @@ def test_use_gemdeps_specific
-     ENV['RUBYGEMS_GEMDEPS'] = rubygems_gemdeps
-   end
- 
-+  def test_operating_system_defaults
-+    operating_system_defaults = Gem.operating_system_defaults
-+
-+    assert operating_system_defaults != nil
-+    assert operating_system_defaults.is_a? Hash
-+  end
-+
-   def test_platform_defaults
-     platform_defaults = Gem.platform_defaults
- 

SOURCES/ruby-2.5.1-Avoid-need-of-C++-compiler-to-pass-the-test-suite.patch

@@ -1,35 +0,0 @@
-From 51e2c91412a511196e58efea5b87c460b4fa6a20 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?V=C3=ADt=20Ondruch?= <vondruch@redhat.com>
-Date: Thu, 26 Jul 2018 13:17:52 +0200
-Subject: [PATCH] Avoid need of C++ compiler to pass the test suite.
-
-The test suite fails when C++ compiler is not available on the system:
-
-~~~
-TestGemExtCmakeBuilder#test_self_build:
-Gem::InstallError: cmake failed, exit code 1
-    /builddir/build/BUILD/ruby-2.5.1/lib/rubygems/ext/builder.rb:92:in `run'
-    /builddir/build/BUILD/ruby-2.5.1/lib/rubygems/ext/cmake_builder.rb:10:in `build'
-    /builddir/build/BUILD/ruby-2.5.1/test/rubygems/test_gem_ext_cmake_builder.rb:37:in `block in test_self_build'
-    /builddir/build/BUILD/ruby-2.5.1/test/rubygems/test_gem_ext_cmake_builder.rb:36:in `chdir'
-    /builddir/build/BUILD/ruby-2.5.1/test/rubygems/test_gem_ext_cmake_builder.rb:36:in `test_self_build'
-~~~
-
-But there is nothing which would realy required C++. It is just CMake
-default to check for C++.
----
- test/rubygems/test_gem_ext_cmake_builder.rb | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/test/rubygems/test_gem_ext_cmake_builder.rb b/test/rubygems/test_gem_ext_cmake_builder.rb
-index 76d3cb2afe..2d449fc2fd 100644
---- a/test/rubygems/test_gem_ext_cmake_builder.rb
-+++ b/test/rubygems/test_gem_ext_cmake_builder.rb
-@@ -25,6 +25,7 @@ def test_self_build
-     File.open File.join(@ext, 'CMakeLists.txt'), 'w' do |cmakelists|
-       cmakelists.write <<-eo_cmake
- cmake_minimum_required(VERSION 2.6)
-+project(self_build LANGUAGES NONE)
- install (FILES test.txt DESTINATION bin)
-       eo_cmake
-     end

SOURCES/ruby-2.5.9-revert-stop-the-error-due-to-openssl-1-1-1h.patch

@@ -1,46 +0,0 @@
-From 93e6364a848f00b34647b13063dceb854dfaa11e Mon Sep 17 00:00:00 2001
-From: usa <usa@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>
-Date: Wed, 28 Oct 2020 13:12:06 +0000
-Subject: [PATCH] merge revision(s): 07786ed
-
-	* test/net/http/test_https.rb: Stop the error due to openssl 1.1.1h
-
-	On some environments that uses OpenSSL 1.1.1h, the two tests now fail.
-
-	http://rubyci.s3.amazonaws.com/android29-x86_64/ruby-master/log/20200924T062352Z.fail.html.gz
-	https://github.com/ruby/ruby/runs/1159288773?check_suite_focus=true
-
-	```
-	  1) Failure:
-	TestNetHTTPS#test_get [/data/data/com.termux/files/home/cb/tmp/build/202	00924T062352Z/ruby/test/net/http/test_https.rb:47]:
-	<"0\x82\x03\xED0\x82\x02\xD5\xA0\x03..."> expected but was
-	<"0\x82\x03\xE30\x82\x02\xCB\xA0\x03...">.
-	```
-
-	Not sure why, but verify_callback now seems to receive only SERVER_CERT
-	but not CA_CERT.
-	It would be good to investigate the issue furthermore, but tentatively,
-	I want to stop the failures.
-
-
-git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67887 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
----
- test/net/http/test_https.rb | 6 ++++--
-
-diff --git a/test/net/http/test_https.rb b/test/net/http/test_https.rb
-index c1d486470ae2..3a2341024121 100644
---- a/test/net/http/test_https.rb
-+++ b/test/net/http/test_https.rb
-@@ -44,8 +44,10 @@ def test_get
-     http.request_get("/") {|res|
-       assert_equal($test_net_http_data, res.body)
-     }
--    assert_equal(CA_CERT.to_der, certs[0].to_der)
--    assert_equal(SERVER_CERT.to_der, certs[1].to_der)
-+    # TODO: OpenSSL 1.1.1h seems to yield only SERVER_CERT; need to check the incompatibility
-+    certs.zip([SERVER_CERT, CA_CERT]) do |actual, expected|
-+      assert_equal(expected.to_der, actual.to_der)
-+    end
-   rescue SystemCallError
-     skip $!
-   end

SOURCES/ruby-2.6.0-Fix-issues-detected-by-code-analysis-tool.patch

@@ -1,78 +0,0 @@
-From 893949167bdb911c7db9fd59de85f288c09741e1 Mon Sep 17 00:00:00 2001
-From: nobu <nobu@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>
-Date: Sat, 15 Sep 2018 09:59:14 +0000
-Subject: [PATCH] Fix issues detected by code analysis tool (mainly Coverity).
-
-* Fix leaked storage in addr2line.c.
-* Fix for "top_root" leaking the resource.
-
-[Fix GH-1956]
-
-From: Jun Aruga <jaruga@redhat.com>
-
-git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@64750 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
----
- addr2line.c | 8 ++++++--
- regcomp.c   | 3 +++
- 2 files changed, 9 insertions(+), 2 deletions(-)
-
-diff --git a/addr2line.c b/addr2line.c
-index 2c422cc1697a..b266e44d5d4b 100644
---- a/addr2line.c
-+++ b/addr2line.c
-@@ -593,11 +593,12 @@ fill_lines(int num_traces, void **traces, int check_debuglink,
- 		h = dlopen(NULL, RTLD_NOW|RTLD_LOCAL);
- 		if (!h) continue;
- 		s = dlsym(h, strtab + sym->st_name);
--		if (!s) continue;
--		if (dladdr(s, &info)) {
-+		if (s && dladdr(s, &info)) {
- 		    dladdr_fbase = (uintptr_t)info.dli_fbase;
-+                    dlclose(h);
- 		    break;
- 		}
-+                dlclose(h);
- 	    }
- 	    if (ehdr->e_type == ET_EXEC) {
- 		obj->base_addr = 0;
-@@ -655,6 +656,9 @@ fill_lines(int num_traces, void **traces, int check_debuglink,
- finish:
-     return dladdr_fbase;
- fail:
-+    if (file != NULL) {
-+        munmap(file, (size_t)filesize);
-+    }
-     return (uintptr_t)-1;
- }
- 
-diff --git a/regcomp.c b/regcomp.c
-index 0f6bee60d576..df7f73bac501 100644
---- a/regcomp.c
-+++ b/regcomp.c
-@@ -3596,6 +3596,7 @@ expand_case_fold_string(Node* node, regex_t* reg)
-     if (n == 0 || varlen == 0) {
-       if (IS_NULL(snode)) {
- 	if (IS_NULL(root) && IS_NOT_NULL(prev_node)) {
-+          onig_node_free(top_root);
- 	  top_root = root = onig_node_list_add(NULL_NODE, prev_node);
- 	  if (IS_NULL(root)) {
- 	    onig_node_free(prev_node);
-@@ -3627,6 +3628,7 @@ expand_case_fold_string(Node* node, regex_t* reg)
- 	}
-       }
-       if (IS_NULL(root) && IS_NOT_NULL(prev_node)) {
-+        onig_node_free(top_root);
- 	top_root = root = onig_node_list_add(NULL_NODE, prev_node);
- 	if (IS_NULL(root)) {
- 	  onig_node_free(prev_node);
-@@ -3677,6 +3679,7 @@ expand_case_fold_string(Node* node, regex_t* reg)
-     if (r != 0) goto mem_err;
- 
-     if (IS_NOT_NULL(prev_node) && IS_NULL(root)) {
-+      onig_node_free(top_root);
-       top_root = root = onig_node_list_add(NULL_NODE, prev_node);
-       if (IS_NULL(root)) {
- 	onig_node_free(srem);
--- 
-2.21.0
-

SOURCES/ruby-2.6.0-config-support-include-directive.patch

@@ -1,182 +0,0 @@
-From f46bac1f3e8634e24c747d06b28e11b874f1e488 Mon Sep 17 00:00:00 2001
-From: Kazuki Yamaguchi <k@rhe.jp>
-Date: Thu, 16 Aug 2018 19:40:48 +0900
-Subject: [PATCH] config: support .include directive
-
-OpenSSL 1.1.1 introduces a new '.include' directive. Update our config
-parser to support that.
-
-As mentioned in the referenced GitHub issue, we should use the OpenSSL
-API instead of implementing the parsing logic ourselves, but it will
-need backwards-incompatible changes which we can't backport to stable
-versions. So continue to use the Ruby implementation for now.
-
-Reference: https://github.com/ruby/openssl/issues/208
----
- ext/openssl/lib/openssl/config.rb | 54 ++++++++++++++++++++++++++++---------------
- test/openssl/test_config.rb   | 54 +++++++++++++++++++++++++++++++++++++++++++
- 2 files changed, 90 insertions(+), 18 deletions(-)
-
-diff --git a/ext/openssl/lib/openssl/config.rb b/ext/openssl/lib/openssl/config.rb
-index 88225451..ba3a54c8 100644
---- a/ext/openssl/lib/openssl/config.rb
-+++ b/ext/openssl/lib/openssl/config.rb
-@@ -77,29 +77,44 @@ def get_key_string(data, section, key) # :nodoc:
-       def parse_config_lines(io)
-         section = 'default'
-         data = {section => {}}
--        while definition = get_definition(io)
-+        io_stack = [io]
-+        while definition = get_definition(io_stack)
-           definition = clear_comments(definition)
-           next if definition.empty?
--          if definition[0] == ?[
-+          case definition
-+          when /\A\[/
-             if /\[([^\]]*)\]/ =~ definition
-               section = $1.strip
-               data[section] ||= {}
-             else
-               raise ConfigError, "missing close square bracket"
-             end
--          else
--            if /\A([^:\s]*)(?:::([^:\s]*))?\s*=(.*)\z/ =~ definition
--              if $2
--                section = $1
--                key = $2
--              else
--                key = $1
-+          when /\A\.include (.+)\z/
-+            path = $1
-+            if File.directory?(path)
-+              files = Dir.glob(File.join(path, "*.{cnf,conf}"), File::FNM_EXTGLOB)
-+            else
-+              files = [path]
-+            end
-+
-+            files.each do |filename|
-+              begin
-+                io_stack << StringIO.new(File.read(filename))
-+              rescue
-+                raise ConfigError, "could not include file '%s'" % filename
-               end
--              value = unescape_value(data, section, $3)
--              (data[section] ||= {})[key] = value.strip
-+            end
-+          when /\A([^:\s]*)(?:::([^:\s]*))?\s*=(.*)\z/
-+            if $2
-+              section = $1
-+              key = $2
-             else
--              raise ConfigError, "missing equal sign"
-+              key = $1
-             end
-+            value = unescape_value(data, section, $3)
-+            (data[section] ||= {})[key] = value.strip
-+          else
-+            raise ConfigError, "missing equal sign"
-           end
-         end
-         data
-@@ -212,10 +227,10 @@ def clear_comments(line)
-         scanned.join
-       end
- 
--      def get_definition(io)
--        if line = get_line(io)
-+      def get_definition(io_stack)
-+        if line = get_line(io_stack)
-           while /[^\\]\\\z/ =~ line
--            if extra = get_line(io)
-+            if extra = get_line(io_stack)
-               line += extra
-             else
-               break
-@@ -225,9 +240,12 @@ def get_definition(io)
-         end
-       end
- 
--      def get_line(io)
--        if line = io.gets
--          line.gsub(/[\r\n]*/, '')
-+      def get_line(io_stack)
-+        while io = io_stack.last
-+          if line = io.gets
-+            return line.gsub(/[\r\n]*/, '')
-+          end
-+          io_stack.pop
-         end
-       end
-     end
-diff --git a/test/openssl/test_config.rb b/test/openssl/test_config.rb
-index 99dcc497..5653b5d0 100644
---- a/test/openssl/test_config.rb
-+++ b/test/openssl/test_config.rb
-@@ -120,6 +120,49 @@ def test_s_parse_format
-     assert_equal("error in line 7: missing close square bracket", excn.message)
-   end
- 
-+  def test_s_parse_include
-+    in_tmpdir("ossl-config-include-test") do |dir|
-+      Dir.mkdir("child")
-+      File.write("child/a.conf", <<~__EOC__)
-+        [default]
-+        file-a = a.conf
-+        [sec-a]
-+        a = 123
-+      __EOC__
-+      File.write("child/b.cnf", <<~__EOC__)
-+        [default]
-+        file-b = b.cnf
-+        [sec-b]
-+        b = 123
-+      __EOC__
-+      File.write("include-child.conf", <<~__EOC__)
-+        key_outside_section = value_a
-+        .include child
-+      __EOC__
-+
-+      include_file = <<~__EOC__
-+        [default]
-+        file-main = unnamed
-+        [sec-main]
-+        main = 123
-+        .include include-child.conf
-+      __EOC__
-+
-+      # Include a file by relative path
-+      c1 = OpenSSL::Config.parse(include_file)
-+      assert_equal(["default", "sec-a", "sec-b", "sec-main"], c1.sections.sort)
-+      assert_equal(["file-main", "file-a", "file-b"], c1["default"].keys)
-+      assert_equal({"a" => "123"}, c1["sec-a"])
-+      assert_equal({"b" => "123"}, c1["sec-b"])
-+      assert_equal({"main" => "123", "key_outside_section" => "value_a"}, c1["sec-main"])
-+
-+      # Relative paths are from the working directory
-+      assert_raise(OpenSSL::ConfigError) do
-+        Dir.chdir("child") { OpenSSL::Config.parse(include_file) }
-+      end
-+    end
-+  end
-+
-   def test_s_load
-     # alias of new
-     c = OpenSSL::Config.load
-@@ -299,6 +342,17 @@ def test_clone
-     @it['newsection'] = {'a' => 'b'}
-     assert_not_equal(@it.sections.sort, c.sections.sort)
-   end
-+
-+  private
-+
-+  def in_tmpdir(*args)
-+    Dir.mktmpdir(*args) do |dir|
-+      dir = File.realpath(dir)
-+      Dir.chdir(dir) do
-+        yield dir
-+      end
-+    end
-+  end
- end
- 
- end

SOURCES/ruby-2.6.0-configure-fstack-protector-strong.patch

@@ -1,43 +0,0 @@
-From c8ccdbfe1e45cb3b832109d644296c0a3b3e0b59 Mon Sep 17 00:00:00 2001
-From: nobu <nobu@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>
-Date: Sun, 2 Sep 2018 03:49:31 +0000
-Subject: [PATCH] configure.ac: -fstack-protector-strong
-
-* configure.ac: use -fstack-protector-strong if available instead of
-  -fstack-protector conditionally.  [ruby-core:88788] [Misc #15053]
-
-git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@64614 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
----
- configure.ac | 17 ++++++++++-------
- 1 file changed, 10 insertions(+), 7 deletions(-)
-
-diff --git a/configure.ac b/configure.ac
-index 9328fa532de0..b8ee57239215 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -837,15 +837,18 @@ AS_IF([test "$GCC" = yes], [
- 	stack_protector=no
-     ])
-     AS_IF([test -z "${stack_protector+set}"], [
--	RUBY_TRY_CFLAGS(-fstack-protector, [stack_protector=yes], [stack_protector=no])
--	AS_IF([test "x$stack_protector" = xyes], [
--	    RUBY_TRY_LDFLAGS(-fstack-protector, [], [stack_protector=broken])
-+	AS_FOR(option, opt, [-fstack-protector-strong -fstack-protector], [
-+	    RUBY_TRY_CFLAGS(option, [stack_protector=yes])
-+	    AS_IF([test "x$stack_protector" = xyes], [
-+		RUBY_TRY_LDFLAGS(option, [], [stack_protector=])
-+	    ])
-+	    AS_IF([test "x$stack_protector" = xyes], [stack_protector=option; break])
- 	])
-     ])
--    AS_IF([test "x$stack_protector" = xyes], [
--	RUBY_APPEND_OPTION(XCFLAGS, -fstack-protector)
--	RUBY_APPEND_OPTION(XLDFLAGS, -fstack-protector)
--	RUBY_APPEND_OPTION(LDFLAGS, -fstack-protector)
-+    AS_CASE(["$stack_protector"], [-*], [
-+	RUBY_APPEND_OPTION(XCFLAGS, $stack_protector)
-+	RUBY_APPEND_OPTION(XLDFLAGS, $stack_protector)
-+	RUBY_APPEND_OPTION(LDFLAGS, $stack_protector)
-     ])
- 
-     AS_CASE("${compress_debug_sections:-zlib}",

SOURCES/ruby-2.6.0-library-options-to-MAINLIBS.patch

@@ -1,177 +0,0 @@
-From bb3db69e2a0c210cc3a63940622db96a97eb7947 Mon Sep 17 00:00:00 2001
-From: nobu <nobu@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>
-Date: Fri, 2 Mar 2018 01:37:53 +0000
-Subject: [PATCH] configure.ac: library options to MAINLIBS
-
-* configure.ac (MAINLIBS): moved library options for main program
-  and static libruby, and append MAINLIBS to LIBRUBYARG_STATIC, as
-  these libraries are not needed for linking to shared libruby.
-  [ruby-core:85882] [Bug #14422]
-
-git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@62627 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
----
- configure.ac        | 33 +++++++++++++++------------------
- template/ruby.pc.in |  1 +
- win32/Makefile.sub  |  6 ++++--
- 3 files changed, 20 insertions(+), 20 deletions(-)
-
-diff --git a/configure.ac b/configure.ac
-index aebbae1969a5..733a0c992fd7 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -10,6 +10,7 @@ AC_DISABLE_OPTION_CHECKING
- AC_ARG_VAR([cflags], [additional CFLAGS])
- AC_ARG_VAR([cppflags], [additional CPPFLAGS])
- AC_ARG_VAR([cxxflags], [additional CXXFLAGS])
-+ORIG_LIBS=$LIBS
- 
- AC_DEFUN([RUBY_RM_RECURSIVE], [
- m4_version_prereq([2.70], [-1], [
-@@ -2939,13 +2940,11 @@ AS_IF([test x"$enable_pthread" = xyes], [
- 	AC_DEFINE(_THREAD_SAFE)
- 	AC_DEFINE(HAVE_LIBPTHREAD)
- 	AC_CHECK_HEADERS(pthread_np.h, [], [], [@%:@include <pthread.h>])
--	AS_CASE([$pthread_lib],
--	[c],    [],
--	[root], [],
--	[c_r],  [MAINLIBS="-pthread $MAINLIBS"],
--	        [AS_CASE(["$target_os"],
--		    [openbsd*|mirbsd*], [LIBS="-pthread $LIBS"],
--		    [LIBS="-l$pthread_lib $LIBS"])])
-+	AS_CASE(["$pthread_lib:$target_os"],
-+		[c:*], [],
-+		[root:*], [],
-+		[c_r:*|*:openbsd*|*:mirbsd*],  [LIBS="-pthread $LIBS"],
-+		[LIBS="-l$pthread_lib $LIBS"])
-     ], [
- 	AC_MSG_WARN("Don't know how to find pthread library on your system -- thread support disabled")
-     ])
-@@ -3624,7 +3623,7 @@ LIBRUBY_A='lib$(RUBY_SO_NAME)-static.a'
- LIBRUBY='$(LIBRUBY_A)'
- LIBRUBYARG_STATIC='-l$(RUBY_SO_NAME)-static'
- LIBRUBYARG='$(LIBRUBYARG_STATIC)'
--SOLIBS=
-+SOLIBS='$(MAINLIBS)'
- 
- AS_CASE(["$target_os"],
-   [cygwin*|mingw*|haiku*|darwin*], [
-@@ -3690,9 +3689,6 @@ AS_CASE("$enable_shared", [yes], [
-   LIBRUBY_RELATIVE=no
-   test -z "$CCDLFLAGS" || CFLAGS="$CFLAGS $CCDLFLAGS"
-   ENABLE_SHARED=yes
--  AS_IF([test "$rb_cv_binary_elf" = yes], [
--    SOLIBS='$(LIBS)'
--  ])
- 
-   # libdir can be overridden in config.site file (on OpenSUSE at least).
-   libdir_basename=lib
-@@ -3727,7 +3723,6 @@ AS_CASE("$enable_shared", [yes], [
- 	])
- 	],
-     [freebsd*|dragonfly*], [
--	SOLIBS='$(LIBS)'
- 	LIBRUBY_SO='lib$(RUBY_SO_NAME).$(SOEXT).$(MAJOR)$(MINOR)'
- 	LIBRUBY_SONAME='$(LIBRUBY_SO)'
- 	AS_IF([test "$rb_cv_binary_elf" != "yes" ], [
-@@ -3736,7 +3731,6 @@ AS_CASE("$enable_shared", [yes], [
- 	])
- 	],
-     [netbsd*], [
--	SOLIBS='$(LIBS)'
- 	LIBRUBY_SONAME='lib$(RUBY_SO_NAME).$(SOEXT).$(MAJOR)$(MINOR)'
- 	LIBRUBY_SO="${LIBRUBY_SONAME}"'.$(TEENY)'
- 	RUBY_APPEND_OPTIONS(LIBRUBY_DLDFLAGS, ['-Wl,-soname,$(LIBRUBY_SONAME)' "$LDFLAGS_OPTDIR"])
-@@ -3747,11 +3741,9 @@ AS_CASE("$enable_shared", [yes], [
- 	])
- 	],
-     [openbsd*|mirbsd*], [
--	SOLIBS='$(LIBS)'
- 	LIBRUBY_SO='lib$(RUBY_SO_NAME).$(SOEXT).$(MAJOR).'`expr ${MINOR} \* 10 + ${TEENY}`
- 	],
-     [solaris*], [
--	SOLIBS='$(LIBS)'
- 	LIBRUBY_SO='lib$(RUBY_SO_NAME).$(SOEXT).$(MAJOR)'
- 	LIBRUBY_SONAME='lib$(RUBY_SO_NAME).$(SOEXT).$(RUBY_PROGRAM_VERSION)'
- 	LIBRUBY_ALIASES='$(LIBRUBY_SONAME) lib$(RUBY_SO_NAME).$(SOEXT)'
-@@ -3769,7 +3761,7 @@ AS_CASE("$enable_shared", [yes], [
-     [aix*], [
- 	RUBY_APPEND_OPTIONS(LIBRUBY_DLDFLAGS, ["${linker_flag}-bnoentry" "$XLDFLAGS" "$LDFLAGS_OPTDIR"])
- 	LIBRUBYARG_SHARED='-L${libdir} -l${RUBY_SO_NAME}'
--	SOLIBS='-lm -lc'
-+	LIBS="$LIBS -lm -lc"
- 	],
-     [darwin*], [
- 	LIBRUBY_LDSHARED='$(CC) -dynamiclib'
-@@ -3789,7 +3781,6 @@ AS_CASE("$enable_shared", [yes], [
- 	LIBRUBY_SO='lib$(RUBY_SO_NAME).$(SOEXT)'
- 	LIBRUBY_SONAME='lib$(RUBY_BASE_NAME).$(RUBY_API_VERSION).$(SOEXT)'
- 	LIBRUBY_ALIASES='$(LIBRUBY_SONAME) lib$(RUBY_INSTALL_NAME).$(SOEXT)'
--	SOLIBS='$(LIBS)'
- 	],
-     [interix*], [
- 	LIBRUBYARG_SHARED='-L. -L${libdir} -l$(RUBY_SO_NAME)'
-@@ -4032,7 +4023,6 @@ AS_CASE(["$target_os"],
- 	    ])
- 	LIBRUBY_ALIASES=''
- 	FIRSTMAKEFILE=GNUmakefile:cygwin/GNUmakefile.in
--	SOLIBS='$(LIBS)'
- 	AS_IF([test x"$enable_shared" = xyes], [
- 	    LIBRUBY='lib$(RUBY_SO_NAME).dll.a'
- 	], [
-@@ -4132,6 +4122,13 @@ AS_IF([test "${universal_binary-no}" = yes ], [
- 		[rb_cv_architecture_available=yes], [rb_cv_architecture_available=no]))
- ])
- 
-+MAINLIBS="$LIBS"
-+LIBS=$ORIG_LIBS
-+AS_IF([test -n "${LIBS}"], [
-+    libspat=`echo "${LIBS}" | sed 's/[[][|.*$^]]/\\&/g;s/^  */ /;s/^  *$/ /'`
-+    MAINFLAGS=`echo " $MAINLIBS " | sed "s|$libspat"'||;s/^ *//;s/ *$//'`
-+])
-+LIBRUBYARG_STATIC="${LIBRUBYARG_STATIC} \$(MAINLIBS)"
- CPPFLAGS="$CPPFLAGS "'$(DEFS)'
- test -z "$CPPFLAGS" || CPPFLAGS="$CPPFLAGS "; CPPFLAGS="$CPPFLAGS"'${cppflags}'
- AS_IF([test -n "${cflags+set}"], [
-diff --git a/template/ruby.pc.in b/template/ruby.pc.in
-index d874f92c3b20..7ce4461c05df 100644
---- a/template/ruby.pc.in
-+++ b/template/ruby.pc.in
-@@ -39,6 +39,7 @@ sitehdrdir=@sitehdrdir@
- rubyarchhdrdir=@rubyarchhdrdir@
- vendorarchhdrdir=@vendorarchhdrdir@
- sitearchhdrdir=@sitearchhdrdir@
-+MAINLIBS=@MAINLIBS@
- SOEXT=@SOEXT@
- LIBPATH=@LIBPATH@
- LIBRUBY_A=@LIBRUBY_A@
-diff --git a/win32/Makefile.sub b/win32/Makefile.sub
-index 8673c121641e..f8316cccb68e 100644
---- a/win32/Makefile.sub
-+++ b/win32/Makefile.sub
-@@ -279,6 +279,7 @@ MJIT_DEBUGFLAGS = $(DEBUGFLAGS)
- CPPFLAGS = $(DEFS) $(ARCHDEFS) $(CPPFLAGS)
- 
- DLDFLAGS = $(LDFLAGS) -dll
-+MAINLIBS = $(LIBS)
- SOLIBS =
- RCFILES = $(RUBY_INSTALL_NAME).rc $(RUBYW_INSTALL_NAME).rc $(RUBY_SO_NAME).rc
- !ifndef RCFLAGS
-@@ -821,7 +822,8 @@ s,@CPPFLAGS@,$(CPPFLAGS),;t t
- s,@CXXFLAGS@,$(CXXFLAGS),;t t
- s,@FFLAGS@,$(FFLAGS),;t t
- s,@LDFLAGS@,$(LDFLAGS),;t t
--s,@LIBS@,$(LIBS),;t t
-+s,@LIBS@,,;t t
-+s,@MAINLIBS@,$(MAINLIBS),;t t
- s,@exec_prefix@,$${prefix},;t t
- s,@prefix@,$(prefix),;t t
- s,@program_transform_name@,s,.*,$(PROGRAM_PREFIX)&$(PROGRAM_SUFFIX),,;t t
-@@ -909,7 +911,7 @@ s,@LIBRUBY_SO@,$$(RUBY_SO_NAME).dll,;t t
- s,@LIBRUBY_ALIASES@,$(LIBRUBY_ALIASES),;t t
- s,@LIBRUBY@,$$(RUBY_SO_NAME).lib,;t t
- s,@LIBRUBYARG@,$$(LIBRUBYARG_SHARED),;t t
--s,@LIBRUBYARG_STATIC@,$$(LIBRUBY_A),;t t
-+s,@LIBRUBYARG_STATIC@,$$(LIBRUBY_A) $$(MAINLIBS),;t t
- s,@LIBRUBYARG_SHARED@,$$(LIBRUBY),;t t
- s,@SOLIBS@,$(SOLIBS),;t t
- s,@DLDLIBS@,$(DLDLIBS),;t t

SOURCES/ruby-2.6.0-rdoc-6.0.2-check-nil-text-token.patch

@@ -1,69 +0,0 @@
-From 9d98bfe7f1abdeda5aedf9404588104980ee7a86 Mon Sep 17 00:00:00 2001
-From: aycabta <aycabta@gmail.com>
-Date: Mon, 15 Jan 2018 22:32:56 +0900
-Subject: [PATCH] Check nil text token
-
-Sometimes :on_ignored_nl token has nil text. This commit checks and
-bypasses the token.
----
- lib/rdoc/parser/ripper_state_lex.rb |  4 +++-
- test/test_rdoc_parser_ruby.rb       | 30 +++++++++++++++++++++++++++++
- 2 files changed, 33 insertions(+), 1 deletion(-)
-
-diff --git a/lib/rdoc/parser/ripper_state_lex.rb b/lib/rdoc/parser/ripper_state_lex.rb
-index 2a285b97a4..c56cef46ee 100644
---- a/lib/rdoc/parser/ripper_state_lex.rb
-+++ b/lib/rdoc/parser/ripper_state_lex.rb
-@@ -330,8 +330,10 @@ class RDoc::RipperStateLex
-       @heredoc_queue << retrieve_heredoc_info(tk)
-       @inner_lex.lex_state = EXPR_END unless RIPPER_HAS_LEX_STATE
-     when :on_nl, :on_ignored_nl, :on_comment, :on_heredoc_end then
--      unless @heredoc_queue.empty?
-+      if !@heredoc_queue.empty?
-         get_heredoc_tk(*@heredoc_queue.shift)
-+      elsif tk[:text].nil? # :on_ignored_nl sometimes gives nil
-+        tk[:text] = ''
-       end
-     when :on_words_beg then
-       tk = get_words_tk(tk)
-diff --git a/test/rdoc/test_rdoc_parser_ruby.rb b/test/rdoc/test_rdoc_parser_ruby.rb
-index 833ed2cc74..c9d57021ce 100644
---- a/test/rdoc/test_rdoc_parser_ruby.rb
-+++ b/test/rdoc/test_rdoc_parser_ruby.rb
-@@ -306,6 +306,36 @@ def sum(n)
-     assert_equal @top_level, sum.file
-   end
-
-+  def test_parse_on_ignored_nl_with_nil_text
-+    util_parser <<ruby
-+class Foo
-+  def meth
-+    variable # comment
-+      .chain
-+  end
-+end
-+ruby
-+
-+    expected = <<EXPECTED
-+<span class="ruby-keyword">def</span> <span class="ruby-identifier ruby-title">meth</span>
-+  <span class="ruby-identifier">variable</span> <span class="ruby-comment"># comment</span>
-+    .<span class="ruby-identifier">chain</span>
-+<span class="ruby-keyword">end</span>
-+EXPECTED
-+    expected = expected.rstrip
-+
-+    @parser.scan
-+
-+    foo = @store.find_class_named 'Foo'
-+    meth = foo.method_list.first
-+
-+    assert_equal 'meth',     meth.name
-+    assert_equal @top_level, meth.file
-+
-+    markup_code = meth.markup_code.sub(/^.*\n/, '')
-+    assert_equal expected, markup_code
-+  end
-+
-   def test_parse_alias
-     klass = RDoc::NormalClass.new 'Foo'
-     klass.parent = @top_level

SOURCES/ruby-2.6.0-rdoc-6.0.2-fix-different-js-gz-pages-across-multilib.patch

@@ -1,214 +0,0 @@
-From 091459248d3ce814e10d50cc4421f0c0454ef61f Mon Sep 17 00:00:00 2001
-From: "Bernhard M. Wiedemann" <bwiedemann@suse.de>
-Date: Sun, 30 Apr 2017 22:47:40 +0200
-Subject: [PATCH 1/4] created.rid: use SOURCE_DATE_EPOCH
-
-use SOURCE_DATE_EPOCH instead of current time in created.rid top line
-to enable reproducible builds of ruby docs
-
-See https://reproducible-builds.org/ for why this is good
-and https://reproducible-builds.org/specs/source-date-epoch/
-for the definition of this variable.
----
- lib/rdoc/rdoc.rb | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/lib/rdoc/rdoc.rb b/lib/rdoc/rdoc.rb
-index 68775c8be1..a2711fbbd1 100644
---- a/lib/rdoc/rdoc.rb
-+++ b/lib/rdoc/rdoc.rb
-@@ -232,6 +232,9 @@ def store= store
- 
-   def update_output_dir(op_dir, time, last = {})
-     return if @options.dry_run or not @options.update_output_dir
-+    unless ENV['SOURCE_DATE_EPOCH'].nil?
-+      time = Time.at(ENV['SOURCE_DATE_EPOCH'].to_i).gmtime
-+    end
- 
-     open output_flag_file(op_dir), "w" do |f|
-       f.puts time.rfc2822
--- 
-2.21.0
-
-From 73a935e9fa63b056ea0be69c0c923afdfb4d88da Mon Sep 17 00:00:00 2001
-From: "Bernhard M. Wiedemann" <bwiedemann@suse.de>
-Date: Thu, 14 Dec 2017 10:54:54 +0100
-Subject: [PATCH 2/4] Do not store current timestamps in gz headers
-
-to enable reproducible builds of rdoc
-
-Normally, 0 would be the preferred value to indicate "no date"
-but that value is handled differently in Zlib::GzipWriter
-to put in the current time
----
- lib/rdoc/generator/json_index.rb | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/lib/rdoc/generator/json_index.rb b/lib/rdoc/generator/json_index.rb
-index e4cfe967c6..a059a5d4d0 100644
---- a/lib/rdoc/generator/json_index.rb
-+++ b/lib/rdoc/generator/json_index.rb
-@@ -175,7 +175,7 @@ def generate_gzipped
-     debug_msg "Writing gzipped search index to %s" % outfile
- 
-     Zlib::GzipWriter.open(outfile) do |gz|
--      gz.mtime = File.mtime(search_index_file)
-+      gz.mtime = 1 # make output reproducible
-       gz.orig_name = search_index_file.basename.to_s
-       gz.write search_index
-       gz.close
-@@ -193,7 +193,7 @@ def generate_gzipped
-         debug_msg "Writing gzipped file to %s" % outfile
- 
-         Zlib::GzipWriter.open(outfile) do |gz|
--          gz.mtime = File.mtime(dest)
-+          gz.mtime = 1 # make output reproducible
-           gz.orig_name = dest.basename.to_s
-           gz.write data
-           gz.close
--- 
-2.21.0
-
-From 1b34b337b72918e83c3b952eed6998ad47974960 Mon Sep 17 00:00:00 2001
-From: aycabta <aycabta@gmail.com>
-Date: Sat, 27 Jan 2018 14:37:42 +0900
-Subject: [PATCH 3/4] Improve reproducible builds for .js and .js.gz files
-
-The mtime for search_index.js.gz should be updated because it's
-generated dynamically. So uses SOURCE_DATE_EPOCH after
-RDoc::Generator::JsonIndex#generate creates index file.
-
-FileUtils.install in RDoc::Generator::JsonIndex#generate with :preserve
-option because the mtime value is based on original .js file.
----
- lib/rdoc/generator/json_index.rb            |  9 +++++---
- test/rdoc/test_rdoc_generator_json_index.rb | 25 ++++++++++++++++++++-
- 2 files changed, 30 insertions(+), 4 deletions(-)
-
-diff --git a/lib/rdoc/generator/json_index.rb b/lib/rdoc/generator/json_index.rb
-index a059a5d4d0..3a1000033d 100644
---- a/lib/rdoc/generator/json_index.rb
-+++ b/lib/rdoc/generator/json_index.rb
-@@ -147,12 +147,15 @@ def generate
- 
-       JSON.dump data, io, 0
-     end
-+    unless ENV['SOURCE_DATE_EPOCH'].nil?
-+      index_file.utime index_file.atime, Time.at(ENV['SOURCE_DATE_EPOCH'].to_i).gmtime
-+    end
- 
-     Dir.chdir @template_dir do
-       Dir['**/*.js'].each do |source|
-         dest = File.join out_dir, source
- 
--        FileUtils.install source, dest, :mode => 0644, :verbose => $DEBUG_RDOC
-+        FileUtils.install source, dest, :mode => 0644, :preserve => true, :verbose => $DEBUG_RDOC
-       end
-     end
-   end
-@@ -175,7 +178,7 @@ def generate_gzipped
-     debug_msg "Writing gzipped search index to %s" % outfile
- 
-     Zlib::GzipWriter.open(outfile) do |gz|
--      gz.mtime = 1 # make output reproducible
-+      gz.mtime = File.mtime(search_index_file)
-       gz.orig_name = search_index_file.basename.to_s
-       gz.write search_index
-       gz.close
-@@ -193,7 +196,7 @@ def generate_gzipped
-         debug_msg "Writing gzipped file to %s" % outfile
- 
-         Zlib::GzipWriter.open(outfile) do |gz|
--          gz.mtime = 1 # make output reproducible
-+          gz.mtime = File.mtime(dest)
-           gz.orig_name = dest.basename.to_s
-           gz.write data
-           gz.close
-diff --git a/test/rdoc/test_rdoc_generator_json_index.rb b/test/rdoc/test_rdoc_generator_json_index.rb
-index 6cb5463d29..65e7f087cc 100644
---- a/test/rdoc/test_rdoc_generator_json_index.rb
-+++ b/test/rdoc/test_rdoc_generator_json_index.rb
-@@ -8,7 +8,7 @@ class TestRDocGeneratorJsonIndex < RDoc::TestCase
-   def setup
-     super
- 
--    @tmpdir = File.join Dir.tmpdir, "test_rdoc_generator_darkfish_#{$$}"
-+    @tmpdir = Dir.mktmpdir "test_rdoc_generator_darkfish_#{$$}_"
-     FileUtils.mkdir_p @tmpdir
- 
-     @options = RDoc::Options.new
-@@ -89,12 +89,21 @@ def test_file_dir
-   end
- 
-   def test_generate
-+    now = Time.now
-     @g.generate
- 
-     assert_file 'js/searcher.js'
-     assert_file 'js/navigation.js'
-     assert_file 'js/search_index.js'
- 
-+    orig_file = Pathname(File.join @pwd, 'lib/rdoc/generator/template/json_index/js/navigation.js')
-+    generated_file = Pathname(File.join @tmpdir, 'js/navigation.js')
-+    assert_equal orig_file.mtime, generated_file.mtime
-+    assert generated_file.mtime < now, '.js files should be the same timestamp'
-+
-+    generated_search_index = Pathname(File.join @tmpdir, 'js/search_index.js')
-+    assert generated_search_index.mtime > (now - 1), 'search_index.js should be generated timestamp'
-+
-     json = File.read 'js/search_index.js'
- 
-     json =~ /\Avar search_data = /
-@@ -137,6 +146,20 @@ def test_generate
-     assert_equal expected, index
-   end
- 
-+  def test_generate_search_index_with_reproducible_builds
-+    backup_epoch = ENV['SOURCE_DATE_EPOCH']
-+    ruby_birthday = Time.parse 'Wed, 24 Feb 1993 21:00:00 +0900'
-+    ENV['SOURCE_DATE_EPOCH'] = ruby_birthday.to_i.to_s
-+
-+    @g.generate
-+
-+    assert_file 'js/search_index.js'
-+    generated_search_index = Pathname(File.join @tmpdir, 'js/search_index.js')
-+    assert_equal ruby_birthday, generated_search_index.mtime
-+
-+    ENV['SOURCE_DATE_EPOCH'] = backup_epoch
-+  end
-+
-   def test_generate_gzipped
-     begin
-       require 'zlib'
--- 
-2.21.0
-
-From 74c1e201f2146e7175e74d6fc0b9386c2e95210f Mon Sep 17 00:00:00 2001
-From: aycabta <aycabta@gmail.com>
-Date: Sat, 27 Jan 2018 17:54:31 +0900
-Subject: [PATCH 4/4] Use dirty hack on JRuby for MiniTest 4
-
----
- test/rdoc/test_rdoc_generator_json_index.rb | 6 +++++-
- 1 file changed, 5 insertions(+), 1 deletion(-)
-
-diff --git a/test/rdoc/test_rdoc_generator_json_index.rb b/test/rdoc/test_rdoc_generator_json_index.rb
-index 65e7f087cc..714d496195 100644
---- a/test/rdoc/test_rdoc_generator_json_index.rb
-+++ b/test/rdoc/test_rdoc_generator_json_index.rb
-@@ -98,7 +98,11 @@ def test_generate
- 
-     orig_file = Pathname(File.join @pwd, 'lib/rdoc/generator/template/json_index/js/navigation.js')
-     generated_file = Pathname(File.join @tmpdir, 'js/navigation.js')
--    assert_equal orig_file.mtime, generated_file.mtime
-+
-+    # This is dirty hack on JRuby for MiniTest 4
-+    assert orig_file.mtime.inspect == generated_file.mtime.inspect,
-+      '.js files should be tha same timestamp of original'
-+
-     assert generated_file.mtime < now, '.js files should be the same timestamp'
- 
-     generated_search_index = Pathname(File.join @tmpdir, 'js/search_index.js')
--- 
-2.21.0
-

SOURCES/ruby-2.6.0-use-larger-keys-for-SSL-tests.patch

@@ -1,486 +0,0 @@
-From b0bcb19cb4f95d260c5993df0aaa3667522fb99d Mon Sep 17 00:00:00 2001
-From: Kazuki Yamaguchi <k@rhe.jp>
-Date: Thu, 16 Aug 2018 20:54:47 +0900
-Subject: [PATCH 1/2] test/openssl/test_pair: fix deadlock in
- test_connect_accept_nonblock
-
-Call IO.select with a timeout value and limit the number of retries to
-prevent stacking forever.
-
-Reference: https://github.com/ruby/openssl/issues/214
----
- test/openssl/test_pair.rb | 51 ++++++++++++++++++++---------------------------
- 1 file changed, 22 insertions(+), 29 deletions(-)
-
-diff --git a/test/openssl/test_pair.rb b/test/openssl/test_pair.rb
-index ea5f0dcf..eac3655e 100644
---- a/test/openssl/test_pair.rb
-+++ b/test/openssl/test_pair.rb
-@@ -442,7 +442,7 @@ def test_connect_accept_nonblock_no_exception
-   end
- 
-   def test_connect_accept_nonblock
--    ctx = OpenSSL::SSL::SSLContext.new()
-+    ctx = OpenSSL::SSL::SSLContext.new
-     ctx.cert = @svr_cert
-     ctx.key = @svr_key
-     ctx.tmp_dh_callback = proc { OpenSSL::TestUtils::Fixtures.pkey_dh("dh1024") }
-@@ -451,45 +451,38 @@ def test_connect_accept_nonblock
- 
-     th = Thread.new {
-       s2 = OpenSSL::SSL::SSLSocket.new(sock2, ctx)
--      s2.sync_close = true
--      begin
-+      5.times {
-+        begin
-+          break s2.accept_nonblock
-+        rescue IO::WaitReadable
-+          IO.select([s2], nil, nil, 1)
-+        rescue IO::WaitWritable
-+          IO.select(nil, [s2], nil, 1)
-+        end
-         sleep 0.2
--        s2.accept_nonblock
-+      }
-+    }
-+
-+    s1 = OpenSSL::SSL::SSLSocket.new(sock1)
-+    5.times {
-+      begin
-+        break s1.connect_nonblock
-       rescue IO::WaitReadable
--        IO.select([s2])
--        retry
-+        IO.select([s1], nil, nil, 1)
-       rescue IO::WaitWritable
--        IO.select(nil, [s2])
--        retry
-+        IO.select(nil, [s1], nil, 1)
-       end
--      s2
--    }
--
--    sleep 0.1
--    ctx = OpenSSL::SSL::SSLContext.new()
--    s1 = OpenSSL::SSL::SSLSocket.new(sock1, ctx)
--    begin
-       sleep 0.2
--      s1.connect_nonblock
--    rescue IO::WaitReadable
--      IO.select([s1])
--      retry
--    rescue IO::WaitWritable
--      IO.select(nil, [s1])
--      retry
--    end
--    s1.sync_close = true
-+    }
- 
-     s2 = th.value
- 
-     s1.print "a\ndef"
-     assert_equal("a\n", s2.gets)
-   ensure
--    th.join if th
--    s1.close if s1 && !s1.closed?
--    s2.close if s2 && !s2.closed?
--    sock1.close if sock1 && !sock1.closed?
--    sock2.close if sock2 && !sock2.closed?
-+    sock1&.close
-+    sock2&.close
-+    th&.join
-   end
- end
- 
-
-From 5ba99ad7ae1267ed964f53906530579299f3fcc6 Mon Sep 17 00:00:00 2001
-From: Kazuki Yamaguchi <k@rhe.jp>
-Date: Thu, 16 Aug 2018 20:04:13 +0900
-Subject: [PATCH 2/2] test: use larger keys for SSL tests
-
-Some systems enforce a system-wide policy to restrict key sizes used in
-SSL/TLS. Use larger ones if possible so that the test suite runs
-successfully.
-
-New PEM files test/openssl/fixtures/pkey/{dh-1,rsa-1,rsa-2,rsa-3}.pem are added
-to the tree, and SSL tests now use them instead of the fixed-size keys.
-
-Reference: https://github.com/ruby/openssl/issues/215
----
- test/openssl/fixtures/pkey/dh-1.pem  | 13 +++++++++
- test/openssl/fixtures/pkey/rsa-1.pem | 51 ++++++++++++++++++++++++++++++++++++
- test/openssl/fixtures/pkey/rsa-2.pem | 51 ++++++++++++++++++++++++++++++++++++
- test/openssl/fixtures/pkey/rsa-3.pem | 51 ++++++++++++++++++++++++++++++++++++
- test/openssl/test_pair.rb            |  8 +++---
- test/openssl/test_pkey_dh.rb         |  8 +++---
- test/openssl/test_ssl.rb             | 11 ++++----
- test/openssl/utils.rb                | 14 +++++-----
- 8 files changed, 186 insertions(+), 21 deletions(-)
- create mode 100644 test/openssl/fixtures/pkey/dh-1.pem
- create mode 100644 test/openssl/fixtures/pkey/rsa-1.pem
- create mode 100644 test/openssl/fixtures/pkey/rsa-2.pem
- create mode 100644 test/openssl/fixtures/pkey/rsa-3.pem
-
-diff --git a/test/openssl/fixtures/pkey/dh-1.pem b/test/openssl/fixtures/pkey/dh-1.pem
-new file mode 100644
-index 00000000..3340a6a1
---- /dev/null
-+++ b/test/openssl/fixtures/pkey/dh-1.pem
-@@ -0,0 +1,13 @@
-+-----BEGIN DH PARAMETERS-----
-+MIICCAKCAgEAvRzXYxY6L2DjeYmm1eowtMDu1it3j+VwFr6s6PRWzc1apMtztr9G
-+xZ2mYndUAJLgNLO3n2fUDCYVMB6ZkcekW8Siocof3xWiMA6wqZ6uw0dsE3q7ZX+6
-+TLjgSjaXeGvjutvuEwVrFeaUi83bMgfXN8ToxIQVprIF35sYFt6fpbFATKfW7qqi
-+P1pQkjmCskU4tztaWvlLh0qg85wuQGnpJaQT3gS30378i0IGbA0EBvJcSpTHYbLa
-+nsdI9bfN/ZVgeolVMNMU9/n8R8vRhNPcHuciFwaqS656q+HavCIyxw/LfjSwwFvR
-+TngCn0wytRErkzFIXnRKckh8/BpI4S+0+l1NkOwG4WJ55KJ/9OOdZW5o/QCp2bDi
-+E0JN1EP/gkSom/prq8JR/yEqtsy99uc5nUxPmzv0IgdcFHZEfiQU7iRggEbx7qfQ
-+Ve55XksmmJInmpCy1bSabAEgIKp8Ckt5KLYZ0RgTXUhcEpsxEo6cuAwoSJT5o4Rp
-+yG3xow2ozPcqZkvb+d2CHj1sc54w9BVFAjVANEKmRil/9WKz14bu3wxEhOPqC54n
-+QojjLcoXSoT66ZUOQnYxTSiLtzoKGPy8cAVPbkBrXz2u2sj5gcvr1JjoGjdHm9/3
-+qnqC8fsTz8UndKNIQC337o4K0833bQMzRGl1/qjbAPit2B7E3b6xTZMCAQI=
-+-----END DH PARAMETERS-----
-diff --git a/test/openssl/fixtures/pkey/rsa-1.pem b/test/openssl/fixtures/pkey/rsa-1.pem
-new file mode 100644
-index 00000000..bd5a624f
---- /dev/null
-+++ b/test/openssl/fixtures/pkey/rsa-1.pem
-@@ -0,0 +1,51 @@
-+-----BEGIN RSA PRIVATE KEY-----
-+MIIJJwIBAAKCAgEArIEJUYZrXhMfUXXdl2gLcXrRB4ciWNEeXt5UVLG0nPhygZwJ
-+xis8tOrjXOJEpUXUsfgF35pQiJLD4T9/Vp3zLFtMOOQjOR3AxjIelbH9KPyGFEr9
-+TcPtsJ24zhcG7RbwOGXR4iIcDaTx+bCLSAd7BjG3XHQtyeepGGRZkGyGUvXjPorH
-+XP+dQjQnMd09wv0GMZSqQ06PedUUKQ4PJRfMCP+mwjFP+rB3NZuThF0CsNmpoixg
-+GdoQ591Yrf5rf2Bs848JrYdqJlKlBL6rTFf2glHiC+mE5YRny7RZtv/qIkyUNotV
-+ce1cE0GFrRmCpw9bqulDDcgKjFkhihTg4Voq0UYdJ6Alg7Ur4JerKTfyCaRGF27V
-+fh/g2A2/6Vu8xKYYwTAwLn+Tvkx9OTVZ1t15wM7Ma8hHowNoO0g/lWkeltgHLMji
-+rmeuIYQ20BQmdx2RRgWKl57D0wO/N0HIR+Bm4vcBoNPgMlk9g5WHA6idHR8TLxOr
-+dMMmTiWfefB0/FzGXBv7DuuzHN3+urdCvG1QIMFQ06kHXhr4rC28KbWIxg+PJGM8
-+oGNEGtGWAOvi4Ov+BVsIdbD5Sfyb4nY3L9qqPl6TxRxMWTKsYCYx11jC8civCzOu
-+yL1z+wgIICJ6iGzrfYf6C2BiNV3BC1YCtp2XsG+AooIxCwjL2CP/54MuRnUCAwEA
-+AQKCAgAP4+8M0HoRd2d6JIZeDRqIwIyCygLy9Yh7qrVP+/KsRwKdR9dqps73x29c
-+Pgeexdj67+Lynw9uFT7v/95mBzTAUESsNO+9sizw1OsWVQgB/4kGU4YT5Ml/bHf6
-+nApqSqOkPlTgJM46v4f+vTGHWBEQGAJRBO62250q/wt1D1osSDQ/rZ8BxRYiZBV8
-+NWocDRzF8nDgtFrpGSS7R21DuHZ2Gb6twscgS6MfkA49sieuTM6gfr/3gavu/+fM
-+V1Rlrmc65GE61++CSjijQEEdTjkJ9isBd+hjEBhTnnBpOBfEQxOgFqOvU/MYXv/G
-+W0Q6yWJjUwt3OIcoOImrY5L3j0vERneA1Alweqsbws3fXXMjA+jhLxlJqjPvSAKc
-+POi7xu7QCJjSSLAzHSDPdmGmfzlrbdWS1h0mrC5YZYOyToLajfnmAlXNNrytnePg
-+JV9/1136ZFrJyEi1JVN3kyrC+1iVd1E+lWK0U1UQ6/25tJvKFc1I+xToaUbK10UN
-+ycXib7p2Zsc/+ZMlPRgCxWmpIHmKhnwbO7vtRunnnc6wzhvlQQNHWlIvkyQukV50
-+6k/bzWw0M6A98B4oCICIcxcpS3njDlHyL7NlkCD+/OfZp6X3RZF/m4grmA2doebz
-+glsaNMyGHFrpHkHq19Y63Y4jtBdW/XuBv06Cnr4r3BXdjEzzwQKCAQEA5bj737Nk
-+ZLA0UgzVVvY67MTserTOECIt4i37nULjRQwsSFiz0AWFOBwUCBJ5N2qDEelbf0Fa
-+t4VzrphryEgzLz/95ZXi+oxw1liqCHi8iHeU2wSclDtx2jKv2q7bFvFSaH4CKC4N
-+zBJNfP92kdXuAjXkbK/jWwr64fLNh/2KFWUAmrYmtGfnOjjyL+yZhPxBatztE58q
-+/T61pkvP9NiLfrr7Xq8fnzrwqGERhXKueyoK6ig9ZJPZ2VTykMUUvNYJJ7OYQZru
-+EYA3zkuEZifqmjgF57Bgg7dkkIh285TzH3CNf3MCMTmjlWVyHjlyeSPYgISB9Mys
-+VKKQth+SvYcChQKCAQEAwDyCcolA7+bQBfECs6GXi7RYy2YSlx562S5vhjSlY9Ko
-+WiwVJWviF7uSBdZRnGUKoPv4K4LV34o2lJpSSTi5Xgp7FH986VdGePe3p4hcXSIZ
-+NtsKImLVLnEjrmkZExfQl7p0MkcU/LheCf/eEZVp0Z84O54WCs6GRm9wHYIUyrag
-+9FREqqxTRVNhQQ2EDVGq1slREdwB+aygE76axK/qosk0RaoLzGZiMn4Sb8bpJxXO
-+mee+ftq5bayVltfR0DhC8eHkcPPFeQMll1g+ML7HbINwHTr01ONm3cFUO4zOLBOO
-+ws/+vtNfiv6S/lO1RQSRoiApbENBLdSc3V8Cy70PMQKCAQBOcZN4uP5gL5c+KWm0
-+T1KhxUDnSdRPyAwY/xC7i7qlullovvlv4GK0XUot03kXBkUJmcEHvF5o6qYtCZlM
-+g/MOgHCHtF4Upl5lo1M0n13pz8PB4lpBd+cR1lscdrcTp4Y3bkf4RnmppNpXA7kO
-+ZZnnoVWGE620ShSPkWTDuj0rvxisu+SNmClqRUXWPZnSwnzoK9a86443efF3fs3d
-+UxCXTuxFUdGfgvXo2XStOBMCtcGSYflM3fv27b4C13mUXhY0O2yTgn8m9LyZsknc
-+xGalENpbWmwqrjYl8KOF2+gFZV68FZ67Bm6otkJ4ta80VJw6joT9/eIe6IA34KIw
-+G+ktAoIBAFRuPxzvC4ZSaasyX21l25mQbC9pdWDKEkqxCmp3VOyy6R4xnlgBOhwS
-+VeAacV2vQyvRfv4dSLIVkkNSRDHEqCWVlNk75TDXFCytIAyE54xAHbLqIVlY7yim
-+qHVB07F/FC6PxdkPPziAAU2DA5XVedSHibslg6jbbD4jU6qiJ1+hNrAZEs+jQC+C
-+n4Ri20y+Qbp0URb2+icemnARlwgr+3HjzQGL3gK4NQjYNmDBjEWOXl9aWWB90FNL
-+KahGwfAhxcVW4W56opCzwR7nsujV4eDXGba83itidRuQfd5pyWOyc1E86TYGwD/b
-+79OkEElv6Ea8uXTDVS075GmWATRapQECggEAd9ZAbyT+KouTfi2e6yLOosxSZfns
-+eF06QAJi5n9GOtdfK5fqdmHJqJI7wbubCnd0oxPeL71lRjrOAMXufaQRdZtfXSMn
-+B1TljteNrh1en5xF451rCPR/Y6tNKBvIKnhy1waO27/vA+ovXrm17iR9rRuGZ29i
-+IurlKA6z/96UdrSdpqITTCyTjSOBYg34f49ueGjlpL4+8HJq2wor4Cb1Sbv8ErqA
-+bsQ/Jz+KIGUiuFCfNa6d6McPRXIrGgzpprXgfimkV3nj49QyrnuCF/Pc4psGgIaN
-+l3EiGXzRt/55K7DQVadtbcjo9zREac8QnDD6dS/gOfJ82L7frQfMpNWgQA==
-+-----END RSA PRIVATE KEY-----
-diff --git a/test/openssl/fixtures/pkey/rsa-2.pem b/test/openssl/fixtures/pkey/rsa-2.pem
-new file mode 100644
-index 00000000..e4fd4f43
---- /dev/null
-+++ b/test/openssl/fixtures/pkey/rsa-2.pem
-@@ -0,0 +1,51 @@
-+-----BEGIN RSA PRIVATE KEY-----
-+MIIJKAIBAAKCAgEA1HUbx825tG7+/ulC5DpDogzXqM2/KmeCwGXZY4XjiWa+Zj7b
-+ECkZwQh7zxFUsPixGqQKJSyFwCogdaPzYTRNtqKKaw/IWS0um1PTn4C4/9atbIsf
-+HVKu/fWg4VrZL+ixFIZxa8Z6pvTB2omMcx+uEzbXPsO01i1pHf7MaWBxUDGFyC9P
-+lASJBfFZAf2Ar1H99OTS4SP+gxM9Kk5tcc22r8uFiqqbhJmQNSDApdHvT1zSZxAc
-+T1BFEZqfmR0B0UegPyJc/9hW0dYpB9JjR29UaZRSta3LUMpqltoOF5bzaKVgMuBm
-+Qy79xJ71LjGp8bKhgRaWXyPsDzAC0MQlOW6En0v8LK8fntivJEvw9PNOMcZ8oMTn
-+no0NeVt32HiQJW8LIVo7dOLVFtguSBMWUVe8mdKbuIIULD6JlSYke9Ob6andUhzO
-+U79m/aRWs2yjD6o5QAktjFBARdPgcpTdWfppc8xpJUkQgRmVhINoIMT9W6Wl898E
-+P4aPx6mRV/k05ellN3zRgd9tx5dyNuj3RBaNmR47cAVvGYRQgtH9bQYs6jtf0oer
-+A5yIYEKspNRlZZJKKrQdLflQFOEwjQJyZnTk7Mp0y21wOuEGgZBexew55/hUJDC2
-+mQ8CqjV4ki/Mm3z6Cw3jXIMNBJkH7oveBGSX0S9bF8A/73oOCU3W/LkORxECAwEA
-+AQKCAgBLK7RMmYmfQbaPUtEMF2FesNSNMV72DfHBSUgFYpYDQ4sSeiLgMOqf1fSY
-+azVf+F4RYwED7iDUwRMDDKNMPUlR2WjIQKlOhCH9a0dxJAZQ3xA1W3QC2AJ6cLIf
-+ihlWTip5bKgszekPsYH1ZL2A7jCVM84ssuoE7cRHjKOelTUCfsMq9TJe2MvyglZP
-+0fX6EjSctWm3pxiiH+iAU4d9wJ9my8fQLFUiMYNIiPIguYrGtbzsIlMh7PDDLcZS
-+UmUWOxWDwRDOpSjyzadu0Q23dLiVMpmhFoDdcQENptFdn1c4K2tCFQuZscKwEt4F
-+HiVXEzD5j5hcyUT4irA0VXImQ+hAH3oSDmn7wyHvyOg0bDZpUZXEHXb83Vvo54/d
-+Fb4AOUva1dwhjci8CTEMxCENMy/CLilRv46AeHbOX8KMPM7BnRSJPptvTTh/qB9C
-+HI5hxfkO+EOYnu0kUlxhJfrqG86H4IS+zA8HWiSEGxQteMjUQfgJoBzJ94YChpzo
-+ePpKSpjxxl1PNNWKxWM3yUvlKmI2lNl6YNC8JpF2wVg4VvYkG7iVjleeRg21ay89
-+NCVMF98n3MI5jdzfDKACnuYxg7sw+gjMy8PSoFvQ5pvHuBBOpa8tho6vk7bLJixT
-+QY5uXMNQaO6OwpkBssKpnuXhIJzDhO48nSjJ5nUEuadPH1nGwQKCAQEA7twrUIMi
-+Vqze/X6VyfEBnX+n3ZyQHLGqUv/ww1ZOOHmSW5ceC4GxHa8EPDjoh9NEjYffwGq9
-+bfQh9Gntjk5gFipT/SfPrIhbPt59HthUqVvOGgSErCmn0vhsa0+ROpVi4K2WHS7O
-+7SEwnoCWd6p1omon2olVY0ODlMH4neCx/ZuKV8SRMREubABlL8/MLp37AkgKarTY
-+tewd0lpaZMvsjOhr1zVCGUUBxy87Fc7OKAcoQY8//0r8VMH7Jlga7F2PKVPzqRKf
-+tjeW5jMAuRxTqtEdIeclJZwvUMxvb23BbBE+mtvKpXv69TB3DK8T1YIkhW2CidZW
-+lad4MESC+QFNbQKCAQEA47PtULM/0ZFdE+PDDHOa2kJ2arm94sVIqF2168ZLXR69
-+NkvCWfjkUPDeejINCx7XQgk0d/+5BCvrJpcM7lE4XfnYVNtPpct1el6eTfaOcPU8
-+wAMsnq5n9Mxt02U+XRPtEqGk+lt0KLPDDSG88Z7jPmfftigLyPH6i/ZJyRUETlGk
-+rGnWSx/LFUxQU5aBa2jUCjKOKa+OOk2jGg50A5Cmk26v9sA/ksOHisMjfdIpZc9P
-+r4R0IteDDD5awlkWTF++5u1GpgU2yav4uan0wzY8OWYFzVyceA6+wffEcoplLm82
-+CPd/qJOB5HHkjoM+CJgfumFxlNtdowKvKNUxpoQNtQKCAQEAh3ugofFPp+Q0M4r6
-+gWnPZbuDxsLIR05K8vszYEjy4zup1YO4ygQNJ24fM91/n5Mo/jJEqwqgWd6w58ax
-+tRclj00BCMXtGMrbHqTqSXWhR9LH66AGdPTHuXWpYZDnKliTlic/z1u+iWhbAHyl
-+XEj2omIeKunc4gnod5cyYrKRouz3omLfi/pX33C19FGkWgjH2HpuViowBbhhDfCr
-+9yJoEWC/0njl/hlTMdzLYcpEyxWMMuuC/FZXG+hPgWdWFh3XVzTEL3Fd3+hWEkp5
-+rYWwu2ITaSiHvHaDrAvZZVXW8WoynXnvzr+tECgmTq57zI4eEwSTl4VY5VfxZ0dl
-+FsIzXQKCAQBC07GYd6MJPGJWzgeWhe8yk0Lxu6WRAll6oFYd5kqD/9uELePSSAup
-+/actsbbGRrziMpVlinWgVctjvf0bjFbArezhqqPLgtTtnwtS0kOnvzGfIM9dms4D
-+uGObISGWa5yuVSZ4G5MRxwA9wGMVfo4u6Iltin868FmZ7iRlkXd8DNYJi95KmgAe
-+NhF1FrzQ6ykf/QpgDZfuYI63vPorea6JonieMHn39s622OJ3sNBZguheGL+E4j8h
-+vsMgOskijQ8X8xdC7lDQC1qqEsk06ZvvNJQLW1zIl3tArhjHjPp5EEaJhym+Ldx3
-+UT3E3Zu9JfhZ2PNevqrShp0lnLw/pI3pAoIBAAUMz5Lj6V9ftsl1pTa8WDFeBJW0
-+Wa5AT1BZg/ip2uq2NLPnA5JWcD+v682fRSvIj1pU0DRi6VsXlzhs+1q3+sgqiXGz
-+u2ArFylh8TvC1gXUctXKZz/M3Rqr6aSNoejUGLmvHre+ja/k6Zwmu6ePtB7dL50d
-+6+xMTYquS4gLbrbSLcEu3iBAAnvRLreXK4KguPxaBdICB7v7epdpAKe3Z7hp/sst
-+eJj1+6KRdlcmt8fh5MPkBBXa6I/9XGmX5UEo7q4wAxeM9nuFWY3watz/EO9LiO6P
-+LmqUSWL65m4cX0VZPvhYEsHppKi1eoWGlHqS4Af5+aIXi2alu2iljQFeA+Q=
-+-----END RSA PRIVATE KEY-----
-diff --git a/test/openssl/fixtures/pkey/rsa-3.pem b/test/openssl/fixtures/pkey/rsa-3.pem
-new file mode 100644
-index 00000000..6c9c9ced
---- /dev/null
-+++ b/test/openssl/fixtures/pkey/rsa-3.pem
-@@ -0,0 +1,51 @@
-+-----BEGIN RSA PRIVATE KEY-----
-+MIIJKAIBAAKCAgEAzn+YCcOh7BIRzrb7TEuhQLD545+/Fx/zCYO3l+y/8ogUxMTg
-+LG5HrcXlX3JP796ie90/GHIf8/lwczVhP1jk/keYjkwoTYDt477R7KRcJPyGqHRr
-+qLp7AnZxtz3JLNboTgO3bAYzlvtsSKU/R3oehBbGHzEWCP2UEYj/Kky0zpcjkhZU
-+jiErr9ARPq8+dOGqBf+CE2NLKYC1bu8hZe9AddvvN2SvfMN6uhJtEGZO1k8tScwf
-+AyvPJ1Po/6z08pzMAgfBUCE95waAVeYJWIOlnNB4eEievzlXdPB9vEt8OOwtWfQX
-+V8xyMsoKeAW05s413E0eTYx1aulFXdWwG2mWEBRtNzKF1iBudlg1a3x1zThWi1pY
-+jW5vROvoWZMCbl9bYQ/LxOCVqDoUl86+NPEGeuESMzm5NvOQA2e0Ty5wphnt9M19
-+Wcc8neBhb6iCGqYzxWNvUYXZWUv1+/MrPHKyJuv7MSivwtctfp8SacUGxkd6T+u6
-+V6ntHf3qtN/5pAmni6nzUTgjC65MS0LEhi/RTzwafkIfifeJH7/LqFtjrursuwua
-++p9lkACck/J5TpzaAfLroFQuepP8qgeq1cpD5Iii56IJ+FPSnkvesHuRUmZIkhtR
-+VVsVqMaNPv/Uzc02bOaRXWP4auUY91mDKx/FDmORa9YCDQxMkKke05SWQ90CAwEA
-+AQKCAgA0+B/c6VTgxGXS+7cMhB3yBTOkgva2jNh/6Uyv6Of345ZIPyQt4X/7gFbt
-+G9qLcjWFxmQH9kZiA+snclrmr/vVijIE1l5EOz1KfUlGBYcpaal1DqALIQKqyA01
-+buDq4pmmYWesiw6yvP2yyMipohav1VOu7p1zYvCXaufhRtneYICcWaQI7VNSfvHd
-+fYBs5PIDJd6M8Jx4Ie7obOjJSAzl7qu3LtmhDFev4Ugeu8+fQ6IfWv/dhWBW+zw6
-+UXhnv3bJUonw7wX8+/rxjdd54BMcXZF5cU9fR+s6MPJf2ZEc3OBpQaa3O9dTVeZH
-+kVctGVpRj2qlg9EewoWro0PQVE5Mjah+mdFhPAHWoGl1xht6xJmg0uHYxMCzbUSz
-+7NSS3knR0qieFvsp5ESY72i7DnQsbhbn6mTuYdVtm9bphxifAWCP3jFdft/bjtSF
-+4yuPI7Qga+3m0B8QhtbWhEzPVon6NyiY7qfa6qllp0opEbw2hE22uGFFNJo2mpPa
-+pe9VwARtD0IyfeklE7KrBEwV8NjTaAipZTZODw0w/dt4K3dOiePDl3pPWjmERpVg
-+Lkw7XSCMtu5X87I1BbfOYbQhOXksPY+W9Asf6ETBeIZ8bD6Iypuk2ssool1lukqv
-+yq1Y8gbR9B2x91ftYwXgzqBSvd8PFNsaXWLD3nrai2G1vb81lQKCAQEA6W02eZcN
-+7wJfkqNokcuqhc5OKXH14gVIRV+KocG6f3vg88wrCg5J2GqNhBFuwVrafJjRenm6
-+C8zWdneeyrl6cztgbaySw7kXnqFdTBiuOT8bhiG5NTPjDQ109EucaTbZU9KUXk6k
-+ChPlr4G6IPrONpvi/9BvDDZLZkwR6uIg1kFWBy9kZaxFUEIug02hrbkTpPtnEUrO
-+r3nG0QL/D0vf+bm4YHIVRMH2O2ZTTWexMw9XlfCe1+WjbJ+PS35QRCRDcRdWHXDb
-+HnIFIAajtH5LtaJLgWUYq3B25WkQYtbHmFkm94sp/G4trb8JIJGzVO8cj9t6KeAT
-+LG+tk8OqplqsYwKCAQEA4ne81KXx8VNwsKVFqwmiDIoi1q3beNa2hoXdzAMrnYdj
-+iLxbfCVgrKPav9hdfXPBncHaNlGsd2G5W1a1UsOr128lTdfBsgm1RVPhVMKvo3fl
-+yUnWajtAR1q3tVEUhuFlbJ/RHEtxJaGrzudYCPWQiYhydpDgSckbxD8PuElEgFBX
-+O91vnWZEjMsxrABWiZNBxmtBUEv+fjUU/9USYzO4sN79UeD1+ZuBxPFwscsRcjLr
-+bPgZWOwiywH6UmQ+DJTzeu0wJ6jgPoy/pgEujsbPDz1wNos6NhA/RQv31QeX33/B
-+7/F5XKNmbJ2AFb/B+xTaTQPg0pjT5Exm+HrNU5OivwKCAQEAsLLVi9FG4OiBBHXi
-+UItFuChljoYPxVqOTMV4Id6OmLZjoOmqouASElsGaTTxDDkEL1FXMUk4Bnq21dLT
-+R06EXPpTknISX0qbkJ9CCrqcGAWnhi+9DYMLmvPW1p7t9c9pUESVv5X0IxTQx7yB
-+8zkoJLp4aYGUrj/jb7qhzZYDmWy3/JRpgXWYupp+rzJy8xiowDj22mYwczDRyaJl
-+BWVAVL+7zHZPl07kYC6jXHLj9mzktkIBXBkfTriyNkmV5R82VkN+Eqc9l5xkOMwN
-+3DHGieYjFf47YHuv5RVVLBy91puWHckgrU+SEHYOKLNidybSDivsHArdOMQJN1Pk
-+uCznVQKCAQAYY7DQbfa6eLQAMixomSb8lrvdxueGAgmyPyR93jGKS5Rqm2521ket
-+EBB07MZUxmyposDvbKhYSwv9TD9G5I/TKcMouP3BQM5m4vu3dygXQMhcfzk6Q5tO
-+k/SI8Gx3gjq8EhIhK/bJiLnKFJwkit3AEhPRtRSSnbgB0JDO1gUslHpwlg55MxRa
-+3V9CGN84/cTtq4tjLGwCB5F1Y+sRB/byBXHeqY2UDi1Rmnb6jtYYKGe2WpnQO84b
-+cuEUknskO75lFLpE6ykLU3koVaQ/+CVAjOtS1He2btWBiCJurNysU0P9pVHeqjJT
-+rDqpHPe1JK/F74783zyir5+/Tuph/9pdAoIBAANPdFRQkJVH8K6iuhxQk6vFqiYB
-+MUxpIVeLonD0p9TgMdezVNESht/AIutc0+5wabM45XuDWFRTuonvcE8lckv2Ux3a
-+AvSsamjuesxw2YmkEtzZouVqDU0+oxppQJiwBG3MiaHX9F5IfnK6YmQ6xPwZ6MXi
-+9feq1jR4KOc1ZrHtRMNgjnBWEFWroGe3FHgV7O133hpMSshRFmwcbE0nAaDr82U9
-+sl8dclDjEKBxaqjAeNajOr+BU0w0AAwWXL7dt/ctG2QClcj9wqbEfsXnOR10h4AI
-+rqkcvQrOLbTwcrOD/6R1rQfQXtEHKf1maThxosootAQZXdf6jxU3oonx3tU=
-+-----END RSA PRIVATE KEY-----
-diff --git a/test/openssl/test_pair.rb b/test/openssl/test_pair.rb
-index eac3655e..8d6ca1e9 100644
---- a/test/openssl/test_pair.rb
-+++ b/test/openssl/test_pair.rb
-@@ -10,7 +10,7 @@ def setup
-     ee_exts = [
-       ["keyUsage", "keyEncipherment,digitalSignature", true],
-     ]
--    @svr_key = OpenSSL::TestUtils::Fixtures.pkey("rsa1024")
-+    @svr_key = OpenSSL::TestUtils::Fixtures.pkey("rsa-1")
-     @svr_cert = issue_cert(svr_dn, @svr_key, 1, ee_exts, nil, nil)
-   end
- 
-@@ -23,7 +23,7 @@ def ssl_pair
-       sctx = OpenSSL::SSL::SSLContext.new
-       sctx.cert = @svr_cert
-       sctx.key = @svr_key
--      sctx.tmp_dh_callback = proc { OpenSSL::TestUtils::Fixtures.pkey_dh("dh1024") }
-+      sctx.tmp_dh_callback = proc { OpenSSL::TestUtils::Fixtures.pkey("dh-1") }
-       sctx.options |= OpenSSL::SSL::OP_NO_COMPRESSION
-       ssls = OpenSSL::SSL::SSLServer.new(tcps, sctx)
-       ns = ssls.accept
-@@ -397,7 +397,7 @@ def test_connect_accept_nonblock_no_exception
-     ctx2 = OpenSSL::SSL::SSLContext.new
-     ctx2.cert = @svr_cert
-     ctx2.key = @svr_key
--    ctx2.tmp_dh_callback = proc { OpenSSL::TestUtils::Fixtures.pkey_dh("dh1024") }
-+    ctx2.tmp_dh_callback = proc { OpenSSL::TestUtils::Fixtures.pkey("dh-1") }
- 
-     sock1, sock2 = tcp_pair
- 
-@@ -445,7 +445,7 @@ def test_connect_accept_nonblock
-     ctx = OpenSSL::SSL::SSLContext.new
-     ctx.cert = @svr_cert
-     ctx.key = @svr_key
--    ctx.tmp_dh_callback = proc { OpenSSL::TestUtils::Fixtures.pkey_dh("dh1024") }
-+    ctx.tmp_dh_callback = proc { OpenSSL::TestUtils::Fixtures.pkey("dh-1") }
- 
-     sock1, sock2 = tcp_pair
- 
-diff --git a/test/openssl/test_pkey_dh.rb b/test/openssl/test_pkey_dh.rb
-index fb713813..79bf9bb7 100644
---- a/test/openssl/test_pkey_dh.rb
-+++ b/test/openssl/test_pkey_dh.rb
-@@ -19,7 +19,7 @@ def test_new_break
-   end
- 
-   def test_DHparams
--    dh1024 = Fixtures.pkey_dh("dh1024")
-+    dh1024 = Fixtures.pkey("dh1024")
-     asn1 = OpenSSL::ASN1::Sequence([
-       OpenSSL::ASN1::Integer(dh1024.p),
-       OpenSSL::ASN1::Integer(dh1024.g)
-@@ -42,7 +42,7 @@ def test_DHparams
-   end
- 
-   def test_public_key
--    dh = Fixtures.pkey_dh("dh1024")
-+    dh = Fixtures.pkey("dh1024")
-     public_key = dh.public_key
-     assert_no_key(public_key) #implies public_key.public? is false!
-     assert_equal(dh.to_der, public_key.to_der)
-@@ -50,14 +50,14 @@ def test_public_key
-   end
- 
-   def test_generate_key
--    dh = Fixtures.pkey_dh("dh1024").public_key # creates a copy
-+    dh = Fixtures.pkey("dh1024").public_key # creates a copy
-     assert_no_key(dh)
-     dh.generate_key!
-     assert_key(dh)
-   end
- 
-   def test_key_exchange
--    dh = Fixtures.pkey_dh("dh1024")
-+    dh = Fixtures.pkey("dh1024")
-     dh2 = dh.public_key
-     dh.generate_key!
-     dh2.generate_key!
-diff --git a/test/openssl/test_ssl.rb b/test/openssl/test_ssl.rb
-index 408c7d82..2633f7c4 100644
---- a/test/openssl/test_ssl.rb
-+++ b/test/openssl/test_ssl.rb
-@@ -708,7 +708,7 @@ def socketpair
- 
-   def test_tlsext_hostname
-     fooctx = OpenSSL::SSL::SSLContext.new
--    fooctx.tmp_dh_callback = proc { Fixtures.pkey_dh("dh1024") }
-+    fooctx.tmp_dh_callback = proc { Fixtures.pkey("dh-1") }
-     fooctx.cert = @cli_cert
-     fooctx.key = @cli_key
- 
-@@ -760,7 +760,7 @@ def test_servername_cb_raises_an_exception_on_unknown_objects
-     ctx2 = OpenSSL::SSL::SSLContext.new
-     ctx2.cert = @svr_cert
-     ctx2.key = @svr_key
--    ctx2.tmp_dh_callback = proc { Fixtures.pkey_dh("dh1024") }
-+    ctx2.tmp_dh_callback = proc { Fixtures.pkey("dh-1") }
-     ctx2.servername_cb = lambda { |args| Object.new }
- 
-     sock1, sock2 = socketpair
-@@ -1140,7 +1140,7 @@ def test_alpn_protocol_selection_cancel
-     ctx1 = OpenSSL::SSL::SSLContext.new
-     ctx1.cert = @svr_cert
-     ctx1.key = @svr_key
--    ctx1.tmp_dh_callback = proc { Fixtures.pkey_dh("dh1024") }
-+    ctx1.tmp_dh_callback = proc { Fixtures.pkey("dh-1") }
-     ctx1.alpn_select_cb = -> (protocols) { nil }
-     ssl1 = OpenSSL::SSL::SSLSocket.new(sock1, ctx1)
- 
-@@ -1382,20 +1382,21 @@ def test_get_ephemeral_key
-   def test_dh_callback
-     pend "TLS 1.2 is not supported" unless tls12_supported?
- 
-+    dh = Fixtures.pkey("dh-1")
-     called = false
-     ctx_proc = -> ctx {
-       ctx.ssl_version = :TLSv1_2
-       ctx.ciphers = "DH:!NULL"
-       ctx.tmp_dh_callback = ->(*args) {
-         called = true
--        Fixtures.pkey_dh("dh1024")
-+        dh
-       }
-     }
-     start_server(ctx_proc: ctx_proc) do |port|
-       server_connect(port) { |ssl|
-         assert called, "dh callback should be called"
-         if ssl.respond_to?(:tmp_key)
--          assert_equal Fixtures.pkey_dh("dh1024").to_der, ssl.tmp_key.to_der
-+          assert_equal dh.to_der, ssl.tmp_key.to_der
-         end
-       }
-     end
-diff --git a/test/openssl/utils.rb b/test/openssl/utils.rb
-index b7ddd891..fe626ade 100644
---- a/test/openssl/utils.rb
-+++ b/test/openssl/utils.rb
-@@ -42,10 +42,8 @@ module Fixtures
- 
-     def pkey(name)
-       OpenSSL::PKey.read(read_file("pkey", name))
--    end
--
--    def pkey_dh(name)
--      # DH parameters can be read by OpenSSL::PKey.read atm
-+    rescue OpenSSL::PKey::PKeyError
-+      # TODO: DH parameters can be read by OpenSSL::PKey.read atm
-       OpenSSL::PKey::DH.new(read_file("pkey", name))
-     end
- 
-@@ -157,9 +155,9 @@ class OpenSSL::SSLTestCase < OpenSSL::TestCase
- 
-   def setup
-     super
--    @ca_key  = Fixtures.pkey("rsa2048")
--    @svr_key = Fixtures.pkey("rsa1024")
--    @cli_key = Fixtures.pkey("rsa2048")
-+    @ca_key  = Fixtures.pkey("rsa-1")
-+    @svr_key = Fixtures.pkey("rsa-2")
-+    @cli_key = Fixtures.pkey("rsa-3")
-     @ca  = OpenSSL::X509::Name.parse("/DC=org/DC=ruby-lang/CN=CA")
-     @svr = OpenSSL::X509::Name.parse("/DC=org/DC=ruby-lang/CN=localhost")
-     @cli = OpenSSL::X509::Name.parse("/DC=org/DC=ruby-lang/CN=localhost")
-@@ -200,7 +198,7 @@ def start_server(verify_mode: OpenSSL::SSL::VERIFY_NONE, start_immediately: true
-       ctx.cert_store = store
-       ctx.cert = @svr_cert
-       ctx.key = @svr_key
--      ctx.tmp_dh_callback = proc { Fixtures.pkey_dh("dh1024") }
-+      ctx.tmp_dh_callback = proc { Fixtures.pkey("dh-1") }
-       ctx.verify_mode = verify_mode
-       ctx_proc.call(ctx) if ctx_proc
- 

SOURCES/ruby-2.6.10-Fix-CVE-2022-28739-Buffer-overrun-in-str2float.patch

@@ -1,73 +0,0 @@
-From 8e2ed0b9d965a526b29f9dc3bff8e9fe33dae98d Mon Sep 17 00:00:00 2001
-From: usa <usa@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>
-Date: Tue, 12 Apr 2022 11:49:45 +0000
-Subject: [PATCH] Fix CVE-2022-28739 Buffer overrun in str2float.
-
-CVE-2022-28739: Buffer overrun in String-to-Float conversion
-Backported from upstream Ruby 2.6.10,
-Git commit:
-https://github.com/ruby/ruby/commit/69f9992ed41920389d4185141a14f02f89a4d306
-
-==== Original commit message
-
-Fix dtoa buffer overrun
-
-git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67957 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
----
- test/ruby/test_float.rb | 18 ++++++++++++++++++
- util.c                  |  3 ++-
- 2 files changed, 20 insertions(+), 1 deletion(-)
-
-diff --git a/test/ruby/test_float.rb b/test/ruby/test_float.rb
-index 7fabfd3..78c63c2 100644
---- a/test/ruby/test_float.rb
-+++ b/test/ruby/test_float.rb
-@@ -171,6 +171,24 @@ class TestFloat < Test::Unit::TestCase
-       assert_raise(ArgumentError, n += z + "A") {Float(n)}
-       assert_raise(ArgumentError, n += z + ".0") {Float(n)}
-     end
-+
-+    x = nil
-+    2000.times do
-+      x = Float("0x"+"0"*30)
-+      break unless x == 0.0
-+    end
-+    assert_equal(0.0, x, ->{"%a" % x})
-+    x = nil
-+    2000.times do
-+      begin
-+        x = Float("0x1."+"0"*270)
-+      rescue ArgumentError => e
-+        raise unless /"0x1\.0{270}"/ =~ e.message
-+      else
-+        break
-+      end
-+    end
-+    assert_nil(x, ->{"%a" % x})
-   end
- 
-   def test_divmod
-diff --git a/util.c b/util.c
-index 2222744..f1d910f 100644
---- a/util.c
-+++ b/util.c
-@@ -2046,6 +2046,7 @@ break2:
- 	    if (!*++s || !(s1 = strchr(hexdigit, *s))) goto ret0;
- 	    if (*s == '0') {
- 		while (*++s == '0');
-+		if (!*s) goto ret;
- 		s1 = strchr(hexdigit, *s);
- 	    }
- 	    if (s1 != NULL) {
-@@ -2068,7 +2069,7 @@ break2:
- 		for (; *s && (s1 = strchr(hexdigit, *s)); ++s) {
- 		    adj += aadj * ((s1 - hexdigit) & 15);
- 		    if ((aadj /= 16) == 0.0) {
--			while (strchr(hexdigit, *++s));
-+			while (*++s && strchr(hexdigit, *s));
- 			break;
- 		    }
- 		}
--- 
-2.41.0
-

SOURCES/ruby-2.6.3-fiddle-1.0.0-ffi-closure-alloc-default.patch

@@ -1,61 +0,0 @@
-diff --git a/ext/fiddle/closure.c b/ext/fiddle/closure.c
-index 1a80b2b..b997e23 100644
---- a/ext/fiddle/closure.c
-+++ b/ext/fiddle/closure.c
-@@ -13,25 +13,11 @@ typedef struct {
-     ffi_type **argv;
- } fiddle_closure;
- 
--#if defined(USE_FFI_CLOSURE_ALLOC)
--#elif defined(__OpenBSD__) || defined(__APPLE__) || defined(__linux__)
--# define USE_FFI_CLOSURE_ALLOC 0
--#elif defined(RUBY_LIBFFI_MODVERSION) && RUBY_LIBFFI_MODVERSION < 3000005 && \
--	(defined(__i386__) || defined(__x86_64__) || defined(_M_IX86) || defined(_M_AMD64))
--# define USE_FFI_CLOSURE_ALLOC 0
--#else
--# define USE_FFI_CLOSURE_ALLOC 1
--#endif
--
- static void
- dealloc(void * ptr)
- {
-     fiddle_closure * cls = (fiddle_closure *)ptr;
--#if USE_FFI_CLOSURE_ALLOC
-     ffi_closure_free(cls->pcl);
--#else
--    munmap(cls->pcl, sizeof(*cls->pcl));
--#endif
-     if (cls->argv) xfree(cls->argv);
-     xfree(cls);
- }
-@@ -205,12 +191,7 @@ allocate(VALUE klass)
-     VALUE i = TypedData_Make_Struct(klass, fiddle_closure,
- 	    &closure_data_type, closure);
- 
--#if USE_FFI_CLOSURE_ALLOC
-     closure->pcl = ffi_closure_alloc(sizeof(ffi_closure), &closure->code);
--#else
--    closure->pcl = mmap(NULL, sizeof(ffi_closure), PROT_READ | PROT_WRITE,
--        MAP_ANON | MAP_PRIVATE, -1, 0);
--#endif
- 
-     return i;
- }
-@@ -257,17 +238,8 @@ initialize(int rbargc, VALUE argv[], VALUE self)
-     if (FFI_OK != result)
- 	rb_raise(rb_eRuntimeError, "error prepping CIF %d", result);
- 
--#if USE_FFI_CLOSURE_ALLOC
-     result = ffi_prep_closure_loc(pcl, cif, callback,
- 		(void *)self, cl->code);
--#else
--    result = ffi_prep_closure(pcl, cif, callback, (void *)self);
--    cl->code = (void *)pcl;
--    i = mprotect(pcl, sizeof(*pcl), PROT_READ | PROT_EXEC);
--    if (i) {
--	rb_sys_fail("mprotect");
--    }
--#endif
- 
-     if (FFI_OK != result)
- 	rb_raise(rb_eRuntimeError, "error prepping closure %d", result);

SOURCES/ruby-2.6.8-net-ftp-pasv-can-connect-to-arbitrary-host.patch

@@ -1,247 +0,0 @@
-commit be5a83e84a34091f2a4e3c6dfb911b20e78e690c
-Author: usa <usa@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>
-Date:   Wed Jul 7 10:34:08 2021 +0000
-
-    Ignore IP addresses in PASV responses by default, and add new option use_pasv_ip
-    
-    This fixes CVE-2021-31810.
-    Reported by Alexandr Savca.
-    
-    Co-authored-by: Shugo Maeda <shugo@ruby-lang.org>
-    
-    
-    git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67949 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
-
-diff --git a/lib/net/ftp.rb b/lib/net/ftp.rb
-index e68d825dcf..c5d669d898 100644
---- a/lib/net/ftp.rb
-+++ b/lib/net/ftp.rb
-@@ -97,6 +97,10 @@ class FTP < Protocol
-     # When +true+, the connection is in passive mode.  Default: +true+.
-     attr_accessor :passive
- 
-+    # When +true+, use the IP address in PASV responses.  Otherwise, it uses
-+    # the same IP address for the control connection.  Default: +false+.
-+    attr_accessor :use_pasv_ip
-+
-     # When +true+, all traffic to and from the server is written
-     # to +$stdout+.  Default: +false+.
-     attr_accessor :debug_mode
-@@ -205,6 +209,9 @@ def FTP.open(host, *args)
-     #                          handshake.
-     #                          See Net::FTP#ssl_handshake_timeout for
-     #                          details.  Default: +nil+.
-+    # use_pasv_ip::  When +true+, use the IP address in PASV responses.
-+    #                Otherwise, it uses the same IP address for the control
-+    #                connection.  Default: +false+.
-     # debug_mode::  When +true+, all traffic to and from the server is
-     #               written to +$stdout+.  Default: +false+.
-     #
-@@ -265,6 +272,7 @@ def initialize(host = nil, user_or_options = {}, passwd = nil, acct = nil)
-       @open_timeout = options[:open_timeout]
-       @ssl_handshake_timeout = options[:ssl_handshake_timeout]
-       @read_timeout = options[:read_timeout] || 60
-+      @use_pasv_ip = options[:use_pasv_ip] || false
-       if host
-         connect(host, options[:port] || FTP_PORT)
-         if options[:username]
-@@ -1330,7 +1338,12 @@ def parse227(resp) # :nodoc:
-         raise FTPReplyError, resp
-       end
-       if m = /\((?<host>\d+(,\d+){3}),(?<port>\d+,\d+)\)/.match(resp)
--        return parse_pasv_ipv4_host(m["host"]), parse_pasv_port(m["port"])
-+        if @use_pasv_ip
-+          host = parse_pasv_ipv4_host(m["host"])
-+        else
-+          host = @bare_sock.remote_address.ip_address
-+        end
-+        return host, parse_pasv_port(m["port"])
-       else
-         raise FTPProtoError, resp
-       end
-diff --git a/test/net/ftp/test_ftp.rb b/test/net/ftp/test_ftp.rb
-index a5219644bb..b3fe7774ed 100644
---- a/test/net/ftp/test_ftp.rb
-+++ b/test/net/ftp/test_ftp.rb
-@@ -61,7 +61,7 @@ def test_connect_fail
-   end
- 
-   def test_parse227
--    ftp = Net::FTP.new
-+    ftp = Net::FTP.new(nil, use_pasv_ip: true)
-     host, port = ftp.send(:parse227, "227 Entering Passive Mode (192,168,0,1,12,34)")
-     assert_equal("192.168.0.1", host)
-     assert_equal(3106, port)
-@@ -80,6 +80,14 @@ def test_parse227
-     assert_raise(Net::FTPProtoError) do
-       ftp.send(:parse227, "227 ) foo bar (")
-     end
-+
-+    ftp = Net::FTP.new
-+    sock = OpenStruct.new
-+    sock.remote_address = OpenStruct.new
-+    sock.remote_address.ip_address = "10.0.0.1"
-+    ftp.instance_variable_set(:@bare_sock, sock)
-+    host, port = ftp.send(:parse227, "227 Entering Passive Mode (192,168,0,1,12,34)")
-+    assert_equal("10.0.0.1", host)
-   end
- 
-   def test_parse228
-@@ -2360,10 +2368,155 @@ def test_puttextfile_command_injection
-     end
-   end
- 
-+  def test_ignore_pasv_ip
-+    commands = []
-+    binary_data = (0..0xff).map {|i| i.chr}.join * 4 * 3
-+    server = create_ftp_server(nil, "127.0.0.1") { |sock|
-+      sock.print("220 (test_ftp).\r\n")
-+      commands.push(sock.gets)
-+      sock.print("331 Please specify the password.\r\n")
-+      commands.push(sock.gets)
-+      sock.print("230 Login successful.\r\n")
-+      commands.push(sock.gets)
-+      sock.print("200 Switching to Binary mode.\r\n")
-+      line = sock.gets
-+      commands.push(line)
-+      data_server = TCPServer.new("127.0.0.1", 0)
-+      port = data_server.local_address.ip_port
-+      sock.printf("227 Entering Passive Mode (999,0,0,1,%s).\r\n",
-+                  port.divmod(256).join(","))
-+      commands.push(sock.gets)
-+      sock.print("150 Opening BINARY mode data connection for foo (#{binary_data.size} bytes)\r\n")
-+      conn = data_server.accept
-+      binary_data.scan(/.{1,1024}/nm) do |s|
-+        conn.print(s)
-+      end
-+      conn.shutdown(Socket::SHUT_WR)
-+      conn.read
-+      conn.close
-+      data_server.close
-+      sock.print("226 Transfer complete.\r\n")
-+    }
-+    begin
-+      begin
-+        ftp = Net::FTP.new
-+        ftp.passive = true
-+        ftp.read_timeout *= 5 if defined?(RubyVM::MJIT) && RubyVM::MJIT.enabled? # for --jit-wait
-+        ftp.connect("127.0.0.1", server.port)
-+        ftp.login
-+        assert_match(/\AUSER /, commands.shift)
-+        assert_match(/\APASS /, commands.shift)
-+        assert_equal("TYPE I\r\n", commands.shift)
-+        buf = ftp.getbinaryfile("foo", nil)
-+        assert_equal(binary_data, buf)
-+        assert_equal(Encoding::ASCII_8BIT, buf.encoding)
-+        assert_equal("PASV\r\n", commands.shift)
-+        assert_equal("RETR foo\r\n", commands.shift)
-+        assert_equal(nil, commands.shift)
-+      ensure
-+        ftp.close if ftp
-+      end
-+    ensure
-+      server.close
-+    end
-+  end
-+
-+  def test_use_pasv_ip
-+    commands = []
-+    binary_data = (0..0xff).map {|i| i.chr}.join * 4 * 3
-+    server = create_ftp_server(nil, "127.0.0.1") { |sock|
-+      sock.print("220 (test_ftp).\r\n")
-+      commands.push(sock.gets)
-+      sock.print("331 Please specify the password.\r\n")
-+      commands.push(sock.gets)
-+      sock.print("230 Login successful.\r\n")
-+      commands.push(sock.gets)
-+      sock.print("200 Switching to Binary mode.\r\n")
-+      line = sock.gets
-+      commands.push(line)
-+      data_server = TCPServer.new("127.0.0.1", 0)
-+      port = data_server.local_address.ip_port
-+      sock.printf("227 Entering Passive Mode (127,0,0,1,%s).\r\n",
-+                  port.divmod(256).join(","))
-+      commands.push(sock.gets)
-+      sock.print("150 Opening BINARY mode data connection for foo (#{binary_data.size} bytes)\r\n")
-+      conn = data_server.accept
-+      binary_data.scan(/.{1,1024}/nm) do |s|
-+        conn.print(s)
-+      end
-+      conn.shutdown(Socket::SHUT_WR)
-+      conn.read
-+      conn.close
-+      data_server.close
-+      sock.print("226 Transfer complete.\r\n")
-+    }
-+    begin
-+      begin
-+        ftp = Net::FTP.new
-+        ftp.passive = true
-+        ftp.use_pasv_ip = true
-+        ftp.read_timeout *= 5 if defined?(RubyVM::MJIT) && RubyVM::MJIT.enabled? # for --jit-wait
-+        ftp.connect("127.0.0.1", server.port)
-+        ftp.login
-+        assert_match(/\AUSER /, commands.shift)
-+        assert_match(/\APASS /, commands.shift)
-+        assert_equal("TYPE I\r\n", commands.shift)
-+        buf = ftp.getbinaryfile("foo", nil)
-+        assert_equal(binary_data, buf)
-+        assert_equal(Encoding::ASCII_8BIT, buf.encoding)
-+        assert_equal("PASV\r\n", commands.shift)
-+        assert_equal("RETR foo\r\n", commands.shift)
-+        assert_equal(nil, commands.shift)
-+      ensure
-+        ftp.close if ftp
-+      end
-+    ensure
-+      server.close
-+    end
-+  end
-+
-+  def test_use_pasv_invalid_ip
-+    commands = []
-+    binary_data = (0..0xff).map {|i| i.chr}.join * 4 * 3
-+    server = create_ftp_server(nil, "127.0.0.1") { |sock|
-+      sock.print("220 (test_ftp).\r\n")
-+      commands.push(sock.gets)
-+      sock.print("331 Please specify the password.\r\n")
-+      commands.push(sock.gets)
-+      sock.print("230 Login successful.\r\n")
-+      commands.push(sock.gets)
-+      sock.print("200 Switching to Binary mode.\r\n")
-+      line = sock.gets
-+      commands.push(line)
-+      sock.print("227 Entering Passive Mode (999,0,0,1,48,57).\r\n")
-+      commands.push(sock.gets)
-+    }
-+    begin
-+      begin
-+        ftp = Net::FTP.new
-+        ftp.passive = true
-+        ftp.use_pasv_ip = true
-+        ftp.read_timeout *= 5 if defined?(RubyVM::MJIT) && RubyVM::MJIT.enabled? # for --jit-wait
-+        ftp.connect("127.0.0.1", server.port)
-+        ftp.login
-+        assert_match(/\AUSER /, commands.shift)
-+        assert_match(/\APASS /, commands.shift)
-+        assert_equal("TYPE I\r\n", commands.shift)
-+        assert_raise(SocketError) do
-+          ftp.getbinaryfile("foo", nil)
-+        end
-+      ensure
-+        ftp.close if ftp
-+      end
-+    ensure
-+      server.close
-+    end
-+  end
-+
-   private
- 
--  def create_ftp_server(sleep_time = nil)
--    server = TCPServer.new(SERVER_ADDR, 0)
-+  def create_ftp_server(sleep_time = nil, addr = SERVER_ADDR)
-+    server = TCPServer.new(addr, 0)
-     @thread = Thread.start do
-       if sleep_time
-         sleep(sleep_time)

SOURCES/ruby-2.6.8-net-imap-startls-stripping-vulnerability.patch

@@ -1,101 +0,0 @@
-commit 95ba9053e20ad8d113af37b3f1f4cbfff1f6a8f1
-Author: usa <usa@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>
-Date:   Wed Jul 7 10:38:10 2021 +0000
-
-    Fix StartTLS stripping vulnerability
-    
-    Reported by Alexandr Savca in https://hackerone.com/reports/1178562
-    
-    Co-authored-by: Shugo Maeda <shugo@ruby-lang.org>
-    
-    
-    git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67950 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
-
-diff --git a/lib/net/imap.rb b/lib/net/imap.rb
-index 1c7e89ba14..91df89b79e 100644
---- a/lib/net/imap.rb
-+++ b/lib/net/imap.rb
-@@ -1213,12 +1213,14 @@ def get_tagged_response(tag, cmd)
-       end
-       resp = @tagged_responses.delete(tag)
-       case resp.name
-+      when /\A(?:OK)\z/ni
-+        return resp
-       when /\A(?:NO)\z/ni
-         raise NoResponseError, resp
-       when /\A(?:BAD)\z/ni
-         raise BadResponseError, resp
-       else
--        return resp
-+        raise UnknownResponseError, resp
-       end
-     end
- 
-@@ -3714,6 +3716,10 @@ class BadResponseError < ResponseError
-     class ByeResponseError < ResponseError
-     end
- 
-+    # Error raised upon an unknown response from the server.
-+    class UnknownResponseError < ResponseError
-+    end
-+
-     RESPONSE_ERRORS = Hash.new(ResponseError)
-     RESPONSE_ERRORS["NO"] = NoResponseError
-     RESPONSE_ERRORS["BAD"] = BadResponseError
-diff --git a/test/net/imap/test_imap.rb b/test/net/imap/test_imap.rb
-index 936f4e0f42..81928cb8fe 100644
---- a/test/net/imap/test_imap.rb
-+++ b/test/net/imap/test_imap.rb
-@@ -127,6 +127,24 @@ def test_starttls
-         imap.disconnect
-       end
-     end
-+
-+    def test_starttls_stripping
-+      starttls_stripping_test do |port|
-+        imap = Net::IMAP.new("localhost", :port => port)
-+        assert_raise(Net::IMAP::UnknownResponseError) do
-+          imap.starttls(:ca_file => CA_FILE)
-+        end
-+        imap
-+      end
-+    end
-+  end
-+
-+  def start_server
-+    th = Thread.new do
-+      yield
-+    end
-+    @threads << th
-+    sleep 0.1 until th.stop?
-   end
- 
-   def test_unexpected_eof
-@@ -760,6 +760,27 @@ def starttls_test
-     end
-   end
- 
-+  def starttls_stripping_test
-+    server = create_tcp_server
-+    port = server.addr[1]
-+    start_server do
-+      sock = server.accept
-+      begin
-+        sock.print("* OK test server\r\n")
-+        sock.gets
-+        sock.print("RUBY0001 BUG unhandled command\r\n")
-+      ensure
-+        sock.close
-+        server.close
-+      end
-+    end
-+    begin
-+      imap = yield(port)
-+    ensure
-+      imap.disconnect if imap && !imap.disconnected?
-+    end
-+  end
-+
-   def create_tcp_server
-     return TCPServer.new(server_addr, 0)
-   end

SOURCES/ruby-2.6.8-rdoc-6.1.2.1-command-injection-vulnerability.patch

@@ -1,88 +0,0 @@
-commit fe3c49c9baeeab58304ede915b7edd18ecf360fc
-Author: usa <usa@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>
-Date:   Sat Jul 3 17:10:28 2021 +0000
-
-    merge revision(s) b1c73f23,c9ab8fe2: [Backport #17877]
-    
-            [ruby/rdoc] Use File.open to fix the OS Command Injection vulnerability in CVE-2021-31799
-    
-            https://github.com/ruby/rdoc/commit/a7f5d6ab88
-    
-            The test for command injection on Unix platforms should be omitted on Windows
-    
-    
-    git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67947 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
-
-diff --git a/lib/rdoc/rdoc.rb b/lib/rdoc/rdoc.rb
-index ca2c1abefd..46aace7839 100644
---- a/lib/rdoc/rdoc.rb
-+++ b/lib/rdoc/rdoc.rb
-@@ -436,7 +436,7 @@ def remove_unparseable files
-     files.reject do |file|
-       file =~ /\.(?:class|eps|erb|scpt\.txt|svg|ttf|yml)$/i or
-         (file =~ /tags$/i and
--         open(file, 'rb') { |io|
-+         File.open(file, 'rb') { |io|
-            io.read(100) =~ /\A(\f\n[^,]+,\d+$|!_TAG_)/
-          })
-     end
---- a/lib/rdoc/encoding.rb	2022-02-16 16:51:28.080178281 +0100
-+++ b/lib/rdoc/encoding.rb	2022-02-16 16:51:37.108160840 +0100
-@@ -18,7 +18,7 @@
-   # unknown character in the target encoding will be replaced with '?'
- 
-   def self.read_file filename, encoding, force_transcode = false
--    content = open filename, "rb" do |f| f.read end
-+    content = File.open filename, "rb" do |f| f.read end
-     content.gsub!("\r\n", "\n") if RUBY_PLATFORM =~ /mswin|mingw/
- 
-     utf8 = content.sub!(/\A\xef\xbb\xbf/, '')
---- a/lib/rdoc/parser.rb	2021-04-05 13:46:35.000000000 +0200
-+++ b/lib/rdoc/parser.rb	2022-02-16 15:37:17.904822389 +0100
-@@ -74,7 +74,12 @@
-   def self.binary?(file)
-     return false if file =~ /\.(rdoc|txt)$/
- 
--    s = File.read(file, 1024) or return false
-+    begin
-+      open_file = File.open(file)
-+      s = open_file.read(1024) or return false
-+    ensure
-+      open_file.close if open_file
-+    end
- 
-     return true if s[0, 2] == Marshal.dump('')[0, 2] or s.index("\x00")
- 
-@@ -92,7 +97,8 @@
-   # http://www.garykessler.net/library/file_sigs.html
- 
-   def self.zip? file
--    zip_signature = File.read file, 4
-+    zip_signature = ''
-+    File.open(file) { |f| zip_signature = f.read(4) }
- 
-     zip_signature == "PK\x03\x04" or
-       zip_signature == "PK\x05\x06" or
-diff --git a/test/rdoc/test_rdoc_rdoc.rb b/test/rdoc/test_rdoc_rdoc.rb
-index 3bce54b243..123b1a4f87 100644
---- a/test/rdoc/test_rdoc_rdoc.rb
-+++ b/test/rdoc/test_rdoc_rdoc.rb
-@@ -366,6 +366,18 @@ def test_remove_unparseable_tags_vim
-     end
-   end
- 
-+  def test_remove_unparseable_CVE_2021_31799
-+    skip 'for Un*x platforms' if Gem.win_platform?
-+    temp_dir do
-+      file_list = ['| touch evil.txt && echo tags']
-+      file_list.each do |f|
-+        FileUtils.touch f
-+      end
-+      assert_equal file_list, @rdoc.remove_unparseable(file_list)
-+      assert_equal file_list, Dir.children('.')
-+    end
-+  end
-+
-   def test_setup_output_dir
-     Dir.mktmpdir {|d|
-       path = File.join d, 'testdir'

SOURCES/ruby-2.6.9-cgi-0.1.1-cookie-parse-not-decode-names.patch

@@ -1,42 +0,0 @@
-From e2c0652dff671dc6e16a80887e781edc0abc8454 Mon Sep 17 00:00:00 2001
-From: usa <usa@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>
-Date: Wed, 24 Nov 2021 11:41:55 +0000
-Subject: [PATCH 2/2] When parsing cookies, only decode the values
-
-git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67953 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
----
- lib/cgi/cookie.rb           | 1 -
- test/cgi/test_cgi_cookie.rb | 5 +++++
- 2 files changed, 5 insertions(+), 1 deletion(-)
-
-diff --git a/lib/cgi/cookie.rb b/lib/cgi/cookie.rb
-index a2155edb77..009566bb92 100644
---- a/lib/cgi/cookie.rb
-+++ b/lib/cgi/cookie.rb
-@@ -165,7 +165,6 @@ def self.parse(raw_cookie)
-       raw_cookie.split(/;\s?/).each do |pairs|
-         name, values = pairs.split('=',2)
-         next unless name and values
--        name = CGI.unescape(name)
-         values ||= ""
-         values = values.split('&').collect{|v| CGI.unescape(v,@@accept_charset) }
-         if cookies.has_key?(name)
-diff --git a/test/cgi/test_cgi_cookie.rb b/test/cgi/test_cgi_cookie.rb
-index 115a57e4a1..985cc0d7a1 100644
---- a/test/cgi/test_cgi_cookie.rb
-+++ b/test/cgi/test_cgi_cookie.rb
-@@ -101,6 +101,11 @@ def test_cgi_cookie_parse
-     end
-   end
- 
-+  def test_cgi_cookie_parse_not_decode_name
-+    cookie_str = "%66oo=baz;foo=bar"
-+    cookies = CGI::Cookie.parse(cookie_str)
-+    assert_equal({"%66oo" => ["baz"], "foo" => ["bar"]}, cookies)
-+  end
- 
-   def test_cgi_cookie_arrayinterface
-     cookie = CGI::Cookie.new('name1', 'a', 'b', 'c')
--- 
-2.36.1
-

SOURCES/ruby-2.6.9-date-2.0.1-parse-length-limit.patch

@@ -1,918 +0,0 @@
-From d5753ec513fa5a4bdcf59fa298642fd0d3a3c364 Mon Sep 17 00:00:00 2001
-From: Yusuke Endoh <mame@ruby-lang.org>
-Date: Fri, 12 Nov 2021 12:11:13 +0900
-Subject: [PATCH 1/2] Add length limit option for methods that parses date
- strings
-
-This patch fixes CVE-2021-41817 and created from the commit
-<https://github.com/ruby/date/commit/4f9b8e946ba98f0a1774f8e677baa4a45637ebb3>.
-We didn't merge the files included in the original commit below, as those are
-for rebasing date gem version.
-
-* ext/date/date.gemspec
-* ext/date/lib/date.rb
-
-== Original commit message ==
-
-`Date.parse` now raises an ArgumentError when a given date string is
-longer than 128. You can configure the limit by giving `limit` keyword
-arguments like `Date.parse(str, limit: 1000)`. If you pass `limit: nil`,
-the limit is disabled.
-
-Not only `Date.parse` but also the following methods are changed.
-
-* Date._parse
-* Date.parse
-* DateTime.parse
-* Date._iso8601
-* Date.iso8601
-* DateTime.iso8601
-* Date._rfc3339
-* Date.rfc3339
-* DateTime.rfc3339
-* Date._xmlschema
-* Date.xmlschema
-* DateTime.xmlschema
-* Date._rfc2822
-* Date.rfc2822
-* DateTime.rfc2822
-* Date._rfc822
-* Date.rfc822
-* DateTime.rfc822
-* Date._jisx0301
-* Date.jisx0301
-* DateTime.jisx0301
----
- ext/date/date_core.c         | 384 +++++++++++++++++++++++++++--------
- test/date/test_date_parse.rb |  29 +++
- 2 files changed, 325 insertions(+), 88 deletions(-)
-
-diff --git a/ext/date/date_core.c b/ext/date/date_core.c
-index c250633426..177ea0f6c5 100644
---- a/ext/date/date_core.c
-+++ b/ext/date/date_core.c
-@@ -4290,12 +4290,37 @@ date_s_strptime(int argc, VALUE *argv, VALUE klass)
- 
- VALUE date__parse(VALUE str, VALUE comp);
- 
-+static size_t
-+get_limit(VALUE opt)
-+{
-+    if (!NIL_P(opt)) {
-+        VALUE limit = rb_hash_aref(opt, ID2SYM(rb_intern("limit")));
-+        if (NIL_P(limit)) return SIZE_MAX;
-+        return NUM2SIZET(limit);
-+    }
-+    return 128;
-+}
-+
-+static void
-+check_limit(VALUE str, VALUE opt)
-+{
-+    StringValue(str);
-+    size_t slen = RSTRING_LEN(str);
-+    size_t limit = get_limit(opt);
-+    if (slen > limit) {
-+	rb_raise(rb_eArgError,
-+		 "string length (%"PRI_SIZE_PREFIX"u) exceeds the limit %"PRI_SIZE_PREFIX"u", slen, limit);
-+    }
-+}
-+
- static VALUE
- date_s__parse_internal(int argc, VALUE *argv, VALUE klass)
- {
--    VALUE vstr, vcomp, hash;
-+    VALUE vstr, vcomp, hash, opt;
- 
--    rb_scan_args(argc, argv, "11", &vstr, &vcomp);
-+    rb_scan_args(argc, argv, "11:", &vstr, &vcomp, &opt);
-+    if (!NIL_P(opt)) argc--;
-+    check_limit(vstr, opt);
-     StringValue(vstr);
-     if (!rb_enc_str_asciicompat_p(vstr))
- 	rb_raise(rb_eArgError,
-@@ -4320,7 +4345,7 @@ date_s__parse_internal(int argc, VALUE *argv, VALUE klass)
- 
- /*
-  * call-seq:
-- *    Date._parse(string[, comp=true])  ->  hash
-+ *    Date._parse(string[, comp=true], limit: 128)  ->  hash
-  *
-  * Parses the given representation of date and time, and returns a
-  * hash of parsed elements.  This method does not function as a
-@@ -4331,6 +4356,10 @@ date_s__parse_internal(int argc, VALUE *argv, VALUE klass)
-  * it full.
-  *
-  *    Date._parse('2001-02-03')	#=> {:year=>2001, :mon=>2, :mday=>3}
-+ *
-+ * Raise an ArgumentError when the string length is longer than _limit_.
-+ * You can stop this check by passing `limit: nil`, but note that
-+ * it may take a long time to parse.
-  */
- static VALUE
- date_s__parse(int argc, VALUE *argv, VALUE klass)
-@@ -4340,7 +4369,7 @@ date_s__parse(int argc, VALUE *argv, VALUE klass)
- 
- /*
-  * call-seq:
-- *    Date.parse(string='-4712-01-01'[, comp=true[, start=Date::ITALY]])  ->  date
-+ *    Date.parse(string='-4712-01-01'[, comp=true[, start=Date::ITALY]], limit: 128)  ->  date
-  *
-  * Parses the given representation of date and time, and creates a
-  * date object.  This method does not function as a validator.
-@@ -4352,13 +4381,18 @@ date_s__parse(int argc, VALUE *argv, VALUE klass)
-  *    Date.parse('2001-02-03')		#=> #<Date: 2001-02-03 ...>
-  *    Date.parse('20010203')		#=> #<Date: 2001-02-03 ...>
-  *    Date.parse('3rd Feb 2001')	#=> #<Date: 2001-02-03 ...>
-+ *
-+ * Raise an ArgumentError when the string length is longer than _limit_.
-+ * You can stop this check by passing `limit: nil`, but note that
-+ * it may take a long time to parse.
-  */
- static VALUE
- date_s_parse(int argc, VALUE *argv, VALUE klass)
- {
--    VALUE str, comp, sg;
-+    VALUE str, comp, sg, opt;
- 
--    rb_scan_args(argc, argv, "03", &str, &comp, &sg);
-+    rb_scan_args(argc, argv, "03:", &str, &comp, &sg, &opt);
-+    if (!NIL_P(opt)) argc--;
- 
-     switch (argc) {
-       case 0:
-@@ -4370,11 +4404,12 @@ date_s_parse(int argc, VALUE *argv, VALUE klass)
-     }
- 
-     {
--	VALUE argv2[2], hash;
--
--	argv2[0] = str;
--	argv2[1] = comp;
--	hash = date_s__parse(2, argv2, klass);
-+        int argc2 = 2;
-+	VALUE argv2[3];
-+        argv2[0] = str;
-+        argv2[1] = comp;
-+        if (!NIL_P(opt)) argv2[argc2++] = opt;
-+	VALUE hash = date_s__parse(argc2, argv2, klass);
- 	return d_new_by_frags(klass, hash, sg);
-     }
- }
-@@ -4388,19 +4423,28 @@ VALUE date__jisx0301(VALUE);
- 
- /*
-  * call-seq:
-- *    Date._iso8601(string)  ->  hash
-+ *    Date._iso8601(string, limit: 128)  ->  hash
-  *
-  * Returns a hash of parsed elements.
-+ *
-+ * Raise an ArgumentError when the string length is longer than _limit_.
-+ * You can stop this check by passing `limit: nil`, but note that
-+ * it may take a long time to parse.
-  */
- static VALUE
--date_s__iso8601(VALUE klass, VALUE str)
-+date_s__iso8601(int argc, VALUE *argv, VALUE klass)
- {
-+    VALUE str, opt;
-+
-+    rb_scan_args(argc, argv, "1:", &str, &opt);
-+    check_limit(str, opt);
-+
-     return date__iso8601(str);
- }
- 
- /*
-  * call-seq:
-- *    Date.iso8601(string='-4712-01-01'[, start=Date::ITALY])  ->  date
-+ *    Date.iso8601(string='-4712-01-01'[, start=Date::ITALY], limit: 128)  ->  date
-  *
-  * Creates a new Date object by parsing from a string according to
-  * some typical ISO 8601 formats.
-@@ -4408,13 +4452,18 @@ date_s__iso8601(VALUE klass, VALUE str)
-  *    Date.iso8601('2001-02-03')	#=> #<Date: 2001-02-03 ...>
-  *    Date.iso8601('20010203')		#=> #<Date: 2001-02-03 ...>
-  *    Date.iso8601('2001-W05-6')	#=> #<Date: 2001-02-03 ...>
-+ *
-+ * Raise an ArgumentError when the string length is longer than _limit_.
-+ * You can stop this check by passing `limit: nil`, but note that
-+ * it may take a long time to parse.
-  */
- static VALUE
- date_s_iso8601(int argc, VALUE *argv, VALUE klass)
- {
--    VALUE str, sg;
-+    VALUE str, sg, opt;
- 
--    rb_scan_args(argc, argv, "02", &str, &sg);
-+    rb_scan_args(argc, argv, "02:", &str, &sg, &opt);
-+    if (!NIL_P(opt)) argc--;
- 
-     switch (argc) {
-       case 0:
-@@ -4424,38 +4473,56 @@ date_s_iso8601(int argc, VALUE *argv, VALUE klass)
-     }
- 
-     {
--	VALUE hash = date_s__iso8601(klass, str);
-+        int argc2 = 1;
-+        VALUE argv2[2];
-+        argv2[0] = str;
-+        if (!NIL_P(opt)) argv2[argc2++] = opt;
-+	VALUE hash = date_s__iso8601(argc2, argv2, klass);
- 	return d_new_by_frags(klass, hash, sg);
-     }
- }
- 
- /*
-  * call-seq:
-- *    Date._rfc3339(string)  ->  hash
-+ *    Date._rfc3339(string, limit: 128)  ->  hash
-  *
-  * Returns a hash of parsed elements.
-+ *
-+ * Raise an ArgumentError when the string length is longer than _limit_.
-+ * You can stop this check by passing `limit: nil`, but note that
-+ * it may take a long time to parse.
-  */
- static VALUE
--date_s__rfc3339(VALUE klass, VALUE str)
-+date_s__rfc3339(int argc, VALUE *argv, VALUE klass)
- {
-+    VALUE str, opt;
-+
-+    rb_scan_args(argc, argv, "1:", &str, &opt);
-+    check_limit(str, opt);
-+
-     return date__rfc3339(str);
- }
- 
- /*
-  * call-seq:
-- *    Date.rfc3339(string='-4712-01-01T00:00:00+00:00'[, start=Date::ITALY])  ->  date
-+ *    Date.rfc3339(string='-4712-01-01T00:00:00+00:00'[, start=Date::ITALY], limit: 128)  ->  date
-  *
-  * Creates a new Date object by parsing from a string according to
-  * some typical RFC 3339 formats.
-  *
-  *    Date.rfc3339('2001-02-03T04:05:06+07:00')	#=> #<Date: 2001-02-03 ...>
-+ *
-+ * Raise an ArgumentError when the string length is longer than _limit_.
-+ * You can stop this check by passing `limit: nil`, but note that
-+ * it may take a long time to parse.
-  */
- static VALUE
- date_s_rfc3339(int argc, VALUE *argv, VALUE klass)
- {
--    VALUE str, sg;
-+    VALUE str, sg, opt;
- 
--    rb_scan_args(argc, argv, "02", &str, &sg);
-+    rb_scan_args(argc, argv, "02:", &str, &sg, &opt);
-+    if (!NIL_P(opt)) argc--;
- 
-     switch (argc) {
-       case 0:
-@@ -4465,38 +4532,56 @@ date_s_rfc3339(int argc, VALUE *argv, VALUE klass)
-     }
- 
-     {
--	VALUE hash = date_s__rfc3339(klass, str);
-+        int argc2 = 1;
-+        VALUE argv2[2];
-+        argv2[0] = str;
-+        if (!NIL_P(opt)) argv2[argc2++] = opt;
-+	VALUE hash = date_s__rfc3339(argc2, argv2, klass);
- 	return d_new_by_frags(klass, hash, sg);
-     }
- }
- 
- /*
-  * call-seq:
-- *    Date._xmlschema(string)  ->  hash
-+ *    Date._xmlschema(string, limit: 128)  ->  hash
-  *
-  * Returns a hash of parsed elements.
-+ *
-+ * Raise an ArgumentError when the string length is longer than _limit_.
-+ * You can stop this check by passing `limit: nil`, but note that
-+ * it may take a long time to parse.
-  */
- static VALUE
--date_s__xmlschema(VALUE klass, VALUE str)
-+date_s__xmlschema(int argc, VALUE *argv, VALUE klass)
- {
-+    VALUE str, opt;
-+
-+    rb_scan_args(argc, argv, "1:", &str, &opt);
-+    check_limit(str, opt);
-+
-     return date__xmlschema(str);
- }
- 
- /*
-  * call-seq:
-- *    Date.xmlschema(string='-4712-01-01'[, start=Date::ITALY])  ->  date
-+ *    Date.xmlschema(string='-4712-01-01'[, start=Date::ITALY], limit: 128)  ->  date
-  *
-  * Creates a new Date object by parsing from a string according to
-  * some typical XML Schema formats.
-  *
-  *    Date.xmlschema('2001-02-03')	#=> #<Date: 2001-02-03 ...>
-+ *
-+ * Raise an ArgumentError when the string length is longer than _limit_.
-+ * You can stop this check by passing `limit: nil`, but note that
-+ * it may take a long time to parse.
-  */
- static VALUE
- date_s_xmlschema(int argc, VALUE *argv, VALUE klass)
- {
--    VALUE str, sg;
-+    VALUE str, sg, opt;
- 
--    rb_scan_args(argc, argv, "02", &str, &sg);
-+    rb_scan_args(argc, argv, "02:", &str, &sg, &opt);
-+    if (!NIL_P(opt)) argc--;
- 
-     switch (argc) {
-       case 0:
-@@ -4506,41 +4591,58 @@ date_s_xmlschema(int argc, VALUE *argv, VALUE klass)
-     }
- 
-     {
--	VALUE hash = date_s__xmlschema(klass, str);
-+        int argc2 = 1;
-+        VALUE argv2[2];
-+        argv2[0] = str;
-+        if (!NIL_P(opt)) argv2[argc2++] = opt;
-+	VALUE hash = date_s__xmlschema(argc2, argv2, klass);
- 	return d_new_by_frags(klass, hash, sg);
-     }
- }
- 
- /*
-  * call-seq:
-- *    Date._rfc2822(string)  ->  hash
-- *    Date._rfc822(string)   ->  hash
-+ *    Date._rfc2822(string, limit: 128)  ->  hash
-+ *    Date._rfc822(string, limit: 128)   ->  hash
-  *
-  * Returns a hash of parsed elements.
-+ *
-+ * Raise an ArgumentError when the string length is longer than _limit_.
-+ * You can stop this check by passing `limit: nil`, but note that
-+ * it may take a long time to parse.
-  */
- static VALUE
--date_s__rfc2822(VALUE klass, VALUE str)
-+date_s__rfc2822(int argc, VALUE *argv, VALUE klass)
- {
-+    VALUE str, opt;
-+
-+    rb_scan_args(argc, argv, "1:", &str, &opt);
-+    check_limit(str, opt);
-+
-     return date__rfc2822(str);
- }
- 
- /*
-  * call-seq:
-- *    Date.rfc2822(string='Mon, 1 Jan -4712 00:00:00 +0000'[, start=Date::ITALY])  ->  date
-- *    Date.rfc822(string='Mon, 1 Jan -4712 00:00:00 +0000'[, start=Date::ITALY])   ->  date
-+ *    Date.rfc2822(string='Mon, 1 Jan -4712 00:00:00 +0000'[, start=Date::ITALY], limit: 128)  ->  date
-+ *    Date.rfc822(string='Mon, 1 Jan -4712 00:00:00 +0000'[, start=Date::ITALY], limit: 128)   ->  date
-  *
-  * Creates a new Date object by parsing from a string according to
-  * some typical RFC 2822 formats.
-  *
-  *    Date.rfc2822('Sat, 3 Feb 2001 00:00:00 +0000')
-  *						#=> #<Date: 2001-02-03 ...>
-+ *
-+ * Raise an ArgumentError when the string length is longer than _limit_.
-+ * You can stop this check by passing `limit: nil`, but note that
-+ * it may take a long time to parse.
-  */
- static VALUE
- date_s_rfc2822(int argc, VALUE *argv, VALUE klass)
- {
--    VALUE str, sg;
-+    VALUE str, sg, opt;
- 
--    rb_scan_args(argc, argv, "02", &str, &sg);
-+    rb_scan_args(argc, argv, "02:", &str, &sg, &opt);
- 
-     switch (argc) {
-       case 0:
-@@ -4550,39 +4652,56 @@ date_s_rfc2822(int argc, VALUE *argv, VALUE klass)
-     }
- 
-     {
--	VALUE hash = date_s__rfc2822(klass, str);
-+        int argc2 = 1;
-+        VALUE argv2[2];
-+        argv2[0] = str;
-+        if (!NIL_P(opt)) argv2[argc2++] = opt;
-+	VALUE hash = date_s__rfc2822(argc2, argv2, klass);
- 	return d_new_by_frags(klass, hash, sg);
-     }
- }
- 
- /*
-  * call-seq:
-- *    Date._httpdate(string)  ->  hash
-+ *    Date._httpdate(string, limit: 128)  ->  hash
-  *
-  * Returns a hash of parsed elements.
-+ *
-+ * Raise an ArgumentError when the string length is longer than _limit_.
-+ * You can stop this check by passing `limit: nil`, but note that
-+ * it may take a long time to parse.
-  */
- static VALUE
--date_s__httpdate(VALUE klass, VALUE str)
-+date_s__httpdate(int argc, VALUE *argv, VALUE klass)
- {
-+    VALUE str, opt;
-+
-+    rb_scan_args(argc, argv, "1:", &str, &opt);
-+    check_limit(str, opt);
-+
-     return date__httpdate(str);
- }
- 
- /*
-  * call-seq:
-- *    Date.httpdate(string='Mon, 01 Jan -4712 00:00:00 GMT'[, start=Date::ITALY])  ->  date
-+ *    Date.httpdate(string='Mon, 01 Jan -4712 00:00:00 GMT'[, start=Date::ITALY], limit: 128)  ->  date
-  *
-  * Creates a new Date object by parsing from a string according to
-  * some RFC 2616 format.
-  *
-  *    Date.httpdate('Sat, 03 Feb 2001 00:00:00 GMT')
-  *						#=> #<Date: 2001-02-03 ...>
-+ *
-+ * Raise an ArgumentError when the string length is longer than _limit_.
-+ * You can stop this check by passing `limit: nil`, but note that
-+ * it may take a long time to parse.
-  */
- static VALUE
- date_s_httpdate(int argc, VALUE *argv, VALUE klass)
- {
--    VALUE str, sg;
-+    VALUE str, sg, opt;
- 
--    rb_scan_args(argc, argv, "02", &str, &sg);
-+    rb_scan_args(argc, argv, "02:", &str, &sg, &opt);
- 
-     switch (argc) {
-       case 0:
-@@ -4592,38 +4711,56 @@ date_s_httpdate(int argc, VALUE *argv, VALUE klass)
-     }
- 
-     {
--	VALUE hash = date_s__httpdate(klass, str);
-+        int argc2 = 1;
-+        VALUE argv2[2];
-+        argv2[0] = str;
-+        if (!NIL_P(opt)) argv2[argc2++] = opt;
-+	VALUE hash = date_s__httpdate(argc2, argv2, klass);
- 	return d_new_by_frags(klass, hash, sg);
-     }
- }
- 
- /*
-  * call-seq:
-- *    Date._jisx0301(string)  ->  hash
-+ *    Date._jisx0301(string, limit: 128)  ->  hash
-  *
-  * Returns a hash of parsed elements.
-+ *
-+ * Raise an ArgumentError when the string length is longer than _limit_.
-+ * You can stop this check by passing `limit: nil`, but note that
-+ * it may take a long time to parse.
-  */
- static VALUE
--date_s__jisx0301(VALUE klass, VALUE str)
-+date_s__jisx0301(int argc, VALUE *argv, VALUE klass)
- {
-+    VALUE str, opt;
-+
-+    rb_scan_args(argc, argv, "1:", &str, &opt);
-+    check_limit(str, opt);
-+
-     return date__jisx0301(str);
- }
- 
- /*
-  * call-seq:
-- *    Date.jisx0301(string='-4712-01-01'[, start=Date::ITALY])  ->  date
-+ *    Date.jisx0301(string='-4712-01-01'[, start=Date::ITALY], limit: 128)  ->  date
-  *
-  * Creates a new Date object by parsing from a string according to
-  * some typical JIS X 0301 formats.
-  *
-  *    Date.jisx0301('H13.02.03')		#=> #<Date: 2001-02-03 ...>
-+ *
-+ * Raise an ArgumentError when the string length is longer than _limit_.
-+ * You can stop this check by passing `limit: nil`, but note that
-+ * it may take a long time to parse.
-  */
- static VALUE
- date_s_jisx0301(int argc, VALUE *argv, VALUE klass)
- {
--    VALUE str, sg;
-+    VALUE str, sg, opt;
- 
--    rb_scan_args(argc, argv, "02", &str, &sg);
-+    rb_scan_args(argc, argv, "02:", &str, &sg, &opt);
-+    if (!NIL_P(opt)) argc--;
- 
-     switch (argc) {
-       case 0:
-@@ -4633,7 +4770,11 @@ date_s_jisx0301(int argc, VALUE *argv, VALUE klass)
-     }
- 
-     {
--	VALUE hash = date_s__jisx0301(klass, str);
-+        int argc2 = 1;
-+        VALUE argv2[2];
-+        argv2[0] = str;
-+        if (!NIL_P(opt)) argv2[argc2++] = opt;
-+	VALUE hash = date_s__jisx0301(argc2, argv2, klass);
- 	return d_new_by_frags(klass, hash, sg);
-     }
- }
-@@ -7925,7 +8066,7 @@ datetime_s_strptime(int argc, VALUE *argv, VALUE klass)
- 
- /*
-  * call-seq:
-- *    DateTime.parse(string='-4712-01-01T00:00:00+00:00'[, comp=true[, start=Date::ITALY]])  ->  datetime
-+ *    DateTime.parse(string='-4712-01-01T00:00:00+00:00'[, comp=true[, start=Date::ITALY]], limit: 128)  ->  datetime
-  *
-  * Parses the given representation of date and time, and creates a
-  * DateTime object.  This method does not function as a validator.
-@@ -7939,13 +8080,18 @@ datetime_s_strptime(int argc, VALUE *argv, VALUE klass)
-  *				#=> #<DateTime: 2001-02-03T04:05:06+07:00 ...>
-  *    DateTime.parse('3rd Feb 2001 04:05:06 PM')
-  *				#=> #<DateTime: 2001-02-03T16:05:06+00:00 ...>
-+ *
-+ * Raise an ArgumentError when the string length is longer than _limit_.
-+ * You can stop this check by passing `limit: nil`, but note that
-+ * it may take a long time to parse.
-  */
- static VALUE
- datetime_s_parse(int argc, VALUE *argv, VALUE klass)
- {
--    VALUE str, comp, sg;
-+    VALUE str, comp, sg, opt;
- 
--    rb_scan_args(argc, argv, "03", &str, &comp, &sg);
-+    rb_scan_args(argc, argv, "03:", &str, &comp, &sg, &opt);
-+    if (!NIL_P(opt)) argc--;
- 
-     switch (argc) {
-       case 0:
-@@ -7957,18 +8103,20 @@ datetime_s_parse(int argc, VALUE *argv, VALUE klass)
-     }
- 
-     {
--	VALUE argv2[2], hash;
--
--	argv2[0] = str;
--	argv2[1] = comp;
--	hash = date_s__parse(2, argv2, klass);
-+        int argc2 = 2;
-+        VALUE argv2[3];
-+        argv2[0] = str;
-+        argv2[1] = comp;
-+        argv2[2] = opt;
-+        if (!NIL_P(opt)) argc2++;
-+	VALUE hash = date_s__parse(argc2, argv2, klass);
- 	return dt_new_by_frags(klass, hash, sg);
-     }
- }
- 
- /*
-  * call-seq:
-- *    DateTime.iso8601(string='-4712-01-01T00:00:00+00:00'[, start=Date::ITALY])  ->  datetime
-+ *    DateTime.iso8601(string='-4712-01-01T00:00:00+00:00'[, start=Date::ITALY], limit: 128)  ->  datetime
-  *
-  * Creates a new DateTime object by parsing from a string according to
-  * some typical ISO 8601 formats.
-@@ -7979,13 +8127,18 @@ datetime_s_parse(int argc, VALUE *argv, VALUE klass)
-  *				#=> #<DateTime: 2001-02-03T04:05:06+07:00 ...>
-  *    DateTime.iso8601('2001-W05-6T04:05:06+07:00')
-  *				#=> #<DateTime: 2001-02-03T04:05:06+07:00 ...>
-+ *
-+ * Raise an ArgumentError when the string length is longer than _limit_.
-+ * You can stop this check by passing `limit: nil`, but note that
-+ * it may take a long time to parse.
-  */
- static VALUE
- datetime_s_iso8601(int argc, VALUE *argv, VALUE klass)
- {
--    VALUE str, sg;
-+    VALUE str, sg, opt;
- 
--    rb_scan_args(argc, argv, "02", &str, &sg);
-+    rb_scan_args(argc, argv, "02:", &str, &sg, &opt);
-+    if (!NIL_P(opt)) argc--;
- 
-     switch (argc) {
-       case 0:
-@@ -7995,27 +8148,37 @@ datetime_s_iso8601(int argc, VALUE *argv, VALUE klass)
-     }
- 
-     {
--	VALUE hash = date_s__iso8601(klass, str);
-+        int argc2 = 1;
-+        VALUE argv2[2];
-+        argv2[0] = str;
-+        argv2[1] = opt;
-+        if (!NIL_P(opt)) argc2--;
-+	VALUE hash = date_s__iso8601(argc2, argv2, klass);
- 	return dt_new_by_frags(klass, hash, sg);
-     }
- }
- 
- /*
-  * call-seq:
-- *    DateTime.rfc3339(string='-4712-01-01T00:00:00+00:00'[, start=Date::ITALY])  ->  datetime
-+ *    DateTime.rfc3339(string='-4712-01-01T00:00:00+00:00'[, start=Date::ITALY], limit: 128)  ->  datetime
-  *
-  * Creates a new DateTime object by parsing from a string according to
-  * some typical RFC 3339 formats.
-  *
-  *    DateTime.rfc3339('2001-02-03T04:05:06+07:00')
-  *				#=> #<DateTime: 2001-02-03T04:05:06+07:00 ...>
-+ *
-+ * Raise an ArgumentError when the string length is longer than _limit_.
-+ * You can stop this check by passing `limit: nil`, but note that
-+ * it may take a long time to parse.
-  */
- static VALUE
- datetime_s_rfc3339(int argc, VALUE *argv, VALUE klass)
- {
--    VALUE str, sg;
-+    VALUE str, sg, opt;
- 
--    rb_scan_args(argc, argv, "02", &str, &sg);
-+    rb_scan_args(argc, argv, "02:", &str, &sg, &opt);
-+    if (!NIL_P(opt)) argc--;
- 
-     switch (argc) {
-       case 0:
-@@ -8025,27 +8188,37 @@ datetime_s_rfc3339(int argc, VALUE *argv, VALUE klass)
-     }
- 
-     {
--	VALUE hash = date_s__rfc3339(klass, str);
-+        int argc2 = 1;
-+        VALUE argv2[2];
-+        argv2[0] = str;
-+        argv2[1] = opt;
-+        if (!NIL_P(opt)) argc2++;
-+	VALUE hash = date_s__rfc3339(argc2, argv2, klass);
- 	return dt_new_by_frags(klass, hash, sg);
-     }
- }
- 
- /*
-  * call-seq:
-- *    DateTime.xmlschema(string='-4712-01-01T00:00:00+00:00'[, start=Date::ITALY])  ->  datetime
-+ *    DateTime.xmlschema(string='-4712-01-01T00:00:00+00:00'[, start=Date::ITALY], limit: 128)  ->  datetime
-  *
-  * Creates a new DateTime object by parsing from a string according to
-  * some typical XML Schema formats.
-  *
-  *    DateTime.xmlschema('2001-02-03T04:05:06+07:00')
-  *				#=> #<DateTime: 2001-02-03T04:05:06+07:00 ...>
-+ *
-+ * Raise an ArgumentError when the string length is longer than _limit_.
-+ * You can stop this check by passing `limit: nil`, but note that
-+ * it may take a long time to parse.
-  */
- static VALUE
- datetime_s_xmlschema(int argc, VALUE *argv, VALUE klass)
- {
--    VALUE str, sg;
-+    VALUE str, sg, opt;
- 
--    rb_scan_args(argc, argv, "02", &str, &sg);
-+    rb_scan_args(argc, argv, "02:", &str, &sg, &opt);
-+    if (!NIL_P(opt)) argc--;
- 
-     switch (argc) {
-       case 0:
-@@ -8055,28 +8228,38 @@ datetime_s_xmlschema(int argc, VALUE *argv, VALUE klass)
-     }
- 
-     {
--	VALUE hash = date_s__xmlschema(klass, str);
-+        int argc2 = 1;
-+        VALUE argv2[2];
-+        argv2[0] = str;
-+        argv2[1] = opt;
-+        if (!NIL_P(opt)) argc2++;
-+	VALUE hash = date_s__xmlschema(argc2, argv2, klass);
- 	return dt_new_by_frags(klass, hash, sg);
-     }
- }
- 
- /*
-  * call-seq:
-- *    DateTime.rfc2822(string='Mon, 1 Jan -4712 00:00:00 +0000'[, start=Date::ITALY])  ->  datetime
-- *    DateTime.rfc822(string='Mon, 1 Jan -4712 00:00:00 +0000'[, start=Date::ITALY])   ->  datetime
-+ *    DateTime.rfc2822(string='Mon, 1 Jan -4712 00:00:00 +0000'[, start=Date::ITALY], limit: 128)  ->  datetime
-+ *    DateTime.rfc822(string='Mon, 1 Jan -4712 00:00:00 +0000'[, start=Date::ITALY], limit: 128)   ->  datetime
-  *
-  * Creates a new DateTime object by parsing from a string according to
-  * some typical RFC 2822 formats.
-  *
-  *     DateTime.rfc2822('Sat, 3 Feb 2001 04:05:06 +0700')
-  *				#=> #<DateTime: 2001-02-03T04:05:06+07:00 ...>
-+ *
-+ * Raise an ArgumentError when the string length is longer than _limit_.
-+ * You can stop this check by passing `limit: nil`, but note that
-+ * it may take a long time to parse.
-  */
- static VALUE
- datetime_s_rfc2822(int argc, VALUE *argv, VALUE klass)
- {
--    VALUE str, sg;
-+    VALUE str, sg, opt;
- 
--    rb_scan_args(argc, argv, "02", &str, &sg);
-+    rb_scan_args(argc, argv, "02:", &str, &sg, &opt);
-+    if (!NIL_P(opt)) argc--;
- 
-     switch (argc) {
-       case 0:
-@@ -8086,7 +8269,12 @@ datetime_s_rfc2822(int argc, VALUE *argv, VALUE klass)
-     }
- 
-     {
--	VALUE hash = date_s__rfc2822(klass, str);
-+        int argc2 = 1;
-+        VALUE argv2[2];
-+        argv2[0] = str;
-+        argv2[1] = opt;
-+        if (!NIL_P(opt)) argc2++;
-+	VALUE hash = date_s__rfc2822(argc2, argv2, klass);
- 	return dt_new_by_frags(klass, hash, sg);
-     }
- }
-@@ -8100,13 +8288,18 @@ datetime_s_rfc2822(int argc, VALUE *argv, VALUE klass)
-  *
-  *    DateTime.httpdate('Sat, 03 Feb 2001 04:05:06 GMT')
-  *				#=> #<DateTime: 2001-02-03T04:05:06+00:00 ...>
-+ *
-+ * Raise an ArgumentError when the string length is longer than _limit_.
-+ * You can stop this check by passing `limit: nil`, but note that
-+ * it may take a long time to parse.
-  */
- static VALUE
- datetime_s_httpdate(int argc, VALUE *argv, VALUE klass)
- {
--    VALUE str, sg;
-+    VALUE str, sg, opt;
- 
--    rb_scan_args(argc, argv, "02", &str, &sg);
-+    rb_scan_args(argc, argv, "02:", &str, &sg, &opt);
-+    if (!NIL_P(opt)) argc--;
- 
-     switch (argc) {
-       case 0:
-@@ -8116,27 +8309,37 @@ datetime_s_httpdate(int argc, VALUE *argv, VALUE klass)
-     }
- 
-     {
--	VALUE hash = date_s__httpdate(klass, str);
-+        int argc2 = 1;
-+        VALUE argv2[2];
-+        argv2[0] = str;
-+        argv2[1] = opt;
-+        if (!NIL_P(opt)) argc2++;
-+	VALUE hash = date_s__httpdate(argc2, argv2, klass);
- 	return dt_new_by_frags(klass, hash, sg);
-     }
- }
- 
- /*
-  * call-seq:
-- *    DateTime.jisx0301(string='-4712-01-01T00:00:00+00:00'[, start=Date::ITALY])  ->  datetime
-+ *    DateTime.jisx0301(string='-4712-01-01T00:00:00+00:00'[, start=Date::ITALY], limit: 128)  ->  datetime
-  *
-  * Creates a new DateTime object by parsing from a string according to
-  * some typical JIS X 0301 formats.
-  *
-  *    DateTime.jisx0301('H13.02.03T04:05:06+07:00')
-  *				#=> #<DateTime: 2001-02-03T04:05:06+07:00 ...>
-+ *
-+ * Raise an ArgumentError when the string length is longer than _limit_.
-+ * You can stop this check by passing `limit: nil`, but note that
-+ * it may take a long time to parse.
-  */
- static VALUE
- datetime_s_jisx0301(int argc, VALUE *argv, VALUE klass)
- {
--    VALUE str, sg;
-+    VALUE str, sg, opt;
- 
--    rb_scan_args(argc, argv, "02", &str, &sg);
-+    rb_scan_args(argc, argv, "02:", &str, &sg, &opt);
-+    if (!NIL_P(opt)) argc--;
- 
-     switch (argc) {
-       case 0:
-@@ -8146,7 +8349,12 @@ datetime_s_jisx0301(int argc, VALUE *argv, VALUE klass)
-     }
- 
-     {
--	VALUE hash = date_s__jisx0301(klass, str);
-+        int argc2 = 1;
-+        VALUE argv2[2];
-+        argv2[0] = str;
-+        argv2[1] = opt;
-+        if (!NIL_P(opt)) argc2++;
-+	VALUE hash = date_s__jisx0301(argc2, argv2, klass);
- 	return dt_new_by_frags(klass, hash, sg);
-     }
- }
-@@ -9297,19 +9505,19 @@ Init_date_core(void)
-     rb_define_singleton_method(cDate, "strptime", date_s_strptime, -1);
-     rb_define_singleton_method(cDate, "_parse", date_s__parse, -1);
-     rb_define_singleton_method(cDate, "parse", date_s_parse, -1);
--    rb_define_singleton_method(cDate, "_iso8601", date_s__iso8601, 1);
-+    rb_define_singleton_method(cDate, "_iso8601", date_s__iso8601, -1);
-     rb_define_singleton_method(cDate, "iso8601", date_s_iso8601, -1);
--    rb_define_singleton_method(cDate, "_rfc3339", date_s__rfc3339, 1);
-+    rb_define_singleton_method(cDate, "_rfc3339", date_s__rfc3339, -1);
-     rb_define_singleton_method(cDate, "rfc3339", date_s_rfc3339, -1);
--    rb_define_singleton_method(cDate, "_xmlschema", date_s__xmlschema, 1);
-+    rb_define_singleton_method(cDate, "_xmlschema", date_s__xmlschema, -1);
-     rb_define_singleton_method(cDate, "xmlschema", date_s_xmlschema, -1);
--    rb_define_singleton_method(cDate, "_rfc2822", date_s__rfc2822, 1);
--    rb_define_singleton_method(cDate, "_rfc822", date_s__rfc2822, 1);
-+    rb_define_singleton_method(cDate, "_rfc2822", date_s__rfc2822, -1);
-+    rb_define_singleton_method(cDate, "_rfc822", date_s__rfc2822, -1);
-     rb_define_singleton_method(cDate, "rfc2822", date_s_rfc2822, -1);
-     rb_define_singleton_method(cDate, "rfc822", date_s_rfc2822, -1);
--    rb_define_singleton_method(cDate, "_httpdate", date_s__httpdate, 1);
-+    rb_define_singleton_method(cDate, "_httpdate", date_s__httpdate, -1);
-     rb_define_singleton_method(cDate, "httpdate", date_s_httpdate, -1);
--    rb_define_singleton_method(cDate, "_jisx0301", date_s__jisx0301, 1);
-+    rb_define_singleton_method(cDate, "_jisx0301", date_s__jisx0301, -1);
-     rb_define_singleton_method(cDate, "jisx0301", date_s_jisx0301, -1);
- 
- #ifndef NDEBUG
-diff --git a/test/date/test_date_parse.rb b/test/date/test_date_parse.rb
-index ac0eb85ca7..f9b160ee8c 100644
---- a/test/date/test_date_parse.rb
-+++ b/test/date/test_date_parse.rb
-@@ -1,6 +1,7 @@
- # frozen_string_literal: true
- require 'test/unit'
- require 'date'
-+require 'timeout'
- 
- class TestDateParse < Test::Unit::TestCase
- 
-@@ -1122,4 +1123,32 @@ def test_given_string
-     assert_equal(s0, s)
-   end
- 
-+  def test_length_limit
-+    assert_raise(ArgumentError) { Date._parse("1" * 1000) }
-+    assert_raise(ArgumentError) { Date._iso8601("1" * 1000) }
-+    assert_raise(ArgumentError) { Date._rfc3339("1" * 1000) }
-+    assert_raise(ArgumentError) { Date._xmlschema("1" * 1000) }
-+    assert_raise(ArgumentError) { Date._rfc2822("1" * 1000) }
-+    assert_raise(ArgumentError) { Date._rfc822("1" * 1000) }
-+    assert_raise(ArgumentError) { Date._jisx0301("1" * 1000) }
-+
-+    assert_raise(ArgumentError) { Date.parse("1" * 1000) }
-+    assert_raise(ArgumentError) { Date.iso8601("1" * 1000) }
-+    assert_raise(ArgumentError) { Date.rfc3339("1" * 1000) }
-+    assert_raise(ArgumentError) { Date.xmlschema("1" * 1000) }
-+    assert_raise(ArgumentError) { Date.rfc2822("1" * 1000) }
-+    assert_raise(ArgumentError) { Date.rfc822("1" * 1000) }
-+    assert_raise(ArgumentError) { Date.jisx0301("1" * 1000) }
-+
-+    assert_raise(ArgumentError) { DateTime.parse("1" * 1000) }
-+    assert_raise(ArgumentError) { DateTime.iso8601("1" * 1000) }
-+    assert_raise(ArgumentError) { DateTime.rfc3339("1" * 1000) }
-+    assert_raise(ArgumentError) { DateTime.xmlschema("1" * 1000) }
-+    assert_raise(ArgumentError) { DateTime.rfc2822("1" * 1000) }
-+    assert_raise(ArgumentError) { DateTime.rfc822("1" * 1000) }
-+    assert_raise(ArgumentError) { DateTime.jisx0301("1" * 1000) }
-+
-+    assert_raise(ArgumentError) { Date._parse("Jan " + "9" * 1000000) }
-+    assert_raise(Timeout::Error) { Timeout.timeout(1) { Date._parse("Jan " + "9" * 1000000, limit: nil) } }
-+  end
- end
--- 
-2.36.1
-

SOURCES/ruby-2.7.0-Initialize-ABRT-hook.patch

@@ -0,0 +1,77 @@
+From eca084e4079c77c061045df9c21b219175b05228 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?V=C3=ADt=20Ondruch?= <vondruch@redhat.com>
+Date: Mon, 6 Jan 2020 13:56:04 +0100
+Subject: [PATCH] Initialize ABRT hook.
+
+The ABRT hook used to be initialized by preludes via patches [[1], [2]].
+Unfortunately, due to [[3]] and especially since [[4]], this would
+require boostrapping [[5]].
+
+To keep the things simple for now, load the ABRT hook via C.
+
+[1]: https://bugs.ruby-lang.org/issues/8566
+[2]: https://bugs.ruby-lang.org/issues/15306
+[3]: https://bugs.ruby-lang.org/issues/16254
+[4]: https://github.com/ruby/ruby/pull/2735
+[5]: https://lists.fedoraproject.org/archives/list/ruby-sig@lists.fedoraproject.org/message/LH6L6YJOYQT4Y5ZNOO4SLIPTUWZ5V45Q/
+---
+ abrt.c    | 12 ++++++++++++
+ common.mk |  3 ++-
+ ruby.c    |  4 ++++
+ 3 files changed, 18 insertions(+), 1 deletion(-)
+ create mode 100644 abrt.c
+
+diff --git a/abrt.c b/abrt.c
+new file mode 100644
+index 0000000000..74b0bd5c0f
+--- /dev/null
++++ b/abrt.c
+@@ -0,0 +1,12 @@
++#include "internal.h"
++
++void
++Init_abrt(void)
++{
++  rb_eval_string(
++    "  begin\n"
++    "    require 'abrt'\n"
++    "  rescue LoadError\n"
++    "  end\n"
++  );
++}
+diff --git a/common.mk b/common.mk
+index b2e5b2b6d0..f39f81da5c 100644
+--- a/common.mk
++++ b/common.mk
+@@ -81,7 +81,8 @@ ENC_MK        = enc.mk
+ MAKE_ENC      = -f $(ENC_MK) V="$(V)" UNICODE_HDR_DIR="$(UNICODE_HDR_DIR)" \
+ 		RUBY="$(MINIRUBY)" MINIRUBY="$(MINIRUBY)" $(mflags)
+ 
+-COMMONOBJS    = array.$(OBJEXT) \
++COMMONOBJS    = abrt.$(OBJEXT) \
++                array.$(OBJEXT) \
+ 		ast.$(OBJEXT) \
+ 		bignum.$(OBJEXT) \
+ 		class.$(OBJEXT) \
+diff --git a/ruby.c b/ruby.c
+index 60c57d6259..1eec16f2c8 100644
+--- a/ruby.c
++++ b/ruby.c
+@@ -1489,10 +1489,14 @@ proc_options(long argc, char **argv, ruby_cmdline_options_t *opt, int envopt)
+ 
+ void Init_builtin_features(void);
+ 
++/* abrt.c */
++void Init_abrt(void);
++
+ static void
+ ruby_init_prelude(void)
+ {
+     Init_builtin_features();
++    Init_abrt();
+     rb_const_remove(rb_cObject, rb_intern_const("TMP_RUBY_PREFIX"));
+ }
+ 
+-- 
+2.24.1
+

SOURCES/ruby-2.7.1-Timeout-the-test_bug_reporter_add-witout-raising-err.patch

@@ -0,0 +1,34 @@
+From 9b42fce32bff25e0569581f76f532b9d57865aef Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?V=C3=ADt=20Ondruch?= <vondruch@redhat.com>
+Date: Mon, 27 Jul 2020 14:56:05 +0200
+Subject: [PATCH] Timeout the test_bug_reporter_add witout raising error.
+
+While timeouting the threads might be still good idea, it does not seems
+the timeout impacts the TestBugReporter#test_bug_reporter_add result,
+because the output of the child process has been already collected
+earlier.
+
+It seems that when the system is under heavy load, the thread might not
+be sheduled to finish its processing. Even finishing the child process
+might take tens of seconds and therefore the test case finish might take
+a while.
+---
+ test/-ext-/bug_reporter/test_bug_reporter.rb | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/test/-ext-/bug_reporter/test_bug_reporter.rb b/test/-ext-/bug_reporter/test_bug_reporter.rb
+index 628fcd0340..2c677cc8a7 100644
+--- a/test/-ext-/bug_reporter/test_bug_reporter.rb
++++ b/test/-ext-/bug_reporter/test_bug_reporter.rb
+@@ -21,7 +21,7 @@ def test_bug_reporter_add
+     args = ["--disable-gems", "-r-test-/bug_reporter",
+             "-C", tmpdir]
+     stdin = "register_sample_bug_reporter(12345); Process.kill :SEGV, $$"
+-    assert_in_out_err(args, stdin, [], expected_stderr, encoding: "ASCII-8BIT")
++    assert_in_out_err(args, stdin, [], expected_stderr, encoding: "ASCII-8BIT", timeout_error: nil)
+   ensure
+     FileUtils.rm_rf(tmpdir) if tmpdir
+   end
+-- 
+2.27.0
+

SOURCES/ruby-2.7.7-Fix-CVE-2021-33621-HTTP-response-splitting-in-CGI.patch

@@ -1,328 +0,0 @@
-From 8fc4b4792919c627183f4ddb6dc256aae49eb738 Mon Sep 17 00:00:00 2001
-From: Hiroshi SHIBATA <hsbt@ruby-lang.org>
-Date: Tue, 22 Nov 2022 13:48:18 +0900
-Subject: [PATCH] Fix CVE-2021-33621 HTTP response splitting in CGI.
-
-Backported from upstream Ruby, commit:
-https://github.com/ruby/ruby/commit/7cf697179dab52b0d024543304f4d3ab5fa5e847
-
-Test "CGICookieTest#test_cgi_cookie_new_with_domain" was adjusted to
-deal with Ruby 2.5 not allowing String with double splat operator.
-
-==== Original commit message
-Merge CGI-0.1.0.2
----
- lib/cgi/cookie.rb           | 51 ++++++++++++++++-------
- lib/cgi/core.rb             | 45 ++++++++++++--------
- test/cgi/test_cgi_cookie.rb | 82 +++++++++++++++++++++++++++++++++++++
- test/cgi/test_cgi_header.rb |  8 ++++
- 4 files changed, 154 insertions(+), 32 deletions(-)
-
-diff --git a/lib/cgi/cookie.rb b/lib/cgi/cookie.rb
-index 009566b..f26f015 100644
---- a/lib/cgi/cookie.rb
-+++ b/lib/cgi/cookie.rb
-@@ -40,6 +40,10 @@ class CGI
-   class Cookie < Array
-     @@accept_charset="UTF-8" unless defined?(@@accept_charset)
- 
-+    TOKEN_RE = %r"\A[[!-~]&&[^()<>@,;:\\\"/?=\[\]{}]]+\z"
-+    PATH_VALUE_RE = %r"\A[[ -~]&&[^;]]*\z"
-+    DOMAIN_VALUE_RE = %r"\A(?<label>(?!-)[-A-Za-z0-9]+(?<!-))(?:\.\g<label>)*\z"
-+
-     # Create a new CGI::Cookie object.
-     #
-     # :call-seq:
-@@ -72,9 +76,8 @@ class CGI
-       @domain = nil
-       @expires = nil
-       if name.kind_of?(String)
--        @name = name
--        %r|^(.*/)|.match(ENV["SCRIPT_NAME"])
--        @path = ($1 or "")
-+        self.name = name
-+        self.path = (%r|\A(.*/)| =~ ENV["SCRIPT_NAME"] ? $1 : "")
-         @secure = false
-         @httponly = false
-         return super(value)
-@@ -85,16 +88,11 @@ class CGI
-         raise ArgumentError, "`name' required"
-       end
- 
--      @name = options["name"]
-+      self.name = options["name"]
-       value = Array(options["value"])
-       # simple support for IE
--      if options["path"]
--        @path = options["path"]
--      else
--        %r|^(.*/)|.match(ENV["SCRIPT_NAME"])
--        @path = ($1 or "")
--      end
--      @domain = options["domain"]
-+      self.path = options["path"] || (%r|\A(.*/)| =~ ENV["SCRIPT_NAME"] ? $1 : "")
-+      self.domain = options["domain"]
-       @expires = options["expires"]
-       @secure = options["secure"] == true
-       @httponly = options["httponly"] == true
-@@ -102,12 +100,35 @@ class CGI
-       super(value)
-     end
- 
--    # Name of this cookie, as a +String+
--    attr_accessor :name
-+    attr_reader :name
-+    # Set name of this cookie
-+    def name=(str)
-+      if str and !TOKEN_RE.match?(str)
-+        raise ArgumentError, "invalid name: #{str.dump}"
-+      end
-+      @name = str
-+    end
-+
-     # Path for which this cookie applies, as a +String+
--    attr_accessor :path
-+    attr_reader :path
-+    # Set path for which this cookie applies
-+    def path=(str)
-+      if str and !PATH_VALUE_RE.match?(str)
-+        raise ArgumentError, "invalid path: #{str.dump}"
-+      end
-+      @path = str
-+    end
-+
-     # Domain for which this cookie applies, as a +String+
--    attr_accessor :domain
-+    attr_reader :domain
-+    # Set domain for which this cookie applies
-+    def domain=(str)
-+      if str and ((str = str.b).bytesize > 255 or !DOMAIN_VALUE_RE.match?(str))
-+        raise ArgumentError, "invalid domain: #{str.dump}"
-+      end
-+      @domain = str
-+    end
-+
-     # Time at which this cookie expires, as a +Time+
-     attr_accessor :expires
-     # True if this cookie is secure; false otherwise
-diff --git a/lib/cgi/core.rb b/lib/cgi/core.rb
-index 9bd7798..7d8b223 100644
---- a/lib/cgi/core.rb
-+++ b/lib/cgi/core.rb
-@@ -188,17 +188,28 @@ class CGI
-   # Using #header with the HTML5 tag maker will create a <header> element.
-   alias :header :http_header
- 
-+  def _no_crlf_check(str)
-+    if str
-+      str = str.to_s
-+      raise "A HTTP status or header field must not include CR and LF" if str =~ /[\r\n]/
-+      str
-+    else
-+      nil
-+    end
-+  end
-+  private :_no_crlf_check
-+
-   def _header_for_string(content_type) #:nodoc:
-     buf = ''.dup
-     if nph?()
--      buf << "#{$CGI_ENV['SERVER_PROTOCOL'] || 'HTTP/1.0'} 200 OK#{EOL}"
-+      buf << "#{_no_crlf_check($CGI_ENV['SERVER_PROTOCOL']) || 'HTTP/1.0'} 200 OK#{EOL}"
-       buf << "Date: #{CGI.rfc1123_date(Time.now)}#{EOL}"
--      buf << "Server: #{$CGI_ENV['SERVER_SOFTWARE']}#{EOL}"
-+      buf << "Server: #{_no_crlf_check($CGI_ENV['SERVER_SOFTWARE'])}#{EOL}"
-       buf << "Connection: close#{EOL}"
-     end
--    buf << "Content-Type: #{content_type}#{EOL}"
-+    buf << "Content-Type: #{_no_crlf_check(content_type)}#{EOL}"
-     if @output_cookies
--      @output_cookies.each {|cookie| buf << "Set-Cookie: #{cookie}#{EOL}" }
-+      @output_cookies.each {|cookie| buf << "Set-Cookie: #{_no_crlf_check(cookie)}#{EOL}" }
-     end
-     return buf
-   end # _header_for_string
-@@ -213,9 +224,9 @@ class CGI
-     ## NPH
-     options.delete('nph') if defined?(MOD_RUBY)
-     if options.delete('nph') || nph?()
--      protocol = $CGI_ENV['SERVER_PROTOCOL'] || 'HTTP/1.0'
-+      protocol = _no_crlf_check($CGI_ENV['SERVER_PROTOCOL']) || 'HTTP/1.0'
-       status = options.delete('status')
--      status = HTTP_STATUS[status] || status || '200 OK'
-+      status = HTTP_STATUS[status] || _no_crlf_check(status) || '200 OK'
-       buf << "#{protocol} #{status}#{EOL}"
-       buf << "Date: #{CGI.rfc1123_date(Time.now)}#{EOL}"
-       options['server'] ||= $CGI_ENV['SERVER_SOFTWARE'] || ''
-@@ -223,38 +234,38 @@ class CGI
-     end
-     ## common headers
-     status = options.delete('status')
--    buf << "Status: #{HTTP_STATUS[status] || status}#{EOL}" if status
-+    buf << "Status: #{HTTP_STATUS[status] || _no_crlf_check(status)}#{EOL}" if status
-     server = options.delete('server')
--    buf << "Server: #{server}#{EOL}" if server
-+    buf << "Server: #{_no_crlf_check(server)}#{EOL}" if server
-     connection = options.delete('connection')
--    buf << "Connection: #{connection}#{EOL}" if connection
-+    buf << "Connection: #{_no_crlf_check(connection)}#{EOL}" if connection
-     type = options.delete('type')
--    buf << "Content-Type: #{type}#{EOL}" #if type
-+    buf << "Content-Type: #{_no_crlf_check(type)}#{EOL}" #if type
-     length = options.delete('length')
--    buf << "Content-Length: #{length}#{EOL}" if length
-+    buf << "Content-Length: #{_no_crlf_check(length)}#{EOL}" if length
-     language = options.delete('language')
--    buf << "Content-Language: #{language}#{EOL}" if language
-+    buf << "Content-Language: #{_no_crlf_check(language)}#{EOL}" if language
-     expires = options.delete('expires')
-     buf << "Expires: #{CGI.rfc1123_date(expires)}#{EOL}" if expires
-     ## cookie
-     if cookie = options.delete('cookie')
-       case cookie
-       when String, Cookie
--        buf << "Set-Cookie: #{cookie}#{EOL}"
-+        buf << "Set-Cookie: #{_no_crlf_check(cookie)}#{EOL}"
-       when Array
-         arr = cookie
--        arr.each {|c| buf << "Set-Cookie: #{c}#{EOL}" }
-+        arr.each {|c| buf << "Set-Cookie: #{_no_crlf_check(c)}#{EOL}" }
-       when Hash
-         hash = cookie
--        hash.each_value {|c| buf << "Set-Cookie: #{c}#{EOL}" }
-+        hash.each_value {|c| buf << "Set-Cookie: #{_no_crlf_check(c)}#{EOL}" }
-       end
-     end
-     if @output_cookies
--      @output_cookies.each {|c| buf << "Set-Cookie: #{c}#{EOL}" }
-+      @output_cookies.each {|c| buf << "Set-Cookie: #{_no_crlf_check(c)}#{EOL}" }
-     end
-     ## other headers
-     options.each do |key, value|
--      buf << "#{key}: #{value}#{EOL}"
-+      buf << "#{_no_crlf_check(key)}: #{_no_crlf_check(value)}#{EOL}"
-     end
-     return buf
-   end # _header_for_hash
-diff --git a/test/cgi/test_cgi_cookie.rb b/test/cgi/test_cgi_cookie.rb
-index 985cc0d..7afff5e 100644
---- a/test/cgi/test_cgi_cookie.rb
-+++ b/test/cgi/test_cgi_cookie.rb
-@@ -60,6 +60,24 @@ class CGICookieTest < Test::Unit::TestCase
-   end
- 
- 
-+  def test_cgi_cookie_new_with_domain
-+    h = {'name'=>'name1', 'value'=>'value1'}
-+    cookie = CGI::Cookie.new({'domain' => 'a.example.com'}.merge(h))
-+    assert_equal('a.example.com', cookie.domain)
-+
-+    cookie = CGI::Cookie.new({'domain'=>'1.example.com'}.merge(h))
-+    assert_equal('1.example.com', cookie.domain, 'enhanced by RFC 1123')
-+
-+    assert_raise(ArgumentError) {
-+      CGI::Cookie.new({'domain'=>'-a.example.com'}.merge(h))
-+    }
-+
-+    assert_raise(ArgumentError) {
-+      CGI::Cookie.new({'domain'=>'a-.example.com'}.merge(h))
-+    }
-+  end
-+
-+
-   def test_cgi_cookie_scriptname
-     cookie = CGI::Cookie.new('name1', 'value1')
-     assert_equal('', cookie.path)
-@@ -118,6 +136,70 @@ class CGICookieTest < Test::Unit::TestCase
-   end
- 
- 
-+  def test_cgi_cookie_domain_injection_into_name
-+    name = "a=b; domain=example.com;"
-+    path = "/"
-+    domain = "example.jp"
-+    assert_raise(ArgumentError) do
-+      CGI::Cookie.new('name' => name,
-+                      'value' => "value",
-+                      'domain' => domain,
-+                      'path' => path)
-+    end
-+  end
-+
-+
-+  def test_cgi_cookie_newline_injection_into_name
-+    name = "a=b;\r\nLocation: http://example.com#"
-+    path = "/"
-+    domain = "example.jp"
-+    assert_raise(ArgumentError) do
-+      CGI::Cookie.new('name' => name,
-+                      'value' => "value",
-+                      'domain' => domain,
-+                      'path' => path)
-+    end
-+  end
-+
-+
-+  def test_cgi_cookie_multibyte_injection_into_name
-+    name = "a=b;\u3042"
-+    path = "/"
-+    domain = "example.jp"
-+    assert_raise(ArgumentError) do
-+      CGI::Cookie.new('name' => name,
-+                      'value' => "value",
-+                      'domain' => domain,
-+                      'path' => path)
-+    end
-+  end
-+
-+
-+  def test_cgi_cookie_injection_into_path
-+    name = "name"
-+    path = "/; samesite=none"
-+    domain = "example.jp"
-+    assert_raise(ArgumentError) do
-+      CGI::Cookie.new('name' => name,
-+                      'value' => "value",
-+                      'domain' => domain,
-+                      'path' => path)
-+    end
-+  end
-+
-+
-+  def test_cgi_cookie_injection_into_domain
-+    name = "name"
-+    path = "/"
-+    domain = "example.jp; samesite=none"
-+    assert_raise(ArgumentError) do
-+      CGI::Cookie.new('name' => name,
-+                      'value' => "value",
-+                      'domain' => domain,
-+                      'path' => path)
-+    end
-+  end
-+
- 
-   instance_methods.each do |method|
-     private method if method =~ /^test_(.*)/ && $1 != ENV['TEST']
-diff --git a/test/cgi/test_cgi_header.rb b/test/cgi/test_cgi_header.rb
-index bab2d03..ec2f4de 100644
---- a/test/cgi/test_cgi_header.rb
-+++ b/test/cgi/test_cgi_header.rb
-@@ -176,6 +176,14 @@ class CGIHeaderTest < Test::Unit::TestCase
-   end
- 
- 
-+  def test_cgi_http_header_crlf_injection
-+    cgi = CGI.new
-+    assert_raise(RuntimeError) { cgi.http_header("text/xhtml\r\nBOO") }
-+    assert_raise(RuntimeError) { cgi.http_header("type" => "text/xhtml\r\nBOO") }
-+    assert_raise(RuntimeError) { cgi.http_header("status" => "200 OK\r\nBOO") }
-+    assert_raise(RuntimeError) { cgi.http_header("location" => "text/xhtml\r\nBOO") }
-+  end
-+
- 
-   instance_methods.each do |method|
-     private method if method =~ /^test_(.*)/ && $1 != ENV['TEST']
--- 
-2.41.0
-

SOURCES/ruby-2.7.8-Fix-CVE-2023-28755-ReDos-vulnerability-in-URI.patch

@@ -1,52 +0,0 @@
-From 61fb466ea0b492c990fcd2d681c08f2001d7a659 Mon Sep 17 00:00:00 2001
-From: Hiroshi SHIBATA <hsbt@ruby-lang.org>
-Date: Tue, 28 Mar 2023 17:33:19 +0900
-Subject: [PATCH] Fix CVE-2023-28755 ReDos vulnerability in URI.
-
-This patch was backported from Ruby 2.7.8
-
-Backported from upstream Ruby, commit:
-https://github.com/ruby/ruby/commit/6855779d580358a6a0b4c9ee06f20e7cae72955a
-
-===== Original commit message
-
-Merge URI-0.10.0.2
----
- lib/uri/rfc3986_parser.rb | 4 ++--
- test/uri/test_parser.rb   | 7 +++++++
- 2 files changed, 9 insertions(+), 2 deletions(-)
-
-diff --git a/lib/uri/rfc3986_parser.rb b/lib/uri/rfc3986_parser.rb
-index 8712800..ad32368 100644
---- a/lib/uri/rfc3986_parser.rb
-+++ b/lib/uri/rfc3986_parser.rb
-@@ -3,8 +3,8 @@ module URI
-   class RFC3986_Parser # :nodoc:
-     # URI defined in RFC3986
-     # this regexp is modified not to host is not empty string
--    RFC3986_URI = /\A(?<URI>(?<scheme>[A-Za-z][+\-.0-9A-Za-z]*):(?<hier-part>\/\/(?<authority>(?:(?<userinfo>(?:%\h\h|[!$&-.0-;=A-Z_a-z~])*)@)?(?<host>(?<IP-literal>\[(?:(?<IPv6address>(?:\h{1,4}:){6}(?<ls32>\h{1,4}:\h{1,4}|(?<IPv4address>(?<dec-octet>[1-9]\d|1\d{2}|2[0-4]\d|25[0-5]|\d)\.\g<dec-octet>\.\g<dec-octet>\.\g<dec-octet>))|::(?:\h{1,4}:){5}\g<ls32>|\h{1,4}?::(?:\h{1,4}:){4}\g<ls32>|(?:(?:\h{1,4}:)?\h{1,4})?::(?:\h{1,4}:){3}\g<ls32>|(?:(?:\h{1,4}:){,2}\h{1,4})?::(?:\h{1,4}:){2}\g<ls32>|(?:(?:\h{1,4}:){,3}\h{1,4})?::\h{1,4}:\g<ls32>|(?:(?:\h{1,4}:){,4}\h{1,4})?::\g<ls32>|(?:(?:\h{1,4}:){,5}\h{1,4})?::\h{1,4}|(?:(?:\h{1,4}:){,6}\h{1,4})?::)|(?<IPvFuture>v\h+\.[!$&-.0-;=A-Z_a-z~]+))\])|\g<IPv4address>|(?<reg-name>(?:%\h\h|[!$&-.0-9;=A-Z_a-z~])+))?(?::(?<port>\d*))?)(?<path-abempty>(?:\/(?<segment>(?:%\h\h|[!$&-.0-;=@-Z_a-z~])*))*)|(?<path-absolute>\/(?:(?<segment-nz>(?:%\h\h|[!$&-.0-;=@-Z_a-z~])+)(?:\/\g<segment>)*)?)|(?<path-rootless>\g<segment-nz>(?:\/\g<segment>)*)|(?<path-empty>))(?:\?(?<query>[^#]*))?(?:\#(?<fragment>(?:%\h\h|[!$&-.0-;=@-Z_a-z~\/?])*))?)\z/
--    RFC3986_relative_ref = /\A(?<relative-ref>(?<relative-part>\/\/(?<authority>(?:(?<userinfo>(?:%\h\h|[!$&-.0-;=A-Z_a-z~])*)@)?(?<host>(?<IP-literal>\[(?<IPv6address>(?:\h{1,4}:){6}(?<ls32>\h{1,4}:\h{1,4}|(?<IPv4address>(?<dec-octet>[1-9]\d|1\d{2}|2[0-4]\d|25[0-5]|\d)\.\g<dec-octet>\.\g<dec-octet>\.\g<dec-octet>))|::(?:\h{1,4}:){5}\g<ls32>|\h{1,4}?::(?:\h{1,4}:){4}\g<ls32>|(?:(?:\h{1,4}:){,1}\h{1,4})?::(?:\h{1,4}:){3}\g<ls32>|(?:(?:\h{1,4}:){,2}\h{1,4})?::(?:\h{1,4}:){2}\g<ls32>|(?:(?:\h{1,4}:){,3}\h{1,4})?::\h{1,4}:\g<ls32>|(?:(?:\h{1,4}:){,4}\h{1,4})?::\g<ls32>|(?:(?:\h{1,4}:){,5}\h{1,4})?::\h{1,4}|(?:(?:\h{1,4}:){,6}\h{1,4})?::)|(?<IPvFuture>v\h+\.[!$&-.0-;=A-Z_a-z~]+)\])|\g<IPv4address>|(?<reg-name>(?:%\h\h|[!$&-.0-9;=A-Z_a-z~])+))?(?::(?<port>\d*))?)(?<path-abempty>(?:\/(?<segment>(?:%\h\h|[!$&-.0-;=@-Z_a-z~])*))*)|(?<path-absolute>\/(?:(?<segment-nz>(?:%\h\h|[!$&-.0-;=@-Z_a-z~])+)(?:\/\g<segment>)*)?)|(?<path-noscheme>(?<segment-nz-nc>(?:%\h\h|[!$&-.0-9;=@-Z_a-z~])+)(?:\/\g<segment>)*)|(?<path-empty>))(?:\?(?<query>[^#]*))?(?:\#(?<fragment>(?:%\h\h|[!$&-.0-;=@-Z_a-z~\/?])*))?)\z/
-+    RFC3986_URI = /\A(?<URI>(?<scheme>[A-Za-z][+\-.0-9A-Za-z]*+):(?<hier-part>\/\/(?<authority>(?:(?<userinfo>(?:%\h\h|[!$&-.0-;=A-Z_a-z~])*+)@)?(?<host>(?<IP-literal>\[(?:(?<IPv6address>(?:\h{1,4}:){6}(?<ls32>\h{1,4}:\h{1,4}|(?<IPv4address>(?<dec-octet>[1-9]\d|1\d{2}|2[0-4]\d|25[0-5]|\d)\.\g<dec-octet>\.\g<dec-octet>\.\g<dec-octet>))|::(?:\h{1,4}:){5}\g<ls32>|\h{1,4}?::(?:\h{1,4}:){4}\g<ls32>|(?:(?:\h{1,4}:)?\h{1,4})?::(?:\h{1,4}:){3}\g<ls32>|(?:(?:\h{1,4}:){,2}\h{1,4})?::(?:\h{1,4}:){2}\g<ls32>|(?:(?:\h{1,4}:){,3}\h{1,4})?::\h{1,4}:\g<ls32>|(?:(?:\h{1,4}:){,4}\h{1,4})?::\g<ls32>|(?:(?:\h{1,4}:){,5}\h{1,4})?::\h{1,4}|(?:(?:\h{1,4}:){,6}\h{1,4})?::)|(?<IPvFuture>v\h++\.[!$&-.0-;=A-Z_a-z~]++))\])|\g<IPv4address>|(?<reg-name>(?:%\h\h|[!$&-.0-9;=A-Z_a-z~])++))?(?::(?<port>\d*+))?)(?<path-abempty>(?:\/(?<segment>(?:%\h\h|[!$&-.0-;=@-Z_a-z~])*+))*+)|(?<path-absolute>\/(?:(?<segment-nz>(?:%\h\h|[!$&-.0-;=@-Z_a-z~])++)(?:\/\g<segment>)*+)?)|(?<path-rootless>\g<segment-nz>(?:\/\g<segment>)*+)|(?<path-empty>))(?:\?(?<query>[^#]*+))?(?:\#(?<fragment>(?:%\h\h|[!$&-.0-;=@-Z_a-z~\/?])*+))?)\z/
-+    RFC3986_relative_ref = /\A(?<relative-ref>(?<relative-part>\/\/(?<authority>(?:(?<userinfo>(?:%\h\h|[!$&-.0-;=A-Z_a-z~])*+)@)?(?<host>(?<IP-literal>\[(?:(?<IPv6address>(?:\h{1,4}:){6}(?<ls32>\h{1,4}:\h{1,4}|(?<IPv4address>(?<dec-octet>[1-9]\d|1\d{2}|2[0-4]\d|25[0-5]|\d)\.\g<dec-octet>\.\g<dec-octet>\.\g<dec-octet>))|::(?:\h{1,4}:){5}\g<ls32>|\h{1,4}?::(?:\h{1,4}:){4}\g<ls32>|(?:(?:\h{1,4}:){,1}\h{1,4})?::(?:\h{1,4}:){3}\g<ls32>|(?:(?:\h{1,4}:){,2}\h{1,4})?::(?:\h{1,4}:){2}\g<ls32>|(?:(?:\h{1,4}:){,3}\h{1,4})?::\h{1,4}:\g<ls32>|(?:(?:\h{1,4}:){,4}\h{1,4})?::\g<ls32>|(?:(?:\h{1,4}:){,5}\h{1,4})?::\h{1,4}|(?:(?:\h{1,4}:){,6}\h{1,4})?::)|(?<IPvFuture>v\h++\.[!$&-.0-;=A-Z_a-z~]++))\])|\g<IPv4address>|(?<reg-name>(?:%\h\h|[!$&-.0-9;=A-Z_a-z~])++))?(?::(?<port>\d*+))?)(?<path-abempty>(?:\/(?<segment>(?:%\h\h|[!$&-.0-;=@-Z_a-z~])*+))*+)|(?<path-absolute>\/(?:(?<segment-nz>(?:%\h\h|[!$&-.0-;=@-Z_a-z~])++)(?:\/\g<segment>)*+)?)|(?<path-noscheme>(?<segment-nz-nc>(?:%\h\h|[!$&-.0-9;=@-Z_a-z~])++)(?:\/\g<segment>)*+)|(?<path-empty>))(?:\?(?<query>[^#]*+))?(?:\#(?<fragment>(?:%\h\h|[!$&-.0-;=@-Z_a-z~\/?])*+))?)\z/
-     attr_reader :regexp
- 
-     def initialize
-diff --git a/test/uri/test_parser.rb b/test/uri/test_parser.rb
-index 757ac86..2f70559 100644
---- a/test/uri/test_parser.rb
-+++ b/test/uri/test_parser.rb
-@@ -45,4 +45,11 @@ class URI::TestParser < Test::Unit::TestCase
-       URI.parse(1)
-     end
-   end
-+
-+  def test_split
-+    assert_equal(["http", nil, "example.com", nil, nil, "", nil, nil, nil], URI.split("http://example.com"))
-+    assert_equal(["http", nil, "[0::0]", nil, nil, "", nil, nil, nil], URI.split("http://[0::0]"))
-+    assert_equal([nil, nil, "example.com", nil, nil, "", nil, nil, nil], URI.split("//example.com"))
-+    assert_equal([nil, nil, "[0::0]", nil, nil, "", nil, nil, nil], URI.split("//[0::0]"))
-+  end
- end
--- 
-2.41.0
-

SOURCES/ruby-2.7.8-Fix-CVE-2023-28756-ReDoS-vulnerability-in-Time.patch

@@ -1,41 +0,0 @@
-From 71c37c29defeab2c98ad4291807efe12427a209f Mon Sep 17 00:00:00 2001
-From: Nobuyoshi Nakada <nobu@ruby-lang.org>
-Date: Tue, 29 Nov 2022 16:22:15 +0900
-Subject: [PATCH] Fix CVE-2023-28756 ReDoS vulnerability in Time.
-
-Backported from: Ruby 2.7.8
-Backported from the following commits:
-https://github.com/ruby/ruby/commit/2cb830602f52e7e76c6781115e7938b21f881c4f
-https://github.com/ruby/ruby/commit/e3f18f7d2e034f20053d7bf2fc7a50f8b7e1a27a
-
-Do not include the test case, as assert_linear_time was introduced in Ruby 2.7.
-
-==== Original commit message(s)
-
-Fix quadratic backtracking on invalid time
-
-Make RFC2822 regexp linear
-
-https://hackerone.com/reports/1485501
----
- lib/time.rb | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/lib/time.rb b/lib/time.rb
-index eb46a03..cb6f1e4 100644
---- a/lib/time.rb
-+++ b/lib/time.rb
-@@ -474,8 +474,8 @@ class Time
-           (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)\s+
-           (\d{2,})\s+
-           (\d{2})\s*
--          :\s*(\d{2})\s*
--          (?::\s*(\d{2}))?\s+
-+          :\s*(\d{2})
-+          (?:\s*:\s*(\d\d))?\s+
-           ([+-]\d{4}|
-            UT|GMT|EST|EDT|CST|CDT|MST|MDT|PST|PDT|[A-IK-Z])/ix =~ date
-         # Since RFC 2822 permit comments, the regexp has no right anchor.
--- 
-2.41.0
-

SOURCES/ruby-3.0.0-Convert-ip-addresses-to-canonical-form.patch

@@ -1,26 +0,0 @@
-From 2becb920e431110c4afc4fa069b051c5940c2096 Mon Sep 17 00:00:00 2001
-From: Jeremy Evans <code@jeremyevans.net>
-Date: Fri, 29 May 2020 14:13:30 -0700
-Subject: [PATCH] Convert ip addresses to canonical form in
- Resolv::DNS::Requester::UnconnectedUDP#sender
-
-Otherwise, if the IP address given is not in canonical form, it
-won't match, and Resolv will ignore it.
-
-Fixes [Bug #16439]
----
- lib/resolv.rb | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/lib/resolv.rb b/lib/resolv.rb
-index e7b45e785a85..d78531e174fd 100644
---- a/lib/resolv.rb
-+++ b/lib/resolv.rb
-@@ -774,6 +774,7 @@ def recv_reply(readable_socks)
-         end
- 
-         def sender(msg, data, host, port=Port)
-+          host = Addrinfo.ip(host).ip_address
-           lazy_initialize
-           sock = @socks_hash[host.index(':') ? "::" : "0.0.0.0"]
-           return nil if !sock

SOURCES/ruby-3.0.3-ext-openssl-extconf.rb-require-OpenSSL-version-1.0.1.patch

@@ -0,0 +1,84 @@
+From 202ff1372a40a8adf9aac74bfe8a39141b0c57e5 Mon Sep 17 00:00:00 2001
+From: Kazuki Yamaguchi <k@rhe.jp>
+Date: Mon, 27 Sep 2021 00:38:38 +0900
+Subject: [PATCH] ext/openssl/extconf.rb: require OpenSSL version >= 1.0.1, < 3
+
+Ruby/OpenSSL 2.1.x and 2.2.x will not support OpenSSL 3.0 API. Let's
+make extconf.rb explicitly check the version number to be within the
+acceptable range, since it will not compile anyway.
+
+Reference: https://bugs.ruby-lang.org/issues/18192
+---
+ ext/openssl/extconf.rb | 43 ++++++++++++++++++++++++------------------
+ 1 file changed, 25 insertions(+), 18 deletions(-)
+
+diff --git a/ext/openssl/extconf.rb b/ext/openssl/extconf.rb
+index 264130bb..7e817ae2 100644
+--- a/ext/openssl/extconf.rb
++++ b/ext/openssl/extconf.rb
+@@ -33,9 +33,6 @@
+   have_library("ws2_32")
+ end
+ 
+-Logging::message "=== Checking for required stuff... ===\n"
+-result = pkg_config("openssl") && have_header("openssl/ssl.h")
+-
+ if $mingw
+   append_cflags '-D_FORTIFY_SOURCE=2'
+   append_ldflags '-fstack-protector'
+@@ -92,19 +89,33 @@ def find_openssl_library
+   return false
+ end
+ 
+-unless result
+-  unless find_openssl_library
+-    Logging::message "=== Checking for required stuff failed. ===\n"
+-    Logging::message "Makefile wasn't created. Fix the errors above.\n"
+-    raise "OpenSSL library could not be found. You might want to use " \
+-      "--with-openssl-dir=<dir> option to specify the prefix where OpenSSL " \
+-      "is installed."
+-  end
++Logging::message "=== Checking for required stuff... ===\n"
++pkg_config_found = pkg_config("openssl") && have_header("openssl/ssl.h")
++
++if !pkg_config_found && !find_openssl_library
++  Logging::message "=== Checking for required stuff failed. ===\n"
++  Logging::message "Makefile wasn't created. Fix the errors above.\n"
++  raise "OpenSSL library could not be found. You might want to use " \
++    "--with-openssl-dir=<dir> option to specify the prefix where OpenSSL " \
++    "is installed."
+ end
+ 
+-unless checking_for("OpenSSL version is 1.0.1 or later") {
+-    try_static_assert("OPENSSL_VERSION_NUMBER >= 0x10001000L", "openssl/opensslv.h") }
+-  raise "OpenSSL >= 1.0.1 or LibreSSL is required"
++version_ok = if have_macro("LIBRESSL_VERSION_NUMBER", "openssl/opensslv.h")
++  is_libressl = true
++  checking_for("LibreSSL version >= 2.5.0") {
++    try_static_assert("LIBRESSL_VERSION_NUMBER >= 0x20500000L", "openssl/opensslv.h") }
++else
++  checking_for("OpenSSL version >= 1.0.1 and < 3.0.0") {
++    try_static_assert("OPENSSL_VERSION_NUMBER >= 0x10001000L", "openssl/opensslv.h") &&
++    !try_static_assert("OPENSSL_VERSION_MAJOR >= 3", "openssl/opensslv.h") }
++end
++unless version_ok
++  raise "OpenSSL >= 1.0.1, < 3.0.0 or LibreSSL >= 2.5.0 is required"
++end
++
++# Prevent wincrypt.h from being included, which defines conflicting macro with openssl/x509.h
++if is_libressl && ($mswin || $mingw)
++  $defs.push("-DNOCRYPT")
+ end
+ 
+ Logging::message "=== Checking for OpenSSL features... ===\n"
+@@ -116,10 +127,6 @@ def find_openssl_library
+   have_func("ENGINE_load_#{name}()", "openssl/engine.h")
+ }
+ 
+-if ($mswin || $mingw) && have_macro("LIBRESSL_VERSION_NUMBER", "openssl/opensslv.h")
+-  $defs.push("-DNOCRYPT")
+-end
+-
+ # added in 1.0.2
+ have_func("EC_curve_nist2nid")
+ have_func("X509_REVOKED_dup")

SOURCES/ruby-3.0.3-fiddle-1.0.8-Rely-on-hard-coded-lib-name-to-detect-glibc.patch

@@ -1,25 +0,0 @@
-From a267a40be7844224c5f000530bd3e8e906f1acea Mon Sep 17 00:00:00 2001
-From: Jeremy Evans <code@jeremyevans.net>
-Date: Wed, 10 Mar 2021 13:48:00 -0800
-Subject: [PATCH] Do not use a libdir for glibc, it breaks Linux PPC64 (#70)
-
-Fixes [Bug #12666]
----
- test/fiddle/helper.rb | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/test/fiddle/helper.rb b/test/fiddle/helper.rb
-index f38f903..a6e2019 100644
---- a/test/fiddle/helper.rb
-+++ b/test/fiddle/helper.rb
-@@ -20,8 +20,8 @@
-     # 64-bit ruby
-     libdir = '/lib64' if File.directory? '/lib64'
-   end
--  libc_so = File.join(libdir, "libc.so.6")
--  libm_so = File.join(libdir, "libm.so.6")
-+  libc_so = "libc.so.6"
-+  libm_so = "libm.so.6"
- when /mingw/, /mswin/
-   require "rbconfig"
-   crtname = RbConfig::CONFIG["RUBY_SO_NAME"][/msvc\w+/] || 'ucrtbase'

SOURCES/ruby-3.0.7-Fix-CVE-2023-36617-Upstreams-incomplete-fix-for-CVE-2023-28755.patch

@@ -1,44 +0,0 @@
-From 5d08bbb0415c2ecc10037837b81e6a27d40ee7be Mon Sep 17 00:00:00 2001
-From: Hiroshi SHIBATA <hsbt@ruby-lang.org>
-Date: Thu, 29 Jun 2023 22:25:17 +0900
-Subject: [PATCH] CVE-2023-36617 for Ruby 3.0 (#7997)
-
-* Merge URI-0.10.3
-
----
-
-Backport note, bundler is not distributed the same as RubyGems in Ruby
-2.5, therefore we do not use backport for Bundler.
----
- lib/uri/rfc2396_parser.rb |  4 ++--
- lib/uri/rfc3986_parser.rb |  2 +-
- 3 files changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/lib/uri/rfc2396_parser.rb b/lib/uri/rfc2396_parser.rb
-index b9e7b2b26e..c7c3ecd96d 100644
---- a/lib/uri/rfc2396_parser.rb
-+++ b/lib/uri/rfc2396_parser.rb
-@@ -502,8 +502,8 @@ def initialize_regexp(pattern)
-       ret = {}
- 
-       # for URI::split
--      ret[:ABS_URI] = Regexp.new('\A\s*' + pattern[:X_ABS_URI] + '\s*\z', Regexp::EXTENDED)
--      ret[:REL_URI] = Regexp.new('\A\s*' + pattern[:X_REL_URI] + '\s*\z', Regexp::EXTENDED)
-+      ret[:ABS_URI] = Regexp.new('\A\s*+' + pattern[:X_ABS_URI] + '\s*\z', Regexp::EXTENDED)
-+      ret[:REL_URI] = Regexp.new('\A\s*+' + pattern[:X_REL_URI] + '\s*\z', Regexp::EXTENDED)
- 
-       # for URI::extract
-       ret[:URI_REF]     = Regexp.new(pattern[:URI_REF])
-diff --git a/lib/uri/rfc3986_parser.rb b/lib/uri/rfc3986_parser.rb
-index ad32368cfa..1accd03376 100644
---- a/lib/uri/rfc3986_parser.rb
-+++ b/lib/uri/rfc3986_parser.rb
-@@ -106,7 +106,7 @@ def default_regexp # :nodoc:
-         QUERY: /\A(?:%\h\h|[!$&-.0-;=@-Z_a-z~\/?])*\z/,
-         FRAGMENT: /\A(?:%\h\h|[!$&-.0-;=@-Z_a-z~\/?])*\z/,
-         OPAQUE: /\A(?:[^\/].*)?\z/,
--        PORT: /\A[\x09\x0a\x0c\x0d ]*\d*[\x09\x0a\x0c\x0d ]*\z/,
-+        PORT: /\A[\x09\x0a\x0c\x0d ]*+\d*[\x09\x0a\x0c\x0d ]*\z/,
-       }
-     end
- 

SOURCES/ruby-3.0.7-Fix-CVE-2024-27280-Buffer-overread-in-StringIO.patch

@@ -1,81 +0,0 @@
-From 740289bf02c9bea54f75b702f62862c62c62672b Mon Sep 17 00:00:00 2001
-From: Hiroshi SHIBATA <hsbt@ruby-lang.org>
-Date: Thu, 21 Mar 2024 15:55:48 +0900
-Subject: [PATCH] Merge StringIO 3.0.1.1
-
----
- ext/stringio/stringio.c        |  2 +-
- test/stringio/test_stringio.rb | 27 ++++++++++++++++++++++-----
- 2 files changed, 23 insertions(+), 6 deletions(-)
-
-diff --git a/ext/stringio/stringio.c b/ext/stringio/stringio.c
-index f537054b5d..946ae06da4 100644
---- a/ext/stringio/stringio.c
-+++ b/ext/stringio/stringio.c
-@@ -833,7 +833,7 @@ strio_unget_bytes(struct StringIO *ptr, const char *cp, long cl)
-     len = RSTRING_LEN(str);
-     rest = pos - len;
-     if (cl > pos) {
--	long ex = (rest < 0 ? cl-pos : cl+rest);
-+	long ex = cl - (rest < 0 ? pos : len);
- 	rb_str_modify_expand(str, ex);
- 	rb_str_set_len(str, len + ex);
- 	s = RSTRING_PTR(str);
-diff --git a/test/stringio/test_stringio.rb b/test/stringio/test_stringio.rb
-index f5169f641a..c055b901e3 100644
---- a/test/stringio/test_stringio.rb
-+++ b/test/stringio/test_stringio.rb
-@@ -693,6 +693,15 @@ def test_ungetc_padding
-     assert_equal("b""\0""a", s.string)
-   end
- 
-+  def test_ungetc_fill
-+    count = 100
-+    s = StringIO.new
-+    s.print 'a' * count
-+    s.ungetc('b' * (count * 5))
-+    assert_equal((count * 5), s.string.size)
-+    assert_match(/\Ab+\z/, s.string)
-+  end
-+
-   def test_ungetbyte_pos
-     b = '\\b00010001 \\B00010001 \\b1 \\B1 \\b000100011'
-     s = StringIO.new( b )
-@@ -718,6 +727,15 @@ def test_ungetbyte_padding
-     assert_equal("b""\0""a", s.string)
-   end
- 
-+  def test_ungetbyte_fill
-+    count = 100
-+    s = StringIO.new
-+    s.print 'a' * count
-+    s.ungetbyte('b' * (count * 5))
-+    assert_equal((count * 5), s.string.size)
-+    assert_match(/\Ab+\z/, s.string)
-+  end
-+
-   def test_frozen
-     s = StringIO.new
-     s.freeze
-@@ -760,18 +778,17 @@ def test_new_block_warning
-   end
- 
-   def test_overflow
--    skip if RbConfig::SIZEOF["void*"] > RbConfig::SIZEOF["long"]
-+    return if RbConfig::SIZEOF["void*"] > RbConfig::SIZEOF["long"]
-     limit = (1 << (RbConfig::SIZEOF["void*"]*8-1)) - 0x10
-     assert_separately(%w[-rstringio], "#{<<-"begin;"}\n#{<<-"end;"}")
-     begin;
-       limit = #{limit}
-       ary = []
--      while true
-+      begin
-         x = "a"*0x100000
-         break if [x].pack("p").unpack("i!")[0] < 0
-         ary << x
--        skip if ary.size > 100
--      end
-+      end while ary.size <= 100
-       s = StringIO.new(x)
-       s.gets("xxx", limit)
-       assert_equal(0x100000, s.pos)

SOURCES/ruby-3.0.7-Fix-CVE-2024-27281-RCE-vulnerability-with-rdoc_options.patch

@@ -1,203 +0,0 @@
-From 7957a25edf844c966de45848fa7e9e2513955660 Mon Sep 17 00:00:00 2001
-From: Hiroshi SHIBATA <hsbt@ruby-lang.org>
-Date: Thu, 21 Mar 2024 15:47:40 +0900
-Subject: [PATCH 1/2] Merge RDoc-6.3.4.1
-
----
- lib/rdoc/rdoc.rb               |  3 ++-
- lib/rdoc/store.rb              | 45 ++++++++++++++++++++--------------
- test/rdoc/test_rdoc_options.rb |  6 ++---
- 3 files changed, 31 insertions(+), 23 deletions(-)
-
-diff --git a/lib/rdoc/rdoc.rb b/lib/rdoc/rdoc.rb
-index a2711fbbd1..c5690fc3b4 100644
---- a/lib/rdoc/rdoc.rb
-+++ b/lib/rdoc/rdoc.rb
-@@ -162,8 +162,9 @@ def load_options
-     RDoc.load_yaml
- 
-     begin
--      options = YAML.load_file '.rdoc_options'
-+      options = YAML.safe_load_file '.rdoc_options', permitted_classes: [RDoc::Options, Symbol]
-     rescue Psych::SyntaxError
-+      raise RDoc::Error, "#{options_file} is not a valid rdoc options file"
-     end
- 
-     raise RDoc::Error, "#{options_file} is not a valid rdoc options file" unless
-diff --git a/lib/rdoc/store.rb b/lib/rdoc/store.rb
-index 999aa76f92..07d03e90f7 100644
---- a/lib/rdoc/store.rb
-+++ b/lib/rdoc/store.rb
-@@ -539,9 +539,7 @@ def load_all
-   def load_cache
-     #orig_enc = @encoding
- 
--    open cache_path, 'rb' do |io|
--      @cache = Marshal.load io.read
--    end
-+    @cache = marshal_load(cache_path)
- 
-     load_enc = @cache[:encoding]
- 
-@@ -596,9 +594,7 @@ def load_class klass_name
-   def load_class_data klass_name
-     file = class_file klass_name
- 
--    open file, 'rb' do |io|
--      Marshal.load io.read
--    end
-+    marshal_load(file)
-   rescue Errno::ENOENT => e
-     error = MissingFileError.new(self, file, klass_name)
-     error.set_backtrace e.backtrace
-@@ -611,14 +607,10 @@ def load_class_data klass_name
-   def load_method klass_name, method_name
-     file = method_file klass_name, method_name
- 
--    open file, 'rb' do |io|
--      obj = Marshal.load io.read
--      obj.store = self
--      obj.parent =
--        find_class_or_module(klass_name) || load_class(klass_name) unless
--          obj.parent
--      obj
--    end
-+    obj = marshal_load(file)
-+    obj.store = self
-+    obj.parent ||= find_class_or_module(klass_name) || load_class(klass_name)
-+    obj
-   rescue Errno::ENOENT => e
-     error = MissingFileError.new(self, file, klass_name + method_name)
-     error.set_backtrace e.backtrace
-@@ -631,11 +623,9 @@ def load_method klass_name, method_name
-   def load_page page_name
-     file = page_file page_name
- 
--    open file, 'rb' do |io|
--      obj = Marshal.load io.read
--      obj.store = self
--      obj
--    end
-+    obj = marshal_load(file)
-+    obj.store = self
-+    obj
-   rescue Errno::ENOENT => e
-     error = MissingFileError.new(self, file, page_name)
-     error.set_backtrace e.backtrace
-@@ -965,4 +955,21 @@ def unique_modules
-     @unique_modules
-   end
- 
-+  private
-+  def marshal_load(file)
-+    File.open(file, 'rb') {|io| Marshal.load(io, MarshalFilter)}
-+  end
-+
-+  MarshalFilter = proc do |obj|
-+    case obj
-+    when true, false, nil, Array, Class, Encoding, Hash, Integer, String, Symbol, RDoc::Text
-+    else
-+      unless obj.class.name.start_with?("RDoc::")
-+        raise TypeError, "not permitted class: #{obj.class.name}"
-+      end
-+    end
-+    obj
-+  end
-+  private_constant :MarshalFilter
-+
- end
-diff --git a/test/rdoc/test_rdoc_options.rb b/test/rdoc/test_rdoc_options.rb
-index 400ed9a549..247c7c87ce 100644
---- a/test/rdoc/test_rdoc_options.rb
-+++ b/test/rdoc/test_rdoc_options.rb
-@@ -145,7 +145,7 @@ def test_init_with_encoding
- 
-     @options.encoding = Encoding::IBM437
- 
--    options = YAML.load YAML.dump @options
-+    options = YAML.safe_load(YAML.dump(@options), permitted_classes: [RDoc::Options, Symbol])
- 
-     assert_equal Encoding::IBM437, options.encoding
-   end
-@@ -161,7 +161,7 @@ def test_init_with_trim_paths
- - /etc
-     YAML
- 
--    options = YAML.load yaml
-+    options = YAML.safe_load(yaml, permitted_classes: [RDoc::Options, Symbol])
- 
-     assert_empty options.rdoc_include
-     assert_empty options.static_path
-@@ -729,7 +729,7 @@ def test_write_options
- 
-       assert File.exist? '.rdoc_options'
- 
--      assert_equal @options, YAML.load(File.read('.rdoc_options'))
-+      assert_equal @options, YAML.safe_load(File.read('.rdoc_options'), permitted_classes: [RDoc::Options, Symbol])
-     end
-   end
- 
-
-From 153a4d16058783c923d0df5b1cbe2610ef96e3a8 Mon Sep 17 00:00:00 2001
-From: Jarek Prokop <jprokop@redhat.com>
-Date: Tue, 28 May 2024 16:56:26 +0200
-Subject: [PATCH 2/2] Port the rebase to work with Ruby 2.5.9.
-
-Ruby 2.5's Psych does not have safe_load_file method.
-However, from Ruby 3.3's sources, the method is just File.read
-simple wrapper with a safe_load call. Therefore it was copied over to
-the lib/rdoc/rdoc.rb file.
----
- lib/rdoc/rdoc.rb               | 9 ++++++-
- test/rdoc/test_rdoc_options.rb | 6 +++---
- 2 files changed, 11 insertions(+), 4 deletions(-)
-
-diff --git a/lib/rdoc/rdoc.rb b/lib/rdoc/rdoc.rb
-index c5690fc3b4..435cd2eaf0 100644
---- a/lib/rdoc/rdoc.rb
-+++ b/lib/rdoc/rdoc.rb
-@@ -162,7 +162,12 @@ def load_options
-     RDoc.load_yaml
- 
-     begin
--      options = YAML.safe_load_file '.rdoc_options', permitted_classes: [RDoc::Options, Symbol]
-+      # Opening file inspired from Ruby 3.3.0 sources,
-+      # file 'ext/psych/lib/psych.rb', line 658.
-+      # https://github.com/ruby/ruby/blob/v3_3_0/ext/psych/lib/psych.rb#L658
-+      options = File.open('.rdoc_options', 'r:bom|utf-8') do |file|
-+        YAML.safe_load file, [RDoc::Options, Symbol], [], false, '.rdoc_options'
-+      end
-     rescue Psych::SyntaxError
-       raise RDoc::Error, "#{options_file} is not a valid rdoc options file"
-     end
-diff --git a/test/rdoc/test_rdoc_options.rb b/test/rdoc/test_rdoc_options.rb
-index 247c7c87ce..60fe035dce 100644
---- a/test/rdoc/test_rdoc_options.rb
-+++ b/test/rdoc/test_rdoc_options.rb
-@@ -145,7 +145,7 @@ def test_init_with_encoding
- 
-     @options.encoding = Encoding::IBM437
- 
--    options = YAML.safe_load(YAML.dump(@options), permitted_classes: [RDoc::Options, Symbol])
-+    options = YAML.safe_load(YAML.dump(@options), [RDoc::Options, Symbol])
- 
-     assert_equal Encoding::IBM437, options.encoding
-   end
-@@ -161,7 +161,7 @@ def test_init_with_trim_paths
- - /etc
-     YAML
- 
--    options = YAML.safe_load(yaml, permitted_classes: [RDoc::Options, Symbol])
-+    options = YAML.safe_load(yaml, [RDoc::Options, Symbol])
- 
-     assert_empty options.rdoc_include
-     assert_empty options.static_path
-@@ -729,7 +729,7 @@ def test_write_options
- 
-       assert File.exist? '.rdoc_options'
- 
--      assert_equal @options, YAML.safe_load(File.read('.rdoc_options'), permitted_classes: [RDoc::Options, Symbol])
-+      assert_equal @options, YAML.safe_load(File.read('.rdoc_options'), [RDoc::Options, Symbol])
-     end
-   end
- 

SOURCES/ruby-3.0.7-Fix-CVE-2024-27282-Memory-address-read-with-Regex.patch

@@ -1,48 +0,0 @@
-From 9eda3000e3efd5bdd4ed60d07e2f43633e39d361 Mon Sep 17 00:00:00 2001
-From: Hiroshi SHIBATA <hsbt@ruby-lang.org>
-Date: Tue, 23 Apr 2024 19:22:22 +0900
-Subject: [PATCH] merge revision(s) 33e5b47c16f1fd3382186e6ffe73cfc6e00946f7:
-
-	Fix handling of reg->dmin in Regex matching
-
-	---
-	 regexec.c | 10 ++++++++++
-	 1 file changed, 10 insertions(+)
----
- regexec.c | 10 ++++++++++
- 1 file changed, 10 insertions(+)
-
-diff --git a/regexec.c b/regexec.c
-index 4582c35c3f..36ac1d4bc5 100644
---- a/regexec.c
-+++ b/regexec.c
-@@ -3900,12 +3900,17 @@ forward_search_range(regex_t* reg, const UChar* str, const UChar* end, UChar* s,
- 		     UChar* range, UChar** low, UChar** high, UChar** low_prev)
- {
-   UChar *p, *pprev = (UChar* )NULL;
-+  size_t input_len = end - str;
- 
- #ifdef ONIG_DEBUG_SEARCH
-   fprintf(stderr, "forward_search_range: str: %"PRIuPTR" (%p), end: %"PRIuPTR" (%p), s: %"PRIuPTR" (%p), range: %"PRIuPTR" (%p)\n",
- 	  (uintptr_t )str, str, (uintptr_t )end, end, (uintptr_t )s, s, (uintptr_t )range, range);
- #endif
- 
-+  if (reg->dmin > input_len) {
-+    return 0;
-+  }
-+
-   p = s;
-   if (reg->dmin > 0) {
-     if (ONIGENC_IS_SINGLEBYTE(reg->enc)) {
-@@ -4042,6 +4047,11 @@ backward_search_range(regex_t* reg, const UChar* str, const UChar* end,
- 		      UChar** low, UChar** high)
- {
-   UChar *p;
-+  size_t input_len = end - str;
-+
-+  if (reg->dmin > input_len) {
-+    return 0;
-+  }
- 
-   range += reg->dmin;
-   p = s;

SOURCES/ruby-3.1.0-Allocate-EVP_PKEY-on-initialize.patch

@@ -0,0 +1,630 @@
+From 316cb2a41f154e4663d7e7fead60cfc0bfa86af9 Mon Sep 17 00:00:00 2001
+From: Kazuki Yamaguchi <k@rhe.jp>
+Date: Mon, 12 Apr 2021 13:55:10 +0900
+Subject: [PATCH 1/2] pkey: do not check NULL argument in ossl_pkey_new()
+
+Passing NULL to ossl_pkey_new() makes no sense in the first place, and
+in fact it is ensured not to be NULL in all cases.
+---
+ ext/openssl/ossl_pkey.c | 6 +-----
+ ext/openssl/ossl_pkey.h | 1 +
+ 2 files changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/ext/openssl/ossl_pkey.c b/ext/openssl/ossl_pkey.c
+index f9f5162e..820e4a2c 100644
+--- a/ext/openssl/ossl_pkey.c
++++ b/ext/openssl/ossl_pkey.c
+@@ -38,12 +38,8 @@ static VALUE
+ pkey_new0(EVP_PKEY *pkey)
+ {
+     VALUE klass, obj;
+-    int type;
+ 
+-    if (!pkey || (type = EVP_PKEY_base_id(pkey)) == EVP_PKEY_NONE)
+-	ossl_raise(rb_eRuntimeError, "pkey is empty");
+-
+-    switch (type) {
++    switch (EVP_PKEY_base_id(pkey)) {
+ #if !defined(OPENSSL_NO_RSA)
+       case EVP_PKEY_RSA: klass = cRSA; break;
+ #endif
+diff --git a/ext/openssl/ossl_pkey.h b/ext/openssl/ossl_pkey.h
+index 4beede22..f0476780 100644
+--- a/ext/openssl/ossl_pkey.h
++++ b/ext/openssl/ossl_pkey.h
+@@ -35,6 +35,7 @@ extern const rb_data_type_t ossl_evp_pkey_type;
+     } \
+ } while (0)
+ 
++/* Takes ownership of the EVP_PKEY */
+ VALUE ossl_pkey_new(EVP_PKEY *);
+ void ossl_pkey_check_public_key(const EVP_PKEY *);
+ EVP_PKEY *ossl_pkey_read_generic(BIO *, VALUE);
+
+From 74f6c6175688502a5bf27ae35367616858630c0f Mon Sep 17 00:00:00 2001
+From: Kazuki Yamaguchi <k@rhe.jp>
+Date: Mon, 12 Apr 2021 18:32:40 +0900
+Subject: [PATCH 2/2] pkey: allocate EVP_PKEY on #initialize
+
+Allocate an EVP_PKEY when the content is ready: when #initialize
+or #initialize_copy is called, rather than when a T_DATA is allocated.
+This is more natural because the lower level API has been deprecated
+and an EVP_PKEY is becoming the minimum unit of handling keys.
+---
+ ext/openssl/ossl_pkey.c     | 15 ++----
+ ext/openssl/ossl_pkey.h     | 15 ++----
+ ext/openssl/ossl_pkey_dh.c  | 71 +++++++++++++++++++--------
+ ext/openssl/ossl_pkey_dsa.c | 93 ++++++++++++++++++++---------------
+ ext/openssl/ossl_pkey_ec.c  | 91 +++++++++++++++++++----------------
+ ext/openssl/ossl_pkey_rsa.c | 96 ++++++++++++++++++++++---------------
+ 6 files changed, 218 insertions(+), 163 deletions(-)
+
+diff --git a/ext/openssl/ossl_pkey.c b/ext/openssl/ossl_pkey.c
+index 820e4a2c..ea75d63f 100644
+--- a/ext/openssl/ossl_pkey.c
++++ b/ext/openssl/ossl_pkey.c
+@@ -54,8 +54,8 @@ pkey_new0(EVP_PKEY *pkey)
+ #endif
+       default:           klass = cPKey; break;
+     }
+-    obj = NewPKey(klass);
+-    SetPKey(obj, pkey);
++    obj = rb_obj_alloc(klass);
++    RTYPEDDATA_DATA(obj) = pkey;
+     return obj;
+ }
+ 
+@@ -511,16 +511,7 @@ DupPKeyPtr(VALUE obj)
+ static VALUE
+ ossl_pkey_alloc(VALUE klass)
+ {
+-    EVP_PKEY *pkey;
+-    VALUE obj;
+-
+-    obj = NewPKey(klass);
+-    if (!(pkey = EVP_PKEY_new())) {
+-	ossl_raise(ePKeyError, NULL);
+-    }
+-    SetPKey(obj, pkey);
+-
+-    return obj;
++    return TypedData_Wrap_Struct(klass, &ossl_evp_pkey_type, NULL);
+ }
+ 
+ /*
+diff --git a/ext/openssl/ossl_pkey.h b/ext/openssl/ossl_pkey.h
+index f0476780..ed18bc69 100644
+--- a/ext/openssl/ossl_pkey.h
++++ b/ext/openssl/ossl_pkey.h
+@@ -15,19 +15,10 @@ extern VALUE cPKey;
+ extern VALUE ePKeyError;
+ extern const rb_data_type_t ossl_evp_pkey_type;
+ 
+-#define OSSL_PKEY_SET_PRIVATE(obj) rb_iv_set((obj), "private", Qtrue)
+-#define OSSL_PKEY_SET_PUBLIC(obj)  rb_iv_set((obj), "private", Qfalse)
+-#define OSSL_PKEY_IS_PRIVATE(obj)  (rb_iv_get((obj), "private") == Qtrue)
++/* For ENGINE */
++#define OSSL_PKEY_SET_PRIVATE(obj) rb_ivar_set((obj), rb_intern("private"), Qtrue)
++#define OSSL_PKEY_IS_PRIVATE(obj)  (rb_attr_get((obj), rb_intern("private")) == Qtrue)
+ 
+-#define NewPKey(klass) \
+-    TypedData_Wrap_Struct((klass), &ossl_evp_pkey_type, 0)
+-#define SetPKey(obj, pkey) do { \
+-    if (!(pkey)) { \
+-	rb_raise(rb_eRuntimeError, "PKEY wasn't initialized!"); \
+-    } \
+-    RTYPEDDATA_DATA(obj) = (pkey); \
+-    OSSL_PKEY_SET_PUBLIC(obj); \
+-} while (0)
+ #define GetPKey(obj, pkey) do {\
+     TypedData_Get_Struct((obj), EVP_PKEY, &ossl_evp_pkey_type, (pkey)); \
+     if (!(pkey)) { \
+diff --git a/ext/openssl/ossl_pkey_dh.c b/ext/openssl/ossl_pkey_dh.c
+index ca782bbe..04c11b21 100644
+--- a/ext/openssl/ossl_pkey_dh.c
++++ b/ext/openssl/ossl_pkey_dh.c
+@@ -72,34 +72,57 @@ static VALUE
+ ossl_dh_initialize(int argc, VALUE *argv, VALUE self)
+ {
+     EVP_PKEY *pkey;
++    int type;
+     DH *dh;
+-    BIO *in;
++    BIO *in = NULL;
+     VALUE arg;
+ 
+-    GetPKey(self, pkey);
++    TypedData_Get_Struct(self, EVP_PKEY, &ossl_evp_pkey_type, pkey);
++    if (pkey)
++        rb_raise(rb_eTypeError, "pkey already initialized");
++
+     /* The DH.new(size, generator) form is handled by lib/openssl/pkey.rb */
+     if (rb_scan_args(argc, argv, "01", &arg) == 0) {
+         dh = DH_new();
+         if (!dh)
+             ossl_raise(eDHError, "DH_new");
++        goto legacy;
+     }
+-    else {
+-	arg = ossl_to_der_if_possible(arg);
+-	in = ossl_obj2bio(&arg);
+-	dh = PEM_read_bio_DHparams(in, NULL, NULL, NULL);
+-	if (!dh){
+-	    OSSL_BIO_reset(in);
+-	    dh = d2i_DHparams_bio(in, NULL);
+-	}
+-	BIO_free(in);
+-	if (!dh) {
+-	    ossl_raise(eDHError, NULL);
+-	}
++
++    arg = ossl_to_der_if_possible(arg);
++    in = ossl_obj2bio(&arg);
++
++    /*
++     * On OpenSSL <= 1.1.1 and current versions of LibreSSL, the generic
++     * routine does not support DER-encoded parameters
++     */
++    dh = d2i_DHparams_bio(in, NULL);
++    if (dh)
++        goto legacy;
++    OSSL_BIO_reset(in);
++
++    pkey = ossl_pkey_read_generic(in, Qnil);
++    BIO_free(in);
++    if (!pkey)
++        ossl_raise(eDHError, "could not parse pkey");
++
++    type = EVP_PKEY_base_id(pkey);
++    if (type != EVP_PKEY_DH) {
++        EVP_PKEY_free(pkey);
++        rb_raise(eDHError, "incorrect pkey type: %s", OBJ_nid2sn(type));
+     }
+-    if (!EVP_PKEY_assign_DH(pkey, dh)) {
+-	DH_free(dh);
+-	ossl_raise(eDHError, NULL);
++    RTYPEDDATA_DATA(self) = pkey;
++    return self;
++
++  legacy:
++    BIO_free(in);
++    pkey = EVP_PKEY_new();
++    if (!pkey || EVP_PKEY_assign_DH(pkey, dh) != 1) {
++        EVP_PKEY_free(pkey);
++        DH_free(dh);
++        ossl_raise(eDHError, "EVP_PKEY_assign_DH");
+     }
++    RTYPEDDATA_DATA(self) = pkey;
+     return self;
+ }
+ 
+@@ -110,15 +133,14 @@ ossl_dh_initialize_copy(VALUE self, VALUE other)
+     DH *dh, *dh_other;
+     const BIGNUM *pub, *priv;
+ 
+-    GetPKey(self, pkey);
+-    if (EVP_PKEY_base_id(pkey) != EVP_PKEY_NONE)
+-	ossl_raise(eDHError, "DH already initialized");
++    TypedData_Get_Struct(self, EVP_PKEY, &ossl_evp_pkey_type, pkey);
++    if (pkey)
++        rb_raise(rb_eTypeError, "pkey already initialized");
+     GetDH(other, dh_other);
+ 
+     dh = DHparams_dup(dh_other);
+     if (!dh)
+ 	ossl_raise(eDHError, "DHparams_dup");
+-    EVP_PKEY_assign_DH(pkey, dh);
+ 
+     DH_get0_key(dh_other, &pub, &priv);
+     if (pub) {
+@@ -133,6 +155,13 @@ ossl_dh_initialize_copy(VALUE self, VALUE other)
+ 	DH_set0_key(dh, pub2, priv2);
+     }
+ 
++    pkey = EVP_PKEY_new();
++    if (!pkey || EVP_PKEY_assign_DH(pkey, dh) != 1) {
++        EVP_PKEY_free(pkey);
++        DH_free(dh);
++        ossl_raise(eDHError, "EVP_PKEY_assign_DH");
++    }
++    RTYPEDDATA_DATA(self) = pkey;
+     return self;
+ }
+ 
+diff --git a/ext/openssl/ossl_pkey_dsa.c b/ext/openssl/ossl_pkey_dsa.c
+index 7af00eeb..15724548 100644
+--- a/ext/openssl/ossl_pkey_dsa.c
++++ b/ext/openssl/ossl_pkey_dsa.c
+@@ -83,50 +83,59 @@ VALUE eDSAError;
+ static VALUE
+ ossl_dsa_initialize(int argc, VALUE *argv, VALUE self)
+ {
+-    EVP_PKEY *pkey, *tmp;
+-    DSA *dsa = NULL;
+-    BIO *in;
++    EVP_PKEY *pkey;
++    DSA *dsa;
++    BIO *in = NULL;
+     VALUE arg, pass;
++    int type;
++
++    TypedData_Get_Struct(self, EVP_PKEY, &ossl_evp_pkey_type, pkey);
++    if (pkey)
++        rb_raise(rb_eTypeError, "pkey already initialized");
+ 
+-    GetPKey(self, pkey);
+     /* The DSA.new(size, generator) form is handled by lib/openssl/pkey.rb */
+     rb_scan_args(argc, argv, "02", &arg, &pass);
+     if (argc == 0) {
+         dsa = DSA_new();
+         if (!dsa)
+             ossl_raise(eDSAError, "DSA_new");
++        goto legacy;
+     }
+-    else {
+-	pass = ossl_pem_passwd_value(pass);
+-	arg = ossl_to_der_if_possible(arg);
+-	in = ossl_obj2bio(&arg);
+-
+-        tmp = ossl_pkey_read_generic(in, pass);
+-        if (tmp) {
+-            if (EVP_PKEY_base_id(tmp) != EVP_PKEY_DSA)
+-                rb_raise(eDSAError, "incorrect pkey type: %s",
+-                         OBJ_nid2sn(EVP_PKEY_base_id(tmp)));
+-            dsa = EVP_PKEY_get1_DSA(tmp);
+-            EVP_PKEY_free(tmp);
+-        }
+-	if (!dsa) {
+-	    OSSL_BIO_reset(in);
+-#define PEM_read_bio_DSAPublicKey(bp,x,cb,u) (DSA *)PEM_ASN1_read_bio( \
+-	(d2i_of_void *)d2i_DSAPublicKey, PEM_STRING_DSA_PUBLIC, (bp), (void **)(x), (cb), (u))
+-	    dsa = PEM_read_bio_DSAPublicKey(in, NULL, NULL, NULL);
+-#undef PEM_read_bio_DSAPublicKey
+-	}
+-	BIO_free(in);
+-	if (!dsa) {
+-	    ossl_clear_error();
+-	    ossl_raise(eDSAError, "Neither PUB key nor PRIV key");
+-	}
+-    }
+-    if (!EVP_PKEY_assign_DSA(pkey, dsa)) {
+-	DSA_free(dsa);
+-	ossl_raise(eDSAError, NULL);
++
++    pass = ossl_pem_passwd_value(pass);
++    arg = ossl_to_der_if_possible(arg);
++    in = ossl_obj2bio(&arg);
++
++    /* DER-encoded DSAPublicKey format isn't supported by the generic routine */
++    dsa = (DSA *)PEM_ASN1_read_bio((d2i_of_void *)d2i_DSAPublicKey,
++                                   PEM_STRING_DSA_PUBLIC,
++                                   in, NULL, NULL, NULL);
++    if (dsa)
++        goto legacy;
++    OSSL_BIO_reset(in);
++
++    pkey = ossl_pkey_read_generic(in, pass);
++    BIO_free(in);
++    if (!pkey)
++        ossl_raise(eDSAError, "Neither PUB key nor PRIV key");
++
++    type = EVP_PKEY_base_id(pkey);
++    if (type != EVP_PKEY_DSA) {
++        EVP_PKEY_free(pkey);
++        rb_raise(eDSAError, "incorrect pkey type: %s", OBJ_nid2sn(type));
+     }
++    RTYPEDDATA_DATA(self) = pkey;
++    return self;
+ 
++  legacy:
++    BIO_free(in);
++    pkey = EVP_PKEY_new();
++    if (!pkey || EVP_PKEY_assign_DSA(pkey, dsa) != 1) {
++        EVP_PKEY_free(pkey);
++        DSA_free(dsa);
++        ossl_raise(eDSAError, "EVP_PKEY_assign_DSA");
++    }
++    RTYPEDDATA_DATA(self) = pkey;
+     return self;
+ }
+ 
+@@ -136,16 +145,24 @@ ossl_dsa_initialize_copy(VALUE self, VALUE other)
+     EVP_PKEY *pkey;
+     DSA *dsa, *dsa_new;
+ 
+-    GetPKey(self, pkey);
+-    if (EVP_PKEY_base_id(pkey) != EVP_PKEY_NONE)
+-	ossl_raise(eDSAError, "DSA already initialized");
++    TypedData_Get_Struct(self, EVP_PKEY, &ossl_evp_pkey_type, pkey);
++    if (pkey)
++        rb_raise(rb_eTypeError, "pkey already initialized");
+     GetDSA(other, dsa);
+ 
+-    dsa_new = ASN1_dup((i2d_of_void *)i2d_DSAPrivateKey, (d2i_of_void *)d2i_DSAPrivateKey, (char *)dsa);
++    dsa_new = (DSA *)ASN1_dup((i2d_of_void *)i2d_DSAPrivateKey,
++                              (d2i_of_void *)d2i_DSAPrivateKey,
++                              (char *)dsa);
+     if (!dsa_new)
+ 	ossl_raise(eDSAError, "ASN1_dup");
+ 
+-    EVP_PKEY_assign_DSA(pkey, dsa_new);
++    pkey = EVP_PKEY_new();
++    if (!pkey || EVP_PKEY_assign_DSA(pkey, dsa_new) != 1) {
++        EVP_PKEY_free(pkey);
++        DSA_free(dsa_new);
++        ossl_raise(eDSAError, "EVP_PKEY_assign_DSA");
++    }
++    RTYPEDDATA_DATA(self) = pkey;
+ 
+     return self;
+ }
+diff --git a/ext/openssl/ossl_pkey_ec.c b/ext/openssl/ossl_pkey_ec.c
+index db80d112..71e63969 100644
+--- a/ext/openssl/ossl_pkey_ec.c
++++ b/ext/openssl/ossl_pkey_ec.c
+@@ -114,13 +114,16 @@ ossl_ec_key_s_generate(VALUE klass, VALUE arg)
+     VALUE obj;
+ 
+     obj = rb_obj_alloc(klass);
+-    GetPKey(obj, pkey);
+ 
+     ec = ec_key_new_from_group(arg);
+-    if (!EVP_PKEY_assign_EC_KEY(pkey, ec)) {
++    pkey = EVP_PKEY_new();
++    if (!pkey || EVP_PKEY_assign_EC_KEY(pkey, ec) != 1) {
++        EVP_PKEY_free(pkey);
+         EC_KEY_free(ec);
+         ossl_raise(eECError, "EVP_PKEY_assign_EC_KEY");
+     }
++    RTYPEDDATA_DATA(obj) = pkey;
++
+     if (!EC_KEY_generate_key(ec))
+ 	ossl_raise(eECError, "EC_KEY_generate_key");
+ 
+@@ -141,51 +144,54 @@ ossl_ec_key_s_generate(VALUE klass, VALUE arg)
+ static VALUE ossl_ec_key_initialize(int argc, VALUE *argv, VALUE self)
+ {
+     EVP_PKEY *pkey;
+-    EC_KEY *ec = NULL;
++    EC_KEY *ec;
++    BIO *in;
+     VALUE arg, pass;
++    int type;
+ 
+-    GetPKey(self, pkey);
+-    if (EVP_PKEY_base_id(pkey) != EVP_PKEY_NONE)
+-        ossl_raise(eECError, "EC_KEY already initialized");
++    TypedData_Get_Struct(self, EVP_PKEY, &ossl_evp_pkey_type, pkey);
++    if (pkey)
++        rb_raise(rb_eTypeError, "pkey already initialized");
+ 
+     rb_scan_args(argc, argv, "02", &arg, &pass);
+-
+     if (NIL_P(arg)) {
+         if (!(ec = EC_KEY_new()))
+-	    ossl_raise(eECError, NULL);
+-    } else if (rb_obj_is_kind_of(arg, cEC)) {
+-	EC_KEY *other_ec = NULL;
++            ossl_raise(eECError, "EC_KEY_new");
++        goto legacy;
++    }
++    else if (rb_obj_is_kind_of(arg, cEC_GROUP)) {
++        ec = ec_key_new_from_group(arg);
++        goto legacy;
++    }
+ 
+-	GetEC(arg, other_ec);
+-	if (!(ec = EC_KEY_dup(other_ec)))
+-	    ossl_raise(eECError, NULL);
+-    } else if (rb_obj_is_kind_of(arg, cEC_GROUP)) {
+-	ec = ec_key_new_from_group(arg);
+-    } else {
+-        BIO *in = ossl_obj2bio(&arg);
+-        EVP_PKEY *tmp;
+-        pass = ossl_pem_passwd_value(pass);
+-        tmp = ossl_pkey_read_generic(in, pass);
+-        if (tmp) {
+-            if (EVP_PKEY_base_id(tmp) != EVP_PKEY_EC)
+-                rb_raise(eECError, "incorrect pkey type: %s",
+-                         OBJ_nid2sn(EVP_PKEY_base_id(tmp)));
+-            ec = EVP_PKEY_get1_EC_KEY(tmp);
+-            EVP_PKEY_free(tmp);
+-        }
+-	BIO_free(in);
++    pass = ossl_pem_passwd_value(pass);
++    arg = ossl_to_der_if_possible(arg);
++    in = ossl_obj2bio(&arg);
+ 
+-	if (!ec) {
+-	    ossl_clear_error();
+-	    ec = ec_key_new_from_group(arg);
+-	}
++    pkey = ossl_pkey_read_generic(in, pass);
++    BIO_free(in);
++    if (!pkey) {
++        ossl_clear_error();
++        ec = ec_key_new_from_group(arg);
++        goto legacy;
+     }
+ 
+-    if (!EVP_PKEY_assign_EC_KEY(pkey, ec)) {
+-	EC_KEY_free(ec);
+-	ossl_raise(eECError, "EVP_PKEY_assign_EC_KEY");
++    type = EVP_PKEY_base_id(pkey);
++    if (type != EVP_PKEY_EC) {
++        EVP_PKEY_free(pkey);
++        rb_raise(eDSAError, "incorrect pkey type: %s", OBJ_nid2sn(type));
+     }
++    RTYPEDDATA_DATA(self) = pkey;
++    return self;
+ 
++  legacy:
++    pkey = EVP_PKEY_new();
++    if (!pkey || EVP_PKEY_assign_EC_KEY(pkey, ec) != 1) {
++        EVP_PKEY_free(pkey);
++        EC_KEY_free(ec);
++        ossl_raise(eECError, "EVP_PKEY_assign_EC_KEY");
++    }
++    RTYPEDDATA_DATA(self) = pkey;
+     return self;
+ }
+ 
+@@ -195,18 +201,21 @@ ossl_ec_key_initialize_copy(VALUE self, VALUE other)
+     EVP_PKEY *pkey;
+     EC_KEY *ec, *ec_new;
+ 
+-    GetPKey(self, pkey);
+-    if (EVP_PKEY_base_id(pkey) != EVP_PKEY_NONE)
+-	ossl_raise(eECError, "EC already initialized");
++    TypedData_Get_Struct(self, EVP_PKEY, &ossl_evp_pkey_type, pkey);
++    if (pkey)
++        rb_raise(rb_eTypeError, "pkey already initialized");
+     GetEC(other, ec);
+ 
+     ec_new = EC_KEY_dup(ec);
+     if (!ec_new)
+ 	ossl_raise(eECError, "EC_KEY_dup");
+-    if (!EVP_PKEY_assign_EC_KEY(pkey, ec_new)) {
+-	EC_KEY_free(ec_new);
+-	ossl_raise(eECError, "EVP_PKEY_assign_EC_KEY");
++
++    pkey = EVP_PKEY_new();
++    if (!pkey || EVP_PKEY_assign_EC_KEY(pkey, ec_new) != 1) {
++        EC_KEY_free(ec_new);
++        ossl_raise(eECError, "EVP_PKEY_assign_EC_KEY");
+     }
++    RTYPEDDATA_DATA(self) = pkey;
+ 
+     return self;
+ }
+diff --git a/ext/openssl/ossl_pkey_rsa.c b/ext/openssl/ossl_pkey_rsa.c
+index 8ebd3ec5..b8dbc0e1 100644
+--- a/ext/openssl/ossl_pkey_rsa.c
++++ b/ext/openssl/ossl_pkey_rsa.c
+@@ -76,51 +76,62 @@ VALUE eRSAError;
+ static VALUE
+ ossl_rsa_initialize(int argc, VALUE *argv, VALUE self)
+ {
+-    EVP_PKEY *pkey, *tmp;
+-    RSA *rsa = NULL;
+-    BIO *in;
++    EVP_PKEY *pkey;
++    RSA *rsa;
++    BIO *in = NULL;
+     VALUE arg, pass;
++    int type;
++
++    TypedData_Get_Struct(self, EVP_PKEY, &ossl_evp_pkey_type, pkey);
++    if (pkey)
++        rb_raise(rb_eTypeError, "pkey already initialized");
+ 
+-    GetPKey(self, pkey);
+     /* The RSA.new(size, generator) form is handled by lib/openssl/pkey.rb */
+     rb_scan_args(argc, argv, "02", &arg, &pass);
+     if (argc == 0) {
+ 	rsa = RSA_new();
+         if (!rsa)
+             ossl_raise(eRSAError, "RSA_new");
++        goto legacy;
+     }
+-    else {
+-	pass = ossl_pem_passwd_value(pass);
+-	arg = ossl_to_der_if_possible(arg);
+-	in = ossl_obj2bio(&arg);
+-
+-        tmp = ossl_pkey_read_generic(in, pass);
+-        if (tmp) {
+-            if (EVP_PKEY_base_id(tmp) != EVP_PKEY_RSA)
+-                rb_raise(eRSAError, "incorrect pkey type: %s",
+-                         OBJ_nid2sn(EVP_PKEY_base_id(tmp)));
+-            rsa = EVP_PKEY_get1_RSA(tmp);
+-            EVP_PKEY_free(tmp);
+-        }
+-	if (!rsa) {
+-	    OSSL_BIO_reset(in);
+-	    rsa = PEM_read_bio_RSAPublicKey(in, NULL, NULL, NULL);
+-	}
+-	if (!rsa) {
+-	    OSSL_BIO_reset(in);
+-	    rsa = d2i_RSAPublicKey_bio(in, NULL);
+-	}
+-	BIO_free(in);
+-	if (!rsa) {
+-            ossl_clear_error();
+-	    ossl_raise(eRSAError, "Neither PUB key nor PRIV key");
+-	}
+-    }
+-    if (!EVP_PKEY_assign_RSA(pkey, rsa)) {
+-	RSA_free(rsa);
+-	ossl_raise(eRSAError, "EVP_PKEY_assign_RSA");
++
++    pass = ossl_pem_passwd_value(pass);
++    arg = ossl_to_der_if_possible(arg);
++    in = ossl_obj2bio(&arg);
++
++    /* First try RSAPublicKey format */
++    rsa = d2i_RSAPublicKey_bio(in, NULL);
++    if (rsa)
++        goto legacy;
++    OSSL_BIO_reset(in);
++    rsa = PEM_read_bio_RSAPublicKey(in, NULL, NULL, NULL);
++    if (rsa)
++        goto legacy;
++    OSSL_BIO_reset(in);
++
++    /* Use the generic routine */
++    pkey = ossl_pkey_read_generic(in, pass);
++    BIO_free(in);
++    if (!pkey)
++        ossl_raise(eRSAError, "Neither PUB key nor PRIV key");
++
++    type = EVP_PKEY_base_id(pkey);
++    if (type != EVP_PKEY_RSA) {
++        EVP_PKEY_free(pkey);
++        rb_raise(eRSAError, "incorrect pkey type: %s", OBJ_nid2sn(type));
+     }
++    RTYPEDDATA_DATA(self) = pkey;
++    return self;
+ 
++  legacy:
++    BIO_free(in);
++    pkey = EVP_PKEY_new();
++    if (!pkey || EVP_PKEY_assign_RSA(pkey, rsa) != 1) {
++        EVP_PKEY_free(pkey);
++        RSA_free(rsa);
++        ossl_raise(eRSAError, "EVP_PKEY_assign_RSA");
++    }
++    RTYPEDDATA_DATA(self) = pkey;
+     return self;
+ }
+ 
+@@ -130,16 +141,23 @@ ossl_rsa_initialize_copy(VALUE self, VALUE other)
+     EVP_PKEY *pkey;
+     RSA *rsa, *rsa_new;
+ 
+-    GetPKey(self, pkey);
+-    if (EVP_PKEY_base_id(pkey) != EVP_PKEY_NONE)
+-	ossl_raise(eRSAError, "RSA already initialized");
++    TypedData_Get_Struct(self, EVP_PKEY, &ossl_evp_pkey_type, pkey);
++    if (pkey)
++        rb_raise(rb_eTypeError, "pkey already initialized");
+     GetRSA(other, rsa);
+ 
+-    rsa_new = ASN1_dup((i2d_of_void *)i2d_RSAPrivateKey, (d2i_of_void *)d2i_RSAPrivateKey, (char *)rsa);
++    rsa_new = (RSA *)ASN1_dup((i2d_of_void *)i2d_RSAPrivateKey,
++                              (d2i_of_void *)d2i_RSAPrivateKey,
++                              (char *)rsa);
+     if (!rsa_new)
+ 	ossl_raise(eRSAError, "ASN1_dup");
+ 
+-    EVP_PKEY_assign_RSA(pkey, rsa_new);
++    pkey = EVP_PKEY_new();
++    if (!pkey || EVP_PKEY_assign_RSA(pkey, rsa_new) != 1) {
++        RSA_free(rsa_new);
++        ossl_raise(eRSAError, "EVP_PKEY_assign_RSA");
++    }
++    RTYPEDDATA_DATA(self) = pkey;
+ 
+     return self;
+ }
+

SOURCES/ruby-3.1.0-Allow-setting-algorithm-specific-options-in-sign-and-verify.patch

@@ -0,0 +1,358 @@
+From f2cf3afc6fa1e13e960f732c0bc658ad408ee219 Mon Sep 17 00:00:00 2001
+From: Kazuki Yamaguchi <k@rhe.jp>
+Date: Fri, 12 Jun 2020 14:12:59 +0900
+Subject: [PATCH 1/3] pkey: fix potential memory leak in PKey#sign
+
+Fix potential leak of EVP_MD_CTX object in an error path. This path is
+normally unreachable, since the size of a signature generated by any
+supported algorithms would not be larger than LONG_MAX.
+---
+ ext/openssl/ossl_pkey.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/ext/openssl/ossl_pkey.c b/ext/openssl/ossl_pkey.c
+index df8b425a0f..7488190e0e 100644
+--- a/ext/openssl/ossl_pkey.c
++++ b/ext/openssl/ossl_pkey.c
+@@ -777,8 +777,10 @@ ossl_pkey_sign(VALUE self, VALUE digest, VALUE data)
+         EVP_MD_CTX_free(ctx);
+         ossl_raise(ePKeyError, "EVP_DigestSign");
+     }
+-    if (siglen > LONG_MAX)
++    if (siglen > LONG_MAX) {
++        EVP_MD_CTX_free(ctx);
+         rb_raise(ePKeyError, "signature would be too large");
++    }
+     sig = ossl_str_new(NULL, (long)siglen, &state);
+     if (state) {
+         EVP_MD_CTX_free(ctx);
+@@ -799,8 +801,10 @@ ossl_pkey_sign(VALUE self, VALUE digest, VALUE data)
+         EVP_MD_CTX_free(ctx);
+         ossl_raise(ePKeyError, "EVP_DigestSignFinal");
+     }
+-    if (siglen > LONG_MAX)
++    if (siglen > LONG_MAX) {
++        EVP_MD_CTX_free(ctx);
+         rb_raise(ePKeyError, "signature would be too large");
++    }
+     sig = ossl_str_new(NULL, (long)siglen, &state);
+     if (state) {
+         EVP_MD_CTX_free(ctx);
+-- 
+2.32.0
+
+
+From 8b30ce20eb9e03180c28288e29a96308e594f860 Mon Sep 17 00:00:00 2001
+From: Kazuki Yamaguchi <k@rhe.jp>
+Date: Fri, 2 Apr 2021 23:58:48 +0900
+Subject: [PATCH 2/3] pkey: prepare pkey_ctx_apply_options() for usage by other
+ operations
+
+The routine to apply Hash to EVP_PKEY_CTX_ctrl_str() is currently used
+by key generation, but it is useful for other operations too. Let's
+change it to a slightly more generic name.
+---
+ ext/openssl/ossl_pkey.c | 22 ++++++++++++++--------
+ 1 file changed, 14 insertions(+), 8 deletions(-)
+
+diff --git a/ext/openssl/ossl_pkey.c b/ext/openssl/ossl_pkey.c
+index 7488190e0e..fed4a2b81f 100644
+--- a/ext/openssl/ossl_pkey.c
++++ b/ext/openssl/ossl_pkey.c
+@@ -198,7 +198,7 @@ ossl_pkey_new_from_data(int argc, VALUE *argv, VALUE self)
+ }
+ 
+ static VALUE
+-pkey_gen_apply_options_i(RB_BLOCK_CALL_FUNC_ARGLIST(i, ctx_v))
++pkey_ctx_apply_options_i(RB_BLOCK_CALL_FUNC_ARGLIST(i, ctx_v))
+ {
+     VALUE key = rb_ary_entry(i, 0), value = rb_ary_entry(i, 1);
+     EVP_PKEY_CTX *ctx = (EVP_PKEY_CTX *)ctx_v;
+@@ -214,15 +214,25 @@ pkey_gen_apply_options_i(RB_BLOCK_CALL_FUNC_ARGLIST(i, ctx_v))
+ }
+ 
+ static VALUE
+-pkey_gen_apply_options0(VALUE args_v)
++pkey_ctx_apply_options0(VALUE args_v)
+ {
+     VALUE *args = (VALUE *)args_v;
+ 
+     rb_block_call(args[1], rb_intern("each"), 0, NULL,
+-                  pkey_gen_apply_options_i, args[0]);
++                  pkey_ctx_apply_options_i, args[0]);
+     return Qnil;
+ }
+ 
++static void
++pkey_ctx_apply_options(EVP_PKEY_CTX *ctx, VALUE options, int *state)
++{
++    VALUE args[2];
++    args[0] = (VALUE)ctx;
++    args[1] = options;
++
++    rb_protect(pkey_ctx_apply_options0, (VALUE)args, state);
++}
++
+ struct pkey_blocking_generate_arg {
+     EVP_PKEY_CTX *ctx;
+     EVP_PKEY *pkey;
+@@ -330,11 +340,7 @@ pkey_generate(int argc, VALUE *argv, VALUE self, int genparam)
+     }
+ 
+     if (!NIL_P(options)) {
+-        VALUE args[2];
+-
+-        args[0] = (VALUE)ctx;
+-        args[1] = options;
+-        rb_protect(pkey_gen_apply_options0, (VALUE)args, &state);
++        pkey_ctx_apply_options(ctx, options, &state);
+         if (state) {
+             EVP_PKEY_CTX_free(ctx);
+             rb_jump_tag(state);
+-- 
+2.32.0
+
+
+From 4c7b0f91da666961d11908b94520db4e09ce4e67 Mon Sep 17 00:00:00 2001
+From: Kazuki Yamaguchi <k@rhe.jp>
+Date: Sat, 18 Jul 2020 20:40:39 +0900
+Subject: [PATCH 3/3] pkey: allow setting algorithm-specific options in #sign
+ and #verify
+
+Similarly to OpenSSL::PKey.generate_key and .generate_parameters, let
+OpenSSL::PKey::PKey#sign and #verify take an optional parameter for
+specifying control strings for EVP_PKEY_CTX_ctrl_str().
+---
+ ext/openssl/ossl_pkey.c       | 113 ++++++++++++++++++++++------------
+ test/openssl/test_pkey_rsa.rb |  34 +++++-----
+ 2 files changed, 89 insertions(+), 58 deletions(-)
+
+diff --git a/ext/openssl/ossl_pkey.c b/ext/openssl/ossl_pkey.c
+index fed4a2b81f..22e9f19982 100644
+--- a/ext/openssl/ossl_pkey.c
++++ b/ext/openssl/ossl_pkey.c
+@@ -739,33 +739,51 @@ ossl_pkey_public_to_pem(VALUE self)
+ }
+ 
+ /*
+- *  call-seq:
+- *      pkey.sign(digest, data) -> String
++ * call-seq:
++ *    pkey.sign(digest, data [, options]) -> string
+  *
+- * To sign the String _data_, _digest_, an instance of OpenSSL::Digest, must
+- * be provided. The return value is again a String containing the signature.
+- * A PKeyError is raised should errors occur.
+- * Any previous state of the Digest instance is irrelevant to the signature
+- * outcome, the digest instance is reset to its initial state during the
+- * operation.
++ * Hashes and signs the +data+ using a message digest algorithm +digest+ and
++ * a private key +pkey+.
+  *
+- * == Example
+- *   data = 'Sign me!'
+- *   digest = OpenSSL::Digest.new('SHA256')
+- *   pkey = OpenSSL::PKey::RSA.new(2048)
+- *   signature = pkey.sign(digest, data)
++ * See #verify for the verification operation.
++ *
++ * See also the man page EVP_DigestSign(3).
++ *
++ * +digest+::
++ *   A String that represents the message digest algorithm name, or +nil+
++ *   if the PKey type requires no digest algorithm.
++ *   For backwards compatibility, this can be an instance of OpenSSL::Digest.
++ *   Its state will not affect the signature.
++ * +data+::
++ *   A String. The data to be hashed and signed.
++ * +options+::
++ *   A Hash that contains algorithm specific control operations to \OpenSSL.
++ *   See OpenSSL's man page EVP_PKEY_CTX_ctrl_str(3) for details.
++ *   +options+ parameter was added in version 2.3.
++ *
++ * Example:
++ *   data = "Sign me!"
++ *   pkey = OpenSSL::PKey.generate_key("RSA", rsa_keygen_bits: 2048)
++ *   signopts = { rsa_padding_mode: "pss" }
++ *   signature = pkey.sign("SHA256", data, signopts)
++ *
++ *   # Creates a copy of the RSA key pkey, but without the private components
++ *   pub_key = pkey.public_key
++ *   puts pub_key.verify("SHA256", signature, data, signopts) # => true
+  */
+ static VALUE
+-ossl_pkey_sign(VALUE self, VALUE digest, VALUE data)
++ossl_pkey_sign(int argc, VALUE *argv, VALUE self)
+ {
+     EVP_PKEY *pkey;
++    VALUE digest, data, options, sig;
+     const EVP_MD *md = NULL;
+     EVP_MD_CTX *ctx;
++    EVP_PKEY_CTX *pctx;
+     size_t siglen;
+     int state;
+-    VALUE sig;
+ 
+     pkey = GetPrivPKeyPtr(self);
++    rb_scan_args(argc, argv, "21", &digest, &data, &options);
+     if (!NIL_P(digest))
+         md = ossl_evp_get_digestbyname(digest);
+     StringValue(data);
+@@ -773,10 +791,17 @@ ossl_pkey_sign(VALUE self, VALUE digest, VALUE data)
+     ctx = EVP_MD_CTX_new();
+     if (!ctx)
+         ossl_raise(ePKeyError, "EVP_MD_CTX_new");
+-    if (EVP_DigestSignInit(ctx, NULL, md, /* engine */NULL, pkey) < 1) {
++    if (EVP_DigestSignInit(ctx, &pctx, md, /* engine */NULL, pkey) < 1) {
+         EVP_MD_CTX_free(ctx);
+         ossl_raise(ePKeyError, "EVP_DigestSignInit");
+     }
++    if (!NIL_P(options)) {
++        pkey_ctx_apply_options(pctx, options, &state);
++        if (state) {
++            EVP_MD_CTX_free(ctx);
++            rb_jump_tag(state);
++        }
++    }
+ #if OPENSSL_VERSION_NUMBER >= 0x10101000 && !defined(LIBRESSL_VERSION_NUMBER)
+     if (EVP_DigestSign(ctx, NULL, &siglen, (unsigned char *)RSTRING_PTR(data),
+                        RSTRING_LEN(data)) < 1) {
+@@ -828,35 +853,40 @@ ossl_pkey_sign(VALUE self, VALUE digest, VALUE data)
+ }
+ 
+ /*
+- *  call-seq:
+- *      pkey.verify(digest, signature, data) -> String
++ * call-seq:
++ *    pkey.verify(digest, signature, data [, options]) -> true or false
+  *
+- * To verify the String _signature_, _digest_, an instance of
+- * OpenSSL::Digest, must be provided to re-compute the message digest of the
+- * original _data_, also a String. The return value is +true+ if the
+- * signature is valid, +false+ otherwise. A PKeyError is raised should errors
+- * occur.
+- * Any previous state of the Digest instance is irrelevant to the validation
+- * outcome, the digest instance is reset to its initial state during the
+- * operation.
++ * Verifies the +signature+ for the +data+ using a message digest algorithm
++ * +digest+ and a public key +pkey+.
+  *
+- * == Example
+- *   data = 'Sign me!'
+- *   digest = OpenSSL::Digest.new('SHA256')
+- *   pkey = OpenSSL::PKey::RSA.new(2048)
+- *   signature = pkey.sign(digest, data)
+- *   pub_key = pkey.public_key
+- *   puts pub_key.verify(digest, signature, data) # => true
++ * Returns +true+ if the signature is successfully verified, +false+ otherwise.
++ * The caller must check the return value.
++ *
++ * See #sign for the signing operation and an example.
++ *
++ * See also the man page EVP_DigestVerify(3).
++ *
++ * +digest+::
++ *   See #sign.
++ * +signature+::
++ *   A String containing the signature to be verified.
++ * +data+::
++ *   See #sign.
++ * +options+::
++ *   See #sign. +options+ parameter was added in version 2.3.
+  */
+ static VALUE
+-ossl_pkey_verify(VALUE self, VALUE digest, VALUE sig, VALUE data)
++ossl_pkey_verify(int argc, VALUE *argv, VALUE self)
+ {
+     EVP_PKEY *pkey;
++    VALUE digest, sig, data, options;
+     const EVP_MD *md = NULL;
+     EVP_MD_CTX *ctx;
+-    int ret;
++    EVP_PKEY_CTX *pctx;
++    int state, ret;
+ 
+     GetPKey(self, pkey);
++    rb_scan_args(argc, argv, "31", &digest, &sig, &data, &options);
+     ossl_pkey_check_public_key(pkey);
+     if (!NIL_P(digest))
+         md = ossl_evp_get_digestbyname(digest);
+@@ -866,10 +896,17 @@ ossl_pkey_verify(VALUE self, VALUE digest, VALUE sig, VALUE data)
+     ctx = EVP_MD_CTX_new();
+     if (!ctx)
+         ossl_raise(ePKeyError, "EVP_MD_CTX_new");
+-    if (EVP_DigestVerifyInit(ctx, NULL, md, /* engine */NULL, pkey) < 1) {
++    if (EVP_DigestVerifyInit(ctx, &pctx, md, /* engine */NULL, pkey) < 1) {
+         EVP_MD_CTX_free(ctx);
+         ossl_raise(ePKeyError, "EVP_DigestVerifyInit");
+     }
++    if (!NIL_P(options)) {
++        pkey_ctx_apply_options(pctx, options, &state);
++        if (state) {
++            EVP_MD_CTX_free(ctx);
++            rb_jump_tag(state);
++        }
++    }
+ #if OPENSSL_VERSION_NUMBER >= 0x10101000 && !defined(LIBRESSL_VERSION_NUMBER)
+     ret = EVP_DigestVerify(ctx, (unsigned char *)RSTRING_PTR(sig),
+                            RSTRING_LEN(sig), (unsigned char *)RSTRING_PTR(data),
+@@ -1042,8 +1079,8 @@ Init_ossl_pkey(void)
+     rb_define_method(cPKey, "public_to_der", ossl_pkey_public_to_der, 0);
+     rb_define_method(cPKey, "public_to_pem", ossl_pkey_public_to_pem, 0);
+ 
+-    rb_define_method(cPKey, "sign", ossl_pkey_sign, 2);
+-    rb_define_method(cPKey, "verify", ossl_pkey_verify, 3);
++    rb_define_method(cPKey, "sign", ossl_pkey_sign, -1);
++    rb_define_method(cPKey, "verify", ossl_pkey_verify, -1);
+     rb_define_method(cPKey, "derive", ossl_pkey_derive, -1);
+ 
+     id_private_q = rb_intern("private?");
+diff --git a/test/openssl/test_pkey_rsa.rb b/test/openssl/test_pkey_rsa.rb
+index 88164c3b52..d1e68dbc9f 100644
+--- a/test/openssl/test_pkey_rsa.rb
++++ b/test/openssl/test_pkey_rsa.rb
+@@ -117,27 +117,21 @@ def test_sign_verify
+     assert_equal false, rsa1024.verify("SHA256", signature1, data)
+   end
+ 
+-  def test_digest_state_irrelevant_sign
++  def test_sign_verify_options
+     key = Fixtures.pkey("rsa1024")
+-    digest1 = OpenSSL::Digest.new('SHA1')
+-    digest2 = OpenSSL::Digest.new('SHA1')
+-    data = 'Sign me!'
+-    digest1 << 'Change state of digest1'
+-    sig1 = key.sign(digest1, data)
+-    sig2 = key.sign(digest2, data)
+-    assert_equal(sig1, sig2)
+-  end
+-
+-  def test_digest_state_irrelevant_verify
+-    key = Fixtures.pkey("rsa1024")
+-    digest1 = OpenSSL::Digest.new('SHA1')
+-    digest2 = OpenSSL::Digest.new('SHA1')
+-    data = 'Sign me!'
+-    sig = key.sign(digest1, data)
+-    digest1.reset
+-    digest1 << 'Change state of digest1'
+-    assert(key.verify(digest1, sig, data))
+-    assert(key.verify(digest2, sig, data))
++    data = "Sign me!"
++    pssopts = {
++      "rsa_padding_mode" => "pss",
++      "rsa_pss_saltlen" => 20,
++      "rsa_mgf1_md" => "SHA1"
++    }
++    sig_pss = key.sign("SHA256", data, pssopts)
++    assert_equal 128, sig_pss.bytesize
++    assert_equal true, key.verify("SHA256", sig_pss, data, pssopts)
++    assert_equal true, key.verify_pss("SHA256", sig_pss, data,
++                                      salt_length: 20, mgf1_hash: "SHA1")
++    # Defaults to PKCS #1 v1.5 padding => verification failure
++    assert_equal false, key.verify("SHA256", sig_pss, data)
+   end
+ 
+   def test_verify_empty_rsa
+-- 
+2.32.0
+

SOURCES/ruby-3.1.0-Deprecate-PKey-set_-and-PKey-DH-EC-generate_key.patch

@@ -0,0 +1,719 @@
+From 46ca47060ca8ef3419ec36c2326a81b442d9b43b Mon Sep 17 00:00:00 2001
+From: Kazuki Yamaguchi <k@rhe.jp>
+Date: Sun, 12 Dec 2021 01:25:20 +0900
+Subject: [PATCH 1/5] pkey/dh: avoid using DH#set_key in DH#compute_key
+
+DH#set_key will not work on OpenSSL 3.0 because keys are immutable.
+For now, let's reimplement DH#compute_key by manually constructing a
+DER-encoded SubjectPublicKeyInfo structure and feeding it to
+OpenSSL::PKey.read.
+
+Eventually, we should implement a new method around EVP_PKEY_fromdata()
+and use it instead.
+---
+ ext/openssl/lib/openssl/pkey.rb | 16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+
+diff --git a/ext/openssl/lib/openssl/pkey.rb b/ext/openssl/lib/openssl/pkey.rb
+index f6bf5892..5864faa9 100644
+--- a/ext/openssl/lib/openssl/pkey.rb
++++ b/ext/openssl/lib/openssl/pkey.rb
+@@ -47,9 +47,19 @@ def public_key
+     # * _pub_bn_ is a OpenSSL::BN, *not* the DH instance returned by
+     #   DH#public_key as that contains the DH parameters only.
+     def compute_key(pub_bn)
+-      peer = dup
+-      peer.set_key(pub_bn, nil)
+-      derive(peer)
++      # FIXME: This is constructing an X.509 SubjectPublicKeyInfo and is very
++      # inefficient
++      obj = OpenSSL::ASN1.Sequence([
++        OpenSSL::ASN1.Sequence([
++          OpenSSL::ASN1.ObjectId("dhKeyAgreement"),
++          OpenSSL::ASN1.Sequence([
++            OpenSSL::ASN1.Integer(p),
++            OpenSSL::ASN1.Integer(g),
++          ]),
++        ]),
++        OpenSSL::ASN1.BitString(OpenSSL::ASN1.Integer(pub_bn).to_der),
++      ])
++      derive(OpenSSL::PKey.read(obj.to_der))
+     end
+ 
+     # :call-seq:
+
+From fc9aabc18df3c189cc6a76a1470ca908c4f16480 Mon Sep 17 00:00:00 2001
+From: Kazuki Yamaguchi <k@rhe.jp>
+Date: Fri, 17 Dec 2021 02:22:25 +0900
+Subject: [PATCH 2/5] pkey/ec: avoid using EC#public_key= in EC#dh_compute_key
+
+Similarly to DH#compute_key, work around it by constructing a
+SubjectPublicKeyInfo. This should be considered as a temporary
+implementation.
+---
+ ext/openssl/lib/openssl/pkey.rb | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/ext/openssl/lib/openssl/pkey.rb b/ext/openssl/lib/openssl/pkey.rb
+index 5864faa9..ba04cf4b 100644
+--- a/ext/openssl/lib/openssl/pkey.rb
++++ b/ext/openssl/lib/openssl/pkey.rb
+@@ -259,9 +259,14 @@ def dsa_verify_asn1(data, sig)
+     # This method is provided for backwards compatibility, and calls #derive
+     # internally.
+     def dh_compute_key(pubkey)
+-      peer = OpenSSL::PKey::EC.new(group)
+-      peer.public_key = pubkey
+-      derive(peer)
++      obj = OpenSSL::ASN1.Sequence([
++        OpenSSL::ASN1.Sequence([
++          OpenSSL::ASN1.ObjectId("id-ecPublicKey"),
++          group.to_der,
++        ]),
++        OpenSSL::ASN1.BitString(pubkey.to_octet_string(:uncompressed)),
++      ])
++      derive(OpenSSL::PKey.read(obj.to_der))
+     end
+   end
+ 
+
+From 8ee6a582c7e4614eec4f5ca5ab59898fbcb50d2a Mon Sep 17 00:00:00 2001
+From: Kazuki Yamaguchi <k@rhe.jp>
+Date: Fri, 22 Oct 2021 16:24:07 +0900
+Subject: [PATCH 3/5] pkey/dh: deprecate OpenSSL::PKey::DH#generate_key!
+
+OpenSSL::PKey::DH#generate_key! will not work on OpenSSL 3.0 because
+keys are made immutable. Users should use OpenSSL::PKey.generate_key
+instead.
+---
+ ext/openssl/lib/openssl/pkey.rb | 23 +++++++++++++++++++----
+ ext/openssl/ossl_pkey_dh.c      |  9 +++++----
+ test/openssl/test_pkey_dh.rb    | 18 ++++++++++--------
+ 3 files changed, 34 insertions(+), 16 deletions(-)
+
+diff --git a/ext/openssl/lib/openssl/pkey.rb b/ext/openssl/lib/openssl/pkey.rb
+index ba04cf4b..c3e06290 100644
+--- a/ext/openssl/lib/openssl/pkey.rb
++++ b/ext/openssl/lib/openssl/pkey.rb
+@@ -71,14 +71,29 @@ def compute_key(pub_bn)
+     # called first in order to generate the per-session keys before performing
+     # the actual key exchange.
+     #
++    # <b>Deprecated in version 3.0</b>. This method is incompatible with
++    # OpenSSL 3.0.0 or later.
++    #
+     # See also OpenSSL::PKey.generate_key.
+     #
+     # Example:
+-    #   dh = OpenSSL::PKey::DH.new(2048)
+-    #   public_key = dh.public_key #contains no private/public key yet
+-    #   public_key.generate_key!
+-    #   puts public_key.private? # => true
++    #   # DEPRECATED USAGE: This will not work on OpenSSL 3.0 or later
++    #   dh0 = OpenSSL::PKey::DH.new(2048)
++    #   dh = dh0.public_key # #public_key only copies the DH parameters (contrary to the name)
++    #   dh.generate_key!
++    #   puts dh.private? # => true
++    #   puts dh0.pub_key == dh.pub_key #=> false
++    #
++    #   # With OpenSSL::PKey.generate_key
++    #   dh0 = OpenSSL::PKey::DH.new(2048)
++    #   dh = OpenSSL::PKey.generate_key(dh0)
++    #   puts dh0.pub_key == dh.pub_key #=> false
+     def generate_key!
++      if OpenSSL::OPENSSL_VERSION_NUMBER >= 0x30000000
++        raise DHError, "OpenSSL::PKey::DH is immutable on OpenSSL 3.0; " \
++        "use OpenSSL::PKey.generate_key instead"
++      end
++
+       unless priv_key
+         tmp = OpenSSL::PKey.generate_key(self)
+         set_key(tmp.pub_key, tmp.priv_key)
+diff --git a/ext/openssl/ossl_pkey_dh.c b/ext/openssl/ossl_pkey_dh.c
+index 04c11b2157..e70d60ed19 100644
+--- a/ext/openssl/ossl_pkey_dh.c
++++ b/ext/openssl/ossl_pkey_dh.c
+@@ -58,15 +58,16 @@ VALUE eDHError;
+  *
+  * Examples:
+  *   # Creating an instance from scratch
+- *   dh = DH.new
++ *   # Note that this is deprecated and will not work on OpenSSL 3.0 or later.
++ *   dh = OpenSSL::PKey::DH.new
+  *   dh.set_pqg(bn_p, nil, bn_g)
+  *
+  *   # Generating a parameters and a key pair
+- *   dh = DH.new(2048) # An alias of DH.generate(2048)
++ *   dh = OpenSSL::PKey::DH.new(2048) # An alias of OpenSSL::PKey::DH.generate(2048)
+  *
+  *   # Reading DH parameters
+- *   dh = DH.new(File.read('parameters.pem')) # -> dh, but no public/private key yet
+- *   dh.generate_key! # -> dh with public and private key
++ *   dh_params = OpenSSL::PKey::DH.new(File.read('parameters.pem')) # loads parameters only
++ *   dh = OpenSSL::PKey.generate_key(dh_params) # generates a key pair
+  */
+ static VALUE
+ ossl_dh_initialize(int argc, VALUE *argv, VALUE self)
+diff --git a/test/openssl/test_pkey_dh.rb b/test/openssl/test_pkey_dh.rb
+index 757704ca..ac11af38 100644
+--- a/test/openssl/test_pkey_dh.rb
++++ b/test/openssl/test_pkey_dh.rb
+@@ -26,14 +26,19 @@ def test_new_break
+   end
+ 
+   def test_derive_key
+-    dh1 = Fixtures.pkey("dh1024").generate_key!
+-    dh2 = Fixtures.pkey("dh1024").generate_key!
++    params = Fixtures.pkey("dh1024")
++    dh1 = OpenSSL::PKey.generate_key(params)
++    dh2 = OpenSSL::PKey.generate_key(params)
+     dh1_pub = OpenSSL::PKey.read(dh1.public_to_der)
+     dh2_pub = OpenSSL::PKey.read(dh2.public_to_der)
++
+     z = dh1.g.mod_exp(dh1.priv_key, dh1.p).mod_exp(dh2.priv_key, dh1.p).to_s(2)
+     assert_equal z, dh1.derive(dh2_pub)
+     assert_equal z, dh2.derive(dh1_pub)
+ 
++    assert_raise(OpenSSL::PKey::PKeyError) { params.derive(dh1_pub) }
++    assert_raise(OpenSSL::PKey::PKeyError) { dh1_pub.derive(params) }
++
+     assert_equal z, dh1.compute_key(dh2.pub_key)
+     assert_equal z, dh2.compute_key(dh1.pub_key)
+   end
+@@ -74,19 +79,16 @@ def test_public_key
+   end
+ 
+   def test_generate_key
+-    dh = Fixtures.pkey("dh1024").public_key # creates a copy
++    # Deprecated in v3.0.0; incompatible with OpenSSL 3.0
++    dh = Fixtures.pkey("dh1024").public_key # creates a copy with params only
+     assert_no_key(dh)
+     dh.generate_key!
+     assert_key(dh)
+-  end
+ 
+-  def test_key_exchange
+-    dh = Fixtures.pkey("dh1024")
+     dh2 = dh.public_key
+-    dh.generate_key!
+     dh2.generate_key!
+     assert_equal(dh.compute_key(dh2.pub_key), dh2.compute_key(dh.pub_key))
+-  end
++  end if !openssl?(3, 0, 0)
+ 
+   def test_params_ok?
+     dh0 = Fixtures.pkey("dh1024")
+
+From 5e2e66cce870ea86001dbb0eaa3092badfd37994 Mon Sep 17 00:00:00 2001
+From: Kazuki Yamaguchi <k@rhe.jp>
+Date: Fri, 17 Dec 2021 02:21:42 +0900
+Subject: [PATCH 4/5] pkey/ec: deprecate OpenSSL::PKey::EC#generate_key!
+
+OpenSSL::PKey::EC#generate_key! will not work on OpenSSL 3.0 because
+keys are made immutable. Users should use OpenSSL::PKey.generate_key
+instead.
+---
+ ext/openssl/ossl_pkey_ec.c   |  4 ++++
+ test/openssl/test_pkey_ec.rb | 21 +++++++++++++--------
+ 2 files changed, 17 insertions(+), 8 deletions(-)
+
+diff --git a/ext/openssl/ossl_pkey_ec.c b/ext/openssl/ossl_pkey_ec.c
+index db80d112..398a550a 100644
+--- a/ext/openssl/ossl_pkey_ec.c
++++ b/ext/openssl/ossl_pkey_ec.c
+@@ -442,6 +442,9 @@ ossl_ec_key_to_der(VALUE self)
+  */
+ static VALUE ossl_ec_key_generate_key(VALUE self)
+ {
++#if OSSL_OPENSSL_PREREQ(3, 0, 0)
++    rb_raise(ePKeyError, "pkeys are immutable on OpenSSL 3.0");
++#else
+     EC_KEY *ec;
+ 
+     GetEC(self, ec);
+@@ -449,6 +452,7 @@ static VALUE ossl_ec_key_generate_key(VALUE self)
+ 	ossl_raise(eECError, "EC_KEY_generate_key");
+ 
+     return self;
++#endif
+ }
+ 
+ /*
+diff --git a/test/openssl/test_pkey_ec.rb b/test/openssl/test_pkey_ec.rb
+index 3f5958af..33f78a4c 100644
+--- a/test/openssl/test_pkey_ec.rb
++++ b/test/openssl/test_pkey_ec.rb
+@@ -13,15 +13,13 @@ def test_ec_key
+       # FIPS-selftest failure on some environment, so skip for now.
+       next if ["Oakley", "X25519"].any? { |n| curve_name.start_with?(n) }
+ 
+-      key = OpenSSL::PKey::EC.new(curve_name)
+-      key.generate_key!
+-
++      key = OpenSSL::PKey::EC.generate(curve_name)
+       assert_predicate key, :private?
+       assert_predicate key, :public?
+       assert_nothing_raised { key.check_key }
+     end
+ 
+-    key1 = OpenSSL::PKey::EC.new("prime256v1").generate_key!
++    key1 = OpenSSL::PKey::EC.generate("prime256v1")
+ 
+     key2 = OpenSSL::PKey::EC.new
+     key2.group = key1.group
+@@ -52,6 +50,13 @@ def test_generate
+     assert_equal(true, ec.private?)
+   end
+ 
++  def test_generate_key
++    ec = OpenSSL::PKey::EC.new("prime256v1")
++    assert_equal false, ec.private?
++    ec.generate_key!
++    assert_equal true, ec.private?
++  end if !openssl?(3, 0, 0)
++
+   def test_marshal
+     key = Fixtures.pkey("p256")
+     deserialized = Marshal.load(Marshal.dump(key))
+@@ -136,7 +141,7 @@ def test_sign_verify_raw
+   end
+ 
+   def test_dsa_sign_asn1_FIPS186_3
+-    key = OpenSSL::PKey::EC.new("prime256v1").generate_key!
++    key = OpenSSL::PKey::EC.generate("prime256v1")
+     size = key.group.order.num_bits / 8 + 1
+     dgst = (1..size).to_a.pack('C*')
+     sig = key.dsa_sign_asn1(dgst)
+@@ -145,8 +150,8 @@ def test_dsa_sign_asn1_FIPS186_3
+   end
+ 
+   def test_dh_compute_key
+-    key_a = OpenSSL::PKey::EC.new("prime256v1").generate_key!
+-    key_b = OpenSSL::PKey::EC.new(key_a.group).generate_key!
++    key_a = OpenSSL::PKey::EC.generate("prime256v1")
++    key_b = OpenSSL::PKey::EC.generate(key_a.group)
+ 
+     pub_a = key_a.public_key
+     pub_b = key_b.public_key
+@@ -276,7 +281,7 @@ def test_ec_group
+ 
+   def test_ec_point
+     group = OpenSSL::PKey::EC::Group.new("prime256v1")
+-    key = OpenSSL::PKey::EC.new(group).generate_key!
++    key = OpenSSL::PKey::EC.generate(group)
+     point = key.public_key
+ 
+     point2 = OpenSSL::PKey::EC::Point.new(group, point.to_bn)
+
+From 6848d2d969d90e6a400d89848ecec21076b87888 Mon Sep 17 00:00:00 2001
+From: Kazuki Yamaguchi <k@rhe.jp>
+Date: Tue, 21 Sep 2021 18:29:59 +0900
+Subject: [PATCH 5/5] pkey: deprecate PKey#set_* methods
+
+OpenSSL 3.0 made EVP_PKEY immutable. This means we can only have a const
+pointer of the low level struct and the following methods can no longer
+be provided when linked against OpenSSL 3.0:
+
+ - OpenSSL::PKey::RSA#set_key
+ - OpenSSL::PKey::RSA#set_factors
+ - OpenSSL::PKey::RSA#set_crt_params
+ - OpenSSL::PKey::DSA#set_pqg
+ - OpenSSL::PKey::DSA#set_key
+ - OpenSSL::PKey::DH#set_pqg
+ - OpenSSL::PKey::DH#set_key
+ - OpenSSL::PKey::EC#group=
+ - OpenSSL::PKey::EC#private_key=
+ - OpenSSL::PKey::EC#public_key=
+
+There is no direct replacement for this functionality at the moment.
+I plan to introduce a wrapper around EVP_PKEY_fromdata(), which takes
+all key components at once to construct an EVP_PKEY.
+---
+ ext/openssl/ossl_pkey.h       | 16 +++++++
+ ext/openssl/ossl_pkey_ec.c    | 12 +++++
+ test/openssl/test_pkey_dh.rb  | 38 +++++++++++-----
+ test/openssl/test_pkey_dsa.rb |  8 +++-
+ test/openssl/test_pkey_ec.rb  | 58 ++++++++++++++----------
+ test/openssl/test_pkey_rsa.rb | 85 ++++++++++++++++++++++-------------
+ 6 files changed, 149 insertions(+), 68 deletions(-)
+
+diff --git a/ext/openssl/ossl_pkey.h b/ext/openssl/ossl_pkey.h
+index 4beede22..4536e58e 100644
+--- a/ext/openssl/ossl_pkey.h
++++ b/ext/openssl/ossl_pkey.h
+@@ -116,6 +116,7 @@ static VALUE ossl_##_keytype##_get_##_name(VALUE self)			\
+ 	OSSL_PKEY_BN_DEF_GETTER0(_keytype, _type, a2,			\
+ 		_type##_get0_##_group(obj, NULL, &bn))
+ 
++#if !OSSL_OPENSSL_PREREQ(3, 0, 0)
+ #define OSSL_PKEY_BN_DEF_SETTER3(_keytype, _type, _group, a1, a2, a3)	\
+ /*									\
+  *  call-seq:								\
+@@ -173,6 +174,21 @@ static VALUE ossl_##_keytype##_set_##_group(VALUE self, VALUE v1, VALUE v2) \
+ 	}								\
+ 	return self;							\
+ }
++#else
++#define OSSL_PKEY_BN_DEF_SETTER3(_keytype, _type, _group, a1, a2, a3)	\
++static VALUE ossl_##_keytype##_set_##_group(VALUE self, VALUE v1, VALUE v2, VALUE v3) \
++{									\
++        rb_raise(ePKeyError,						\
++                 #_keytype"#set_"#_group"= is incompatible with OpenSSL 3.0"); \
++}
++
++#define OSSL_PKEY_BN_DEF_SETTER2(_keytype, _type, _group, a1, a2)	\
++static VALUE ossl_##_keytype##_set_##_group(VALUE self, VALUE v1, VALUE v2) \
++{									\
++        rb_raise(ePKeyError,						\
++                 #_keytype"#set_"#_group"= is incompatible with OpenSSL 3.0"); \
++}
++#endif
+ 
+ #define OSSL_PKEY_BN_DEF_SETTER_OLD(_keytype, _type, _group, _name)	\
+ /*									\
+diff --git a/ext/openssl/ossl_pkey_ec.c b/ext/openssl/ossl_pkey_ec.c
+index 398a550a..7a6ed1c9 100644
+--- a/ext/openssl/ossl_pkey_ec.c
++++ b/ext/openssl/ossl_pkey_ec.c
+@@ -251,6 +251,9 @@ ossl_ec_key_get_group(VALUE self)
+ static VALUE
+ ossl_ec_key_set_group(VALUE self, VALUE group_v)
+ {
++#if OSSL_OPENSSL_PREREQ(3, 0, 0)
++    rb_raise(ePKeyError, "pkeys are immutable on OpenSSL 3.0");
++#else
+     EC_KEY *ec;
+     EC_GROUP *group;
+ 
+@@ -261,6 +264,7 @@ ossl_ec_key_set_group(VALUE self, VALUE group_v)
+         ossl_raise(eECError, "EC_KEY_set_group");
+ 
+     return group_v;
++#endif
+ }
+ 
+ /*
+@@ -289,6 +293,9 @@ static VALUE ossl_ec_key_get_private_key(VALUE self)
+  */
+ static VALUE ossl_ec_key_set_private_key(VALUE self, VALUE private_key)
+ {
++#if OSSL_OPENSSL_PREREQ(3, 0, 0)
++    rb_raise(ePKeyError, "pkeys are immutable on OpenSSL 3.0");
++#else
+     EC_KEY *ec;
+     BIGNUM *bn = NULL;
+ 
+@@ -307,6 +314,7 @@ static VALUE ossl_ec_key_set_private_key(VALUE self, VALUE private_key)
+     }
+ 
+     return private_key;
++#endif
+ }
+ 
+ /*
+@@ -335,6 +343,9 @@ static VALUE ossl_ec_key_get_public_key(VALUE self)
+  */
+ static VALUE ossl_ec_key_set_public_key(VALUE self, VALUE public_key)
+ {
++#if OSSL_OPENSSL_PREREQ(3, 0, 0)
++    rb_raise(ePKeyError, "pkeys are immutable on OpenSSL 3.0");
++#else
+     EC_KEY *ec;
+     EC_POINT *point = NULL;
+ 
+@@ -353,6 +364,7 @@ static VALUE ossl_ec_key_set_public_key(VALUE self, VALUE public_key)
+     }
+ 
+     return public_key;
++#endif
+ }
+ 
+ /*
+diff --git a/test/openssl/test_pkey_dh.rb b/test/openssl/test_pkey_dh.rb
+index ac11af38..161af189 100644
+--- a/test/openssl/test_pkey_dh.rb
++++ b/test/openssl/test_pkey_dh.rb
+@@ -107,13 +107,32 @@ def test_params_ok?
+   end
+ 
+   def test_dup
+-    dh = Fixtures.pkey("dh1024")
+-    dh2 = dh.dup
+-    assert_equal dh.to_der, dh2.to_der # params
+-    assert_equal_params dh, dh2 # keys
+-    dh2.set_pqg(dh2.p + 1, nil, dh2.g)
+-    assert_not_equal dh2.p, dh.p
+-    assert_equal dh2.g, dh.g
++    # Parameters only
++    dh1 = Fixtures.pkey("dh1024")
++    dh2 = dh1.dup
++    assert_equal dh1.to_der, dh2.to_der
++    assert_not_equal nil, dh1.p
++    assert_not_equal nil, dh1.g
++    assert_equal [dh1.p, dh1.g], [dh2.p, dh2.g]
++    assert_equal nil, dh1.pub_key
++    assert_equal nil, dh1.priv_key
++    assert_equal [dh1.pub_key, dh1.priv_key], [dh2.pub_key, dh2.priv_key]
++
++    # PKey is immutable in OpenSSL >= 3.0
++    if !openssl?(3, 0, 0)
++      dh2.set_pqg(dh2.p + 1, nil, dh2.g)
++      assert_not_equal dh2.p, dh1.p
++    end
++
++    # With a key pair
++    dh3 = OpenSSL::PKey.generate_key(Fixtures.pkey("dh1024"))
++    dh4 = dh3.dup
++    assert_equal dh3.to_der, dh4.to_der
++    assert_equal dh1.to_der, dh4.to_der # encodes parameters only
++    assert_equal [dh1.p, dh1.g], [dh4.p, dh4.g]
++    assert_not_equal nil, dh3.pub_key
++    assert_not_equal nil, dh3.priv_key
++    assert_equal [dh3.pub_key, dh3.priv_key], [dh4.pub_key, dh4.priv_key]
+   end
+ 
+   def test_marshal
+@@ -125,11 +144,6 @@ def test_marshal
+ 
+   private
+ 
+-  def assert_equal_params(dh1, dh2)
+-    assert_equal(dh1.g, dh2.g)
+-    assert_equal(dh1.p, dh2.p)
+-  end
+-
+   def assert_no_key(dh)
+     assert_equal(false, dh.public?)
+     assert_equal(false, dh.private?)
+diff --git a/test/openssl/test_pkey_dsa.rb b/test/openssl/test_pkey_dsa.rb
+index 0994607f..726b7dbf 100644
+--- a/test/openssl/test_pkey_dsa.rb
++++ b/test/openssl/test_pkey_dsa.rb
+@@ -208,8 +208,12 @@ def test_dup
+     key = Fixtures.pkey("dsa1024")
+     key2 = key.dup
+     assert_equal key.params, key2.params
+-    key2.set_pqg(key2.p + 1, key2.q, key2.g)
+-    assert_not_equal key.params, key2.params
++
++    # PKey is immutable in OpenSSL >= 3.0
++    if !openssl?(3, 0, 0)
++      key2.set_pqg(key2.p + 1, key2.q, key2.g)
++      assert_not_equal key.params, key2.params
++    end
+   end
+ 
+   def test_marshal
+diff --git a/test/openssl/test_pkey_ec.rb b/test/openssl/test_pkey_ec.rb
+index 33f78a4c..ffe5a94e 100644
+--- a/test/openssl/test_pkey_ec.rb
++++ b/test/openssl/test_pkey_ec.rb
+@@ -21,11 +21,15 @@ def test_ec_key
+ 
+     key1 = OpenSSL::PKey::EC.generate("prime256v1")
+ 
+-    key2 = OpenSSL::PKey::EC.new
+-    key2.group = key1.group
+-    key2.private_key = key1.private_key
+-    key2.public_key = key1.public_key
+-    assert_equal key1.to_der, key2.to_der
++    # PKey is immutable in OpenSSL >= 3.0; constructing an empty EC object is
++    # deprecated
++    if !openssl?(3, 0, 0)
++      key2 = OpenSSL::PKey::EC.new
++      key2.group = key1.group
++      key2.private_key = key1.private_key
++      key2.public_key = key1.public_key
++      assert_equal key1.to_der, key2.to_der
++    end
+ 
+     key3 = OpenSSL::PKey::EC.new(key1)
+     assert_equal key1.to_der, key3.to_der
+@@ -35,10 +39,14 @@ def test_ec_key
+ 
+     key5 = key1.dup
+     assert_equal key1.to_der, key5.to_der
+-    key_tmp = OpenSSL::PKey::EC.new("prime256v1").generate_key!
+-    key5.private_key = key_tmp.private_key
+-    key5.public_key = key_tmp.public_key
+-    assert_not_equal key1.to_der, key5.to_der
++
++    # PKey is immutable in OpenSSL >= 3.0; EC object should not be modified
++    if !openssl?(3, 0, 0)
++      key_tmp = OpenSSL::PKey::EC.generate("prime256v1")
++      key5.private_key = key_tmp.private_key
++      key5.public_key = key_tmp.public_key
++      assert_not_equal key1.to_der, key5.to_der
++    end
+   end
+ 
+   def test_generate
+@@ -65,22 +73,26 @@ def test_marshal
+   end
+ 
+   def test_check_key
+-    key = OpenSSL::PKey::EC.new("prime256v1").generate_key!
+-    assert_equal(true, key.check_key)
+-    assert_equal(true, key.private?)
+-    assert_equal(true, key.public?)
+-    key2 = OpenSSL::PKey::EC.new(key.group)
+-    assert_equal(false, key2.private?)
+-    assert_equal(false, key2.public?)
+-    key2.public_key = key.public_key
+-    assert_equal(false, key2.private?)
+-    assert_equal(true, key2.public?)
+-    key2.private_key = key.private_key
++    key0 = Fixtures.pkey("p256")
++    assert_equal(true, key0.check_key)
++    assert_equal(true, key0.private?)
++    assert_equal(true, key0.public?)
++
++    key1 = OpenSSL::PKey.read(key0.public_to_der)
++    assert_equal(true, key1.check_key)
++    assert_equal(false, key1.private?)
++    assert_equal(true, key1.public?)
++
++    key2 = OpenSSL::PKey.read(key0.private_to_der)
+     assert_equal(true, key2.private?)
+     assert_equal(true, key2.public?)
+     assert_equal(true, key2.check_key)
+-    key2.private_key += 1
+-    assert_raise(OpenSSL::PKey::ECError) { key2.check_key }
++
++    # EC#private_key= is deprecated in 3.0 and won't work on OpenSSL 3.0
++    if !openssl?(3, 0, 0)
++      key2.private_key += 1
++      assert_raise(OpenSSL::PKey::ECError) { key2.check_key }
++    end
+   end
+ 
+   def test_sign_verify
+@@ -112,7 +124,7 @@ def test_derive_key
+     assert_equal [zIUT].pack("H*"), a.derive(b)
+ 
+     assert_equal a.derive(b), a.dh_compute_key(b.public_key)
+-  end
++  end if !openssl?(3, 0, 0) # TODO: Test it without using #private_key=
+ 
+   def test_sign_verify_raw
+     key = Fixtures.pkey("p256")
+diff --git a/test/openssl/test_pkey_rsa.rb b/test/openssl/test_pkey_rsa.rb
+index dbe87ba4..1c7f9ccf 100644
+--- a/test/openssl/test_pkey_rsa.rb
++++ b/test/openssl/test_pkey_rsa.rb
+@@ -31,15 +31,18 @@ def test_private
+     assert(!key4.private?)
+     rsa1024 = Fixtures.pkey("rsa1024")
+ 
+-    # Generated by RSA#set_key
+-    key5 = OpenSSL::PKey::RSA.new
+-    key5.set_key(rsa1024.n, rsa1024.e, rsa1024.d)
+-    assert(key5.private?)
+-
+-    # Generated by RSA#set_key, without d
+-    key6 = OpenSSL::PKey::RSA.new
+-    key6.set_key(rsa1024.n, rsa1024.e, nil)
+-    assert(!key6.private?)
++    if !openssl?(3, 0, 0)
++      key = OpenSSL::PKey::RSA.new
++      # Generated by RSA#set_key
++      key5 = OpenSSL::PKey::RSA.new
++      key5.set_key(rsa1024.n, rsa1024.e, rsa1024.d)
++      assert(key5.private?)
++
++      # Generated by RSA#set_key, without d
++      key6 = OpenSSL::PKey::RSA.new
++      key6.set_key(rsa1024.n, rsa1024.e, nil)
++      assert(!key6.private?)
++    end
+   end
+ 
+   def test_new
+@@ -235,36 +238,52 @@ def test_encrypt_decrypt_legacy
+ 
+   def test_export
+     rsa1024 = Fixtures.pkey("rsa1024")
+-    key = OpenSSL::PKey::RSA.new
+ 
+-    # key has only n, e and d
+-    key.set_key(rsa1024.n, rsa1024.e, rsa1024.d)
+-    assert_equal rsa1024.public_key.export, key.export
++    pub = OpenSSL::PKey.read(rsa1024.public_to_der)
++    assert_not_equal rsa1024.export, pub.export
++    assert_equal rsa1024.public_to_pem, pub.export
++
++    # PKey is immutable in OpenSSL >= 3.0
++    if !openssl?(3, 0, 0)
++      key = OpenSSL::PKey::RSA.new
+ 
+-    # key has only n, e, d, p and q
+-    key.set_factors(rsa1024.p, rsa1024.q)
+-    assert_equal rsa1024.public_key.export, key.export
++      # key has only n, e and d
++      key.set_key(rsa1024.n, rsa1024.e, rsa1024.d)
++      assert_equal rsa1024.public_key.export, key.export
+ 
+-    # key has n, e, d, p, q, dmp1, dmq1 and iqmp
+-    key.set_crt_params(rsa1024.dmp1, rsa1024.dmq1, rsa1024.iqmp)
+-    assert_equal rsa1024.export, key.export
++      # key has only n, e, d, p and q
++      key.set_factors(rsa1024.p, rsa1024.q)
++      assert_equal rsa1024.public_key.export, key.export
++
++      # key has n, e, d, p, q, dmp1, dmq1 and iqmp
++      key.set_crt_params(rsa1024.dmp1, rsa1024.dmq1, rsa1024.iqmp)
++      assert_equal rsa1024.export, key.export
++    end
+   end
+ 
+   def test_to_der
+     rsa1024 = Fixtures.pkey("rsa1024")
+-    key = OpenSSL::PKey::RSA.new
+ 
+-    # key has only n, e and d
+-    key.set_key(rsa1024.n, rsa1024.e, rsa1024.d)
+-    assert_equal rsa1024.public_key.to_der, key.to_der
++    pub = OpenSSL::PKey.read(rsa1024.public_to_der)
++    assert_not_equal rsa1024.to_der, pub.to_der
++    assert_equal rsa1024.public_to_der, pub.to_der
+ 
+-    # key has only n, e, d, p and q
+-    key.set_factors(rsa1024.p, rsa1024.q)
+-    assert_equal rsa1024.public_key.to_der, key.to_der
++    # PKey is immutable in OpenSSL >= 3.0
++    if !openssl?(3, 0, 0)
++      key = OpenSSL::PKey::RSA.new
+ 
+-    # key has n, e, d, p, q, dmp1, dmq1 and iqmp
+-    key.set_crt_params(rsa1024.dmp1, rsa1024.dmq1, rsa1024.iqmp)
+-    assert_equal rsa1024.to_der, key.to_der
++      # key has only n, e and d
++      key.set_key(rsa1024.n, rsa1024.e, rsa1024.d)
++      assert_equal rsa1024.public_key.to_der, key.to_der
++
++      # key has only n, e, d, p and q
++      key.set_factors(rsa1024.p, rsa1024.q)
++      assert_equal rsa1024.public_key.to_der, key.to_der
++
++      # key has n, e, d, p, q, dmp1, dmq1 and iqmp
++      key.set_crt_params(rsa1024.dmp1, rsa1024.dmq1, rsa1024.iqmp)
++      assert_equal rsa1024.to_der, key.to_der
++    end
+   end
+ 
+   def test_RSAPrivateKey
+@@ -501,8 +520,12 @@ def test_dup
+     key = Fixtures.pkey("rsa1024")
+     key2 = key.dup
+     assert_equal key.params, key2.params
+-    key2.set_key(key2.n, 3, key2.d)
+-    assert_not_equal key.params, key2.params
++
++    # PKey is immutable in OpenSSL >= 3.0
++    if !openssl?(3, 0, 0)
++      key2.set_key(key2.n, 3, key2.d)
++      assert_not_equal key.params, key2.params
++    end
+   end
+ 
+   def test_marshal

SOURCES/ruby-3.1.0-Disable-test_no_private_exp-on-OpenSSL-3.0.patch

@@ -0,0 +1,27 @@
+From 47975ece4096cdab16b3f200f93ea2377dfb41ac Mon Sep 17 00:00:00 2001
+From: Kazuki Yamaguchi <k@rhe.jp>
+Date: Mon, 31 May 2021 14:17:21 +0900
+Subject: [PATCH] test/openssl/test_pkey_rsa: disable test_no_private_exp on
+ OpenSSL 3.0
+
+OpenSSL::PKey::RSA#set_key does not exist when built with OpenSSL 3.0,
+so it is not possible to create an RSA object with incomplete state.
+
+https://github.com/ruby/openssl/commit/ca03c9c070
+---
+ test/openssl/test_pkey_rsa.rb | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/test/openssl/test_pkey_rsa.rb b/test/openssl/test_pkey_rsa.rb
+index 4548bdb2cfa6..dbe87ba4c1b0 100644
+--- a/test/openssl/test_pkey_rsa.rb
++++ b/test/openssl/test_pkey_rsa.rb
+@@ -11,7 +11,7 @@ def test_no_private_exp
+     key.set_factors(rsa.p, rsa.q)
+     assert_raise(OpenSSL::PKey::RSAError){ key.private_encrypt("foo") }
+     assert_raise(OpenSSL::PKey::RSAError){ key.private_decrypt("foo") }
+-  end
++  end if !openssl?(3, 0, 0) # Impossible state in OpenSSL 3.0
+ 
+   def test_private
+     # Generated by key size and public exponent

SOURCES/ruby-3.1.0-Don-t-query-RubyVM-FrozenCore-for-class-path.patch

@@ -0,0 +1,43 @@
+From 0ade5611df9f981005eed32b369d1e699e520221 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?V=C3=ADt=20Ondruch?= <vondruch@redhat.com>
+Date: Thu, 10 Feb 2022 13:26:44 +0100
+Subject: [PATCH] Don't query `RubyVM::FrozenCore` for class path.
+
+The `RubyVM::FrozenCore` class path is corrupted during GC cycle and
+returns random garbage, which might result in segfault.
+
+But since it is easy to detect the `RubyVM::FrozenCore`, just provide
+the class path explicitly as a workaround.
+
+Other possibility would be to ignore `RubyVM::FrozenCore` simlarly as
+TracePoint API does:
+
+https://github.com/ruby/ruby/blob/46f6575157d4c2f6bbd5693896e26a65037e5552/vm_trace.c#L411
+---
+ vm.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/vm.c b/vm.c
+index 8ce8b279d4..3d189fa63a 100644
+--- a/vm.c
++++ b/vm.c
+@@ -446,7 +446,15 @@ rb_dtrace_setup(rb_execution_context_t *ec, VALUE klass, ID id,
+     }
+     type = BUILTIN_TYPE(klass);
+     if (type == T_CLASS || type == T_ICLASS || type == T_MODULE) {
+-	VALUE name = rb_class_path(klass);
++	VALUE name = Qnil;
++	/*
++	 * Special treatment for rb_mRubyVMFrozenCore wchi is broken by GC.
++         * https://bugs.ruby-lang.org/issues/18257
++	 */
++	if (klass == rb_mRubyVMFrozenCore)
++	    name = rb_str_new_cstr("RubyVM::FrozenCore");
++	else
++	    name = rb_class_path(klass);
+ 	const char *classname, *filename;
+ 	const char *methodname = rb_id2name(id);
+ 	if (methodname && (filename = rb_source_location_cstr(&args->line_no)) != 0) {
+-- 
+2.34.1
+

SOURCES/ruby-3.1.0-Get-rid-of-type-punning-pointer-casts.patch

@@ -0,0 +1,186 @@
+From 104b009e26c050584e4d186c8cc4e1496a14061b Mon Sep 17 00:00:00 2001
+From: Nobuyoshi Nakada <nobu@ruby-lang.org>
+Date: Thu, 5 Aug 2021 20:09:25 +0900
+Subject: [PATCH] Get rid of type-punning pointer casts [Bug #18062]
+
+---
+ vm_eval.c       |  4 +++-
+ vm_insnhelper.c |  7 +++++--
+ vm_method.c     | 41 ++++++++++++++++++++++++++---------------
+ 3 files changed, 34 insertions(+), 18 deletions(-)
+
+diff --git a/vm_eval.c b/vm_eval.c
+index 6d4b5c3c0b28..7ce9f157e671 100644
+--- a/vm_eval.c
++++ b/vm_eval.c
+@@ -350,9 +350,11 @@ cc_new(VALUE klass, ID mid, int argc, const rb_callable_method_entry_t *cme)
+     {
+         struct rb_class_cc_entries *ccs;
+         struct rb_id_table *cc_tbl = RCLASS_CC_TBL(klass);
++        VALUE ccs_data;
+ 
+-        if (rb_id_table_lookup(cc_tbl, mid, (VALUE*)&ccs)) {
++        if (rb_id_table_lookup(cc_tbl, mid, &ccs_data)) {
+             // ok
++            ccs = (struct rb_class_cc_entries *)ccs_data;
+         }
+         else {
+             ccs = vm_ccs_create(klass, cme);
+diff --git a/vm_insnhelper.c b/vm_insnhelper.c
+index 14928b2afe8e..e186376b24d7 100644
+--- a/vm_insnhelper.c
++++ b/vm_insnhelper.c
+@@ -1637,9 +1637,11 @@ vm_search_cc(const VALUE klass, const struct rb_callinfo * const ci)
+     const ID mid = vm_ci_mid(ci);
+     struct rb_id_table *cc_tbl = RCLASS_CC_TBL(klass);
+     struct rb_class_cc_entries *ccs = NULL;
++    VALUE ccs_data;
+ 
+     if (cc_tbl) {
+-        if (rb_id_table_lookup(cc_tbl, mid, (VALUE *)&ccs)) {
++        if (rb_id_table_lookup(cc_tbl, mid, &ccs_data)) {
++            ccs = (struct rb_class_cc_entries *)ccs_data;
+             const int ccs_len = ccs->len;
+             VM_ASSERT(vm_ccs_verify(ccs, mid, klass));
+ 
+@@ -1706,8 +1708,9 @@ vm_search_cc(const VALUE klass, const struct rb_callinfo * const ci)
+     if (ccs == NULL) {
+         VM_ASSERT(cc_tbl != NULL);
+ 
+-        if (LIKELY(rb_id_table_lookup(cc_tbl, mid, (VALUE*)&ccs))) {
++        if (LIKELY(rb_id_table_lookup(cc_tbl, mid, &ccs_data))) {
+             // rb_callable_method_entry() prepares ccs.
++            ccs = (struct rb_class_cc_entries *)ccs_data;
+         }
+         else {
+             // TODO: required?
+diff --git a/vm_method.c b/vm_method.c
+index 016dba1dbb18..1fd0bd57f7ca 100644
+--- a/vm_method.c
++++ b/vm_method.c
+@@ -42,11 +42,11 @@ vm_ccs_dump(VALUE klass, ID target_mid)
+ {
+     struct rb_id_table *cc_tbl = RCLASS_CC_TBL(klass);
+     if (cc_tbl) {
+-        const struct rb_class_cc_entries *ccs;
++        VALUE ccs;
+         if (target_mid) {
+-            if (rb_id_table_lookup(cc_tbl, target_mid, (VALUE *)&ccs)) {
++            if (rb_id_table_lookup(cc_tbl, target_mid, &ccs)) {
+                 fprintf(stderr, "  [CCTB] %p\n", (void *)cc_tbl);
+-                vm_ccs_dump_i(target_mid, (VALUE)ccs, NULL);
++                vm_ccs_dump_i(target_mid, ccs, NULL);
+             }
+         }
+         else {
+@@ -72,11 +72,11 @@ vm_mtbl_dump(VALUE klass, ID target_mid)
+     fprintf(stderr, "# vm_mtbl\n");
+     while (klass) {
+         rp_m("  -> ", klass);
+-        rb_method_entry_t *me;
++        VALUE me;
+ 
+         if (RCLASS_M_TBL(klass)) {
+             if (target_mid != 0) {
+-                if (rb_id_table_lookup(RCLASS_M_TBL(klass), target_mid, (VALUE *)&me)) {
++                if (rb_id_table_lookup(RCLASS_M_TBL(klass), target_mid, &me)) {
+                     rp_m("  [MTBL] ", me);
+                 }
+             }
+@@ -90,7 +90,7 @@ vm_mtbl_dump(VALUE klass, ID target_mid)
+         }
+         if (RCLASS_CALLABLE_M_TBL(klass)) {
+             if (target_mid != 0) {
+-                if (rb_id_table_lookup(RCLASS_CALLABLE_M_TBL(klass), target_mid, (VALUE *)&me)) {
++                if (rb_id_table_lookup(RCLASS_CALLABLE_M_TBL(klass), target_mid, &me)) {
+                     rp_m("  [CM**] ", me);
+                 }
+             }
+@@ -144,10 +144,11 @@ clear_method_cache_by_id_in_class(VALUE klass, ID mid)
+         // check only current class
+ 
+         struct rb_id_table *cc_tbl = RCLASS_CC_TBL(klass);
+-        struct rb_class_cc_entries *ccs;
++        VALUE ccs_data;
+ 
+         // invalidate CCs
+-        if (cc_tbl && rb_id_table_lookup(cc_tbl, mid, (VALUE *)&ccs)) {
++        if (cc_tbl && rb_id_table_lookup(cc_tbl, mid, &ccs_data)) {
++            struct rb_class_cc_entries *ccs = (struct rb_class_cc_entries *)ccs_data;
+             rb_vm_ccs_free(ccs);
+             rb_id_table_delete(cc_tbl, mid);
+             RB_DEBUG_COUNTER_INC(cc_invalidate_leaf_ccs);
+@@ -205,9 +206,10 @@ clear_method_cache_by_id_in_class(VALUE klass, ID mid)
+         }
+         else {
+             rb_vm_t *vm = GET_VM();
+-            if (rb_id_table_lookup(vm->negative_cme_table, mid, (VALUE *)&cme)) {
++            VALUE cme_data = (VALUE) cme;
++            if (rb_id_table_lookup(vm->negative_cme_table, mid, &cme_data)) {
+                 rb_id_table_delete(vm->negative_cme_table, mid);
+-                vm_me_invalidate_cache((rb_callable_method_entry_t *)cme);
++                vm_me_invalidate_cache((rb_callable_method_entry_t *)cme_data);
+ 
+                 RB_DEBUG_COUNTER_INC(cc_invalidate_negative);
+             }
+@@ -1030,6 +1032,7 @@ prepare_callable_method_entry(VALUE defined_class, ID id, const rb_method_entry_
+ {
+     struct rb_id_table *mtbl;
+     const rb_callable_method_entry_t *cme;
++    VALUE cme_data;
+ 
+     if (me) {
+         if (me->defined_class == 0) {
+@@ -1039,7 +1042,8 @@ prepare_callable_method_entry(VALUE defined_class, ID id, const rb_method_entry_
+ 
+             mtbl = RCLASS_CALLABLE_M_TBL(defined_class);
+ 
+-            if (mtbl && rb_id_table_lookup(mtbl, id, (VALUE *)&cme)) {
++            if (mtbl && rb_id_table_lookup(mtbl, id, &cme_data)) {
++                cme = (rb_callable_method_entry_t *)cme_data;
+                 RB_DEBUG_COUNTER_INC(mc_cme_complement_hit);
+                 VM_ASSERT(callable_method_entry_p(cme));
+                 VM_ASSERT(!METHOD_ENTRY_INVALIDATED(cme));
+@@ -1083,9 +1087,10 @@ cached_callable_method_entry(VALUE klass, ID mid)
+     ASSERT_vm_locking();
+ 
+     struct rb_id_table *cc_tbl = RCLASS_CC_TBL(klass);
+-    struct rb_class_cc_entries *ccs;
++    VALUE ccs_data;
+ 
+-    if (cc_tbl && rb_id_table_lookup(cc_tbl, mid, (VALUE *)&ccs)) {
++    if (cc_tbl && rb_id_table_lookup(cc_tbl, mid, &ccs_data)) {
++        struct rb_class_cc_entries *ccs = (struct rb_class_cc_entries *)ccs_data;
+         VM_ASSERT(vm_ccs_p(ccs));
+ 
+         if (LIKELY(!METHOD_ENTRY_INVALIDATED(ccs->cme))) {
+@@ -1111,12 +1116,14 @@ cache_callable_method_entry(VALUE klass, ID mid, const rb_callable_method_entry_
+ 
+     struct rb_id_table *cc_tbl = RCLASS_CC_TBL(klass);
+     struct rb_class_cc_entries *ccs;
++    VALUE ccs_data;
+ 
+     if (!cc_tbl) {
+         cc_tbl = RCLASS_CC_TBL(klass) = rb_id_table_create(2);
+     }
+ 
+-    if (rb_id_table_lookup(cc_tbl, mid, (VALUE *)&ccs)) {
++    if (rb_id_table_lookup(cc_tbl, mid, &ccs_data)) {
++        ccs = (struct rb_class_cc_entries *)ccs_data;
+         VM_ASSERT(ccs->cme == cme);
+     }
+     else {
+@@ -1130,8 +1137,12 @@ negative_cme(ID mid)
+ {
+     rb_vm_t *vm = GET_VM();
+     const rb_callable_method_entry_t *cme;
++    VALUE cme_data;
+ 
+-    if (!rb_id_table_lookup(vm->negative_cme_table, mid, (VALUE *)&cme)) {
++    if (rb_id_table_lookup(vm->negative_cme_table, mid, &cme_data)) {
++        cme = (rb_callable_method_entry_t *)cme_data;
++    }
++    else {
+         cme = (rb_callable_method_entry_t *)rb_method_entry_alloc(mid, Qnil, Qnil, NULL);
+         rb_id_table_insert(vm->negative_cme_table, mid, (VALUE)cme);
+     }

SOURCES/ruby-3.1.0-Ignore-DW_FORM_ref_addr.patch

@@ -0,0 +1,58 @@
+From 72317b333b85eed483ad00bcd4f40944019a7c13 Mon Sep 17 00:00:00 2001
+From: "xtkoba+ruby@gmail.com" <xtkoba+ruby@gmail.com>
+Date: Fri, 13 Aug 2021 13:45:53 +0000
+Subject: [PATCH] Ignore `DW_FORM_ref_addr` [Bug #17052]
+
+Ignore `DW_FORM_ref_addr` form and other forms that are not supposed
+to be used currently.
+---
+ addr2line.c | 23 ++++++++++++++++++++---
+ 1 file changed, 20 insertions(+), 3 deletions(-)
+
+diff --git a/addr2line.c b/addr2line.c
+index fed1a8da84e5..92c6da5e3bea 100644
+--- a/addr2line.c
++++ b/addr2line.c
+@@ -1593,14 +1593,31 @@ di_read_cu(DebugInfoReader *reader)
+ }
+ 
+ static void
+-read_abstract_origin(DebugInfoReader *reader, uint64_t abstract_origin, line_info_t *line)
++read_abstract_origin(DebugInfoReader *reader, uint64_t form, uint64_t abstract_origin, line_info_t *line)
+ {
+     char *p = reader->p;
+     char *q = reader->q;
+     int level = reader->level;
+     DIE die;
+ 
+-    reader->p = reader->current_cu + abstract_origin;
++    switch (form) {
++      case DW_FORM_ref1:
++      case DW_FORM_ref2:
++      case DW_FORM_ref4:
++      case DW_FORM_ref8:
++      case DW_FORM_ref_udata:
++        reader->p = reader->current_cu + abstract_origin;
++        break;
++      case DW_FORM_ref_addr:
++        goto finish; /* not supported yet */
++      case DW_FORM_ref_sig8:
++        goto finish; /* not supported yet */
++      case DW_FORM_ref_sup4:
++      case DW_FORM_ref_sup8:
++        goto finish; /* not supported yet */
++      default:
++        goto finish;
++    }
+     if (!di_read_die(reader, &die)) goto finish;
+ 
+     /* enumerate abbrev */
+@@ -1665,7 +1682,7 @@ debug_info_read(DebugInfoReader *reader, int num_traces, void **traces,
+                 /* 1 or 3 */
+                 break; /* goto skip_die; */
+               case DW_AT_abstract_origin:
+-                read_abstract_origin(reader, v.as.uint64, &line);
++                read_abstract_origin(reader, v.form, v.as.uint64, &line);
+                 break; /* goto skip_die; */
+             }
+         }

SOURCES/ruby-3.1.0-Migrate-from-the-low-level-HMAC-API-to-the-EVP-API.patch

@@ -0,0 +1,523 @@
+From 8253d7c9cea16c2aa009b59db4f5d93afb74c6eb Mon Sep 17 00:00:00 2001
+From: Kazuki Yamaguchi <k@rhe.jp>
+Date: Tue, 30 Jun 2020 14:27:13 +0900
+Subject: [PATCH 1/2] hmac: add a test case for OpenSSL::HMAC singleton methods
+
+---
+ test/openssl/test_hmac.rb | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/test/openssl/test_hmac.rb b/test/openssl/test_hmac.rb
+index 9cb3c5a86..7202a5902 100644
+--- a/test/openssl/test_hmac.rb
++++ b/test/openssl/test_hmac.rb
+@@ -49,6 +49,15 @@ def test_eq
+     refute_equal h1, h2.digest
+     refute_equal h1, h3
+   end
++
++  def test_singleton_methods
++    # RFC 2202 2. Test Cases for HMAC-MD5
++    key = ["0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b"].pack("H*")
++    digest = OpenSSL::HMAC.digest("MD5", key, "Hi There")
++    assert_equal ["9294727a3638bb1c13f48ef8158bfc9d"].pack("H*"), digest
++    hexdigest = OpenSSL::HMAC.hexdigest("MD5", key, "Hi There")
++    assert_equal "9294727a3638bb1c13f48ef8158bfc9d", hexdigest
++  end
+ end
+ 
+ end
+
+From 0317e2fc028be40a7d64d0e4337d3e21539613ce Mon Sep 17 00:00:00 2001
+From: Kazuki Yamaguchi <k@rhe.jp>
+Date: Mon, 18 May 2020 16:15:07 +0900
+Subject: [PATCH 2/2] hmac: migrate from the low-level HMAC API to the EVP API
+
+Use the EVP API instead of the low-level HMAC API. Use of the HMAC API
+has been discouraged and is being marked as deprecated starting from
+OpenSSL 3.0.0.
+
+The two singleton methods OpenSSL::HMAC, HMAC.digest and HMAC.hexdigest
+are now in lib/openssl/hmac.rb.
+---
+ ext/openssl/extconf.rb          |   3 +-
+ ext/openssl/lib/openssl/hmac.rb |  40 +++++++
+ ext/openssl/openssl_missing.c   |  26 -----
+ ext/openssl/openssl_missing.h   |  10 +-
+ ext/openssl/ossl.h              |   1 -
+ ext/openssl/ossl_hmac.c         | 179 ++++++++------------------------
+ 6 files changed, 89 insertions(+), 170 deletions(-)
+
+diff --git a/ext/openssl/extconf.rb b/ext/openssl/extconf.rb
+index 693e55cd9..063498a76 100644
+--- a/ext/openssl/extconf.rb
++++ b/ext/openssl/extconf.rb
+@@ -141,8 +141,7 @@ def find_openssl_library
+ have_func("BN_GENCB_get_arg")
+ have_func("EVP_MD_CTX_new")
+ have_func("EVP_MD_CTX_free")
+-have_func("HMAC_CTX_new")
+-have_func("HMAC_CTX_free")
++have_func("EVP_MD_CTX_pkey_ctx")
+ have_func("X509_STORE_get_ex_data")
+ have_func("X509_STORE_set_ex_data")
+ have_func("X509_STORE_get_ex_new_index")
+diff --git a/ext/openssl/lib/openssl/hmac.rb b/ext/openssl/lib/openssl/hmac.rb
+index 3d4427611d..9bc8bc8df3 100644
+--- a/ext/openssl/lib/openssl/hmac.rb
++++ b/ext/openssl/lib/openssl/hmac.rb
+@@ -9,5 +9,45 @@ def ==(other)
+ 
+       OpenSSL.fixed_length_secure_compare(self.digest, other.digest)
+     end
++
++    class << self
++      # :call-seq:
++      #    HMAC.digest(digest, key, data) -> aString
++      #
++      # Returns the authentication code as a binary string. The _digest_ parameter
++      # specifies the digest algorithm to use. This may be a String representing
++      # the algorithm name or an instance of OpenSSL::Digest.
++      #
++      # === Example
++      #  key = 'key'
++      #  data = 'The quick brown fox jumps over the lazy dog'
++      #
++      #  hmac = OpenSSL::HMAC.digest('SHA1', key, data)
++      #  #=> "\xDE|\x9B\x85\xB8\xB7\x8A\xA6\xBC\x8Az6\xF7\n\x90p\x1C\x9D\xB4\xD9"
++      def digest(digest, key, data)
++        hmac = new(key, digest)
++        hmac << data
++        hmac.digest
++      end
++
++      # :call-seq:
++      #    HMAC.hexdigest(digest, key, data) -> aString
++      #
++      # Returns the authentication code as a hex-encoded string. The _digest_
++      # parameter specifies the digest algorithm to use. This may be a String
++      # representing the algorithm name or an instance of OpenSSL::Digest.
++      #
++      # === Example
++      #  key = 'key'
++      #  data = 'The quick brown fox jumps over the lazy dog'
++      #
++      #  hmac = OpenSSL::HMAC.hexdigest('SHA1', key, data)
++      #  #=> "de7c9b85b8b78aa6bc8a7a36f70a90701c9db4d9"
++      def hexdigest(digest, key, data)
++        hmac = new(key, digest)
++        hmac << data
++        hmac.hexdigest
++      end
++    end
+   end
+ end
+diff --git a/ext/openssl/openssl_missing.c b/ext/openssl/openssl_missing.c
+index b36ef0288..010c158dc 100644
+--- a/ext/openssl/openssl_missing.c
++++ b/ext/openssl/openssl_missing.c
+@@ -13,9 +13,6 @@
+ #if !defined(OPENSSL_NO_ENGINE)
+ # include <openssl/engine.h>
+ #endif
+-#if !defined(OPENSSL_NO_HMAC)
+-# include <openssl/hmac.h>
+-#endif
+ #include <openssl/x509_vfy.h>
+ 
+ #include "openssl_missing.h"
+@@ -58,29 +55,6 @@ ossl_EC_curve_nist2nid(const char *name)
+ #endif
+ 
+ /*** added in 1.1.0 ***/
+-#if !defined(HAVE_HMAC_CTX_NEW)
+-HMAC_CTX *
+-ossl_HMAC_CTX_new(void)
+-{
+-    HMAC_CTX *ctx = OPENSSL_malloc(sizeof(HMAC_CTX));
+-    if (!ctx)
+-	return NULL;
+-    HMAC_CTX_init(ctx);
+-    return ctx;
+-}
+-#endif
+-
+-#if !defined(HAVE_HMAC_CTX_FREE)
+-void
+-ossl_HMAC_CTX_free(HMAC_CTX *ctx)
+-{
+-    if (ctx) {
+-	HMAC_CTX_cleanup(ctx);
+-	OPENSSL_free(ctx);
+-    }
+-}
+-#endif
+-
+ #if !defined(HAVE_X509_CRL_GET0_SIGNATURE)
+ void
+ ossl_X509_CRL_get0_signature(const X509_CRL *crl, const ASN1_BIT_STRING **psig,
+diff --git a/ext/openssl/openssl_missing.h b/ext/openssl/openssl_missing.h
+index 7d218f86f..06d2a9082 100644
+--- a/ext/openssl/openssl_missing.h
++++ b/ext/openssl/openssl_missing.h
+@@ -54,14 +54,8 @@ int ossl_EC_curve_nist2nid(const char *);
+ #  define EVP_MD_CTX_free EVP_MD_CTX_destroy
+ #endif
+ 
+-#if !defined(HAVE_HMAC_CTX_NEW)
+-HMAC_CTX *ossl_HMAC_CTX_new(void);
+-#  define HMAC_CTX_new ossl_HMAC_CTX_new
+-#endif
+-
+-#if !defined(HAVE_HMAC_CTX_FREE)
+-void ossl_HMAC_CTX_free(HMAC_CTX *);
+-#  define HMAC_CTX_free ossl_HMAC_CTX_free
++#if !defined(HAVE_EVP_MD_CTX_PKEY_CTX)
++#  define EVP_MD_CTX_pkey_ctx(x) (x)->pctx
+ #endif
+ 
+ #if !defined(HAVE_X509_STORE_GET_EX_DATA)
+diff --git a/ext/openssl/ossl.h b/ext/openssl/ossl.h
+index c20f506bd..577eb6d6b 100644
+--- a/ext/openssl/ossl.h
++++ b/ext/openssl/ossl.h
+@@ -24,7 +24,6 @@
+ #include <openssl/ssl.h>
+ #include <openssl/pkcs12.h>
+ #include <openssl/pkcs7.h>
+-#include <openssl/hmac.h>
+ #include <openssl/rand.h>
+ #include <openssl/conf.h>
+ #ifndef OPENSSL_NO_TS
+diff --git a/ext/openssl/ossl_hmac.c b/ext/openssl/ossl_hmac.c
+index 70e9fb819..a21db6c48 100644
+--- a/ext/openssl/ossl_hmac.c
++++ b/ext/openssl/ossl_hmac.c
+@@ -7,14 +7,12 @@
+  * This program is licensed under the same licence as Ruby.
+  * (See the file 'LICENCE'.)
+  */
+-#if !defined(OPENSSL_NO_HMAC)
+-
+ #include "ossl.h"
+ 
+ #define NewHMAC(klass) \
+     TypedData_Wrap_Struct((klass), &ossl_hmac_type, 0)
+ #define GetHMAC(obj, ctx) do { \
+-    TypedData_Get_Struct((obj), HMAC_CTX, &ossl_hmac_type, (ctx)); \
++    TypedData_Get_Struct((obj), EVP_MD_CTX, &ossl_hmac_type, (ctx)); \
+     if (!(ctx)) { \
+ 	ossl_raise(rb_eRuntimeError, "HMAC wasn't initialized"); \
+     } \
+@@ -36,7 +34,7 @@ VALUE eHMACError;
+ static void
+ ossl_hmac_free(void *ctx)
+ {
+-    HMAC_CTX_free(ctx);
++    EVP_MD_CTX_free(ctx);
+ }
+ 
+ static const rb_data_type_t ossl_hmac_type = {
+@@ -51,12 +49,12 @@ static VALUE
+ ossl_hmac_alloc(VALUE klass)
+ {
+     VALUE obj;
+-    HMAC_CTX *ctx;
++    EVP_MD_CTX *ctx;
+ 
+     obj = NewHMAC(klass);
+-    ctx = HMAC_CTX_new();
++    ctx = EVP_MD_CTX_new();
+     if (!ctx)
+-	ossl_raise(eHMACError, NULL);
++        ossl_raise(eHMACError, "EVP_MD_CTX");
+     RTYPEDDATA_DATA(obj) = ctx;
+ 
+     return obj;
+@@ -76,8 +74,7 @@ ossl_hmac_alloc(VALUE klass)
+  * === Example
+  *
+  *	key = 'key'
+- * 	digest = OpenSSL::Digest.new('sha1')
+- * 	instance = OpenSSL::HMAC.new(key, digest)
++ * 	instance = OpenSSL::HMAC.new(key, 'SHA1')
+  * 	#=> f42bb0eeb018ebbd4597ae7213711ec60760843f
+  * 	instance.class
+  * 	#=> OpenSSL::HMAC
+@@ -86,7 +83,7 @@ ossl_hmac_alloc(VALUE klass)
+  *
+  * Two instances can be securely compared with #== in constant time:
+  *
+- *	other_instance = OpenSSL::HMAC.new('key', OpenSSL::Digest.new('sha1'))
++ *	other_instance = OpenSSL::HMAC.new('key', 'SHA1')
+  *  #=> f42bb0eeb018ebbd4597ae7213711ec60760843f
+  *  instance == other_instance
+  *  #=> true
+@@ -95,12 +92,23 @@ ossl_hmac_alloc(VALUE klass)
+ static VALUE
+ ossl_hmac_initialize(VALUE self, VALUE key, VALUE digest)
+ {
+-    HMAC_CTX *ctx;
++    EVP_MD_CTX *ctx;
++    EVP_PKEY *pkey;
+ 
+-    StringValue(key);
+     GetHMAC(self, ctx);
+-    HMAC_Init_ex(ctx, RSTRING_PTR(key), RSTRING_LENINT(key),
+-		 ossl_evp_get_digestbyname(digest), NULL);
++    StringValue(key);
++    pkey = EVP_PKEY_new_mac_key(EVP_PKEY_HMAC, NULL,
++                                (unsigned char *)RSTRING_PTR(key),
++                                RSTRING_LENINT(key));
++    if (!pkey)
++        ossl_raise(eHMACError, "EVP_PKEY_new_mac_key");
++    if (EVP_DigestSignInit(ctx, NULL, ossl_evp_get_digestbyname(digest),
++                           NULL, pkey) != 1) {
++        EVP_PKEY_free(pkey);
++        ossl_raise(eHMACError, "EVP_DigestSignInit");
++    }
++    /* Decrement reference counter; EVP_MD_CTX still keeps it */
++    EVP_PKEY_free(pkey);
+ 
+     return self;
+ }
+@@ -108,16 +116,15 @@ ossl_hmac_initialize(VALUE self, VALUE key, VALUE digest)
+ static VALUE
+ ossl_hmac_copy(VALUE self, VALUE other)
+ {
+-    HMAC_CTX *ctx1, *ctx2;
++    EVP_MD_CTX *ctx1, *ctx2;
+ 
+     rb_check_frozen(self);
+     if (self == other) return self;
+ 
+     GetHMAC(self, ctx1);
+     GetHMAC(other, ctx2);
+-
+-    if (!HMAC_CTX_copy(ctx1, ctx2))
+-	ossl_raise(eHMACError, "HMAC_CTX_copy");
++    if (EVP_MD_CTX_copy(ctx1, ctx2) != 1)
++        ossl_raise(eHMACError, "EVP_MD_CTX_copy");
+     return self;
+ }
+ 
+@@ -142,33 +149,16 @@ ossl_hmac_copy(VALUE self, VALUE other)
+ static VALUE
+ ossl_hmac_update(VALUE self, VALUE data)
+ {
+-    HMAC_CTX *ctx;
++    EVP_MD_CTX *ctx;
+ 
+     StringValue(data);
+     GetHMAC(self, ctx);
+-    HMAC_Update(ctx, (unsigned char *)RSTRING_PTR(data), RSTRING_LEN(data));
++    if (EVP_DigestSignUpdate(ctx, RSTRING_PTR(data), RSTRING_LEN(data)) != 1)
++        ossl_raise(eHMACError, "EVP_DigestSignUpdate");
+ 
+     return self;
+ }
+ 
+-static void
+-hmac_final(HMAC_CTX *ctx, unsigned char *buf, unsigned int *buf_len)
+-{
+-    HMAC_CTX *final;
+-
+-    final = HMAC_CTX_new();
+-    if (!final)
+-	ossl_raise(eHMACError, "HMAC_CTX_new");
+-
+-    if (!HMAC_CTX_copy(final, ctx)) {
+-	HMAC_CTX_free(final);
+-	ossl_raise(eHMACError, "HMAC_CTX_copy");
+-    }
+-
+-    HMAC_Final(final, buf, buf_len);
+-    HMAC_CTX_free(final);
+-}
+-
+ /*
+  *  call-seq:
+  *     hmac.digest -> string
+@@ -176,7 +166,7 @@ hmac_final(HMAC_CTX *ctx, unsigned char *buf, unsigned int *buf_len)
+  * Returns the authentication code an instance represents as a binary string.
+  *
+  * === Example
+- *  instance = OpenSSL::HMAC.new('key', OpenSSL::Digest.new('sha1'))
++ *  instance = OpenSSL::HMAC.new('key', 'SHA1')
+  *  #=> f42bb0eeb018ebbd4597ae7213711ec60760843f
+  *  instance.digest
+  *  #=> "\xF4+\xB0\xEE\xB0\x18\xEB\xBDE\x97\xAEr\x13q\x1E\xC6\a`\x84?"
+@@ -184,15 +174,16 @@ hmac_final(HMAC_CTX *ctx, unsigned char *buf, unsigned int *buf_len)
+ static VALUE
+ ossl_hmac_digest(VALUE self)
+ {
+-    HMAC_CTX *ctx;
+-    unsigned int buf_len;
++    EVP_MD_CTX *ctx;
++    size_t buf_len;
+     VALUE ret;
+ 
+     GetHMAC(self, ctx);
+     ret = rb_str_new(NULL, EVP_MAX_MD_SIZE);
+-    hmac_final(ctx, (unsigned char *)RSTRING_PTR(ret), &buf_len);
+-    assert(buf_len <= EVP_MAX_MD_SIZE);
+-    rb_str_set_len(ret, buf_len);
++    if (EVP_DigestSignFinal(ctx, (unsigned char *)RSTRING_PTR(ret),
++                            &buf_len) != 1)
++        ossl_raise(eHMACError, "EVP_DigestSignFinal");
++    rb_str_set_len(ret, (long)buf_len);
+ 
+     return ret;
+ }
+@@ -207,13 +198,14 @@ ossl_hmac_digest(VALUE self)
+ static VALUE
+ ossl_hmac_hexdigest(VALUE self)
+ {
+-    HMAC_CTX *ctx;
++    EVP_MD_CTX *ctx;
+     unsigned char buf[EVP_MAX_MD_SIZE];
+-    unsigned int buf_len;
++    size_t buf_len;
+     VALUE ret;
+ 
+     GetHMAC(self, ctx);
+-    hmac_final(ctx, buf, &buf_len);
++    if (EVP_DigestSignFinal(ctx, buf, &buf_len) != 1)
++        ossl_raise(eHMACError, "EVP_DigestSignFinal");
+     ret = rb_str_new(NULL, buf_len * 2);
+     ossl_bin2hex(buf, RSTRING_PTR(ret), buf_len);
+ 
+@@ -230,7 +222,7 @@ ossl_hmac_hexdigest(VALUE self)
+  * === Example
+  *
+  *	data = "The quick brown fox jumps over the lazy dog"
+- * 	instance = OpenSSL::HMAC.new('key', OpenSSL::Digest.new('sha1'))
++ * 	instance = OpenSSL::HMAC.new('key', 'SHA1')
+  * 	#=> f42bb0eeb018ebbd4597ae7213711ec60760843f
+  *
+  * 	instance.update(data)
+@@ -242,84 +234,17 @@ ossl_hmac_hexdigest(VALUE self)
+ static VALUE
+ ossl_hmac_reset(VALUE self)
+ {
+-    HMAC_CTX *ctx;
++    EVP_MD_CTX *ctx;
++    EVP_PKEY *pkey;
+ 
+     GetHMAC(self, ctx);
+-    HMAC_Init_ex(ctx, NULL, 0, NULL, NULL);
++    pkey = EVP_PKEY_CTX_get0_pkey(EVP_MD_CTX_pkey_ctx(ctx));
++    if (EVP_DigestSignInit(ctx, NULL, EVP_MD_CTX_md(ctx), NULL, pkey) != 1)
++        ossl_raise(eHMACError, "EVP_DigestSignInit");
+ 
+     return self;
+ }
+ 
+-/*
+- *  call-seq:
+- *     HMAC.digest(digest, key, data) -> aString
+- *
+- * Returns the authentication code as a binary string. The _digest_ parameter
+- * specifies the digest algorithm to use. This may be a String representing
+- * the algorithm name or an instance of OpenSSL::Digest.
+- *
+- * === Example
+- *
+- *	key = 'key'
+- * 	data = 'The quick brown fox jumps over the lazy dog'
+- *
+- * 	hmac = OpenSSL::HMAC.digest('sha1', key, data)
+- * 	#=> "\xDE|\x9B\x85\xB8\xB7\x8A\xA6\xBC\x8Az6\xF7\n\x90p\x1C\x9D\xB4\xD9"
+- *
+- */
+-static VALUE
+-ossl_hmac_s_digest(VALUE klass, VALUE digest, VALUE key, VALUE data)
+-{
+-    unsigned char *buf;
+-    unsigned int buf_len;
+-
+-    StringValue(key);
+-    StringValue(data);
+-    buf = HMAC(ossl_evp_get_digestbyname(digest), RSTRING_PTR(key),
+-	       RSTRING_LENINT(key), (unsigned char *)RSTRING_PTR(data),
+-	       RSTRING_LEN(data), NULL, &buf_len);
+-
+-    return rb_str_new((const char *)buf, buf_len);
+-}
+-
+-/*
+- *  call-seq:
+- *     HMAC.hexdigest(digest, key, data) -> aString
+- *
+- * Returns the authentication code as a hex-encoded string. The _digest_
+- * parameter specifies the digest algorithm to use. This may be a String
+- * representing the algorithm name or an instance of OpenSSL::Digest.
+- *
+- * === Example
+- *
+- *	key = 'key'
+- * 	data = 'The quick brown fox jumps over the lazy dog'
+- *
+- * 	hmac = OpenSSL::HMAC.hexdigest('sha1', key, data)
+- * 	#=> "de7c9b85b8b78aa6bc8a7a36f70a90701c9db4d9"
+- *
+- */
+-static VALUE
+-ossl_hmac_s_hexdigest(VALUE klass, VALUE digest, VALUE key, VALUE data)
+-{
+-    unsigned char buf[EVP_MAX_MD_SIZE];
+-    unsigned int buf_len;
+-    VALUE ret;
+-
+-    StringValue(key);
+-    StringValue(data);
+-
+-    if (!HMAC(ossl_evp_get_digestbyname(digest), RSTRING_PTR(key),
+-	      RSTRING_LENINT(key), (unsigned char *)RSTRING_PTR(data),
+-	      RSTRING_LEN(data), buf, &buf_len))
+-	ossl_raise(eHMACError, "HMAC");
+-
+-    ret = rb_str_new(NULL, buf_len * 2);
+-    ossl_bin2hex(buf, RSTRING_PTR(ret), buf_len);
+-
+-    return ret;
+-}
+-
+ /*
+  * INIT
+  */
+@@ -353,8 +278,7 @@ Init_ossl_hmac(void)
+      *   data1 = File.read("file1")
+      *   data2 = File.read("file2")
+      *   key = "key"
+-     *   digest = OpenSSL::Digest.new('SHA256')
+-     *   hmac = OpenSSL::HMAC.new(key, digest)
++     *   hmac = OpenSSL::HMAC.new(key, 'SHA256')
+      *   hmac << data1
+      *   hmac << data2
+      *   mac = hmac.digest
+@@ -364,8 +288,6 @@ Init_ossl_hmac(void)
+     cHMAC = rb_define_class_under(mOSSL, "HMAC", rb_cObject);
+ 
+     rb_define_alloc_func(cHMAC, ossl_hmac_alloc);
+-    rb_define_singleton_method(cHMAC, "digest", ossl_hmac_s_digest, 3);
+-    rb_define_singleton_method(cHMAC, "hexdigest", ossl_hmac_s_hexdigest, 3);
+ 
+     rb_define_method(cHMAC, "initialize", ossl_hmac_initialize, 2);
+     rb_define_method(cHMAC, "initialize_copy", ossl_hmac_copy, 1);
+@@ -378,12 +300,3 @@ Init_ossl_hmac(void)
+     rb_define_alias(cHMAC, "inspect", "hexdigest");
+     rb_define_alias(cHMAC, "to_s", "hexdigest");
+ }
+-
+-#else /* NO_HMAC */
+-#  warning >>> OpenSSL is compiled without HMAC support <<<
+-void
+-Init_ossl_hmac(void)
+-{
+-    rb_warning("HMAC is not available: OpenSSL is compiled without HMAC.");
+-}
+-#endif /* NO_HMAC */
+-- 
+2.34.1
+

SOURCES/ruby-3.1.0-Miscellaneous-changes-for-OpenSSL-3.0-support-part-2.patch

@@ -0,0 +1,458 @@
+From 91d04f991f8b9910efea7bbe5aecb0fea2bbd5fa Mon Sep 17 00:00:00 2001
+From: Kazuki Yamaguchi <k@rhe.jp>
+Date: Sun, 24 Oct 2021 17:50:18 +0900
+Subject: [PATCH 1/8] cipher: update test_ciphers
+
+Do not attempt to actually use all algorithms. Not all algorithms listed
+in OpenSSL::Cipher.ciphers are always available.
+---
+ test/openssl/test_cipher.rb | 13 +++++--------
+ 1 file changed, 5 insertions(+), 8 deletions(-)
+
+diff --git a/test/openssl/test_cipher.rb b/test/openssl/test_cipher.rb
+index 6d18c0c8..b5fdf0b3 100644
+--- a/test/openssl/test_cipher.rb
++++ b/test/openssl/test_cipher.rb
+@@ -135,14 +135,11 @@ def test_ctr_if_exists
+   end
+ 
+   def test_ciphers
+-    OpenSSL::Cipher.ciphers.each{|name|
+-      next if /netbsd/ =~ RUBY_PLATFORM && /idea|rc5/i =~ name
+-      begin
+-        assert_kind_of(OpenSSL::Cipher, OpenSSL::Cipher.new(name))
+-      rescue OpenSSL::Cipher::CipherError => e
+-        raise unless /wrap/ =~ name and /wrap mode not allowed/ =~ e.message
+-      end
+-    }
++    ciphers = OpenSSL::Cipher.ciphers
++    assert_kind_of Array, ciphers
++    assert_include ciphers, "aes-128-cbc"
++    assert_include ciphers, "aes128" # alias of aes-128-cbc
++    assert_include ciphers, "aes-128-gcm"
+   end
+ 
+   def test_AES
+
+From 6a60c7b2e7b6afe8b8c98d864ef2740094d86e1d Mon Sep 17 00:00:00 2001
+From: Kazuki Yamaguchi <k@rhe.jp>
+Date: Sat, 11 Dec 2021 16:27:42 +0900
+Subject: [PATCH 2/8] hmac: fix wrong usage of EVP_DigestSignFinal()
+
+According to the manpage, the "siglen" parameter must be initialized
+beforehand.
+---
+ ext/openssl/ossl_hmac.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/ext/openssl/ossl_hmac.c b/ext/openssl/ossl_hmac.c
+index f89ff2f9..bfe3a74b 100644
+--- a/ext/openssl/ossl_hmac.c
++++ b/ext/openssl/ossl_hmac.c
+@@ -175,7 +175,7 @@ static VALUE
+ ossl_hmac_digest(VALUE self)
+ {
+     EVP_MD_CTX *ctx;
+-    size_t buf_len;
++    size_t buf_len = EVP_MAX_MD_SIZE;
+     VALUE ret;
+ 
+     GetHMAC(self, ctx);
+@@ -200,7 +200,7 @@ ossl_hmac_hexdigest(VALUE self)
+ {
+     EVP_MD_CTX *ctx;
+     unsigned char buf[EVP_MAX_MD_SIZE];
+-    size_t buf_len;
++    size_t buf_len = EVP_MAX_MD_SIZE;
+     VALUE ret;
+ 
+     GetHMAC(self, ctx);
+
+From 46995816392a79d037df5550b2fb226652c06f42 Mon Sep 17 00:00:00 2001
+From: Kazuki Yamaguchi <k@rhe.jp>
+Date: Sat, 11 Dec 2021 16:30:30 +0900
+Subject: [PATCH 3/8] hmac: skip test_dup on OpenSSL 3.0 for now
+
+EVP_MD_CTX_copy() doesn't seem to work as intended on HMAC EVP_MD_CTX
+on OpenSSL 3.0.0 and causes a double free. I haven't found the root
+problem yet, but let's skip the test case for now.
+---
+ test/openssl/test_hmac.rb | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/test/openssl/test_hmac.rb b/test/openssl/test_hmac.rb
+index 2f53a813..47cb3718 100644
+--- a/test/openssl/test_hmac.rb
++++ b/test/openssl/test_hmac.rb
+@@ -19,6 +19,7 @@ def test_hmac
+   end
+ 
+   def test_dup
++    pend "HMAC#initialize_copy is currently broken on OpenSSL 3.0.0" if openssl?(3, 0, 0)
+     h1 = OpenSSL::HMAC.new("KEY", "MD5")
+     h1.update("DATA")
+     h = h1.dup
+
+From 69a27d8de4bd291cb4eb21a4d715b197e7da5a06 Mon Sep 17 00:00:00 2001
+From: Kazuki Yamaguchi <k@rhe.jp>
+Date: Thu, 15 Apr 2021 00:51:58 +0900
+Subject: [PATCH 4/8] engine: disable OpenSSL::Engine on OpenSSL 3.0
+
+The entire ENGINE API is deprecated in OpenSSL 3.0 in favor of the new
+"Provider" concept.
+
+OpenSSL::Engine will not be defined when compiled with OpenSSL 3.0.
+We would need a way to interact with providers from Ruby programs, but
+since the concept is completely different from the ENGINE API, it will
+not be through the current OpenSSL::Engine interface.
+---
+ ext/openssl/openssl_missing.c | 3 ---
+ ext/openssl/ossl.h            | 8 +++++---
+ ext/openssl/ossl_engine.c     | 3 ++-
+ ext/openssl/ossl_pkey.c       | 4 ++++
+ 4 files changed, 11 insertions(+), 7 deletions(-)
+
+diff --git a/ext/openssl/openssl_missing.c b/ext/openssl/openssl_missing.c
+index 8b93cba6..4415703d 100644
+--- a/ext/openssl/openssl_missing.c
++++ b/ext/openssl/openssl_missing.c
+@@ -10,9 +10,6 @@
+ #include RUBY_EXTCONF_H
+ 
+ #include <string.h> /* memcpy() */
+-#if !defined(OPENSSL_NO_ENGINE)
+-# include <openssl/engine.h>
+-#endif
+ #include <openssl/x509_vfy.h>
+ 
+ #include "openssl_missing.h"
+diff --git a/ext/openssl/ossl.h b/ext/openssl/ossl.h
+index 3a0ab1e5..4b512689 100644
+--- a/ext/openssl/ossl.h
++++ b/ext/openssl/ossl.h
+@@ -18,6 +18,7 @@
+ #include <ruby/io.h>
+ #include <ruby/thread.h>
+ #include <openssl/opensslv.h>
++
+ #include <openssl/err.h>
+ #include <openssl/asn1.h>
+ #include <openssl/x509v3.h>
+@@ -30,9 +31,6 @@
+   #include <openssl/ts.h>
+ #endif
+ #include <openssl/crypto.h>
+-#if !defined(OPENSSL_NO_ENGINE)
+-#  include <openssl/engine.h>
+-#endif
+ #if !defined(OPENSSL_NO_OCSP)
+ #  include <openssl/ocsp.h>
+ #endif
+@@ -54,6 +52,10 @@
+       (LIBRESSL_VERSION_NUMBER >= (maj << 28) | (min << 20) | (pat << 12))
+ #endif
+ 
++#if !defined(OPENSSL_NO_ENGINE) && !OSSL_OPENSSL_PREREQ(3, 0, 0)
++# define OSSL_USE_ENGINE
++#endif
++
+ /*
+  * Common Module
+  */
+diff --git a/ext/openssl/ossl_engine.c b/ext/openssl/ossl_engine.c
+index 661a1368..1abde7f7 100644
+--- a/ext/openssl/ossl_engine.c
++++ b/ext/openssl/ossl_engine.c
+@@ -9,7 +9,8 @@
+  */
+ #include "ossl.h"
+ 
+-#if !defined(OPENSSL_NO_ENGINE)
++#ifdef OSSL_USE_ENGINE
++# include <openssl/engine.h>
+ 
+ #define NewEngine(klass) \
+     TypedData_Wrap_Struct((klass), &ossl_engine_type, 0)
+diff --git a/ext/openssl/ossl_pkey.c b/ext/openssl/ossl_pkey.c
+index 7030be3c..94760d32 100644
+--- a/ext/openssl/ossl_pkey.c
++++ b/ext/openssl/ossl_pkey.c
+@@ -9,6 +9,10 @@
+  */
+ #include "ossl.h"
+ 
++#ifdef OSSL_USE_ENGINE
++# include <openssl/engine.h>
++#endif
++
+ /*
+  * Classes
+  */
+
+From b1ee2f23b28c2d0b14fd9b4b9fef13e870370746 Mon Sep 17 00:00:00 2001
+From: Kazuki Yamaguchi <k@rhe.jp>
+Date: Wed, 17 Nov 2021 11:39:06 +0900
+Subject: [PATCH 5/8] ssl: add constants for new SSL_OP_* flags
+
+Add all SSL_OP_* constants defined in OpenSSL 3.0.0 which are not
+specific to DTLS.
+---
+ ext/openssl/ossl_ssl.c | 35 +++++++++++++++++++++++++++++------
+ 1 file changed, 29 insertions(+), 6 deletions(-)
+
+diff --git a/ext/openssl/ossl_ssl.c b/ext/openssl/ossl_ssl.c
+index 3b425ca7..9a0682a7 100644
+--- a/ext/openssl/ossl_ssl.c
++++ b/ext/openssl/ossl_ssl.c
+@@ -2941,13 +2941,28 @@ Init_ossl_ssl(void)
+     rb_define_const(mSSL, "VERIFY_CLIENT_ONCE", INT2NUM(SSL_VERIFY_CLIENT_ONCE));
+ 
+     rb_define_const(mSSL, "OP_ALL", ULONG2NUM(SSL_OP_ALL));
++#ifdef SSL_OP_CLEANSE_PLAINTEXT /* OpenSSL 3.0 */
++    rb_define_const(mSSL, "OP_CLEANSE_PLAINTEXT", ULONG2NUM(SSL_OP_CLEANSE_PLAINTEXT));
++#endif
+     rb_define_const(mSSL, "OP_LEGACY_SERVER_CONNECT", ULONG2NUM(SSL_OP_LEGACY_SERVER_CONNECT));
++#ifdef SSL_OP_ENABLE_KTLS /* OpenSSL 3.0 */
++    rb_define_const(mSSL, "OP_ENABLE_KTLS", ULONG2NUM(SSL_OP_ENABLE_KTLS));
++#endif
+ #ifdef SSL_OP_TLSEXT_PADDING /* OpenSSL 1.0.1h and OpenSSL 1.0.2 */
+     rb_define_const(mSSL, "OP_TLSEXT_PADDING", ULONG2NUM(SSL_OP_TLSEXT_PADDING));
+ #endif
+ #ifdef SSL_OP_SAFARI_ECDHE_ECDSA_BUG /* OpenSSL 1.0.1f and OpenSSL 1.0.2 */
+     rb_define_const(mSSL, "OP_SAFARI_ECDHE_ECDSA_BUG", ULONG2NUM(SSL_OP_SAFARI_ECDHE_ECDSA_BUG));
+ #endif
++#ifdef SSL_OP_IGNORE_UNEXPECTED_EOF /* OpenSSL 3.0 */
++    rb_define_const(mSSL, "OP_IGNORE_UNEXPECTED_EOF", ULONG2NUM(SSL_OP_IGNORE_UNEXPECTED_EOF));
++#endif
++#ifdef SSL_OP_ALLOW_CLIENT_RENEGOTIATION /* OpenSSL 3.0 */
++    rb_define_const(mSSL, "OP_ALLOW_CLIENT_RENEGOTIATION", ULONG2NUM(SSL_OP_ALLOW_CLIENT_RENEGOTIATION));
++#endif
++#ifdef SSL_OP_DISABLE_TLSEXT_CA_NAMES /* OpenSSL 3.0 */
++    rb_define_const(mSSL, "OP_DISABLE_TLSEXT_CA_NAMES", ULONG2NUM(SSL_OP_DISABLE_TLSEXT_CA_NAMES));
++#endif
+ #ifdef SSL_OP_ALLOW_NO_DHE_KEX /* OpenSSL 1.1.1 */
+     rb_define_const(mSSL, "OP_ALLOW_NO_DHE_KEX", ULONG2NUM(SSL_OP_ALLOW_NO_DHE_KEX));
+ #endif
+@@ -2959,13 +2974,15 @@ Init_ossl_ssl(void)
+ #ifdef SSL_OP_NO_ENCRYPT_THEN_MAC /* OpenSSL 1.1.1 */
+     rb_define_const(mSSL, "OP_NO_ENCRYPT_THEN_MAC", ULONG2NUM(SSL_OP_NO_ENCRYPT_THEN_MAC));
+ #endif
+-    rb_define_const(mSSL, "OP_CIPHER_SERVER_PREFERENCE", ULONG2NUM(SSL_OP_CIPHER_SERVER_PREFERENCE));
+-    rb_define_const(mSSL, "OP_TLS_ROLLBACK_BUG", ULONG2NUM(SSL_OP_TLS_ROLLBACK_BUG));
+-#ifdef SSL_OP_NO_RENEGOTIATION /* OpenSSL 1.1.1 */
+-    rb_define_const(mSSL, "OP_NO_RENEGOTIATION", ULONG2NUM(SSL_OP_NO_RENEGOTIATION));
++#ifdef SSL_OP_ENABLE_MIDDLEBOX_COMPAT /* OpenSSL 1.1.1 */
++    rb_define_const(mSSL, "OP_ENABLE_MIDDLEBOX_COMPAT", ULONG2NUM(SSL_OP_ENABLE_MIDDLEBOX_COMPAT));
++#endif
++#ifdef SSL_OP_PRIORITIZE_CHACHA /* OpenSSL 1.1.1 */
++    rb_define_const(mSSL, "OP_PRIORITIZE_CHACHA", ULONG2NUM(SSL_OP_PRIORITIZE_CHACHA));
++#endif
++#ifdef SSL_OP_NO_ANTI_REPLAY /* OpenSSL 1.1.1 */
++    rb_define_const(mSSL, "OP_NO_ANTI_REPLAY", ULONG2NUM(SSL_OP_NO_ANTI_REPLAY));
+ #endif
+-    rb_define_const(mSSL, "OP_CRYPTOPRO_TLSEXT_BUG", ULONG2NUM(SSL_OP_CRYPTOPRO_TLSEXT_BUG));
+-
+     rb_define_const(mSSL, "OP_NO_SSLv3", ULONG2NUM(SSL_OP_NO_SSLv3));
+     rb_define_const(mSSL, "OP_NO_TLSv1", ULONG2NUM(SSL_OP_NO_TLSv1));
+     rb_define_const(mSSL, "OP_NO_TLSv1_1", ULONG2NUM(SSL_OP_NO_TLSv1_1));
+@@ -2973,6 +2990,12 @@ Init_ossl_ssl(void)
+ #ifdef SSL_OP_NO_TLSv1_3 /* OpenSSL 1.1.1 */
+     rb_define_const(mSSL, "OP_NO_TLSv1_3", ULONG2NUM(SSL_OP_NO_TLSv1_3));
+ #endif
++    rb_define_const(mSSL, "OP_CIPHER_SERVER_PREFERENCE", ULONG2NUM(SSL_OP_CIPHER_SERVER_PREFERENCE));
++    rb_define_const(mSSL, "OP_TLS_ROLLBACK_BUG", ULONG2NUM(SSL_OP_TLS_ROLLBACK_BUG));
++#ifdef SSL_OP_NO_RENEGOTIATION /* OpenSSL 1.1.1 */
++    rb_define_const(mSSL, "OP_NO_RENEGOTIATION", ULONG2NUM(SSL_OP_NO_RENEGOTIATION));
++#endif
++    rb_define_const(mSSL, "OP_CRYPTOPRO_TLSEXT_BUG", ULONG2NUM(SSL_OP_CRYPTOPRO_TLSEXT_BUG));
+ 
+     /* SSL_OP_* flags for DTLS */
+ #if 0
+
+From e168df0f3570709bfb38e9a39838bd0a7e78164c Mon Sep 17 00:00:00 2001
+From: Kazuki Yamaguchi <k@rhe.jp>
+Date: Sun, 12 Dec 2021 00:47:35 +0900
+Subject: [PATCH 6/8] ssl: update test_options_disable_versions
+
+Use the combination of TLS 1.2 and TLS 1.3 instead of TLS 1.1 and TLS
+1.2 so that will the test case will be run on latest platforms.
+---
+ test/openssl/test_ssl.rb | 75 +++++++++++++++++++++-------------------
+ 1 file changed, 40 insertions(+), 35 deletions(-)
+
+diff --git a/test/openssl/test_ssl.rb b/test/openssl/test_ssl.rb
+index 22691292..2abade06 100644
+--- a/test/openssl/test_ssl.rb
++++ b/test/openssl/test_ssl.rb
+@@ -1180,46 +1180,51 @@ def test_minmax_version
+   end
+ 
+   def test_options_disable_versions
+-    # Note: Use of these OP_* flags has been deprecated since OpenSSL 1.1.0.
++    # It's recommended to use SSLContext#{min,max}_version= instead in real
++    # applications. The purpose of this test case is to check that SSL options
++    # are properly propagated to OpenSSL library.
+     supported = check_supported_protocol_versions
++    if !defined?(OpenSSL::SSL::TLS1_3_VERSION) ||
++        !supported.include?(OpenSSL::SSL::TLS1_2_VERSION) ||
++        !supported.include?(OpenSSL::SSL::TLS1_3_VERSION) ||
++        !defined?(OpenSSL::SSL::OP_NO_TLSv1_3) # LibreSSL < 3.4
++      pend "this test case requires both TLS 1.2 and TLS 1.3 to be supported " \
++        "and enabled by default"
++    end
+ 
+-    if supported.include?(OpenSSL::SSL::TLS1_1_VERSION) &&
+-        supported.include?(OpenSSL::SSL::TLS1_2_VERSION)
+-      # Server disables ~ TLS 1.1
+-      ctx_proc = proc { |ctx|
+-        ctx.options |= OpenSSL::SSL::OP_NO_SSLv2 | OpenSSL::SSL::OP_NO_SSLv3 |
+-          OpenSSL::SSL::OP_NO_TLSv1 | OpenSSL::SSL::OP_NO_TLSv1_1
+-      }
+-      start_server(ctx_proc: ctx_proc, ignore_listener_error: true) { |port|
+-        # Client only supports TLS 1.1
+-        ctx1 = OpenSSL::SSL::SSLContext.new
+-        ctx1.min_version = ctx1.max_version = OpenSSL::SSL::TLS1_1_VERSION
+-        assert_handshake_error { server_connect(port, ctx1) { } }
++    # Server disables TLS 1.2 and earlier
++    ctx_proc = proc { |ctx|
++      ctx.options |= OpenSSL::SSL::OP_NO_SSLv2 | OpenSSL::SSL::OP_NO_SSLv3 |
++        OpenSSL::SSL::OP_NO_TLSv1 | OpenSSL::SSL::OP_NO_TLSv1_1 |
++        OpenSSL::SSL::OP_NO_TLSv1_2
++    }
++    start_server(ctx_proc: ctx_proc, ignore_listener_error: true) { |port|
++      # Client only supports TLS 1.2
++      ctx1 = OpenSSL::SSL::SSLContext.new
++      ctx1.min_version = ctx1.max_version = OpenSSL::SSL::TLS1_2_VERSION
++      assert_handshake_error { server_connect(port, ctx1) { } }
+ 
+-        # Client only supports TLS 1.2
+-        ctx2 = OpenSSL::SSL::SSLContext.new
+-        ctx2.min_version = ctx2.max_version = OpenSSL::SSL::TLS1_2_VERSION
+-        assert_nothing_raised { server_connect(port, ctx2) { } }
+-      }
++      # Client only supports TLS 1.3
++      ctx2 = OpenSSL::SSL::SSLContext.new
++      ctx2.min_version = ctx2.max_version = OpenSSL::SSL::TLS1_3_VERSION
++      assert_nothing_raised { server_connect(port, ctx2) { } }
++    }
+ 
+-      # Server only supports TLS 1.1
+-      ctx_proc = proc { |ctx|
+-        ctx.min_version = ctx.max_version = OpenSSL::SSL::TLS1_1_VERSION
+-      }
+-      start_server(ctx_proc: ctx_proc, ignore_listener_error: true) { |port|
+-        # Client disables TLS 1.1
+-        ctx1 = OpenSSL::SSL::SSLContext.new
+-        ctx1.options |= OpenSSL::SSL::OP_NO_TLSv1_1
+-        assert_handshake_error { server_connect(port, ctx1) { } }
++    # Server only supports TLS 1.2
++    ctx_proc = proc { |ctx|
++      ctx.min_version = ctx.max_version = OpenSSL::SSL::TLS1_2_VERSION
++    }
++    start_server(ctx_proc: ctx_proc, ignore_listener_error: true) { |port|
++      # Client doesn't support TLS 1.2
++      ctx1 = OpenSSL::SSL::SSLContext.new
++      ctx1.options |= OpenSSL::SSL::OP_NO_TLSv1_2
++      assert_handshake_error { server_connect(port, ctx1) { } }
+ 
+-        # Client disables TLS 1.2
+-        ctx2 = OpenSSL::SSL::SSLContext.new
+-        ctx2.options |= OpenSSL::SSL::OP_NO_TLSv1_2
+-        assert_nothing_raised { server_connect(port, ctx2) { } }
+-      }
+-    else
+-      pend "TLS 1.1 and TLS 1.2 must be supported; skipping"
+-    end
++      # Client supports TLS 1.2 by default
++      ctx2 = OpenSSL::SSL::SSLContext.new
++      ctx2.options |= OpenSSL::SSL::OP_NO_TLSv1_3
++      assert_nothing_raised { server_connect(port, ctx2) { } }
++    }
+   end
+ 
+   def test_ssl_methods_constant
+
+From ccdb6f7bfa5f988a07beecedbf2b6205b6ab8492 Mon Sep 17 00:00:00 2001
+From: Kazuki Yamaguchi <k@rhe.jp>
+Date: Sat, 20 Mar 2021 23:16:41 +0900
+Subject: [PATCH 7/8] pkey: assume a pkey always has public key components on
+ OpenSSL 3.0
+
+OpenSSL 3.0's EVP_PKEY_get0() returns NULL for provider-backed pkeys.
+This causes segfault because it was supposed to never return NULL
+before.
+
+We can't check the existence of public key components in this way on
+OpenSSL 3.0. Let's just skip it for now.
+---
+ ext/openssl/ossl_pkey.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/ext/openssl/ossl_pkey.c b/ext/openssl/ossl_pkey.c
+index 94760d32..09d45d85 100644
+--- a/ext/openssl/ossl_pkey.c
++++ b/ext/openssl/ossl_pkey.c
+@@ -428,9 +428,19 @@ ossl_pkey_s_generate_key(int argc, VALUE *argv, VALUE self)
+     return pkey_generate(argc, argv, self, 0);
+ }
+ 
++/*
++ * TODO: There is no convenient way to check the presence of public key
++ * components on OpenSSL 3.0. But since keys are immutable on 3.0, pkeys without
++ * these should only be created by OpenSSL::PKey.generate_parameters or by
++ * parsing DER-/PEM-encoded string. We would need another flag for that.
++ */
+ void
+ ossl_pkey_check_public_key(const EVP_PKEY *pkey)
+ {
++#if OSSL_OPENSSL_PREREQ(3, 0, 0)
++    if (EVP_PKEY_missing_parameters(pkey))
++        ossl_raise(ePKeyError, "parameters missing");
++#else
+     void *ptr;
+     const BIGNUM *n, *e, *pubkey;
+ 
+@@ -466,6 +476,7 @@ ossl_pkey_check_public_key(const EVP_PKEY *pkey)
+ 	return;
+     }
+     ossl_raise(ePKeyError, "public key missing");
++#endif
+ }
+ 
+ EVP_PKEY *
+
+From d6535d13d174cd87ae99f3e60e97f7a00e1474e5 Mon Sep 17 00:00:00 2001
+From: Kazuki Yamaguchi <k@rhe.jp>
+Date: Mon, 12 Apr 2021 10:43:46 +0900
+Subject: [PATCH 8/8] pkey: use EVP_PKEY_CTX_new_from_name() on OpenSSL 3.0
+
+Replace EVP_PKEY_CTX_new_id() with the new EVP_PKEY_CTX_new_from_name()
+which takes the algorithm name in a string instead of in an NID.
+---
+ ext/openssl/ossl_pkey.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/ext/openssl/ossl_pkey.c b/ext/openssl/ossl_pkey.c
+index 09d45d85..2a4835a2 100644
+--- a/ext/openssl/ossl_pkey.c
++++ b/ext/openssl/ossl_pkey.c
+@@ -315,6 +315,11 @@ pkey_generate(int argc, VALUE *argv, VALUE self, int genparam)
+             ossl_raise(ePKeyError, "EVP_PKEY_CTX_new");
+     }
+     else {
++#if OSSL_OPENSSL_PREREQ(3, 0, 0)
++        ctx = EVP_PKEY_CTX_new_from_name(NULL, StringValueCStr(alg), NULL);
++        if (!ctx)
++            ossl_raise(ePKeyError, "EVP_PKEY_CTX_new_from_name");
++#else
+         const EVP_PKEY_ASN1_METHOD *ameth;
+         ENGINE *tmpeng;
+         int pkey_id;
+@@ -333,6 +338,7 @@ pkey_generate(int argc, VALUE *argv, VALUE self, int genparam)
+         ctx = EVP_PKEY_CTX_new_id(pkey_id, NULL/* engine */);
+         if (!ctx)
+             ossl_raise(ePKeyError, "EVP_PKEY_CTX_new_id");
++#endif
+     }
+ 
+     if (genparam && EVP_PKEY_paramgen_init(ctx) <= 0) {

SOURCES/ruby-3.1.0-Miscellaneous-changes-for-OpenSSL-3.0-support.patch

@@ -0,0 +1,304 @@
+From 8f948ed68a4ed6c05ff66d822711e3b70ae4bb3f Mon Sep 17 00:00:00 2001
+From: Kazuki Yamaguchi <k@rhe.jp>
+Date: Mon, 27 Sep 2021 13:32:03 +0900
+Subject: [PATCH 1/5] ext/openssl/ossl.h: add helper macros for
+ OpenSSL/LibreSSL versions
+
+Add following convenient macros:
+
+ - OSSL_IS_LIBRESSL
+ - OSSL_OPENSSL_PREREQ(maj, min, pat)
+ - OSSL_LIBRESSL_PREREQ(maj, min, pat)
+---
+ ext/openssl/ossl.h | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/ext/openssl/ossl.h b/ext/openssl/ossl.h
+index c20f506bda..a0cef29d74 100644
+--- a/ext/openssl/ossl.h
++++ b/ext/openssl/ossl.h
+@@ -42,6 +42,18 @@
+ #include <openssl/evp.h>
+ #include <openssl/dh.h>
+ 
++#ifndef LIBRESSL_VERSION_NUMBER
++# define OSSL_IS_LIBRESSL 0
++# define OSSL_OPENSSL_PREREQ(maj, min, pat) \
++      (OPENSSL_VERSION_NUMBER >= (maj << 28) | (min << 20) | (pat << 12))
++# define OSSL_LIBRESSL_PREREQ(maj, min, pat) 0
++#else
++# define OSSL_IS_LIBRESSL 1
++# define OSSL_OPENSSL_PREREQ(maj, min, pat) 0
++# define OSSL_LIBRESSL_PREREQ(maj, min, pat) \
++      (LIBRESSL_VERSION_NUMBER >= (maj << 28) | (min << 20) | (pat << 12))
++#endif
++
+ /*
+  * Common Module
+  */
+-- 
+2.32.0
+
+
+From bbf235091e49807ece8f3a3df95bbfcc9d3ab43d Mon Sep 17 00:00:00 2001
+From: Kazuki Yamaguchi <k@rhe.jp>
+Date: Sat, 22 Feb 2020 05:37:01 +0900
+Subject: [PATCH 2/5] ts: use TS_VERIFY_CTX_set_certs instead of
+ TS_VERIFY_CTS_set_certs
+
+OpenSSL 3.0 fixed the typo in the function name and replaced the
+current 'CTS' version with a macro.
+---
+ ext/openssl/extconf.rb        | 5 ++++-
+ ext/openssl/openssl_missing.h | 5 +++++
+ ext/openssl/ossl_ts.c         | 2 +-
+ 3 files changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/ext/openssl/extconf.rb b/ext/openssl/extconf.rb
+index 17d93443fc..09cae05b72 100644
+--- a/ext/openssl/extconf.rb
++++ b/ext/openssl/extconf.rb
+@@ -165,7 +165,7 @@ def find_openssl_library
+ have_func("TS_STATUS_INFO_get0_status")
+ have_func("TS_STATUS_INFO_get0_text")
+ have_func("TS_STATUS_INFO_get0_failure_info")
+-have_func("TS_VERIFY_CTS_set_certs")
++have_func("TS_VERIFY_CTS_set_certs(NULL, NULL)", "openssl/ts.h")
+ have_func("TS_VERIFY_CTX_set_store")
+ have_func("TS_VERIFY_CTX_add_flags")
+ have_func("TS_RESP_CTX_set_time_cb")
+@@ -174,6 +174,9 @@ def find_openssl_library
+ 
+ # added in 1.1.1
+ have_func("EVP_PKEY_check")
++ 
++# added in 3.0.0
++have_func("TS_VERIFY_CTX_set_certs(NULL, NULL)", "openssl/ts.h")
+ 
+ Logging::message "=== Checking done. ===\n"
+ 
+diff --git a/ext/openssl/openssl_missing.h b/ext/openssl/openssl_missing.h
+index e575415f49..fe486bcfcf 100644
+--- a/ext/openssl/openssl_missing.h
++++ b/ext/openssl/openssl_missing.h
+@@ -236,4 +236,9 @@ IMPL_PKEY_GETTER(EC_KEY, ec)
+     } while (0)
+ #endif
+ 
++/* added in 3.0.0 */
++#if !defined(HAVE_TS_VERIFY_CTX_SET_CERTS)
++#  define TS_VERIFY_CTX_set_certs(ctx, crts) TS_VERIFY_CTS_set_certs(ctx, crts)
++#endif
++
+ #endif /* _OSSL_OPENSSL_MISSING_H_ */
+diff --git a/ext/openssl/ossl_ts.c b/ext/openssl/ossl_ts.c
+index 692c0d620f..f1da7c1947 100644
+--- a/ext/openssl/ossl_ts.c
++++ b/ext/openssl/ossl_ts.c
+@@ -820,7 +820,7 @@ ossl_ts_resp_verify(int argc, VALUE *argv, VALUE self)
+         X509_up_ref(cert);
+     }
+ 
+-    TS_VERIFY_CTS_set_certs(ctx, x509inter);
++    TS_VERIFY_CTX_set_certs(ctx, x509inter);
+     TS_VERIFY_CTX_add_flags(ctx, TS_VFY_SIGNATURE);
+     TS_VERIFY_CTX_set_store(ctx, x509st);
+ 
+-- 
+2.32.0
+
+
+From 5fba3bc1df93ab6abc3ea53be3393480f36ea259 Mon Sep 17 00:00:00 2001
+From: Kazuki Yamaguchi <k@rhe.jp>
+Date: Fri, 19 Mar 2021 19:18:25 +0900
+Subject: [PATCH 3/5] ssl: use SSL_get_rbio() to check if SSL is started or not
+
+Use SSL_get_rbio() instead of SSL_get_fd(). SSL_get_fd() internally
+calls SSL_get_rbio() and it's enough for our purpose.
+
+In OpenSSL 3.0, SSL_get_fd() leaves an entry in the OpenSSL error queue
+if BIO has not been set up yet, and we would have to clean it up.
+---
+ ext/openssl/ossl_ssl.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/ext/openssl/ossl_ssl.c b/ext/openssl/ossl_ssl.c
+index 4b7efa39f5..ec430bfb0c 100644
+--- a/ext/openssl/ossl_ssl.c
++++ b/ext/openssl/ossl_ssl.c
+@@ -1535,8 +1535,8 @@ ossl_sslctx_flush_sessions(int argc, VALUE *argv, VALUE self)
+ static inline int
+ ssl_started(SSL *ssl)
+ {
+-    /* the FD is set in ossl_ssl_setup(), called by #connect or #accept */
+-    return SSL_get_fd(ssl) >= 0;
++    /* BIO is created through ossl_ssl_setup(), called by #connect or #accept */
++    return SSL_get_rbio(ssl) != NULL;
+ }
+ 
+ static void
+-- 
+2.32.0
+
+From 0a253027e6be47c0b7fd8b664f1048f24d7ca657 Mon Sep 17 00:00:00 2001
+From: Kazuki Yamaguchi <k@rhe.jp>
+Date: Thu, 22 Apr 2021 13:57:47 +0900
+Subject: [PATCH 4/5] digest: use EVP_MD_CTX_get0_md() instead of
+ EVP_MD_CTX_md() if exists
+
+The function was renamed in OpenSSL 3.0 due to the change of the
+lifetime of EVP_MD objects. They are no longer necessarily statically
+allocated and can be reference-counted -- when an EVP_MD_CTX is free'd,
+the associated EVP_MD can also become inaccessible.
+
+Currently Ruby/OpenSSL only handles builtin algorithms, so no special
+handling is needed except for adapting to the rename.
+---
+ ext/openssl/extconf.rb        | 1 +
+ ext/openssl/openssl_missing.h | 4 ++++
+ ext/openssl/ossl_digest.c     | 6 +++---
+ ext/openssl/ossl_hmac.c       | 2 +-
+ 4 files changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/ext/openssl/extconf.rb b/ext/openssl/extconf.rb
+index 98f96afe..842b7f5b 100644
+--- a/ext/openssl/extconf.rb
++++ b/ext/openssl/extconf.rb
+@@ -177,6 +177,7 @@ def find_openssl_library
+  
+ # added in 3.0.0
+ have_func("TS_VERIFY_CTX_set_certs(NULL, NULL)", "openssl/ts.h")
++have_func("EVP_MD_CTX_get0_md")
+ 
+ Logging::message "=== Checking done. ===\n"
+ 
+diff --git a/ext/openssl/openssl_missing.h b/ext/openssl/openssl_missing.h
+index 1b1a54a8..64212349 100644
+--- a/ext/openssl/openssl_missing.h
++++ b/ext/openssl/openssl_missing.h
+@@ -241,4 +241,8 @@ IMPL_PKEY_GETTER(EC_KEY, ec)
+ #  define TS_VERIFY_CTX_set_certs(ctx, crts) TS_VERIFY_CTS_set_certs(ctx, crts)
+ #endif
+ 
++#ifndef HAVE_EVP_MD_CTX_GET0_MD
++#  define EVP_MD_CTX_get0_md(ctx) EVP_MD_CTX_md(ctx)
++#endif
++
+ #endif /* _OSSL_OPENSSL_MISSING_H_ */
+diff --git a/ext/openssl/ossl_digest.c b/ext/openssl/ossl_digest.c
+index b2506de7..fc326ec1 100644
+--- a/ext/openssl/ossl_digest.c
++++ b/ext/openssl/ossl_digest.c
+@@ -63,7 +63,7 @@ ossl_evp_get_digestbyname(VALUE obj)
+ 
+         GetDigest(obj, ctx);
+ 
+-        md = EVP_MD_CTX_md(ctx);
++        md = EVP_MD_CTX_get0_md(ctx);
+     }
+ 
+     return md;
+@@ -176,7 +176,7 @@ ossl_digest_reset(VALUE self)
+     EVP_MD_CTX *ctx;
+ 
+     GetDigest(self, ctx);
+-    if (EVP_DigestInit_ex(ctx, EVP_MD_CTX_md(ctx), NULL) != 1) {
++    if (EVP_DigestInit_ex(ctx, EVP_MD_CTX_get0_md(ctx), NULL) != 1) {
+ 	ossl_raise(eDigestError, "Digest initialization failed.");
+     }
+ 
+@@ -259,7 +259,7 @@ ossl_digest_name(VALUE self)
+ 
+     GetDigest(self, ctx);
+ 
+-    return rb_str_new2(EVP_MD_name(EVP_MD_CTX_md(ctx)));
++    return rb_str_new_cstr(EVP_MD_name(EVP_MD_CTX_get0_md(ctx)));
+ }
+ 
+ /*
+diff --git a/ext/openssl/ossl_hmac.c b/ext/openssl/ossl_hmac.c
+index a21db6c4..2642728b 100644
+--- a/ext/openssl/ossl_hmac.c
++++ b/ext/openssl/ossl_hmac.c
+@@ -239,7 +239,7 @@ ossl_hmac_reset(VALUE self)
+ 
+     GetHMAC(self, ctx);
+     pkey = EVP_PKEY_CTX_get0_pkey(EVP_MD_CTX_pkey_ctx(ctx));
+-    if (EVP_DigestSignInit(ctx, NULL, EVP_MD_CTX_md(ctx), NULL, pkey) != 1)
++    if (EVP_DigestSignInit(ctx, NULL, EVP_MD_CTX_get0_md(ctx), NULL, pkey) != 1)
+         ossl_raise(eHMACError, "EVP_DigestSignInit");
+ 
+     return self;
+
+From c106d888c62e44a11cdbba5e4d2d0cb837ec3e52 Mon Sep 17 00:00:00 2001
+From: Kazuki Yamaguchi <k@rhe.jp>
+Date: Tue, 22 Jun 2021 18:50:17 +0900
+Subject: [PATCH 5/5] hmac: use EVP_MD_CTX_get_pkey_ctx() instead of
+ EVP_MD_CTX_pkey_ctx()
+
+OpenSSL 3.0 renamed EVP_MD_CTX_pkey_ctx() to include "get" in the
+function name. Adjust compatibility macro so that we can use the new
+function name for all OpenSSL 1.0.2-3.0.
+---
+ ext/openssl/extconf.rb        |  1 +
+ ext/openssl/openssl_missing.h | 16 ++++++++++++----
+ ext/openssl/ossl_hmac.c       |  2 +-
+ 3 files changed, 14 insertions(+), 5 deletions(-)
+
+diff --git a/ext/openssl/extconf.rb b/ext/openssl/extconf.rb
+index 842b7f5b..d9d34b7c 100644
+--- a/ext/openssl/extconf.rb
++++ b/ext/openssl/extconf.rb
+@@ -178,6 +178,7 @@ def find_openssl_library
+ # added in 3.0.0
+ have_func("TS_VERIFY_CTX_set_certs(NULL, NULL)", "openssl/ts.h")
+ have_func("EVP_MD_CTX_get0_md")
++have_func("EVP_MD_CTX_get_pkey_ctx")
+ 
+ Logging::message "=== Checking done. ===\n"
+ 
+diff --git a/ext/openssl/openssl_missing.h b/ext/openssl/openssl_missing.h
+index 64212349..55c4f378 100644
+--- a/ext/openssl/openssl_missing.h
++++ b/ext/openssl/openssl_missing.h
+@@ -42,10 +42,6 @@ int ossl_EC_curve_nist2nid(const char *);
+ #  define EVP_MD_CTX_free EVP_MD_CTX_destroy
+ #endif
+ 
+-#if !defined(HAVE_EVP_MD_CTX_PKEY_CTX)
+-#  define EVP_MD_CTX_pkey_ctx(x) (x)->pctx
+-#endif
+-
+ #if !defined(HAVE_X509_STORE_GET_EX_DATA)
+ #  define X509_STORE_get_ex_data(x, idx) \
+ 	CRYPTO_get_ex_data(&(x)->ex_data, (idx))
+@@ -245,4 +241,16 @@ IMPL_PKEY_GETTER(EC_KEY, ec)
+ #  define EVP_MD_CTX_get0_md(ctx) EVP_MD_CTX_md(ctx)
+ #endif
+ 
++/*
++ * OpenSSL 1.1.0 added EVP_MD_CTX_pkey_ctx(), and then it was renamed to
++ * EVP_MD_CTX_get_pkey_ctx(x) in OpenSSL 3.0.
++ */
++#ifndef HAVE_EVP_MD_CTX_GET_PKEY_CTX
++# ifdef HAVE_EVP_MD_CTX_PKEY_CTX
++#  define EVP_MD_CTX_get_pkey_ctx(x) EVP_MD_CTX_pkey_ctx(x)
++# else
++#  define EVP_MD_CTX_get_pkey_ctx(x) (x)->pctx
++# endif
++#endif
++
+ #endif /* _OSSL_OPENSSL_MISSING_H_ */
+diff --git a/ext/openssl/ossl_hmac.c b/ext/openssl/ossl_hmac.c
+index 2642728b..f89ff2f9 100644
+--- a/ext/openssl/ossl_hmac.c
++++ b/ext/openssl/ossl_hmac.c
+@@ -238,7 +238,7 @@ ossl_hmac_reset(VALUE self)
+     EVP_PKEY *pkey;
+ 
+     GetHMAC(self, ctx);
+-    pkey = EVP_PKEY_CTX_get0_pkey(EVP_MD_CTX_pkey_ctx(ctx));
++    pkey = EVP_PKEY_CTX_get0_pkey(EVP_MD_CTX_get_pkey_ctx(ctx));
+     if (EVP_DigestSignInit(ctx, NULL, EVP_MD_CTX_get0_md(ctx), NULL, pkey) != 1)
+         ossl_raise(eHMACError, "EVP_DigestSignInit");
+ 

SOURCES/ruby-3.1.0-Properly-exclude-test-cases.patch

@@ -0,0 +1,93 @@
+From 96684439e96aa92e10376b5be45f006772028295 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?V=C3=ADt=20Ondruch?= <vondruch@redhat.com>
+Date: Thu, 21 Oct 2021 13:02:38 +0200
+Subject: [PATCH] Properly exclude test cases.
+
+Lets consider the following scenario:
+
+~~~
+irb(#<Test::Unit::AutoRunner::Runner:0x0000560f68afc3c8>):001:0> p suite
+OpenSSL::TestEC
+=> OpenSSL::TestEC
+
+irb(#<Test::Unit::AutoRunner::Runner:0x0000560f68afc3c8>):002:0> p all_test_methods
+["test_ECPrivateKey", "test_ECPrivateKey_encrypted", "test_PUBKEY", "test_check_key", "test_derive_key", "test_dh_compute_key", "test_dsa_sign_asn1_FIPS186_3", "test_ec_group", "test_ec_key", "test_ec_point", "test_ec_point_add", "test_ec_point_mul", "test_generate", "test_marshal", "test_sign_verify", "test_sign_verify_raw"]
+=>
+["test_ECPrivateKey",
+ "test_ECPrivateKey_encrypted",
+ "test_PUBKEY",
+ "test_check_key",
+ "test_derive_key",
+ "test_dh_compute_key",
+ "test_dsa_sign_asn1_FIPS186_3",
+ "test_ec_group",
+ "test_ec_key",
+ "test_ec_point",
+ "test_ec_point_add",
+ "test_ec_point_mul",
+ "test_generate",
+ "test_marshal",
+ "test_sign_verify",
+ "test_sign_verify_raw"]
+
+irb(#<Test::Unit::AutoRunner::Runner:0x0000560f68afc3c8>):003:0> p filter
+/\A(?=.*)(?!.*(?-mix:(?-mix:memory_leak)|(?-mix:OpenSSL::TestEC.test_check_key)))/
+=> /\A(?=.*)(?!.*(?-mix:(?-mix:memory_leak)|(?-mix:OpenSSL::TestEC.test_check_key)))/
+
+irb(#<Test::Unit::AutoRunner::Runner:0x0000560f68afc3c8>):004:0> method = "test_check_key"
+=> "test_check_key"
+~~~
+
+The intention here is to exclude the `test_check_key` test case.
+Unfortunately this does not work as expected, because the negative filter
+is never checked:
+
+~~~
+
+irb(#<Test::Unit::AutoRunner::Runner:0x0000560f68afc3c8>):005:0> filter === method
+=> true
+
+irb(#<Test::Unit::AutoRunner::Runner:0x0000560f68afc3c8>):006:0> filter === "#{suite}##{method}"
+=> false
+
+irb(#<Test::Unit::AutoRunner::Runner:0x0000560f68afc3c8>):007:0> filter === method || filter === "#{suite}##{method}"
+=> true
+~~~
+
+Therefore always filter against the fully qualified method name
+`#{suite}##{method}`, which should provide the expected result.
+
+However, if plain string filter is used, keep checking also only the
+method name.
+
+This resolves [Bug #16936].
+---
+ tool/lib/minitest/unit.rb | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/tool/lib/minitest/unit.rb b/tool/lib/minitest/unit.rb
+index c58a609bfa..d5af6cb906 100644
+--- a/tool/lib/minitest/unit.rb
++++ b/tool/lib/minitest/unit.rb
+@@ -956,9 +956,15 @@ def _run_suite suite, type
+ 
+       all_test_methods = suite.send "#{type}_methods"
+ 
+-      filtered_test_methods = all_test_methods.find_all { |m|
+-        filter === m || filter === "#{suite}##{m}"
+-      }
++      filtered_test_methods = if Regexp === filter
++        all_test_methods.find_all { |m|
++          filter === "#{suite}##{m}"
++        }
++      else
++        all_test_methods.find_all {|m|
++          filter === m || filter === "#{suite}##{m}"
++        }
++      end
+ 
+       leakchecker = LeakChecker.new
+ 
+-- 
+2.32.0
+

SOURCES/ruby-3.1.0-Support-GCCs-DWARF-5.patch

@@ -0,0 +1,229 @@
+From 3b91792d3d644d6d6b0059cb315c9fe5d3626bab Mon Sep 17 00:00:00 2001
+From: Yusuke Endoh <mame@ruby-lang.org>
+Date: Sat, 6 Mar 2021 00:03:57 +0900
+Subject: [PATCH] Support GCC's DWARF 5 [Bug #17585]
+
+Co-Authored-By: xtkoba (Tee KOBAYASHI) <xtkoba+ruby@gmail.com>
+---
+ addr2line.c | 119 ++++++++++++++++++++++++++++++++++++++++++----------
+ 1 file changed, 97 insertions(+), 22 deletions(-)
+
+diff --git a/addr2line.c b/addr2line.c
+index 0029cffbca..855efb40d4 100644
+--- a/addr2line.c
++++ b/addr2line.c
+@@ -159,11 +159,12 @@ typedef struct obj_info {
+     struct dwarf_section debug_info;
+     struct dwarf_section debug_line;
+     struct dwarf_section debug_ranges;
++    struct dwarf_section debug_rnglists;
+     struct dwarf_section debug_str;
+     struct obj_info *next;
+ } obj_info_t;
+ 
+-#define DWARF_SECTION_COUNT 5
++#define DWARF_SECTION_COUNT 6
+ 
+ static struct dwarf_section *
+ obj_dwarf_section_at(obj_info_t *obj, int n)
+@@ -173,6 +174,7 @@ obj_dwarf_section_at(obj_info_t *obj, int n)
+         &obj->debug_info,
+         &obj->debug_line,
+         &obj->debug_ranges,
++        &obj->debug_rnglists,
+         &obj->debug_str
+     };
+     if (n < 0 || DWARF_SECTION_COUNT <= n) {
+@@ -411,7 +413,7 @@ parse_debug_line_cu(int num_traces, void **traces, char **debug_line,
+ 	    FILL_LINE();
+ 	    break;
+ 	case DW_LNS_advance_pc:
+-	    a = uleb128((char **)&p);
++	    a = uleb128((char **)&p) * header.minimum_instruction_length;
+ 	    addr += a;
+ 	    break;
+ 	case DW_LNS_advance_line: {
+@@ -451,7 +453,7 @@ parse_debug_line_cu(int num_traces, void **traces, char **debug_line,
+ 	    /* isa = (unsigned int)*/(void)uleb128((char **)&p);
+ 	    break;
+ 	case 0:
+-	    a = *(unsigned char *)p++;
++	    a = uleb128((char **)&p);
+ 	    op = *p++;
+ 	    switch (op) {
+ 	    case DW_LNE_end_sequence:
+@@ -808,6 +810,18 @@ enum
+     DW_FORM_addrx4 = 0x2c
+ };
+ 
++/* Range list entry encodings */
++enum {
++    DW_RLE_end_of_list = 0x00,
++    DW_RLE_base_addressx = 0x01,
++    DW_RLE_startx_endx = 0x02,
++    DW_RLE_startx_length = 0x03,
++    DW_RLE_offset_pair = 0x04,
++    DW_RLE_base_address = 0x05,
++    DW_RLE_start_end = 0x06,
++    DW_RLE_start_length = 0x07
++};
++
+ enum {
+     VAL_none = 0,
+     VAL_cstr = 1,
+@@ -961,6 +975,23 @@ debug_info_reader_init(DebugInfoReader *reader, obj_info_t *obj)
+     reader->current_low_pc = 0;
+ }
+ 
++static void
++di_skip_die_attributes(char **p)
++{
++    for (;;) {
++        uint64_t at = uleb128(p);
++        uint64_t form = uleb128(p);
++        if (!at && !form) break;
++        switch (form) {
++          default:
++            break;
++          case DW_FORM_implicit_const:
++            sleb128(p);
++            break;
++        }
++    }
++}
++
+ static void
+ di_read_debug_abbrev_cu(DebugInfoReader *reader)
+ {
+@@ -975,12 +1006,7 @@ di_read_debug_abbrev_cu(DebugInfoReader *reader)
+         prev = abbrev_number;
+         uleb128(&p); /* tag */
+         p++; /* has_children */
+-        /* skip content */
+-        for (;;) {
+-            uint64_t at = uleb128(&p);
+-            uint64_t form = uleb128(&p);
+-            if (!at && !form) break;
+-        }
++        di_skip_die_attributes(&p);
+     }
+ }
+ 
+@@ -1244,12 +1270,7 @@ di_find_abbrev(DebugInfoReader *reader, uint64_t abbrev_number)
+     /* skip 255th record */
+     uleb128(&p); /* tag */
+     p++; /* has_children */
+-    /* skip content */
+-    for (;;) {
+-        uint64_t at = uleb128(&p);
+-        uint64_t form = uleb128(&p);
+-        if (!at && !form) break;
+-    }
++    di_skip_die_attributes(&p);
+     for (uint64_t n = uleb128(&p); abbrev_number != n; n = uleb128(&p)) {
+         if (n == 0) {
+             fprintf(stderr,"%d: Abbrev Number %"PRId64" not found\n",__LINE__, abbrev_number);
+@@ -1257,12 +1278,7 @@ di_find_abbrev(DebugInfoReader *reader, uint64_t abbrev_number)
+         }
+         uleb128(&p); /* tag */
+         p++; /* has_children */
+-        /* skip content */
+-        for (;;) {
+-            uint64_t at = uleb128(&p);
+-            uint64_t form = uleb128(&p);
+-            if (!at && !form) break;
+-        }
++        di_skip_die_attributes(&p);
+     }
+     return p;
+ }
+@@ -1390,6 +1406,21 @@ ranges_set(ranges_t *ptr, DebugInfoValue *v)
+     }
+ }
+ 
++static uint64_t
++read_dw_form_addr(DebugInfoReader *reader, char **ptr)
++{
++    char *p = *ptr;
++    *ptr = p + reader->format;
++    if (reader->format == 4) {
++        return read_uint32(&p);
++    } else if (reader->format == 8) {
++        return read_uint64(&p);
++    } else {
++        fprintf(stderr,"unknown address_size:%d", reader->address_size);
++        abort();
++    }
++}
++
+ static uintptr_t
+ ranges_include(DebugInfoReader *reader, ranges_t *ptr, uint64_t addr)
+ {
+@@ -1403,8 +1434,50 @@ ranges_include(DebugInfoReader *reader, ranges_t *ptr, uint64_t addr)
+     }
+     else if (ptr->ranges_set) {
+         /* TODO: support base address selection entry */
+-        char *p = reader->obj->debug_ranges.ptr + ptr->ranges;
++        char *p;
+         uint64_t base = ptr->low_pc_set ? ptr->low_pc : reader->current_low_pc;
++        if (reader->obj->debug_rnglists.ptr) {
++            p = reader->obj->debug_rnglists.ptr + ptr->ranges;
++            for (;;) {
++                uint8_t rle = read_uint8(&p);
++                uintptr_t base_address = 0;
++                uintptr_t from, to;
++                if (rle == DW_RLE_end_of_list) break;
++                switch (rle) {
++                  case DW_RLE_base_addressx:
++                    uleb128(&p);
++                    break;
++                  case DW_RLE_startx_endx:
++                    uleb128(&p);
++                    uleb128(&p);
++                    break;
++                  case DW_RLE_startx_length:
++                    uleb128(&p);
++                    uleb128(&p);
++                    break;
++                  case DW_RLE_offset_pair:
++                    from = base_address + uleb128(&p);
++                    to = base_address + uleb128(&p);
++                    if (base + from <= addr && addr < base + to) {
++                        return from;
++                    }
++                    break;
++                  case DW_RLE_base_address:
++                    base_address = read_dw_form_addr(reader, &p);
++                    break;
++                  case DW_RLE_start_end:
++                    read_dw_form_addr(reader, &p);
++                    read_dw_form_addr(reader, &p);
++                    break;
++                  case DW_RLE_start_length:
++                    read_dw_form_addr(reader, &p);
++                    uleb128(&p);
++                    break;
++                }
++            }
++            return false;
++        }
++        p = reader->obj->debug_ranges.ptr + ptr->ranges;
+         for (;;) {
+             uintptr_t from = read_uintptr(&p);
+             uintptr_t to = read_uintptr(&p);
+@@ -1750,6 +1823,7 @@ fill_lines(int num_traces, void **traces, int check_debuglink,
+                     ".debug_info",
+                     ".debug_line",
+                     ".debug_ranges",
++                    ".debug_rnglists",
+                     ".debug_str"
+                 };
+ 
+@@ -2006,6 +2080,7 @@ found_mach_header:
+                     "__debug_info",
+                     "__debug_line",
+                     "__debug_ranges",
++                    "__debug_rnglists",
+                     "__debug_str"
+                 };
+                 struct LP(segment_command) *scmd = (struct LP(segment_command) *)lcmd;

SOURCES/ruby-3.1.0-Use-EVP-API-in-more-places.patch

@@ -0,0 +1,831 @@
+From cf070378020088cd7e69b1cb08be68152ab8a078 Mon Sep 17 00:00:00 2001
+From: Kazuki Yamaguchi <k@rhe.jp>
+Date: Sun, 17 May 2020 18:25:38 +0900
+Subject: [PATCH 1/3] pkey: implement #to_text using EVP API
+
+Use EVP_PKEY_print_private() instead of the low-level API *_print()
+functions, such as RSA_print().
+
+EVP_PKEY_print_*() family was added in OpenSSL 1.0.0.
+
+Note that it falls back to EVP_PKEY_print_public() and
+EVP_PKEY_print_params() as necessary. This is required for EVP_PKEY_DH
+type for which _private() fails if the private component is not set in
+the pkey object.
+
+Since the new API works in the same way for all key types, we now
+implement #to_text in the base class OpenSSL::PKey::PKey rather than in
+each subclass.
+---
+ ext/openssl/ossl_pkey.c     | 38 +++++++++++++++++++++++++++++++++++++
+ ext/openssl/ossl_pkey_dh.c  | 29 ----------------------------
+ ext/openssl/ossl_pkey_dsa.c | 29 ----------------------------
+ ext/openssl/ossl_pkey_ec.c  | 27 --------------------------
+ ext/openssl/ossl_pkey_rsa.c | 31 ------------------------------
+ test/openssl/test_pkey.rb   |  5 +++++
+ 6 files changed, 43 insertions(+), 116 deletions(-)
+
+diff --git a/ext/openssl/ossl_pkey.c b/ext/openssl/ossl_pkey.c
+index f9282b9417..21cd4b2cda 100644
+--- a/ext/openssl/ossl_pkey.c
++++ b/ext/openssl/ossl_pkey.c
+@@ -539,6 +539,43 @@ ossl_pkey_inspect(VALUE self)
+                       OBJ_nid2sn(nid));
+ }
+ 
++/*
++ * call-seq:
++ *    pkey.to_text -> string
++ *
++ * Dumps key parameters, public key, and private key components contained in
++ * the key into a human-readable text.
++ *
++ * This is intended for debugging purpose.
++ *
++ * See also the man page EVP_PKEY_print_private(3).
++ */
++static VALUE
++ossl_pkey_to_text(VALUE self)
++{
++    EVP_PKEY *pkey;
++    BIO *bio;
++
++    GetPKey(self, pkey);
++    if (!(bio = BIO_new(BIO_s_mem())))
++        ossl_raise(ePKeyError, "BIO_new");
++
++    if (EVP_PKEY_print_private(bio, pkey, 0, NULL) == 1)
++        goto out;
++    OSSL_BIO_reset(bio);
++    if (EVP_PKEY_print_public(bio, pkey, 0, NULL) == 1)
++        goto out;
++    OSSL_BIO_reset(bio);
++    if (EVP_PKEY_print_params(bio, pkey, 0, NULL) == 1)
++        goto out;
++
++    BIO_free(bio);
++    ossl_raise(ePKeyError, "EVP_PKEY_print_params");
++
++  out:
++    return ossl_membio2str(bio);
++}
++
+ VALUE
+ ossl_pkey_export_traditional(int argc, VALUE *argv, VALUE self, int to_der)
+ {
+@@ -1039,6 +1076,7 @@ Init_ossl_pkey(void)
+     rb_define_method(cPKey, "initialize", ossl_pkey_initialize, 0);
+     rb_define_method(cPKey, "oid", ossl_pkey_oid, 0);
+     rb_define_method(cPKey, "inspect", ossl_pkey_inspect, 0);
++    rb_define_method(cPKey, "to_text", ossl_pkey_to_text, 0);
+     rb_define_method(cPKey, "private_to_der", ossl_pkey_private_to_der, -1);
+     rb_define_method(cPKey, "private_to_pem", ossl_pkey_private_to_pem, -1);
+     rb_define_method(cPKey, "public_to_der", ossl_pkey_public_to_der, 0);
+diff --git a/ext/openssl/ossl_pkey_dh.c b/ext/openssl/ossl_pkey_dh.c
+index 6b477b077c..acd3bf474e 100644
+--- a/ext/openssl/ossl_pkey_dh.c
++++ b/ext/openssl/ossl_pkey_dh.c
+@@ -266,34 +266,6 @@ ossl_dh_get_params(VALUE self)
+     return hash;
+ }
+ 
+-/*
+- *  call-seq:
+- *     dh.to_text -> aString
+- *
+- * Prints all parameters of key to buffer
+- * INSECURE: PRIVATE INFORMATIONS CAN LEAK OUT!!!
+- * Don't use :-)) (I's up to you)
+- */
+-static VALUE
+-ossl_dh_to_text(VALUE self)
+-{
+-    DH *dh;
+-    BIO *out;
+-    VALUE str;
+-
+-    GetDH(self, dh);
+-    if (!(out = BIO_new(BIO_s_mem()))) {
+-	ossl_raise(eDHError, NULL);
+-    }
+-    if (!DHparams_print(out, dh)) {
+-	BIO_free(out);
+-	ossl_raise(eDHError, NULL);
+-    }
+-    str = ossl_membio2str(out);
+-
+-    return str;
+-}
+-
+ /*
+  *  call-seq:
+  *     dh.public_key -> aDH
+@@ -426,7 +398,6 @@ Init_ossl_dh(void)
+     rb_define_method(cDH, "initialize_copy", ossl_dh_initialize_copy, 1);
+     rb_define_method(cDH, "public?", ossl_dh_is_public, 0);
+     rb_define_method(cDH, "private?", ossl_dh_is_private, 0);
+-    rb_define_method(cDH, "to_text", ossl_dh_to_text, 0);
+     rb_define_method(cDH, "export", ossl_dh_export, 0);
+     rb_define_alias(cDH, "to_pem", "export");
+     rb_define_alias(cDH, "to_s", "export");
+diff --git a/ext/openssl/ossl_pkey_dsa.c b/ext/openssl/ossl_pkey_dsa.c
+index 1c5a8a737e..f017cceb4a 100644
+--- a/ext/openssl/ossl_pkey_dsa.c
++++ b/ext/openssl/ossl_pkey_dsa.c
+@@ -264,34 +264,6 @@ ossl_dsa_get_params(VALUE self)
+     return hash;
+ }
+ 
+-/*
+- *  call-seq:
+- *    dsa.to_text -> aString
+- *
+- * Prints all parameters of key to buffer
+- * INSECURE: PRIVATE INFORMATIONS CAN LEAK OUT!!!
+- * Don't use :-)) (I's up to you)
+- */
+-static VALUE
+-ossl_dsa_to_text(VALUE self)
+-{
+-    DSA *dsa;
+-    BIO *out;
+-    VALUE str;
+-
+-    GetDSA(self, dsa);
+-    if (!(out = BIO_new(BIO_s_mem()))) {
+-	ossl_raise(eDSAError, NULL);
+-    }
+-    if (!DSA_print(out, dsa, 0)) { /* offset = 0 */
+-	BIO_free(out);
+-	ossl_raise(eDSAError, NULL);
+-    }
+-    str = ossl_membio2str(out);
+-
+-    return str;
+-}
+-
+ /*
+  *  call-seq:
+  *    dsa.public_key -> aDSA
+@@ -469,7 +441,6 @@ Init_ossl_dsa(void)
+ 
+     rb_define_method(cDSA, "public?", ossl_dsa_is_public, 0);
+     rb_define_method(cDSA, "private?", ossl_dsa_is_private, 0);
+-    rb_define_method(cDSA, "to_text", ossl_dsa_to_text, 0);
+     rb_define_method(cDSA, "export", ossl_dsa_export, -1);
+     rb_define_alias(cDSA, "to_pem", "export");
+     rb_define_alias(cDSA, "to_s", "export");
+diff --git a/ext/openssl/ossl_pkey_ec.c b/ext/openssl/ossl_pkey_ec.c
+index c2534251c3..ecb8305184 100644
+--- a/ext/openssl/ossl_pkey_ec.c
++++ b/ext/openssl/ossl_pkey_ec.c
+@@ -417,32 +417,6 @@ ossl_ec_key_to_der(VALUE self)
+     else
+         return ossl_pkey_export_spki(self, 1);
+ }
+-
+-/*
+- *  call-seq:
+- *     key.to_text   => String
+- *
+- *  See the OpenSSL documentation for EC_KEY_print()
+- */
+-static VALUE ossl_ec_key_to_text(VALUE self)
+-{
+-    EC_KEY *ec;
+-    BIO *out;
+-    VALUE str;
+-
+-    GetEC(self, ec);
+-    if (!(out = BIO_new(BIO_s_mem()))) {
+-	ossl_raise(eECError, "BIO_new(BIO_s_mem())");
+-    }
+-    if (!EC_KEY_print(out, ec, 0)) {
+-	BIO_free(out);
+-	ossl_raise(eECError, "EC_KEY_print");
+-    }
+-    str = ossl_membio2str(out);
+-
+-    return str;
+-}
+-
+ /*
+  *  call-seq:
+  *     key.generate_key!   => self
+@@ -1633,7 +1607,6 @@ void Init_ossl_ec(void)
+     rb_define_method(cEC, "export", ossl_ec_key_export, -1);
+     rb_define_alias(cEC, "to_pem", "export");
+     rb_define_method(cEC, "to_der", ossl_ec_key_to_der, 0);
+-    rb_define_method(cEC, "to_text", ossl_ec_key_to_text, 0);
+ 
+ 
+     rb_define_alloc_func(cEC_GROUP, ossl_ec_group_alloc);
+diff --git a/ext/openssl/ossl_pkey_rsa.c b/ext/openssl/ossl_pkey_rsa.c
+index 43f82cb29e..7a7e66dbda 100644
+--- a/ext/openssl/ossl_pkey_rsa.c
++++ b/ext/openssl/ossl_pkey_rsa.c
+@@ -587,36 +587,6 @@ ossl_rsa_get_params(VALUE self)
+     return hash;
+ }
+ 
+-/*
+- * call-seq:
+- *   rsa.to_text => String
+- *
+- * THIS METHOD IS INSECURE, PRIVATE INFORMATION CAN LEAK OUT!!!
+- *
+- * Dumps all parameters of a keypair to a String
+- *
+- * Don't use :-)) (It's up to you)
+- */
+-static VALUE
+-ossl_rsa_to_text(VALUE self)
+-{
+-    RSA *rsa;
+-    BIO *out;
+-    VALUE str;
+-
+-    GetRSA(self, rsa);
+-    if (!(out = BIO_new(BIO_s_mem()))) {
+-	ossl_raise(eRSAError, NULL);
+-    }
+-    if (!RSA_print(out, rsa, 0)) { /* offset = 0 */
+-	BIO_free(out);
+-	ossl_raise(eRSAError, NULL);
+-    }
+-    str = ossl_membio2str(out);
+-
+-    return str;
+-}
+-
+ /*
+  * call-seq:
+  *    rsa.public_key -> RSA
+@@ -738,7 +708,6 @@ Init_ossl_rsa(void)
+ 
+     rb_define_method(cRSA, "public?", ossl_rsa_is_public, 0);
+     rb_define_method(cRSA, "private?", ossl_rsa_is_private, 0);
+-    rb_define_method(cRSA, "to_text", ossl_rsa_to_text, 0);
+     rb_define_method(cRSA, "export", ossl_rsa_export, -1);
+     rb_define_alias(cRSA, "to_pem", "export");
+     rb_define_alias(cRSA, "to_s", "export");
+diff --git a/test/openssl/test_pkey.rb b/test/openssl/test_pkey.rb
+index 5307fe5b08..3630458b3c 100644
+--- a/test/openssl/test_pkey.rb
++++ b/test/openssl/test_pkey.rb
+@@ -151,4 +151,9 @@ def test_x25519
+     assert_equal bob_pem, bob.public_to_pem
+     assert_equal [shared_secret].pack("H*"), alice.derive(bob)
+   end
++
++  def test_to_text
++    rsa = Fixtures.pkey("rsa1024")
++    assert_include rsa.to_text, "publicExponent"
++  end
+ end
+-- 
+2.32.0
+
+
+From 0c45b22e485bfa62f4d704b08e3704e6444118c4 Mon Sep 17 00:00:00 2001
+From: Kazuki Yamaguchi <k@rhe.jp>
+Date: Thu, 15 Apr 2021 19:11:32 +0900
+Subject: [PATCH 2/3] pkey: implement {DH,DSA,RSA}#public_key in Ruby
+
+The low-level API that is used to implement #public_key is deprecated
+in OpenSSL 3.0. It is actually very simple to implement in another way,
+using existing methods only, in much shorter code. Let's do it.
+
+While we are at it, the documentation is updated to recommend against
+using #public_key. Now that OpenSSL::PKey::PKey implements public_to_der
+method, there is no real use case for #public_key in newly written Ruby
+programs.
+---
+ ext/openssl/lib/openssl/pkey.rb | 55 ++++++++++++++++++++++++++++
+ ext/openssl/ossl_pkey_dh.c      | 63 +++++++--------------------------
+ ext/openssl/ossl_pkey_dsa.c     | 42 ----------------------
+ ext/openssl/ossl_pkey_rsa.c     | 58 +-----------------------------
+ test/openssl/test_pkey_rsa.rb   | 37 ++++++++++---------
+ 5 files changed, 87 insertions(+), 168 deletions(-)
+
+diff --git a/ext/openssl/lib/openssl/pkey.rb b/ext/openssl/lib/openssl/pkey.rb
+index 53ee52f98b..569559e1ce 100644
+--- a/ext/openssl/lib/openssl/pkey.rb
++++ b/ext/openssl/lib/openssl/pkey.rb
+@@ -10,6 +10,30 @@ module OpenSSL::PKey
+   class DH
+     include OpenSSL::Marshal
+ 
++    # :call-seq:
++    #    dh.public_key -> dhnew
++    #
++    # Returns a new DH instance that carries just the \DH parameters.
++    #
++    # Contrary to the method name, the returned DH object contains only
++    # parameters and not the public key.
++    #
++    # This method is provided for backwards compatibility. In most cases, there
++    # is no need to call this method.
++    #
++    # For the purpose of re-generating the key pair while keeping the
++    # parameters, check OpenSSL::PKey.generate_key.
++    #
++    # Example:
++    #   # OpenSSL::PKey::DH.generate by default generates a random key pair
++    #   dh1 = OpenSSL::PKey::DH.generate(2048)
++    #   p dh1.priv_key #=> #<OpenSSL::BN 1288347...>
++    #   dhcopy = dh1.public_key
++    #   p dhcopy.priv_key #=> nil
++    def public_key
++      DH.new(to_der)
++    end
++
+     # :call-seq:
+     #    dh.compute_key(pub_bn) -> string
+     #
+@@ -89,6 +113,22 @@ def new(*args, &blk) # :nodoc:
+   class DSA
+     include OpenSSL::Marshal
+ 
++    # :call-seq:
++    #    dsa.public_key -> dsanew
++    #
++    # Returns a new DSA instance that carries just the \DSA parameters and the
++    # public key.
++    #
++    # This method is provided for backwards compatibility. In most cases, there
++    # is no need to call this method.
++    #
++    # For the purpose of serializing the public key, to PEM or DER encoding of
++    # X.509 SubjectPublicKeyInfo format, check PKey#public_to_pem and
++    # PKey#public_to_der.
++    def public_key
++      OpenSSL::PKey.read(public_to_der)
++    end
++
+     class << self
+       # :call-seq:
+       #    DSA.generate(size) -> dsa
+@@ -159,6 +199,21 @@ def to_bn(conversion_form = group.point_conversion_form)
+   class RSA
+     include OpenSSL::Marshal
+ 
++    # :call-seq:
++    #    rsa.public_key -> rsanew
++    #
++    # Returns a new RSA instance that carries just the public key components.
++    #
++    # This method is provided for backwards compatibility. In most cases, there
++    # is no need to call this method.
++    #
++    # For the purpose of serializing the public key, to PEM or DER encoding of
++    # X.509 SubjectPublicKeyInfo format, check PKey#public_to_pem and
++    # PKey#public_to_der.
++    def public_key
++      OpenSSL::PKey.read(public_to_der)
++    end
++
+     class << self
+       # :call-seq:
+       #    RSA.generate(size, exponent = 65537) -> RSA
+diff --git a/ext/openssl/ossl_pkey_dh.c b/ext/openssl/ossl_pkey_dh.c
+index acd3bf474e..a512b209d3 100644
+--- a/ext/openssl/ossl_pkey_dh.c
++++ b/ext/openssl/ossl_pkey_dh.c
+@@ -266,48 +266,6 @@ ossl_dh_get_params(VALUE self)
+     return hash;
+ }
+ 
+-/*
+- *  call-seq:
+- *     dh.public_key -> aDH
+- *
+- * Returns a new DH instance that carries just the public information, i.e.
+- * the prime _p_ and the generator _g_, but no public/private key yet. Such
+- * a pair may be generated using DH#generate_key!. The "public key" needed
+- * for a key exchange with DH#compute_key is considered as per-session
+- * information and may be retrieved with DH#pub_key once a key pair has
+- * been generated.
+- * If the current instance already contains private information (and thus a
+- * valid public/private key pair), this information will no longer be present
+- * in the new instance generated by DH#public_key. This feature is helpful for
+- * publishing the Diffie-Hellman parameters without leaking any of the private
+- * per-session information.
+- *
+- * === Example
+- *  dh = OpenSSL::PKey::DH.new(2048) # has public and private key set
+- *  public_key = dh.public_key # contains only prime and generator
+- *  parameters = public_key.to_der # it's safe to publish this
+- */
+-static VALUE
+-ossl_dh_to_public_key(VALUE self)
+-{
+-    EVP_PKEY *pkey;
+-    DH *orig_dh, *dh;
+-    VALUE obj;
+-
+-    obj = rb_obj_alloc(rb_obj_class(self));
+-    GetPKey(obj, pkey);
+-
+-    GetDH(self, orig_dh);
+-    dh = DHparams_dup(orig_dh);
+-    if (!dh)
+-        ossl_raise(eDHError, "DHparams_dup");
+-    if (!EVP_PKEY_assign_DH(pkey, dh)) {
+-        DH_free(dh);
+-        ossl_raise(eDHError, "EVP_PKEY_assign_DH");
+-    }
+-    return obj;
+-}
+-
+ /*
+  *  call-seq:
+  *     dh.params_ok? -> true | false
+@@ -384,14 +342,20 @@ Init_ossl_dh(void)
+      *   The per-session private key, an OpenSSL::BN.
+      *
+      * === Example of a key exchange
+-     *  dh1 = OpenSSL::PKey::DH.new(2048)
+-     *  der = dh1.public_key.to_der #you may send this publicly to the participating party
+-     *  dh2 = OpenSSL::PKey::DH.new(der)
+-     *  dh2.generate_key! #generate the per-session key pair
+-     *  symm_key1 = dh1.compute_key(dh2.pub_key)
+-     *  symm_key2 = dh2.compute_key(dh1.pub_key)
++     *   # you may send the parameters (der) and own public key (pub1) publicly
++     *   # to the participating party
++     *   dh1 = OpenSSL::PKey::DH.new(2048)
++     *   der = dh1.to_der
++     *   pub1 = dh1.pub_key
++     *
++     *   # the other party generates its per-session key pair
++     *   dhparams = OpenSSL::PKey::DH.new(der)
++     *   dh2 = OpenSSL::PKey.generate_key(dhparams)
++     *   pub2 = dh2.pub_key
+      *
+-     *  puts symm_key1 == symm_key2 # => true
++     *   symm_key1 = dh1.compute_key(pub2)
++     *   symm_key2 = dh2.compute_key(pub1)
++     *   puts symm_key1 == symm_key2 # => true
+      */
+     cDH = rb_define_class_under(mPKey, "DH", cPKey);
+     rb_define_method(cDH, "initialize", ossl_dh_initialize, -1);
+@@ -402,7 +366,6 @@ Init_ossl_dh(void)
+     rb_define_alias(cDH, "to_pem", "export");
+     rb_define_alias(cDH, "to_s", "export");
+     rb_define_method(cDH, "to_der", ossl_dh_to_der, 0);
+-    rb_define_method(cDH, "public_key", ossl_dh_to_public_key, 0);
+     rb_define_method(cDH, "params_ok?", ossl_dh_check_params, 0);
+ 
+     DEF_OSSL_PKEY_BN(cDH, dh, p);
+diff --git a/ext/openssl/ossl_pkey_dsa.c b/ext/openssl/ossl_pkey_dsa.c
+index f017cceb4a..ab9ac781e8 100644
+--- a/ext/openssl/ossl_pkey_dsa.c
++++ b/ext/openssl/ossl_pkey_dsa.c
+@@ -264,47 +264,6 @@ ossl_dsa_get_params(VALUE self)
+     return hash;
+ }
+ 
+-/*
+- *  call-seq:
+- *    dsa.public_key -> aDSA
+- *
+- * Returns a new DSA instance that carries just the public key information.
+- * If the current instance has also private key information, this will no
+- * longer be present in the new instance. This feature is helpful for
+- * publishing the public key information without leaking any of the private
+- * information.
+- *
+- * === Example
+- *  dsa = OpenSSL::PKey::DSA.new(2048) # has public and private information
+- *  pub_key = dsa.public_key # has only the public part available
+- *  pub_key_der = pub_key.to_der # it's safe to publish this
+- *
+- *
+- */
+-static VALUE
+-ossl_dsa_to_public_key(VALUE self)
+-{
+-    EVP_PKEY *pkey, *pkey_new;
+-    DSA *dsa;
+-    VALUE obj;
+-
+-    GetPKeyDSA(self, pkey);
+-    obj = rb_obj_alloc(rb_obj_class(self));
+-    GetPKey(obj, pkey_new);
+-
+-#define DSAPublicKey_dup(dsa) (DSA *)ASN1_dup( \
+-	(i2d_of_void *)i2d_DSAPublicKey, (d2i_of_void *)d2i_DSAPublicKey, (char *)(dsa))
+-    dsa = DSAPublicKey_dup(EVP_PKEY_get0_DSA(pkey));
+-#undef DSAPublicKey_dup
+-    if (!dsa)
+-        ossl_raise(eDSAError, "DSAPublicKey_dup");
+-    if (!EVP_PKEY_assign_DSA(pkey_new, dsa)) {
+-        DSA_free(dsa);
+-        ossl_raise(eDSAError, "EVP_PKEY_assign_DSA");
+-    }
+-    return obj;
+-}
+-
+ /*
+  *  call-seq:
+  *    dsa.syssign(string) -> aString
+@@ -445,7 +404,6 @@ Init_ossl_dsa(void)
+     rb_define_alias(cDSA, "to_pem", "export");
+     rb_define_alias(cDSA, "to_s", "export");
+     rb_define_method(cDSA, "to_der", ossl_dsa_to_der, 0);
+-    rb_define_method(cDSA, "public_key", ossl_dsa_to_public_key, 0);
+     rb_define_method(cDSA, "syssign", ossl_dsa_sign, 1);
+     rb_define_method(cDSA, "sysverify", ossl_dsa_verify, 2);
+ 
+diff --git a/ext/openssl/ossl_pkey_rsa.c b/ext/openssl/ossl_pkey_rsa.c
+index 7a7e66dbda..1c5476cdcd 100644
+--- a/ext/openssl/ossl_pkey_rsa.c
++++ b/ext/openssl/ossl_pkey_rsa.c
+@@ -390,7 +390,7 @@ ossl_rsa_private_decrypt(int argc, VALUE *argv, VALUE self)
+  *   data = "Sign me!"
+  *   pkey = OpenSSL::PKey::RSA.new(2048)
+  *   signature = pkey.sign_pss("SHA256", data, salt_length: :max, mgf1_hash: "SHA256")
+- *   pub_key = pkey.public_key
++ *   pub_key = OpenSSL::PKey.read(pkey.public_to_der)
+  *   puts pub_key.verify_pss("SHA256", signature, data,
+  *                           salt_length: :auto, mgf1_hash: "SHA256") # => true
+  */
+@@ -587,61 +587,6 @@ ossl_rsa_get_params(VALUE self)
+     return hash;
+ }
+ 
+-/*
+- * call-seq:
+- *    rsa.public_key -> RSA
+- *
+- * Makes new RSA instance containing the public key from the private key.
+- */
+-static VALUE
+-ossl_rsa_to_public_key(VALUE self)
+-{
+-    EVP_PKEY *pkey, *pkey_new;
+-    RSA *rsa;
+-    VALUE obj;
+-
+-    GetPKeyRSA(self, pkey);
+-    obj = rb_obj_alloc(rb_obj_class(self));
+-    GetPKey(obj, pkey_new);
+-
+-    rsa = RSAPublicKey_dup(EVP_PKEY_get0_RSA(pkey));
+-    if (!rsa)
+-        ossl_raise(eRSAError, "RSAPublicKey_dup");
+-    if (!EVP_PKEY_assign_RSA(pkey_new, rsa)) {
+-        RSA_free(rsa);
+-        ossl_raise(eRSAError, "EVP_PKEY_assign_RSA");
+-    }
+-    return obj;
+-}
+-
+-/*
+- * TODO: Test me
+-
+-static VALUE
+-ossl_rsa_blinding_on(VALUE self)
+-{
+-    RSA *rsa;
+-
+-    GetRSA(self, rsa);
+-
+-    if (RSA_blinding_on(rsa, ossl_bn_ctx) != 1) {
+-	ossl_raise(eRSAError, NULL);
+-    }
+-    return self;
+-}
+-
+-static VALUE
+-ossl_rsa_blinding_off(VALUE self)
+-{
+-    RSA *rsa;
+-
+-    GetRSA(self, rsa);
+-    RSA_blinding_off(rsa);
+-
+-    return self;
+-}
+- */
+-
+ /*
+  * Document-method: OpenSSL::PKey::RSA#set_key
+  * call-seq:
+@@ -712,7 +657,6 @@ Init_ossl_rsa(void)
+     rb_define_alias(cRSA, "to_pem", "export");
+     rb_define_alias(cRSA, "to_s", "export");
+     rb_define_method(cRSA, "to_der", ossl_rsa_to_der, 0);
+-    rb_define_method(cRSA, "public_key", ossl_rsa_to_public_key, 0);
+     rb_define_method(cRSA, "public_encrypt", ossl_rsa_public_encrypt, -1);
+     rb_define_method(cRSA, "public_decrypt", ossl_rsa_public_decrypt, -1);
+     rb_define_method(cRSA, "private_encrypt", ossl_rsa_private_encrypt, -1);
+diff --git a/test/openssl/test_pkey_rsa.rb b/test/openssl/test_pkey_rsa.rb
+index d1e68dbc9f..5f8d04e754 100644
+--- a/test/openssl/test_pkey_rsa.rb
++++ b/test/openssl/test_pkey_rsa.rb
+@@ -69,29 +69,28 @@ def test_private
+   end
+ 
+   def test_new
+-    key = OpenSSL::PKey::RSA.new 512
+-    pem  = key.public_key.to_pem
+-    OpenSSL::PKey::RSA.new pem
+-    assert_equal([], OpenSSL.errors)
+-  end
++    key = OpenSSL::PKey::RSA.new(512)
++    assert_equal 512, key.n.num_bits
++    assert_equal 65537, key.e
++    assert_not_nil key.d
+ 
+-  def test_new_exponent_default
+-    assert_equal(65537, OpenSSL::PKey::RSA.new(512).e)
++    # Specify public exponent
++    key2 = OpenSSL::PKey::RSA.new(512, 3)
++    assert_equal 512, key2.n.num_bits
++    assert_equal 3, key2.e
++    assert_not_nil key2.d
+   end
+ 
+-  def test_new_with_exponent
+-    1.upto(30) do |idx|
+-      e = (2 ** idx) + 1
+-      key = OpenSSL::PKey::RSA.new(512, e)
+-      assert_equal(e, key.e)
+-    end
+-  end
++  def test_s_generate
++    key1 = OpenSSL::PKey::RSA.generate(512)
++    assert_equal 512, key1.n.num_bits
++    assert_equal 65537, key1.e
+ 
+-  def test_generate
+-    key = OpenSSL::PKey::RSA.generate(512, 17)
+-    assert_equal 512, key.n.num_bits
+-    assert_equal 17, key.e
+-    assert_not_nil key.d
++    # Specify public exponent
++    key2 = OpenSSL::PKey::RSA.generate(512, 3)
++    assert_equal 512, key2.n.num_bits
++    assert_equal 3, key2.e
++    assert_not_nil key2.d
+   end
+ 
+   def test_new_break
+-- 
+2.32.0
+
+
+From 2150af0e55b2a25c24f62006e27e0aec3dc81b57 Mon Sep 17 00:00:00 2001
+From: Kazuki Yamaguchi <k@rhe.jp>
+Date: Fri, 10 Jul 2020 14:34:51 +0900
+Subject: [PATCH 3/3] pkey/dh, pkey/ec: use EVP_PKEY_check() family
+
+Use EVP_PKEY_param_check() instead of DH_check() if available. Also,
+use EVP_PKEY_public_check() instead of EC_KEY_check_key().
+
+EVP_PKEY_*check() is part of the EVP API and is meant to replace those
+low-level functions. They were added by OpenSSL 1.1.1. It is currently
+not provided by LibreSSL.
+---
+ ext/openssl/extconf.rb       |  3 +++
+ ext/openssl/ossl_pkey_dh.c   | 27 +++++++++++++++++++++++----
+ ext/openssl/ossl_pkey_ec.c   | 23 +++++++++++++++++++----
+ test/openssl/test_pkey_dh.rb | 16 ++++++++++++++++
+ 4 files changed, 61 insertions(+), 8 deletions(-)
+
+diff --git a/ext/openssl/extconf.rb b/ext/openssl/extconf.rb
+index b3c6647faf..17d93443fc 100644
+--- a/ext/openssl/extconf.rb
++++ b/ext/openssl/extconf.rb
+@@ -172,6 +172,9 @@ def find_openssl_library
+ have_func("EVP_PBE_scrypt")
+ have_func("SSL_CTX_set_post_handshake_auth")
+ 
++# added in 1.1.1
++have_func("EVP_PKEY_check")
++
+ Logging::message "=== Checking done. ===\n"
+ 
+ create_header
+diff --git a/ext/openssl/ossl_pkey_dh.c b/ext/openssl/ossl_pkey_dh.c
+index a512b209d3..ca782bbe59 100644
+--- a/ext/openssl/ossl_pkey_dh.c
++++ b/ext/openssl/ossl_pkey_dh.c
+@@ -273,19 +273,38 @@ ossl_dh_get_params(VALUE self)
+  * Validates the Diffie-Hellman parameters associated with this instance.
+  * It checks whether a safe prime and a suitable generator are used. If this
+  * is not the case, +false+ is returned.
++ *
++ * See also the man page EVP_PKEY_param_check(3).
+  */
+ static VALUE
+ ossl_dh_check_params(VALUE self)
+ {
++    int ret;
++#ifdef HAVE_EVP_PKEY_CHECK
++    EVP_PKEY *pkey;
++    EVP_PKEY_CTX *pctx;
++
++    GetPKey(self, pkey);
++    pctx = EVP_PKEY_CTX_new(pkey, /* engine */NULL);
++    if (!pctx)
++        ossl_raise(eDHError, "EVP_PKEY_CTX_new");
++    ret = EVP_PKEY_param_check(pctx);
++    EVP_PKEY_CTX_free(pctx);
++#else
+     DH *dh;
+     int codes;
+ 
+     GetDH(self, dh);
+-    if (!DH_check(dh, &codes)) {
+-	return Qfalse;
+-    }
++    ret = DH_check(dh, &codes) == 1 && codes == 0;
++#endif
+ 
+-    return codes == 0 ? Qtrue : Qfalse;
++    if (ret == 1)
++        return Qtrue;
++    else {
++        /* DH_check_ex() will put error entry on failure */
++        ossl_clear_error();
++        return Qfalse;
++    }
+ }
+ 
+ /*
+diff --git a/ext/openssl/ossl_pkey_ec.c b/ext/openssl/ossl_pkey_ec.c
+index ecb8305184..829529d4b9 100644
+--- a/ext/openssl/ossl_pkey_ec.c
++++ b/ext/openssl/ossl_pkey_ec.c
+@@ -443,20 +443,35 @@ static VALUE ossl_ec_key_generate_key(VALUE self)
+ }
+ 
+ /*
+- *  call-seq:
+- *     key.check_key   => true
++ * call-seq:
++ *    key.check_key   => true
+  *
+- *  Raises an exception if the key is invalid.
++ * Raises an exception if the key is invalid.
+  *
+- *  See the OpenSSL documentation for EC_KEY_check_key()
++ * See also the man page EVP_PKEY_public_check(3).
+  */
+ static VALUE ossl_ec_key_check_key(VALUE self)
+ {
++#ifdef HAVE_EVP_PKEY_CHECK
++    EVP_PKEY *pkey;
++    EVP_PKEY_CTX *pctx;
++    int ret;
++
++    GetPKey(self, pkey);
++    pctx = EVP_PKEY_CTX_new(pkey, /* engine */NULL);
++    if (!pctx)
++        ossl_raise(eDHError, "EVP_PKEY_CTX_new");
++    ret = EVP_PKEY_public_check(pctx);
++    EVP_PKEY_CTX_free(pctx);
++    if (ret != 1)
++        ossl_raise(eECError, "EVP_PKEY_public_check");
++#else
+     EC_KEY *ec;
+ 
+     GetEC(self, ec);
+     if (EC_KEY_check_key(ec) != 1)
+ 	ossl_raise(eECError, "EC_KEY_check_key");
++#endif
+ 
+     return Qtrue;
+ }
+diff --git a/test/openssl/test_pkey_dh.rb b/test/openssl/test_pkey_dh.rb
+index 279ce1984c..f80af8f841 100644
+--- a/test/openssl/test_pkey_dh.rb
++++ b/test/openssl/test_pkey_dh.rb
+@@ -86,6 +86,22 @@ def test_key_exchange
+     assert_equal(dh.compute_key(dh2.pub_key), dh2.compute_key(dh.pub_key))
+   end
+ 
++  def test_params_ok?
++    dh0 = Fixtures.pkey("dh1024")
++
++    dh1 = OpenSSL::PKey::DH.new(OpenSSL::ASN1::Sequence([
++      OpenSSL::ASN1::Integer(dh0.p),
++      OpenSSL::ASN1::Integer(dh0.g)
++    ]))
++    assert_equal(true, dh1.params_ok?)
++
++    dh2 = OpenSSL::PKey::DH.new(OpenSSL::ASN1::Sequence([
++      OpenSSL::ASN1::Integer(dh0.p + 1),
++      OpenSSL::ASN1::Integer(dh0.g)
++    ]))
++    assert_equal(false, dh2.params_ok?)
++  end
++
+   def test_dup
+     dh = Fixtures.pkey("dh1024")
+     dh2 = dh.dup
+-- 
+2.32.0
+

SOURCES/ruby-3.1.0-Use-OSSL_DECODER-to-load-encrypted-PEM-on-OpenSSL-3.0.patch

@@ -0,0 +1,114 @@
+From 8c185e0ae5e42bf5f3d76a1a0898946671116fa3 Mon Sep 17 00:00:00 2001
+From: Kazuki Yamaguchi <k@rhe.jp>
+Date: Wed, 3 Nov 2021 23:31:29 +0900
+Subject: [PATCH 1/2] pkey: test parsing concatenated PEM string
+
+PEM-encoded private keys are sometimes stored together with irrelevant
+PEM blocks, such as the corresponding X.509 certificate.
+
+PEM_read_bio_*() family automatically skips unknown PEM blocks, but on
+OpenSSL 3.0 we will be using the new OSSL_DECODER API instead due to
+some breaking changes around the password callback.
+
+Let's add a test case so that we won't break the current behavior.
+---
+ test/openssl/test_pkey_rsa.rb | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/test/openssl/test_pkey_rsa.rb b/test/openssl/test_pkey_rsa.rb
+index dbe87ba4..7510658d 100644
+--- a/test/openssl/test_pkey_rsa.rb
++++ b/test/openssl/test_pkey_rsa.rb
+@@ -306,6 +306,12 @@ def test_RSAPrivateKey
+ 
+     assert_equal asn1.to_der, rsa1024.to_der
+     assert_equal pem, rsa1024.export
++
++    # Unknown PEM prepended
++    cert = issue_cert(OpenSSL::X509::Name.new([["CN", "nobody"]]), rsa1024, 1, [], nil, nil)
++    str = cert.to_text + cert.to_pem + rsa1024.to_pem
++    key = OpenSSL::PKey::RSA.new(str)
++    assert_same_rsa rsa1024, key
+   end
+ 
+   def test_RSAPrivateKey_encrypted
+
+From a84ea531bbd080c3f58fe8d3dc9ffb1af2251f35 Mon Sep 17 00:00:00 2001
+From: Kazuki Yamaguchi <k@rhe.jp>
+Date: Sat, 20 Mar 2021 23:16:16 +0900
+Subject: [PATCH 2/2] pkey: use OSSL_DECODER to load encrypted PEM on OpenSSL
+ 3.0
+
+OpenSSL 3.0 has rewritten routines to load pkeys (PEM_read_bio_* and
+d2i_* functions) around the newly introduced OSSL_DECODER API.
+
+This comes with a slight behavior change. They now decrypt and parse
+each encountered PEM block, then check the kind of the block. This used
+to be the reverse: they checked the PEM header to see the kind, and then
+decrypted the content. This means that the password callback may now be
+called repeatedly.
+
+Let's use the OSSL_DECODER API directly on OpenSSL 3.0 so that the
+return value from the password callback will be reused automatically.
+---
+ ext/openssl/ossl_pkey.c | 40 ++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 40 insertions(+)
+
+diff --git a/ext/openssl/ossl_pkey.c b/ext/openssl/ossl_pkey.c
+index f9f5162e..b08168a5 100644
+--- a/ext/openssl/ossl_pkey.c
++++ b/ext/openssl/ossl_pkey.c
+@@ -78,6 +78,45 @@ ossl_pkey_new(EVP_PKEY *pkey)
+     return obj;
+ }
+ 
++#if OSSL_OPENSSL_PREREQ(3, 0, 0)
++# include <openssl/decoder.h>
++
++EVP_PKEY *
++ossl_pkey_read_generic(BIO *bio, VALUE pass)
++{
++    void *ppass = (void *)pass;
++    OSSL_DECODER_CTX *dctx;
++    EVP_PKEY *pkey = NULL;
++    int pos = 0, pos2;
++
++    dctx = OSSL_DECODER_CTX_new_for_pkey(&pkey, "DER", NULL, NULL, 0, NULL, NULL);
++    if (!dctx)
++        goto out;
++    if (OSSL_DECODER_CTX_set_pem_password_cb(dctx, ossl_pem_passwd_cb, ppass) != 1)
++        goto out;
++
++    /* First check DER */
++    if (OSSL_DECODER_from_bio(dctx, bio) == 1)
++        goto out;
++
++    /* Then check PEM; multiple OSSL_DECODER_from_bio() calls may be needed */
++    OSSL_BIO_reset(bio);
++    if (OSSL_DECODER_CTX_set_input_type(dctx, "PEM") != 1)
++        goto out;
++    while (OSSL_DECODER_from_bio(dctx, bio) != 1) {
++        if (BIO_eof(bio))
++            goto out;
++        pos2 = BIO_tell(bio);
++        if (pos2 < 0 || pos2 <= pos)
++            goto out;
++        pos = pos2;
++    }
++
++  out:
++    OSSL_DECODER_CTX_free(dctx);
++    return pkey;
++}
++#else
+ EVP_PKEY *
+ ossl_pkey_read_generic(BIO *bio, VALUE pass)
+ {
+@@ -106,6 +145,7 @@ ossl_pkey_read_generic(BIO *bio, VALUE pass)
+   out:
+     return pkey;
+ }
++#endif
+ 
+ /*
+  *  call-seq:

SOURCES/ruby-3.1.0-Use-mmap-for-allocating-heap-pages-in-the-GC.patch

@@ -0,0 +1,359 @@
+From bcab8c3cd877506de75f50e0f9ed98827ed554b0 Mon Sep 17 00:00:00 2001
+From: Peter Zhu <peter@peterzhu.ca>
+Date: Tue, 23 Feb 2021 16:28:56 -0500
+Subject: [PATCH] Use mmap for allocating heap pages
+
+---
+ configure.ac                 |  16 ++++
+ gc.c                         | 149 ++++++++++++++++++++++++++---------
+ test/ruby/test_gc_compact.rb |  41 ++++++----
+ 3 files changed, 155 insertions(+), 51 deletions(-)
+
+diff --git a/configure.ac b/configure.ac
+index 2dcebdde9f..b1b190004d 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -1944,6 +1944,7 @@ AC_CHECK_FUNCS(memmem)
+ AC_CHECK_FUNCS(mkfifo)
+ AC_CHECK_FUNCS(mknod)
+ AC_CHECK_FUNCS(mktime)
++AC_CHECK_FUNCS(mmap)
+ AC_CHECK_FUNCS(openat)
+ AC_CHECK_FUNCS(pipe2)
+ AC_CHECK_FUNCS(poll)
+@@ -2666,6 +2667,21 @@ main(int argc, char *argv[])
+ 	rb_cv_fork_with_pthread=yes)])
+     test x$rb_cv_fork_with_pthread = xyes || AC_DEFINE(CANNOT_FORK_WITH_PTHREAD)
+ ])
++
++AC_CHECK_HEADERS([sys/user.h])
++AS_IF([test "x$ac_cv_func_mmap" = xyes], [
++    AC_CACHE_CHECK([whether PAGE_SIZE is compile-time const], rb_cv_const_page_size,
++	[malloc_headers=`sed -n '/MALLOC_HEADERS_BEGIN/,/MALLOC_HEADERS_END/p' ${srcdir}/gc.c`
++	AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[$malloc_headers
++            typedef char conftest_page[PAGE_SIZE];
++        ]], [[]])],
++        [rb_cv_const_page_size=yes],
++        [rb_cv_const_page_size=no])])
++])
++AS_IF([test "x$rb_cv_const_page_size" = xyes],
++    [AC_DEFINE(HAVE_CONST_PAGE_SIZE, 1)],
++    [AC_DEFINE(HAVE_CONST_PAGE_SIZE, 0)]
++)
+ }
+ 
+ : "runtime section" && {
+diff --git a/gc.c b/gc.c
+index f6acf3e117..6f8e5f242d 100644
+--- a/gc.c
++++ b/gc.c
+@@ -32,6 +32,7 @@
+ #include <stdarg.h>
+ #include <stdio.h>
+ 
++/* MALLOC_HEADERS_BEGIN */
+ #ifndef HAVE_MALLOC_USABLE_SIZE
+ # ifdef _WIN32
+ #  define HAVE_MALLOC_USABLE_SIZE
+@@ -54,6 +55,12 @@
+ # endif
+ #endif
+ 
++#if !defined(PAGE_SIZE) && defined(HAVE_SYS_USER_H)
++/* LIST_HEAD conflicts with sys/queue.h on macOS */
++# include <sys/user.h>
++#endif
++/* MALLOC_HEADERS_END */
++
+ #ifdef HAVE_SYS_TIME_H
+ # include <sys/time.h>
+ #endif
+@@ -821,6 +828,25 @@ enum {
+     HEAP_PAGE_BITMAP_SIZE = (BITS_SIZE * HEAP_PAGE_BITMAP_LIMIT),
+     HEAP_PAGE_BITMAP_PLANES = 4 /* RGENGC: mark, unprotected, uncollectible, marking */
+ };
++#define HEAP_PAGE_ALIGN (1 << HEAP_PAGE_ALIGN_LOG)
++#define HEAP_PAGE_SIZE HEAP_PAGE_ALIGN
++
++#ifdef HAVE_MMAP
++# if HAVE_CONST_PAGE_SIZE
++/* If we have the HEAP_PAGE and it is a constant, then we can directly use it. */
++static const bool USE_MMAP_ALIGNED_ALLOC = (PAGE_SIZE <= HEAP_PAGE_SIZE);
++# elif defined(PAGE_MAX_SIZE) && (PAGE_MAX_SIZE <= HEAP_PAGE_SIZE)
++/* PAGE_SIZE <= HEAP_PAGE_SIZE */
++static const bool USE_MMAP_ALIGNED_ALLOC = true;
++# else
++/* Otherwise, fall back to determining if we can use mmap during runtime. */
++#  define USE_MMAP_ALIGNED_ALLOC (use_mmap_aligned_alloc != false)
++
++static bool use_mmap_aligned_alloc;
++# endif
++#elif !defined(__MINGW32__) && !defined(_WIN32)
++static const bool USE_MMAP_ALIGNED_ALLOC = false;
++#endif
+ 
+ struct heap_page {
+     short total_slots;
+@@ -1760,14 +1786,14 @@ heap_unlink_page(rb_objspace_t *objspace, rb_heap_t *heap, struct heap_page *pag
+     heap->total_slots -= page->total_slots;
+ }
+ 
+-static void rb_aligned_free(void *ptr);
++static void rb_aligned_free(void *ptr, size_t size);
+ 
+ static void
+ heap_page_free(rb_objspace_t *objspace, struct heap_page *page)
+ {
+     heap_allocated_pages--;
+     objspace->profile.total_freed_pages++;
+-    rb_aligned_free(GET_PAGE_BODY(page->start));
++    rb_aligned_free(GET_PAGE_BODY(page->start), HEAP_PAGE_SIZE);
+     free(page);
+ }
+ 
+@@ -1819,7 +1845,7 @@ heap_page_allocate(rb_objspace_t *objspace)
+     /* assign heap_page entry */
+     page = calloc1(sizeof(struct heap_page));
+     if (page == 0) {
+-        rb_aligned_free(page_body);
++        rb_aligned_free(page_body, HEAP_PAGE_SIZE);
+ 	rb_memerror();
+     }
+ 
+@@ -3159,15 +3185,18 @@ Init_heap(void)
+ {
+     rb_objspace_t *objspace = &rb_objspace;
+ 
+-#if defined(HAVE_SYSCONF) && defined(_SC_PAGE_SIZE)
+-    /* If Ruby's heap pages are not a multiple of the system page size, we
+-     * cannot use mprotect for the read barrier, so we must disable automatic
+-     * compaction. */
+-    int pagesize;
+-    pagesize = (int)sysconf(_SC_PAGE_SIZE);
+-    if ((HEAP_PAGE_SIZE % pagesize) != 0) {
+-        ruby_enable_autocompact = 0;
+-    }
++#if defined(HAVE_MMAP) && !HAVE_CONST_PAGE_SIZE && !defined(PAGE_MAX_SIZE)
++    /* Need to determine if we can use mmap at runtime. */
++# ifdef PAGE_SIZE
++    /* If the PAGE_SIZE macro can be used. */
++    use_mmap_aligned_alloc = PAGE_SIZE <= HEAP_PAGE_SIZE;
++# elif defined(HAVE_SYSCONF) && defined(_SC_PAGE_SIZE)
++    /* If we can use sysconf to determine the page size. */
++    use_mmap_aligned_alloc = sysconf(_SC_PAGE_SIZE) <= HEAP_PAGE_SIZE;
++# else
++    /* Otherwise we can't determine the system page size, so don't use mmap. */
++    use_mmap_aligned_alloc = FALSE;
++# endif
+ #endif
+ 
+     objspace->next_object_id = INT2FIX(OBJ_ID_INITIAL);
+@@ -8533,6 +8562,14 @@ gc_start_internal(rb_execution_context_t *ec, VALUE self, VALUE full_mark, VALUE
+ 
+     /* For now, compact implies full mark / sweep, so ignore other flags */
+     if (RTEST(compact)) {
++        /* If not MinGW, Windows, or does not have mmap, we cannot use mprotect for
++         * the read barrier, so we must disable compaction. */
++#if !defined(__MINGW32__) && !defined(_WIN32)
++        if (!USE_MMAP_ALIGNED_ALLOC) {
++            rb_raise(rb_eNotImpError, "Compaction isn't available on this platform");
++        }
++#endif
++
+         reason |= GPR_FLAG_COMPACT;
+     } else {
+         if (!RTEST(full_mark))       reason &= ~GPR_FLAG_FULL_MARK;
+@@ -9944,16 +9981,14 @@ gc_disable(rb_execution_context_t *ec, VALUE _)
+ static VALUE
+ gc_set_auto_compact(rb_execution_context_t *ec, VALUE _, VALUE v)
+ {
+-#if defined(HAVE_SYSCONF) && defined(_SC_PAGE_SIZE)
+-    /* If Ruby's heap pages are not a multiple of the system page size, we
+-     * cannot use mprotect for the read barrier, so we must disable automatic
+-     * compaction. */
+-    int pagesize;
+-    pagesize = (int)sysconf(_SC_PAGE_SIZE);
+-    if ((HEAP_PAGE_SIZE % pagesize) != 0) {
++    /* If not MinGW, Windows, or does not have mmap, we cannot use mprotect for
++     * the read barrier, so we must disable automatic compaction. */
++#if !defined(__MINGW32__) && !defined(_WIN32)
++    if (!USE_MMAP_ALIGNED_ALLOC) {
+         rb_raise(rb_eNotImpError, "Automatic compaction isn't available on this platform");
+     }
+ #endif
++
+     ruby_enable_autocompact = RTEST(v);
+     return v;
+ }
+@@ -10350,22 +10385,54 @@ rb_aligned_malloc(size_t alignment, size_t size)
+ #elif defined _WIN32
+     void *_aligned_malloc(size_t, size_t);
+     res = _aligned_malloc(size, alignment);
+-#elif defined(HAVE_POSIX_MEMALIGN)
+-    if (posix_memalign(&res, alignment, size) == 0) {
+-        return res;
++#else
++    if (USE_MMAP_ALIGNED_ALLOC) {
++        GC_ASSERT(alignment % sysconf(_SC_PAGE_SIZE) == 0);
++
++        char *ptr = mmap(NULL, alignment + size, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
++        if (ptr == MAP_FAILED) {
++            return NULL;
++        }
++
++        char *aligned = ptr + alignment;
++        aligned -= ((VALUE)aligned & (alignment - 1));
++        GC_ASSERT(aligned > ptr);
++        GC_ASSERT(aligned <= ptr + alignment);
++
++        size_t start_out_of_range_size = aligned - ptr;
++        GC_ASSERT(start_out_of_range_size % sysconf(_SC_PAGE_SIZE) == 0);
++        if (start_out_of_range_size > 0) {
++            if (munmap(ptr, start_out_of_range_size)) {
++                rb_bug("rb_aligned_malloc: munmap failed for start");
++            }
++        }
++
++        size_t end_out_of_range_size = alignment - start_out_of_range_size;
++        GC_ASSERT(end_out_of_range_size % sysconf(_SC_PAGE_SIZE) == 0);
++        if (end_out_of_range_size > 0) {
++            if (munmap(aligned + size, end_out_of_range_size)) {
++                rb_bug("rb_aligned_malloc: munmap failed for end");
++            }
++        }
++
++        res = (void *)aligned;
+     }
+     else {
+-        return NULL;
++# if defined(HAVE_POSIX_MEMALIGN)
++        if (posix_memalign(&res, alignment, size) != 0) {
++            return NULL;
++        }
++# elif defined(HAVE_MEMALIGN)
++        res = memalign(alignment, size);
++# else
++        char* aligned;
++        res = malloc(alignment + size + sizeof(void*));
++        aligned = (char*)res + alignment + sizeof(void*);
++        aligned -= ((VALUE)aligned & (alignment - 1));
++        ((void**)aligned)[-1] = res;
++        res = (void*)aligned;
++# endif
+     }
+-#elif defined(HAVE_MEMALIGN)
+-    res = memalign(alignment, size);
+-#else
+-    char* aligned;
+-    res = malloc(alignment + size + sizeof(void*));
+-    aligned = (char*)res + alignment + sizeof(void*);
+-    aligned -= ((VALUE)aligned & (alignment - 1));
+-    ((void**)aligned)[-1] = res;
+-    res = (void*)aligned;
+ #endif
+ 
+     /* alignment must be a power of 2 */
+@@ -10375,16 +10442,26 @@ rb_aligned_malloc(size_t alignment, size_t size)
+ }
+ 
+ static void
+-rb_aligned_free(void *ptr)
++rb_aligned_free(void *ptr, size_t size)
+ {
+ #if defined __MINGW32__
+     __mingw_aligned_free(ptr);
+ #elif defined _WIN32
+     _aligned_free(ptr);
+-#elif defined(HAVE_MEMALIGN) || defined(HAVE_POSIX_MEMALIGN)
+-    free(ptr);
+ #else
+-    free(((void**)ptr)[-1]);
++    if (USE_MMAP_ALIGNED_ALLOC) {
++        GC_ASSERT(size % sysconf(_SC_PAGE_SIZE) == 0);
++        if (munmap(ptr, size)) {
++            rb_bug("rb_aligned_free: munmap failed");
++        }
++    }
++    else {
++# if defined(HAVE_POSIX_MEMALIGN) || defined(HAVE_MEMALIGN)
++        free(ptr);
++# else
++        free(((void**)ptr)[-1]);
++# endif
++    }
+ #endif
+ }
+ 
+diff --git a/test/ruby/test_gc_compact.rb b/test/ruby/test_gc_compact.rb
+index 4a8cff33f4..f5cab55ba7 100644
+--- a/test/ruby/test_gc_compact.rb
++++ b/test/ruby/test_gc_compact.rb
+@@ -4,12 +4,32 @@
+ require 'etc'
+ 
+ class TestGCCompact < Test::Unit::TestCase
+-  class AutoCompact < Test::Unit::TestCase
++  module SupportsCompact
+     def setup
+       skip "autocompact not supported on this platform" unless supports_auto_compact?
+       super
+     end
+ 
++    private
++
++    def supports_auto_compact?
++      return true unless defined?(Etc::SC_PAGE_SIZE)
++
++      begin
++        return GC::INTERNAL_CONSTANTS[:HEAP_PAGE_SIZE] % Etc.sysconf(Etc::SC_PAGE_SIZE) == 0
++      rescue NotImplementedError
++      rescue ArgumentError
++      end
++
++      true
++    end
++  end
++
++  include SupportsCompact
++
++  class AutoCompact < Test::Unit::TestCase
++    include SupportsCompact
++
+     def test_enable_autocompact
+       before = GC.auto_compact
+       GC.auto_compact = true
+@@ -59,26 +79,17 @@ def test_implicit_compaction_does_something
+     ensure
+       GC.auto_compact = before
+     end
+-
+-    private
+-
+-    def supports_auto_compact?
+-      return true unless defined?(Etc::SC_PAGE_SIZE)
+-
+-      begin
+-        return GC::INTERNAL_CONSTANTS[:HEAP_PAGE_SIZE] % Etc.sysconf(Etc::SC_PAGE_SIZE) == 0
+-      rescue NotImplementedError
+-      rescue ArgumentError
+-      end
+-
+-      true
+-    end
+   end
+ 
+   def os_page_size
+     return true unless defined?(Etc::SC_PAGE_SIZE)
+   end
+ 
++  def setup
++    skip "autocompact not supported on this platform" unless supports_auto_compact?
++    super
++  end
++
+   def test_gc_compact_stats
+     list = []
+ 
+-- 
+2.30.1 (Apple Git-130)
+

SOURCES/ruby-3.1.0-addr2line-DW_FORM_ref_addr.patch

@@ -0,0 +1,29 @@
+From a9977ba2f9863e3fb1b2346589ebbca67d80536c Mon Sep 17 00:00:00 2001
+From: Nobuyoshi Nakada <nobu@ruby-lang.org>
+Date: Sat, 14 Aug 2021 10:08:19 +0900
+Subject: [PATCH] Constified addr2line.c
+
+---
+ addr2line.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/addr2line.c b/addr2line.c
+index 8ee4416650d3..fed1a8da84e5 100644
+--- a/addr2line.c
++++ b/addr2line.c
+@@ -1138,12 +1138,12 @@ debug_info_reader_read_value(DebugInfoReader *reader, uint64_t form, DebugInfoVa
+         set_uint_value(v, read_uleb128(reader));
+         break;
+       case DW_FORM_ref_addr:
+-        if (reader->address_size == 4) {
++        if (reader->format == 4) {
+             set_uint_value(v, read_uint32(&reader->p));
+-        } else if (reader->address_size == 8) {
++        } else if (reader->format == 8) {
+             set_uint_value(v, read_uint64(&reader->p));
+         } else {
+-            fprintf(stderr,"unknown address_size:%d", reader->address_size);
++            fprintf(stderr,"unknown format:%d", reader->format);
+             abort();
+         }
+         break;

SOURCES/ruby-3.1.0-test-openssl-test_digest-do-not-test-constants-for-l.patch

@@ -0,0 +1,29 @@
+From b4b5eab2a5fd0e9ac62c01102dd26d0a433c5683 Mon Sep 17 00:00:00 2001
+From: Kazuki Yamaguchi <k@rhe.jp>
+Date: Mon, 18 May 2020 02:17:28 +0900
+Subject: [PATCH] test/openssl/test_digest: do not test constants for legacy
+ algorithms
+
+Remove availability test for MD4 and RIPEMD160 as they are considered
+legacy and may be missing depending on the compile-time options of
+OpenSSL. OpenSSL 3.0 by default disables them.
+---
+ test/openssl/test_digest.rb | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/test/openssl/test_digest.rb b/test/openssl/test_digest.rb
+index 8d7046e831..84c128c12f 100644
+--- a/test/openssl/test_digest.rb
++++ b/test/openssl/test_digest.rb
+@@ -54,7 +54,7 @@ def test_reset
+   end
+ 
+   def test_digest_constants
+-    %w{MD4 MD5 RIPEMD160 SHA1 SHA224 SHA256 SHA384 SHA512}.each do |name|
++    %w{MD5 SHA1 SHA224 SHA256 SHA384 SHA512}.each do |name|
+       assert_not_nil(OpenSSL::Digest.new(name))
+       klass = OpenSSL::Digest.const_get(name.tr('-', '_'))
+       assert_not_nil(klass.new)
+-- 
+2.32.0
+

SOURCES/ruby-3.1.0-test-openssl-test_pkcs12-fix-test-failures-with-Open.patch

@@ -0,0 +1,439 @@
+From 9596788bdd2d061bef042485af14262e9fc4020c Mon Sep 17 00:00:00 2001
+From: Kazuki Yamaguchi <k@rhe.jp>
+Date: Thu, 13 Aug 2020 23:20:55 +0900
+Subject: [PATCH] test/openssl/test_pkcs12: fix test failures with OpenSSL 3.0
+
+OpenSSL's PKCS12_create() by default uses pbewithSHAAnd40BitRC2-CBC for
+encryption of the certificates. However, in OpenSSL 3.0, the algorithm
+is part of the legacy provider and is not enabled by default.
+
+Specify another algorithm that is still in the default provider for
+these test cases.
+---
+ test/openssl/test_pkcs12.rb | 297 ++++++++++++++++++------------------
+ 1 file changed, 149 insertions(+), 148 deletions(-)
+
+diff --git a/test/openssl/test_pkcs12.rb b/test/openssl/test_pkcs12.rb
+index fdbe753b17..ec676743bc 100644
+--- a/test/openssl/test_pkcs12.rb
++++ b/test/openssl/test_pkcs12.rb
+@@ -5,6 +5,9 @@
+ 
+ module OpenSSL
+   class TestPKCS12 < OpenSSL::TestCase
++    DEFAULT_PBE_PKEYS = "PBE-SHA1-3DES"
++    DEFAULT_PBE_CERTS = "PBE-SHA1-3DES"
++
+     def setup
+       super
+       ca = OpenSSL::X509::Name.parse("/DC=org/DC=ruby-lang/CN=CA")
+@@ -14,47 +17,41 @@ def setup
+         ["subjectKeyIdentifier","hash",false],
+         ["authorityKeyIdentifier","keyid:always",false],
+       ]
+-      @cacert = issue_cert(ca, Fixtures.pkey("rsa2048"), 1, ca_exts, nil, nil)
++      ca_key = Fixtures.pkey("rsa-1")
++      @cacert = issue_cert(ca, ca_key, 1, ca_exts, nil, nil)
+ 
+       inter_ca = OpenSSL::X509::Name.parse("/DC=org/DC=ruby-lang/CN=Intermediate CA")
+-      inter_ca_key = OpenSSL::PKey.read <<-_EOS_
+------BEGIN RSA PRIVATE KEY-----
+-MIICXAIBAAKBgQDp7hIG0SFMG/VWv1dBUWziAPrNmkMXJgTCAoB7jffzRtyyN04K
+-oq/89HAszTMStZoMigQURfokzKsjpUp8OYCAEsBtt9d5zPndWMz/gHN73GrXk3LT
+-ZsxEn7Xv5Da+Y9F/Hx2QZUHarV5cdZixq2NbzWGwrToogOQMh2pxN3Z/0wIDAQAB
+-AoGBAJysUyx3olpsGzv3OMRJeahASbmsSKTXVLZvoIefxOINosBFpCIhZccAG6UV
+-5c/xCvS89xBw8aD15uUfziw3AuT8QPEtHCgfSjeT7aWzBfYswEgOW4XPuWr7EeI9
+-iNHGD6z+hCN/IQr7FiEBgTp6A+i/hffcSdR83fHWKyb4M7TRAkEA+y4BNd668HmC
+-G5MPRx25n6LixuBxrNp1umfjEI6UZgEFVpYOg4agNuimN6NqM253kcTR94QNTUs5
+-Kj3EhG1YWwJBAO5rUjiOyCNVX2WUQrOMYK/c1lU7fvrkdygXkvIGkhsPoNRzLPeA
+-HGJszKtrKD8bNihWpWNIyqKRHfKVD7yXT+kCQGCAhVCIGTRoypcDghwljHqLnysf
+-ci0h5ZdPcIqc7ODfxYhFsJ/Rql5ONgYsT5Ig/+lOQAkjf+TRYM4c2xKx2/8CQBvG
+-jv6dy70qDgIUgqzONtlmHeYyFzn9cdBO5sShdVYHvRHjFSMEXsosqK9zvW2UqvuK
+-FJx7d3f29gkzynCLJDkCQGQZlEZJC4vWmWJGRKJ24P6MyQn3VsPfErSKOg4lvyM3
+-Li8JsX5yIiuVYaBg/6ha3tOg4TCa5K/3r3tVliRZ2Es=
+------END RSA PRIVATE KEY-----
+-      _EOS_
+-      @inter_cacert = issue_cert(inter_ca, inter_ca_key, 2, ca_exts, @cacert, Fixtures.pkey("rsa2048"))
++      inter_ca_key = Fixtures.pkey("rsa-2")
++      @inter_cacert = issue_cert(inter_ca, inter_ca_key, 2, ca_exts, @cacert, ca_key)
+ 
+       exts = [
+         ["keyUsage","digitalSignature",true],
+         ["subjectKeyIdentifier","hash",false],
+       ]
+       ee = OpenSSL::X509::Name.parse("/DC=org/DC=ruby-lang/CN=Ruby PKCS12 Test Certificate")
+-      @mykey = Fixtures.pkey("rsa1024")
++      @mykey = Fixtures.pkey("rsa-3")
+       @mycert = issue_cert(ee, @mykey, 3, exts, @inter_cacert, inter_ca_key)
+     end
+ 
+-    def test_create
++    def test_create_single_key_single_cert
+       pkcs12 = OpenSSL::PKCS12.create(
+         "omg",
+         "hello",
+         @mykey,
+-        @mycert
++        @mycert,
++        nil,
++        DEFAULT_PBE_PKEYS,
++        DEFAULT_PBE_CERTS,
+       )
+-      assert_equal @mycert.to_der, pkcs12.certificate.to_der
++      assert_equal @mycert, pkcs12.certificate
+       assert_equal @mykey.to_der, pkcs12.key.to_der
+       assert_nil pkcs12.ca_certs
++
++      der = pkcs12.to_der
++      decoded = OpenSSL::PKCS12.new(der, "omg")
++      assert_equal @mykey.to_der, decoded.key.to_der
++      assert_equal @mycert, decoded.certificate
++      assert_equal [], Array(decoded.ca_certs)
+     end
+ 
+     def test_create_no_pass
+@@ -62,14 +59,17 @@ def test_create_no_pass
+         nil,
+         "hello",
+         @mykey,
+-        @mycert
++        @mycert,
++        nil,
++        DEFAULT_PBE_PKEYS,
++        DEFAULT_PBE_CERTS,
+       )
+-      assert_equal @mycert.to_der, pkcs12.certificate.to_der
++      assert_equal @mycert, pkcs12.certificate
+       assert_equal @mykey.to_der, pkcs12.key.to_der
+       assert_nil pkcs12.ca_certs
+ 
+       decoded = OpenSSL::PKCS12.new(pkcs12.to_der)
+-      assert_cert @mycert, decoded.certificate
++      assert_equal @mycert, decoded.certificate
+     end
+ 
+     def test_create_with_chain
+@@ -80,7 +80,9 @@ def test_create_with_chain
+         "hello",
+         @mykey,
+         @mycert,
+-        chain
++        chain,
++        DEFAULT_PBE_PKEYS,
++        DEFAULT_PBE_CERTS,
+       )
+       assert_equal chain, pkcs12.ca_certs
+     end
+@@ -95,14 +97,16 @@ def test_create_with_chain_decode
+         "hello",
+         @mykey,
+         @mycert,
+-        chain
++        chain,
++        DEFAULT_PBE_PKEYS,
++        DEFAULT_PBE_CERTS,
+       )
+ 
+       decoded = OpenSSL::PKCS12.new(pkcs12.to_der, passwd)
+       assert_equal chain.size, decoded.ca_certs.size
+-      assert_include_cert @cacert, decoded.ca_certs
+-      assert_include_cert @inter_cacert, decoded.ca_certs
+-      assert_cert @mycert, decoded.certificate
++      assert_include decoded.ca_certs, @cacert
++      assert_include decoded.ca_certs, @inter_cacert
++      assert_equal @mycert, decoded.certificate
+       assert_equal @mykey.to_der, decoded.key.to_der
+     end
+ 
+@@ -126,8 +130,8 @@ def test_create_with_itr
+         @mykey,
+         @mycert,
+         [],
+-        nil,
+-        nil,
++        DEFAULT_PBE_PKEYS,
++        DEFAULT_PBE_CERTS,
+         2048
+       )
+ 
+@@ -138,8 +142,8 @@ def test_create_with_itr
+           @mykey,
+           @mycert,
+           [],
+-          nil,
+-          nil,
++          DEFAULT_PBE_PKEYS,
++          DEFAULT_PBE_CERTS,
+           "omg"
+         )
+       end
+@@ -152,7 +156,8 @@ def test_create_with_mac_itr
+         @mykey,
+         @mycert,
+         [],
+-        nil,
++        DEFAULT_PBE_PKEYS,
++        DEFAULT_PBE_CERTS,
+         nil,
+         nil,
+         2048
+@@ -165,148 +170,144 @@ def test_create_with_mac_itr
+           @mykey,
+           @mycert,
+           [],
+-          nil,
+-          nil,
++          DEFAULT_PBE_PKEYS,
++          DEFAULT_PBE_CERTS,
+           nil,
+           "omg"
+         )
+       end
+     end
+ 
+-    def test_new_with_one_key_and_one_cert
+-      # generated with:
+-      #   openssl version #=> OpenSSL 1.0.2h  3 May 2016
+-      #   openssl pkcs12 -in <@mycert> -inkey <RSA1024> -export -out <out>
+-      str = <<~EOF.unpack("m").first
+-MIIGQQIBAzCCBgcGCSqGSIb3DQEHAaCCBfgEggX0MIIF8DCCAu8GCSqGSIb3DQEH
+-BqCCAuAwggLcAgEAMIIC1QYJKoZIhvcNAQcBMBwGCiqGSIb3DQEMAQYwDgQIeZPM
+-Rh6KiXgCAggAgIICqL6O+LCZmBzdIg6mozPF3FpY0hVbWHvTNMiDHieW3CrAanhN
+-YCH2/wHqH8WpFpEWwF0qEEXAWjHsIlYB4Cfqo6b7XpuZe5eVESsjNTOTMF1JCUJj
+-A6iNefXmCFLync1JK5LUodRDhTlKLU1WPK20X9X4vuEwHn8wt5RUb8P0E+Xh6rpS
+-XC4LkZKT45zF3cJa/n5+dW65ohVGNVnF9D1bCNEKHMOllK1V9omutQ9slW88hpga
+-LGiFsJoFOb/ESGb78KO+bd6zbX1MdKdBV+WD6t1uF/cgU65y+2A4nXs1urda+MJ7
+-7iVqiB7Vnc9cANTbAkTSGNyoUDVM/NZde782/8IvddLAzUZ2EftoRDke6PvuBOVL
+-ljBhNWmdamrtBqzuzVZCRdWq44KZkF2Xoc9asepwIkdVmntzQF7f1Z+Ta5yg6HFp
+-xnr7CuM+MlHEShXkMgYtHnwAq10fDMSXIvjhi/AA5XUAusDO3D+hbtcRDcJ4uUes
+-dm5dhQE2qJ02Ysn4aH3o1F3RYNOzrxejHJwl0D2TCE8Ww2X342xib57+z9u03ufj
+-jswhiMKxy67f1LhUMq3XrT3uV6kCVXk/KUOUPcXPlPVNA5JmZeFhMp6GrtB5xJJ9
+-wwBZD8UL5A2U2Mxi2OZsdUBv8eo3jnjZ284aFpt+mCjIHrLW5O0jwY8OCwSlYUoY
+-IY00wlabX0s82kBcIQNZbC1RSV2267ro/7A0MClc8YQ/zWN0FKY6apgtUkHJI1cL
+-1dc77mhnjETjwW94iLMDFy4zQfVu7IfCBqOBzygRNnqqUG66UhTs1xFnWM0mWXl/
+-Zh9+AMpbRLIPaKCktIjl5juzzm+KEgkhD+707XRCFIGUYGP5bSHzGaz8PK9hj0u1
+-E2SpZHUvYOcawmxtA7pmpSxl5uQjMIIC+QYJKoZIhvcNAQcBoIIC6gSCAuYwggLi
+-MIIC3gYLKoZIhvcNAQwKAQKgggKmMIICojAcBgoqhkiG9w0BDAEDMA4ECKB338m8
+-qSzHAgIIAASCAoACFhJeqA3xx+s1qIH6udNQYY5hAL6oz7SXoGwFhDiceSyJjmAD
+-Dby9XWM0bPl1Gj5nqdsuI/lAM++fJeoETk+rxw8q6Ofk2zUaRRE39qgpwBwSk44o
+-0SAFJ6bzHpc5CFh6sZmDaUX5Lm9GtjnGFmmsPTSJT5an5JuJ9WczGBEd0nSBQhJq
+-xHbTGZiN8i3SXcIH531Sub+CBIFWy5lyCKgDYh/kgJFGQAaWUOjLI+7dCEESonXn
+-F3Jh2uPbnDF9MGJyAFoNgWFhgSpi1cf6AUi87GY4Oyur88ddJ1o0D0Kz2uw8/bpG
+-s3O4PYnIW5naZ8mozzbnYByEFk7PoTwM7VhoFBfYNtBoAI8+hBnPY/Y71YUojEXf
+-SeX6QbtkIANfzS1XuFNKElShC3DPQIHpKzaatEsfxHfP+8VOav6zcn4mioao7NHA
+-x7Dp6R1enFGoQOq4UNjBT8YjnkG5vW8zQHW2dAHLTJBq6x2Fzm/4Pjo/8vM1FiGl
+-BQdW5vfDeJ/l6NgQm3xR9ka2E2HaDqIcj1zWbN8jy/bHPFJYuF/HH8MBV/ngMIXE
+-vFEW/ToYv8eif0+EpUtzBsCKD4a7qYYYh87RmEVoQU96q6m+UbhpD2WztYfAPkfo
+-OSL9j2QHhVczhL7OAgqNeM95pOsjA9YMe7exTeqK31LYnTX8oH8WJD1xGbRSJYgu
+-SY6PQbumcJkc/TFPn0GeVUpiDdf83SeG50lo/i7UKQi2l1hi5Y51fQhnBnyMr68D
+-llSZEvSWqfDxBJkBpeg6PIYvkTpEwKRJpVQoM3uYvdqVSSnW6rydqIb+snfOrlhd
+-f+xCtq9xr+kHeTSqLIDRRAnMfgFRhY3IBlj6MSUwIwYJKoZIhvcNAQkVMRYEFBdb
+-8XGWehZ6oPj56Pf/uId46M9AMDEwITAJBgUrDgMCGgUABBRvSCB04/f8f13pp2PF
+-vyl2WuMdEwQIMWFFphPkIUICAggA
+-      EOF
+-      p12 = OpenSSL::PKCS12.new(str, "abc123")
+-
+-      assert_equal @mykey.to_der, p12.key.to_der
+-      assert_equal @mycert.subject.to_der, p12.certificate.subject.to_der
+-      assert_equal [], Array(p12.ca_certs)
+-    end
+-
+     def test_new_with_no_keys
+       # generated with:
+-      #   openssl pkcs12 -in <@mycert> -nokeys -export -out <out>
++      #   openssl pkcs12 -certpbe PBE-SHA1-3DES -in <@mycert> -nokeys -export
+       str = <<~EOF.unpack("m").first
+-MIIDHAIBAzCCAuIGCSqGSIb3DQEHAaCCAtMEggLPMIICyzCCAscGCSqGSIb3DQEH
+-BqCCArgwggK0AgEAMIICrQYJKoZIhvcNAQcBMBwGCiqGSIb3DQEMAQYwDgQIX4+W
+-irqwH40CAggAgIICgOaCyo+5+6IOVoGCCL80c50bkkzAwqdXxvkKExJSdcJz2uMU
+-0gRrKnZEjL5wrUsN8RwZu8DvgQTEhNEkKsUgM7AWainmN/EnwohIdHZAHpm6WD67
+-I9kLGp0/DHrqZrV9P2dLfhXLUSQE8PI0tqZPZ8UEABhizkViw4eISTkrOUN7pGbN
+-Qtx/oqgitXDuX2polbxYYDwt9vfHZhykHoKgew26SeJyZfeMs/WZ6olEI4cQUAFr
+-mvYGuC1AxEGTo9ERmU8Pm16j9Hr9PFk50WYe+rnk9oX3wJogQ7XUWS5kYf7XRycd
+-NDkNiwV/ts94bbuaGZp1YA6I48FXpIc8b5fX7t9tY0umGaWy0bARe1L7o0Y89EPe
+-lMg25rOM7j3uPtFG8whbSfdETSy57UxzzTcJ6UwexeaK6wb2jqEmj5AOoPLWeaX0
+-LyOAszR3v7OPAcjIDYZGdrbb3MZ2f2vo2pdQfu9698BrWhXuM7Odh73RLhJVreNI
+-aezNOAtPyBlvGiBQBGTzRIYHSLL5Y5aVj2vWLAa7hjm5qTL5C5mFdDIo6TkEMr6I
+-OsexNQofEGs19kr8nARXDlcbEimk2VsPj4efQC2CEXZNzURsKca82pa62MJ8WosB
+-DTFd8X06zZZ4nED50vLopZvyW4fyW60lELwOyThAdG8UchoAaz2baqP0K4de44yM
+-Y5/yPFDu4+GoimipJfbiYviRwbzkBxYW8+958ILh0RtagLbvIGxbpaym9PqGjOzx
+-ShNXjLK2aAFZsEizQ8kd09quJHU/ogq2cUXdqqhmOqPnUWrJVi/VCoRB3Pv1/lE4
+-mrUgr2YZ11rYvBw6g5XvNvFcSc53OKyV7SLn0dwwMTAhMAkGBSsOAwIaBQAEFEWP
+-1WRQykaoD4uJCpTx/wv0SLLBBAiDKI26LJK7xgICCAA=
++MIIGJAIBAzCCBeoGCSqGSIb3DQEHAaCCBdsEggXXMIIF0zCCBc8GCSqGSIb3
++DQEHBqCCBcAwggW8AgEAMIIFtQYJKoZIhvcNAQcBMBwGCiqGSIb3DQEMAQMw
++DgQIjv5c3OHvnBgCAggAgIIFiMJa8Z/w7errRvCQPXh9dGQz3eJaFq3S2gXD
++rh6oiwsgIRJZvYAWgU6ll9NV7N5SgvS2DDNVuc3tsP8TPWjp+bIxzS9qmGUV
++kYWuURWLMKhpF12ZRDab8jcIwBgKoSGiDJk8xHjx6L613/XcRM6ln3VeQK+C
++hlW5kXniNAUAgTft25Fn61Xa8xnhmsz/fk1ycGnyGjKCnr7Mgy7KV0C1vs23
++18n8+b1ktDWLZPYgpmXuMFVh0o+HJTV3O86mkIhJonMcnOMgKZ+i8KeXaocN
++JQlAPBG4+HOip7FbQT/h6reXv8/J+hgjLfqAb5aV3m03rUX9mXx66nR1tQU0
++Jq+XPfDh5+V4akIczLlMyyo/xZjI1/qupcMjr+giOGnGd8BA3cuXW+ueLQiA
++PpTp+DQLVHRfz9XTZbyqOReNEtEXvO9gOlKSEY5lp65ItXVEs2Oqyf9PfU9y
++DUltN6fCMilwPyyrsIBKXCu2ZLM5h65KVCXAYEX9lNqj9zrQ7vTqvCNN8RhS
++ScYouTX2Eqa4Z+gTZWLHa8RCQFoyP6hd+97/Tg2Gv2UTH0myQxIVcnpdi1wy
++cqb+er7tyKbcO96uSlUjpj/JvjlodtjJcX+oinEqGb/caj4UepbBwiG3vv70
++63bS3jTsOLNjDRsR9if3LxIhLa6DW8zOJiGC+EvMD1o4dzHcGVpQ/pZWCHZC
+++YiNJpQOBApiZluE+UZ0m3XrtHFQYk7xblTrh+FJF91wBsok0rZXLAKd8m4p
++OJsc7quCq3cuHRRTzJQ4nSe01uqbwGDAYwLvi6VWy3svU5qa05eDRmgzEFTG
++e84Gp/1LQCtpQFr4txkjFchO2whWS80KoQKqmLPyGm1D9Lv53Q4ZsKMgNihs
++rEepuaOZMKHl4yMAYFoOXZCAYzfbhN6b2phcFAHjMUHUw9e3F0QuDk9D0tsr
++riYTrkocqlOKfK4QTomx27O0ON2J6f1rtEojGgfl9RNykN7iKGzjS3914QjW
++W6gGiZejxHsDPEAa4gUp0WiSUSXtD5WJgoyAzLydR2dKWsQ4WlaUXi01CuGy
+++xvncSn2nO3bbot8VD5H6XU1CjREVtnIfbeRYO/uofyLUP3olK5RqN6ne6Xo
++eXnJ/bjYphA8NGuuuvuW1SCITmINkZDLC9cGlER9+K65RR/DR3TigkexXMeN
++aJ70ivZYAl0OuhZt3TGIlAzS64TIoyORe3z7Ta1Pp9PZQarYJpF9BBIZIFor
++757PHHuQKRuugiRkp8B7v4eq1BQ+VeAxCKpyZ7XrgEtbY/AWDiaKcGPKPjc3
++AqQraVeQm7kMBT163wFmZArCphzkDOI3bz2oEO8YArMgLq2Vto9jAZlqKyWr
++pi2bSJxuoP1aoD58CHcWMrf8/j1LVdQhKgHQXSik2ID0H2Wc/XnglhzlVFuJ
++JsNIW/EGJlZh/5WDez9U0bXqnBlu3uasPEOezdoKlcCmQlmTO5+uLHYLEtNA
++EH9MtnGZebi9XS5meTuS6z5LILt8O9IHZxmT3JRPHYj287FEzotlLdcJ4Ee5
++enW41UHjLrfv4OaITO1hVuoLRGdzjESx/fHMWmxroZ1nVClxECOdT42zvIYJ
++J3xBZ0gppzQ5fjoYiKjJpxTflRxUuxshk3ih6VUoKtqj/W18tBQ3g5SOlkgT
++yCW8r74yZlfYmNrPyDMUQYpLUPWj2n71GF0KyPfTU5yOatRgvheh262w5BG3
++omFY7mb3tCv8/U2jdMIoukRKacpZiagofz3SxojOJq52cHnCri+gTHBMX0cO
++j58ygfntHWRzst0pV7Ze2X3fdCAJ4DokH6bNJNthcgmolFJ/y3V1tJjgsdtQ
++7Pjn/vE6xUV0HXE2x4yoVYNirbAMIvkN/X+atxrN0dA4AchN+zGp8TAxMCEw
++CQYFKw4DAhoFAAQUQ+6XXkyhf6uYgtbibILN2IjKnOAECLiqoY45MPCrAgII
++AA==
+       EOF
+       p12 = OpenSSL::PKCS12.new(str, "abc123")
+ 
+       assert_equal nil, p12.key
+       assert_equal nil, p12.certificate
+       assert_equal 1, p12.ca_certs.size
+-      assert_equal @mycert.subject.to_der, p12.ca_certs[0].subject.to_der
++      assert_equal @mycert.subject, p12.ca_certs[0].subject
+     end
+ 
+     def test_new_with_no_certs
+       # generated with:
+-      #   openssl pkcs12 -inkey <RSA1024> -nocerts -export -out <out>
++      #   openssl pkcs12 -inkey fixtures/openssl/pkey/rsa-1.pem -nocerts -export
+       str = <<~EOF.unpack("m").first
+-MIIDJwIBAzCCAu0GCSqGSIb3DQEHAaCCAt4EggLaMIIC1jCCAtIGCSqGSIb3DQEH
+-AaCCAsMEggK/MIICuzCCArcGCyqGSIb3DQEMCgECoIICpjCCAqIwHAYKKoZIhvcN
+-AQwBAzAOBAg6AaYnJs84SwICCAAEggKAQzZH+fWSpcQYD1J7PsGSune85A++fLCQ
+-V7tacp2iv95GJkxwYmfTP176pJdgs00mceB9UJ/u9EX5nD0djdjjQjwo6sgKjY0q
+-cpVhZw8CMxw7kBD2dhtui0zT8z5hy03LePxsjEKsGiSbeVeeGbSfw/I6AAYbv+Uh
+-O/YPBGumeHj/D2WKnfsHJLQ9GAV3H6dv5VKYNxjciK7f/JEyZCuUQGIN64QFHDhJ
+-7fzLqd/ul3FZzJZO6a+dwvcgux09SKVXDRSeFmRCEX4b486iWhJJVspCo9P2KNne
+-ORrpybr3ZSwxyoICmjyo8gj0OSnEfdx9790Ej1takPqSA1wIdSdBLekbZqB0RBQg
+-DEuPOsXNo3QFi8ji1vu0WBRJZZSNC2hr5NL6lNR+DKxG8yzDll2j4W4BBIp22mAE
+-7QRX7kVxu17QJXQhOUac4Dd1qXmzebP8t6xkAxD9L7BWEN5OdiXWwSWGjVjMBneX
+-nYObi/3UT/aVc5WHMHK2BhCI1bwH51E6yZh06d5m0TQpYGUTWDJdWGBSrp3A+8jN
+-N2PMQkWBFrXP3smHoTEN4oZC4FWiPsIEyAkQsfKRhcV9lGKl2Xgq54ROTFLnwKoj
+-Z3zJScnq9qmNzvVZSMmDLkjLyDq0pxRxGKBvgouKkWY7VFFIwwBIJM39iDJ5NbBY
+-i1AQFTRsRSsZrNVPasCXrIq7bhMoJZb/YZOGBLNyJVqKUoYXhtwsajzSq54VlWft
+-JxsPayEd4Vi6O9EU1ahnj6qFEZiKFzsicgK2J1Rb8cYagrp0XWjHW0SBn5GVUWCg
+-GUokSFG/0JTdeYTo/sQuG4qNgJkOolRjpeI48Fciq5VUWLvVdKioXzAxMCEwCQYF
+-Kw4DAhoFAAQUYAuwVtGD1TdgbFK4Yal2XBgwUR4ECEawsN3rNaa6AgIIAA==
++MIIJ7wIBAzCCCbUGCSqGSIb3DQEHAaCCCaYEggmiMIIJnjCCCZoGCSqGSIb3
++DQEHAaCCCYsEggmHMIIJgzCCCX8GCyqGSIb3DQEMCgECoIIJbjCCCWowHAYK
++KoZIhvcNAQwBAzAOBAjX5nN8jyRKwQICCAAEgglIBIRLHfiY1mNHpl3FdX6+
++72L+ZOVXnlZ1MY9HSeg0RMkCJcm0mJ2UD7INUOGXvwpK9fr6WJUZM1IqTihQ
++1dM0crRC2m23aP7KtAlXh2DYD3otseDtwoN/NE19RsiJzeIiy5TSW1d47weU
+++D4Ig/9FYVFPTDgMzdCxXujhvO/MTbZIjqtcS+IOyF+91KkXrHkfkGjZC7KS
++WRmYw9BBuIPQEewdTI35sAJcxT8rK7JIiL/9mewbSE+Z28Wq1WXwmjL3oZm9
++lw6+f515b197GYEGomr6LQqJJamSYpwQbTGHonku6Tf3ylB4NLFqOnRCKE4K
++zRSSYIqJBlKHmQ4pDm5awoupHYxMZLZKZvXNYyYN3kV8r1iiNVlY7KBR4CsX
++rqUkXehRmcPnuqEMW8aOpuYe/HWf8PYI93oiDZjcEZMwW2IZFFrgBbqUeNCM
++CQTkjAYxi5FyoaoTnHrj/aRtdLOg1xIJe4KKcmOXAVMmVM9QEPNfUwiXJrE7
++n42gl4NyzcZpxqwWBT++9TnQGZ/lEpwR6dzkZwICNQLdQ+elsdT7mumywP+1
++WaFqg9kpurimaiBu515vJNp9Iqv1Nmke6R8Lk6WVRKPg4Akw0fkuy6HS+LyN
++ofdCfVUkPGN6zkjAxGZP9ZBwvXUbLRC5W3N5qZuAy5WcsS75z+oVeX9ePV63
++cue23sClu8JSJcw3HFgPaAE4sfkQ4MoihPY5kezgT7F7Lw/j86S0ebrDNp4N
++Y685ec81NRHJ80CAM55f3kGCOEhoifD4VZrvr1TdHZY9Gm3b1RYaJCit2huF
++nlOfzeimdcv/tkjb6UsbpXx3JKkF2NFFip0yEBERRCdWRYMUpBRcl3ad6XHy
++w0pVTgIjTxGlbbtOCi3siqMOK0GNt6UgjoEFc1xqjsgLwU0Ta2quRu7RFPGM
++GoEwoC6VH23p9Hr4uTFOL0uHfkKWKunNN+7YPi6LT6IKmTQwrp+fTO61N6Xh
++KlqTpwESKsIJB2iMnc8wBkjXJtmG/e2n5oTqfhICIrxYmEb7zKDyK3eqeTj3
++FhQh2t7cUIiqcT52AckUqniPmlE6hf82yBjhaQUPfi/ExTBtTDSmFfRPUzq+
++Rlla4OHllPRzUXJExyansgCxZbPqlw46AtygSWRGcWoYAKUKwwoYjerqIV5g
++JoZICV9BOU9TXco1dHXZQTs/nnTwoRmYiL/Ly5XpvUAnQOhYeCPjBeFnPSBR
++R/hRNqrDH2MOV57v5KQIH2+mvy26tRG+tVGHmLMaOJeQkjLdxx+az8RfXIrH
++7hpAsoBb+g9jUDY1mUVavPk1T45GMpQH8u3kkzRvChfOst6533GyIZhE7FhN
++KanC6ACabVFDUs6P9pK9RPQMp1qJfpA0XJFx5TCbVbPkvnkZd8K5Tl/tzNM1
++n32eRao4MKr9KDwoDL93S1yJgYTlYjy1XW/ewdedtX+B4koAoz/wSXDYO+GQ
++Zu6ZSpKSEHTRPhchsJ4oICvpriVaJkn0/Z7H3YjNMB9U5RR9+GiIg1wY1Oa1
++S3WfuwrrI6eqfbQwj6PDNu3IKy6srEgvJwaofQALNBPSYWbauM2brc8qsD+t
++n8jC/aD1aMcy00+9t3H/RVCjEOb3yKfUpAldIkEA2NTTnZpoDQDXeNYU2F/W
++yhmFjJy8A0O4QOk2xnZK9kcxSRs0v8vI8HivvgWENoVPscsDC4742SSIe6SL
++f/T08reIX11f0K70rMtLhtFMQdHdYOTNl6JzhkHPLr/f9MEZsBEQx52depnF
++ARb3gXGbCt7BAi0OeCEBSbLr2yWuW4r55N0wRZSOBtgqgjsiHP7CDQSkbL6p
++FPlQS1do9gBSHiNYvsmN1LN5bG+mhcVb0UjZub4mL0EqGadjDfDdRJmWqlX0
++r5dyMcOWQVy4O2cPqYFlcP9lk8buc5otcyVI2isrAFdlvBK29oK6jc52Aq5Q
++0b2ESDlgX8WRgiOPPxK8dySKEeuIwngCtJyNTecP9Ug06TDsu0znZGCXJ+3P
++8JOpykgA8EQdOZOYHbo76ZfB2SkklI5KeRA5IBjGs9G3TZ4PHLy2DIwsbWzS
++H1g01o1x264nx1cJ+eEgUN/KIiGFIib42RS8Af4D5e+Vj54Rt3axq+ag3kI+
++53p8uotyu+SpvvXUP7Kv4xpQ/L6k41VM0rfrd9+DrlDVvSfxP2uh6I1TKF7A
++CT5n8zguMbng4PGjxvyPBM5k62t6hN5fuw6Af0aZFexh+IjB/5wFQ6onSz23
++fBzMW4St7RgSs8fDg3lrM+5rwXiey1jxY1ddaxOoUsWRMvvdd7rZxRZQoN5v
++AcI5iMkK/vvpQgC/sfzhtXtrJ2XOPZ+GVgi7VcuDLKSkdFMcPbGzO8SdxUnS
++SLV5XTKqKND+Lrfx7DAoKi5wbDFHu5496/MHK5qP4tBe6sJ5bZc+KDJIH46e
++wTV1oWtB5tV4q46hOb5WRcn/Wjz3HSKaGZgx5QbK1MfKTzD5CTUn+ArMockX
++2wJhPnFK85U4rgv8iBuh9bRjyw+YaKf7Z3loXRiE1eRG6RzuPF0ZecFiDumk
++AC/VUXynJhzePBLqzrQj0exanACdullN+pSfHiRWBxR2VFUkjoFP5X45GK3z
++OstSH6FOkMVU4afqEmjsIwozDFIyin5EyWTtdhJe3szdJSGY23Tut+9hUatx
++9FDFLESOd8z3tyQSNiLk/Hib+e/lbjxqbXBG/p/oyvP3N999PLUPtpKqtYkV
++H0+18sNh9CVfojiJl44fzxe8yCnuefBjut2PxEN0EFRBPv9P2wWlmOxkPKUq
++NrCJP0rDj5aONLrNZPrR8bZNdIShkZ/rKkoTuA0WMZ+xUlDRxAupdMkWAlrz
++8IcwNcdDjPnkGObpN5Ctm3vK7UGSBmPeNqkXOYf3QTJ9gStJEd0F6+DzTN5C
++KGt1IyuGwZqL2Yk51FDIIkr9ykEnBMaA39LS7GFHEDNGlW+fKC7AzA0zfoOr
++fXZlHMBuqHtXqk3zrsHRqGGoocigg4ctrhD1UREYKj+eIj1TBiRdf7c6+COf
++NIOmej8pX3FmZ4ui+dDA8r2ctgsWHrb4A6iiH+v1DRA61GtoaA/tNRggewXW
++VXCZCGWyyTuyHGOqq5ozrv5MlzZLWD/KV/uDsAWmy20RAed1C4AzcXlpX25O
++M4SNl47g5VRNJRtMqokc8j6TjZrzMDEwITAJBgUrDgMCGgUABBRrkIRuS5qg
++BC8fv38mue8LZVcbHQQIUNrWKEnskCoCAggA
+       EOF
+       p12 = OpenSSL::PKCS12.new(str, "abc123")
+ 
+-      assert_equal @mykey.to_der, p12.key.to_der
++      assert_equal Fixtures.pkey("rsa-1").to_der, p12.key.to_der
+       assert_equal nil, p12.certificate
+       assert_equal [], Array(p12.ca_certs)
+     end
+ 
+     def test_dup
+-      p12 = OpenSSL::PKCS12.create("pass", "name", @mykey, @mycert)
++      p12 = OpenSSL::PKCS12.create(
++        "pass",
++        "name",
++        @mykey,
++        @mycert,
++        nil,
++        DEFAULT_PBE_PKEYS,
++        DEFAULT_PBE_CERTS,
++      )
+       assert_equal p12.to_der, p12.dup.to_der
+     end
+-
+-    private
+-    def assert_cert expected, actual
+-      [
+-        :subject,
+-        :issuer,
+-        :serial,
+-        :not_before,
+-        :not_after,
+-      ].each do |attribute|
+-        assert_equal expected.send(attribute), actual.send(attribute)
+-      end
+-      assert_equal expected.to_der, actual.to_der
+-    end
+-
+-    def assert_include_cert cert, ary
+-      der = cert.to_der
+-      ary.each do |candidate|
+-        if candidate.to_der == der
+-          return true
+-        end
+-      end
+-      false
+-    end
+   end
+ end
+ 
+-- 
+2.32.0
+

SOURCES/ruby-3.1.0-test-openssl-test_pkey-use-EC-keys-for-PKey.generate.patch

@@ -0,0 +1,67 @@
+From 10d2216b2f35a31777a099d9f765b0b6ea34a63e Mon Sep 17 00:00:00 2001
+From: Kazuki Yamaguchi <k@rhe.jp>
+Date: Mon, 18 May 2020 02:35:35 +0900
+Subject: [PATCH] test/openssl/test_pkey: use EC keys for
+ PKey.generate_parameters tests
+
+OpenSSL 3.0 refuses to generate DSA parameters shorter than 2048 bits,
+but generating 2048 bits parameters takes very long time. Let's use EC
+in these test cases instead.
+---
+ test/openssl/test_pkey.rb | 27 +++++++++++----------------
+ 1 file changed, 11 insertions(+), 16 deletions(-)
+
+diff --git a/test/openssl/test_pkey.rb b/test/openssl/test_pkey.rb
+index 3630458b3c..88a6e04581 100644
+--- a/test/openssl/test_pkey.rb
++++ b/test/openssl/test_pkey.rb
+@@ -27,20 +27,16 @@ def test_generic_oid_inspect
+   end
+ 
+   def test_s_generate_parameters
+-    # 512 is non-default; 1024 is used if 'dsa_paramgen_bits' is not specified
+-    # with OpenSSL 1.1.0.
+-    pkey = OpenSSL::PKey.generate_parameters("DSA", {
+-      "dsa_paramgen_bits" => 512,
+-      "dsa_paramgen_q_bits" => 256,
++    pkey = OpenSSL::PKey.generate_parameters("EC", {
++      "ec_paramgen_curve" => "secp384r1",
+     })
+-    assert_instance_of OpenSSL::PKey::DSA, pkey
+-    assert_equal 512, pkey.p.num_bits
+-    assert_equal 256, pkey.q.num_bits
+-    assert_equal nil, pkey.priv_key
++    assert_instance_of OpenSSL::PKey::EC, pkey
++    assert_equal "secp384r1", pkey.group.curve_name
++    assert_equal nil, pkey.private_key
+ 
+     # Invalid options are checked
+     assert_raise(OpenSSL::PKey::PKeyError) {
+-      OpenSSL::PKey.generate_parameters("DSA", "invalid" => "option")
++      OpenSSL::PKey.generate_parameters("EC", "invalid" => "option")
+     }
+ 
+     # Parameter generation callback is called
+@@ -59,14 +55,13 @@ def test_s_generate_key
+       # DSA key pair cannot be generated without parameters
+       OpenSSL::PKey.generate_key("DSA")
+     }
+-    pkey_params = OpenSSL::PKey.generate_parameters("DSA", {
+-      "dsa_paramgen_bits" => 512,
+-      "dsa_paramgen_q_bits" => 256,
++    pkey_params = OpenSSL::PKey.generate_parameters("EC", {
++      "ec_paramgen_curve" => "secp384r1",
+     })
+     pkey = OpenSSL::PKey.generate_key(pkey_params)
+-    assert_instance_of OpenSSL::PKey::DSA, pkey
+-    assert_equal 512, pkey.p.num_bits
+-    assert_not_equal nil, pkey.priv_key
++    assert_instance_of OpenSSL::PKey::EC, pkey
++    assert_equal "secp384r1", pkey.group.curve_name
++    assert_not_equal nil, pkey.private_key
+   end
+ 
+   def test_hmac_sign_verify
+-- 
+2.32.0
+

SOURCES/ruby-3.1.0-test-openssl-test_ssl-relax-regex-to-match-OpenSSL-s.patch

@@ -0,0 +1,31 @@
+From 05fd14aea7eff2a6911a6f529f1237276482c6e7 Mon Sep 17 00:00:00 2001
+From: Kazuki Yamaguchi <k@rhe.jp>
+Date: Fri, 10 Jul 2020 13:56:38 +0900
+Subject: [PATCH] test/openssl/test_ssl: relax regex to match OpenSSL's error
+ message
+
+OpenSSL 3.0 slightly changed the error message for a certificate
+verification failure when an untrusted self-signed certificate is found
+in the chain.
+---
+ test/openssl/test_ssl.rb | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/test/openssl/test_ssl.rb b/test/openssl/test_ssl.rb
+index 6095d545b5..9e9b8b9b69 100644
+--- a/test/openssl/test_ssl.rb
++++ b/test/openssl/test_ssl.rb
+@@ -964,7 +964,9 @@ def test_connect_certificate_verify_failed_exception_message
+     start_server(ignore_listener_error: true) { |port|
+       ctx = OpenSSL::SSL::SSLContext.new
+       ctx.set_params
+-      assert_raise_with_message(OpenSSL::SSL::SSLError, /self signed/) {
++      # OpenSSL <= 1.1.0: "self signed certificate in certificate chain"
++      # OpenSSL >= 3.0.0: "self-signed certificate in certificate chain"
++      assert_raise_with_message(OpenSSL::SSL::SSLError, /self.signed/) {
+         server_connect(port, ctx)
+       }
+     }
+-- 
+2.32.0
+

SOURCES/ruby-3.1.0-test-openssl-utils-remove-dup_public-helper-method.patch

@@ -0,0 +1,265 @@
+From 2c6797bc97d7c92284dc3c0ed27f97ace4e5cfb9 Mon Sep 17 00:00:00 2001
+From: Kazuki Yamaguchi <k@rhe.jp>
+Date: Mon, 31 May 2021 11:44:05 +0900
+Subject: [PATCH] test/openssl/utils: remove dup_public helper method
+
+It uses deprecated PKey::{RSA,DSA,DH}#set_* methods, which will not
+work with OpenSSL 3.0. The same can easily be achieved using
+PKey#public_to_der regardless of the key kind.
+---
+ test/openssl/test_pkey_dh.rb  |  8 +++++---
+ test/openssl/test_pkey_dsa.rb | 15 +++++++++++----
+ test/openssl/test_pkey_ec.rb  | 15 +++++++++++----
+ test/openssl/test_pkey_rsa.rb | 31 +++++++++++++++++--------------
+ test/openssl/utils.rb         | 26 --------------------------
+ 5 files changed, 44 insertions(+), 51 deletions(-)
+
+diff --git a/test/openssl/test_pkey_dh.rb b/test/openssl/test_pkey_dh.rb
+index f80af8f841..757704caf6 100644
+--- a/test/openssl/test_pkey_dh.rb
++++ b/test/openssl/test_pkey_dh.rb
+@@ -40,12 +40,14 @@ def test_derive_key
+ 
+   def test_DHparams
+     dh1024 = Fixtures.pkey("dh1024")
++    dh1024params = dh1024.public_key
++
+     asn1 = OpenSSL::ASN1::Sequence([
+       OpenSSL::ASN1::Integer(dh1024.p),
+       OpenSSL::ASN1::Integer(dh1024.g)
+     ])
+     key = OpenSSL::PKey::DH.new(asn1.to_der)
+-    assert_same_dh dup_public(dh1024), key
++    assert_same_dh dh1024params, key
+ 
+     pem = <<~EOF
+     -----BEGIN DH PARAMETERS-----
+@@ -55,9 +57,9 @@ def test_DHparams
+     -----END DH PARAMETERS-----
+     EOF
+     key = OpenSSL::PKey::DH.new(pem)
+-    assert_same_dh dup_public(dh1024), key
++    assert_same_dh dh1024params, key
+     key = OpenSSL::PKey.read(pem)
+-    assert_same_dh dup_public(dh1024), key
++    assert_same_dh dh1024params, key
+ 
+     assert_equal asn1.to_der, dh1024.to_der
+     assert_equal pem, dh1024.export
+diff --git a/test/openssl/test_pkey_dsa.rb b/test/openssl/test_pkey_dsa.rb
+index 147e50176b..0994607f21 100644
+--- a/test/openssl/test_pkey_dsa.rb
++++ b/test/openssl/test_pkey_dsa.rb
+@@ -138,6 +138,8 @@ def test_DSAPrivateKey_encrypted
+ 
+   def test_PUBKEY
+     dsa512 = Fixtures.pkey("dsa512")
++    dsa512pub = OpenSSL::PKey::DSA.new(dsa512.public_to_der)
++
+     asn1 = OpenSSL::ASN1::Sequence([
+       OpenSSL::ASN1::Sequence([
+         OpenSSL::ASN1::ObjectId("DSA"),
+@@ -153,7 +155,7 @@ def test_PUBKEY
+     ])
+     key = OpenSSL::PKey::DSA.new(asn1.to_der)
+     assert_not_predicate key, :private?
+-    assert_same_dsa dup_public(dsa512), key
++    assert_same_dsa dsa512pub, key
+ 
+     pem = <<~EOF
+     -----BEGIN PUBLIC KEY-----
+@@ -166,10 +168,15 @@ def test_PUBKEY
+     -----END PUBLIC KEY-----
+     EOF
+     key = OpenSSL::PKey::DSA.new(pem)
+-    assert_same_dsa dup_public(dsa512), key
++    assert_same_dsa dsa512pub, key
++
++    assert_equal asn1.to_der, key.to_der
++    assert_equal pem, key.export
+ 
+-    assert_equal asn1.to_der, dup_public(dsa512).to_der
+-    assert_equal pem, dup_public(dsa512).export
++    assert_equal asn1.to_der, dsa512.public_to_der
++    assert_equal asn1.to_der, key.public_to_der
++    assert_equal pem, dsa512.public_to_pem
++    assert_equal pem, key.public_to_pem
+   end
+ 
+   def test_read_DSAPublicKey_pem
+diff --git a/test/openssl/test_pkey_ec.rb b/test/openssl/test_pkey_ec.rb
+index 4b6df0290f..d62f1b5eb8 100644
+--- a/test/openssl/test_pkey_ec.rb
++++ b/test/openssl/test_pkey_ec.rb
+@@ -210,6 +210,8 @@ def test_ECPrivateKey_encrypted
+ 
+   def test_PUBKEY
+     p256 = Fixtures.pkey("p256")
++    p256pub = OpenSSL::PKey::EC.new(p256.public_to_der)
++
+     asn1 = OpenSSL::ASN1::Sequence([
+       OpenSSL::ASN1::Sequence([
+         OpenSSL::ASN1::ObjectId("id-ecPublicKey"),
+@@ -221,7 +223,7 @@ def test_PUBKEY
+     ])
+     key = OpenSSL::PKey::EC.new(asn1.to_der)
+     assert_not_predicate key, :private?
+-    assert_same_ec dup_public(p256), key
++    assert_same_ec p256pub, key
+ 
+     pem = <<~EOF
+     -----BEGIN PUBLIC KEY-----
+@@ -230,10 +232,15 @@ def test_PUBKEY
+     -----END PUBLIC KEY-----
+     EOF
+     key = OpenSSL::PKey::EC.new(pem)
+-    assert_same_ec dup_public(p256), key
++    assert_same_ec p256pub, key
++
++    assert_equal asn1.to_der, key.to_der
++    assert_equal pem, key.export
+ 
+-    assert_equal asn1.to_der, dup_public(p256).to_der
+-    assert_equal pem, dup_public(p256).export
++    assert_equal asn1.to_der, p256.public_to_der
++    assert_equal asn1.to_der, key.public_to_der
++    assert_equal pem, p256.public_to_pem
++    assert_equal pem, key.public_to_pem
+   end
+ 
+   def test_ec_group
+diff --git a/test/openssl/test_pkey_rsa.rb b/test/openssl/test_pkey_rsa.rb
+index 5e127f5407..4548bdb2cf 100644
+--- a/test/openssl/test_pkey_rsa.rb
++++ b/test/openssl/test_pkey_rsa.rb
+@@ -201,7 +201,7 @@ def test_sign_verify_pss
+ 
+   def test_encrypt_decrypt
+     rsapriv = Fixtures.pkey("rsa-1")
+-    rsapub = dup_public(rsapriv)
++    rsapub = OpenSSL::PKey.read(rsapriv.public_to_der)
+ 
+     # Defaults to PKCS #1 v1.5
+     raw = "data"
+@@ -216,7 +216,7 @@ def test_encrypt_decrypt
+ 
+   def test_encrypt_decrypt_legacy
+     rsapriv = Fixtures.pkey("rsa-1")
+-    rsapub = dup_public(rsapriv)
++    rsapub = OpenSSL::PKey.read(rsapriv.public_to_der)
+ 
+     # Defaults to PKCS #1 v1.5
+     raw = "data"
+@@ -346,13 +346,15 @@ def test_RSAPrivateKey_encrypted
+ 
+   def test_RSAPublicKey
+     rsa1024 = Fixtures.pkey("rsa1024")
++    rsa1024pub = OpenSSL::PKey::RSA.new(rsa1024.public_to_der)
++
+     asn1 = OpenSSL::ASN1::Sequence([
+       OpenSSL::ASN1::Integer(rsa1024.n),
+       OpenSSL::ASN1::Integer(rsa1024.e)
+     ])
+     key = OpenSSL::PKey::RSA.new(asn1.to_der)
+     assert_not_predicate key, :private?
+-    assert_same_rsa dup_public(rsa1024), key
++    assert_same_rsa rsa1024pub, key
+ 
+     pem = <<~EOF
+     -----BEGIN RSA PUBLIC KEY-----
+@@ -362,11 +364,13 @@ def test_RSAPublicKey
+     -----END RSA PUBLIC KEY-----
+     EOF
+     key = OpenSSL::PKey::RSA.new(pem)
+-    assert_same_rsa dup_public(rsa1024), key
++    assert_same_rsa rsa1024pub, key
+   end
+ 
+   def test_PUBKEY
+     rsa1024 = Fixtures.pkey("rsa1024")
++    rsa1024pub = OpenSSL::PKey::RSA.new(rsa1024.public_to_der)
++
+     asn1 = OpenSSL::ASN1::Sequence([
+       OpenSSL::ASN1::Sequence([
+         OpenSSL::ASN1::ObjectId("rsaEncryption"),
+@@ -381,7 +385,7 @@ def test_PUBKEY
+     ])
+     key = OpenSSL::PKey::RSA.new(asn1.to_der)
+     assert_not_predicate key, :private?
+-    assert_same_rsa dup_public(rsa1024), key
++    assert_same_rsa rsa1024pub, key
+ 
+     pem = <<~EOF
+     -----BEGIN PUBLIC KEY-----
+@@ -392,10 +396,15 @@ def test_PUBKEY
+     -----END PUBLIC KEY-----
+     EOF
+     key = OpenSSL::PKey::RSA.new(pem)
+-    assert_same_rsa dup_public(rsa1024), key
++    assert_same_rsa rsa1024pub, key
++
++    assert_equal asn1.to_der, key.to_der
++    assert_equal pem, key.export
+ 
+-    assert_equal asn1.to_der, dup_public(rsa1024).to_der
+-    assert_equal pem, dup_public(rsa1024).export
++    assert_equal asn1.to_der, rsa1024.public_to_der
++    assert_equal asn1.to_der, key.public_to_der
++    assert_equal pem, rsa1024.public_to_pem
++    assert_equal pem, key.public_to_pem
+   end
+ 
+   def test_pem_passwd
+@@ -482,12 +491,6 @@ def test_private_encoding_encrypted
+     assert_same_rsa rsa1024, OpenSSL::PKey.read(pem, "abcdef")
+   end
+ 
+-  def test_public_encoding
+-    rsa1024 = Fixtures.pkey("rsa1024")
+-    assert_equal dup_public(rsa1024).to_der, rsa1024.public_to_der
+-    assert_equal dup_public(rsa1024).to_pem, rsa1024.public_to_pem
+-  end
+-
+   def test_dup
+     key = Fixtures.pkey("rsa1024")
+     key2 = key.dup
+diff --git a/test/openssl/utils.rb b/test/openssl/utils.rb
+index c1d737b2ab..f664bd3074 100644
+--- a/test/openssl/utils.rb
++++ b/test/openssl/utils.rb
+@@ -313,32 +313,6 @@ def check_component(base, test, keys)
+       assert_equal base.send(comp), test.send(comp)
+     }
+   end
+-
+-  def dup_public(key)
+-    case key
+-    when OpenSSL::PKey::RSA
+-      rsa = OpenSSL::PKey::RSA.new
+-      rsa.set_key(key.n, key.e, nil)
+-      rsa
+-    when OpenSSL::PKey::DSA
+-      dsa = OpenSSL::PKey::DSA.new
+-      dsa.set_pqg(key.p, key.q, key.g)
+-      dsa.set_key(key.pub_key, nil)
+-      dsa
+-    when OpenSSL::PKey::DH
+-      dh = OpenSSL::PKey::DH.new
+-      dh.set_pqg(key.p, nil, key.g)
+-      dh
+-    else
+-      if defined?(OpenSSL::PKey::EC) && OpenSSL::PKey::EC === key
+-        ec = OpenSSL::PKey::EC.new(key.group)
+-        ec.public_key = key.public_key
+-        ec
+-      else
+-        raise "unknown key type"
+-      end
+-    end
+-  end
+ end
+ 
+ module OpenSSL::Certs
+-- 
+2.32.0
+

SOURCES/ruby-3.1.1-ossl_ocsp-use-null.patch

@@ -0,0 +1,31 @@
+--- ext/openssl/ossl_ocsp.c.orig	2022-04-07 16:40:13.263752886 +0200
++++ ext/openssl/ossl_ocsp.c	2022-04-07 16:45:56.818971187 +0200
+@@ -382,7 +382,7 @@
+     if (!NIL_P(flags))
+ 	flg = NUM2INT(flags);
+     if (NIL_P(digest))
+-	md = EVP_sha1();
++	md = NULL;
+     else
+ 	md = ossl_evp_get_digestbyname(digest);
+     if (NIL_P(certs))
+@@ -1033,7 +1033,7 @@
+     if (!NIL_P(flags))
+ 	flg = NUM2INT(flags);
+     if (NIL_P(digest))
+-	md = EVP_sha1();
++	md = NULL;
+     else
+ 	md = ossl_evp_get_digestbyname(digest);
+     if (NIL_P(certs))
+--- test/openssl/test_ocsp.rb.orig      2022-04-08 08:20:31.400739869 +0200
++++ test/openssl/test_ocsp.rb   2022-04-08 08:20:37.208727488 +0200
+@@ -99,7 +99,7 @@
+     request.sign(@cert, @cert_key, [@ca_cert], 0)
+     asn1 = OpenSSL::ASN1.decode(request.to_der)
+     assert_equal cid.to_der, asn1.value[0].value.find { |a| a.tag_class == :UNIVERSAL }.value[0].value[0].to_der
+-    assert_equal OpenSSL::ASN1.ObjectId("sha1WithRSAEncryption").to_der, asn1.value[1].value[0].value[0].value[0].to_der
++    assert_equal OpenSSL::ASN1.ObjectId("sha256WithRSAEncryption").to_der, asn1.value[1].value[0].value[0].value[0].to_der
+     assert_equal @cert.to_der, asn1.value[1].value[0].value[2].value[0].value[0].to_der
+     assert_equal @ca_cert.to_der, asn1.value[1].value[0].value[2].value[0].value[1].to_der
+     assert_equal asn1.to_der, OpenSSL::OCSP::Request.new(asn1.to_der).to_der

SOURCES/ruby-3.1.2-ossl-tests-replace-sha1.patch

@@ -0,0 +1,647 @@
+diff --git a/ext/openssl/extconf.rb b/ext/openssl/extconf.rb
+index fedcb93..53ad621 100644
+--- a/ext/openssl/extconf.rb
++++ b/ext/openssl/extconf.rb
+@@ -174,6 +174,7 @@ have_func("SSL_CTX_set_post_handshake_auth")
+ 
+ # added in 1.1.1
+ have_func("EVP_PKEY_check")
++have_func("SSL_CTX_set_ciphersuites")
+  
+ # added in 3.0.0
+ have_func("TS_VERIFY_CTX_set_certs(NULL, NULL)", "openssl/ts.h")
+diff --git a/ext/openssl/ossl.h b/ext/openssl/ossl.h
+index 4b51268..2ab8aea 100644
+--- a/ext/openssl/ossl.h
++++ b/ext/openssl/ossl.h
+@@ -43,13 +43,13 @@
+ #ifndef LIBRESSL_VERSION_NUMBER
+ # define OSSL_IS_LIBRESSL 0
+ # define OSSL_OPENSSL_PREREQ(maj, min, pat) \
+-      (OPENSSL_VERSION_NUMBER >= (maj << 28) | (min << 20) | (pat << 12))
++      (OPENSSL_VERSION_NUMBER >= ((maj << 28) | (min << 20) | (pat << 12)))
+ # define OSSL_LIBRESSL_PREREQ(maj, min, pat) 0
+ #else
+ # define OSSL_IS_LIBRESSL 1
+ # define OSSL_OPENSSL_PREREQ(maj, min, pat) 0
+ # define OSSL_LIBRESSL_PREREQ(maj, min, pat) \
+-      (LIBRESSL_VERSION_NUMBER >= (maj << 28) | (min << 20) | (pat << 12))
++      (LIBRESSL_VERSION_NUMBER >= ((maj << 28) | (min << 20) | (pat << 12)))
+ #endif
+ 
+ #if !defined(OPENSSL_NO_ENGINE) && !OSSL_OPENSSL_PREREQ(3, 0, 0)
+diff --git a/ext/openssl/ossl_asn1.c b/ext/openssl/ossl_asn1.c
+index a61d3ee..0d3fa9a 100644
+--- a/ext/openssl/ossl_asn1.c
++++ b/ext/openssl/ossl_asn1.c
+@@ -1510,7 +1510,7 @@ Init_ossl_asn1(void)
+      *
+      * An Array that stores the name of a given tag number. These names are
+      * the same as the name of the tag constant that is additionally defined,
+-     * e.g. UNIVERSAL_TAG_NAME[2] = "INTEGER" and OpenSSL::ASN1::INTEGER = 2.
++     * e.g. <tt>UNIVERSAL_TAG_NAME[2] = "INTEGER"</tt> and <tt>OpenSSL::ASN1::INTEGER = 2</tt>.
+      *
+      * == Example usage
+      *
+diff --git a/ext/openssl/ossl_pkey.c b/ext/openssl/ossl_pkey.c
+index 2a4835a..24d0da4 100644
+--- a/ext/openssl/ossl_pkey.c
++++ b/ext/openssl/ossl_pkey.c
+@@ -649,7 +649,7 @@ ossl_pkey_export_traditional(int argc, VALUE *argv, VALUE self, int to_der)
+ 	}
+     }
+     else {
+-#if OPENSSL_VERSION_NUMBER >= 0x10100000 && !defined(LIBRESSL_VERSION_NUMBER)
++#if OSSL_OPENSSL_PREREQ(1, 1, 0) || OSSL_LIBRESSL_PREREQ(3, 5, 0)
+ 	if (!PEM_write_bio_PrivateKey_traditional(bio, pkey, enc, NULL, 0,
+ 						  ossl_pem_passwd_cb,
+ 						  (void *)pass)) {
+diff --git a/ext/openssl/ossl_ssl.c b/ext/openssl/ossl_ssl.c
+index 9a0682a..af262d9 100644
+--- a/ext/openssl/ossl_ssl.c
++++ b/ext/openssl/ossl_ssl.c
+@@ -1025,27 +1025,13 @@ ossl_sslctx_get_ciphers(VALUE self)
+     return ary;
+ }
+ 
+-/*
+- * call-seq:
+- *    ctx.ciphers = "cipher1:cipher2:..."
+- *    ctx.ciphers = [name, ...]
+- *    ctx.ciphers = [[name, version, bits, alg_bits], ...]
+- *
+- * Sets the list of available cipher suites for this context.  Note in a server
+- * context some ciphers require the appropriate certificates.  For example, an
+- * RSA cipher suite can only be chosen when an RSA certificate is available.
+- */
+ static VALUE
+-ossl_sslctx_set_ciphers(VALUE self, VALUE v)
++build_cipher_string(VALUE v)
+ {
+-    SSL_CTX *ctx;
+     VALUE str, elem;
+     int i;
+ 
+-    rb_check_frozen(self);
+-    if (NIL_P(v))
+-	return v;
+-    else if (RB_TYPE_P(v, T_ARRAY)) {
++    if (RB_TYPE_P(v, T_ARRAY)) {
+         str = rb_str_new(0, 0);
+         for (i = 0; i < RARRAY_LEN(v); i++) {
+             elem = rb_ary_entry(v, i);
+@@ -1059,14 +1059,67 @@ ossl_sslctx_set_ciphers(VALUE self, VALUE v)
+         StringValue(str);
+     }
+ 
++    return str;
++}
++
++/*
++ * call-seq:
++ *    ctx.ciphers = "cipher1:cipher2:..."
++ *    ctx.ciphers = [name, ...]
++ *    ctx.ciphers = [[name, version, bits, alg_bits], ...]
++ *
++ * Sets the list of available cipher suites for this context.  Note in a server
++ * context some ciphers require the appropriate certificates.  For example, an
++ * RSA cipher suite can only be chosen when an RSA certificate is available.
++ */
++static VALUE
++ossl_sslctx_set_ciphers(VALUE self, VALUE v)
++{
++    SSL_CTX *ctx;
++    VALUE str;
++
++    rb_check_frozen(self);
++    if (NIL_P(v))
++        return v;
++
++    str = build_cipher_string(v);
++
+     GetSSLCTX(self, ctx);
+-    if (!SSL_CTX_set_cipher_list(ctx, StringValueCStr(str))) {
++    if (!SSL_CTX_set_cipher_list(ctx, StringValueCStr(str)))
+         ossl_raise(eSSLError, "SSL_CTX_set_cipher_list");
+-    }
+ 
+     return v;
+ }
+ 
++#ifdef HAVE_SSL_CTX_SET_CIPHERSUITES
++/*
++ * call-seq:
++ *    ctx.ciphersuites = "cipher1:cipher2:..."
++ *    ctx.ciphersuites = [name, ...]
++ *    ctx.ciphersuites = [[name, version, bits, alg_bits], ...]
++ *
++ * Sets the list of available TLSv1.3 cipher suites for this context.
++ */
++static VALUE
++ossl_sslctx_set_ciphersuites(VALUE self, VALUE v)
++{
++    SSL_CTX *ctx;
++    VALUE str;
++
++    rb_check_frozen(self);
++    if (NIL_P(v))
++        return v;
++
++    str = build_cipher_string(v);
++
++    GetSSLCTX(self, ctx);
++    if (!SSL_CTX_set_ciphersuites(ctx, StringValueCStr(str)))
++        ossl_raise(eSSLError, "SSL_CTX_set_ciphersuites");
++
++    return v;
++}
++#endif
++
+ #if !defined(OPENSSL_NO_EC)
+ /*
+  * call-seq:
+@@ -2818,6 +2857,9 @@ Init_ossl_ssl(void)
+ 			     ossl_sslctx_set_minmax_proto_version, 2);
+     rb_define_method(cSSLContext, "ciphers",     ossl_sslctx_get_ciphers, 0);
+     rb_define_method(cSSLContext, "ciphers=",    ossl_sslctx_set_ciphers, 1);
++#ifdef HAVE_SSL_CTX_SET_CIPHERSUITES
++    rb_define_method(cSSLContext, "ciphersuites=", ossl_sslctx_set_ciphersuites, 1);
++#endif
+     rb_define_method(cSSLContext, "ecdh_curves=", ossl_sslctx_set_ecdh_curves, 1);
+     rb_define_method(cSSLContext, "security_level", ossl_sslctx_get_security_level, 0);
+     rb_define_method(cSSLContext, "security_level=", ossl_sslctx_set_security_level, 1);
+diff --git a/test/openssl/test_asn1.rb b/test/openssl/test_asn1.rb
+index 0fd7971..c79bc14 100644
+--- a/test/openssl/test_asn1.rb
++++ b/test/openssl/test_asn1.rb
+@@ -14,7 +14,7 @@ class  OpenSSL::TestASN1 < OpenSSL::TestCase
+       ["keyUsage","keyCertSign, cRLSign",true],
+       ["subjectKeyIdentifier","hash",false],
+     ]
+-    dgst = OpenSSL::Digest.new('SHA1')
++    dgst = OpenSSL::Digest.new('SHA256')
+     cert = OpenSSL::TestUtils.issue_cert(
+       subj, key, s, exts, nil, nil, digest: dgst, not_before: now, not_after: now+3600)
+ 
+@@ -42,7 +42,7 @@ class  OpenSSL::TestASN1 < OpenSSL::TestCase
+     assert_equal(OpenSSL::ASN1::Sequence, sig.class)
+     assert_equal(2, sig.value.size)
+     assert_equal(OpenSSL::ASN1::ObjectId, sig.value[0].class)
+-    assert_equal("1.2.840.113549.1.1.5", sig.value[0].oid)
++    assert_equal("1.2.840.113549.1.1.11", sig.value[0].oid)
+     assert_equal(OpenSSL::ASN1::Null, sig.value[1].class)
+ 
+     dn = tbs_cert.value[3] # issuer
+@@ -189,7 +189,7 @@ class  OpenSSL::TestASN1 < OpenSSL::TestCase
+     assert_equal(OpenSSL::ASN1::Null, pkey.value[0].value[1].class)
+ 
+     assert_equal(OpenSSL::ASN1::BitString, sig_val.class)
+-    cululated_sig = key.sign(OpenSSL::Digest.new('SHA1'), tbs_cert.to_der)
++    cululated_sig = key.sign(OpenSSL::Digest.new('SHA256'), tbs_cert.to_der)
+     assert_equal(cululated_sig, sig_val.value)
+   end
+ 
+diff --git a/test/openssl/test_ns_spki.rb b/test/openssl/test_ns_spki.rb
+index ed3be86..383931b 100644
+--- a/test/openssl/test_ns_spki.rb
++++ b/test/openssl/test_ns_spki.rb
+@@ -22,7 +22,7 @@ class OpenSSL::TestNSSPI < OpenSSL::TestCase
+     spki = OpenSSL::Netscape::SPKI.new
+     spki.challenge = "RandomString"
+     spki.public_key = key1.public_key
+-    spki.sign(key1, OpenSSL::Digest.new('SHA1'))
++    spki.sign(key1, OpenSSL::Digest.new('SHA256'))
+     assert(spki.verify(spki.public_key))
+     assert(spki.verify(key1.public_key))
+     assert(!spki.verify(key2.public_key))
+diff --git a/test/openssl/test_pkey_dsa.rb b/test/openssl/test_pkey_dsa.rb
+index 726b7db..08213df 100644
+--- a/test/openssl/test_pkey_dsa.rb
++++ b/test/openssl/test_pkey_dsa.rb
+@@ -36,8 +36,8 @@ class OpenSSL::TestPKeyDSA < OpenSSL::PKeyTestCase
+       assert_equal true, dsa512.verify(OpenSSL::Digest.new('DSS1'), signature, data)
+     end
+ 
+-    signature = dsa512.sign("SHA1", data)
+-    assert_equal true, dsa512.verify("SHA1", signature, data)
++    signature = dsa512.sign("SHA256", data)
++    assert_equal true, dsa512.verify("SHA256", signature, data)
+ 
+     signature0 = (<<~'end;').unpack("m")[0]
+       MCwCFH5h40plgU5Fh0Z4wvEEpz0eE9SnAhRPbkRB8ggsN/vsSEYMXvJwjGg/
+diff --git a/test/openssl/test_pkey_ec.rb b/test/openssl/test_pkey_ec.rb
+index ffe5a94..c06fe6f 100644
+--- a/test/openssl/test_pkey_ec.rb
++++ b/test/openssl/test_pkey_ec.rb
+@@ -98,8 +98,8 @@ class OpenSSL::TestEC < OpenSSL::PKeyTestCase
+   def test_sign_verify
+     p256 = Fixtures.pkey("p256")
+     data = "Sign me!"
+-    signature = p256.sign("SHA1", data)
+-    assert_equal true, p256.verify("SHA1", signature, data)
++    signature = p256.sign("SHA256", data)
++    assert_equal true, p256.verify("SHA256", signature, data)
+ 
+     signature0 = (<<~'end;').unpack("m")[0]
+       MEQCIEOTY/hD7eI8a0qlzxkIt8LLZ8uwiaSfVbjX2dPAvN11AiAQdCYx56Fq
+diff --git a/test/openssl/test_pkey_rsa.rb b/test/openssl/test_pkey_rsa.rb
+index 4bb39ed..9e06e43 100644
+--- a/test/openssl/test_pkey_rsa.rb
++++ b/test/openssl/test_pkey_rsa.rb
+@@ -80,8 +80,8 @@ class OpenSSL::TestPKeyRSA < OpenSSL::PKeyTestCase
+   def test_sign_verify
+     rsa1024 = Fixtures.pkey("rsa1024")
+     data = "Sign me!"
+-    signature = rsa1024.sign("SHA1", data)
+-    assert_equal true, rsa1024.verify("SHA1", signature, data)
++    signature = rsa1024.sign("SHA256", data)
++    assert_equal true, rsa1024.verify("SHA256", signature, data)
+ 
+     signature0 = (<<~'end;').unpack("m")[0]
+       oLCgbprPvfhM4pjFQiDTFeWI9Sk+Og7Nh9TmIZ/xSxf2CGXQrptlwo7NQ28+
+@@ -113,10 +113,10 @@ class OpenSSL::TestPKeyRSA < OpenSSL::PKeyTestCase
+   def test_sign_verify_raw
+     key = Fixtures.pkey("rsa-1")
+     data = "Sign me!"
+-    hash = OpenSSL::Digest.digest("SHA1", data)
+-    signature = key.sign_raw("SHA1", hash)
+-    assert_equal true, key.verify_raw("SHA1", signature, hash)
+-    assert_equal true, key.verify("SHA1", signature, data)
++    hash = OpenSSL::Digest.digest("SHA256", data)
++    signature = key.sign_raw("SHA256", hash)
++    assert_equal true, key.verify_raw("SHA256", signature, hash)
++    assert_equal true, key.verify("SHA256", signature, data)
+ 
+     # Too long data
+     assert_raise(OpenSSL::PKey::PKeyError) {
+@@ -129,9 +129,9 @@ class OpenSSL::TestPKeyRSA < OpenSSL::PKeyTestCase
+       "rsa_pss_saltlen" => 20,
+       "rsa_mgf1_md" => "SHA256"
+     }
+-    sig_pss = key.sign_raw("SHA1", hash, pssopts)
+-    assert_equal true, key.verify("SHA1", sig_pss, data, pssopts)
+-    assert_equal true, key.verify_raw("SHA1", sig_pss, hash, pssopts)
++    sig_pss = key.sign_raw("SHA256", hash, pssopts)
++    assert_equal true, key.verify("SHA256", sig_pss, data, pssopts)
++    assert_equal true, key.verify_raw("SHA256", sig_pss, hash, pssopts)
+   end
+ 
+   def test_sign_verify_raw_legacy
+diff --git a/test/openssl/test_ssl.rb b/test/openssl/test_ssl.rb
+index a7607da..3ba8b39 100644
+--- a/test/openssl/test_ssl.rb
++++ b/test/openssl/test_ssl.rb
+@@ -669,10 +669,16 @@ class OpenSSL::TestSSL < OpenSSL::SSLTestCase
+     #     buzz.example.net, respectively).  ...
+     assert_equal(true, OpenSSL::SSL.verify_certificate_identity(
+       create_cert_with_san('DNS:baz*.example.com'), 'baz1.example.com'))
++
++    # LibreSSL 3.5.0+ doesn't support other wildcard certificates
++    # (it isn't required to, as RFC states MAY, not MUST)
++    return if libressl?(3, 5, 0)
++
+     assert_equal(true, OpenSSL::SSL.verify_certificate_identity(
+       create_cert_with_san('DNS:*baz.example.com'), 'foobaz.example.com'))
+     assert_equal(true, OpenSSL::SSL.verify_certificate_identity(
+       create_cert_with_san('DNS:b*z.example.com'), 'buzz.example.com'))
++
+     # Section 6.4.3 of RFC6125 states that client should NOT match identifier
+     # where wildcard is other than left-most label.
+     #
+@@ -1556,8 +1562,101 @@ class OpenSSL::TestSSL < OpenSSL::SSLTestCase
+     end
+   end
+ 
++  def test_ciphersuites_method_tls_connection
++    ssl_ctx = OpenSSL::SSL::SSLContext.new
++    if !tls13_supported? || !ssl_ctx.respond_to?(:ciphersuites=)
++      pend 'TLS 1.3 not supported'
++    end
++
++    csuite = ['TLS_AES_128_GCM_SHA256', 'TLSv1.3', 128, 128]
++    inputs = [csuite[0], [csuite[0]], [csuite]]
++
++    start_server do |port|
++      inputs.each do |input|
++        cli_ctx = OpenSSL::SSL::SSLContext.new
++        cli_ctx.min_version = cli_ctx.max_version = OpenSSL::SSL::TLS1_3_VERSION
++        cli_ctx.ciphersuites = input
++
++        server_connect(port, cli_ctx) do |ssl|
++          assert_equal('TLSv1.3', ssl.ssl_version)
++          if libressl?(3, 4, 0) && !libressl?(3, 5, 0)
++            assert_equal("AEAD-AES128-GCM-SHA256", ssl.cipher[0]) 
++          else
++            assert_equal(csuite[0], ssl.cipher[0]) 
++          end
++          ssl.puts('abc'); assert_equal("abc\n", ssl.gets)
++        end
++      end
++    end
++  end
++
++  def test_ciphersuites_method_nil_argument
++    ssl_ctx = OpenSSL::SSL::SSLContext.new
++    pend 'ciphersuites= method is missing' unless ssl_ctx.respond_to?(:ciphersuites=)
++
++    assert_nothing_raised { ssl_ctx.ciphersuites = nil }
++  end
++
++  def test_ciphersuites_method_frozen_object
++    ssl_ctx = OpenSSL::SSL::SSLContext.new
++    pend 'ciphersuites= method is missing' unless ssl_ctx.respond_to?(:ciphersuites=)
++
++    ssl_ctx.freeze
++    assert_raise(FrozenError) { ssl_ctx.ciphersuites = 'TLS_AES_256_GCM_SHA384' }
++  end
++
++  def test_ciphersuites_method_bogus_csuite
++    ssl_ctx = OpenSSL::SSL::SSLContext.new
++    pend 'ciphersuites= method is missing' unless ssl_ctx.respond_to?(:ciphersuites=)
++
++    assert_raise_with_message(
++      OpenSSL::SSL::SSLError,
++      /SSL_CTX_set_ciphersuites: no cipher match/i
++    ) { ssl_ctx.ciphersuites = 'BOGUS' }
++  end
++
++  def test_ciphers_method_tls_connection
++    csuite = ['ECDHE-RSA-AES256-GCM-SHA384', 'TLSv1.2', 256, 256]
++    inputs = [csuite[0], [csuite[0]], [csuite]]
++
++    start_server do |port|
++      inputs.each do |input|
++        cli_ctx = OpenSSL::SSL::SSLContext.new
++        cli_ctx.min_version = cli_ctx.max_version = OpenSSL::SSL::TLS1_2_VERSION
++        cli_ctx.ciphers = input
++
++        server_connect(port, cli_ctx) do |ssl|
++          assert_equal('TLSv1.2', ssl.ssl_version)
++          assert_equal(csuite[0], ssl.cipher[0])
++          ssl.puts('abc'); assert_equal("abc\n", ssl.gets)
++        end
++      end
++    end
++  end
++
++  def test_ciphers_method_nil_argument
++    ssl_ctx = OpenSSL::SSL::SSLContext.new
++    assert_nothing_raised { ssl_ctx.ciphers = nil }
++  end
++
++  def test_ciphers_method_frozen_object
++    ssl_ctx = OpenSSL::SSL::SSLContext.new
++
++    ssl_ctx.freeze
++    assert_raise(FrozenError) { ssl_ctx.ciphers = 'ECDHE-RSA-AES128-SHA' }
++  end
++
++  def test_ciphers_method_bogus_csuite
++    ssl_ctx = OpenSSL::SSL::SSLContext.new
++
++    assert_raise_with_message(
++      OpenSSL::SSL::SSLError,
++      /SSL_CTX_set_cipher_list: no cipher match/i
++    ) { ssl_ctx.ciphers = 'BOGUS' }
++  end
++
+   def test_connect_works_when_setting_dh_callback_to_nil
+     pend "TLS 1.2 is not supported" unless tls12_supported?
+
+     ctx_proc = -> ctx {
+       ctx.ssl_version = :TLSv1_2
+diff --git a/test/openssl/test_x509cert.rb b/test/openssl/test_x509cert.rb
+index d696b98..4e2bd0c 100644
+--- a/test/openssl/test_x509cert.rb
++++ b/test/openssl/test_x509cert.rb
+@@ -180,6 +180,7 @@ class OpenSSL::TestX509Certificate < OpenSSL::TestCase
+     assert_equal(false, certificate_error_returns_false { cert.verify(@dsa512) })
+     cert.serial = 2
+     assert_equal(false, cert.verify(@rsa2048))
++  rescue OpenSSL::X509::CertificateError # RHEL 9 disables SHA1
+   end
+ 
+   def test_sign_and_verify_rsa_md5
+@@ -226,9 +227,8 @@ class OpenSSL::TestX509Certificate < OpenSSL::TestCase
+     assert_equal("dsa_with_SHA256", cert.signature_algorithm)
+     # TODO: need more tests for dsa + sha2
+ 
+-    # SHA1 is allowed from OpenSSL 1.0.0 (0.9.8 requires DSS1)
+-    cert = issue_cert(@ca, @dsa256, 1, [], nil, nil, digest: "sha1")
+-    assert_equal("dsaWithSHA1", cert.signature_algorithm)
++    cert = issue_cert(@ca, @dsa256, 1, [], nil, nil, digest: "sha512")
++    assert_equal("dsa_with_SHA512", cert.signature_algorithm)
+   end
+ 
+   def test_check_private_key
+diff --git a/test/openssl/test_x509crl.rb b/test/openssl/test_x509crl.rb
+index bcdb0a6..146ee07 100644
+--- a/test/openssl/test_x509crl.rb
++++ b/test/openssl/test_x509crl.rb
+@@ -20,7 +20,7 @@ class OpenSSL::TestX509CRL < OpenSSL::TestCase
+ 
+     cert = issue_cert(@ca, @rsa2048, 1, [], nil, nil)
+     crl = issue_crl([], 1, now, now+1600, [],
+-                    cert, @rsa2048, OpenSSL::Digest.new('SHA1'))
++                    cert, @rsa2048, OpenSSL::Digest.new('SHA256'))
+     assert_equal(1, crl.version)
+     assert_equal(cert.issuer.to_der, crl.issuer.to_der)
+     assert_equal(now, crl.last_update)
+@@ -57,7 +57,7 @@ class OpenSSL::TestX509CRL < OpenSSL::TestCase
+     ]
+     cert = issue_cert(@ca, @rsa2048, 1, [], nil, nil)
+     crl = issue_crl(revoke_info, 1, Time.now, Time.now+1600, [],
+-                    cert, @rsa2048, OpenSSL::Digest.new('SHA1'))
++                    cert, @rsa2048, OpenSSL::Digest.new('SHA256'))
+     revoked = crl.revoked
+     assert_equal(5, revoked.size)
+     assert_equal(1, revoked[0].serial)
+@@ -98,7 +98,7 @@ class OpenSSL::TestX509CRL < OpenSSL::TestCase
+ 
+     revoke_info = (1..1000).collect{|i| [i, now, 0] }
+     crl = issue_crl(revoke_info, 1, Time.now, Time.now+1600, [],
+-                    cert, @rsa2048, OpenSSL::Digest.new('SHA1'))
++                    cert, @rsa2048, OpenSSL::Digest.new('SHA256'))
+     revoked = crl.revoked
+     assert_equal(1000, revoked.size)
+     assert_equal(1, revoked[0].serial)
+@@ -124,7 +124,7 @@ class OpenSSL::TestX509CRL < OpenSSL::TestCase
+ 
+     cert = issue_cert(@ca, @rsa2048, 1, cert_exts, nil, nil)
+     crl = issue_crl([], 1, Time.now, Time.now+1600, crl_exts,
+-                    cert, @rsa2048, OpenSSL::Digest.new('SHA1'))
++                    cert, @rsa2048, OpenSSL::Digest.new('SHA256'))
+     exts = crl.extensions
+     assert_equal(3, exts.size)
+     assert_equal("1", exts[0].value)
+@@ -160,24 +160,24 @@ class OpenSSL::TestX509CRL < OpenSSL::TestCase
+     assert_equal(false, exts[2].critical?)
+ 
+     no_ext_crl = issue_crl([], 1, Time.now, Time.now+1600, [],
+-      cert, @rsa2048, OpenSSL::Digest.new('SHA1'))
++      cert, @rsa2048, OpenSSL::Digest.new('SHA256'))
+     assert_equal nil, no_ext_crl.authority_key_identifier
+   end
+ 
+   def test_crlnumber
+     cert = issue_cert(@ca, @rsa2048, 1, [], nil, nil)
+     crl = issue_crl([], 1, Time.now, Time.now+1600, [],
+-                    cert, @rsa2048, OpenSSL::Digest.new('SHA1'))
++                    cert, @rsa2048, OpenSSL::Digest.new('SHA256'))
+     assert_match(1.to_s, crl.extensions[0].value)
+     assert_match(/X509v3 CRL Number:\s+#{1}/m, crl.to_text)
+ 
+     crl = issue_crl([], 2**32, Time.now, Time.now+1600, [],
+-                    cert, @rsa2048, OpenSSL::Digest.new('SHA1'))
++                    cert, @rsa2048, OpenSSL::Digest.new('SHA256'))
+     assert_match((2**32).to_s, crl.extensions[0].value)
+     assert_match(/X509v3 CRL Number:\s+#{2**32}/m, crl.to_text)
+ 
+     crl = issue_crl([], 2**100, Time.now, Time.now+1600, [],
+-                    cert, @rsa2048, OpenSSL::Digest.new('SHA1'))
++                    cert, @rsa2048, OpenSSL::Digest.new('SHA256'))
+     assert_match(/X509v3 CRL Number:\s+#{2**100}/m, crl.to_text)
+     assert_match((2**100).to_s, crl.extensions[0].value)
+   end
+@@ -185,7 +185,7 @@ class OpenSSL::TestX509CRL < OpenSSL::TestCase
+   def test_sign_and_verify
+     cert = issue_cert(@ca, @rsa2048, 1, [], nil, nil)
+     crl = issue_crl([], 1, Time.now, Time.now+1600, [],
+-                    cert, @rsa2048, OpenSSL::Digest.new('SHA1'))
++                    cert, @rsa2048, OpenSSL::Digest.new('SHA256'))
+     assert_equal(false, crl.verify(@rsa1024))
+     assert_equal(true,  crl.verify(@rsa2048))
+     assert_equal(false, crl_error_returns_false { crl.verify(@dsa256) })
+@@ -195,7 +195,7 @@ class OpenSSL::TestX509CRL < OpenSSL::TestCase
+ 
+     cert = issue_cert(@ca, @dsa512, 1, [], nil, nil)
+     crl = issue_crl([], 1, Time.now, Time.now+1600, [],
+-                    cert, @dsa512, OpenSSL::Digest.new('SHA1'))
++                    cert, @dsa512, OpenSSL::Digest.new('SHA256'))
+     assert_equal(false, crl_error_returns_false { crl.verify(@rsa1024) })
+     assert_equal(false, crl_error_returns_false { crl.verify(@rsa2048) })
+     assert_equal(false, crl.verify(@dsa256))
+diff --git a/test/openssl/test_x509req.rb b/test/openssl/test_x509req.rb
+index ee9c678..a84b162 100644
+--- a/test/openssl/test_x509req.rb
++++ b/test/openssl/test_x509req.rb
+@@ -23,31 +23,31 @@ class OpenSSL::TestX509Request < OpenSSL::TestCase
+   end
+ 
+   def test_public_key
+-    req = issue_csr(0, @dn, @rsa1024, OpenSSL::Digest.new('SHA1'))
++    req = issue_csr(0, @dn, @rsa1024, OpenSSL::Digest.new('SHA256'))
+     assert_equal(@rsa1024.public_key.to_der, req.public_key.to_der)
+     req = OpenSSL::X509::Request.new(req.to_der)
+     assert_equal(@rsa1024.public_key.to_der, req.public_key.to_der)
+ 
+-    req = issue_csr(0, @dn, @dsa512, OpenSSL::Digest.new('SHA1'))
++    req = issue_csr(0, @dn, @dsa512, OpenSSL::Digest.new('SHA256'))
+     assert_equal(@dsa512.public_key.to_der, req.public_key.to_der)
+     req = OpenSSL::X509::Request.new(req.to_der)
+     assert_equal(@dsa512.public_key.to_der, req.public_key.to_der)
+   end
+ 
+   def test_version
+-    req = issue_csr(0, @dn, @rsa1024, OpenSSL::Digest.new('SHA1'))
++    req = issue_csr(0, @dn, @rsa1024, OpenSSL::Digest.new('SHA256'))
+     assert_equal(0, req.version)
+     req = OpenSSL::X509::Request.new(req.to_der)
+     assert_equal(0, req.version)
+ 
+-    req = issue_csr(1, @dn, @rsa1024, OpenSSL::Digest.new('SHA1'))
++    req = issue_csr(1, @dn, @rsa1024, OpenSSL::Digest.new('SHA256'))
+     assert_equal(1, req.version)
+     req = OpenSSL::X509::Request.new(req.to_der)
+     assert_equal(1, req.version)
+   end
+ 
+   def test_subject
+-    req = issue_csr(0, @dn, @rsa1024, OpenSSL::Digest.new('SHA1'))
++    req = issue_csr(0, @dn, @rsa1024, OpenSSL::Digest.new('SHA256'))
+     assert_equal(@dn.to_der, req.subject.to_der)
+     req = OpenSSL::X509::Request.new(req.to_der)
+     assert_equal(@dn.to_der, req.subject.to_der)
+@@ -78,9 +78,9 @@ class OpenSSL::TestX509Request < OpenSSL::TestCase
+       OpenSSL::X509::Attribute.new("msExtReq", attrval),
+     ]
+ 
+-    req0 = issue_csr(0, @dn, @rsa1024, OpenSSL::Digest.new('SHA1'))
++    req0 = issue_csr(0, @dn, @rsa1024, OpenSSL::Digest.new('SHA256'))
+     attrs.each{|attr| req0.add_attribute(attr) }
+-    req1 = issue_csr(0, @dn, @rsa1024, OpenSSL::Digest.new('SHA1'))
++    req1 = issue_csr(0, @dn, @rsa1024, OpenSSL::Digest.new('SHA256'))
+     req1.attributes = attrs
+     assert_equal(req0.to_der, req1.to_der)
+ 
+@@ -101,7 +101,7 @@ class OpenSSL::TestX509Request < OpenSSL::TestCase
+   end
+ 
+   def test_sign_and_verify_rsa_sha1
+-    req = issue_csr(0, @dn, @rsa1024, OpenSSL::Digest.new('SHA1'))
++    req = issue_csr(0, @dn, @rsa1024, OpenSSL::Digest.new('SHA256'))
+     assert_equal(true,  req.verify(@rsa1024))
+     assert_equal(false, req.verify(@rsa2048))
+     assert_equal(false, request_error_returns_false { req.verify(@dsa256) })
+@@ -122,7 +122,7 @@ class OpenSSL::TestX509Request < OpenSSL::TestCase
+   end
+ 
+   def test_sign_and_verify_dsa
+-    req = issue_csr(0, @dn, @dsa512, OpenSSL::Digest.new('SHA1'))
++    req = issue_csr(0, @dn, @dsa512, OpenSSL::Digest.new('SHA256'))
+     assert_equal(false, request_error_returns_false { req.verify(@rsa1024) })
+     assert_equal(false, request_error_returns_false { req.verify(@rsa2048) })
+     assert_equal(false, req.verify(@dsa256))
+@@ -137,13 +137,13 @@ class OpenSSL::TestX509Request < OpenSSL::TestCase
+   end
+ 
+   def test_dup
+-    req = issue_csr(0, @dn, @rsa1024, OpenSSL::Digest.new('SHA1'))
++    req = issue_csr(0, @dn, @rsa1024, OpenSSL::Digest.new('SHA256'))
+     assert_equal(req.to_der, req.dup.to_der)
+   end
+ 
+   def test_eq
+-    req1 = issue_csr(0, @dn, @rsa1024, "sha1")
+-    req2 = issue_csr(0, @dn, @rsa1024, "sha1")
++    req1 = issue_csr(0, @dn, @rsa1024, "sha512")
++    req2 = issue_csr(0, @dn, @rsa1024, "sha512")
+     req3 = issue_csr(0, @dn, @rsa1024, "sha256")
+ 
+     assert_equal false, req1 == 12345
+--- a/test/openssl/test_x509store.rb.orig	2022-07-14 14:07:32.468809273 +0200
++++ b/test/openssl/test_x509store.rb	2022-07-13 17:27:58.115363595 +0200
+@@ -72,16 +72,16 @@
+ 
+     revoke_info = []
+     crl1   = issue_crl(revoke_info, 1, now, now+1800, [],
+-                       ca1_cert, @rsa2048, OpenSSL::Digest.new('SHA1'))
++                       ca1_cert, @rsa2048, OpenSSL::Digest.new('SHA256'))
+     revoke_info = [ [2, now, 1], ]
+     crl1_2 = issue_crl(revoke_info, 2, now, now+1800, [],
+-                       ca1_cert, @rsa2048, OpenSSL::Digest.new('SHA1'))
++                       ca1_cert, @rsa2048, OpenSSL::Digest.new('SHA256'))
+     revoke_info = [ [20, now, 1], ]
+     crl2   = issue_crl(revoke_info, 1, now, now+1800, [],
+-                       ca2_cert, @rsa1024, OpenSSL::Digest.new('SHA1'))
++                       ca2_cert, @rsa1024, OpenSSL::Digest.new('SHA256'))
+     revoke_info = []
+     crl2_2 = issue_crl(revoke_info, 2, now-100, now-1, [],
+-                       ca2_cert, @rsa1024, OpenSSL::Digest.new('SHA1'))
++                       ca2_cert, @rsa1024, OpenSSL::Digest.new('SHA256'))
+ 
+     assert_equal(true, ca1_cert.verify(ca1_cert.public_key))   # self signed
+     assert_equal(true, ca2_cert.verify(ca1_cert.public_key))   # issued by ca1
+@@ -220,10 +220,10 @@
+ 
+     revoke_info = []
+     crl1 = issue_crl(revoke_info, 1, now, now+1800, [],
+-                     ca1_cert, @rsa2048, OpenSSL::Digest.new('SHA1'))
++                     ca1_cert, @rsa2048, OpenSSL::Digest.new('SHA256'))
+     revoke_info = [ [2, now, 1], ]
+     crl2 = issue_crl(revoke_info, 2, now+1800, now+3600, [],
+-                     ca1_cert, @rsa2048, OpenSSL::Digest.new('SHA1'))
++                     ca1_cert, @rsa2048, OpenSSL::Digest.new('SHA256'))
+     store.add_crl(crl1)
+     assert_raise(OpenSSL::X509::StoreError){
+       store.add_crl(crl2) # add CRL issued by same CA twice.

SOURCES/ruby-3.1.3-Fix-for-tzdata-2022g.patch

@@ -17,19 +17,19 @@ diff --git a/test/ruby/test_time_tz.rb b/test/ruby/test_time_tz.rb
 index b6785f336028d..939f218ed4d10 100644
 --- a/test/ruby/test_time_tz.rb
 +++ b/test/ruby/test_time_tz.rb
-@@ -6,9 +6,9 @@ class TestTimeTZ < Test::Unit::TestCase
+@@ -7,9 +7,9 @@ class TestTimeTZ < Test::Unit::TestCase
    has_lisbon_tz = true
    force_tz_test = ENV["RUBY_FORCE_TIME_TZ_TEST"] == "yes"
    case RUBY_PLATFORM
 -  when /linux/
 +  when /darwin|linux/
      force_tz_test = true
--  when /darwin|freebsd/
+-  when /darwin|freebsd|openbsd/
 +  when /freebsd|openbsd/
      has_lisbon_tz = false
      force_tz_test = true
    end
-@@ -94,6 +94,9 @@ def group_by(e, &block)
+@@ -95,6 +95,9 @@ def group_by(e, &block)
    CORRECT_KIRITIMATI_SKIP_1994 = with_tz("Pacific/Kiritimati") {
      Time.local(1994, 12, 31, 0, 0, 0).year == 1995
    }
@@ -39,7 +39,7 @@ index b6785f336028d..939f218ed4d10 100644
  
    def time_to_s(t)
      t.to_s
-@@ -139,9 +142,12 @@ def test_america_managua
+@@ -140,9 +143,12 @@ def test_america_managua
  
    def test_asia_singapore
      with_tz(tz="Asia/Singapore") {
@@ -55,7 +55,7 @@ index b6785f336028d..939f218ed4d10 100644
        assert_time_constructor(tz, "1982-01-01 00:30:00 +0800", :local, [1982,1,1,0,30,0])
      }
    end
-@@ -364,8 +370,11 @@ def self.gen_zdump_test(data)
+@@ -448,8 +454,11 @@ def self.gen_zdump_test(data)
  America/Managua  Wed Jan  1 04:59:59 1997 UTC = Tue Dec 31 23:59:59 1996 EST isdst=0 gmtoff=-18000
  America/Managua  Wed Jan  1 05:00:00 1997 UTC = Tue Dec 31 23:00:00 1996 CST isdst=0 gmtoff=-21600
  Asia/Singapore  Sun Aug  8 16:30:00 1965 UTC = Mon Aug  9 00:00:00 1965 SGT isdst=0 gmtoff=27000

SOURCES/ruby-3.2.0-git-2.38.1-fix-rubygems-test.patch

@@ -13,7 +13,7 @@ diff --git a/test/rubygems/test_gem_source_git.rb b/test/rubygems/test_gem_sourc
 index 5702da05974b6..c3b324771fa4d 100644
 --- a/test/rubygems/test_gem_source_git.rb
 +++ b/test/rubygems/test_gem_source_git.rb
-@@ -64,6 +64,11 @@ def test_checkout_local_cached
+@@ -63,6 +63,11 @@ def test_checkout_local_cached
    end
  
    def test_checkout_submodules

SOURCES/ruby-3.3.0-openssl-3.2.0-fips-enable-tests.patch

@@ -0,0 +1,32 @@
+From f0b254f1f6610294821bbfc06b414d2af452db5b Mon Sep 17 00:00:00 2001
+From: Jun Aruga <jaruga@redhat.com>
+Date: Thu, 13 Apr 2023 17:28:27 +0200
+Subject: [PATCH] [ruby/openssl] Drop a common logic disabling the FIPS mode in
+ the tests.
+
+We want to run the unit tests in the FIPS mode too.
+
+https://github.com/ruby/openssl/commit/ab92baff34
+---
+ test/openssl/utils.rb | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/test/openssl/utils.rb b/test/openssl/utils.rb
+index 4ebcb9837b..8a0be0d154 100644
+--- a/test/openssl/utils.rb
++++ b/test/openssl/utils.rb
+@@ -1,11 +1,6 @@
+ # frozen_string_literal: true
+ begin
+   require "openssl"
+-
+-  # Disable FIPS mode for tests for installations
+-  # where FIPS mode would be enabled by default.
+-  # Has no effect on all other installations.
+-  OpenSSL.fips_mode=false
+ rescue LoadError
+ end
+ 
+-- 
+2.41.0
+

SOURCES/ruby-3.3.0-openssl-3.2.0-fips-fix-pkey-dh-require-openssl.patch

@@ -0,0 +1,73 @@
+From b6d7cdc2bad0eadbca73f3486917f0ec7a475814 Mon Sep 17 00:00:00 2001
+From: Kazuki Yamaguchi <k@rhe.jp>
+Date: Tue, 29 Aug 2023 19:46:02 +0900
+Subject: [PATCH] [ruby/openssl] ssl: use ffdhe2048 from RFC 7919 as the
+ default DH group parameters
+
+In TLS 1.2 or before, if DH group parameters for DHE are not supplied
+with SSLContext#tmp_dh= or #tmp_dh_callback=, we currently use the
+self-generated parameters added in commit https://github.com/ruby/openssl/commit/bb3399a61c03 ("support 2048
+bit length DH-key", 2016-01-15) as the fallback.
+
+While there is no known weakness in the current parameters, it would be
+a good idea to switch to pre-defined, more well audited parameters.
+
+This also allows the fallback to work in the FIPS mode.
+
+The PEM encoding was derived with:
+
+	# RFC 7919 Appendix A.1. ffdhe2048
+	print OpenSSL::PKey.read(OpenSSL::ASN1::Sequence([OpenSSL::ASN1::Integer((<<-END).split.join.to_i(16)), OpenSSL::ASN1::Integer(2)]).to_der).to_pem
+	    FFFFFFFF FFFFFFFF ADF85458 A2BB4A9A AFDC5620 273D3CF1
+	    D8B9C583 CE2D3695 A9E13641 146433FB CC939DCE 249B3EF9
+	    7D2FE363 630C75D8 F681B202 AEC4617A D3DF1ED5 D5FD6561
+	    2433F51F 5F066ED0 85636555 3DED1AF3 B557135E 7F57C935
+	    984F0C70 E0E68B77 E2A689DA F3EFE872 1DF158A1 36ADE735
+	    30ACCA4F 483A797A BC0AB182 B324FB61 D108A94B B2C8E3FB
+	    B96ADAB7 60D7F468 1D4F42A3 DE394DF4 AE56EDE7 6372BB19
+	    0B07A7C8 EE0A6D70 9E02FCE1 CDF7E2EC C03404CD 28342F61
+	    9172FE9C E98583FF 8E4F1232 EEF28183 C3FE3B1B 4C6FAD73
+	    3BB5FCBC 2EC22005 C58EF183 7D1683B2 C6F34A26 C1B2EFFA
+	    886B4238 61285C97 FFFFFFFF FFFFFFFF
+	END
+
+https://github.com/ruby/openssl/commit/a5527cb4f4
+---
+ ext/openssl/lib/openssl/ssl.rb | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/ext/openssl/lib/openssl/ssl.rb b/ext/openssl/lib/openssl/ssl.rb
+index ea8bb2a18e533..94be6ba80b894 100644
+--- a/ext/openssl/lib/openssl/ssl.rb
++++ b/ext/openssl/lib/openssl/ssl.rb
+@@ -31,21 +31,21 @@ class SSLContext
+       }
+ 
+       if defined?(OpenSSL::PKey::DH)
+-        DEFAULT_2048 = OpenSSL::PKey::DH.new <<-_end_of_pem_
++        DH_ffdhe2048 = OpenSSL::PKey::DH.new <<-_end_of_pem_
+ -----BEGIN DH PARAMETERS-----
+-MIIBCAKCAQEA7E6kBrYiyvmKAMzQ7i8WvwVk9Y/+f8S7sCTN712KkK3cqd1jhJDY
+-JbrYeNV3kUIKhPxWHhObHKpD1R84UpL+s2b55+iMd6GmL7OYmNIT/FccKhTcveab
+-VBmZT86BZKYyf45hUF9FOuUM9xPzuK3Vd8oJQvfYMCd7LPC0taAEljQLR4Edf8E6
+-YoaOffgTf5qxiwkjnlVZQc3whgnEt9FpVMvQ9eknyeGB5KHfayAc3+hUAvI3/Cr3
+-1bNveX5wInh5GDx1FGhKBZ+s1H+aedudCm7sCgRwv8lKWYGiHzObSma8A86KG+MD
+-7Lo5JquQ3DlBodj3IDyPrxIv96lvRPFtAwIBAg==
++MIIBCAKCAQEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz
+++8yTnc4kmz75fS/jY2MMddj2gbICrsRhetPfHtXV/WVhJDP1H18GbtCFY2VVPe0a
++87VXE15/V8k1mE8McODmi3fipona8+/och3xWKE2rec1MKzKT0g6eXq8CrGCsyT7
++YdEIqUuyyOP7uWrat2DX9GgdT0Kj3jlN9K5W7edjcrsZCwenyO4KbXCeAvzhzffi
++7MA0BM0oNC9hkXL+nOmFg/+OTxIy7vKBg8P+OxtMb61zO7X8vC7CIAXFjvGDfRaD
++ssbzSibBsu/6iGtCOGEoXJf//////////wIBAg==
+ -----END DH PARAMETERS-----
+         _end_of_pem_
+-        private_constant :DEFAULT_2048
++        private_constant :DH_ffdhe2048
+ 
+         DEFAULT_TMP_DH_CALLBACK = lambda { |ctx, is_export, keylen| # :nodoc:
+           warn "using default DH parameters." if $VERBOSE
+-          DEFAULT_2048
++          DH_ffdhe2048
+         }
+       end
+ 

SOURCES/ruby-3.3.0-openssl-3.2.0-fips-fix-pkey-read-in-openssl-3.patch

@@ -0,0 +1,160 @@
+From 40451afa279c52ce7a508f8a9ec553cfe7a76a10 Mon Sep 17 00:00:00 2001
+From: Jun Aruga <jaruga@redhat.com>
+Date: Wed, 12 Apr 2023 17:15:21 +0200
+Subject: [PATCH] Fix OpenSSL::PKey.read in OpenSSL 3 FIPS module.
+
+This is a combination of the following 2 commits. Because the combined patch is
+easy to merge.
+
+This is the 1st commit message:
+
+[ruby/openssl] Workaround: Fix OpenSSL::PKey.read that cannot parse PKey in the FIPS mode.
+
+This commit is a workaround to avoid the error below that the
+`OpenSSL::PKey.read` fails with the OpenSSL 3.0 FIPS mode.
+
+```
+$ openssl genrsa -out key.pem 4096
+
+$ ruby -e "require 'openssl'; OpenSSL::PKey.read(File.read('key.pem'))"
+-e:1:in `read': Could not parse PKey (OpenSSL::PKey::PKeyError)
+  from -e:1:in `<main>'
+```
+
+The root cause is on the OpenSSL side. The `OSSL_DECODER_CTX_set_selection`
+doesn't apply the selection value properly if there are multiple providers, and
+a provider (e.g.  "base" provider) handles the decoder implementation, and
+another provider (e.g. "fips" provider) handles the keys.
+
+The workaround is to create `OSSL_DECODER_CTX` variable each time without using
+the `OSSL_DECODER_CTX_set_selection`.
+
+https://github.com/ruby/openssl/commit/5ff4a31621
+
+This is the commit message #2:
+
+[ruby/openssl] ossl_pkey.c: Workaround: Decode with non-zero selections.
+
+This is a workaround for the decoding issue in ossl_pkey_read_generic().
+The issue happens in the case that a key management provider is different from
+a decoding provider.
+
+Try all the non-zero selections in order, instead of selection 0 for OpenSSL 3
+to avoid the issue.
+
+https://github.com/ruby/openssl/commit/db688fa739
+---
+ ext/openssl/ossl_pkey.c | 78 ++++++++++++++++++++++++++++++++++++++---
+ 1 file changed, 73 insertions(+), 5 deletions(-)
+
+diff --git a/ext/openssl/ossl_pkey.c b/ext/openssl/ossl_pkey.c
+index 24d0da4683..15854aeca1 100644
+--- a/ext/openssl/ossl_pkey.c
++++ b/ext/openssl/ossl_pkey.c
+@@ -81,18 +81,20 @@ ossl_pkey_new(EVP_PKEY *pkey)
+ #if OSSL_OPENSSL_PREREQ(3, 0, 0)
+ # include <openssl/decoder.h>
+ 
+-EVP_PKEY *
+-ossl_pkey_read_generic(BIO *bio, VALUE pass)
++static EVP_PKEY *
++ossl_pkey_read(BIO *bio, const char *input_type, int selection, VALUE pass)
+ {
+     void *ppass = (void *)pass;
+     OSSL_DECODER_CTX *dctx;
+     EVP_PKEY *pkey = NULL;
+     int pos = 0, pos2;
+ 
+-    dctx = OSSL_DECODER_CTX_new_for_pkey(&pkey, "DER", NULL, NULL, 0, NULL, NULL);
++    dctx = OSSL_DECODER_CTX_new_for_pkey(&pkey, input_type, NULL, NULL,
++                                         selection, NULL, NULL);
+     if (!dctx)
+         goto out;
+-    if (OSSL_DECODER_CTX_set_pem_password_cb(dctx, ossl_pem_passwd_cb, ppass) != 1)
++    if (OSSL_DECODER_CTX_set_pem_password_cb(dctx, ossl_pem_passwd_cb,
++                                             ppass) != 1)
+         goto out;
+ 
+     /* First check DER */
+@@ -111,11 +113,77 @@ ossl_pkey_read_generic(BIO *bio, VALUE pass)
+             goto out;
+         pos = pos2;
+     }
+-
+   out:
++    OSSL_BIO_reset(bio);
+     OSSL_DECODER_CTX_free(dctx);
+     return pkey;
+ }
++
++EVP_PKEY *
++ossl_pkey_read_generic(BIO *bio, VALUE pass)
++{
++    EVP_PKEY *pkey = NULL;
++    /* First check DER, then check PEM. */
++    const char *input_types[] = {"DER", "PEM"};
++    int input_type_num = (int)(sizeof(input_types) / sizeof(char *));
++    /*
++     * Non-zero selections to try to decode.
++     *
++     * See EVP_PKEY_fromdata(3) - Selections to see all the selections.
++     *
++     * This is a workaround for the decoder failing to decode or returning
++     * bogus keys with selection 0, if a key management provider is different
++     * from a decoder provider. The workaround is to avoid using selection 0.
++     *
++     * Affected OpenSSL versions: >= 3.1.0, <= 3.1.2, or >= 3.0.0, <= 3.0.10
++     * Fixed OpenSSL versions: 3.2, next release of the 3.1.z and 3.0.z
++     *
++     * See https://github.com/openssl/openssl/pull/21519 for details.
++     *
++     * First check for private key formats (EVP_PKEY_KEYPAIR). This is to keep
++     * compatibility with ruby/openssl < 3.0 which decoded the following as a
++     * private key.
++     *
++     *     $ openssl ecparam -name prime256v1 -genkey -outform PEM
++     *     -----BEGIN EC PARAMETERS-----
++     *     BggqhkjOPQMBBw==
++     *     -----END EC PARAMETERS-----
++     *     -----BEGIN EC PRIVATE KEY-----
++     *     MHcCAQEEIAG8ugBbA5MHkqnZ9ujQF93OyUfL9tk8sxqM5Wv5tKg5oAoGCCqGSM49
++     *     AwEHoUQDQgAEVcjhJfkwqh5C7kGuhAf8XaAjVuG5ADwb5ayg/cJijCgs+GcXeedj
++     *     86avKpGH84DXUlB23C/kPt+6fXYlitUmXQ==
++     *     -----END EC PRIVATE KEY-----
++     *
++     * While the first PEM block is a proper encoding of ECParameters, thus
++     * OSSL_DECODER_from_bio() would pick it up, ruby/openssl used to return
++     * the latter instead. Existing applications expect this behavior.
++     *
++     * Note that normally, the input is supposed to contain a single decodable
++     * PEM block only, so this special handling should not create a new problem.
++     *
++     * Note that we need to create the OSSL_DECODER_CTX variable each time when
++     * we use the different selection as a workaround.
++     * See https://github.com/openssl/openssl/issues/20657 for details.
++     */
++    int selections[] = {
++        EVP_PKEY_KEYPAIR,
++        EVP_PKEY_KEY_PARAMETERS,
++        EVP_PKEY_PUBLIC_KEY
++    };
++    int selection_num = (int)(sizeof(selections) / sizeof(int));
++    int i, j;
++
++    for (i = 0; i < input_type_num; i++) {
++        for (j = 0; j < selection_num; j++) {
++            pkey = ossl_pkey_read(bio, input_types[i], selections[j], pass);
++            if (pkey) {
++                goto out;
++            }
++        }
++    }
++  out:
++    return pkey;
++}
+ #else
+ EVP_PKEY *
+ ossl_pkey_read_generic(BIO *bio, VALUE pass)
+-- 
+2.41.0
+

SOURCES/ruby-3.3.0-openssl-3.2.0-fix-fips-get-set-in-openssl-3.patch

@@ -0,0 +1,142 @@
+From 29920ec109751459a65c6478525f2e59c644891f Mon Sep 17 00:00:00 2001
+From: Jun Aruga <jaruga@redhat.com>
+Date: Thu, 16 Mar 2023 21:36:43 +0100
+Subject: [PATCH] [ruby/openssl] Implement FIPS functions on OpenSSL 3.
+
+This commit is to implement the `OpenSSL::OPENSSL_FIPS`, `ossl_fips_mode_get`
+and `ossl_fips_mode_set` to pass the test `test/openssl/test_fips.rb`.
+
+It seems that the `OPENSSL_FIPS` macro is not used on the FIPS mode case any
+more, and some FIPS related APIs also were removed in OpenSSL 3.
+
+See the document <https://github.com/openssl/openssl/blob/master/doc/man7/migration_guide.pod#removed-fips_mode-and-fips_mode_set>
+the section OPENSSL 3.0 > Main Changes from OpenSSL 1.1.1 >
+Other notable deprecations and changes - Removed FIPS_mode() and FIPS_mode_set() .
+
+The `OpenSSL::OPENSSL_FIPS` returns always true in OpenSSL 3 because the used
+functions `EVP_default_properties_enable_fips` and `EVP_default_properties_is_fips_enabled`
+works with the OpenSSL installed without FIPS option.
+
+The `TEST_RUBY_OPENSSL_FIPS_ENABLED` is set on the FIPS mode case on the CI.
+Because I want to test that the `OpenSSL.fips_mode` returns the `true` or
+'false' surely in the CI. You can test the FIPS mode case by setting
+`TEST_RUBY_OPENSSL_FIPS_ENABLED` on local too. Right now I don't find a better
+way to get the status of the FIPS mode enabled or disabled for this purpose. I
+am afraid of the possibility that the FIPS test case is unintentionally skipped.
+
+I also replaced the ambiguous "returns" with "should return" in the tests.
+
+https://github.com/ruby/openssl/commit/c5b2bc1268
+---
+ ext/openssl/ossl.c        | 25 +++++++++++++++++++++----
+ test/openssl/test_fips.rb | 32 ++++++++++++++++++++++++++++----
+ 2 files changed, 49 insertions(+), 8 deletions(-)
+
+diff --git a/ext/openssl/ossl.c b/ext/openssl/ossl.c
+index 6c532aca94..fcf3744c65 100644
+--- a/ext/openssl/ossl.c
++++ b/ext/openssl/ossl.c
+@@ -405,7 +405,11 @@ static VALUE
+ ossl_fips_mode_get(VALUE self)
+ {
+ 
+-#ifdef OPENSSL_FIPS
++#if OSSL_OPENSSL_PREREQ(3, 0, 0)
++    VALUE enabled;
++    enabled = EVP_default_properties_is_fips_enabled(NULL) ? Qtrue : Qfalse;
++    return enabled;
++#elif OPENSSL_FIPS
+     VALUE enabled;
+     enabled = FIPS_mode() ? Qtrue : Qfalse;
+     return enabled;
+@@ -429,8 +433,18 @@ ossl_fips_mode_get(VALUE self)
+ static VALUE
+ ossl_fips_mode_set(VALUE self, VALUE enabled)
+ {
+-
+-#ifdef OPENSSL_FIPS
++#if OSSL_OPENSSL_PREREQ(3, 0, 0)
++    if (RTEST(enabled)) {
++        if (!EVP_default_properties_enable_fips(NULL, 1)) {
++            ossl_raise(eOSSLError, "Turning on FIPS mode failed");
++        }
++    } else {
++        if (!EVP_default_properties_enable_fips(NULL, 0)) {
++            ossl_raise(eOSSLError, "Turning off FIPS mode failed");
++        }
++    }
++    return enabled;
++#elif OPENSSL_FIPS
+     if (RTEST(enabled)) {
+ 	int mode = FIPS_mode();
+ 	if(!mode && !FIPS_mode_set(1)) /* turning on twice leads to an error */
+@@ -1185,7 +1199,10 @@ Init_openssl(void)
+      * Boolean indicating whether OpenSSL is FIPS-capable or not
+      */
+     rb_define_const(mOSSL, "OPENSSL_FIPS",
+-#ifdef OPENSSL_FIPS
++/* OpenSSL 3 is FIPS-capable even when it is installed without fips option */
++#if OSSL_OPENSSL_PREREQ(3, 0, 0)
++                    Qtrue
++#elif OPENSSL_FIPS
+ 		    Qtrue
+ #else
+ 		    Qfalse
+diff --git a/test/openssl/test_fips.rb b/test/openssl/test_fips.rb
+index 8cd474f9a3..56a12a94ce 100644
+--- a/test/openssl/test_fips.rb
++++ b/test/openssl/test_fips.rb
+@@ -4,22 +4,46 @@
+ if defined?(OpenSSL)
+ 
+ class OpenSSL::TestFIPS < OpenSSL::TestCase
++  def test_fips_mode_get_is_true_on_fips_mode_enabled
++    unless ENV["TEST_RUBY_OPENSSL_FIPS_ENABLED"]
++      omit "Only for FIPS mode environment"
++    end
++
++    assert_separately([{ "OSSL_MDEBUG" => nil }, "-ropenssl"], <<~"end;")
++      assert OpenSSL.fips_mode == true, ".fips_mode should return true on FIPS mode enabled"
++    end;
++  end
++
++  def test_fips_mode_get_is_false_on_fips_mode_disabled
++    if ENV["TEST_RUBY_OPENSSL_FIPS_ENABLED"]
++      omit "Only for non-FIPS mode environment"
++    end
++
++    assert_separately([{ "OSSL_MDEBUG" => nil }, "-ropenssl"], <<~"end;")
++      message = ".fips_mode should return false on FIPS mode disabled. " \
++                "If you run the test on FIPS mode, please set " \
++                "TEST_RUBY_OPENSSL_FIPS_ENABLED=true"
++      assert OpenSSL.fips_mode == false, message
++    end;
++  end
++
+   def test_fips_mode_is_reentrant
+     OpenSSL.fips_mode = false
+     OpenSSL.fips_mode = false
+   end
+ 
+-  def test_fips_mode_get
+-    return unless OpenSSL::OPENSSL_FIPS
++  def test_fips_mode_get_with_fips_mode_set
++    omit('OpenSSL is not FIPS-capable') unless OpenSSL::OPENSSL_FIPS
++
+     assert_separately([{ "OSSL_MDEBUG" => nil }, "-ropenssl"], <<~"end;")
+       require #{__FILE__.dump}
+ 
+       begin
+         OpenSSL.fips_mode = true
+-        assert OpenSSL.fips_mode == true, ".fips_mode returns true when .fips_mode=true"
++        assert OpenSSL.fips_mode == true, ".fips_mode should return true when .fips_mode=true"
+ 
+         OpenSSL.fips_mode = false
+-        assert OpenSSL.fips_mode == false, ".fips_mode returns false when .fips_mode=false"
++        assert OpenSSL.fips_mode == false, ".fips_mode should return false when .fips_mode=false"
+       rescue OpenSSL::OpenSSLError
+         pend "Could not set FIPS mode (OpenSSL::OpenSSLError: \#$!); skipping"
+       end
+-- 
+2.41.0
+

SOURCES/ruby-3.3.0-test-file-utime.patch

@@ -0,0 +1,36 @@
+From 8d1109c03bacc952b6218af2e4ae9b74c9855273 Mon Sep 17 00:00:00 2001
+From: Hiroshi SHIBATA <hsbt@ruby-lang.org>
+Date: Wed, 22 Mar 2023 16:10:06 +0900
+Subject: [PATCH] Added assertion values for Amazon Linux 2023
+
+---
+ spec/ruby/core/file/utime_spec.rb | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/spec/ruby/core/file/utime_spec.rb b/spec/ruby/core/file/utime_spec.rb
+index a191e2924037c..0b0e4f979c935 100644
+--- a/spec/ruby/core/file/utime_spec.rb
++++ b/spec/ruby/core/file/utime_spec.rb
+@@ -72,17 +72,19 @@
+ 
+   platform_is :linux do
+     platform_is wordsize: 64 do
+-      it "allows Time instances in the far future to set mtime and atime (but some filesystems limit it up to 2446-05-10 or 2038-01-19)" do
++      it "allows Time instances in the far future to set mtime and atime (but some filesystems limit it up to 2446-05-10 or 2038-01-19 or 2486-07-02)" do
+         # https://ext4.wiki.kernel.org/index.php/Ext4_Disk_Layout#Inode_Timestamps
+         # "Therefore, timestamps should not overflow until May 2446."
+         # https://lwn.net/Articles/804382/
+         # "On-disk timestamps hitting the y2038 limit..."
+         # The problem seems to be being improved, but currently it actually fails on XFS on RHEL8
+         # https://rubyci.org/logs/rubyci.s3.amazonaws.com/rhel8/ruby-master/log/20201112T123004Z.fail.html.gz
++        # Amazon Linux 2023 returns 2486-07-02 in this example
++        # http://rubyci.s3.amazonaws.com/amazon2023/ruby-master/log/20230322T063004Z.fail.html.gz
+         time = Time.at(1<<44)
+         File.utime(time, time, @file1)
+-        [559444, 2446, 2038].should.include? File.atime(@file1).year
+-        [559444, 2446, 2038].should.include? File.mtime(@file1).year
++        [559444, 2486, 2446, 2038].should.include? File.atime(@file1).year
++        [559444, 2486, 2446, 2038].should.include? File.mtime(@file1).year
+       end
+     end
+   end

SOURCES/ruby-3.4.0-ruby-net-http-Renew-test-certificates.patch

@@ -1,236 +0,0 @@
-From d3933fc753187a055a4904af82f5f3794c88c416 Mon Sep 17 00:00:00 2001
-From: Sorah Fukumori <her@sorah.jp>
-Date: Mon, 1 Jan 2024 20:45:54 +0900
-Subject: [PATCH] [ruby/net-http] Renew test certificates
-
-The private key is replaced with a public known test key published at
-[RFC 9500].
-
-Also lifetime has been extended to 10 years from 4 years.
-
-[RFC 9500]: https://www.rfc-editor.org/rfc/rfc9500.html
-
-https://github.com/ruby/net-http/commit/4ab6c4a500
----
- test/net/fixtures/cacert.pem | 44 ++++++++--------
- test/net/fixtures/server.crt | 99 +++++++-----------------------------
- test/net/fixtures/server.key | 55 ++++++++++----------
- 4 files changed, 68 insertions(+), 130 deletions(-)
-
-diff --git a/test/net/fixtures/cacert.pem b/test/net/fixtures/cacert.pem
-index f623bd62ed375..24c83f1c65225 100644
---- a/test/net/fixtures/cacert.pem
-+++ b/test/net/fixtures/cacert.pem
-@@ -1,24 +1,24 @@
- -----BEGIN CERTIFICATE-----
--MIID7TCCAtWgAwIBAgIJAIltvxrFAuSnMA0GCSqGSIb3DQEBCwUAMIGMMQswCQYD
--VQQGEwJKUDEQMA4GA1UECAwHU2hpbWFuZTEUMBIGA1UEBwwLTWF0ei1lIGNpdHkx
--FzAVBgNVBAoMDlJ1YnkgQ29yZSBUZWFtMRUwEwYDVQQDDAxSdWJ5IFRlc3QgQ0Ex
--JTAjBgkqhkiG9w0BCQEWFnNlY3VyaXR5QHJ1YnktbGFuZy5vcmcwHhcNMTkwMTAy
--MDI1ODI4WhcNMjQwMTAxMDI1ODI4WjCBjDELMAkGA1UEBhMCSlAxEDAOBgNVBAgM
--B1NoaW1hbmUxFDASBgNVBAcMC01hdHotZSBjaXR5MRcwFQYDVQQKDA5SdWJ5IENv
--cmUgVGVhbTEVMBMGA1UEAwwMUnVieSBUZXN0IENBMSUwIwYJKoZIhvcNAQkBFhZz
--ZWN1cml0eUBydWJ5LWxhbmcub3JnMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
--CgKCAQEAznlbjRVhz1NlutHVrhcGnK8W0qug2ujKXv1njSC4U6nJF6py7I9EeehV
--SaKePyv+I9z3K1LnfUHOtUbdwdKC77yN66A6q2aqzu5q09/NSykcZGOIF0GuItYI
--3nvW3IqBddff2ffsyR+9pBjfb5AIPP08WowF9q4s1eGULwZc4w2B8PFhtxYANd7d
--BvGLXFlcufv9tDtzyRi4t7eqxCRJkZQIZNZ6DHHIJrNxejOILfHLarI12yk8VK6L
--2LG4WgGqyeePiRyd1o1MbuiAFYqAwpXNUbRKg5NaZGwBHZk8UZ+uFKt1QMBURO5R
--WFy1c349jbWszTqFyL4Lnbg9HhAowQIDAQABo1AwTjAdBgNVHQ4EFgQU9tEiKdU9
--I9derQyc5nWPnc34nVMwHwYDVR0jBBgwFoAU9tEiKdU9I9derQyc5nWPnc34nVMw
--DAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAxj7F/u3C3fgq24N7hGRA
--of7ClFQxGmo/IGT0AISzW3HiVYiFaikKhbO1NwD9aBpD8Zwe62sCqMh8jGV/b0+q
--aOORnWYNy2R6r9FkASAglmdF6xn3bhgGD5ls4pCvcG9FynGnGc24g6MrjFNrBYUS
--2iIZsg36i0IJswo/Dy6HLphCms2BMCD3DeWtfjePUiTmQHJo6HsQIKP/u4N4Fvee
--uMBInei2M4VU74fLXbmKl1F9AEX7JDP3BKSZG19Ch5pnUo4uXM1uNTGsi07P4Y0s
--K44+SKBC0bYEFbDK0eQWMrX3kIhkPxyIWhxdq9/NqPYjShuSEAhA6CSpmRg0pqc+
--mA==
-+MIID+zCCAuOgAwIBAgIUGMvHl3EhtKPKcgc3NQSAYfFuC+8wDQYJKoZIhvcNAQEL
-+BQAwgYwxCzAJBgNVBAYTAkpQMRAwDgYDVQQIDAdTaGltYW5lMRQwEgYDVQQHDAtN
-+YXR6LWUgY2l0eTEXMBUGA1UECgwOUnVieSBDb3JlIFRlYW0xFTATBgNVBAMMDFJ1
-+YnkgVGVzdCBDQTElMCMGCSqGSIb3DQEJARYWc2VjdXJpdHlAcnVieS1sYW5nLm9y
-+ZzAeFw0yNDAxMDExMTQ3MjNaFw0zMzEyMjkxMTQ3MjNaMIGMMQswCQYDVQQGEwJK
-+UDEQMA4GA1UECAwHU2hpbWFuZTEUMBIGA1UEBwwLTWF0ei1lIGNpdHkxFzAVBgNV
-+BAoMDlJ1YnkgQ29yZSBUZWFtMRUwEwYDVQQDDAxSdWJ5IFRlc3QgQ0ExJTAjBgkq
-+hkiG9w0BCQEWFnNlY3VyaXR5QHJ1YnktbGFuZy5vcmcwggEiMA0GCSqGSIb3DQEB
-+AQUAA4IBDwAwggEKAoIBAQCw+egZQ6eumJKq3hfKfED4dE/tL4FI5sjqont9ABVI
-++1GSqyi1bFBgsRjM0THllIdMbKmJtWwnKW8J+5OgNN8y6Xxv8JmM/Y5vQt2lis0f
-+qXmG8UTz0VTWdlAXXmhUs6lSADvAaIe4RVrCsZ97L3ZQTryY7JRVcbB4khUN3Gp0
-+yg+801SXzoFTTa+UGIRLE66jH51aa5VXu99hnv1OiH8tQrjdi8mH6uG/icq4XuIe
-+NWMF32wHqIOOPvQcWV3M5D2vxJEj702Ku6k9OQXkAo17qRSEonWW4HtLbtmS8He1
-+JNPc/n3dVUm+fM6NoDXPoLP7j55G9zKyqGtGAWXAj1MTAgMBAAGjUzBRMB0GA1Ud
-+DgQWBBSJGVleDvFp9cu9R+E0/OKYzGkwkTAfBgNVHSMEGDAWgBSJGVleDvFp9cu9
-+R+E0/OKYzGkwkTAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQBl
-+8GLB8skAWlkSw/FwbUmEV3zyqu+p7PNP5YIYoZs0D74e7yVulGQ6PKMZH5hrZmHo
-+orFSQU+VUUirG8nDGj7Rzce8WeWBxsaDGC8CE2dq6nC6LuUwtbdMnBrH0LRWAz48
-+jGFF3jHtVz8VsGfoZTZCjukWqNXvU6hETT9GsfU+PZqbqcTVRPH52+XgYayKdIbD
-+r97RM4X3+aXBHcUW0b76eyyi65RR/Xtvn8ioZt2AdX7T2tZzJyXJN3Hupp77s6Ui
-+AZR35SToHCZeTZD12YBvLBdaTPLZN7O/Q/aAO9ZiJaZ7SbFOjz813B2hxXab4Fob
-+2uJX6eMWTVxYK5D4M9lm
- -----END CERTIFICATE-----
-diff --git a/test/net/fixtures/server.crt b/test/net/fixtures/server.crt
-index 5ca78a6d146a0..5d2923795dabc 100644
---- a/test/net/fixtures/server.crt
-+++ b/test/net/fixtures/server.crt
-@@ -1,82 +1,21 @@
--Certificate:
--    Data:
--        Version: 3 (0x2)
--        Serial Number: 2 (0x2)
--    Signature Algorithm: sha256WithRSAEncryption
--        Issuer: C=JP, ST=Shimane, L=Matz-e city, O=Ruby Core Team, CN=Ruby Test CA/emailAddress=security@ruby-lang.org
--        Validity
--            Not Before: Jan  2 03:27:13 2019 GMT
--            Not After : Jan  1 03:27:13 2024 GMT
--        Subject: C=JP, ST=Shimane, O=Ruby Core Team, OU=Ruby Test, CN=localhost
--        Subject Public Key Info:
--            Public Key Algorithm: rsaEncryption
--                Public-Key: (2048 bit)
--                Modulus:
--                    00:e8:da:9c:01:2e:2b:10:ec:49:cd:5e:07:13:07:
--                    9c:70:9e:c6:74:bc:13:c2:e1:6f:c6:82:fd:e3:48:
--                    e0:2c:a5:68:c7:9e:42:de:60:54:65:e6:6a:14:57:
--                    7a:30:d0:cc:b5:b6:d9:c3:d2:df:c9:25:97:54:67:
--                    cf:f6:be:5e:cb:8b:ee:03:c5:e1:e2:f9:e7:f7:d1:
--                    0c:47:f0:b8:da:33:5a:ad:41:ad:e7:b5:a2:7b:b7:
--                    bf:30:da:60:f8:e3:54:a2:bc:3a:fd:1b:74:d9:dc:
--                    74:42:e9:29:be:df:ac:b4:4f:eb:32:f4:06:f1:e1:
--                    8c:4b:a8:8b:fb:29:e7:b1:bf:1d:01:ee:73:0f:f9:
--                    40:dc:d5:15:79:d9:c6:73:d0:c0:dd:cb:e4:da:19:
--                    47:80:c6:14:04:72:fd:9a:7c:8f:11:82:76:49:04:
--                    79:cc:f2:5c:31:22:95:13:3e:5d:40:a6:4d:e0:a3:
--                    02:26:7d:52:3b:bb:ed:65:a1:0f:ed:6b:b0:3c:d4:
--                    de:61:15:5e:d3:dd:68:09:9f:4a:57:a5:c2:a9:6d:
--                    86:92:c5:f4:a4:d4:b7:13:3b:52:63:24:05:e2:cc:
--                    e3:8a:3c:d4:35:34:2b:10:bb:58:72:e7:e1:8d:1d:
--                    74:8c:61:16:20:3d:d0:1c:4e:8f:6e:fd:fe:64:10:
--                    4f:41
--                Exponent: 65537 (0x10001)
--        X509v3 extensions:
--            X509v3 Basic Constraints: 
--                CA:FALSE
--            Netscape Comment: 
--                OpenSSL Generated Certificate
--            X509v3 Subject Key Identifier: 
--                ED:28:C2:7E:AB:4B:C8:E8:FE:55:6D:66:95:31:1C:2D:60:F9:02:36
--            X509v3 Authority Key Identifier: 
--                keyid:F6:D1:22:29:D5:3D:23:D7:5E:AD:0C:9C:E6:75:8F:9D:CD:F8:9D:53
--
--    Signature Algorithm: sha256WithRSAEncryption
--         1d:b8:c5:8b:72:41:20:65:ad:27:6f:15:63:06:26:12:8d:9c:
--         ad:ca:f4:db:97:b4:90:cb:ff:35:94:bb:2a:a7:a1:ab:1e:35:
--         2d:a5:3f:c9:24:b0:1a:58:89:75:3e:81:0a:2c:4f:98:f9:51:
--         fb:c0:a3:09:d0:0a:9b:e7:a2:b7:c3:60:40:c8:f4:6d:b2:6a:
--         56:12:17:4c:00:24:31:df:9c:60:ae:b1:68:54:a9:e6:b5:4a:
--         04:e6:92:05:86:d9:5a:dc:96:30:a5:58:de:14:99:0f:e5:15:
--         89:3e:9b:eb:80:e3:bd:83:c3:ea:33:35:4b:3e:2f:d3:0d:64:
--         93:67:7f:8d:f5:3f:0c:27:bc:37:5a:cc:d6:47:16:af:5a:62:
--         d2:da:51:f8:74:06:6b:24:ad:28:68:08:98:37:7d:ed:0e:ab:
--         1e:82:61:05:d0:ba:75:a0:ab:21:b0:9a:fd:2b:54:86:1d:0d:
--         1f:c2:d4:77:1f:72:26:5e:ad:8a:9f:09:36:6d:44:be:74:c2:
--         5a:3e:ff:5c:9d:75:d6:38:7b:c5:39:f9:44:6e:a1:d1:8e:ff:
--         63:db:c4:bb:c6:91:92:ca:5c:60:9b:1d:eb:0a:de:08:ee:bf:
--         da:76:03:65:62:29:8b:f8:7f:c7:86:73:1e:f6:1f:2d:89:69:
--         fd:be:bd:6e
- -----BEGIN CERTIFICATE-----
--MIID4zCCAsugAwIBAgIBAjANBgkqhkiG9w0BAQsFADCBjDELMAkGA1UEBhMCSlAx
--EDAOBgNVBAgMB1NoaW1hbmUxFDASBgNVBAcMC01hdHotZSBjaXR5MRcwFQYDVQQK
--DA5SdWJ5IENvcmUgVGVhbTEVMBMGA1UEAwwMUnVieSBUZXN0IENBMSUwIwYJKoZI
--hvcNAQkBFhZzZWN1cml0eUBydWJ5LWxhbmcub3JnMB4XDTE5MDEwMjAzMjcxM1oX
--DTI0MDEwMTAzMjcxM1owYDELMAkGA1UEBhMCSlAxEDAOBgNVBAgMB1NoaW1hbmUx
--FzAVBgNVBAoMDlJ1YnkgQ29yZSBUZWFtMRIwEAYDVQQLDAlSdWJ5IFRlc3QxEjAQ
--BgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
--AOjanAEuKxDsSc1eBxMHnHCexnS8E8Lhb8aC/eNI4CylaMeeQt5gVGXmahRXejDQ
--zLW22cPS38kll1Rnz/a+XsuL7gPF4eL55/fRDEfwuNozWq1Bree1onu3vzDaYPjj
--VKK8Ov0bdNncdELpKb7frLRP6zL0BvHhjEuoi/sp57G/HQHucw/5QNzVFXnZxnPQ
--wN3L5NoZR4DGFARy/Zp8jxGCdkkEeczyXDEilRM+XUCmTeCjAiZ9Uju77WWhD+1r
--sDzU3mEVXtPdaAmfSlelwqlthpLF9KTUtxM7UmMkBeLM44o81DU0KxC7WHLn4Y0d
--dIxhFiA90BxOj279/mQQT0ECAwEAAaN7MHkwCQYDVR0TBAIwADAsBglghkgBhvhC
--AQ0EHxYdT3BlblNTTCBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUwHQYDVR0OBBYEFO0o
--wn6rS8jo/lVtZpUxHC1g+QI2MB8GA1UdIwQYMBaAFPbRIinVPSPXXq0MnOZ1j53N
--+J1TMA0GCSqGSIb3DQEBCwUAA4IBAQAduMWLckEgZa0nbxVjBiYSjZytyvTbl7SQ
--y/81lLsqp6GrHjUtpT/JJLAaWIl1PoEKLE+Y+VH7wKMJ0Aqb56K3w2BAyPRtsmpW
--EhdMACQx35xgrrFoVKnmtUoE5pIFhtla3JYwpVjeFJkP5RWJPpvrgOO9g8PqMzVL
--Pi/TDWSTZ3+N9T8MJ7w3WszWRxavWmLS2lH4dAZrJK0oaAiYN33tDqsegmEF0Lp1
--oKshsJr9K1SGHQ0fwtR3H3ImXq2Knwk2bUS+dMJaPv9cnXXWOHvFOflEbqHRjv9j
--28S7xpGSylxgmx3rCt4I7r/adgNlYimL+H/HhnMe9h8tiWn9vr1u
-+MIIDYTCCAkkCAQAwDQYJKoZIhvcNAQELBQAwgYwxCzAJBgNVBAYTAkpQMRAwDgYD
-+VQQIDAdTaGltYW5lMRQwEgYDVQQHDAtNYXR6LWUgY2l0eTEXMBUGA1UECgwOUnVi
-+eSBDb3JlIFRlYW0xFTATBgNVBAMMDFJ1YnkgVGVzdCBDQTElMCMGCSqGSIb3DQEJ
-+ARYWc2VjdXJpdHlAcnVieS1sYW5nLm9yZzAeFw0yNDAxMDExMTQ3MjNaFw0zMzEy
-+MjkxMTQ3MjNaMGAxCzAJBgNVBAYTAkpQMRAwDgYDVQQIDAdTaGltYW5lMRcwFQYD
-+VQQKDA5SdWJ5IENvcmUgVGVhbTESMBAGA1UECwwJUnVieSBUZXN0MRIwEAYDVQQD
-+DAlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCw+egZ
-+Q6eumJKq3hfKfED4dE/tL4FI5sjqont9ABVI+1GSqyi1bFBgsRjM0THllIdMbKmJ
-+tWwnKW8J+5OgNN8y6Xxv8JmM/Y5vQt2lis0fqXmG8UTz0VTWdlAXXmhUs6lSADvA
-+aIe4RVrCsZ97L3ZQTryY7JRVcbB4khUN3Gp0yg+801SXzoFTTa+UGIRLE66jH51a
-+a5VXu99hnv1OiH8tQrjdi8mH6uG/icq4XuIeNWMF32wHqIOOPvQcWV3M5D2vxJEj
-+702Ku6k9OQXkAo17qRSEonWW4HtLbtmS8He1JNPc/n3dVUm+fM6NoDXPoLP7j55G
-+9zKyqGtGAWXAj1MTAgMBAAEwDQYJKoZIhvcNAQELBQADggEBACtGNdj5TEtnJBYp
-+M+LhBeU3oNteldfycEm993gJp6ghWZFg23oX8fVmyEeJr/3Ca9bAgDqg0t9a0npN
-+oWKEY6wVKqcHgu3gSvThF5c9KhGbeDDmlTSVVNQmXWX0K2d4lS2cwZHH8mCm2mrY
-+PDqlEkSc7k4qSiqigdS8i80Yk+lDXWsm8CjsiC93qaRM7DnS0WPQR0c16S95oM6G
-+VklFKUSDAuFjw9aVWA/nahOucjn0w5fVW6lyIlkBslC1ChlaDgJmvhz+Ol3iMsE0
-+kAmFNu2KKPVrpMWaBID49QwQTDyhetNLaVVFM88iUdA9JDoVMEuP1mm39JqyzHTu
-+uBrdP4Q=
- -----END CERTIFICATE-----
-diff --git a/test/net/fixtures/server.key b/test/net/fixtures/server.key
-index 7f2380e71e637..6a83d5bcf4a52 100644
---- a/test/net/fixtures/server.key
-+++ b/test/net/fixtures/server.key
-@@ -1,28 +1,27 @@
-------BEGIN PRIVATE KEY-----
--MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQDo2pwBLisQ7EnN
--XgcTB5xwnsZ0vBPC4W/Ggv3jSOAspWjHnkLeYFRl5moUV3ow0My1ttnD0t/JJZdU
--Z8/2vl7Li+4DxeHi+ef30QxH8LjaM1qtQa3ntaJ7t78w2mD441SivDr9G3TZ3HRC
--6Sm+36y0T+sy9Abx4YxLqIv7Keexvx0B7nMP+UDc1RV52cZz0MDdy+TaGUeAxhQE
--cv2afI8RgnZJBHnM8lwxIpUTPl1Apk3gowImfVI7u+1loQ/ta7A81N5hFV7T3WgJ
--n0pXpcKpbYaSxfSk1LcTO1JjJAXizOOKPNQ1NCsQu1hy5+GNHXSMYRYgPdAcTo9u
--/f5kEE9BAgMBAAECggEBAOHkwhc7DLh8IhTDNSW26oMu5OP2WU1jmiYAigDmf+OQ
--DBgrZj+JQBci8qINQxL8XLukSZn5hvQCLc7Kbyu1/wyEEUFDxSGGwwzclodr9kho
--LX2LDASPZrOSzD2+fPi2wTKmXKuS6Uc44OjQfZkYMNkz9r4Vkm8xGgOD3VipjIYX
--QXlhhdqkXZcNABsihCV52GKkDFSVm8jv95YJc5xhoYCy/3a4/qPdF0aT2R7oYUej
--hKrxVDskyooe8Zg/JTydZNV5GQEDmW01/K3r6XGT26oPi1AqMU1gtv/jkW56CRQQ
--1got8smnqM+AV7Slf9R6DauIPdQJ2S8wsr/o8ISBsOECgYEA9YrqEP2gAYSGFXRt
--liw0WI2Ant8BqXS6yvq1jLo/qWhLw/ph4Di73OQ2mpycVTpgfGr2wFPQR1XJ+0Fd
--U+Ir/C3Q7FK4VIGHK7B0zNvZr5tEjlFfeRezo2JMVw5YWeSagIFcSwK+KqCTH9qc
--pw/Eb8nB/4XNcpTZu7Fg0Wc+ooUCgYEA8sVaicn1Wxkpb45a4qfrA6wOr5xdJ4cC
--A5qs7vjX2OdPIQOmoQhdI7bCWFXZzF33wA4YCws6j5wRaySLIJqdms8Gl9QnODy1
--ZlA5gwKToBC/jqPmWAXSKb8EH7cHilaxU9OKnQ7CfwlGLHqjMtjrhR7KHlt3CVRs
--oRmvsjZVXI0CgYAmPedslAO6mMhFSSfULrhMXmV82OCqYrrA6EEkVNGbcdnzAOkD
--gfKIWabDd8bFY10po4Mguy0CHzNhBXIioWQWV5BlbhC1YKMLw+S9DzSdLAKGY9gJ
--xQ4+UQ3wtRQ/k+IYR413RUsW2oFvgZ3KSyNeAb9MK6uuv84VdG/OzVSs/QKBgQDn
--kap//l2EbObiWyaERunckdVcW0lcN+KK75J/TGwPoOwQsLvTpPe65kxRGGrtDsEQ
--uCDk/+v3KkZPLgdrrTAih9FhJ+PVN8tMcb+6IM4SA4fFFr/UPJEwct0LJ3oQ0grJ
--y+HPWFHb/Uurh7t99/4H98uR02sjQh1wOeEmm78mzQKBgQDm+LzGH0se6CXQ6cdZ
--g1JRZeXkDEsrW3hfAsW62xJQmXcWxBoblP9OamMY+A06rM5og3JbDk5Zm6JsOaA8
--wS2gw4ilp46jors4eQey8ux7kB9LzdBoDBBElnsbjLO8oBNZlVcYXg+6BOl/CUi7
--2whRF0FEjKA8ehrNhAq+VFfFNw==
-------END PRIVATE KEY-----
-+-----BEGIN RSA PRIVATE KEY-----
-+MIIEowIBAAKCAQEAsPnoGUOnrpiSqt4XynxA+HRP7S+BSObI6qJ7fQAVSPtRkqso
-+tWxQYLEYzNEx5ZSHTGypibVsJylvCfuToDTfMul8b/CZjP2Ob0LdpYrNH6l5hvFE
-+89FU1nZQF15oVLOpUgA7wGiHuEVawrGfey92UE68mOyUVXGweJIVDdxqdMoPvNNU
-+l86BU02vlBiESxOuox+dWmuVV7vfYZ79Toh/LUK43YvJh+rhv4nKuF7iHjVjBd9s
-+B6iDjj70HFldzOQ9r8SRI+9NirupPTkF5AKNe6kUhKJ1luB7S27ZkvB3tSTT3P59
-+3VVJvnzOjaA1z6Cz+4+eRvcysqhrRgFlwI9TEwIDAQABAoIBAEEYiyDP29vCzx/+
-+dS3LqnI5BjUuJhXUnc6AWX/PCgVAO+8A+gZRgvct7PtZb0sM6P9ZcLrweomlGezI
-+FrL0/6xQaa8bBr/ve/a8155OgcjFo6fZEw3Dz7ra5fbSiPmu4/b/kvrg+Br1l77J
-+aun6uUAs1f5B9wW+vbR7tzbT/mxaUeDiBzKpe15GwcvbJtdIVMa2YErtRjc1/5B2
-+BGVXyvlJv0SIlcIEMsHgnAFOp1ZgQ08aDzvilLq8XVMOahAhP1O2A3X8hKdXPyrx
-+IVWE9bS9ptTo+eF6eNl+d7htpKGEZHUxinoQpWEBTv+iOoHsVunkEJ3vjLP3lyI/
-+fY0NQ1ECgYEA3RBXAjgvIys2gfU3keImF8e/TprLge1I2vbWmV2j6rZCg5r/AS0u
-+pii5CvJ5/T5vfJPNgPBy8B/yRDs+6PJO1GmnlhOkG9JAIPkv0RBZvR0PMBtbp6nT
-+Y3yo1lwamBVBfY6rc0sLTzosZh2aGoLzrHNMQFMGaauORzBFpY5lU50CgYEAzPHl
-+u5DI6Xgep1vr8QvCUuEesCOgJg8Yh1UqVoY/SmQh6MYAv1I9bLGwrb3WW/7kqIoD
-+fj0aQV5buVZI2loMomtU9KY5SFIsPV+JuUpy7/+VE01ZQM5FdY8wiYCQiVZYju9X
-+Wz5LxMNoz+gT7pwlLCsC4N+R8aoBk404aF1gum8CgYAJ7VTq7Zj4TFV7Soa/T1eE
-+k9y8a+kdoYk3BASpCHJ29M5R2KEA7YV9wrBklHTz8VzSTFTbKHEQ5W5csAhoL5Fo
-+qoHzFFi3Qx7MHESQb9qHyolHEMNx6QdsHUn7rlEnaTTyrXh3ifQtD6C0yTmFXUIS
-+CW9wKApOrnyKJ9nI0HcuZQKBgQCMtoV6e9VGX4AEfpuHvAAnMYQFgeBiYTkBKltQ
-+XwozhH63uMMomUmtSG87Sz1TmrXadjAhy8gsG6I0pWaN7QgBuFnzQ/HOkwTm+qKw
-+AsrZt4zeXNwsH7QXHEJCFnCmqw9QzEoZTrNtHJHpNboBuVnYcoueZEJrP8OnUG3r
-+UjmopwKBgAqB2KYYMUqAOvYcBnEfLDmyZv9BTVNHbR2lKkMYqv5LlvDaBxVfilE0
-+2riO4p6BaAdvzXjKeRrGNEKoHNBpOSfYCOM16NjL8hIZB1CaV3WbT5oY+jp7Mzd5
-+7d56RZOE+ERK2uz/7JX9VSsM/LbH9pJibd4e8mikDS9ntciqOH/3
-+-----END RSA PRIVATE KEY-----

SOURCES/ruby-spec-Fix-tests-on-tzdata-2022b.patch

@@ -0,0 +1,40 @@
+From 7e9ec8a20b0f7469b415283d2ec0c22087f8eb2b Mon Sep 17 00:00:00 2001
+From: Jun Aruga <jaruga@redhat.com>
+Date: Wed, 24 Aug 2022 12:02:56 +0200
+Subject: [PATCH] Fix tests with Europe/Amsterdam pre-1970 time on tzdata
+ version 2022b.
+
+The Time Zone Database (tzdata) changed the pre-1970 timestamps in some zones
+including Europe/Amsterdam on tzdata version 2022b or later.
+See <https://github.com/eggert/tz/commit/35fa37fbbb152f5dbed4fd5edfdc968e3584fe12>.
+
+The tzdata RPM package maintainer on Fedora project suggested changing the Ruby
+test, because the change is intentional.
+See <https://bugzilla.redhat.com/show_bug.cgi?id=2118259#c1>.
+
+We use post-1970 time test data to simplify the test.
+---
+ core/time/shared/local.rb | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/spec/ruby/core/time/shared/local.rb b/spec/ruby/core/time/shared/local.rb
+index 43f331c4c..c4aa7a7ea 100644
+--- a/spec/ruby/core/time/shared/local.rb
++++ b/spec/ruby/core/time/shared/local.rb
+@@ -8,10 +8,10 @@ describe :time_local, shared: true do
+ 
+   platform_is_not :windows do
+     describe "timezone changes" do
+-      it "correctly adjusts the timezone change to 'CEST' on 'Europe/Amsterdam'" do
++      it "correctly adjusts the timezone change to 'CET' on 'Europe/Amsterdam'" do
+         with_timezone("Europe/Amsterdam") do
+-          Time.send(@method, 1940, 5, 16).to_a.should ==
+-            [0, 40, 1, 16, 5, 1940, 4, 137, true, "CEST"]
++          Time.send(@method, 1970, 5, 16).to_a.should ==
++            [0, 0, 0, 16, 5, 1970, 6, 136, false, "CET"]
+         end
+       end
+     end
+-- 
+2.36.1
+

SOURCES/rubygem-cgi-0.3.6-Loosen-the-domain-regex-to-accept-dot.patch

@@ -1,41 +0,0 @@
-From 5e09d632f3b56d85b2659ab47d5571ae9e270e10 Mon Sep 17 00:00:00 2001
-From: Xenor Chang <tubaxenor@gmail.com>
-Date: Mon, 28 Nov 2022 12:34:06 +0800
-Subject: [PATCH] Loosen the domain regex to accept '.' (#29)
-
-* Loosen the domain regex to accept '.'
-
-Co-authored-by: Nobuyoshi Nakada <nobu@ruby-lang.org>
-Co-authored-by: Hiroshi SHIBATA <hsbt@ruby-lang.org>
----
- lib/cgi/cookie.rb           | 2 +-
- test/cgi/test_cgi_cookie.rb | 3 +++
- 2 files changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/lib/cgi/cookie.rb b/lib/cgi/cookie.rb
-index 1a9c1a8..9498e2f 100644
---- a/lib/cgi/cookie.rb
-+++ b/lib/cgi/cookie.rb
-@@ -42,7 +42,7 @@ class Cookie < Array
-
-     TOKEN_RE = %r"\A[[!-~]&&[^()<>@,;:\\\"/?=\[\]{}]]+\z"
-     PATH_VALUE_RE = %r"\A[[ -~]&&[^;]]*\z"
--    DOMAIN_VALUE_RE = %r"\A(?<label>(?!-)[-A-Za-z0-9]+(?<!-))(?:\.\g<label>)*\z"
-+    DOMAIN_VALUE_RE = %r"\A\.?(?<label>(?!-)[-A-Za-z0-9]+(?<!-))(?:\.\g<label>)*\z"
-
-     # Create a new CGI::Cookie object.
-     #
-diff --git a/test/cgi/test_cgi_cookie.rb b/test/cgi/test_cgi_cookie.rb
-index 6d31932..eadae45 100644
---- a/test/cgi/test_cgi_cookie.rb
-+++ b/test/cgi/test_cgi_cookie.rb
-@@ -65,6 +65,9 @@ class CGICookieTest < Test::Unit::TestCase
-     cookie = CGI::Cookie.new({'domain' => 'a.example.com'}.merge(h))
-     assert_equal('a.example.com', cookie.domain)
-
-+    cookie = CGI::Cookie.new(h.merge('domain'=>'.example.com'))
-+    assert_equal('.example.com', cookie.domain)
-+
-     cookie = CGI::Cookie.new({'domain'=>'1.example.com'}.merge(h))
-     assert_equal('1.example.com', cookie.domain, 'enhanced by RFC 1123')
-

SOURCES/rubygem-strscan-1.0.2-Accept-String-as-a-pattern.patch

@@ -1,264 +0,0 @@
-From e56ac27d19cc3acdf6c1cb13b14224c43df5f5f6 Mon Sep 17 00:00:00 2001
-From: Kouhei Sutou <kou@clear-code.com>
-Date: Thu, 4 Apr 2019 17:52:50 +0900
-Subject: [PATCH] Accept String as a pattern
-
-It's only for head only match case such as StringScanner#scan.
-
-If we use a String as a pattern, we can improve match performance.
-Here is a result of the including benchmark. It shows String as a
-pattern is 1.25x faster than Regexp as a pattern.
-
-    % rake benchmark
-    /tmp/local/bin/ruby -S benchmark-driver benchmark/scan.yaml
-    Warming up --------------------------------------
-                  regexp    12.094M i/s -     12.242M times in 1.012250s (82.69ns/i, 277clocks/i)
-                  string    14.653M i/s -     14.889M times in 1.016124s (68.25ns/i, 252clocks/i)
-    Calculating -------------------------------------
-                  regexp    14.713M i/s -     36.281M times in 2.465970s (67.97ns/i, 254clocks/i)
-                  string    18.422M i/s -     43.959M times in 2.386255s (54.28ns/i, 201clocks/i)
-
-    Comparison:
-                  string:  18421631.8 i/s
-                  regexp:  14712660.7 i/s - 1.25x  slower
-
-====
-Backport https://github.com/ruby/strscan/pull/4 for strscan.
-
-REXML fixes for CVE-2024-35716 depend on this feature.
----
- ext/strscan/strscan.c              | 92 +++++++++++++++++++-----------
- test/strscan/test_stringscanner.rb | 45 ++++++++++++++-
- 2 files changed, 100 insertions(+), 37 deletions(-)
-
-diff --git a/ext/strscan/strscan.c b/ext/strscan/strscan.c
-index d6168a0d4f..43319b672e 100644
---- a/ext/strscan/strscan.c
-+++ b/ext/strscan/strscan.c
-@@ -447,15 +447,18 @@ strscan_set_pos(VALUE self, VALUE v)
- }
- 
- static VALUE
--strscan_do_scan(VALUE self, VALUE regex, int succptr, int getstr, int headonly)
-+strscan_do_scan(VALUE self, VALUE pattern, int succptr, int getstr, int headonly)
- {
--    regex_t *rb_reg_prepare_re(VALUE re, VALUE str);
-     struct strscanner *p;
--    regex_t *re;
--    long ret;
--    int tmpreg;
- 
--    Check_Type(regex, T_REGEXP);
-+    if (headonly) {
-+        if (!RB_TYPE_P(pattern, T_REGEXP)) {
-+            StringValue(pattern);
-+        }
-+    }
-+    else {
-+        Check_Type(pattern, T_REGEXP);
-+    }
-     GET_SCANNER(self, p);
- 
-     CLEAR_MATCH_STATUS(p);
-@@ -463,37 +466,55 @@ strscan_do_scan(VALUE self, VALUE regex, int succptr, int getstr, int headonly)
-         return Qnil;
-     }
- 
--    p->regex = regex;
--    re = rb_reg_prepare_re(regex, p->str);
--    tmpreg = re != RREGEXP_PTR(regex);
--    if (!tmpreg) RREGEXP(regex)->usecnt++;
-+    if (RB_TYPE_P(pattern, T_REGEXP)) {
-+        regex_t *rb_reg_prepare_re(VALUE re, VALUE str);
-+        regex_t *re;
-+        long ret;
-+        int tmpreg;
-+
-+        p->regex = pattern;
-+        re = rb_reg_prepare_re(pattern, p->str);
-+        tmpreg = re != RREGEXP_PTR(pattern);
-+        if (!tmpreg) RREGEXP(pattern)->usecnt++;
-+
-+        if (headonly) {
-+            ret = onig_match(re, (UChar* )CURPTR(p),
-+                             (UChar* )(CURPTR(p) + S_RESTLEN(p)),
-+                             (UChar* )CURPTR(p), &(p->regs), ONIG_OPTION_NONE);
-+        }
-+        else {
-+            ret = onig_search(re,
-+                              (UChar* )CURPTR(p), (UChar* )(CURPTR(p) + S_RESTLEN(p)),
-+                              (UChar* )CURPTR(p), (UChar* )(CURPTR(p) + S_RESTLEN(p)),
-+                              &(p->regs), ONIG_OPTION_NONE);
-+        }
-+        if (!tmpreg) RREGEXP(pattern)->usecnt--;
-+        if (tmpreg) {
-+            if (RREGEXP(pattern)->usecnt) {
-+                onig_free(re);
-+            }
-+            else {
-+                onig_free(RREGEXP_PTR(pattern));
-+                RREGEXP_PTR(pattern) = re;
-+            }
-+        }
- 
--    if (headonly) {
--        ret = onig_match(re, (UChar* )CURPTR(p),
--                         (UChar* )(CURPTR(p) + S_RESTLEN(p)),
--                         (UChar* )CURPTR(p), &(p->regs), ONIG_OPTION_NONE);
-+        if (ret == -2) rb_raise(ScanError, "regexp buffer overflow");
-+        if (ret < 0) {
-+            /* not matched */
-+            return Qnil;
-+        }
-     }
-     else {
--        ret = onig_search(re,
--                          (UChar* )CURPTR(p), (UChar* )(CURPTR(p) + S_RESTLEN(p)),
--                          (UChar* )CURPTR(p), (UChar* )(CURPTR(p) + S_RESTLEN(p)),
--                          &(p->regs), ONIG_OPTION_NONE);
--    }
--    if (!tmpreg) RREGEXP(regex)->usecnt--;
--    if (tmpreg) {
--        if (RREGEXP(regex)->usecnt) {
--            onig_free(re);
-+        rb_enc_check(p->str, pattern);
-+        if (S_RESTLEN(p) < RSTRING_LEN(pattern)) {
-+            return Qnil;
-         }
--        else {
--            onig_free(RREGEXP_PTR(regex));
--            RREGEXP_PTR(regex) = re;
-+        if (memcmp(CURPTR(p), RSTRING_PTR(pattern), RSTRING_LEN(pattern)) != 0) {
-+            return Qnil;
-         }
--    }
--
--    if (ret == -2) rb_raise(ScanError, "regexp buffer overflow");
--    if (ret < 0) {
--        /* not matched */
--        return Qnil;
-+        onig_region_clear(&(p->regs));
-+        onig_region_set(&(p->regs), 0, 0, RSTRING_LEN(pattern));
-     }
- 
-     MATCHED(p);
-@@ -520,7 +541,8 @@ strscan_do_scan(VALUE self, VALUE regex, int succptr, int getstr, int headonly)
-  *   p s.scan(/\w+/)   # -> "test"
-  *   p s.scan(/\w+/)   # -> nil
-  *   p s.scan(/\s+/)   # -> " "
-- *   p s.scan(/\w+/)   # -> "string"
-+ *   p s.scan("str")   # -> "str"
-+ *   p s.scan(/\w+/)   # -> "ing"
-  *   p s.scan(/./)     # -> nil
-  *
-  */
-@@ -539,6 +561,7 @@ strscan_scan(VALUE self, VALUE re)
-  *   s = StringScanner.new('test string')
-  *   p s.match?(/\w+/)   # -> 4
-  *   p s.match?(/\w+/)   # -> 4
-+ *   p s.match?("test")  # -> 4
-  *   p s.match?(/\s+/)   # -> nil
-  */
- static VALUE
-@@ -560,7 +583,8 @@ strscan_match_p(VALUE self, VALUE re)
-  *   p s.skip(/\w+/)   # -> 4
-  *   p s.skip(/\w+/)   # -> nil
-  *   p s.skip(/\s+/)   # -> 1
-- *   p s.skip(/\w+/)   # -> 6
-+ *   p s.skip("st")    # -> 2
-+ *   p s.skip(/\w+/)   # -> 4
-  *   p s.skip(/./)     # -> nil
-  *
-  */
-diff --git a/test/strscan/test_stringscanner.rb b/test/strscan/test_stringscanner.rb
-index 3423f9cfed..63b1ce1f9b 100644
---- a/test/strscan/test_stringscanner.rb
-+++ b/test/strscan/test_stringscanner.rb
-@@ -282,6 +282,22 @@ def test_scan
-     assert_equal "", s.scan(//)
-   end
- 
-+  def test_scan_string
-+    s = StringScanner.new('stra strb strc')
-+    assert_equal 'str', s.scan('str')
-+    assert_equal 'str', s[0]
-+    assert_equal 3, s.pos
-+    assert_equal false, s.tainted?
-+    assert_equal 'a ', s.scan('a ')
-+
-+    str = 'stra strb strc'.dup
-+    str.taint
-+    s = StringScanner.new(str, false)
-+    matched = s.scan('str')
-+    assert_equal 'str', matched
-+    assert_equal true, matched.tainted?
-+  end
-+
-   def test_skip
-     s = StringScanner.new('stra strb strc', true)
-     assert_equal 4, s.skip(/\w+/)
-@@ -367,8 +383,10 @@ def test_matched
-     assert_equal false, s.matched.tainted?
-     s.scan(/\s+/)
-     assert_equal ' ', s.matched
-+    s.scan('st')
-+    assert_equal 'st', s.matched
-     s.scan(/\w+/)
--    assert_equal 'strb', s.matched
-+    assert_equal 'rb', s.matched
-     s.scan(/\s+/)
-     assert_equal ' ', s.matched
-     s.scan(/\w+/)
-@@ -483,7 +501,7 @@ def test_pre_match
-     s.skip(/\s/)
-     assert_equal 'a', s.pre_match
-     assert_equal false, s.pre_match.tainted?
--    s.scan(/\w/)
-+    s.scan('b')
-     assert_equal 'a ', s.pre_match
-     s.scan_until(/c/)
-     assert_equal 'a b ', s.pre_match
-@@ -513,7 +531,7 @@ def test_post_match
-     assert_equal ' b c d e', s.post_match
-     s.skip(/\s/)
-     assert_equal 'b c d e', s.post_match
--    s.scan(/\w/)
-+    s.scan('b')
-     assert_equal ' c d e', s.post_match
-     s.scan_until(/c/)
-     assert_equal ' d e', s.post_match
-@@ -589,6 +607,20 @@ def test_encoding
-     assert_equal(Encoding::EUC_JP, ss.scan(/./e).encoding)
-   end
- 
-+  def test_encoding_string
-+    str = "\xA1\xA2".dup.force_encoding("euc-jp")
-+    ss = StringScanner.new(str)
-+    assert_equal(str.dup, ss.scan(str.dup))
-+  end
-+
-+  def test_invalid_encoding_string
-+    str = "\xA1\xA2".dup.force_encoding("euc-jp")
-+    ss = StringScanner.new(str)
-+    assert_raise(Encoding::CompatibilityError) do
-+      ss.scan(str.encode("UTF-8"))
-+    end
-+  end
-+
-   def test_generic_regexp
-     ss = StringScanner.new("\xA1\xA2".dup.force_encoding("euc-jp"))
-     t = ss.scan(/./)
-@@ -643,6 +675,13 @@ def test_exist_p
-     assert_equal(nil, s.exist?(/e/))
-   end
- 
-+  def test_exist_p_string
-+    s = StringScanner.new("test string")
-+    assert_raise(TypeError) do
-+      s.exist?(" ")
-+    end
-+  end
-+
-   def test_skip_until
-     s = StringScanner.new("Foo Bar Baz")
-     assert_equal(3, s.skip_until(/Foo/))

SOURCES/rubygems-3.2.30-Provide-distinguished-name-which-will-be-correctly-p.patch

@@ -0,0 +1,44 @@
+From bb0f57aeb4de36a3b2b8b8cb01d25b32af0357d3 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?V=C3=ADt=20Ondruch?= <vondruch@redhat.com>
+Date: Wed, 27 Oct 2021 16:28:24 +0200
+Subject: [PATCH] Provide distinguished name which will be correctly parsed.
+
+It seems that since ruby openssl 2.1.0 [[1]], the distinguished name
+submitted to `OpenSSL::X509::Name.parse` is not correctly parsed if it
+does not contain the first slash:
+
+~~~
+$ ruby -v
+ruby 3.0.2p107 (2021-07-07 revision 0db68f0233) [x86_64-linux]
+
+$ gem list | grep openssl
+openssl (default: 2.2.0)
+
+$ irb -r openssl
+irb(main):001:0> OpenSSL::X509::Name.parse("CN=nobody/DC=example").to_s(OpenSSL::X509::Name::ONELINE)
+=> "CN = nobody/DC=example"
+irb(main):002:0> OpenSSL::X509::Name.parse("/CN=nobody/DC=example").to_s(OpenSSL::X509::Name::ONELINE)
+=> "CN = nobody, DC = example"
+~~~
+
+[1]: https://github.com/ruby/openssl/commit/19c67cd10c57f3ab7b13966c36431ebc3fdd653b
+---
+ lib/rubygems/security.rb | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/rubygems/security.rb b/lib/rubygems/security.rb
+index c80639af6d..12de141f36 100644
+--- a/lib/rubygems/security.rb
++++ b/lib/rubygems/security.rb
+@@ -510,7 +510,7 @@ def self.email_to_name(email_address)
+ 
+     dcs = dcs.split '.'
+ 
+-    name = "CN=#{cn}/#{dcs.map {|dc| "DC=#{dc}" }.join '/'}"
++    name = "/CN=#{cn}/#{dcs.map {|dc| "DC=#{dc}" }.join '/'}"
+ 
+     OpenSSL::X509::Name.parse name
+   end
+-- 
+2.32.0
+

SOURCES/rubygems-3.2.33-Fix-loading-operating_system-rb-customizations-too-late.patch

@@ -0,0 +1,261 @@
+From e80e7a3d0b3d72f7af7286b935702b3fab117008 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?David=20Rodr=C3=ADguez?= <deivid.rodriguez@riseup.net>
+Date: Wed, 8 Dec 2021 21:12:24 +0100
+Subject: [PATCH 1/5] More explicit require
+
+This class does not use `rubygems/deprecate`. It uses
+`rubygems/version`, which in turn uses `rubygems/deprecate`. Make this
+explicit.
+---
+ lib/rubygems/requirement.rb | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/rubygems/requirement.rb b/lib/rubygems/requirement.rb
+index d2e28fab5b4..9edd6aa7d3c 100644
+--- a/lib/rubygems/requirement.rb
++++ b/lib/rubygems/requirement.rb
+@@ -1,5 +1,5 @@
+ # frozen_string_literal: true
+-require_relative "deprecate"
++require_relative "version"
+ 
+ ##
+ # A Requirement is a set of one or more version restrictions. It supports a
+
+From 4e46dcc17ee5cabbde43b8a34063b8ab042536f9 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?David=20Rodr=C3=ADguez?= <deivid.rodriguez@riseup.net>
+Date: Wed, 8 Dec 2021 21:17:30 +0100
+Subject: [PATCH 2/5] Remove ineffective autoloads
+
+These files are loaded on startup unconditionally, so we can require
+them relatively when needed.
+---
+ lib/rubygems.rb               | 4 +---
+ lib/rubygems/specification.rb | 2 ++
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/lib/rubygems.rb b/lib/rubygems.rb
+index f803e47628e..b8747409304 100644
+--- a/lib/rubygems.rb
++++ b/lib/rubygems.rb
+@@ -1310,19 +1310,17 @@ def default_gem_load_paths
+   autoload :Licenses,           File.expand_path('rubygems/util/licenses', __dir__)
+   autoload :NameTuple,          File.expand_path('rubygems/name_tuple', __dir__)
+   autoload :PathSupport,        File.expand_path('rubygems/path_support', __dir__)
+-  autoload :Platform,           File.expand_path('rubygems/platform', __dir__)
+   autoload :RequestSet,         File.expand_path('rubygems/request_set', __dir__)
+-  autoload :Requirement,        File.expand_path('rubygems/requirement', __dir__)
+   autoload :Resolver,           File.expand_path('rubygems/resolver', __dir__)
+   autoload :Source,             File.expand_path('rubygems/source', __dir__)
+   autoload :SourceList,         File.expand_path('rubygems/source_list', __dir__)
+   autoload :SpecFetcher,        File.expand_path('rubygems/spec_fetcher', __dir__)
+-  autoload :Specification,      File.expand_path('rubygems/specification', __dir__)
+   autoload :Util,               File.expand_path('rubygems/util', __dir__)
+   autoload :Version,            File.expand_path('rubygems/version', __dir__)
+ end
+ 
+ require_relative 'rubygems/exceptions'
++require_relative 'rubygems/specification'
+ 
+ # REFACTOR: This should be pulled out into some kind of hacks file.
+ begin
+diff --git a/lib/rubygems/specification.rb b/lib/rubygems/specification.rb
+index d3b96491a28..dc5e5ba0138 100644
+--- a/lib/rubygems/specification.rb
++++ b/lib/rubygems/specification.rb
+@@ -9,6 +9,8 @@
+ require_relative 'deprecate'
+ require_relative 'basic_specification'
+ require_relative 'stub_specification'
++require_relative 'platform'
++require_relative 'requirement'
+ require_relative 'specification_policy'
+ require_relative 'util/list'
+ 
+
+From 96b6b3e04e8e4fec17f63079a0caf999a2709d71 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?David=20Rodr=C3=ADguez?= <deivid.rodriguez@riseup.net>
+Date: Wed, 8 Dec 2021 21:45:16 +0100
+Subject: [PATCH 3/5] Load `operating_system.rb` customizations before setting
+ up default gems
+
+It's very common for packagers to configure gem paths in this file, for
+example, `Gem.default_dir`. Also, setting up default gems requires these
+paths to be set, so that we know which default gems need to be setup.
+
+If we setup default gems before loading `operatin_system.rb`
+customizations, the wrong default gems will be setup.
+
+Unfortunately, default gems loaded by `operating_system.rb` can't be
+upgraded if we do this, but it seems much of a smaller issue. I wasn't
+even fully sure it was the right thing to do when I added that, and it
+was not the culprit of the end user issue that led to making that
+change.
+---
+ lib/rubygems.rb                | 32 ++++++++++++++++----------------
+ test/rubygems/test_rubygems.rb | 23 +++++++++++++++++++++++
+ 2 files changed, 39 insertions(+), 16 deletions(-)
+
+diff --git a/lib/rubygems.rb b/lib/rubygems.rb
+index b8747409304..11474b6554c 100644
+--- a/lib/rubygems.rb
++++ b/lib/rubygems.rb
+@@ -1323,22 +1323,6 @@ def default_gem_load_paths
+ require_relative 'rubygems/specification'
+ 
+ # REFACTOR: This should be pulled out into some kind of hacks file.
+-begin
+-  ##
+-  # Defaults the Ruby implementation wants to provide for RubyGems
+-
+-  require "rubygems/defaults/#{RUBY_ENGINE}"
+-rescue LoadError
+-end
+-
+-##
+-# Loads the default specs.
+-Gem::Specification.load_defaults
+-
+-require_relative 'rubygems/core_ext/kernel_gem'
+-require_relative 'rubygems/core_ext/kernel_require'
+-require_relative 'rubygems/core_ext/kernel_warn'
+-
+ begin
+   ##
+   # Defaults the operating system (or packager) wants to provide for RubyGems.
+@@ -1354,3 +1338,19 @@ def default_gem_load_paths
+     "the problem and ask for help."
+   raise e.class, msg
+ end
++
++begin
++  ##
++  # Defaults the Ruby implementation wants to provide for RubyGems
++
++  require "rubygems/defaults/#{RUBY_ENGINE}"
++rescue LoadError
++end
++
++##
++# Loads the default specs.
++Gem::Specification.load_defaults
++
++require_relative 'rubygems/core_ext/kernel_gem'
++require_relative 'rubygems/core_ext/kernel_require'
++require_relative 'rubygems/core_ext/kernel_warn'
+diff --git a/test/rubygems/test_rubygems.rb b/test/rubygems/test_rubygems.rb
+index 493b9fdf4a3..fa77a299322 100644
+--- a/test/rubygems/test_rubygems.rb
++++ b/test/rubygems/test_rubygems.rb
+@@ -22,6 +22,29 @@ def test_operating_system_other_exceptions
+     "the problem and ask for help."
+   end
+ 
++  def test_operating_system_customizing_default_dir
++    pend "does not apply to truffleruby" if RUBY_ENGINE == 'truffleruby'
++    pend "loads a custom defaults/jruby file that gets in the middle" if RUBY_ENGINE == 'jruby'
++
++    # On a non existing default dir, there should be no gems
++
++    path = util_install_operating_system_rb <<-RUBY
++      module Gem
++        def self.default_dir
++          File.expand_path("foo")
++        end
++      end
++    RUBY
++
++    output = Gem::Util.popen(
++      *ruby_with_rubygems_and_fake_operating_system_in_load_path(path),
++      '-e',
++      "require \"rubygems\"; puts Gem::Specification.stubs.map(&:full_name)",
++      {:err => [:child, :out]}
++    ).strip
++    assert_empty output
++  end
++
+   private
+ 
+   def util_install_operating_system_rb(content)
+
+From 52cfdd14fd1213a97aac12f01177e27779de9035 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?David=20Rodr=C3=ADguez?= <deivid.rodriguez@riseup.net>
+Date: Thu, 9 Dec 2021 06:08:31 +0100
+Subject: [PATCH 4/5] Install default fiddle on latest ruby on specs that need
+ it
+
+Otherwise first OS customizations load and activate that fiddle version,
+but then when we change to `Gem.default_dir`, that fiddle version is no
+longer there.
+---
+ spec/bundler/commands/clean_spec.rb          | 2 +-
+ spec/bundler/install/gems/standalone_spec.rb | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/spec/bundler/commands/clean_spec.rb b/spec/bundler/commands/clean_spec.rb
+index ffaf22dbb32..65231b35fac 100644
+--- a/spec/bundler/commands/clean_spec.rb
++++ b/spec/bundler/commands/clean_spec.rb
+@@ -638,7 +638,7 @@ def should_not_have_gems(*gems)
+       s.executables = "irb"
+     end
+ 
+-    realworld_system_gems "fiddle --version 1.0.6", "tsort --version 0.1.0", "pathname --version 0.1.0", "set --version 1.0.1"
++    realworld_system_gems "fiddle --version 1.0.8", "tsort --version 0.1.0", "pathname --version 0.1.0", "set --version 1.0.1"
+ 
+     install_gemfile <<-G
+       source "#{file_uri_for(gem_repo2)}"
+diff --git a/spec/bundler/install/gems/standalone_spec.rb b/spec/bundler/install/gems/standalone_spec.rb
+index db16a1b0e13..faefda25f45 100644
+--- a/spec/bundler/install/gems/standalone_spec.rb
++++ b/spec/bundler/install/gems/standalone_spec.rb
+@@ -113,7 +113,7 @@
+       skip "does not work on rubygems versions where `--install_dir` doesn't respect --default" unless Gem::Installer.for_spec(loaded_gemspec, :install_dir => "/foo").default_spec_file == "/foo/specifications/default/bundler-#{Bundler::VERSION}.gemspec" # Since rubygems 3.2.0.rc.2
+       skip "does not work on old rubies because the realworld gems that need to be installed don't support them" if RUBY_VERSION < "2.7.0"
+ 
+-      realworld_system_gems "fiddle --version 1.0.6", "tsort --version 0.1.0"
++      realworld_system_gems "fiddle --version 1.0.8", "tsort --version 0.1.0"
+ 
+       necessary_system_gems = ["optparse --version 0.1.1", "psych --version 3.3.2", "yaml --version 0.1.1", "logger --version 1.4.3", "etc --version 1.2.0", "stringio --version 3.0.0"]
+       necessary_system_gems += ["shellwords --version 0.1.0", "base64 --version 0.1.0", "resolv --version 0.2.1"] if Gem.rubygems_version < Gem::Version.new("3.3.3.a")
+
+From c6a9c81021092c9157f5616a2bbe1323411a5bf8 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?David=20Rodr=C3=ADguez?= <deivid.rodriguez@riseup.net>
+Date: Thu, 9 Dec 2021 12:46:23 +0100
+Subject: [PATCH 5/5] Resolve symlinks in LOAD_PATH when activating
+ pre-required default gems
+
+Some double load issues were reported a while ago by OS packagers where
+if a gem has been required before rubygems, and then after, rubygems
+require would cause a double load.
+
+We avoid this issue by activating the corresponding gem if we detect
+that a file in the default LOAD_PATH that belongs to a default gem has
+already been required when rubygems registers default gems.
+
+However, the fix does not take into account that the default LOAD_PATH
+could potentially include symlinks. This change fixes the same double
+load issue described above but for situations where the default
+LOAD_PATH includes symlinks.
+---
+ lib/rubygems.rb | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/lib/rubygems.rb b/lib/rubygems.rb
+index 11474b6554c..b7dda38d522 100644
+--- a/lib/rubygems.rb
++++ b/lib/rubygems.rb
+@@ -1293,7 +1293,12 @@ def already_loaded?(file)
+     end
+ 
+     def default_gem_load_paths
+-      @default_gem_load_paths ||= $LOAD_PATH[load_path_insert_index..-1]
++      @default_gem_load_paths ||= $LOAD_PATH[load_path_insert_index..-1].map do |lp|
++        expanded = File.expand_path(lp)
++        next expanded unless File.exist?(expanded)
++
++        File.realpath(expanded)
++      end
+     end
+   end
+ 

SOURCES/rubygems-3.3.1-Fix-compatibility-with-OpenSSL3.0.patch

@@ -0,0 +1,105 @@
+From 558128594de16add5b453833fd5b043a24c1b7f5 Mon Sep 17 00:00:00 2001
+From: Kazuki Yamaguchi <k@rhe.jp>
+Date: Wed, 22 Dec 2021 01:38:47 +0900
+Subject: [PATCH 1/3] Use OpenSSL::PKey::EC.generate to generate ECC key pairs
+
+When Ruby/OpenSSL is built against OpenSSL 3.0, OpenSSL::PKey::PKey
+instances are immutable and OpenSSL::PKey::EC#generate_key cannot work
+because it modifies the receiver.
+
+OpenSSL::PKey::EC.generate is available on Ruby 2.4 (Ruby/OpenSSL 2.0)
+or later.
+---
+ lib/rubygems/security.rb | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/lib/rubygems/security.rb b/lib/rubygems/security.rb
+index 22759972070..2aa07381d69 100644
+--- a/lib/rubygems/security.rb
++++ b/lib/rubygems/security.rb
+@@ -490,9 +490,13 @@ def self.create_key(algorithm)
+       when 'rsa'
+         OpenSSL::PKey::RSA.new(RSA_DSA_KEY_LENGTH)
+       when 'ec'
+-        domain_key = OpenSSL::PKey::EC.new(EC_NAME)
+-        domain_key.generate_key
+-        domain_key
++        if RUBY_VERSION >= "2.4.0"
++          OpenSSL::PKey::EC.generate(EC_NAME)
++        else
++          domain_key = OpenSSL::PKey::EC.new(EC_NAME)
++          domain_key.generate_key
++          domain_key
++        end
+       else
+         raise Gem::Security::Exception,
+         "#{algorithm} algorithm not found. RSA, DSA, and EC algorithms are supported."
+
+From 60067d4f09b7fb9c23bed38e91acfde0293f29a0 Mon Sep 17 00:00:00 2001
+From: Kazuki Yamaguchi <k@rhe.jp>
+Date: Wed, 22 Dec 2021 01:49:05 +0900
+Subject: [PATCH 2/3] Use OpenSSL::X509::Certificate#check_private_key
+
+The method is for the exact purpose: to check that an instance of
+OpenSSL::PKey::PKey matches the public key in a certificate.
+---
+ lib/rubygems/security.rb        | 2 +-
+ lib/rubygems/security/policy.rb | 4 +---
+ 2 files changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/lib/rubygems/security.rb b/lib/rubygems/security.rb
+index 2aa07381d69..2906819bd34 100644
+--- a/lib/rubygems/security.rb
++++ b/lib/rubygems/security.rb
+@@ -530,7 +530,7 @@ def self.re_sign(expired_certificate, private_key, age = ONE_YEAR,
+     raise Gem::Security::Exception,
+           "incorrect signing key for re-signing " +
+           "#{expired_certificate.subject}" unless
+-      expired_certificate.public_key.to_pem == get_public_key(private_key).to_pem
++      expired_certificate.check_private_key(private_key)
+ 
+     unless expired_certificate.subject.to_s ==
+            expired_certificate.issuer.to_s
+diff --git a/lib/rubygems/security/policy.rb b/lib/rubygems/security/policy.rb
+index 3c3cb647ee3..06eae073f4a 100644
+--- a/lib/rubygems/security/policy.rb
++++ b/lib/rubygems/security/policy.rb
+@@ -115,11 +115,9 @@ def check_key(signer, key)
+       raise Gem::Security::Exception, 'missing key or signature'
+     end
+ 
+-    public_key = Gem::Security.get_public_key(key)
+-
+     raise Gem::Security::Exception,
+       "certificate #{signer.subject} does not match the signing key" unless
+-        signer.public_key.to_pem == public_key.to_pem
++        signer.check_private_key(key)
+ 
+     true
+   end
+
+From 6819e3d0fadc10ce8d10919402eedb730cf0e43f Mon Sep 17 00:00:00 2001
+From: Kazuki Yamaguchi <k@rhe.jp>
+Date: Wed, 22 Dec 2021 01:54:10 +0900
+Subject: [PATCH 3/3] Fix Gem::Security.get_public_key on OpenSSL 3.0
+
+Ruby/OpenSSL 2.2 added OpenSSL::PKey::PKey#public_to_der for serializing
+only the public key components contained in the instance. This works
+for all possible key types.
+---
+ lib/rubygems/security.rb | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/lib/rubygems/security.rb b/lib/rubygems/security.rb
+index 2906819bd34..f21c1756422 100644
+--- a/lib/rubygems/security.rb
++++ b/lib/rubygems/security.rb
+@@ -424,6 +424,8 @@ def self.create_cert(subject, key, age = ONE_YEAR, extensions = EXTENSIONS,
+   # Gets the right public key from a PKey instance
+ 
+   def self.get_public_key(key)
++    # Ruby 3.0 (Ruby/OpenSSL 2.2) or later
++    return OpenSSL::PKey.read(key.public_to_der) if key.respond_to?(:public_to_der)
+     return key.public_key unless key.is_a?(OpenSSL::PKey::EC)
+ 
+     ec_key = OpenSSL::PKey::EC.new(key.group.curve_name)

SOURCES/rubygems.prov

@@ -9,9 +9,9 @@ module RubyGemsProv
     def self.normalize_prerelease(version)
       if version.prerelease?
         prerelease = version.version.sub /^#{version.release}\./, ''
-        "#{version.release}-0.1.#{prerelease}"
+        "#{version.release}~#{prerelease}"
       else
-        "#{version.release}-1"
+        version.release
       end
     end
   end

SOURCES/rubygems.req

@@ -35,31 +35,35 @@ module RubyGemsReq
     # with RPM .spec file.
     def self.requirement_versions_to_rpm(requirement)
       self.expand_requirement(requirement.requirements).map do |op, version|
-        version == Gem::Version.new(0) ? "" : "#{op} #{version}"
+        version == Gem::Version.new(0) ? "" : " #{op} #{version}"
       end
     end
+
+    # Compose dependency together with its requirements in RPM rich dependency
+    # string.
+    def self.compose_dependency_string(name, requirements)
+      dependency_strings = requirements.map { |requirement| name + requirement }
+      dependency_string = dependency_strings.join(' with ')
+      dependency_string.prepend('(').concat(')') if dependency_strings.length > 1
+      dependency_string
+    end
   end
 
   # Report RubyGems dependency, versioned if required.
   def self.rubygems_dependency(specification)
-    Helpers::requirement_versions_to_rpm(specification.required_rubygems_version).each do |requirement|
-      dependency_string = "ruby(rubygems)"
-      dependency_string += " #{specification.required_rubygems_version}" if requirement&.length > 0
-      puts dependency_string
-    end
+    dependency_name = "ruby(rubygems)"
+    requirements = Helpers::requirement_versions_to_rpm(specification.required_rubygems_version)
+
+    puts Helpers::compose_dependency_string(dependency_name, requirements)
   end
 
   # Report all gem dependencies including their version.
   def self.gem_depenencies(specification)
     specification.runtime_dependencies.each do |dependency|
-      dependency_strings = Helpers::requirement_versions_to_rpm(dependency.requirement).map do |requirement|
-        requirement_string = "rubygem(#{dependency.name})"
-        requirement_string += " #{requirement}" if requirement&.length > 0
-        requirement_string
-      end
-      dependency_string = dependency_strings.join(' with ')
-      dependency_string.prepend('(').concat(')') if dependency_strings.length > 1
-      puts dependency_string
+      dependency_name = "rubygem(#{dependency.name})"
+      requirements = Helpers::requirement_versions_to_rpm(dependency.requirement)
+
+      puts Helpers::compose_dependency_string(dependency_name, requirements)
     end
   end
 

SOURCES/test_openssl_fips.rb

@@ -0,0 +1,34 @@
+require 'openssl'
+
+# Run openssl tests in OpenSSL FIPS. See the link below for how to test.
+# https://github.com/ruby/openssl/blob/master/.github/workflows/test.yml
+# - step name: test on fips module
+
+# Listing the testing files by an array explicitly rather than the `Dir.glob`
+# to prevent the test files from not loading unintentionally.
+TEST_FILES = %w[
+  test/openssl/test_fips.rb
+  test/openssl/test_pkey.rb
+].freeze
+
+if ARGV.empty?
+  puts 'ERROR: Argument base_dir required.'
+  puts "Usage: #{__FILE__} base_dir [options]"
+  exit false
+end
+BASE_DIR = ARGV[0]
+abs_test_files = TEST_FILES.map { |file| File.join(BASE_DIR, file) }
+
+# Set Fedora/RHEL downstream OpenSSL downstream environment variable to enable
+# FIPS module in non-FIPS OS environment. It is available in Fedora 38 or later
+# versions.
+# https://src.fedoraproject.org/rpms/openssl/blob/rawhide/f/0009-Add-Kernel-FIPS-mode-flag-support.patch
+ENV['OPENSSL_FORCE_FIPS_MODE'] = '1'
+# A flag to tell the tests the current environment is FIPS enabled.
+# https://github.com/ruby/openssl/blob/master/test/openssl/test_fips.rb
+ENV['TEST_RUBY_OPENSSL_FIPS_ENABLED'] = 'true'
+
+abs_test_files.each do |file|
+  puts "INFO: Loading #{file}."
+  require file
+end