rpms/sscg
7
0
Fork 0
Code Issues Pull Requests Releases Activity

import UBI sscg-4.0.3-2.el9

Browse Source
This commit is contained in:
AlmaLinux RelEng Bot 2026-05-19 20:10:05 -04:00
parent e171d2551c
commit 9edbc4de52
14 changed files with 229 additions and 1492 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.gitignore vendored
View File

@ -1 +1 @@
SOURCES/sscg-3.0.0.tar.xz
SOURCES/sscg-4.0.3.tar.gz

2
.sscg.metadata
View File

@ -1 +1 @@
81e3b33e118edff96583314ceb4bfde9a1e6b45c SOURCES/sscg-3.0.0.tar.xz
829d6dd6d5ad493499317a2bf6f25167c9b3c623 SOURCES/sscg-4.0.3.tar.gz

30
SOURCES/0001-Drop-usage-of-ERR_GET_FUNC.patch
View File

@ -1,30 +0,0 @@
From 67ef8f036f7324fe37bc7a7e31a38e7088d21df2 Mon Sep 17 00:00:00 2001
From: Stephen Gallagher <sgallagh@redhat.com>
Date: Sat, 7 Aug 2021 11:48:04 -0400
Subject: [PATCH 1/6] Drop usage of ERR_GET_FUNC()
This macro was dropped in OpenSSL 3.0 and has actually not been
providing a valid return code for some time.
Related: rhbz#1964837
Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>
---
include/sscg.h | 1 -
1 file changed, 1 deletion(-)
diff --git a/include/sscg.h b/include/sscg.h
index faf86ba4f68e186bd35c7bc3ec77b98b8e37d253..851dc93175607e5223a70ef40a5feb24b7b69215 100644
--- a/include/sscg.h
+++ b/include/sscg.h
@@ -96,7 +96,6 @@
/* Get information about error from OpenSSL */ \
unsigned long _ssl_error = ERR_get_error (); \
if ((ERR_GET_LIB (_ssl_error) == ERR_LIB_UI) && \
- (ERR_GET_FUNC (_ssl_error) == UI_F_UI_SET_RESULT_EX) && \
((ERR_GET_REASON (_ssl_error) == UI_R_RESULT_TOO_LARGE) || \
(ERR_GET_REASON (_ssl_error) == UI_R_RESULT_TOO_SMALL))) \
{ \
--
2.49.0

119
SOURCES/0001-Restore-defaulting-to-dhparams.pem-creation.patch Normal file
View File

@ -0,0 +1,119 @@
From 771a7663bccbd360f017c4c22358a46abcdfa93f Mon Sep 17 00:00:00 2001
From: Stephen Gallagher <sgallagh@redhat.com>
Date: Mon, 27 Oct 2025 14:58:11 -0400
Subject: [PATCH] Restore defaulting to dhparams.pem creation
This was disabled upstream, but for backwards-compatibility in the RHEL
9 and RHEL 10 lifecycle, we'll continue to do so there.
This reverts commit 0e5e011acc2dc19f3c2fcb5699cf8fa662a2b135.
Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>
---
src/arguments.c | 4 ++--
src/sscg.c | 39 +++++++++++++++++++++++++---------
test/test_dhparams_creation.sh | 6 +-----
3 files changed, 32 insertions(+), 17 deletions(-)
diff --git a/src/arguments.c b/src/arguments.c
index 38c8740c1f159368d6fc92d51ba48d83700c3320..4ff75fdf86728592e7ca05db4cf4ac88bf79ca2e 100644
--- a/src/arguments.c
+++ b/src/arguments.c
@@ -682,7 +682,7 @@ sscg_handle_arguments (TALLOC_CTX *mem_ctx,
&options->dhparams_file,
0,
_("A file to contain a set of Diffie-Hellman parameters. "
- "(Default: not created)"),
+ "(Default: \"./dhparams.pem\")"),
NULL
},
@@ -692,7 +692,7 @@ sscg_handle_arguments (TALLOC_CTX *mem_ctx,
POPT_ARG_NONE | POPT_ARGFLAG_DOC_HIDDEN,
&options->skip_dhparams,
0,
- _ ("Deprecated: Retained for backwards compatibility. To be removed in SSCG 5.0."),
+ _ ("Do not create the dhparams file"),
NULL
},
diff --git a/src/sscg.c b/src/sscg.c
index b9b191f109300f6447262858f57a3a8321a14966..d2dce334cff1342d975e9867a2c82a222d76925e 100644
--- a/src/sscg.c
+++ b/src/sscg.c
@@ -166,19 +166,38 @@ main (int argc, const char **argv)
options->crl_mode);
CHECK_OK (ret);
- if (options->dhparams_file)
+ if (!options->skip_dhparams)
{
- dhparams_file = talloc_strdup (main_ctx, options->dhparams_file);
- CHECK_MEM (dhparams_file);
+ if (options->dhparams_file)
+ {
+ dhparams_file = talloc_strdup (main_ctx, options->dhparams_file);
+ CHECK_MEM (dhparams_file);
- ret = sscg_io_utils_add_output_file (options->streams,
- SSCG_FILE_TYPE_DHPARAMS,
- dhparams_file,
- options->overwrite,
- options->dhparams_mode);
- CHECK_OK (ret);
+ ret = sscg_io_utils_add_output_file (options->streams,
+ SSCG_FILE_TYPE_DHPARAMS,
+ dhparams_file,
+ options->overwrite,
+ options->dhparams_mode);
+ CHECK_OK (ret);
+ }
+ else
+ {
+ dhparams_file = talloc_strdup (main_ctx, "./dhparams.pem");
+ CHECK_MEM (dhparams_file);
+
+ ret = sscg_io_utils_add_output_file (options->streams,
+ SSCG_FILE_TYPE_DHPARAMS,
+ dhparams_file,
+ options->overwrite,
+ options->dhparams_mode);
+ SSCG_LOG (SSCG_VERBOSE,
+ "Could not open dhparams file %s: %s\n",
+ dhparams_file,
+ strerror (ret));
+ /* This is non-fatal if the file path was not explicitly passed */
+ ret = EOK;
+ }
}
-
/* Validate and open the file paths */
ret = sscg_io_utils_open_BIOs (options->streams);
CHECK_OK (ret);
diff --git a/test/test_dhparams_creation.sh b/test/test_dhparams_creation.sh
index d0b4cbb71f3cd1656f1422524c4da7b30fbf3e0a..49f2b08d23246c90663eb7d2e5078817eb42139b 100755
--- a/test/test_dhparams_creation.sh
+++ b/test/test_dhparams_creation.sh
@@ -42,10 +42,6 @@
# just warn and ignore it if it was not (returning 0). However, if it is
# explicitly requested on the command-line and cannot be written to that
# location, it should fail with an error code.
-#
-# Updated 2025-10-21: SSCG 4.0 no longer creates the dhparams file by default.
-# It should not attempt to create it unless explicitly requested using the
-# --dhparams-file option.
set -e
@@ -181,7 +177,7 @@ run_test \
"" \
0 \
"$WRITABLE_DIR/dhparams.pem" \
- "false" \
+ "true" \
"$WRITABLE_DIR"
# Test 2: No --dhparams-file, readonly directory, no existing file
--
2.52.0

38
SOURCES/0002-Avoid-segfault-on-receiving-bad-CLI-arguments.patch Normal file
View File

@ -0,0 +1,38 @@
From f40d0070641543a140428d70211d53d36fd2c34b Mon Sep 17 00:00:00 2001
From: Stephen Gallagher <sgallagh@redhat.com>
Date: Tue, 2 Dec 2025 12:12:26 -0500
Subject: [PATCH 2/3] Avoid segfault on receiving bad CLI arguments
Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>
---
src/sscg.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/src/sscg.c b/src/sscg.c
index d2dce334cff1342d975e9867a2c82a222d76925e..070d567bb189d42a20fd0a80f8fe2f7caae4d9eb 100644
--- a/src/sscg.c
+++ b/src/sscg.c
@@ -59,7 +59,7 @@ int
main (int argc, const char **argv)
{
int ret, sret;
- struct sscg_options *options;
+ struct sscg_options *options = NULL;
bool build_client_cert = false;
char *dhparams_file = NULL;
@@ -361,7 +361,10 @@ main (int argc, const char **argv)
done:
if (ret != EOK)
{
- sscg_io_utils_delete_output_files (options->streams);
+ if (options)
+ {
+ sscg_io_utils_delete_output_files (options->streams);
+ }
}
talloc_zfree (main_ctx);
if (getenv ("SSCG_TALLOC_REPORT"))
--
2.52.0

42
SOURCES/0002-Correct-certificate-lifetime-calculation.patch
View File

@ -1,42 +0,0 @@
From 5852d74f338bb6de3f303275aa73024f082b47bf Mon Sep 17 00:00:00 2001
From: Allison Karlitskaya <allison.karlitskaya@redhat.com>
Date: Tue, 26 Oct 2021 12:32:13 +0200
Subject: [PATCH 2/6] Correct certificate lifetime calculation
sscg allows passing the certificate lifetime, as a number of days, as a
commandline argument. It converts this value to seconds using the
formula
days * 24 * 3650
which is incorrect. The correct value is 3600.
This effectively adds an extra 20 minutes to the lifetime of the
certificate for each day as given on the commandline, and was enough to
cause some new integration tests in cockpit to fail.
Interestingly, 3650 is the old default value for the number of days of
certificate validity (~10 years) so this probably slipped in as a sort
of muscle-memory-assisted typo.
Let's just write `24 * 60 * 60` to make things clear.
---
src/x509.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/x509.c b/src/x509.c
index dc1594a4bdcb9d81607f0fe5ad2d4562e5edb533..7c7e4dfe56d5756862f3e0f851941e846ce96f31 100644
--- a/src/x509.c
+++ b/src/x509.c
@@ -418,7 +418,7 @@ sscg_sign_x509_csr (TALLOC_CTX *mem_ctx,
/* set time */
X509_gmtime_adj (X509_get_notBefore (cert), 0);
- X509_gmtime_adj (X509_get_notAfter (cert), days * 24 * 3650);
+ X509_gmtime_adj (X509_get_notAfter (cert), days * 24 * 60 * 60);
/* set subject */
subject = X509_NAME_dup (X509_REQ_get_subject_name (csr));
--
2.49.0

29
SOURCES/0003-Restore-error-message.patch Normal file
View File

@ -0,0 +1,29 @@
From 08dacb632cc331027f39dcfa0b782aeb6f2f893a Mon Sep 17 00:00:00 2001
From: Stephen Gallagher <sgallagh@redhat.com>
Date: Tue, 2 Dec 2025 12:19:04 -0500
Subject: [PATCH 3/3] Restore error message
This was dropped in 4.0, but should be retained in RHEL 9 and 10 for
compatibility, particularly with existing tests that look for specific
messages.
Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>
---
src/sscg.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/src/sscg.c b/src/sscg.c
index 070d567bb189d42a20fd0a80f8fe2f7caae4d9eb..9f46cd622a4d55bd634a370ccc81ff063422b5af 100644
--- a/src/sscg.c
+++ b/src/sscg.c
@@ -361,6 +361,7 @@ main (int argc, const char **argv)
done:
if (ret != EOK)
{
+ SSCG_ERROR ("%s\n", strerror (ret));
if (options)
{
sscg_io_utils_delete_output_files (options->streams);
--
2.52.0

56
SOURCES/0003-Truncate-IP-address-in-SAN.patch
View File

@ -1,56 +0,0 @@
From c633de3d77987cef5b652c861aa646774c6f1167 Mon Sep 17 00:00:00 2001
From: Stephen Gallagher <sgallagh@redhat.com>
Date: Tue, 8 Mar 2022 16:33:35 -0500
Subject: [PATCH 3/6] Truncate IP address in SAN
In OpenSSL 1.1, this was done automatically when addind a SAN extension,
but in OpenSSL 3.0 it is rejected as an invalid input.
Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>
---
src/x509.c | 15 ++++++++++++++-
1 file changed, 14 insertions(+), 1 deletion(-)
diff --git a/src/x509.c b/src/x509.c
index 7c7e4dfe56d5756862f3e0f851941e846ce96f31..e828ec725b23d7ea79393151e7bb436e2f61bdb8 100644
--- a/src/x509.c
+++ b/src/x509.c
@@ -133,6 +133,7 @@ sscg_x509v3_csr_new (TALLOC_CTX *mem_ctx,
char *alt_name = NULL;
char *tmp = NULL;
char *san = NULL;
+ char *slash = NULL;
TALLOC_CTX *tmp_ctx;
X509_EXTENSION *ex = NULL;
struct sscg_x509_req *csr;
@@ -267,6 +268,12 @@ sscg_x509v3_csr_new (TALLOC_CTX *mem_ctx,
else
{
san = talloc_strdup (tmp_ctx, certinfo->subject_alt_names[i]);
+ /* SAN IP addresses cannot include the subnet mask */
+ if ((slash = strchr (san, '/')))
+ {
+ /* Truncate at the slash */
+ *slash = '\0';
+ }
}
CHECK_MEM (san);
@@ -289,7 +296,13 @@ sscg_x509v3_csr_new (TALLOC_CTX *mem_ctx,
}
ex = X509V3_EXT_conf_nid (NULL, NULL, NID_subject_alt_name, alt_name);
- CHECK_MEM (ex);
+ if (!ex)
+ {
+ ret = EINVAL;
+ fprintf (stderr, "Invalid subjectAlternativeName: %s\n", alt_name);
+ goto done;
+ }
+
sk_X509_EXTENSION_push (certinfo->extensions, ex);
/* Set the public key for the certificate */
--
2.49.0

139
SOURCES/0004-dhparams-don-t-fail-if-default-file-can-t-be-created.patch
View File

@ -1,139 +0,0 @@
From 259c4c83307273551fd267585ec8854896a168bd Mon Sep 17 00:00:00 2001
From: Stephen Gallagher <sgallagh@redhat.com>
Date: Wed, 16 Nov 2022 15:27:58 -0500
Subject: [PATCH 4/6] dhparams: don't fail if default file can't be created
Resolves: rhbz#2143206
Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>
---
src/arguments.c | 1 -
src/io_utils.c | 12 +++++++++++
src/sscg.c | 55 +++++++++++++++++++++++++++++++++----------------
3 files changed, 49 insertions(+), 19 deletions(-)
diff --git a/src/arguments.c b/src/arguments.c
index 7b9da14a732875b0f33a12e22a97d51a78216839..770d834aacc05d6d92cc0c855852eadb88f8c9bc 100644
--- a/src/arguments.c
+++ b/src/arguments.c
@@ -69,7 +69,6 @@ set_default_options (struct sscg_options *opts)
opts->lifetime = 398;
- opts->dhparams_file = talloc_strdup (opts, "dhparams.pem");
opts->dhparams_group = talloc_strdup (opts, "ffdhe4096");
opts->dhparams_generator = 2;
diff --git a/src/io_utils.c b/src/io_utils.c
index 1b8bc41c3849acbe4657ae14dfe55e3010957129..5d34327bdbe450add5326ac20c337c9399b471dc 100644
--- a/src/io_utils.c
+++ b/src/io_utils.c
@@ -544,6 +544,18 @@ sscg_io_utils_open_output_files (struct sscg_stream **streams, bool overwrite)
{
SSCG_LOG (SSCG_DEBUG, "Opening %s\n", stream->path);
stream->bio = BIO_new_file (stream->path, create_mode);
+ if (!stream->bio)
+ {
+ fprintf (stderr,
+ "Could not write to %s. Check directory permissions.\n",
+ stream->path);
+
+ /* The dhparams file is special, it will be handled later */
+ if (i != SSCG_FILE_TYPE_DHPARAMS)
+ {
+ continue;
+ }
+ }
CHECK_BIO (stream->bio, stream->path);
}
diff --git a/src/sscg.c b/src/sscg.c
index 1bf8019c2dda136abe56acd101dfe8ad0b3d725d..dcff4cd2b8dfd2e11c8612d36ecc94b175e9dc26 100644
--- a/src/sscg.c
+++ b/src/sscg.c
@@ -93,6 +93,7 @@ main (int argc, const char **argv)
int ret, sret;
struct sscg_options *options;
bool build_client_cert = false;
+ char *dhparams_file = NULL;
struct sscg_x509_cert *cacert;
struct sscg_evp_pkey *cakey;
@@ -182,9 +183,19 @@ main (int argc, const char **argv)
options->crl_mode);
CHECK_OK (ret);
+ if (options->dhparams_file)
+ {
+ dhparams_file = talloc_strdup (main_ctx, options->dhparams_file);
+ }
+ else
+ {
+ dhparams_file = talloc_strdup (main_ctx, "./dhparams.pem");
+ }
+ CHECK_MEM (dhparams_file);
+
ret = sscg_io_utils_add_output_file (options->streams,
SSCG_FILE_TYPE_DHPARAMS,
- options->dhparams_file,
+ dhparams_file,
options->dhparams_mode);
CHECK_OK (ret);
@@ -281,28 +292,36 @@ main (int argc, const char **argv)
/* Create DH parameters file */
- bp = GET_BIO (SSCG_FILE_TYPE_DHPARAMS);
- if (options->dhparams_prime_len > 0)
+ if ((bp = GET_BIO (SSCG_FILE_TYPE_DHPARAMS)))
{
- ret = create_dhparams (options->verbosity,
- options->dhparams_prime_len,
- options->dhparams_generator,
- &dhparams);
- CHECK_OK (ret);
+ if (options->dhparams_prime_len > 0)
+ {
+ ret = create_dhparams (options->verbosity,
+ options->dhparams_prime_len,
+ options->dhparams_generator,
+ &dhparams);
+ CHECK_OK (ret);
+ }
+ else
+ {
+ ret = get_params_by_named_group (options->dhparams_group, &dhparams);
+ CHECK_OK (ret);
+ }
+
+ /* Export the DH parameters to the file */
+ sret = PEM_write_bio_Parameters (bp, dhparams);
+ CHECK_SSL (sret, PEM_write_bio_Parameters ());
+ ANNOUNCE_WRITE (SSCG_FILE_TYPE_DHPARAMS);
+ EVP_PKEY_free (dhparams);
}
- else
+ else if (options->dhparams_file)
{
- ret = get_params_by_named_group (options->dhparams_group, &dhparams);
- CHECK_OK (ret);
+ /* A filename was explicitly passed, but it couldn't be created */
+ ret = EPERM;
+ fprintf (stderr, "Could not write to %s: ", options->dhparams_file);
+ goto done;
}
- /* Export the DH parameters to the file */
- sret = PEM_write_bio_Parameters (bp, dhparams);
- CHECK_SSL (sret, PEM_write_bio_Parameters ());
- ANNOUNCE_WRITE (SSCG_FILE_TYPE_DHPARAMS);
- EVP_PKEY_free (dhparams);
-
-
/* Set the final file permissions */
sscg_io_utils_finalize_output_files (options->streams);
--
2.49.0

32
SOURCES/0005-dhparams-Fix-the-FIPS_mode-call-for-OpenSSL-3.0.patch
View File

@ -1,32 +0,0 @@
From 7abb9f7f929eb85fa3ab66a150978bbc5e198e5c Mon Sep 17 00:00:00 2001
From: Simon Chopin <simon.chopin@canonical.com>
Date: Mon, 13 Dec 2021 15:20:55 +0100
Subject: [PATCH 5/6] dhparams: Fix the FIPS_mode() call for OpenSSL 3.0
This function has been removed from OpenSSL 3.0, replaced by
EVP_default_properties_is_fips_enabled().
Closes #50
---
src/dhparams.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/src/dhparams.c b/src/dhparams.c
index 5c50128970d48790df910b9f9531e61e1d4c5758..61fd57aeedca47fba49f75d356cd5f42b9586696 100644
--- a/src/dhparams.c
+++ b/src/dhparams.c
@@ -231,7 +231,11 @@ is_valid_named_group (const char *group_name)
}
/* Check non-FIPS groups */
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
if (!FIPS_mode ())
+#else
+ if (!EVP_default_properties_is_fips_enabled(NULL))
+#endif
{
i = 0;
while (dh_nonfips_groups[i])
--
2.49.0

31
SOURCES/0006-x509-Use-proper-version-for-CSR.patch
View File

@ -1,31 +0,0 @@
From 6b48b480d57f75fc93ea646fbe6a457c4afd319f Mon Sep 17 00:00:00 2001
From: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date: Sat, 19 Oct 2024 15:43:20 +0200
Subject: [PATCH 6/6] x509: Use proper version for CSR.
RFC 2986 only defines a single version for CSRs: X509_VERSION_1 (0).
OpenSSL starting with 3.4 rejects everything else.
Use X509_VERSION_1 as version for X509_REQ_set_version.
Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
---
src/x509.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/x509.c b/src/x509.c
index e828ec725b23d7ea79393151e7bb436e2f61bdb8..22f8163ec5a6b20bcb16177edf8088cf148a8661 100644
--- a/src/x509.c
+++ b/src/x509.c
@@ -156,7 +156,7 @@ sscg_x509v3_csr_new (TALLOC_CTX *mem_ctx,
talloc_set_destructor ((TALLOC_CTX *)csr, _sscg_csr_destructor);
/* We will generate only x509v3 certificates */
- sslret = X509_REQ_set_version (csr->x509_req, 2);
+ sslret = X509_REQ_set_version (csr->x509_req, X509_VERSION_1);
CHECK_SSL (sslret, X509_REQ_set_version);
subject = X509_REQ_get_subject_name (csr->x509_req);
--
2.49.0

29
SOURCES/0007-Ensure-critical-basicConstraint-for-CA-cert.patch
View File

@ -1,29 +0,0 @@
From 499ce83c85d14dd8cbc52f6431e775f1d00578d6 Mon Sep 17 00:00:00 2001
From: Stephen Gallagher <sgallagh@redhat.com>
Date: Tue, 22 Apr 2025 13:09:32 -0400
Subject: [PATCH 7/7] Ensure 'critical' basicConstraint for CA cert
Fixes: https://github.com/sgallagher/sscg/issues/74
Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>
---
src/authority.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/src/authority.c b/src/authority.c
index af60e1a93023c32e3fdf6da920fba4464256ed81..044c62f5192e75a9f7d3f49616f852a97da7505a 100644
--- a/src/authority.c
+++ b/src/authority.c
@@ -89,7 +89,8 @@ create_private_CA (TALLOC_CTX *mem_ctx,
sk_X509_EXTENSION_push (ca_certinfo->extensions, ex);
/* Mark it as a CA */
- ex = X509V3_EXT_conf_nid (NULL, NULL, NID_basic_constraints, "CA:TRUE");
+ ex = X509V3_EXT_conf_nid (
+ NULL, NULL, NID_basic_constraints, "critical,CA:TRUE");
CHECK_MEM (ex);
sk_X509_EXTENSION_push (ca_certinfo->extensions, ex);
--
2.49.0

1115
SOURCES/0008-Fix-IP-address-handling-in-CA-certificate-SAN-constr.patch
View File

File diff suppressed because it is too large Load Diff

57
SPECS/sscg.spec
View File

@ -1,3 +1,13 @@
## START: Set by rpmautospec
## (rpmautospec version 0.6.5)
## RPMAUTOSPEC: autorelease, autochangelog
%define autorelease(e:s:pb:n) %{?-p:0.}%{lua:
release_number = 2;
base_release_number = tonumber(rpm.expand("%{?-b*}%{!?-b:1}"));
print(release_number + base_release_number - 1);
}%{?-e:.%{-e*}}%{?-s:.%{-s*}}%{!?-n:%{?dist}}
## END: Set by rpmautospec
%global provider github
%global provider_tld com
%global project sgallagher
@ -8,32 +18,32 @@
Name: sscg
Version: 3.0.0
Release: 10%{?dist}
Summary: Simple SSL certificate generator
Version: 4.0.3
Release: %autorelease
Summary: Simple Signed Certificate Generator
License: GPLv3+ with exceptions
License: GPL-3.0-or-later WITH cryptsetup-OpenSSL-exception
URL: https://%{provider_prefix}
Source0: https://%{provider_prefix}/releases/download/%{repo}-%{version}/%{repo}-%{version}.tar.xz
Source0: %{URL}/archive/refs/tags/sscg-%{version}.tar.gz
BuildRequires: gcc
BuildRequires: libtalloc-devel
BuildRequires: openssl-devel
BuildRequires: popt-devel
BuildRequires: libpath_utils-devel
BuildRequires: meson
BuildRequires: ninja-build
BuildRequires: help2man
Patch: 0001-Drop-usage-of-ERR_GET_FUNC.patch
Patch: 0002-Correct-certificate-lifetime-calculation.patch
Patch: 0003-Truncate-IP-address-in-SAN.patch
Patch: 0004-dhparams-don-t-fail-if-default-file-can-t-be-created.patch
Patch: 0005-dhparams-Fix-the-FIPS_mode-call-for-OpenSSL-3.0.patch
Patch: 0006-x509-Use-proper-version-for-CSR.patch
Patch: 0007-Ensure-critical-basicConstraint-for-CA-cert.patch
Patch: 0008-Fix-IP-address-handling-in-CA-certificate-SAN-constr.patch
# For backwards-compatibility in RHEL, revert the 4.0 patch that disables
# dhparam file generation by default.
Patch: 0001-Restore-defaulting-to-dhparams.pem-creation.patch
# Upstream patch to avoid segfault when receiving bad CLI arguments
Patch: 0002-Avoid-segfault-on-receiving-bad-CLI-arguments.patch
# Downstream patch to restore error message at the end of execution that is
# checked by certain tests
Patch: 0003-Restore-error-message.patch
%description
A utility to aid in the creation of more secure "self-signed"
@ -44,7 +54,7 @@ up a full PKI environment and without exposing the machine to a risk of
false signatures from the service certificate.
%prep
%autosetup -p1
%autosetup -p1 -n sscg-sscg-%{version}
%build
@ -64,6 +74,19 @@ false signatures from the service certificate.
%{_mandir}/man8/%{name}.8*
%changelog
## START: Generated by rpmautospec
* Tue Dec 02 2025 Stephen Gallagher <sgallagh@redhat.com> - 4.0.3-2
- Fix issues discovered by OSCI tests
* Tue Dec 02 2025 Stephen Gallagher <sgallagh@redhat.com> - 4.0.3-1
- Update to SSCG 4.0.3
* Tue Dec 02 2025 Stephen Gallagher <sgallagh@redhat.com> - 4.0.1-1
- Update to SSCG 4.0.1
* Mon Oct 27 2025 Stephen Gallagher <sgallagh@redhat.com> - 4.0.0-2
- Restore creation of dhparams file by default
* Mon Aug 11 2025 Stephen Gallagher <sgallagh@redhat.com> - 3.0.0-10
- Fix IP address handling in CA certificate SAN constraints
- Resolves: RHEL-107289
@ -328,3 +351,5 @@ false signatures from the service certificate.
* Mon Mar 16 2015 Stephen Gallagher <sgallagh@redhat.com> 0.1-1
- First packaging
## END: Generated by rpmautospec