From ea24c62658486297afb56369d6dcfe8f2f2c88e4 Mon Sep 17 00:00:00 2001 From: Stephen Gallagher Date: Tue, 2 Dec 2025 09:53:51 -0500 Subject: [PATCH] Update to SSCG 4.0.3 * Fix regression introduced in 4.0.1 that prevented writing multiple certificate types to the same output file. * Don't truncate destination files until just prior to writing. * Use int type for POPT_ARG_NONE values to fix a bug on s390x. * Don't crash when passed a hostname without a dot (such as localhost) Related: RHEL-124447 Signed-off-by: Stephen Gallagher --- .gitignore | 1 + ...-defaulting-to-dhparams.pem-creation.patch | 119 ++++++ ...default-to-generating-DH-params-file.patch | 172 --------- 0002-Handle-opening-the-same-file.patch | 361 ------------------ sources | 2 +- sscg.spec | 8 +- 6 files changed, 123 insertions(+), 540 deletions(-) create mode 100644 0001-Restore-defaulting-to-dhparams.pem-creation.patch delete mode 100644 0001-Revert-Don-t-default-to-generating-DH-params-file.patch delete mode 100644 0002-Handle-opening-the-same-file.patch diff --git a/.gitignore b/.gitignore index c0c0701..204baac 100644 --- a/.gitignore +++ b/.gitignore @@ -32,3 +32,4 @@ /sscg-3.0.8.tar.gz /sscg-4.0.0.tar.gz /sscg-4.0.1.tar.gz +/sscg-4.0.3.tar.gz diff --git a/0001-Restore-defaulting-to-dhparams.pem-creation.patch b/0001-Restore-defaulting-to-dhparams.pem-creation.patch new file mode 100644 index 0000000..f1c692c --- /dev/null +++ b/0001-Restore-defaulting-to-dhparams.pem-creation.patch @@ -0,0 +1,119 @@ +From 771a7663bccbd360f017c4c22358a46abcdfa93f Mon Sep 17 00:00:00 2001 +From: Stephen Gallagher +Date: Mon, 27 Oct 2025 14:58:11 -0400 +Subject: [PATCH] Restore defaulting to dhparams.pem creation + +This was disabled upstream, but for backwards-compatibility in the RHEL +9 and RHEL 10 lifecycle, we'll continue to do so there. + +This reverts commit 0e5e011acc2dc19f3c2fcb5699cf8fa662a2b135. + +Signed-off-by: Stephen Gallagher +--- + src/arguments.c | 4 ++-- + src/sscg.c | 39 +++++++++++++++++++++++++--------- + test/test_dhparams_creation.sh | 6 +----- + 3 files changed, 32 insertions(+), 17 deletions(-) + +diff --git a/src/arguments.c b/src/arguments.c +index 38c8740c1f159368d6fc92d51ba48d83700c3320..4ff75fdf86728592e7ca05db4cf4ac88bf79ca2e 100644 +--- a/src/arguments.c ++++ b/src/arguments.c +@@ -682,7 +682,7 @@ sscg_handle_arguments (TALLOC_CTX *mem_ctx, + &options->dhparams_file, + 0, + _("A file to contain a set of Diffie-Hellman parameters. " +- "(Default: not created)"), ++ "(Default: \"./dhparams.pem\")"), + NULL + }, + +@@ -692,7 +692,7 @@ sscg_handle_arguments (TALLOC_CTX *mem_ctx, + POPT_ARG_NONE | POPT_ARGFLAG_DOC_HIDDEN, + &options->skip_dhparams, + 0, +- _ ("Deprecated: Retained for backwards compatibility. To be removed in SSCG 5.0."), ++ _ ("Do not create the dhparams file"), + NULL + }, + +diff --git a/src/sscg.c b/src/sscg.c +index b9b191f109300f6447262858f57a3a8321a14966..d2dce334cff1342d975e9867a2c82a222d76925e 100644 +--- a/src/sscg.c ++++ b/src/sscg.c +@@ -166,19 +166,38 @@ main (int argc, const char **argv) + options->crl_mode); + CHECK_OK (ret); + +- if (options->dhparams_file) ++ if (!options->skip_dhparams) + { +- dhparams_file = talloc_strdup (main_ctx, options->dhparams_file); +- CHECK_MEM (dhparams_file); ++ if (options->dhparams_file) ++ { ++ dhparams_file = talloc_strdup (main_ctx, options->dhparams_file); ++ CHECK_MEM (dhparams_file); + +- ret = sscg_io_utils_add_output_file (options->streams, +- SSCG_FILE_TYPE_DHPARAMS, +- dhparams_file, +- options->overwrite, +- options->dhparams_mode); +- CHECK_OK (ret); ++ ret = sscg_io_utils_add_output_file (options->streams, ++ SSCG_FILE_TYPE_DHPARAMS, ++ dhparams_file, ++ options->overwrite, ++ options->dhparams_mode); ++ CHECK_OK (ret); ++ } ++ else ++ { ++ dhparams_file = talloc_strdup (main_ctx, "./dhparams.pem"); ++ CHECK_MEM (dhparams_file); ++ ++ ret = sscg_io_utils_add_output_file (options->streams, ++ SSCG_FILE_TYPE_DHPARAMS, ++ dhparams_file, ++ options->overwrite, ++ options->dhparams_mode); ++ SSCG_LOG (SSCG_VERBOSE, ++ "Could not open dhparams file %s: %s\n", ++ dhparams_file, ++ strerror (ret)); ++ /* This is non-fatal if the file path was not explicitly passed */ ++ ret = EOK; ++ } + } +- + /* Validate and open the file paths */ + ret = sscg_io_utils_open_BIOs (options->streams); + CHECK_OK (ret); +diff --git a/test/test_dhparams_creation.sh b/test/test_dhparams_creation.sh +index d0b4cbb71f3cd1656f1422524c4da7b30fbf3e0a..49f2b08d23246c90663eb7d2e5078817eb42139b 100755 +--- a/test/test_dhparams_creation.sh ++++ b/test/test_dhparams_creation.sh +@@ -42,10 +42,6 @@ + # just warn and ignore it if it was not (returning 0). However, if it is + # explicitly requested on the command-line and cannot be written to that + # location, it should fail with an error code. +-# +-# Updated 2025-10-21: SSCG 4.0 no longer creates the dhparams file by default. +-# It should not attempt to create it unless explicitly requested using the +-# --dhparams-file option. + + set -e + +@@ -181,7 +177,7 @@ run_test \ + "" \ + 0 \ + "$WRITABLE_DIR/dhparams.pem" \ +- "false" \ ++ "true" \ + "$WRITABLE_DIR" + + # Test 2: No --dhparams-file, readonly directory, no existing file +-- +2.52.0 + diff --git a/0001-Revert-Don-t-default-to-generating-DH-params-file.patch b/0001-Revert-Don-t-default-to-generating-DH-params-file.patch deleted file mode 100644 index ccc1879..0000000 --- a/0001-Revert-Don-t-default-to-generating-DH-params-file.patch +++ /dev/null @@ -1,172 +0,0 @@ -From 48660f15f990c645c10c261fadd53b128206802a Mon Sep 17 00:00:00 2001 -From: Stephen Gallagher -Date: Mon, 27 Oct 2025 14:58:11 -0400 -Subject: [PATCH] Revert "Don't default to generating DH params file" - -This reverts commit 0e5e011acc2dc19f3c2fcb5699cf8fa662a2b135. ---- - src/arguments.c | 4 ++-- - src/sscg.c | 12 +++++++++--- - test/test_dhparams_creation.sh | 30 +++++++++++++----------------- - 3 files changed, 24 insertions(+), 22 deletions(-) - -diff --git a/src/arguments.c b/src/arguments.c -index 53d5f44cec63b7a02a1c949844a28c6dcb49c7e3..0f27efd8d62a0566a5c8ab16a0c5f5e69e2fb51f 100644 ---- a/src/arguments.c -+++ b/src/arguments.c -@@ -682,7 +682,7 @@ sscg_handle_arguments (TALLOC_CTX *mem_ctx, - &options->dhparams_file, - 0, - _("A file to contain a set of Diffie-Hellman parameters. " -- "(Default: not created)"), -+ "(Default: \"./dhparams.pem\")"), - NULL - }, - -@@ -692,7 +692,7 @@ sscg_handle_arguments (TALLOC_CTX *mem_ctx, - POPT_ARG_NONE | POPT_ARGFLAG_DOC_HIDDEN, - &options->skip_dhparams, - 0, -- _ ("Deprecated: Retained for backwards compatibility. To be removed in SSCG 5.0."), -+ _ ("Do not create the dhparams file"), - NULL - }, - -diff --git a/src/sscg.c b/src/sscg.c -index 0beec82585228d4de49db3aecbedb13eb1e7be51..760e9ed258f06c09a09b3e1cdf1d237f792f7e5f 100644 ---- a/src/sscg.c -+++ b/src/sscg.c -@@ -165,9 +165,16 @@ main (int argc, const char **argv) - options->crl_mode); - CHECK_OK (ret); - -- if (options->dhparams_file) -+ if (!options->skip_dhparams) - { -- dhparams_file = talloc_strdup (main_ctx, options->dhparams_file); -+ if (options->dhparams_file) -+ { -+ dhparams_file = talloc_strdup (main_ctx, options->dhparams_file); -+ } -+ else -+ { -+ dhparams_file = talloc_strdup (main_ctx, "./dhparams.pem"); -+ } - CHECK_MEM (dhparams_file); - - ret = sscg_io_utils_add_output_file (options->streams, -@@ -177,7 +184,6 @@ main (int argc, const char **argv) - options->dhparams_mode); - CHECK_OK (ret); - } -- - /* Validate and open the file paths */ - ret = sscg_io_utils_open_BIOs (options->streams); - CHECK_OK (ret); -diff --git a/test/test_dhparams_creation.sh b/test/test_dhparams_creation.sh -index aeeabc66458d1ad90fd5e954532f68f5619cb0a0..ca6fc77a268d2ef5d3d49309190ddd05a087f89e 100755 ---- a/test/test_dhparams_creation.sh -+++ b/test/test_dhparams_creation.sh -@@ -42,10 +42,6 @@ - # just warn and ignore it if it was not (returning 0). However, if it is - # explicitly requested on the command-line and cannot be written to that - # location, it should fail with an error code. --# --# Updated 2025-10-21: SSCG 4.0 no longer creates the dhparams file by default. --# It should not attempt to create it unless explicitly requested using the --# --dhparams-file option. - - set -e - -@@ -90,9 +86,9 @@ function run_test { - local expected_file="$6" - local should_create_file="$7" - local output_dir="$8" -- -+ - echo "Test $test_num: $description" -- -+ - pushd "$work_dir" >/dev/null - - # Check if the expected file exists before running sscg -@@ -106,7 +102,7 @@ function run_test { - if [ -z "$output_dir" ]; then - output_dir="." - fi -- -+ - # Run sscg with the specified arguments - local cmd_args=( - "${MESON_BUILD_ROOT}/sscg" -@@ -115,23 +111,23 @@ function run_test { - --cert-file "${output_dir}/service.pem" - --cert-key-file "${output_dir}/service-key.pem" - ) -- -+ - if [ -n "$dhparams_output_file" ]; then - cmd_args+=("--dhparams-file=$dhparams_output_file") - fi - echo "${cmd_args[@]}" -- -+ - local exit_code=0 - "${cmd_args[@]}" >/dev/null 2>&1 || exit_code=$? -- -+ - local test_passed=true -- -+ - # Check exit code - if [ "$exit_code" -ne "$expected_exit_code" ]; then - echo " FAIL: Expected exit code $expected_exit_code, got $exit_code" - test_passed=false - fi -- -+ - # Check file creation - if [ "$should_create_file" = "true" ]; then - if [ ! -f "$expected_file" ]; then -@@ -151,17 +147,17 @@ function run_test { - test_passed=false - fi - fi -- -+ - if [ "$test_passed" = "true" ]; then - echo " PASS" - else - ((failed_tests++)) - fi -- -+ - # Clean up any created files for next test - rm -f "${output_dir}/ca.crt" "${output_dir}/service.pem" "${output_dir}/service-key.pem" - rm -f "$expected_file" || true # Ignore errors -- -+ - popd >/dev/null - echo - } -@@ -178,7 +174,7 @@ run_test \ - "" \ - 0 \ - "$WRITABLE_DIR/dhparams.pem" \ -- "false" \ -+ "true" \ - "$WRITABLE_DIR" - - # Test 2: No --dhparams-file, readonly directory, no existing file -@@ -254,7 +250,7 @@ run_test \ - "false" \ - "$WRITABLE_DIR" - --# Test 8: --dhparams-file to non-writable path, existing file -+# Test 8: --dhparams-file to non-writable path, existing file - # Arguments: test_num description work_dir dhparams_output_file expected_exit_code expected_file should_create_file output_dir - run_test \ - 8 \ --- -2.51.1 - diff --git a/0002-Handle-opening-the-same-file.patch b/0002-Handle-opening-the-same-file.patch deleted file mode 100644 index 0785319..0000000 --- a/0002-Handle-opening-the-same-file.patch +++ /dev/null @@ -1,361 +0,0 @@ -From ad7ec4c30d8b0911574131157c7c7aeee9b4c570 Mon Sep 17 00:00:00 2001 -From: Stephen Gallagher -Date: Mon, 1 Dec 2025 11:31:43 -0500 -Subject: [PATCH 2/2] Handle opening the same file - -We introduced a regression in 4.0.1 when closing the TOCTOU issue. We -incorrectly refuse to open the same file twice to save both a CA and -cert into the same location. - -This changes the opening logic to always open for both reading and -writing to check if it is zero-length. - -Also switches the EC curve tests to output the CA and service cert to a -common path to ensure we are testing this case properly. - -Updates some incorrect expected behaviors in the test_dhparams_creation -test as well. - -Signed-off-by: Stephen Gallagher ---- - src/io_utils.c | 85 +++++++++++++++++++++++++++++--- - src/sscg.c | 44 ++++++++++++----- - test/test_dhparams_creation.sh | 37 +++++++------- - test/test_ecdsa_cert_validity.sh | 12 ++--- - 4 files changed, 135 insertions(+), 43 deletions(-) - -diff --git a/src/io_utils.c b/src/io_utils.c -index 1cc855bb8f394fe6a11faf28eb127a54ab8df3f5..10c5f6818115a0c8219bca586e710ac9f3266bd5 100644 ---- a/src/io_utils.c -+++ b/src/io_utils.c -@@ -37,6 +37,7 @@ - #include - #include - #include -+#include - - #include "config.h" - #ifdef HAVE_GETTEXT -@@ -102,17 +103,85 @@ static int - sscg_io_utils_open_file (const char *path, bool overwrite, FILE **fp) - { - FILE *_fp = NULL; -- if (overwrite) -- _fp = fopen (path, "w"); -- else -- _fp = fopen (path, "wx"); -+ struct stat st; -+ int ret; -+ int fd; -+ -+ /* Try to open with r+ mode (file must exist) */ -+ _fp = fopen (path, "r+"); - if (!_fp) - { -- SSCG_ERROR ("Could not open file %s: %s\n", path, strerror (errno)); -- return errno; -+ /* If file doesn't exist, create it with w+ mode */ -+ if (errno == ENOENT) -+ { -+ _fp = fopen (path, "w+"); -+ if (!_fp) -+ { -+ SSCG_ERROR ( -+ "Could not create file %s: %s\n", path, strerror (errno)); -+ return errno; -+ } -+ /* New file has size 0, so we can proceed */ -+ ret = EOK; -+ goto done; -+ } -+ else -+ { -+ SSCG_ERROR ("Could not open file %s: %s\n", path, strerror (errno)); -+ ret = errno; -+ goto done; -+ } - } -- *fp = _fp; -- return EOK; -+ -+ /* File exists and was opened successfully, check its size */ -+ fd = fileno (_fp); -+ ret = fstat (fd, &st); -+ if (ret != 0) -+ { -+ SSCG_ERROR ("Could not stat file %s: %s\n", path, strerror (errno)); -+ ret = errno; -+ goto done; -+ } -+ -+ /* Check if file size is greater than zero */ -+ if (st.st_size > 0) -+ { -+ if (overwrite) -+ { -+ /* Truncate the file */ -+ ret = ftruncate (fd, 0); -+ if (ret != 0) -+ { -+ SSCG_ERROR ( -+ "Could not truncate file %s: %s\n", path, strerror (errno)); -+ ret = errno; -+ goto done; -+ } -+ /* Rewind to beginning after truncation */ -+ rewind (_fp); -+ } -+ else -+ { -+ /* File exists and overwrite is false - return error */ -+ SSCG_ERROR ("File %s already exists\n", path); -+ ret = EEXIST; -+ goto done; -+ } -+ } -+ -+ /* File size is zero or has been truncated */ -+ ret = EOK; -+ -+done: -+ if (ret == EOK) -+ { -+ *fp = _fp; -+ _fp = NULL; -+ } -+ -+ if (_fp) -+ fclose (_fp); -+ return ret; - } - - -diff --git a/src/sscg.c b/src/sscg.c -index 760e9ed258f06c09a09b3e1cdf1d237f792f7e5f..7ce0a331e56d32c5ebf94e580f9bd9836a909028 100644 ---- a/src/sscg.c -+++ b/src/sscg.c -@@ -75,10 +75,11 @@ main (int argc, const char **argv) - - struct sscg_stream *stream = NULL; - -- /* Always use umask 0577 for generating certificates and keys -- This means that it's opened as write-only by the effective -- user. */ -- umask (0577); -+ /* Always use umask 0177 for generating certificates and keys -+ This means that it's opened as read/write only by the effective -+ user. -+ */ -+ umask (0177); - - #ifdef HAVE_GETTEXT - /* Initialize internationalization */ -@@ -170,19 +171,38 @@ main (int argc, const char **argv) - if (options->dhparams_file) - { - dhparams_file = talloc_strdup (main_ctx, options->dhparams_file); -+ CHECK_MEM (dhparams_file); -+ -+ ret = sscg_io_utils_add_output_file (options->streams, -+ SSCG_FILE_TYPE_DHPARAMS, -+ dhparams_file, -+ options->overwrite, -+ options->dhparams_mode); -+ CHECK_OK (ret); - } - else - { - dhparams_file = talloc_strdup (main_ctx, "./dhparams.pem"); -- } -- CHECK_MEM (dhparams_file); -+ CHECK_MEM (dhparams_file); - -- ret = sscg_io_utils_add_output_file (options->streams, -- SSCG_FILE_TYPE_DHPARAMS, -- dhparams_file, -- options->overwrite, -- options->dhparams_mode); -- CHECK_OK (ret); -+ ret = sscg_io_utils_add_output_file (options->streams, -+ SSCG_FILE_TYPE_DHPARAMS, -+ dhparams_file, -+ options->overwrite, -+ options->dhparams_mode); -+ if (ret == EACCES || ret == EEXIST) -+ { -+ SSCG_LOG (SSCG_VERBOSE, -+ "Could not open dhparams file %s: %s\n", -+ dhparams_file, -+ strerror (ret)); -+ ret = EOK; -+ } -+ else -+ { -+ CHECK_OK (ret); -+ } -+ } - } - /* Validate and open the file paths */ - ret = sscg_io_utils_open_BIOs (options->streams); -diff --git a/test/test_dhparams_creation.sh b/test/test_dhparams_creation.sh -index ca6fc77a268d2ef5d3d49309190ddd05a087f89e..49f2b08d23246c90663eb7d2e5078817eb42139b 100755 ---- a/test/test_dhparams_creation.sh -+++ b/test/test_dhparams_creation.sh -@@ -50,6 +50,7 @@ set -e - DHPARAMS_TMPDIR=$(mktemp --directory --tmpdir=$GITHUB_WORKSPACE sscg_dhparams_test_XXXXXX) - WRITABLE_DIR="$DHPARAMS_TMPDIR/writable" - READONLY_DIR="$DHPARAMS_TMPDIR/readonly" -+READONLY_WITH_DHPARAMS_DIR="$DHPARAMS_TMPDIR/readonly_with_dhparams" - DHPARAMS_DIR="$DHPARAMS_TMPDIR/dhparams" - - function cleanup { -@@ -65,14 +66,16 @@ trap cleanup EXIT - # Set up test directories - mkdir -p "$WRITABLE_DIR" - mkdir -p "$READONLY_DIR" -+mkdir -p "$READONLY_WITH_DHPARAMS_DIR" - mkdir -p "$DHPARAMS_DIR" - - # Create a pre-existing dhparams.pem file for some tests --touch "$DHPARAMS_DIR/dhparams.pem" -+echo "preexisting dhparams.pem" > "$DHPARAMS_DIR/dhparams.pem" - - # Copy pre-existing dhparams.pem to readonly directory before making it readonly --cp "$DHPARAMS_DIR/dhparams.pem" "$READONLY_DIR/dhparams.pem" --chmod 555 "$READONLY_DIR" -+cp "$DHPARAMS_DIR/dhparams.pem" "$READONLY_WITH_DHPARAMS_DIR/dhparams.pem" -+chmod 0555 "$READONLY_DIR" -+chmod 0555 "$READONLY_WITH_DHPARAMS_DIR" - - failed_tests=0 - total_tests=8 -@@ -86,9 +89,9 @@ function run_test { - local expected_file="$6" - local should_create_file="$7" - local output_dir="$8" -- -+ - echo "Test $test_num: $description" -- -+ - pushd "$work_dir" >/dev/null - - # Check if the expected file exists before running sscg -@@ -102,7 +105,7 @@ function run_test { - if [ -z "$output_dir" ]; then - output_dir="." - fi -- -+ - # Run sscg with the specified arguments - local cmd_args=( - "${MESON_BUILD_ROOT}/sscg" -@@ -111,23 +114,23 @@ function run_test { - --cert-file "${output_dir}/service.pem" - --cert-key-file "${output_dir}/service-key.pem" - ) -- -+ - if [ -n "$dhparams_output_file" ]; then - cmd_args+=("--dhparams-file=$dhparams_output_file") - fi - echo "${cmd_args[@]}" -- -+ - local exit_code=0 - "${cmd_args[@]}" >/dev/null 2>&1 || exit_code=$? -- -+ - local test_passed=true -- -+ - # Check exit code - if [ "$exit_code" -ne "$expected_exit_code" ]; then - echo " FAIL: Expected exit code $expected_exit_code, got $exit_code" - test_passed=false - fi -- -+ - # Check file creation - if [ "$should_create_file" = "true" ]; then - if [ ! -f "$expected_file" ]; then -@@ -147,17 +150,17 @@ function run_test { - test_passed=false - fi - fi -- -+ - if [ "$test_passed" = "true" ]; then - echo " PASS" - else - ((failed_tests++)) - fi -- -+ - # Clean up any created files for next test - rm -f "${output_dir}/ca.crt" "${output_dir}/service.pem" "${output_dir}/service-key.pem" - rm -f "$expected_file" || true # Ignore errors -- -+ - popd >/dev/null - echo - } -@@ -250,15 +253,15 @@ run_test \ - "false" \ - "$WRITABLE_DIR" - --# Test 8: --dhparams-file to non-writable path, existing file -+# Test 8: --dhparams-file to non-writable path, existing file - # Arguments: test_num description work_dir dhparams_output_file expected_exit_code expected_file should_create_file output_dir - run_test \ - 8 \ - "--dhparams-file to non-writable path, existing file" \ - "$WRITABLE_DIR" \ -- "$READONLY_DIR/dhparams.pem" \ -+ "$READONLY_WITH_DHPARAMS_DIR/dhparams.pem" \ - 17 \ -- "$READONLY_DIR/dhparams.pem" \ -+ "$READONLY_WITH_DHPARAMS_DIR/dhparams.pem" \ - "false" \ - "$WRITABLE_DIR" - -diff --git a/test/test_ecdsa_cert_validity.sh b/test/test_ecdsa_cert_validity.sh -index e7a58c543b692099fc6aeb965e19a6cbe7841975..996be7d1628204433a342f322c72d0b3359fd109 100755 ---- a/test/test_ecdsa_cert_validity.sh -+++ b/test/test_ecdsa_cert_validity.sh -@@ -185,18 +185,18 @@ pushd "$TMPDIR" - --key-type ecdsa \ - --ec-curve "$_arg_ec_curve" \ - --cert-key-password mypassword \ -- --dhparams-file "dhparams.pem" -+ --dhparams-file "dhparams.pem" \ -+ --ca-file "combined.crt" \ -+ --cert-file "combined.crt" - - # Verify that the expected files were created - test -e dhparams.pem --test -e ca.crt --test -e service.pem -+test -e combined.crt - test -e service-key.pem - - # Verify that they have the correct file format - openssl dhparam -noout -in dhparams.pem --openssl x509 -noout -in ca.crt --openssl x509 -noout -in service.pem -+openssl x509 -noout -in combined.crt - - grep "ENCRYPTED PRIVATE KEY" service-key.pem - openssl pkey -noout -in service-key.pem -passin pass:mypassword -@@ -210,7 +210,7 @@ curve_info=$(openssl pkey -text -noout -in service-key.pem -passin pass:mypasswo - echo "$curve_info" | grep "$_arg_ec_curve" - - # Validate the certificates --openssl verify -x509_strict -CAfile ca.crt service.pem -+openssl verify -x509_strict -CAfile combined.crt combined.crt - - popd # $TMPDIR - --- -2.52.0 - diff --git a/sources b/sources index 2f64a75..ebbdfd3 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (sscg-4.0.1.tar.gz) = 935ce6f22cb5fb8fd5cf325a6df296de5d8527c22e86f948b6b15b5e568c767fe26267aaaaf6d741dad02bfabf821eb6c8a5b729dcab3ed91af4f553478f7fd9 +SHA512 (sscg-4.0.3.tar.gz) = f629cf7e32d4d4e7c1f58c4a53be925b96980e6fb3106e3a36a72f85c723bd79fba6aecdbf092b50f915a8833297bc7c6c1ccbe04fef488db38bbdc1e3a95b96 diff --git a/sscg.spec b/sscg.spec index 9ca33c9..52f680a 100644 --- a/sscg.spec +++ b/sscg.spec @@ -8,7 +8,7 @@ Name: sscg -Version: 4.0.1 +Version: 4.0.3 Release: %autorelease Summary: Simple Signed Certificate Generator @@ -26,11 +26,7 @@ BuildRequires: help2man # For backwards-compatibility in RHEL, revert the 4.0 patch that disables # dhparam file generation by default. -Patch: 0001-Revert-Don-t-default-to-generating-DH-params-file.patch - -# Fix a regression in SSCG 4.0.1 that prevents use of the same file for -# the cert and CA. -Patch: 0002-Handle-opening-the-same-file.patch +Patch: 0001-Restore-defaulting-to-dhparams.pem-creation.patch %description A utility to aid in the creation of more secure "self-signed"