text:
NO-ISSUE: Synchronize From Upstream Repositories

The staging/ and vendor/ directories have been synchronized from the upstream repositories, pulling in the following commits:

Date
Commit
Author
Message

2024-05-01 14:43:38
operator-framework/operator-lifecycle-manager@01d4a00
Per Goncalves da Silva
Update to go v1.22 (#3213)

2024-05-02 12:07:00
operator-framework/operator-lifecycle-manager@9b28021
Per Goncalves da Silva
OCPBUGS-29729: Updates default security context behavior for catalog source pods (#3206)

2024-05-02 18:17:52
operator-framework/operator-lifecycle-manager@c3e1774
Bryce Palmer
OCPBUGS-31522: Warn and allow CRD upgrade if validation fails but new CRD specifies a conversion strategy (#3209)

2024-05-03 16:41:15
operator-framework/operator-lifecycle-manager@157af32
Per Goncalves da Silva
remove run-kind and run-minikube github actions (#3216)

2024-05-06 18:28:09
operator-framework/operator-lifecycle-manager@b785bc7
Per Goncalves da Silva
remove docker e2e functionality (#3219)

2024-05-07 08:40:52
operator-framework/operator-lifecycle-manager@66f8571
Per Goncalves da Silva
remove minikube (#3220)

2024-05-07 11:36:56
operator-framework/operator-lifecycle-manager@3669b33
Per Goncalves da Silva
remove bare build and e2e modality (#3218)

2024-05-08 12:48:20
operator-framework/operator-lifecycle-manager@b70e300
Per Goncalves da Silva
Make amd64 the default GOARCH (#3221)

2024-05-08 13:41:23
operator-framework/operator-lifecycle-manager@232cf32
Per Goncalves da Silva
add dependabot (#3226)

2024-05-08 15:04:20
operator-framework/operator-lifecycle-manager@39ff42c
dependabot[bot]
build(deps): bump docker/login-action from 2 to 3 (#3229)

2024-05-08 15:08:24
operator-framework/operator-lifecycle-manager@ba748d8
dependabot[bot]
build(deps): bump golangci/golangci-lint-action from 3 to 6 (#3233)

2024-05-08 15:29:19
operator-framework/operator-lifecycle-manager@4ad0881
dependabot[bot]
build(deps): bump sigs.k8s.io/kind from 0.20.0 to 0.22.0 (#3238)

2024-05-08 15:34:46
operator-framework/operator-lifecycle-manager@51036b1
dependabot[bot]
build(deps): bump helm.sh/helm/v3 from 3.14.3 to 3.14.4 (#3237)

2024-05-08 16:26:46
operator-framework/operator-lifecycle-manager@2799d54
dependabot[bot]
build(deps): bump github.com/itchyny/gojq from 0.11.0 to 0.12.15 (#3234)

2024-05-08 18:55:27
operator-framework/operator-lifecycle-manager@1a1d7fe
dependabot[bot]
build(deps): bump actions/setup-go from 4 to 5 (#3231)

2024-05-08 18:55:34
operator-framework/operator-lifecycle-manager@f0a6e56
dependabot[bot]
build(deps): bump docker/setup-qemu-action from 2 to 3 (#3230)

2024-05-08 20:09:03
operator-framework/operator-lifecycle-manager@72b0467
dependabot[bot]
build(deps): bump docker/build-push-action from 4 to 5 (#3232)

2024-05-10 15:18:31
operator-framework/operator-lifecycle-manager@ef919fe
Per Goncalves da Silva
build(deps): bump actions/upload-artifact from 3 to 4 (#3243)

2024-05-10 15:48:46
operator-framework/operator-lifecycle-manager@1c406c2
Per Goncalves da Silva
cleanup: add vet and make it pass (#3241)

2024-05-10 16:37:22
operator-framework/operator-lifecycle-manager@dd94b92
Per Goncalves da Silva
build(deps): bump actions/checkout from 3 to 4 (#3242)

2024-05-14 10:39:02
operator-framework/operator-lifecycle-manager@bbc1272
dependabot[bot]
build(deps): bump softprops/action-gh-release from 1 to 2 (#3252)

2024-05-14 11:02:01
operator-framework/operator-lifecycle-manager@1ca6136
dependabot[bot]
build(deps): bump goreleaser/goreleaser-action from 4 to 5 (#3253)

2024-05-14 11:43:51
operator-framework/operator-lifecycle-manager@76022e9
dependabot[bot]
build(deps): bump github.com/stretchr/testify from 1.8.4 to 1.9.0 (#3249)

2024-05-14 12:31:49
operator-framework/operator-lifecycle-manager@69004bb
dependabot[bot]
build(deps): bump golang.org/x/sync from 0.6.0 to 0.7.0 (#3250)

2024-05-14 15:20:02
operator-framework/operator-lifecycle-manager@1991a8f
Per Goncalves da Silva
build(deps): bump github.com/distribution/distribution from 2.7.1+incompatible to 2.8.3+incompatible (#3239)

2024-05-14 20:17:23
operator-framework/operator-lifecycle-manager@a3069db
Jordan Keister
shift to maintenance mode (#3255)

2024-05-16 15:35:50
operator-framework/operator-lifecycle-manager@3e0230e
Per Goncalves da Silva
bugfix: refactor test package names 'packageA' and 'packageB' because they break naming conventions (#3260)

2024-05-16 18:13:24
operator-framework/operator-lifecycle-manager@d3afe92
Per Goncalves da Silva
build(deps): bump github.com/operator-framework/operator-registry v1.39 to v1.41 (#3256)

2024-05-17 16:52:31
operator-framework/operator-lifecycle-manager@d15a4b5
Per Goncalves da Silva
build(deps): bump k8s.io/api to v0.30.0 sigs.k8s.io/controller-runtime to v0.18.0 sigs.k8s.io/controller-tools to 0.15.0 + codegen refactor (#3240)

2024-05-21 07:56:10
operator-framework/operator-lifecycle-manager@94e37bc
dependabot[bot]
--- (#3265)

2024-05-21 11:20:02
operator-framework/operator-lifecycle-manager@a028787
dependabot[bot]
--- (#3264)

2024-05-21 13:00:37
operator-framework/operator-lifecycle-manager@31ee2de
dependabot[bot]
--- (#3266)

2024-05-21 15:52:13
operator-framework/operator-lifecycle-manager@d8ee29d
Per Goncalves da Silva
cleanup: remove cluster provisioning from e2e binary (#3254)

2024-05-21 19:58:26
operator-framework/operator-lifecycle-manager@91aaffe
Per Goncalves da Silva
build(deps): bump github.com/operator-framework/api from v0.23.0 to v0.24.0 (#3268)

2024-05-22 07:40:14
operator-framework/operator-lifecycle-manager@618aac7
Joe Lanford
fix: set securityContext values for extractContent containers (#3270)

2024-05-23 13:47:05
operator-framework/operator-lifecycle-manager@f9485ff
Per Goncalves da Silva
:seedling: update unit test gha to test against the k8s version of client-go (#3272)

2024-05-24 11:52:07
operator-framework/operator-lifecycle-manager@1f5e0dc
Per Goncalves da Silva
:seedling: parameterizes the e2e target and pins opm images (#3275)

2024-04-02 14:06:43
operator-framework/operator-registry@363de49
dependabot[bot]
build(deps): bump github.com/stretchr/testify from 1.8.4 to 1.9.0 (#1250)

2024-04-02 14:14:37
operator-framework/operator-registry@5e780fe
dependabot[bot]
build(deps): bump sigs.k8s.io/kind from 0.20.0 to 0.22.0 (#1249)

2024-04-02 14:27:22
operator-framework/operator-registry@90c0ea3
dependabot[bot]
build(deps): bump github.com/containers/image/v5 from 5.29.0 to 5.30.0 (#1253)

2024-04-02 14:53:28
operator-framework/operator-registry@433577e
dependabot[bot]
build(deps): bump github.com/containerd/containerd from 1.7.11 to 1.7.14 (#1252)

2024-04-02 18:31:41
operator-framework/operator-registry@8ce5c52
dependabot[bot]
build(deps): bump github.com/docker/cli (#1251)

2024-04-03 13:56:09
operator-framework/operator-registry@de4a488
dependabot[bot]
build(deps): bump github.com/onsi/gomega from 1.31.1 to 1.32.0 (#1254)

2024-04-03 14:16:20
operator-framework/operator-registry@e67f74b
dependabot[bot]
build(deps): bump github.com/joelanford/ignore (#1258)

2024-04-03 14:19:04
operator-framework/operator-registry@6cbd689
dependabot[bot]
build(deps): bump google.golang.org/grpc from 1.61.1 to 1.62.1 (#1257)

2024-04-03 14:21:51
operator-framework/operator-registry@813df31
dependabot[bot]
build(deps): bump github.com/containers/common from 0.57.1 to 0.58.1 (#1256)

2024-04-03 14:27:21
operator-framework/operator-registry@9deb7d7
dependabot[bot]
build(deps): bump github.com/grpc-ecosystem/grpc-health-probe (#1255)

2024-04-08 07:29:12
operator-framework/operator-registry@4fde558
dependabot[bot]
build(deps): bump google.golang.org/grpc from 1.62.1 to 1.63.0 (#1260)

2024-04-08 07:29:15
operator-framework/operator-registry@a5db0a8
dependabot[bot]
build(deps): bump golang.org/x/mod from 0.16.0 to 0.17.0 (#1261)

2024-04-08 07:29:17
operator-framework/operator-registry@4ffe465
dependabot[bot]
build(deps): bump golang.org/x/sys from 0.18.0 to 0.19.0 (#1262)

2024-04-08 08:41:13
operator-framework/operator-registry@fa7090c
dependabot[bot]
build(deps): bump golang.org/x/net from 0.22.0 to 0.24.0 (#1263)

2024-04-08 09:50:21
operator-framework/operator-registry@aa9b216
dependabot[bot]
build(deps): bump golang.org/x/sync from 0.6.0 to 0.7.0 (#1264)

2024-04-09 09:29:18
operator-framework/operator-registry@5322c70
dependabot[bot]
build(deps): bump google.golang.org/grpc from 1.63.0 to 1.63.2 (#1267)

2024-04-09 09:29:30
operator-framework/operator-registry@0bdb706
dependabot[bot]
build(deps): bump sigs.k8s.io/controller-runtime from 0.17.2 to 0.17.3 (#1266)

2024-04-09 09:29:41
operator-framework/operator-registry@3fe3905
dependabot[bot]
build(deps): bump github.com/containerd/containerd from 1.7.14 to 1.7.15 (#1265)

2024-04-12 14:41:35
operator-framework/operator-registry@07d9041
dependabot[bot]
build(deps): bump github.com/docker/cli (#1268)

2024-04-16 08:53:52
operator-framework/operator-registry@81b3c02
dependabot[bot]
build(deps): bump github.com/containers/common from 0.58.1 to 0.58.2 (#1269)

2024-04-19 21:06:36
operator-framework/operator-registry@aa0777c
Joe Lanford
pkg/cache: set explicit mode to handle upcoming go1.22 defaulting in fstest.MapFS (#1279)

2024-04-25 11:01:46
operator-framework/operator-registry@5eff485
dependabot[bot]
build(deps): bump github.com/onsi/gomega from 1.32.0 to 1.33.0 (#1280)

2024-04-25 11:09:43
operator-framework/operator-registry@bc9a5c2
Jordan Keister
providing a constraint property constant for dependency consistency (#1282)

2024-04-26 08:20:44
operator-framework/operator-registry@ca0483f
dependabot[bot]
build(deps): bump github.com/containerd/containerd from 1.7.15 to 1.7.16 (#1285)

2024-04-26 08:20:55
operator-framework/operator-registry@29410ea
dependabot[bot]
build(deps): bump github.com/docker/cli (#1286)

2024-04-26 12:41:19
operator-framework/operator-registry@92dece4
dependabot[bot]
build(deps): bump github.com/golang-migrate/migrate/v4 (#1284)

2024-04-29 07:27:02
operator-framework/operator-registry@f98b49c
dependabot[bot]
build(deps): bump github.com/onsi/ginkgo/v2 from 2.17.1 to 2.17.2 (#1289)

2024-04-29 12:24:34
operator-framework/operator-registry@773f39d
Per Goncalves da Silva
update kubeapis to 0.30.0 (#1283)

2024-04-30 10:01:35
operator-framework/operator-registry@9ffb9a1
Per Goncalves da Silva
update grpc-health-probe dependency (#1290)

2024-05-03 11:15:03
operator-framework/operator-registry@fad33d5
dependabot[bot]
build(deps): bump github.com/onsi/gomega from 1.33.0 to 1.33.1 (#1294)

2024-05-03 11:15:38
operator-framework/operator-registry@9161fc0
dependabot[bot]
build(deps): bump github.com/docker/cli (#1293)

2024-05-03 11:16:20
operator-framework/operator-registry@9f91a60
dependabot[bot]
build(deps): bump google.golang.org/protobuf from 1.33.0 to 1.34.0 (#1292)

2024-05-06 14:15:43
operator-framework/operator-registry@cdfe6cf
dependabot[bot]
build(deps): bump golang.org/x/text from 0.14.0 to 0.15.0 (#1300)

2024-05-07 13:58:03
operator-framework/operator-registry@9fdedc2
dependabot[bot]
build(deps): bump go.etcd.io/bbolt from 1.3.9 to 1.3.10 (#1303)

2024-05-14 15:21:39
operator-framework/operator-registry@26505f9
dependabot[bot]
build(deps): bump golang.org/x/net from 0.24.0 to 0.25.0 (#1302)

2024-05-14 15:21:59
operator-framework/operator-registry@08e226f
dependabot[bot]
build(deps): bump golang.org/x/sys from 0.19.0 to 0.20.0 (#1299)

2024-05-14 15:45:55
operator-framework/operator-registry@2c49e9c
dependabot[bot]
build(deps): bump google.golang.org/protobuf from 1.34.0 to 1.34.1 (#1304)

2024-05-14 18:55:39
operator-framework/operator-registry@6bb0a3e
Jordan Keister
enforce rfc1123 compatibility for olm.package.name (#1307)

2024-05-14 20:26:36
operator-framework/operator-registry@5b5181b
Joe Lanford
pkg/cache: add preferred pogreb database cache impl (#1278)

2024-05-15 08:11:48
operator-framework/operator-registry@8469f13
dependabot[bot]
build(deps): bump github.com/docker/cli (#1310)

2024-05-15 08:12:33
operator-framework/operator-registry@cfe364c
dependabot[bot]
build(deps): bump github.com/containers/image/v5 from 5.30.0 to 5.30.1 (#1308)

2024-05-15 08:18:16
operator-framework/operator-registry@8e24c88
dependabot[bot]
build(deps): bump github.com/onsi/ginkgo/v2 from 2.17.2 to 2.17.3 (#1309)

This pull request is expected to merge without any human intervention. If tests are failing here, changes must land upstream to fix any issues so that future downstreaming efforts succeed.
/cc @openshift/openshift-team-operator-runtime
/cc @openshift/openshift-team-operator-ecosystem

/retest

Looking at the last few commits:
Can we avoid modifying anything in the staging directory directly, it can cause downstreaming issues. Better to fix upstream, or create process that allows for extensions.

Yup - all good ^^ With the sync process. Running it manually is the same as running it in the job right? Meaning, as long as I use the tool to pull in the commits, then everything should be ok, right?

/hold contains experimental commits

authors: perdasilva tmshort

repo: openshift/operator-framework-olm


text:
introducing 3scale in the middleware integration list

Adding 3scale to the middleware list.
I'm assuming here that the tags array will match with the OS template tags.
cc @spadgett

I'm assuming here that the tags array will match with the OS template tags.

That's right.

Thanks, you'll need to build the dist files and amend your commit to add them. See
https://github.com/openshift/origin-web-catalog#contributing

@spadgett done the rebuild. thanks.

source: gharchive/pull-request

authors: maneta spadgett

repo: openshift/origin-web-catalog

license_type: permissive

license_source: github-api


text:
OSD-19636: Add Dynatrace URL option to osdctl cluster context

This PR closes OSD-19636.

It updates the osdctl cluster context command to include the Dynatrace Environment URL when running for Management Cluster.
Adds a new command - osdctl cluster dynatrace <Cluster ID> to directly fetch the DT Url without context command.

Example Output
>> Dynatrace Environment URL
https://hrm15629.live.dynatrace.com

I'm in agreement with @mjlshen 's comment about creating a new k8s client for fetching the dynatrace CRD.
As for adding the second command, I'm fine with it for now. Most of that code is required for the ticket's acceptance criteria anyway.

authors: AlexVulaj devppratik

repo: openshift/osdctl


text:
Fix SCC in OSC 1.2

This brings the fix of PR #196 to the 1.2 release, along with an extra patch to an already created SCC.
This will simplify OCP upgrades.

/test all

/test all

repo: openshift/sandboxed-containers-operator


text:
Keep Option for Injected Files

Adding a Keep option to VolumeSpec so that files can be kept in s2i builds.
This will be used to support the injection of ConfigMap build sources, which should not be truncated.
Trello card: https://trello.com/c/RMKJxJUm/1020-5-allow-using-a-configmap-as-an-input-to-a-build-builds

@bparees updated test messages.

[merge]

 (5) Allow using a ConfigMap as an input to a build [builds]

authors: adambkaplan bparees

repo: openshift/source-to-image


text:
issues in README of WildFly Swarm REST API Level 0 .zip booster

I see a couple of small issues in the generated README in the .zip of the Swarm REST booster. I guess some/most of them are more common than for just this booster.

It says "unzip booster-rest-http-wildfly-swarm.zip", but the .zip name is "booster.zip".
It says "cd booster-rest-http-wildfly-swarm" after unzipping, but the directory is called just "booster".
In "Update this Booster", it says "Stop your booster" but doesn't tell how. (It's Ctrl+C on Linux, not sure about Windows.)
It says "mvn clean fabric8:deploy -Popenshift -DskipTests", but there's really no reason to skip the tests. They pass just fine. (They are just local tests, as we don't specify -Popenshift-it here.)
There's also a section "CI/CD Deployment", which is just wrong for the .zip. But the last sentence "You can also learn more about this booster and rest of the WildFly Swarm runtime in ..." makes sence and should be kept.

Also the "Next Steps" in the wizard tell me: "unzip wfswarm-rest-http.zip" and "cd wfswarm-rest-http", even though (as I said above) the .zip is called "booster.zip" and the directory in it is called "booster". I'm mentioning it here because I know (I think :-) ) that the text is present in this repo.

That's a bug in the launchpad-addon. I fixed it in https://github.com/openshiftio/launchpad-addon/commit/1ed9dd72f86633ffd4cf000cc318e2e67696523b

Thanks for catching that! :+1:

@gastaldi Will the downloaded .zip file also have correct name and its top-level directory will have correct name? Thanks for the fix!

@Ladicek yes, you can already see that in https://launch.prod-preview.openshift.io/wizard

OK thanks @gastaldi. I just checked and the issue in "Next Steps" in the wizard is gone. But the issue in the README remains. So all 5 items in the 1st comment of this issue are still valid.

source: gharchive/issue

authors: Ladicek gastaldi

repo: openshiftio/appdev-documentation


text:
Issue #268: Fixed markup error in Nexus installation section

Fixes #268

LGTM, will merge today.

Merged: https://github.com/openshiftio/appdev-documentation/commit/2bfcc35754180aff5794d53122cade1d8516625b


text:
Implement two step shutdown with sigint

Fixes #60
Here's a quick rundown of the changes:

The signal handler needs to send a shutdown signal to the agents from a separate thread, since running it in the same one as the nameserver's socket (default), would lead to a deadlock where the nameserver is waiting for the agents to shut down and the agents are waiting for the name server to accept their 'unregister' message.
The nameserver process can't call terminate on itself from the sigint handler because ._popen seems to be undefined when accessed from a different process. Right now it seems the NameserverProcess is being terminated anyway (the tests would block otherwise, and there's no zombie python process afterwards), but I'm not entirely sure how or why.
I removed the sigint handler on the AgentProcess. I don't think it's needed anymore, since we are capturing the signal from the nameserver.
This took me way longer than I expected, so I hope this is the right way to do it 👍

More changes:

Re-added and fixed the sigint handler for agents.
Added a test for the agent's sigint handler based on the commits from this branch: https://github.com/Flood1993/osbrain/tree/sigint_tests
Added psutil as a testing dependency. It makes process management much easier to handle, especially if you are dealing with multiple OSs.

@Peque Let me know how much you disagree with me 😄

@Peque Is this a good moment to go on with this?
This should be rebased on top of the appveyor integration, by the way, I don't trust Windows signals whatsoever.

@ocaballeror Let us first improve the current Windows CI integration (combine coverage reports, fix tests currently failing, see if we can skip less tests...).
Trying to tackle this now would only add more noise to the currently incomplete Windows support.

@Peque Shall we take a look at this again?

@ocaballeror Sure. I will review this this week.

authors: Peque ocaballeror

repo: opensistemas-hub/osbrain

license_source: bigquery


text:
Develop pipeline visualization

This may be something similar to the IR visualization.  However, we probably need some notional feedback such that the user can edit it.

Works as of 3f16eb0; passed all initial devel tests.

repo: opensocsysarch/CoreGenPortal


text:
🛑 Dev is down

In 7c345d9, Dev (https://dev.opensourcepos.org) was down:

HTTP code: 502
Response time: 515 ms

Resolved: Dev is back up in 16d7752.

repo: opensourcepos/upptime

license: MIT


text:
Pinch zoom / pan on ios jittery / stops before gesture complete

I implemented this component in my app and it works great on android device.
But on IOS when I pinch to zoom it zooms only a little and stops.  I have to re pinch and zoom again to get further zoom.
Also it does not recognize panning while pinching like it does on Android.
From the behavior it appears to me that other higher level component is consuming / interfering with the pinch / pan gestures.
I am running the component in a Tab created with the  react-navigation/material-top-tabs
I set the Tab option swipeEnabled to false for this tab so I thought that would not interfere with gestures.  But something else must be interfering
Any suggestions on how to figure out why it is not zooming / panning smoothly on ios?
Or is there any known compatibility issues running this component in a tab for IOS?

Hi @kmeekva – it sounds as though something is interfering with the gestures as these behaviours should work fine in both iOS and Android.
You may want to try wrapping the component in react-native-gesture-handler to try and catch these events. I know that with native views like Modal views, native gesture handlers can grab the event and take over, and this library helps avoid that.

How exactly would I use the react-native-gesture-handler in this case?
I installed react-native-gesture-handler
Then in my app I imported like this:
import {Gesture, GestureDetector } from 'react-native-gesture-handler'
Do I need to define gestures ( pinch and pan ) and pass them to the Gesturedetector element?
Seems like when that is done you can add actions to fire on the events -- but what I want is for the events to be handled by the zoomable view ( in my sub component )
How do I pass these events to my component ( which has a zoomable view )
I tried this:
  const pinch = Gesture.Pinch();

But now pinch does nothing.
Before it was just jittery ( not really jittery -- but would only zoom a little then stop and not allow more zooming or panning without lifting fingers and zooming again )
Seems like I need the gestruredetector to pass the gestures to the subcomponent somehow.

Try wrapping it in its own gesture handler root view, that should stop events bubbling up

I wrapped my component in

It is slightly more responsive, but pinch zoom still stops after a small zoom amount and cannot continue until you re-pinch.
I think I've narrowed down the issue to be something with the material-top-tabs Tab Navigation that is interfering.
When I take the component out of the tab navigation it works flawlessly.
Anyone know any trick to get material-top-tabs to not grab the gestures?
I've tried setting the swipeEnabled=false (see below config)  but is still won't work smoothly
I am using:
import { createMaterialTopTabNavigator } from '@react-navigation/material-top-tabs';
         <Tab.Navigator
            swipeEnabled={false}
            screenOptions={({ route }) => ({
                swipeEnabled: false ,

Sounds like they switched from using react-native-gesture-handler to  react-native-pager-view in the material top tab navigator.  Some people suggest downgrading.   Do you think that could be the issue?

5.3.14
@react-navigation/native @ ^5.0.5react @ *react-native @ *react-native-gesture-handler @ >= 1.0.0react-native-reanimated @ >= 1.0.0react-native-tab-view @ >= 2.0.0

6.0.0-next.0
@react-navigation/native @ ^5.0.5react @ *react-native @ *react-native-pager-view @ >= 1.0.0react-native-tab-view @ >= 3.0.0

https://www.npmpeer.dev/packages/@react-navigation/material-top-tabs/compatibility

Possibly - let me know if that helps.
Are you using the very latest version of this library? There is a new prop onShouldBlockNativeResponder that will now work with gesture-handler. It is set to true by default. Merged in the last couple of weeks.
If you wrap your zoomable view in a gesture handler root view, this prop allows the gesture handler to override the gesture system and block native event responders. I was able to use this with an RNScreens modal view with react-navigation.
If that doesn't work, yes - I suspect something in the top tabs view

I was running version 2.1.3
I upgraded to version 2.1.4 but the issue still persists.
Do I need to pass this new prop?  Or is it supposed to default to true?
I think the issue is that the react-native/material-top-tabs is using viewPager now no react-native-gesture-handler
So I think both are trying to grab the gestures.
I found viewPager has settings  onStartShouldSetResponder and onMoveShouldSetResponder  that sound like they should have something to do with bubbling of getsures, but not sure how to use them.

Yeah, I don't know. That depends on how viewPager intercepts events. We've used <PanGestureHandler> as a wrapper for our zoomable view and that worked. Sorry I can't be more help

Well to try to isolate the issue, I created an expo SNAK to try to reproduce the problem with material-top-tabs -- BUT it worked perfectly when I ran the test on my device.
I started investigating the versions of all the libraries the snack was pulling in, and I noticed they were using SDK 48 when I was still using SDK 47.
I did
yarn add expo@^48.0.0
npx expo install --fix
npx expo-doctor
This updated lots of packages and NOW everything works perfectly!
So there is no compatibility issues when everything is up to date.
I see SDK 49  is out -- I'll test that next.  But for now things are working so we can close this I think.

There's a bug in the code that defaults onShouldBlockNativeResponder to true, I've fixed this in https://github.com/openspacelabs/react-native-zoomable-view/pull/77.
@kmeekva in the meantime you can use an onShouldBlockNativeResponder prop with a value of () => true to avoid the issue.

authors: elliottkember kmeekva notclive


text:
OpenSSL failed in speed evp test for all of the aes-xxx-siv algorithms

I found the issue in daily performance test on latest version of OpenSSL.  Run OpenSSL speed test, and it report errors on all of the aes-xxx-siv test cases.  Suppose the new add code cause this issue.

This issue happened on both x86 and aarch64, maybe it also happened on other archs. I am debugging and  fixing up this issue.

repo: openssl/openssl


text:
Error 404 for master man1

Trying to access s_client/s_server manuals for master, I came across 404 errors.
The page https://www.openssl.org/docs/manmaster/man1/s_client.html provides links to https://www.openssl.org/docs/manmaster/man1/openssl-s_client.html, https://www.openssl.org/docs/manmaster/man1/openssl-s_server.html, and many other commands, which lead to the page with 404 text:
Page Not Found
Sorry, but the link you gave does not exist.

To get the latest news about OpenSSL, download the source, and so on, please see the sidebar or the buttons at the top of every page. For more information about the team and community around the project, or to start making your own contributions, start with the community page.

Oh srgh. Since som pod files are now generated, the current rendering is no longer feasible.
OK, I will have a look at that tomorrow...

Ping @levitte

Fixed by #13031

Oh, well. Didn't see that the issue is from 12 Feb. So it's probably unrelated. Nevertheless, it's fixed.

Oh, well. Didn't see that the issue is from 12 Feb. So it's probably unrelated. Nevertheless, it's fixed.

Yeah, I believe that openssl/web#175 fixed this.

authors: beldmit levitte mattcaswell mspncp


text:
PKCS#12 support in OpenSSL 3.0 FIPS provider

We are using pkcs#12 container to store personal identification information and when I am trying to use OpenSSL-3.0.0 in FIPS mode to load PKCS#12 file the following error is coming
root@mackinac-6ull:/data/Openssl_LS_test_cert# openssl pkcs12 -in new.pfx -info
Enter Import Password:
MAC: sha256, Iteration 2048
MAC length: 32, salt length: 8
Error verifying PKCS12 MAC; no PKCS12KDF support.
Use -nomacver if MAC verification is not required.
root@mackinac-6ull:/data/Openssl_LS_test_cert#
Is PKCS#12 not FIPS supported? And if it is not FIPS compliant then is there any other FIPS certified container that we can use to store personal identification information.
Is there any way we can use FIPS approved algorithms in PKCS#12?

@mattcaswell  Thanks for quick response.
So it means that we can not use PKCS#12 container in FIPS mode. Is this understanding correct?
is PKCS12KDF algorithm is hardcoded in PCKS#12 standard or we can change the KDF fnuncion at time of .pfx creation?

There is a draft
https://datatracker.ietf.org/doc/draft-ietf-lamps-pkcs12-pbmac1/ by @tomato42 and I have a very draft implementation of it.

So it means that we can not use PKCS#12 container in FIPS mode. Is this understanding correct?

Correct. At least not without one of the workarounds I mentioned

is PKCS12KDF algorithm is hardcoded in PCKS#12 standard or we can change the KDF fnuncion at time of .pfx creation?

It's hard coded (but see @beldmit's post above).

@mattcaswell @beldmit Thanks for the updates.
@mattcaswell, If the draft gets approved and PKCS#12 comes with a new implementation, does OpenSSL require any changes in the FIPS provider code to integrate the new changes (PKCS#12)?
I am asking this question because if there is any change in FIPS provider code then OpenSSL have to go to CMWP again for new FIPS 140-2 certification.

@mattcaswell, If the draft gets approved and PKCS#12 comes with a new implementation, does OpenSSL require any changes in the FIPS provider code to integrate the new changes (PKCS#12)?

It's unclear. The proposed draft is based on PBMAC1 which combines a password based KDF (PBKDF2) with an underlying MAC (and at a minimum a compliant implementation must support SHA-256 HMAC). Our current FIPS module already supports PBKDF2 and SHA-256 HMAC. However the FIPS module (and OpenSSL in general) does not have a MAC implementation known as PBMAC1. The code that combines PBKDF2 with SHA-256 HMAC is actually quite trivial, but I'm not sure whether that code would need to be inside the module boundary or not. If not then the current module already has everything needed. If it does then modifications to the module (and hence a revalidation would be required).
In any case this is likely to be a long term solution. The draft would have to be approved, OpenSSL would have to implement it, and it would have to be incorporated into an OpenSSL release (OpenSSL 3.3 at the earliest I would think) before it could be used.

I'm pretty sure that "PBMAC1" doesn't have to be in the fips module, otherwise all constructions that use some kind of KDF to get keys for the HMAC would have to be inside the fips module (e.g. the TLS ciphers).

I'm pretty sure that "PBMAC1" doesn't have to be in the fips module, otherwise all constructions that use some kind of KDF to get keys for the HMAC would have to be inside the fips module (e.g. the TLS ciphers).

Good point. Hopefully that's true. I guess we'd need to confirm it with the lab.

If we implement it as a new MAC, it would need to be inside the boundary or a work-around like @mattcaswell mentioned would be required.

If we implement it as a new MAC

Not sure why we would want to do it. It is clear that naming it as a "special" MAC is just for the purpose of adding an object identifier. We can special-case it in the code.

The only reason I see is that the intermediate data shouldn't cross the FIPS boundary.

I am looking at this page of docs -> https://www.openssl.org/docs/man3.0/man1/openssl-pkcs12.html. Its mentioned in the nomac option that
Do not attempt to provide the MAC integrity. This can be useful with the FIPS provider as the PKCS12 MAC requires PKCS12KDF which is not an approved FIPS algorithm and cannot be supported by the FIPS provider.
This makes me confused, is PKCS12 MAC not supported by FIPS or PKCS12KDF not supported by FIPS?

My openssl version is OpenSSL 1.1.1k  FIPS 25 Mar 2021. May I know what is the difference if I create a pkcs12 keystore with and without the nomac option? It seems that I can create two keystores successfully within a fips version openssl. Does that mean the mac value is calculated in a fips version openssl?

The OpenSSL 1.1.1k  FIPS 25 Mar 2021 is a vendor (most probably Red Hat) patched version, not something that the OpenSSL project directly provides. We cannot really give you any guidance for this FIPS module.
The -nomac option creates a PKCS12 file without an integrity protection. The PKCS12KDF is used to create the key for the MAC. Unfortunately that KDF function is not approved by FIPS standard which means, if strict compliance with FIPS rules is required, that it cannot be used. That's why our FIPS module does not provide that KDF function and thus it cannot create PKCS12 files with integrity protection.

Thanks for the information. General speaking, does PKCS12 need a MAC check in FIPS mode?

General speaking, does PKCS12 need a MAC check in FIPS mode?

Without doing the MAC check, you're losing the integrity protection on the PKCS12 file. It depends on how do you use it. If you need just confidentiality and not the integrity protection, you do not need to do MAC check. You can also provide the integrity protection on transport by other means such as adding a signature outside of the PKCS12 file.

Thanks for the information. General speaking, does PKCS12 need a MAC check in FIPS mode?

yes, FIPS rules require use of integrity protection with confidentiality protection for storage of key material; by omitting integrity protection you need to consider the keys to be stored in plantext

@mattcaswell @paulidale
Hi Matt/Paul,
PKCS12KDF was working when we were using FIPS 1.0.2 + FIPS and now we migrated to 3.0.8 + FIPS, now it is not able to load the certificates in urlib3. So is there a change from the previous version of openssl w.r.t FIPS algorithms?

That KDF cannot be FIPS validated so it isn't in the FIPS provider.
You can still load such by using the default provider and an explicit 'fips=no' property query.

That KDF cannot be FIPS validated so it isn't in the FIPS provider.
You can still load such by using the default provider and an explicit 'fips=no' property query.

Thanks @paulidale
PKCS12KDF is not working in OpenSSL 3.0.8 + FIPS ( As we are loading only fips + base provider, no default provider and inorder to use that we need to use a different context). This is fine
But PKCSKDF is working in OpenSSL 1.0.2 + FIPS this is our doubt, this is a bit concern here
so is there any difference here?

So is there a change from the previous version of openssl w.r.t FIPS algorithms?

1.0.2 does not really have the concept of KDF crypto algorithms as a separate thing, i.e. there are no EVP_KDF APIs there. The fact that the PKCS12 KDF works with the FIPS module there is probably "by accident". The 3.0 FIPS provider is a complete rewrite and works totally differently to the old FIPS module. In 3.0 the PKCS12 KDF is recognised as a crypto algorithm in its own right and does exist inside the FIPS provider (only in the default provider).

can we load both default and fips provider in the default context in openssl 3.0.8 + fips use case? and make the pkcs12kdf work?

You could, and it would then work (dependent on property settings). Having both the default and fips providers loaded means you don't know which provider is used for any given algorithm since all algorithms in the fips provider are also in default. You can resolve this with appropriate global property settings. But ultimately loading some crypto from "default" means you are no longer FIPS.

@mattcaswell
Thanks for the information.
one doubt on this
You can resolve this with appropriate global property settings. But ultimately loading some crypto from "default" means you are no longer FIPS.

we are loading as of now fips and base providers and making the fips enable call from the code as shown below
self.crypto_context.EVP_default_properties_enable_fips(None, 1):

we understood that it is no longer fips compliant just for understanding a bit more, if we are using both providers when we are using the pkcs12kdf will it go to fips provider/default provider?

@paulidale @mattcaswell
Hi Matt/Dr.Paul,
one of our counterparts in our organization where we call them to provide some certs (pub/priv/passphrase) information which we store and later use for connecting them (https) when we are on the customer site. This is where we are facing issues now.
They are using the below Java code to generate the certificate pair and pass it to our application.
snippet:
/ generate PKCS10 certificate request
        X500Principal subjectName = new X500Principal(cn);
        PKCS10CertificationRequestBuilder p10Builder = new JcaPKCS10CertificationRequestBuilder(subjectName, keyPair.getPublic());
so the way certificate generation using pkcs10 is the issue and when we use the contents in the urllib method of python which internally uses (https along with certs ) is getting failed in FIPS mode and working in non-FIPS mode
self.__connection = PoolManager(cert_file=cert_file, key_file=cert_key, key_password=key_pwd,
cert_reqs=cert_reqs, ca_certs=ca_cert,
timeout=self._get_timeout(connect_timeout=self.__connect_timeout,
read_timeout=self.__read_timeout),
ssl_context=self.__get_ssl_context()
)
could you please help on is the cert creation is the RC for the failure or should we look on other areas?
Thanks once again

So If I understand correctly, just using "-nomacver" when exporting/reading PKCS keystore is not an sufficient with openssl fips right? I am getting following error. Is this error related to using fips compliant openssl(i.e. not loading PKCS12KDF algo)?
Shrouded Keybag: pbeWithSHA1And3-KeyTripleDES-CBC, Iteration 1024
PKCS7 Encrypted data: pbeWithSHA1And3-KeyTripleDES-CBC, Iteration 1024
Error outputting keys and certificates
80117D8084700000:error:0308010C:digital envelope routines:inner_evp_generic_fetch:unsupported:crypto/evp/evp_fetch.c:373:Global default library context, Algorithm (PKCS12KDF : 0), Properties (<null>)
80117D8084700000:error:1180006B:PKCS12 routines:PKCS12_PBE_keyivgen_ex:key gen error:crypto/pkcs12/p12_crpt.c:55:

Yes, that would be related.  3DES isn't permitted under FIPS anymore.

I found this Document released at this year May -> https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp4282.pdf.
It mentioned that PBKDF2 function is supported in FIPS mode for key derivation. Please correct me if Im wrong, the OpenSSL version of PBKDF2 is PKCS12KDF function?

PBKDF2 is supported in our FIPS module already, but that is a different algorithm to PKCS12KDF. Both of those algorithms are supported in our default provider (see the KDF section below):
https://www.openssl.org/docs/man3.0/man7/OSSL_PROVIDER-default.html
But not in the FIPS provider (compare the list of KDFs supported):
https://www.openssl.org/docs/man3.0/man7/OSSL_PROVIDER-FIPS.html

@mattcaswell thanks for the quick response, so if I want to run in FIPS mode, should I enable the FIPS provider and use PBKDF2 function from the FIPS module?

The KDF used in PKCS12 is PKCS12KDF. You cannot configure it to use PBKDF2 instead.

More specifically PBKDF2 can also be used in PKCS12, but for a different purpose. The use of PKCS12KDF unfortunately cannot be replaced.

hi @mattcaswell, @t8m ,
Currently we are migrating from OpenSSL v102 to v 3.0.x
We are extensively using PKCS12_create API, without FIPS it is working fine. The certificate generated by our application are consumed by Android, IOS and Windows device.
We are now making or application FIPS compliant, we cannot use the workaround of loading default provider in FIPS mode and we cannot skip integrity check also due to security issues. The application is audited and will not be certified in FIPS mode.
Could you please help what is the other alternate for us now.

Will this draft https://datatracker.ietf.org/doc/draft-ietf-lamps-pkcs12-pbmac1/ fix the PKCS12_create API issue and it will start working in FPS mode.
When is the fix  expected for this and in which version. As we are on 3.0.x version.

Will this draft https://datatracker.ietf.org/doc/draft-ietf-lamps-pkcs12-pbmac1/ fix the PKCS12_create API issue and it will start working in FPS mode.
When is the fix expected for this and in which version. As we are on 3.0.x version.

We believe it will fix the issue (on the assumption that PBMAC1 does not need to be inside the FIPS boundary - which the discussion above suggests should be ok). I'm not tracking the status of the draft but I understand it is still active.
@tomato42 is probably in a better position to know what the latest is on this draft. I assume it will be discussed at the IETF meeting this week.

When is the fix expected for this and in which version. As we are on 3.0.x version.

Any fix will not be added to 3.0.x since that is a stable release and we don't add new features to stable releases. In order for the feature to be available, the draft first needs to be completed and published as a standard (OpenSSL only implements  crypto that has been standardised as a matter of policy). Again @tomato42 might be able to advise on the timelines here.
Once standardised a PR needs to be raised/approved and merged and it will then go into the next release. I feel fairly confident that @beldmit will raise a PR for this fairly soon after the standard is available. Even if everything goes smoothly and quickly, the earliest release that this could go into would be 3.3, which will be available in April 2024.

I will raise a PR ASAP when the draft becomes an RFC. https://github.com/beldmit/openssl/tree/pkcs12_pbmac1 is a quick and dirty implementation

hi @mattcaswell, @beldmit
Thank you for the response.
Could you please clarify my understanding - even after the fix, which is related to PBMAC1.  PKCS12 will still use PKCS12KDF which is not FIPS complaint so I will still not able to use PKCS12_create API in FIPS mode.

It's intended that you will be able to specify PBMAC1 instead of PKCS12KDF though I am not sure if it directly fits the PKCS12_create function or you will have to use smth else

that will be included in master branch, so 3.4.0 is earliest.

Current master branch is for 3.3.0 (to be release April 2024), so that would be the earliest.

ah, right, 3.3.0 is earliest

Hi @beldmit ,
It was my mistake I was using algo NID_pbe_WithSHA1And40BitRC2_CBC in PKCS12_create API hence it was not working in FIPS. with default algos. PKCS12_create api is working in FIPS. Apologies for the confusion.
Cert generated
MAC: sha256, Iteration 2048
MAC length: 32, salt length: 8
PKCS7 Encrypted data: PBES2, PBKDF2, AES-256-CBC, Iteration 2048, PRF hmacWithSHA256
Certificate bag
PKCS7 Data
Shrouded Keybag: PBES2, PBKDF2, AES-256-CBC, Iteration 2048, PRF hmacWithSHA256

Now, the next issue I encountered is in PKCS12_parse api, it is failing here. with the below mentioned error.
error:0308010C:digital envelope routines::unsupported
error:1180006B:PKCS12 routines::key gen error
error:1180006D:PKCS12 routines::mac generation error
error:11800071:PKCS12 routines::mac verify failure

So,  for my understanding, with the fix there will be a way to specify PBMAC1 instead of PKCS12KDF and mac integrity check will be performed successfully either during PKCS12_create or PKCS12_parse.
For now, could you please help me where should i set -nomac option in code (during create or during parse), to skip the mac verification.  This is just for testing purpose. We still can't skip mac verification, neither we can load default provider as this will get audited and our app will not be FIPS compliant.
Also, the fix will be available in 3.3, will it be eventually merged to 3.0.x version ?
We are working on getting FIPS certified so we need to this information to plan the release.

PBMAC1 isn't available in the FIPS provider and I doubt it ever will be able to be validated, so that isn't a useful path for you.
We don't back port features to stable releases, so no a fix in 3.3 will not be merged to 3.0.x.

Hi @paulidale,
Thank you for the response, could you please suggest what is the suitable alternate for this.

PBMAC1 isn't available in the FIPS provider and I doubt it ever will be able to be validated, so that isn't a useful path for you.

@paulidale - the argument earlier in this thread is that PBMAC1 is a trivial combination of a KDF and a MAC - and isn't a new algorithm in its own right (we wouldn't implement PBMAC1 as an EVP_MAC):

Or to put it other way, PBMAC1 is the name of construct on PKCS#12 level, similar to PBES2, not a new MAC algorithm.

See this comment.
So the argument is that as long as the KDF and the MAC are inside the boundary then PBMAC1 can be outside the boundary and still be a FIPS compliant solution.

That would work at least until the CMVP decides to draw this into the boundary too.
Then we'd have to validate it.

@paulidale If that happens, then we will cross that bridge. As far as we (Red Hat) are aware, the existing fips module is already sufficient to implement PBMAC1 support in PKCS#12.

PKCS12_create API also does not work in FIPS mode, following is the error:
60690000:error:0308010C:digital envelope routines:inner_evp_generic_fetch:unsupported:crypto\evp\evp_fetch.c:373:Global default library context, Algorithm (PKCS12KDF : 0), Properties (<null>)
I have update my above comment https://github.com/openssl/openssl/issues/19997#issuecomment-1798015008

PKCS12KDF is the KDF that will get replaced once PBMAC1 is supported.

Hi team,
Just for internal testing we are working on skipping MAC check. However this is not the valid option for us.
As suggested here, we set the mac_iter = -1, certificate is generated successfully with FIPS provider.
p12 = PKCS12_create((char*)pswd, (char*)szCertStorePath, pkey, cert, NULL, 0, 0, 0, -1, 0).
https://www.openssl.org/docs/man3.0/man3/PKCS12_create.html#:~:text=mac_iter can be set to -1 and the MAC will then be omitted entirely. This can be useful when running with the FIPS provider as the PKCS12KDF is not a FIPS approvable algorithm
While parsing the certificate we are facing this issue. What to set here to skip the MAC check.
PKCS12_parse(ptr, password, out pkey, out cert, out cacerts)
Error:
error:1180006C:PKCS12 routines::mac absent
error:11800071:PKCS12 routines::mac verify failure

It's partially related to #20072 and in general will be fixed by implementing https://datatracker.ietf.org/doc/draft-ietf-lamps-pkcs12-pbmac1/

@mattcaswell
Thanks for the information.
one doubt on this You can resolve this with appropriate global property settings. But ultimately loading some crypto from "default" means you are no longer FIPS.

we are loading as of now fips and base providers and making the fips enable call from the code as shown below
self.crypto_context.EVP_default_properties_enable_fips(None, 1):

we understood that it is no longer fips compliant just for understanding a bit more, if we are using both providers when we are using the pkcs12kdf will it go to fips provider/default provider?

Did you get answer to this query? if so please share
we understood that it is no longer fips compliant just for understanding a bit more, if we are using both providers when we are using the pkcs12kdf will it go to fips provider/default provider?

authors: ChauhanPriyanka Phani-Sreenivasa-Prasad WilburZjh beldmit iambate mattcaswell paulidale raghupcr t8m tomato42 vikas-yadav77


text:
test "80-test_ssl_new.t" fails on Solaris 10 SPARCv9

The result of a compile and test of OpenSSL 3.0.8 seems unusable on
a Solaris 10 SPARCv9 server.

In OpenSSL 3.0.8 the configuration needs a minor tweak within the
file Configurations/10-main.conf such that CFLAGS are respected :

$ diff ./Configurations/10-main.conf.orig ./Configurations/10-main.conf
213c213
<         ex_libs          => add("-lsocket -lnsl -ldl"),
---
>         ex_libs          => add("-lsocket -lnsl -ldl -lrt"),
350,351c350,351
<         CFLAGS           => add_before(picker(debug   => "-g",
<                                               release => "-xO5 -xdepend")),
---
>         CFLAGS           => add_before(picker(debug   => "-xO0 -g -xdepend",
>                                               release => "-xO0 -g -xdepend")),
358c358
<         shared_cflag     => "-KPIC",
---
>         shared_cflag     => "-xcode=pic32",
376c376
<         cflags           => add_before("-m64 -xarch=sparc"),
---
>         cflags           => add_before("-m64 -xarch=sparc -g -xO0 -m64 -errfmt=error -erroff=%none -xmemalign=8s -errshort=full -xstrconst -xildoff -xnolibmil -xcode=pic32 -xregs=no%appl -xlibmieee -ftrap=%none -xchip=ultra -mc -xs -xbuiltin=%none -xdebugformat=dwarf -xunroll=1"),
$

Also the Makefile is slightly strange with the destination lib dir
placed at :

# Do not edit these manually. Use Configure with --prefix or --openssldir
# to change this!  Short explanation in the top comment in Configure
INSTALLTOP=/usr/local/ssl
OPENSSLDIR=/usr/local/ssl/ssl
LIBDIR=lib/64

This LIBDIR would result at /usr/local/ssl/lib/64 and that makes no
sense whatsoever. Regardless the compile finishes fine.

This is a full non-optimized compile with debug information and without
stripped binaries. This allows for single stepping and debug later.

$ /usr/local/bin/perl ./Configure solaris64-sparcv9-cc no-asm --prefix=/usr/local/ssl shared no-engine -DPEDANTIC
Configuring OpenSSL version 3.0.8 for target solaris64-sparcv9-cc
Using os-specific seed configuration
Created configdata.pm
Running configdata.pm
Created Makefile.in
Created Makefile
Created include/openssl/configuration.h

**********************************************************************
***                                                                ***
***   OpenSSL has been successfully configured                     ***
***                                                                ***
***   If you encounter a problem while building, please open an    ***
***   issue on GitHub <https://github.com/openssl/openssl/issues>  ***
***   and include the output from the following command:           ***
***                                                                ***
***       perl configdata.pm --dump                                ***
***                                                                ***
***   (If you are new to OpenSSL, you might want to consult the    ***
***   'Troubleshooting' section in the INSTALL.md file first)      ***
***                                                                ***
**********************************************************************
$

Here is basic system information and the "dump" as requested :

pollux $
pollux $ uname -a
SunOS pollux 5.10 Generic_150400-44 sun4u sparc SUNW,UltraAX-i2
pollux $
pollux $ psrinfo -pv
The physical processor has 1 virtual processor (0)
  UltraSPARC-IIe (portid 0 impl 0x13 ver 0x14 clock 500 MHz)
pollux $
pollux $ zfs list
NAME                                USED  AVAIL  REFER  MOUNTPOINT
iscbind_rpool                      28.8G  7.86G    97K  /iscbind_rpool
iscbind_rpool/ROOT                 16.5G  7.86G    21K  legacy
iscbind_rpool/ROOT/s10s_u9wos_14a  16.5G  7.86G  16.5G  /
iscbind_rpool/build                2.76G  7.86G  2.76G  /usr/local/build
iscbind_rpool/dump                 2.00G  7.86G  2.00G  -
iscbind_rpool/export               2.29G  7.86G   827M  /export
iscbind_rpool/export/home          1.49G  7.86G  1.49G  /export/home
iscbind_rpool/local                1.96G  7.86G  1.96G  /usr/local
iscbind_rpool/opt                   757M  7.86G   757M  /opt
iscbind_rpool/s8_hw4                493M  7.86G   493M  /mnt/s8_hw4
iscbind_rpool/swap                 2.06G  7.92G  2.00G  -
pollux $

pollux $ env | sort
AR=/usr/xpg4/bin/ar
AS=/usr/ccs/bin/as
AUTOCONF=/usr/local/bin/autoconf
AUTOHEADER=/usr/local/bin/autoheader
AUTOMAKE=/usr/local/bin/automake
AWK=/usr/local/bin/gawk
BISON=/usr/local/bin/bison
CC=/opt/solarisstudio12.4/bin/cc
CFLAGS=-m64 -xarch=sparc -g -xO0 -errfmt=error -erroff=%none -xmemalign=8s -errshort=full -xstrconst -xildoff -xnolibmil -xcode=pic32 -xregs=no%appl -xlibmieee -ftrap=%none -xchip=ultra -mc -xs -xbuiltin=%none -xdebugformat=dwarf -xunroll=1
COLUMNS=132
CONFIG_SHELL=/usr/xpg4/bin/sh
CPPFLAGS=-I/usr/local/include -D_LARGEFILE64_SOURCE -D__EXTENSIONS__
CXXFLAGS=-m64 -O0 -g -fno-builtin -mno-app-regs -mhard-float -mno-faster-structs -mstd-struct-return -mcpu=ultrasparc -mtune=ultrasparc -mno-vis
CXX=/opt/solarisstudio12.4/bin/CC
DISPLAY=localhost:10.0
EDITOR=/usr/xpg6/bin/vi
GREP=/usr/xpg4/bin/grep
HOME=/export/home/dclarke
JAVA_HOME=/usr/jdk/instances/jdk1.8.0
LANG=en_US.UTF-8
LC_COLLATE=en_US.UTF-8
LC_CTYPE=en_US.UTF-8
LC_MESSAGES=en_US.UTF-8
LC_MONETARY=en_US.UTF-8
LC_NUMERIC=en_US.UTF-8
LC_TIME=en_US.UTF-8
LD_OPTIONS=-R/usr/local/lib -R/usr/local/ssl/lib -L/usr/local/lib -L/usr/local/ssl/lib
LD=/usr/ccs/bin/sparcv9/ld
LINES=43
LOGNAME=dclarke
M4=/usr/local/bin/m4
MAIL=/usr/mail/dclarke
MAKE=/usr/local/bin/gmake
MANPATH=/usr/jdk/instances/jdk1.8.0/man:/usr/share/man:/usr/X11/share/man:/opt/solarisstudio12.4/share/man
NICE=/usr/xpg4/bin/nice
NM=/usr/ccs/bin/nm -p
OPENSSL_SOURCE=/usr/local/build/openssl-3.0.8_SunOS5.10_sun4u.007
PAGER=/usr/xpg4/bin/more
PATH=/usr/xpg6/bin:/usr/xpg4/bin:/usr/ccs/bin:/usr/jdk/instances/jdk1.8.0/bin:/usr/local/bin:/usr/bin:/opt/solarisstudio12.4/bin:/sbin:/bin:/usr/sbin:/opt/schily/bin
PCRE_CONFIG=/usr/local/bin/pcre-config
PERL=/usr/local/bin/perl
PWD=/usr/local/build/openssl-3.0.8_SunOS5.10_sun4u.007
SHELL=/usr/xpg4/bin/sh
SSH_CLIENT=172.16.35.9 55183 22
SSH_CONNECTION=172.16.35.9 55183 172.16.35.20 22
SSH_TTY=/dev/pts/1
TERM=vt100
TIME=/usr/bin/time
TMPDIR=/var/tmp/dclarke
TZ=GMT0
USER=dclarke
_=/usr/xpg4/bin/env
VISUAL=/usr/xpg6/bin/vi
XTERM_LOCALE=en_US.UTF-8
pollux $

Most tools are up to date and perl is brand new :

pollux $ /usr/local/bin/perl -V | head -8
Summary of my perl5 (revision 5 version 36 subversion 0) configuration:

  Platform:
    osname=solaris
    osvers=2.10
    archname=sun4-solaris-64-ld
    uname='sunos pollux 5.10 generic_150400-44 sun4u sparc sunw,ultraax-i2 '
    config_args='-Dcc=/opt/solarisstudio12.4/bin/c99 -Dprefix=/usr/local -Dmksymlinks -Accflags=-Xc -g -xO0 -errfmt=error -erroff=%none -xmemalign=8s -errshort=full -xstrconst -xildoff -m64 -xnolibmil -xcode=pic32 -xregs=no%appl -xlibmieee -ftrap=%none -xchip=ultra -mc -xs -xbuiltin=%none -xdebugformat=dwarf -xunroll=1 -L/usr/local/lib -R/usr/local/lib -I/usr/local/include -D_XOPEN_SOURCE=600 -D__EXTENSIONS__'
pollux $

pollux $ /usr/local/bin/perl configdata.pm --dump

Command line (with current working directory = .):

    /usr/local/bin/perl ./Configure solaris64-sparcv9-cc no-asm --prefix=/usr/local/ssl shared no-engine -DPEDANTIC

Perl information:

    /usr/local/bin/perl
    5.36.0 for sun4-solaris-64-ld

Enabled features:

    aria
    async
    autoalginit
    autoerrinit
    autoload-config
    bf
    blake2
    bulk
    cached-fetch
    camellia
    cast
    chacha
    cmac
    cmp
    cms
    comp
    ct
    deprecated
    des
    dgram
    dh
    dsa
    dso
    dtls
    ec
    ec2m
    ecdh
    ecdsa
    err
    filenames
    gost
    idea
    legacy
    md4
    mdc2
    module
    multiblock
    nextprotoneg
    ocb
    ocsp
    pic
    pinshared
    poly1305
    posix-io
    psk
    rc2
    rc4
    rdrand
    rfc3779
    rmd160
    scrypt
    secure-memory
    seed
    shared
    siphash
    siv
    sm2
    sm3
    sm4
    sock
    srp
    srtp
    sse2
    ssl
    ssl-trace
    static-engine
    stdio
    tests
    threads
    tls
    ts
    ui-console
    whirlpool
    tls1
    tls1-method
    tls1_1
    tls1_1-method
    tls1_2
    tls1_2-method
    tls1_3
    dtls1
    dtls1-method
    dtls1_2
    dtls1_2-method

Disabled features:

    acvp-tests          [cascade]        OPENSSL_NO_ACVP_TESTS
    afalgeng            [cascade]        OPENSSL_NO_AFALGENG
    asan                [default]        OPENSSL_NO_ASAN
    asm                 [option]         OPENSSL_NO_ASM
    buildtest-c++       [default]
    capieng             [cascade]        OPENSSL_NO_CAPIENG
    crypto-mdebug       [default]        OPENSSL_NO_CRYPTO_MDEBUG
    devcryptoeng        [default]        OPENSSL_NO_DEVCRYPTOENG
    dynamic-engine      [cascade]
    ec_nistp_64_gcc_128 [default]        OPENSSL_NO_EC_NISTP_64_GCC_128
    egd                 [default]        OPENSSL_NO_EGD
    engine              [option]         OPENSSL_NO_ENGINE (skip engines, crypto/engine)
    external-tests      [default]        OPENSSL_NO_EXTERNAL_TESTS
    fips                [default]
    fips-securitychecks [cascade]        OPENSSL_NO_FIPS_SECURITYCHECKS
    fuzz-afl            [default]        OPENSSL_NO_FUZZ_AFL
    fuzz-libfuzzer      [default]        OPENSSL_NO_FUZZ_LIBFUZZER
    ktls                [default]        OPENSSL_NO_KTLS
    loadereng           [cascade]        OPENSSL_NO_LOADERENG
    makedepend          [unavailable]
    md2                 [default]        OPENSSL_NO_MD2 (skip crypto/md2)
    msan                [default]        OPENSSL_NO_MSAN
    padlockeng          [cascade]        OPENSSL_NO_PADLOCKENG
    rc5                 [default]        OPENSSL_NO_RC5 (skip crypto/rc5)
    sctp                [default]        OPENSSL_NO_SCTP
    trace               [default]        OPENSSL_NO_TRACE
    ubsan               [default]        OPENSSL_NO_UBSAN
    unit-test           [default]        OPENSSL_NO_UNIT_TEST
    uplink              [no uplink_arch] OPENSSL_NO_UPLINK
    weak-ssl-ciphers    [default]        OPENSSL_NO_WEAK_SSL_CIPHERS
    zlib                [default]
    zlib-dynamic        [default]
    ssl3                [default]        OPENSSL_NO_SSL3
    ssl3-method         [default]        OPENSSL_NO_SSL3_METHOD

Config target attributes:

    AR => "ar",
    ARFLAGS => "qc",
    CC => "cc",
    CFLAGS => "-xO0 -g -xdepend",
    HASHBANGPERL => "/usr/bin/env perl",
    RANLIB => "ranlib",
    RC => "windres",
    asm_arch => "sparcv9",
    bn_ops => "BN_LLONG RC4_CHAR",
    build_file => "Makefile",
    build_scheme => [ "unified", "unix" ],
    cflags => "-m64 -xarch=sparc -g -xO0 -m64 -errfmt=error -erroff=%none -xmemalign=8s -errshort=full -xstrconst -xildoff -xnolibmil -xcode=pic32 -xregs=no%appl -xlibmieee -ftrap=%none -xchip=ultra -mc -xs -xbuiltin=%none -xdebugformat=dwarf -xunroll=1 -xstrconst -Xa",
    cppflags => "-D_REENTRANT",
    defines => [ "OPENSSL_BUILDING_OPENSSL" ],
    disable => [  ],
    dso_scheme => "dlfcn",
    enable => [  ],
    ex_libs => "-lsocket -lnsl -ldl -lrt -lpthread",
    includes => [  ],
    lflags => "-mt",
    lib_cflags => "",
    lib_cppflags => "-DFILIO_H -DB_ENDIAN -DBN_DIV2W",
    lib_defines => [  ],
    module_cflags => "-xcode=pic32",
    module_cxxflags => undef,
    module_ldflags => "-G -dy -z text -Wl,-Bsymbolic",
    multilib => "/64",
    perl_platform => "Unix",
    perlasm_scheme => "void",
    shared_cflag => "-xcode=pic32",
    shared_defflag => "-Wl,-M,",
    shared_defines => [  ],
    shared_ldflag => "-G -dy -z text -Wl,-Bsymbolic",
    shared_rcflag => "",
    shared_sonameflag => "-Wl,-h,",
    shared_target => "solaris",
    thread_defines => [  ],
    thread_scheme => "pthreads",
    unistd => "<unistd.h>",

Recorded environment:

    AR = /usr/xpg4/bin/ar
    BUILDFILE =
    CC = /opt/solarisstudio12.4/bin/cc
    CFLAGS = -m64 -xarch=sparc -g -xO0 -m64 -errfmt=error -erroff=%none -xmemalign=8s -errshort=full -xstrconst -xildoff -xnolibmil -xcode=pic32 -xregs=no%appl -xlibmieee -ftrap=%none -xchip=ultra -mc -xs -xbuiltin=%none -xdebugformat=dwarf -xunroll=1
    CPPFLAGS = -I/usr/local/include -D_LARGEFILE64_SOURCE -D__EXTENSIONS__
    CROSS_COMPILE =
    CXX = /opt/solarisstudio12.4/bin/CC
    CXXFLAGS = -m64 -O0 -g -fno-builtin -mno-app-regs -mhard-float -mno-faster-structs -mstd-struct-return -mcpu=ultrasparc -mtune=ultrasparc -mno-vis
    HASHBANGPERL =
    LDFLAGS =
    LDLIBS =
    OPENSSL_LOCAL_CONFIG_DIR =
    PERL = /usr/local/bin/perl
    RANLIB =
    RC =
    RCFLAGS =
    WINDRES =
    __CNF_CFLAGS =
    __CNF_CPPDEFINES =
    __CNF_CPPFLAGS =
    __CNF_CPPINCLUDES =
    __CNF_CXXFLAGS =
    __CNF_LDFLAGS =
    __CNF_LDLIBS =

Makevars:

    AR              = /usr/xpg4/bin/ar
    ARFLAGS         = qc
    CC              = /opt/solarisstudio12.4/bin/cc
    CFLAGS          = -m64 -xarch=sparc -g -xO0 -m64 -errfmt=error -erroff=%none -xmemalign=8s -errshort=full -xstrconst -xildoff -xnolibmil -xcode=pic32 -xregs=no%appl -xlibmieee -ftrap=%none -xchip=ultra -mc -xs -xbuiltin=%none -xdebugformat=dwarf -xunroll=1
    CPPDEFINES      = PEDANTIC
    CPPFLAGS        = -I/usr/local/include -D_LARGEFILE64_SOURCE -D__EXTENSIONS__
    CPPINCLUDES     =
    CXX             = /opt/solarisstudio12.4/bin/CC
    CXXFLAGS        = -m64 -O0 -g -fno-builtin -mno-app-regs -mhard-float -mno-faster-structs -mstd-struct-return -mcpu=ultrasparc -mtune=ultrasparc -mno-vis
    HASHBANGPERL    = /usr/local/bin/perl
    LDFLAGS         =
    LDLIBS          =
    PERL            = /usr/local/bin/perl
    RANLIB          = ranlib
    RC              = windres
    RCFLAGS         =

NOTE: These variables only represent the configuration view.  The build file
template may have processed these variables further, please have a look at the
build file for more exact data:
    Makefile

build file:

    Makefile

build file templates:

    Configurations/common0.tmpl
    Configurations/unix-Makefile.tmpl
pollux $

Strange failure output was seen during testing :

80-test_ocsp.t ..................... ok
80-test_pkcs12.t ................... ok

            # ERROR: (int) 'result->result == test_ctx->expected_result' failed @ test/ssl_test.c:36
            # [3] compared to [0]
            # INFO:
            # ExpectedResult mismatch: expected Success, got InternalError.
            # OPENSSL_TEST_RAND_ORDER=1677380088
            not ok 10 - iteration 10
# ------------------------------------------------------------------------------
        # OPENSSL_TEST_RAND_ORDER=1677380088
        not ok 1 - test_handshake
# ------------------------------------------------------------------------------
../../util/wrap.pl ../../test/ssl_test 07-dtls-protocol-version.cnf.default default => 1
    not ok 6 - running CTLOG_FILE=test/ct/log_list.cnf TEST_CERTS_DIR=test/certs test/ssl_test test/ssl-tests/07-dtls-protocol-versi
on.cnf default
# ------------------------------------------------------------------------------
    #   Failed test 'running CTLOG_FILE=test/ct/log_list.cnf TEST_CERTS_DIR=test/certs test/ssl_test test/ssl-tests/07-dtls-protocol
-version.cnf default'
    #   at test/recipes/80-test_ssl_new.t line 177.
    # Looks like you failed 1 test of 6.
not ok 7 - Test configuration 07-dtls-protocol-version.cnf
# ------------------------------------------------------------------------------
# Looks like you failed 1 test of 30.80-test_ssl_new.t ..................
Dubious, test returned 1 (wstat 256, 0x100)
Failed 1/30 subtests
80-test_ssl_old.t .................. ok
80-test_ssl_test_ctx.t ............. ok

Also a large number of tests were skipped for various reasons where the
most susppect reason seemed to be a failure of "dynamic engine" :

pollux $ grep 'skipped' ../openssl-3.0.8_SunOS5.10_sun4u.007.test.log
00-prep_fipsmodule_cnf.t .. skipped: FIPS module config file only supported in a fips build
01-test_fipsmodule_cnf.t ........... skipped: Test only supported in a fips build
03-test_fipsinstall.t .............. skipped: Test only supported in a fips build
05-test_rc5.t ...................... skipped: rc5 is not supported by this OpenSSL build
20-test_cli_fips.t ................. skipped: Test only supported in a fips build with security checks
30-test_acvp.t ..................... skipped: ACVP is not supported by this test
30-test_afalg.t .................... skipped: test_afalg not supported for this build
70-test_comp.t ..................... skipped: test_comp needs the dynamic engine feature enabled
70-test_key_share.t ................ skipped: test_key_share needs the dynamic engine feature enabled
70-test_renegotiation.t ............ skipped: test_renegotiation needs the dynamic engine feature enabled
70-test_sslcbcpadding.t ............ skipped: test_sslcbcpadding needs the dynamic engine feature enabled
70-test_sslcertstatus.t ............ skipped: test_sslcertstatus needs the dynamic engine feature enabled
70-test_sslextension.t ............. skipped: test_sslextension needs the dynamic engine feature enabled
70-test_sslmessages.t .............. skipped: test_sslmessages needs the dynamic engine feature enabled
70-test_sslrecords.t ............... skipped: test_sslrecords needs the dynamic engine feature enabled
70-test_sslsessiontick.t ........... skipped: test_sslsessiontick needs the dynamic engine feature enabled
70-test_sslsigalgs.t ............... skipped: test_sslsigalgs needs the dynamic engine feature enabled
70-test_sslsignature.t ............. skipped: test_sslsignature needs the dynamic engine feature enabled
70-test_sslskewith0p.t ............. skipped: test_sslskewith0p needs the dynamic engine feature enabled
70-test_sslversions.t .............. skipped: test_sslversions needs the dynamic engine feature enabled
70-test_sslvertol.t ................ skipped: test_sslvertol needs the dynamic engine feature enabled
70-test_tls13alerts.t .............. skipped: test_tls13alerts needs the dynamic engine feature enabled
70-test_tls13cookie.t .............. skipped: test_tls13cookie needs the dynamic engine feature enabled
70-test_tls13downgrade.t ........... skipped: test_tls13downgrade needs the dynamic engine feature enabled
70-test_tls13hrr.t ................. skipped: test_tls13hrr needs the dynamic engine feature enabled
70-test_tls13kexmodes.t ............ skipped: test_tls13kexmodes needs the dynamic engine feature enabled
70-test_tls13messages.t ............ skipped: test_tls13messages needs the dynamic engine feature enabled
70-test_tls13psk.t ................. skipped: test_tls13psk needs the dynamic engine feature enabled
70-test_tlsextms.t ................. skipped: test_tlsextms needs the dynamic engine feature enabled
90-test_fipsload.t ................. skipped: Test is disabled with disabled fips
95-test_external_gost_engine.t ..... skipped: No external tests in this configuration
95-test_external_krb5.t ............ skipped: No external tests in this configuration
95-test_external_pyca.t ............ skipped: No external tests in this configuration
pollux $

I do not know what these "dynamic engine feature" tests are but there
seems to be an entire component of the build that is missing. I also
did try with strict C99 but that fails in multiple ways. Regardless the
OpenSSL 3.0.8 build process completes but results in a broken result.

--
Dennis Clarke
RISC-V/SPARC/PPC/ARM/CISC
UNIX and Linux spoken
GreyBeard and suspenders optional

Ping @orcl-jlana @cernoseka

I am going to try a rebuild wherein I will remove the config options no-asm and no-engines.

IMHO it is not Solaris 10 issue but the compiler you use. Have you switch to a new Studio recently?

IMHO it is not Solaris 10 issue but the compiler you use. Have you switch to a new Studio recently?

That is impossible. ORACLE in their magnificent wisdom dropped support
for all baseline sparcv9 servers in their updates to ORACLE Studio 12.5
and 12.6 such that no binary can be produced for anything manufactured
before 2010.

Part of the ORACLE plan for support of all old running Sun hardware.

If I can bootstrap a recent GCC then I will.

I rebuilt OpenSSL 3.0.8 with a slightly different configuration wherein I see :

pollux $
pollux $ /usr/local/bin/perl ./Configure solaris64-sparcv9-cc no-asm \
> --prefix=/usr/local/ssl --openssldir=/usr/local/ssl \
> shared -DPEDANTIC
Configuring OpenSSL version 3.0.8 for target solaris64-sparcv9-cc
Using os-specific seed configuration
Created configdata.pm
Running configdata.pm
Created Makefile.in
Created Makefile
Created include/openssl/configuration.h

**********************************************************************
***                                                                ***
***   OpenSSL has been successfully configured                     ***
***                                                                ***
***   If you encounter a problem while building, please open an    ***
***   issue on GitHub <https://github.com/openssl/openssl/issues>  ***
***   and include the output from the following command:           ***
***                                                                ***
***       perl configdata.pm --dump                                ***
***                                                                ***
***   (If you are new to OpenSSL, you might want to consult the    ***
***   'Troubleshooting' section in the INSTALL.md file first)      ***
***                                                                ***
**********************************************************************
pollux $

The compile runs just fine wwith no major complaints seen.

pollux $ /usr/local/bin/gmake test
/usr/local/bin/gmake depend && /usr/local/bin/gmake _tests
gmake[1]: Entering directory `/usr/local/build/openssl-3.0.8_SunOS5.10_sun4u.008'
gmake[1]: Leaving directory `/usr/local/build/openssl-3.0.8_SunOS5.10_sun4u.008'
gmake[1]: Entering directory `/usr/local/build/openssl-3.0.8_SunOS5.10_sun4u.008'
( SRCTOP=. \
  BLDTOP=. \
  PERL="/usr/local/bin/perl" \
  FIPSKEY="f4556650ac31d35461610bac4ed81b1a181b2d8a43ea2854cbae22ca74560813" \
  EXE_EXT= \
  /usr/local/bin/perl ./test/run_tests.pl  )
00-prep_fipsmodule_cnf.t .. skipped: FIPS module config file only supported in a fips build
Files=1, Tests=0, 12 wallclock secs ( 0.00 usr +  0.00 sys =  0.00 CPU)
Result: NOTESTS
01-test_abort.t .................... ok
01-test_fipsmodule_cnf.t ........... skipped: Test only supported in a fips build
01-test_sanity.t ................... ok
01-test_symbol_presence.t .......... ok
01-test_test.t ..................... ok
02-test_errstr.t ................... ok
02-test_internal_context.t ......... ok
02-test_internal_ctype.t ........... ok
02-test_internal_exts.t ............ ok
02-test_internal_keymgmt.t ......... ok
02-test_internal_provider.t ........ ok
02-test_lhash.t .................... ok
02-test_localetest.t ............... ok
02-test_ordinals.t ................. ok
02-test_sparse_array.t ............. ok
02-test_stack.t .................... ok
03-test_exdata.t ................... ok
03-test_fipsinstall.t .............. skipped: Test only supported in a fips build
03-test_internal_asn1.t ............ ok
03-test_internal_asn1_dsa.t ........ ok
03-test_internal_bn.t .............. ok
03-test_internal_chacha.t .......... ok
03-test_internal_curve448.t ........ ok
03-test_internal_ec.t .............. ok
03-test_internal_ffc.t ............. ok
03-test_internal_mdc2.t ............ ok
03-test_internal_modes.t ........... ok
03-test_internal_namemap.t ......... ok
03-test_internal_poly1305.t ........ ok
03-test_internal_rsa_sp800_56b.t ... ok
03-test_internal_siphash.t ......... ok
03-test_internal_sm2.t ............. ok
03-test_internal_sm3.t ............. ok
03-test_internal_sm4.t ............. ok
03-test_internal_ssl_cert_table.t .. ok
03-test_internal_x509.t ............ ok
03-test_params_api.t ............... ok
03-test_property.t ................. ok
03-test_ui.t ....................... ok
04-test_asn1_decode.t .............. ok
04-test_asn1_encode.t .............. ok
04-test_asn1_string_table.t ........ ok
04-test_bio_callback.t ............. ok
04-test_bio_core.t ................. ok
04-test_bioprint.t ................. ok
04-test_conf.t ..................... ok
04-test_encoder_decoder.t .......... ok
04-test_encoder_decoder_legacy.t ... ok
04-test_err.t ...................... ok
04-test_hexstring.t ................ ok
04-test_param_build.t .............. ok
04-test_params.t ................... ok
04-test_params_conversion.t ........ ok
04-test_pem_read_depr.t ............ ok
04-test_pem_reading.t .............. ok
04-test_provfetch.t ................ ok
04-test_provider.t ................. ok
04-test_provider_fallback.t ........ ok
04-test_provider_pkey.t ............ ok
04-test_punycode.t ................. ok
04-test_upcalls.t .................. ok
05-test_bf.t ....................... ok
05-test_cast.t ..................... ok
05-test_cmac.t ..................... ok
05-test_des.t ...................... ok
05-test_hmac.t ..................... ok
05-test_idea.t ..................... ok
05-test_pbe.t ...................... ok
05-test_rand.t ..................... ok
05-test_rc2.t ...................... ok
05-test_rc4.t ...................... ok
05-test_rc5.t ...................... skipped: rc5 is not supported by this OpenSSL build
06-test_algorithmid.t .............. ok
06-test_rdrand_sanity.t ............ ok
10-test_bn.t ....................... ok
10-test_exp.t ...................... ok
15-test_dh.t ....................... ok
15-test_dsa.t ...................... ok
15-test_dsaparam.t ................. ok
15-test_ec.t ....................... ok
15-test_ecdsa.t .................... ok
15-test_ecparam.t .................. ok
15-test_gendh.t .................... ok
15-test_gendhparam.t ............... ok
15-test_gendsa.t ................... ok
15-test_genec.t .................... ok
15-test_genrsa.t ................... ok
15-test_mp_rsa.t ................... ok
15-test_out_option.t ............... ok
15-test_rsa.t ...................... ok
15-test_rsaoaep.t .................. ok
15-test_rsapss.t ................... ok
15-test_sha.t ...................... ok
20-test_app.t ...................... ok
20-test_cli_fips.t ................. skipped: Test only supported in a fips build with security checks
20-test_dgst.t ..................... ok
20-test_dhparam.t .................. ok
20-test_dhparam_check.t ............ ok
20-test_enc.t ...................... ok
20-test_enc_more.t ................. ok
20-test_kdf.t ...................... ok
20-test_legacy_okay.t .............. ok
20-test_mac.t ...................... ok
20-test_passwd.t ................... ok
20-test_pkeyutl.t .................. ok
20-test_rand_config.t .............. ok
20-test_spkac.t .................... ok
25-test_crl.t ...................... ok
25-test_d2i.t ...................... ok
25-test_eai_data.t ................. ok
25-test_pkcs7.t .................... ok
25-test_req.t ...................... ok
25-test_rusext.t ................... ok
25-test_sid.t ...................... ok
25-test_verify.t ................... ok
25-test_verify_store.t ............. ok
25-test_x509.t ..................... ok
30-test_acvp.t ..................... skipped: ACVP is not supported by this test
30-test_aesgcm.t ................... ok
30-test_afalg.t .................... skipped: test_afalg not supported for this build
30-test_defltfips.t ................ ok
30-test_engine.t ................... ok
30-test_evp.t ...................... ok
30-test_evp_extra.t ................ ok
30-test_evp_fetch_prov.t ........... ok
30-test_evp_kdf.t .................. ok
30-test_evp_libctx.t ............... ok
30-test_evp_pkey_dparam.t .......... ok
30-test_evp_pkey_provided.t ........ ok
30-test_pbelu.t .................... ok
30-test_pkey_meth.t ................ ok
30-test_pkey_meth_kdf.t ............ ok
30-test_prov_config.t .............. ok
30-test_provider_status.t .......... ok
40-test_rehash.t ................... ok
60-test_x509_check_cert_pkey.t ..... ok
60-test_x509_dup_cert.t ............ ok
60-test_x509_store.t ............... ok
60-test_x509_time.t ................ ok
61-test_bio_prefix.t ............... ok
61-test_bio_readbuffer.t ........... ok
65-test_cmp_asn.t .................. ok
65-test_cmp_client.t ............... ok
65-test_cmp_ctx.t .................. ok
65-test_cmp_hdr.t .................. ok
65-test_cmp_msg.t .................. ok
65-test_cmp_protect.t .............. ok
65-test_cmp_server.t ............... ok
65-test_cmp_status.t ............... ok
65-test_cmp_vfy.t .................. ok
66-test_ossl_store.t ............... ok
70-test_asyncio.t .................. ok
70-test_bad_dtls.t ................. ok
70-test_clienthello.t .............. ok
70-test_comp.t ..................... ok
70-test_key_share.t ................ ok
70-test_packet.t ................... ok
70-test_recordlen.t ................ ok
70-test_renegotiation.t ............ ok
70-test_servername.t ............... ok
70-test_sslcbcpadding.t ............ ok
70-test_sslcertstatus.t ............ ok
70-test_sslextension.t ............. ok
70-test_sslmessages.t .............. ok
70-test_sslrecords.t ............... ok
70-test_sslsessiontick.t ........... ok
70-test_sslsigalgs.t ............... ok
70-test_sslsignature.t ............. ok
70-test_sslskewith0p.t ............. ok
70-test_sslversions.t .............. ok
70-test_sslvertol.t ................ ok
70-test_tls13alerts.t .............. ok
70-test_tls13cookie.t .............. ok
70-test_tls13downgrade.t ........... ok
70-test_tls13hrr.t ................. ok
70-test_tls13kexmodes.t ............ ok
70-test_tls13messages.t ............ ok
70-test_tls13psk.t ................. ok
70-test_tlsextms.t ................. ok
70-test_verify_extra.t ............. ok
70-test_wpacket.t .................. ok
71-test_ssl_ctx.t .................. ok
79-test_http.t ..................... ok
80-test_ca.t ....................... ok
80-test_cipherbytes.t .............. ok
80-test_cipherlist.t ............... ok
80-test_ciphername.t ............... ok
80-test_cmp_http.t ................. ok
80-test_cms.t ...................... ok
80-test_cmsapi.t ................... ok
80-test_ct.t ....................... ok
80-test_dane.t ..................... ok
80-test_dtls.t ..................... ok
80-test_dtls_mtu.t ................. ok
80-test_dtlsv1listen.t ............. ok
80-test_ocsp.t ..................... ok
80-test_pkcs12.t ................... ok

            # ERROR: (int) 'result->result == test_ctx->expected_result' failed @ test/ssl_test.c:36
            # [3] compared to [0]
            # INFO:
            # ExpectedResult mismatch: expected Success, got InternalError.
            # OPENSSL_TEST_RAND_ORDER=1677641640
            not ok 18 - iteration 18
# ------------------------------------------------------------------------------
        # OPENSSL_TEST_RAND_ORDER=1677641640
        not ok 1 - test_handshake
# ------------------------------------------------------------------------------
../../util/wrap.pl ../../test/ssl_test 07-dtls-protocol-version.cnf.default default => 1
    not ok 6 - running CTLOG_FILE=test/ct/log_list.cnf TEST_CERTS_DIR=test/certs test/ssl_test test/ssl-tests/07-dtls-protocol-version.cnf default
# ------------------------------------------------------------------------------
    #   Failed test 'running CTLOG_FILE=test/ct/log_list.cnf TEST_CERTS_DIR=test/certs test/ssl_test test/ssl-tests/07-dtls-protocol-version.cnf default'
    #   at test/recipes/80-test_ssl_new.t line 177.
    # Looks like you failed 1 test of 6.
not ok 7 - Test configuration 07-dtls-protocol-version.cnf
# ------------------------------------------------------------------------------
            # ERROR: (int) 'result->result == test_ctx->expected_result' failed @ test/ssl_test.c:36
            # [3] compared to [0]
            # INFO:
            # ExpectedResult mismatch: expected Success, got InternalError.
            # OPENSSL_TEST_RAND_ORDER=1677642175
            not ok 13 - iteration 13
# ------------------------------------------------------------------------------
        # OPENSSL_TEST_RAND_ORDER=1677642175
        not ok 1 - test_handshake
# ------------------------------------------------------------------------------
../../util/wrap.pl ../../test/ssl_test 11-dtls_resumption.cnf.none none => 1
    not ok 3 - running CTLOG_FILE=test/ct/log_list.cnf TEST_CERTS_DIR=test/certs test/ssl_test test/ssl-tests/11-dtls_resumption.cnf none
# ------------------------------------------------------------------------------
            # ERROR: (int) 'result->result == test_ctx->expected_result' failed @ test/ssl_test.c:36
            # [3] compared to [0]
            # INFO:
            # ExpectedResult mismatch: expected Success, got InternalError.
            # OPENSSL_TEST_RAND_ORDER=1677642218
            not ok 6 - iteration 6
# ------------------------------------------------------------------------------
        # OPENSSL_TEST_RAND_ORDER=1677642218
        not ok 1 - test_handshake
# ------------------------------------------------------------------------------
../../util/wrap.pl ../../test/ssl_test 11-dtls_resumption.cnf.default default => 1
    not ok 6 - running CTLOG_FILE=test/ct/log_list.cnf TEST_CERTS_DIR=test/certs test/ssl_test test/ssl-tests/11-dtls_resumption.cnf default
# ------------------------------------------------------------------------------
    #   Failed test 'running CTLOG_FILE=test/ct/log_list.cnf TEST_CERTS_DIR=test/certs test/ssl_test test/ssl-tests/11-dtls_resumption.cnf default'
    #   at test/recipes/80-test_ssl_new.t line 177.
    # Looks like you failed 2 tests of 6.
not ok 11 - Test configuration 11-dtls_resumption.cnf
# ------------------------------------------------------------------------------
# Looks like you failed 2 tests of 30.80-test_ssl_new.t ..................
Dubious, test returned 2 (wstat 512, 0x200)
Failed 2/30 subtests
80-test_ssl_old.t .................. ok
80-test_ssl_test_ctx.t ............. ok
80-test_sslcorrupt.t ............... ok
80-test_tsa.t ...................... ok
80-test_x509aux.t .................. ok
81-test_cmp_cli.t .................. ok
90-test_asn1_time.t ................ ok
90-test_async.t .................... ok
90-test_bio_enc.t .................. ok
90-test_bio_memleak.t .............. ok
90-test_constant_time.t ............ ok
90-test_fatalerr.t ................. ok
90-test_fipsload.t ................. skipped: Test is disabled with disabled fips
90-test_gmdiff.t ................... ok
90-test_ige.t ...................... ok
90-test_includes.t ................. ok
90-test_memleak.t .................. ok
90-test_overhead.t ................. ok
90-test_secmem.t ................... ok
90-test_shlibload.t ................ ok
90-test_srp.t ...................... ok
90-test_sslapi.t ................... ok
90-test_sslbuffers.t ............... ok
90-test_store.t .................... ok
90-test_sysdefault.t ............... ok
90-test_threads.t .................. ok
90-test_time_offset.t .............. ok
90-test_tls13ccs.t ................. ok
90-test_tls13encryption.t .......... ok
90-test_tls13secrets.t ............. ok
90-test_traceapi.t ................. ok
90-test_v3name.t ................... ok
91-test_pkey_check.t ............... ok
95-test_external_gost_engine.t ..... skipped: No external tests in this configuration
95-test_external_krb5.t ............ skipped: No external tests in this configuration
95-test_external_pyca.t ............ skipped: No external tests in this configuration
99-test_ecstress.t ................. ok
99-test_fuzz_asn1.t ................ ok
99-test_fuzz_asn1parse.t ........... ok
99-test_fuzz_bignum.t .............. ok
99-test_fuzz_bndiv.t ............... ok
99-test_fuzz_client.t .............. ok
99-test_fuzz_cmp.t ................. ok
99-test_fuzz_cms.t ................. ok
99-test_fuzz_conf.t ................ ok
99-test_fuzz_crl.t ................. ok
99-test_fuzz_ct.t .................. ok
99-test_fuzz_server.t .............. ok
99-test_fuzz_x509.t ................ ok

Test Summary Report
-------------------
80-test_ssl_new.t                (Wstat: 512 (exited 2) Tests: 30 Failed: 2)
  Failed tests:  7, 11
  Non-zero exit status: 2
Files=247, Tests=3311, 54370 wallclock secs ( 0.00 usr +  0.00 sys =  0.00 CPU)
Result: FAIL
gmake[1]: *** [run_tests] Error 1
gmake[1]: Leaving directory `/usr/local/build/openssl-3.0.8_SunOS5.10_sun4u.008'
gmake: *** [tests] Error 2

pollux $

This is a better result. I feel that the single test that fails is the issue here.

authors: blastwave mattcaswell orcl-jlana


text:
Typo OPENSS_NO_QUIC -> OPENSSL_NO_QUIC

Looking at the code on master(810f7dc1c7) I found a typo in s_client.c: OPENSS_NO_QUIC. It looks like it should be OPENSSL_NO_QUIC.

Thanks for the report. Fix in #21293

authors: fwh-dc mattcaswell


text:
Début d aventure

Sorry, closing this as not clear what you're asking

authors: Charlesjourdain tom-cosgrove-arm


text:
problem using openssl static library

I am using 1.1.0b on Ubuntu linux.
I did the following:
./config no-shared
make
Does this allow me to use openssl static without any shared libraries?
I linked against libcrypto.a. I still got the problem when running the application:
error while loading shared libraries: libcrypto.so.1.1: cannot open shared object file: No such file or directory
What should I do?
Thanks for help.

Please show us how you linked against libcrypto.a

I am using like:
-L/path/to/openssl -lcrypto

You should show the full linker command line.  If there are other directories earlier in the search path, that contain a different installation of openssl, that will be preferred.

I did another build from scratch(deleted previous). And built a small test app, it is working. It seems if I did a './config' and build before, and do another './config no-shared' and build, the result might not be what i wanted.

Yeah, I usually to this:
make clean; ./config ...

exactly to make sure I start from a clean slate

authors: kaduk levitte tanhuazh


text:
Regarding TLS-1.3 ClientFinished during post-handshake authentication

In TLS-1.3 draft section 4.4 [page 65],
base key mentioned for MAC key to be used while generating FinishedMessage
during post handshake authentication is  client_application_traffic_secret_N . But  client_finished_secret
is being used regardless of whether it is post-handshake authentication or not.

    if (!ssl_handshake_hash(s, hash, sizeof(hash), &hashlen)) {
        /* SSLfatal() already called */
        goto err;
    }

    if (str == s->method->ssl3_enc->server_finished_label)
        key = EVP_PKEY_new_raw_private_key(EVP_PKEY_HMAC, NULL,
                                           s->server_finished_secret, hashlen);
    else
        key = EVP_PKEY_new_raw_private_key(EVP_PKEY_HMAC, NULL,
                                           s->client_finished_secret, hashlen);

    if (key == NULL
            || ctx == NULL
            || EVP_DigestSignInit(ctx, NULL, md, NULL, key) <= 0
            || EVP_DigestSignUpdate(ctx, hash, hashlen) <= 0
            || EVP_DigestSignFinal(ctx, out, &hashlen) <= 0) {
        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS13_FINAL_FINISH_MAC,
                 ERR_R_INTERNAL_ERROR);
        goto err;
    }

    ret = hashlen;
 err:
    EVP_PKEY_free(key);
    EVP_MD_CTX_free(ctx);
    return ret;
}

If s->post_handshake_auth is set as SSL_PHA_REQUESTED , should we not use s->client_app_traffic_secret?
Sorry if I have misread something here.

I believe your analysis is correct; thank you for reporting it!.  @mattcaswell what are your thoughts?

Looks correct to me. Fix in #6297.
I'm intrigued to know how you found that! Is there another implementation somewhere that does post handshake authentication? I think this remains untested from an inter op perspective (because no one else had it).

I work for Cavium and we use OpenSSL stack to offload some of the SSL operations during handshake to our crypto accelerator. I noticed the difference from TLS draft while trying to offload post handshake authentication.

Ah! Makes sense! Thanks.

authors: kaduk mattcaswell ukartha


text:
Error #2F067065 - "ess signing certificate error" when validating timestamp reply

Hi,
I get an error when I try to validate a RFC3161-compliant timestamp reply.
The reply can be validated with an application using BouncyCastle.
This bug was also present in OpenSSL 1.0.1 as mentioned in #2473 .
Here is my environment:
# Distrib info
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=18.04
DISTRIB_CODENAME=bionic
DISTRIB_DESCRIPTION="Ubuntu 18.04.1 LTS"

# OpenSSL info
OpenSSL 1.1.0g  2 Nov 2017
built on: reproducible build, date unspecified
platform: debian-amd64
compiler: gcc -DDSO_DLFCN -DHAVE_DLFCN_H -DNDEBUG -DOPENSSL_THREADS -DOPENSSL_NO_STATIC_ENGINE -DOPENSSL_PIC -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPADLOCK_ASM -DPOLY1305_ASM -DOPENSSLDIR="\"/usr/lib/ssl\"" -DENGINESDIR="\"/usr/lib/x86_64-linux-gnu/engines-1.1\""
OPENSSLDIR: "/usr/lib/ssl"
ENGINESDIR: "/usr/lib/x86_64-linux-gnu/engines-1.1"

Steps to reproduce:
# Query generation
$ openssl ts -query -data /etc/passwd -sha256 -out query.tsr

# Here is the query
$ openssl ts -query -text -in query.tsq
Using configuration from /usr/lib/ssl/openssl.cnf
Version: 1
Hash Algorithm: sha256
Message data:
    0000 - 85 26 8f fc df fc 8f 54-ea d0 04 88 02 35 53 c1   .&.....T.....5S.
    0010 - 06 4b d9 7f 04 ed e4 11-a1 dc 99 12 4c e9 ac 54   .K..........L..T
Policy OID: unspecified
Nonce: 0x985B3170CE7DEED8
Certificate required: no
Extensions:

# Send it to the server - PrimeKey SignServer 4.0.0
$ cat query.tsq | curl -H 'Content-Type: application/timestamp-query' --cacert ca-tls.pem https://signserver.my.domain:8442/signserver/tsa?workerName=TimeStampSigner --data-binary @- -o reply.tsr

# Here is the reply
$ openssl ts -reply -in reply.tsr -text
Using configuration from /usr/lib/ssl/openssl.cnf
Status info:
Status: Granted.
Status description: Operation Okay
Failure info: unspecified

TST info:
Version: 1
Policy OID: [confidential - scrapped]
Hash Algorithm: sha256
Message data:
    0000 - 85 26 8f fc df fc 8f 54-ea d0 04 88 02 35 53 c1   .&.....T.....5S.
    0010 - 06 4b d9 7f 04 ed e4 11-a1 dc 99 12 4c e9 ac 54   .K..........L..T
Serial number: 0x2D26E0730ABDDD1B
Time stamp: Aug 23 14:19:52 2018 GMT
Accuracy: 0x01 seconds, unspecified millis, unspecified micros
Ordering: no
Nonce: 0x985B3170CE7DEED8
TSA: [confidential - scrapped: same info as my TSA cert for sure]
Extensions:

# This is when it gets weird
$ openssl ts -verify -in query.tsr -CAfile tsa-ca.pem -untrusted tsa.pem -queryfile query.tsq
Using configuration from /usr/lib/ssl/openssl.cnf
Verification: FAILED
140401657303488:error:2F067065:time stamp routines:ts_check_signing_certs:ess signing certificate error:../crypto/ts/ts_rsp_verify.c:230:

I can't attach reply ASN.1 for confidentiality issues but if it is really needed I can reproduce these steps in a test environment with no private info and then send the reply.
Thanks !

Hi Gigaju,
I ran into the same issue while working with dfn.de TSA. This happens when your TSA is working with the SHA256withRSAEncryption algorithm.
Support has been added in the pull request #771 , but it is not included in openssl 1.1.0. It is included in openssl 1.1.1 pre-release though.
I downloaded this version, compiled it and timestamp verification worked fine for me.
Hope this helps you.

I have a similar issue when the timestamp response contains an EssCertIdv2 as described in the RFC and to be compliant with ETSI. Does someone have already verify a timestamp response with and EssCertIdv2 ?

@H3llK33p3r : take a look at #14503 and related, it has fix some issues related to EssCertIdv2.

Thank for the response @FdaSilvaYY , after more investigation it seems that my issue is related to the EssCertIdv2 issuerSerial.
I have no issue with my server returning the v1 (no general names included in issuer serial).
With EssCertIdv2, the verify fails when issuer serial is set (this part is optionnal according to rfc5035). So either the serial number has an issue or the general names. I will perform additionnal tests.

The ess cert id handling should be fixed on current master. Closing. Please open new issues if you still see problems with ess handling in the current 3.0 prereleases.

Ok thanks, the issue was related to the RFC (on my side only) and the order of the general names element.
issuer
      contains the issuer name of the certificate.  For non-attribute certificates, the issuer MUST contain only the issuer name from
      the certificate encoded in the directoryName choice of GeneralNames.  For attribute certificates, the issuer MUST contain
      the issuer name field from the attribute certificate.

Sorry for the inconvenience.

Sorry for the inconvenience.

No problem.


text:
Allow different ciphers for encryption of new private keys in req

Hello,
genpkey/genrsa allows to specify a different cipher for private key. However, "req -newkey" will always use 3des or none.
The code is here:
https://github.com/openssl/openssl/blob/master/apps/req.c#L244
https://github.com/openssl/openssl/blob/master/apps/req.c#L661
https://github.com/openssl/openssl/blob/master/apps/req.c#L668
The "[ req ]" config encrypt_key is only used for setting as "no", equivalent to -nodes.
I would be interesting to have a parameter for settings a different cipher. Also, "encrypt_key" config  entry (or a new one) could also be used for setting the default private key cipher.
Using genpkey + req with encrypted private keys will require the user to enter private key twice or storing it outside openssl. Both are not ideal.

Marking as inactive, to be closed at the end of 3.4 dev, barring further input

authors: luizluca nhorman


text:
Fix a mem leak in libssl

Make sure we free up any ENGINE references after we have finished using
them.
Fixes #11064

I'm tempted to mark this "urgent", because it is disruptive for any up to date branch where you want to build with 'enable-asan' (that's how I discovered this).

Travis red cross is not relevant.

I would support labeling this as urgent!
I always build with memchecks and this is quite blocking!
I am surprised this was not caught by the CI: is it because we had to disable the asan build because it was timing-out in some platforms?
Can we reenable the ASAN build at least limited to one of the platforms we knew did not have a problem running ASAN?

Never mind what I wrote above, it was already discussed in the original issue #11064 !
Sorry!

I would have supported labeling this as urgent!

I already merged it. I just forgot to close the PR!

authors: levitte mattcaswell romen


text:
Improve DH and DSA error output

As discussed in https://github.com/openssl/openssl/issues/12047#issuecomment-638967154 and https://github.com/openssl/openssl/pull/12048#issuecomment-639472423, there is no to-the-point error output in case DH or DSA key sizes are considered unsuitable according to FIPS 186 FFC.
Maybe similar related issues should be handled as well,
maybe the placement of the DHerr and DSAerr calls is not yet optimal,
and maybe the wording of the reason codes needs improvement,
but this PR is at least a starting point.

Is this good to go now, or should we add/improve any more related error reporting?

@levitte, your new PR #12072 overlaps with the error reporting cleanup I already did in one of the two commits of this PR: https://github.com/openssl/openssl/pull/12062/commits/c77e4e5aaba119fc291aa3d3ddad7d9bf2c10ba9. How to deal with that?

How to deal with that?

I believe this PR will be merged before #12072, so I guess I'll rebase after that?
Either way, it seems that this PR conflicts with the changes from #12048, so you need to do a little bit of rebasing as well :wink:

I believe this PR will be merged before #12072, so I guess I'll rebase after that?

Sounds good.

Either way, it seems that this PR conflicts with the changes from #12048, so you need to do a little bit of rebasing as well :wink:

Yeah, right - done.
CI has been happy already.
Happy to approve this now? :smile:

Happy to approve this now?

Obviously

This pull request is ready to merge

Merged -thanks @levitte
you can now rebase #12072.

authors: DDvO levitte openssl-machine


text:
Add Explicit EC parameter support to providers.

This fixes the 15-test_genec.t TODO.

Checklist

[x] documentation is added or updated
[x] tests are added or updated

I believe that #12587 depends on this as well, because some of the keys in test/recipes/30-test_evp_data/evppkey_ecc.txt can currently not be exported to keymgmt...

Nit: typo in commit message(s): compatability -> compatibility

nit: typo in commit messages: compatability

Still some work to do to clean this up + add docs + tests, but most of the implementation is in place now.

I realized that the polynomial parameters I was supplying are all derived from the polynomial.. I have ripped them all out so now just the p is set. I have made them gettable only. (Wish I had of realized this a bit earlier)

Added some cleanups by moving a new API into eclib.c + added more test guards for ECM2 + added EC errors.

I'm glad to see this... that'll resolve quite a few issues, among others the testing problem in #12536

I am glad its nearly done too :)

@romen - you may not have time, but I thought I should let you know its here..

Argh...  the usual Windows oopsie, seen in Appveyor:
libcrypto-shlib-ec_lib.obj : error LNK2019: unresolved external symbol strcasecmp referenced in function EC_GROUP_new_from_params

Added the missing include..
Appveyor queue is a bit of  killer at the moment.

Appveyor queue is a bit of killer at the moment.

Yup...

This pull request is ready to merge

authors: FdaSilvaYY levitte mspncp openssl-machine slontis


text:
Fix s_server PSK handling

Issue #15951 describes a scenario which causes s_server to fail when using
a PSK. In the originally described issue this only impacted master and not
1.1.1. However, in fact this issue does also impact 1.1.1 - but only if you
additionally supply the option "-no_ticket" to the s_server command line.
The difference between the behaviour in master and 1.1.1 is due to 9c13b49,
which changed PSK_MAX_IDENTITY_LEN from 128 to 256. It just so happens that
a default OpenSSL TLSv1.3 ticket length happens to fall between those 2
values. Tickets are presented in TLSv1.3 as a PSK "identity". Passing
"no_ticket" doesn't actually stop TLSv1.3 tickets completely, it just
forces the use of "session ids as a ticket" instead. This significantly
reduces the ticket size to below 128 in 1.1.1.
The problem was due to s_server setting a TLSv1.2 PSK callback and a
TLSv1.3 PSK callback. For backwards compat reasons the TLSv1.2 PSK
callbacks also work in TLSv1.3 but are not preferred. In the described
scenario we use a PSK to create the initial connection. Subsequent to that
we attempt a resumption using a TLSv1.3 ticket (psk). If the psk length is
below PSK_MAX_IDENTITY_LEN then we first call the TLSv1.2 PSK callback.
Subsequently we call the TLSv1.3 PSK callback. Unfortunately s_server's
TLSv1.2 PSK callback accepts the identity regardless, even though it is an
unexpected value, and hence the binder subsequently fails to verify.
The fix is to bail early in the TLSv1.2 callback if we detect we are being
called from a TLSv1.3 connection.
Fixes #15951

Thanks @mattcaswell !

24 hours has passed since 'approval: done' was set, but as this PR has been updated in that time the label 'approval: ready to merge' is not being automatically set.  Please review the updates and set the label manually.

Merged to master.

And to 1.1.1

Hey @mattcaswell
I believe this broke PSK for DTLS. I opened a PR to fix in https://github.com/openssl/openssl/issues/16707

authors: Sean-Der mattcaswell openssl-machine paulidale tmshort


text:
EVP demo for XOF digest using SHAKE256

This demo optionally accepts a single command line argument, allowing the output length to be specified.
Fixes #14106.

Updated.

Updated.

@mattcaswell please reapprove.

24 hours has passed since 'approval: done' was set, but this PR has failing CI tests.  Once the tests pass it will get moved to 'approval: ready to merge' automatically, alternatively please review and set the label manually.

Merged to master and 3.0 branches. Thank you.

authors: hlandau openssl-machine t8m