Repository navigation
Conversation
_cjose_jws_build_dig_hmac_sha() handed jwk->keydata to HMAC_Init_ex() as keysize/8 octets of key material for any key type; the key type was only checked afterwards in _cjose_jws_build_sig_hmac_sha(). For an EC or RSA key keydata is a (much smaller) key structure, so cjose_jws_sign() with an HS256/HS384/HS512 header and such a key computed an HMAC over the structure and past the end of its allocation before failing; valgrind flags the over-read. The call did return CJOSE_ERR_INVALID_ARG, so the visible behaviour does not change. Reject a non-oct key up front, as the other digest and signing steps do for their key types. The regression test signs with EC and RSA keys under the three HS algorithms; it fails on master under valgrind. Signed-off-by: Hans Zandbelt <hans.zandbelt@openidc.com> Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
The build sets OPENSSL_API_COMPAT=0x10100000L. Under that level OpenSSL 1.1.x no longer provides the pre-1.1.0 compatibility names EVP_CIPHER_CTX_init, ERR_load_crypto_strings, OpenSSL_add_all_algorithms, EVP_cleanup and ERR_free_strings, which 1.0.x implements as functions and 3.x still defines as macros, so the library and the test harness failed to compile with implicit function declarations. jws.c also relied on a transitive <openssl/bn.h> include that went away when the public headers stopped including OpenSSL headers (cisco#166); 1.0.x and 3.x happen to pull it in through <openssl/rsa.h>. Drop the EVP_CIPHER_CTX_init calls, which are redundant right after EVP_CIPHER_CTX_new on every release, include bn.h where the BIGNUM functions are used, and confine the explicit initialisation and cleanup in the test harness to OpenSSL before 1.1.0, which initialises itself. README.md promises OpenSSL 1.0.1h or newer; the OpenSSL workflow that follows builds against the last release of every series to keep it that way. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Signed-off-by: Hans Zandbelt <hans.zandbelt@openidc.com>
zandbelt
force-pushed
the
ci-openssl-3.0
branch
from
September 11, 2026 10:39
a7de6ff to
09a6a2e
Compare
zandbelt
changed the title
The Build and Archs workflows test against the OpenSSL that the platform packages provide, which is a recent release, so behaviour that only differs in another release goes unnoticed, and README.md promises OpenSSL 1.0.1h or newer. Add an OpenSSL workflow that builds the last release of every series from 1.0.1 to 4.0 from the GitHub release tarball (sha256 pinned, cached across runs), configures cjose with OPENSSL_ROOT_DIR pointing at it, checks with ldd that check_cjose loads that library rather than the system one, and runs the tests. 3.0.7 is in the matrix as well: it is the release RHEL 9 is based on and the last 3.0.x whose EdDSA signing dereferences a missing private key instead of failing; 3.0.8 added the guard. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Signed-off-by: Hans Zandbelt <hans.zandbelt@openidc.com>
actions/cache@v4 targets Node.js 20, which GitHub has deprecated on its runners: every run carries a "Node.js 20 is deprecated ... forced to run on Node.js 24: actions/cache@v4" annotation. v5 moved the action to Node.js 24 with unchanged inputs and v6 is the current major. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Signed-off-by: Hans Zandbelt <hans.zandbelt@openidc.com>
zandbelt
force-pushed
the
ci-openssl-3.0
branch
from
September 11, 2026 10:46
09a6a2e to
c715228
Compare
Member
Author
|
Validation done: opened upstream as cisco#170 (all 13 matrix entries green here). |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Validation run inside the fork for a workflow change (a plain branch push no longer runs CI). Two commits:
OPENSSL_API_COMPAT=0x10100000L(EVP_CIPHER_CTX_init, missing<openssl/bn.h>in jws.c since Remove OpenSSL dependencies from public headers cisco/cjose#166, pre-1.1 init/cleanup calls in the test harness).OpenSSLworkflow that builds the last release of every series from 1.0.1 to 4.0 from source (sha256 pinned, cached) plus 3.0.7, checks withlddthatcheck_cjoseloads that library, and runs the tests.Expected: green on master for all 13 entries.
🤖 Generated with Claude Code