openssl/crypto/store, branch master

Add symmetric key support to OSSL_STORE PKCS#12 loader

2026-09-24T07:25:11Z

Reviewed-by: Mounir Idrassi Reviewed-by: Simo Sorce MergeDate: Thu Sep 24 07:34:25 2026 (Merged from https://github.com/openssl/openssl/pull/30937)

Fix NULL dereference in try_key_value()

2026-09-15T14:19:48Z

In store_result.c:try_key_value() return value of OSSL_DECODER_CTX_new_for_pkey() is not checked so on failed memory allocation OSSL_DECODER_CTX_set_passphrase_cb() dereferences NULL without any check. Found by : store fuzzer (MFAIL-test) Reviewed-by: Jakub Zelenka Reviewed-by: Neil Horman MergeDate: Tue Sep 15 14:20:04 2026 (Merged from https://github.com/openssl/openssl/pull/32413)

Fix bugs in OSSL_STORE_attach

2026-09-15T14:19:48Z

Unify error handling in OSSL_STORE_attach with OSSL_STORE_open_ex. If setting loader params fails loader_ctx is closed but not set to NULL. Which leads to successful return with invalid object. Fixed by setting loader_ctx to NULL triggering error return path. If allocation OSSL_STORE_CTX fails after the loader context creation close the loader context and release the fetched loader. This covers both OSSL_STORE_CTX allocation failure and UI method setup failure. Found by : store fuzzer (MFAIL-test) Assisted-by: ChatGPT:gpt-5.6 Reviewed-by: Jakub Zelenka Reviewed-by: Neil Horman MergeDate: Tue Sep 15 14:20:01 2026 (Merged from https://github.com/openssl/openssl/pull/32413)

OSSL_STORE_open_ex(): fix scheme parsing, using new OSSL_SKIP_SCHEME()

2026-09-10T13:32:49Z

Reviewed-by: Eugene Syromiatnikov Reviewed-by: Nikola Pajkovsky Reviewed-by: Simo Sorce MergeDate: Thu Sep 10 13:32:58 2026 (Merged from https://github.com/openssl/openssl/pull/27507)

ossl_store_register_loader_int(): make sure to check that scheme is non-empty

2026-09-10T13:32:49Z

Reviewed-by: Eugene Syromiatnikov Reviewed-by: Nikola Pajkovsky Reviewed-by: Simo Sorce MergeDate: Thu Sep 10 13:32:56 2026 (Merged from https://github.com/openssl/openssl/pull/27507)

ossl_store_register_loader_int(): refactor by extracting the macro OSSL_SKIP_SCHEME()

2026-09-10T13:32:49Z

Reviewed-by: Eugene Syromiatnikov Reviewed-by: Nikola Pajkovsky Reviewed-by: Simo Sorce MergeDate: Thu Sep 10 13:32:55 2026 (Merged from https://github.com/openssl/openssl/pull/27507)

Copyright year updates

2026-09-09T13:12:46Z

Reviewed-by: Daniel Kubec Reviewed-by: Eugene Syromiatnikov Merge-date: Wed Sep 9 13:12:46 2026 Release: yes

Generate the error headers and tables at build time

2026-09-01T14:01:38Z

Teach util/mkerr.pl two new modes. -emit FILE writes one generated error file to standard output as a pure function of openssl.ec and openssl.txt, with no source scan and no state update; every file in the openssl.ec L table becomes a GENERATE rule driven by it, and the generated error headers join the mandatory generated headers. -state scans the sources and maintains openssl.txt but writes no other files; "make errors" now uses it, so the developer flow only curates the state and the build emits everything else. Reason-code assignment moves out of the header emission into its own pass, the three emitters become subroutines writing to a filehandle, and the up-to-date stamp moves from the statefile's own timestamp to a separate gitignored stamp file, since the statefile is now a build input whose timestamp must track its content. Removing the committed copies also retires 15 that had silently drifted from the generator's output, among them crypto/bio/bio_err.c, which was missing the reason strings for three BIO error codes that exist in the state file. Reviewed-by: Neil Horman Reviewed-by: Andrew Dinh Reviewed-by: Tomas Mraz Merge-date: Tue Sep 1 14:03:03 2026 Merged-from: https://github.com/openssl/openssl/pull/32243

Make sure we always check return of CRYPTO_UP_REF which can fail.

2026-07-20T11:13:57Z

Reviewed-by: Kurt Roeckx Reviewed-by: Paul Dale MergeDate: Mon Jul 20 11:13:58 2026 (Merged from https://github.com/openssl/openssl/pull/31753)

Fix refcounting for ENCODER/DECODER/STORE methods without caching

2026-07-14T05:20:58Z

https://github.com/openssl/openssl/pull/31782 Fixed method refcounting for EVP objects when the provider they are fetched from requests no-caching, but I neglected to add simmilar refcounting fixes for DECODERS/ENCODERS and STORE objects, who follow a different fetch path (these use inner_[decoder|encoder|loader]_fetch rather than inner_evp_generic_fetch. They got missed because the p_ossltest provider that we use to test these paths don't provide these objects, so the path never got exercised. Reviewed-by: Bob Beck Reviewed-by: Paul Dale MergeDate: Tue Jul 14 05:21:36 2026 (Merged from https://github.com/openssl/openssl/pull/31844)