openssl/util/wrap.pl.in, branch dependabot/github_actions/actions/setup-python-7

Fix unit tests when run under fuzz builds

2026-02-19T08:49:54Z

PR https://github.com/openssl/openssl/pull/30045 Fixed an oss-fuzz failure that occured because we feed random data into the pkcs12 kdf, which sometimes results in a huge iteration count, that leads to timeouts in oss-fuzz. The fix was to simply limit the number of iterations that we go through during derivation. This breaks the kdf of course, but it doesn't really matter during fuzzing, because we don't expect random input data to produce reasonable results, so no harm, no foul. except. We also, in our CI, build our fuzzer tests and run them through our regular CI unit tests, during which we both provide valid data, and expect valid results, and pr 30045 breaks that expectation. The conventional wisdom is to simply skip unit tests that break under these sorts of conditions (we do this for things like 70-test_quic_record.t already). however, the tests that broke here are 25_test_x509, 30_test_evp, 80_test_pkcs12, and 90_test_store_cases. It seems like we would want to keep testing those unless we absolutely have to skip them. So instead, lets indicate that we are running the unit tests with an environment variable, and check that variable when we have an UNSAFE_FOR_PRODUCTION build, skiping the iteration clamp in pkcs12kdf if it is. This allows us to continue running these unit tests, while still getting the oss-fuzz runs to pass. Reviewed-by: Tomas Mraz Reviewed-by: Norbert Pocs MergeDate: Thu Feb 19 08:49:56 2026 (Merged from https://github.com/openssl/openssl/pull/30070)

Clear util dir from engines

2025-12-04T12:32:18Z

Signed-off-by: Norbert Pocs Reviewed-by: Paul Yang Reviewed-by: Eugene Syromiatnikov Reviewed-by: Tomas Mraz Reviewed-by: Saša Nedvědický Reviewed-by: Neil Horman Reviewed-by: Matt Caswell (Merged from https://github.com/openssl/openssl/pull/29305)

Split arguments taking quotes into account

2025-06-04T15:33:48Z

CA.pl supports interpolating multiple arguments into the executed commands. Previously these were evaluated by a shell, which supported quoting of values that contain whitespace, backslashes, ... With a shell no longer used (avoid command injection), backwards compatibility requires some similar functionality. The code now handles double and single-quoted strings (shell-style word splitting), but not parameter expansion ($foo remains unexpanded) or command substitution (`cmd` and $(cmd) remain unexpanded). On Windows system(@LIST) does not correctly preserve argv, do our own quoting instead and use system(<$quoted_cmd>). Reviewed-by: Tom Cosgrove Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/27432)

jitter: add a new provider containing a jitter entropy source alone

2024-07-31T04:44:51Z

This entropy source can be used instead of SEED-SRC. Sample openssl.cnf configuration is provided. It is built as a separate provider, because it is likely to require less frequent updates than fips provider. The same build likely can span multiple generations of FIPS 140 standard revisions. Note that rand-instances currently chain from public/private instances to primary, prior to consuming the seed. Thus currently a unique ESV needs to be obtained, and resue of jitterentropy.a certificate is not possible as is. Separately a patch will be sent to allow for unchaining public/private RAND instances for the purpose of reusing ESV. Also I do wonder if it makes sense to create a fips variant of stock SEED-SRC entropy source, which in addition to using getrandom() also verifies that the kernel is operating in FIPS mode and thus is likely a validated entropy source. As in on Linux, check that /proc/sys/crypto/fips_enabled is set to 1, and similar checks on Windows / MacOS and so on. Reviewed-by: Shane Lontis Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/24844)

Fix util/wrap.pl.in for VMS usage

2023-03-08T11:29:22Z

In the name of consistency, make sure that this same script is used across more platforms, in this case VMS. This removes the need for util/local_shlib.com.in and util/unlocal_shlib.com.in, which were under-used anyway. Reviewed-by: Dmitry Belyavskiy Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/20415)

util/wrap.pl.in: Use parentheses so `kill` gets all its arguments

2022-09-15T06:42:23Z

In perl, this may be ambiguous: fn (expr1), expr2 Is the comma (which may be `=>` just as well in this case) a separator between arguments to `fn`, or is it the comma operator, separating the expressions `fn(expr1)` and `expr2`? It appears that in this particular case, perl takes the existing parentheses to mean the latter. When the former was intended, extra parentheses are required. Fixes #19209 Reviewed-by: Dmitry Belyavskiy Reviewed-by: Paul Dale Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/19211)

util/wrap.pl.in: If the subprocess died with a signal, let's re-signal it

2022-08-23T23:35:39Z

A simple 'kill' of the same signal on our own process should do it. This will allow the shell that this is running under to catch it properly, and output something if it usually does that. Fixes #19041 Reviewed-by: Dmitry Belyavskiy Reviewed-by: Matt Caswell Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/19042)

util: add -fips option to wrap.pl to make using the FIPS provider easier

2021-07-06T08:14:08Z

Without this option, I find I need to figure out which environment variables point where which wastes effort. Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/15966)

Make util/wrap.pl work better on VMS

2021-06-18T07:08:16Z

Perl's system() on VMS needs to have the command line properly fixed up, even with arguments passed in list form. We arrange that by having util/wrap.pl use the same command line fixups as OpenSSL::Test. As a consequence, util/wrap.pl needs to be generated, to easily pick up data from configdata.pm. This also removes yet another file copying hack from the build file templates. Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/15791)