aboutsummaryrefslogtreecommitdiffstats
path: root/crypto/store
Commit message (Collapse)AuthorAgeFilesLines
* Add symmetric key support to OSSL_STORE PKCS#12 loaderDmitry Belyavskiy2026-09-241-4/+29
| | | | | | | Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Simo Sorce <[email protected]> MergeDate: Thu Sep 24 07:34:25 2026 (Merged from https://github.com/openssl/openssl/pull/30937)
* Fix NULL dereference in try_key_value()Greensi72026-09-151-0/+6
| | | | | | | | | | | | | | In store_result.c:try_key_value() return value of OSSL_DECODER_CTX_new_for_pkey() is not checked so on failed memory allocation OSSL_DECODER_CTX_set_passphrase_cb() dereferences NULL without any check. Found by : store fuzzer (MFAIL-test) Reviewed-by: Jakub Zelenka <[email protected]> Reviewed-by: Neil Horman <[email protected]> MergeDate: Tue Sep 15 14:20:04 2026 (Merged from https://github.com/openssl/openssl/pull/32413)
* Fix bugs in OSSL_STORE_attachGreensi72026-09-151-7/+28
| | | | | | | | | | | | | | | | | | | | | Unify error handling in OSSL_STORE_attach with OSSL_STORE_open_ex. If setting loader params fails loader_ctx is closed but not set to NULL. Which leads to successful return with invalid object. Fixed by setting loader_ctx to NULL triggering error return path. If allocation OSSL_STORE_CTX fails after the loader context creation close the loader context and release the fetched loader. This covers both OSSL_STORE_CTX allocation failure and UI method setup failure. Found by : store fuzzer (MFAIL-test) Assisted-by: ChatGPT:gpt-5.6 Reviewed-by: Jakub Zelenka <[email protected]> Reviewed-by: Neil Horman <[email protected]> MergeDate: Tue Sep 15 14:20:01 2026 (Merged from https://github.com/openssl/openssl/pull/32413)
* OSSL_STORE_open_ex(): fix scheme parsing, using new OSSL_SKIP_SCHEME()Dr. David von Oheimb2026-09-101-3/+4
| | | | | | | | Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Simo Sorce <[email protected]> MergeDate: Thu Sep 10 13:32:58 2026 (Merged from https://github.com/openssl/openssl/pull/27507)
* ossl_store_register_loader_int(): make sure to check that scheme is non-emptyDr. David von Oheimb2026-09-101-1/+1
| | | | | | | | Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Simo Sorce <[email protected]> MergeDate: Thu Sep 10 13:32:56 2026 (Merged from https://github.com/openssl/openssl/pull/27507)
* ossl_store_register_loader_int(): refactor by extracting the macro ↵Dr. David von Oheimb2026-09-101-7/+1
| | | | | | | | | | OSSL_SKIP_SCHEME() Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Simo Sorce <[email protected]> MergeDate: Thu Sep 10 13:32:55 2026 (Merged from https://github.com/openssl/openssl/pull/27507)
* Copyright year updatesopenssl-machine2026-09-091-1/+1
| | | | | | | Reviewed-by: Daniel Kubec <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Merge-date: Wed Sep 9 13:12:46 2026 Release: yes
* Generate the error headers and tables at build timeBob Beck2026-09-011-77/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Teach util/mkerr.pl two new modes. -emit FILE writes one generated error file to standard output as a pure function of openssl.ec and openssl.txt, with no source scan and no state update; every file in the openssl.ec L table becomes a GENERATE rule driven by it, and the generated error headers join the mandatory generated headers. -state scans the sources and maintains openssl.txt but writes no other files; "make errors" now uses it, so the developer flow only curates the state and the build emits everything else. Reason-code assignment moves out of the header emission into its own pass, the three emitters become subroutines writing to a filehandle, and the up-to-date stamp moves from the statefile's own timestamp to a separate gitignored stamp file, since the statefile is now a build input whose timestamp must track its content. Removing the committed copies also retires 15 that had silently drifted from the generator's output, among them crypto/bio/bio_err.c, which was missing the reason strings for three BIO error codes that exist in the state file. Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Tue Sep 1 14:03:03 2026 Merged-from: https://github.com/openssl/openssl/pull/32243
* Make sure we always check return of CRYPTO_UP_REF which can fail.Frederik Wedel-Heinen2026-07-201-1/+1
| | | | | | | Reviewed-by: Kurt Roeckx <[email protected]> Reviewed-by: Paul Dale <[email protected]> MergeDate: Mon Jul 20 11:13:58 2026 (Merged from https://github.com/openssl/openssl/pull/31753)
* Fix refcounting for ENCODER/DECODER/STORE methods without cachingNeil Horman2026-07-141-2/+13
| | | | | | | | | | | | | | | | | | https://github.com/openssl/openssl/pull/31782 Fixed method refcounting for EVP objects when the provider they are fetched from requests no-caching, but I neglected to add simmilar refcounting fixes for DECODERS/ENCODERS and STORE objects, who follow a different fetch path (these use inner_[decoder|encoder|loader]_fetch rather than inner_evp_generic_fetch. They got missed because the p_ossltest provider that we use to test these paths don't provide these objects, so the path never got exercised. Reviewed-by: Bob Beck <[email protected]> Reviewed-by: Paul Dale <[email protected]> MergeDate: Tue Jul 14 05:21:36 2026 (Merged from https://github.com/openssl/openssl/pull/31844)
* Extend refcounting on evp objects to provider requesed no-cachingNeil Horman2026-07-022-3/+10
| | | | | | | | | | | | | | | | | | | | | | | | We recently removed reference counting for EVP objects, but kept the refcounting when we build with no-cached-fetch. There is a corner case in which providers in builds that do caching may still request non-caching by setting *no_cache = 1 in their query operations. OQS tripped over this here: https://github.com/open-quantum-safe/oqs-provider/pull/787 When a provider requests no caching, we need to treat those algorithms as though we are running in a no-cached-fetch build and still do ref counting on them. Teach our algorithms implementation to understand when a provider is requesting non-caching, mark them as such and ref count only those. Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> MergeDate: Thu Jul 2 14:24:13 2026 (Merged from https://github.com/openssl/openssl/pull/31782)
* Makle STORE_LOADER not do ref countingNeil Horman2026-06-251-14/+23
| | | | | | | Reviewed-by: Bob Beck <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> MergeDate: Thu Jun 25 21:26:13 2026 (Merged from https://github.com/openssl/openssl/pull/31143)
* Add missing header guards in local crypto includes.Bob Beck2026-05-061-0/+5
| | | | | | | | | | | These are guarded with "OSSL_LIBCRYPTO" to ensure the namespace is distinct from the "OSSL_CRYPTO" guards used in include/crypto Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> MergeDate: Wed May 6 11:35:55 2026 (Merged from https://github.com/openssl/openssl/pull/31001)
* Fix NULL pointer dereference in OSSL_STORE_delete()Weidong Wang2026-04-021-0/+4
| | | | | | | | | | | | | | Add a NULL check for the uri parameter before passing it to OPENSSL_strlcpy(), matching the guard already present in OSSL_STORE_open_ex(). Fixes: 0a8807b4a838 "Store: API for deletion" Reviewed-by: Frederik Wedel-Heinen <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Paul Dale <[email protected]> MergeDate: Thu Apr 2 07:14:08 2026 (Merged from https://github.com/openssl/openssl/pull/30512)
* namemap: handle NULL names in name2num lookupsNikola Pajkovsky2026-03-101-1/+1
| | | | | | | | | | | | | | | | Make ossl_namemap_name2num() return 0 when `name` is NULL, so callers can use a single lookup path without local NULL guards. Fixes: aec9e7fe1693 ("Allow core_namemap to limit hashtable key sizes") Resolves: https://scan5.scan.coverity.com/#/project-view/65138/10222?selectedIssue=1683247 Resolves: https://scan5.scan.coverity.com/#/project-view/65138/10222?selectedIssue=1683248 Resolves: https://scan5.scan.coverity.com/#/project-view/65138/10222?selectedIssue=1683249 Signed-off-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Neil Horman <[email protected]> MergeDate: Tue Mar 10 18:29:00 2026 (Merged from https://github.com/openssl/openssl/pull/30286)
* Copyright year updatesopenssl-machine2026-03-103-3/+3
| | | | | | | Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> MergeDate: Tue Mar 10 14:37:54 2026 Release: yes
* Constify X509_NAMEBob Beck2026-02-252-4/+4
| | | | | | | | | | | | | | There are still a few casts away from const where things do not actually end up mutating the object, we'll deal with that later. Part of #28654 and #29117 Fixes openssl/project#1781 Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> MergeDate: Wed Feb 25 09:58:35 2026 (Merged from https://github.com/openssl/openssl/pull/29468)
* Apply clang-format to the source treeEugene Syromiatnikov2026-02-111-1/+1
| | | | | | | | | | | | | | | Ensure that all the source files are formatted with the current .clang-format configuration, to avoid spurious clang-format checker errors when arbitrary files are touched. Complements: 1b0f21f0555c "Implementing store support for EVP_SKEY" Signed-off-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Richard Levitte <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> MergeDate: Wed Feb 11 07:35:04 2026 (Merged from https://github.com/openssl/openssl/pull/29852)
* Missed a spot!Richard Levitte2025-12-171-7/+8
| | | | | | | | | | For some reason, source reformatting didn't catch everything. Reviewed-by: Paul Yang <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Neil Horman <[email protected]> (Merged from https://github.com/openssl/openssl/pull/29383)
* Implementing store support for EVP_SKEYDmitry Belyavskiy2025-12-105-3/+89
| | | | | | Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Simo Sorce <[email protected]> (Merged from https://github.com/openssl/openssl/pull/28278)
* 4.0-POST-CLANG-FORMAT-WEBKIT4.0-POST-CLANG-FORMAT-WEBKITBob Beck2025-12-097-287/+277
| | | | | | | Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> (Merged from https://github.com/openssl/openssl/pull/29242)
* crypto: Remove internal ENGINE usage from the subdirNorbert Pocs2025-12-041-0/+3
| | | | | | | | | | | | | | | | | Engines can be removed safely from static and internal functions clearing out our codebase. Resolves: https://github.com/openssl/project/issues/1625 Signed-off-by: Norbert Pocs <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Matt Caswell <[email protected]> (Merged from https://github.com/openssl/openssl/pull/29305)
* Remove engine.h includes for internal code.Milan Broz2025-12-041-1/+0
| | | | | | | | | | | | | | | | This should no be used anywhere, as typedef for ENGINE is in types.h. Only apps should include this header for compatibility stubs. Signed-off-by: Milan Broz <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Matt Caswell <[email protected]> (Merged from https://github.com/openssl/openssl/pull/29305)
* Remove *_get0_engine() API callsMilan Broz2025-12-041-5/+0
| | | | | | | | | | | | | | Resolves: https://github.com/openssl/project/issues/1337 Signed-off-by: Milan Broz <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Matt Caswell <[email protected]> (Merged from https://github.com/openssl/openssl/pull/29305)
* Remove private ENGINE references from local structs.Milan Broz2025-12-042-3/+1
| | | | | | | | | | | | | | | Resolves: https://github.com/openssl/project/issues/1368 Signed-off-by: Milan Broz <[email protected]> Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> (Merged from https://github.com/openssl/openssl/pull/29305)
* const up some more low hanging thingsCaolán McNamara2025-12-031-1/+1
| | | | | | | Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/29246)
* CRYPTO_R_ cannot be used with ERR_LIB_OSSL_STORETomas Mraz2025-11-181-1/+1
| | | | | | | | | | | | Use ERR_R_PASSED_NULL_PARAMETER instead. Fixes e9e643bc580e4ba0c6f8f9b4dd2ce59397b1b786 Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Tom Cosgrove <[email protected]> Reviewed-by: Viktor Dukhovni <[email protected]> Reviewed-by: Richard Levitte <[email protected]> (Merged from https://github.com/openssl/openssl/pull/29006)
* store: check for NULL uri argumentPauli2025-10-251-0/+5
| | | | | | | | Fixes #28978 Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> (Merged from https://github.com/openssl/openssl/pull/28980)
* Fix OSSL_STORE to consider cached info in the EOF check.Richard Levitte2025-07-261-11/+14
| | | | | | | | | | | | | | | | | OSSL_STORE_load() called OSSL_STORE_eof() before checking if there is cached OSSL_STORE_INFO to consider. To fix this issue, the cached info check is moved to OSSL_STORE_eof(), as that seems to make most common sense. This solves an issue with PKCS#12 files, where the cached info was never considered because the underlying file IO layer signaled that EOF is reached. Fixes #28010 Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: David von Oheimb <[email protected]> (Merged from https://github.com/openssl/openssl/pull/28016)
* libapps + libcrypto: Silence warnings on Win64 buildsTomas Mraz2025-07-021-6/+6
| | | | | | Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Neil Horman <[email protected]> (Merged from https://github.com/openssl/openssl/pull/27806)
* store_result.c: add to error queue which provider failed to load credential ↵Dr. David von Oheimb2025-05-201-2/+13
| | | | | | | | and hint on using default provider Reviewed-by: Nicola Tuveri <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/27367)
* Add verbose output to 'openssl list -store-loaders'Richard Levitte2025-04-281-0/+8
| | | | | | | | | | | The provider based STORE loaders do have settable parameters, so they should be displayed when '-verbose' is given, just like for any other list. Out of necessity, this also introduces OSSL_STORE_LOADER_settable_ctx_params() Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/26437)
* Copyright year updatesopenssl-machine2025-03-123-3/+3
| | | | | | Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Matt Caswell <[email protected]> Release: yes
* Further decoder tuning possibly better perfViktor Dukhovni2025-03-011-1/+6
| | | | | | | | | | | | | | - The decoder should consider fewer options based on more precise tracking of the desired input type (DER, PVK, MSBLOB), algorithm (RSA, EC, ...), input structure (SPKI, P8, ...). How much this affects actual use-cases is harder to estimate, we'll just have to run before/after perf tests. Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Tim Hudson <[email protected]> (Merged from https://github.com/openssl/openssl/pull/26927)
* Adds missing checks of return from XXX_up_ref().Frederik Wedel-Heinen2025-02-182-7/+15
| | | | | | Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/26294)
* Reject import of private keys that fail PCTViktor Dukhovni2025-02-141-4/+9
| | | | | | | | | - Also added a provider "validate" method that wraps the PCT test. Reviewed-by: Shane Lontis <[email protected]> Reviewed-by: Tim Hudson <[email protected]> Reviewed-by: Matt Caswell <[email protected]> (Merged from https://github.com/openssl/openssl/pull/26656)
* Copyright year updatesTomas Mraz2024-09-052-2/+2
| | | | | Reviewed-by: Neil Horman <[email protected]> Release: yes
* Prefer ARRAY_SIZE(...)Dimitri Papadopoulos2024-07-221-1/+3
| | | | | | | | | | | In OpenSSL, it's actually OSSL_NELEM() in "internal/nelem.h". Found by running the checkpatch.pl Linux script to enforce coding style. Reviewed-by: Neil Horman <[email protected]> Reviewed-by: David von Oheimb <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/22097)
* Adding missing NULL pointer checkafshinpir2024-04-151-2/+3
| | | | | | | | | | | | CLA: trivial In the provider store API, it is not necessary to provide both open and attach method at the same time and providing at least one of them is enough. Adding some null pointer checks to prevent exceptions in case of not providing both methods at the same time. Reviewed-by: Tom Cosgrove <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/23703)
* Add OPENSSL_free to avoid mem leakJiasheng Jiang2024-04-011-1/+3
| | | | | | | | | Signed-off-by: Jiasheng Jiang <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Todd Short <[email protected]> Reviewed-by: Neil Horman <[email protected]> (Merged from https://github.com/openssl/openssl/pull/23955)
* store/store_lib.c: Add the checks for the EVP_MD_CTX_get_size()Jiasheng Jiang2024-04-011-2/+7
| | | | | | | | | | | | Add the checks for the return value of EVP_MD_CTX_get_size() before explicitly cast them to size_t to avoid the integer overflow. Fixes: fac8673b8a ("STORE: Add the possibility to search for specific information") Signed-off-by: Jiasheng Jiang <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Todd Short <[email protected]> Reviewed-by: Neil Horman <[email protected]> (Merged from https://github.com/openssl/openssl/pull/23955)
* Copyright year updatesMatt Caswell2023-09-281-1/+1
| | | | | Reviewed-by: Richard Levitte <[email protected]> Release: yes
* Allow to pass a passprase callback at store openSimo Sorce2023-09-193-12/+31
| | | | | | | | | | | | | | | | | | Some PKCS11 modules require authentication early on to be able to preload objects, which we want to do to avoid costly roundtrips when the HSM is actually reached over a network (Cloud HSM). Unfortunately at open time we can't interact with the user becaue the callbacks are only passed at object load time. later on. This patch corrects this issue by providing a more feature rich open call for providers. Signed-off-by: Simo Sorce <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Richard Levitte <[email protected]> (Merged from https://github.com/openssl/openssl/pull/20131)
* Store: API for deletionDmitry Belyavskiy2023-09-153-1/+53
| | | | | | Reviewed-by: Richard Levitte <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/21901)
* Remove repeated wordsDimitri Papadopoulos2023-09-111-1/+1
| | | | | | | | Found by running the checkpatch.pl Linux script to enforce coding style. Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/21468)
* OSSL_STORE: Fix error flag clearing and setting (provider path only)Richard Levitte2023-09-081-2/+2
| | | | | | | | | | | | | | | | When the provider's load function returned with an error, the libcrypto error flag was only set if EOF hadn't been reached. This is troublesome, as an error can very well occur during the last load before EOF is reached! Also, the error flag was never reset, even though documentation specifies that it should indicate an error in the last load (i.e. not the one before that). Fixes #21968 Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Paul Dale <[email protected]> (Merged from https://github.com/openssl/openssl/pull/21976)
* Copyright year updatesMatt Caswell2023-09-073-3/+3
| | | | | Reviewed-by: Richard Levitte <[email protected]> Release: yes
* store: update to structure based atomicsPauli2023-07-012-6/+4
| | | | | | Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Matt Caswell <[email protected]> (Merged from https://github.com/openssl/openssl/pull/21260)
* OSSL_STORE and PKCS#12: Check if there is a MAC to verify before promptingRichard Levitte2023-06-261-1/+3
| | | | | | | | | | | | | | | | When a DER object with unknown contents comes all the way to ossl_store_handle_load_result(), and it attempts to decode them as different objects, the PKCS#12 decoding attempt would (almost) always prompt for a passphrase, even if there isn't a MAC to verify it against in the PKCS#12 object. This change checks if there is a MAC to verify against before attempting to prompt for a passphrase, leading to less surprising behavior. Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Paul Dale <[email protected]> (Merged from https://github.com/openssl/openssl/pull/21197)
* crypto/*: Fix various typos, repeated words, align some spelling to LDP.FdaSilvaYY2022-10-121-1/+1
| | | | | | | | | | | | partially revamped from #16712 - fall thru -> fall through - time stamp -> timestamp - host name -> hostname - ipv6 -> IPv6 Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Paul Dale <[email protected]> (Merged from https://github.com/openssl/openssl/pull/19059)
generated by cgit (git 2.51.2) at 2026-10-25 12:49:53 +0100