From 0954d1a211323c3cff529ac0506974134bbdca6e Mon Sep 17 00:00:00 2001 From: Stephen Gallagher Date: Wed, 23 Jul 2025 16:46:15 -0400 Subject: [PATCH 1/7] Update to SSCG 3.0.8 - Fix IP address handling in CA certificate SAN constraints * Add automatic single-IP subnet mask to IP addresses in CA name constraints * Update help text to show simplified IP format without subnet mask - Greatly expand the in-tree test suite Signed-off-by: Stephen Gallagher --- .gitignore | 1 + sources | 2 +- sscg.spec | 2 +- 3 files changed, 3 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 36b5c11..95dcb45 100644 --- a/.gitignore +++ b/.gitignore @@ -29,3 +29,4 @@ /sscg-3.0.5.tar.gz /sscg-3.0.6.tar.gz /sscg-3.0.7.tar.gz +/sscg-3.0.8.tar.gz diff --git a/sources b/sources index 4d52610..38fe736 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (sscg-3.0.7.tar.gz) = d9cb1700b835c5d4d358d821a1022f285bed1a199fdd140fe31339248c5e859a438a26bc8cd55f1d3a8eadaed77e1aa655a22d6a4e483d4fb26db007c4248009 +SHA512 (sscg-3.0.8.tar.gz) = cc72ce3c3ee762c0f82d2e7dbbd2136bd343214336e6eb08f802bbcbde995e76a017ce498e6fd11ff081dda9b3e8e462c164905c2684ba550021bf261cf1814b diff --git a/sscg.spec b/sscg.spec index bf8137a..87eb0a0 100644 --- a/sscg.spec +++ b/sscg.spec @@ -9,7 +9,7 @@ %{!?meson_test: %global meson_test %{__meson} test -C %{_vpath_builddir} --num-processes %{_smp_build_ncpus} --print-errorlogs} Name: sscg -Version: 3.0.7 +Version: 3.0.8 Release: %autorelease Summary: Simple SSL certificate generator From 9111b8538658d0008b02104689a1ab55ac25871f Mon Sep 17 00:00:00 2001 From: Stephen Gallagher Date: Mon, 11 Aug 2025 05:11:41 -0400 Subject: [PATCH 2/7] Fix Summary Upstream renamed the project years ago from "Simple SSL Certificate Generator" to "Simple Signed Certificate Generator" and we never updated the packaging to match. Signed-off-by: Stephen Gallagher --- sscg.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sscg.spec b/sscg.spec index 87eb0a0..78f604f 100644 --- a/sscg.spec +++ b/sscg.spec @@ -11,7 +11,7 @@ Name: sscg Version: 3.0.8 Release: %autorelease -Summary: Simple SSL certificate generator +Summary: Simple Signed Certificate Generator License: GPL-3.0-or-later WITH cryptsetup-OpenSSL-exception URL: https://%{provider_prefix} From 900e10c558a5d7fe2cc00d1c9a96a60616ecc321 Mon Sep 17 00:00:00 2001 From: Stephen Gallagher Date: Thu, 23 Oct 2025 10:52:52 -0400 Subject: [PATCH 3/7] Release SSCG 4.0.0 - Support for ML-DSA keys for post-quantum cryptography (PQC) when built against OpenSSL 3.5 or later - Support for EC-DSA keys for elliptic curves - RSA certificate authority is now created with a minimum key strength of 4096 bits - Improved --help output - Deprecated support for generating custom DH parameters - Stopped producing the DH parameter file by default (it may be requested explicitly with the --dhparams-file argument) - Minimum OpenSSL version is now 3.0 Signed-off-by: Stephen Gallagher --- .gitignore | 1 + sources | 2 +- sscg.spec | 2 +- 3 files changed, 3 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 95dcb45..b68ee09 100644 --- a/.gitignore +++ b/.gitignore @@ -30,3 +30,4 @@ /sscg-3.0.6.tar.gz /sscg-3.0.7.tar.gz /sscg-3.0.8.tar.gz +/sscg-4.0.0.tar.gz diff --git a/sources b/sources index 38fe736..6dc9c06 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (sscg-3.0.8.tar.gz) = cc72ce3c3ee762c0f82d2e7dbbd2136bd343214336e6eb08f802bbcbde995e76a017ce498e6fd11ff081dda9b3e8e462c164905c2684ba550021bf261cf1814b +SHA512 (sscg-4.0.0.tar.gz) = 163fd89520714a8e9643c0f83c84b3d602b77351e4094bb214a2545cacaef10a0b195fd7f176ac3c8bca975c3b96568eb802e562f13d5e94438f728cea6e8965 diff --git a/sscg.spec b/sscg.spec index 78f604f..6093d06 100644 --- a/sscg.spec +++ b/sscg.spec @@ -9,7 +9,7 @@ %{!?meson_test: %global meson_test %{__meson} test -C %{_vpath_builddir} --num-processes %{_smp_build_ncpus} --print-errorlogs} Name: sscg -Version: 3.0.8 +Version: 4.0.0 Release: %autorelease Summary: Simple Signed Certificate Generator From 9017cd8b5add793e189d1a3752d9fbdf72fc3100 Mon Sep 17 00:00:00 2001 From: Stephen Gallagher Date: Fri, 21 Nov 2025 15:24:57 -0500 Subject: [PATCH 4/7] Update to SSCG 4.0.1 * Drop dependency on libpath_utils * Minor fixes and code cleanups Signed-off-by: Stephen Gallagher --- .gitignore | 1 + sources | 2 +- sscg.spec | 3 +-- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index b68ee09..c0c0701 100644 --- a/.gitignore +++ b/.gitignore @@ -31,3 +31,4 @@ /sscg-3.0.7.tar.gz /sscg-3.0.8.tar.gz /sscg-4.0.0.tar.gz +/sscg-4.0.1.tar.gz diff --git a/sources b/sources index 6dc9c06..2f64a75 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (sscg-4.0.0.tar.gz) = 163fd89520714a8e9643c0f83c84b3d602b77351e4094bb214a2545cacaef10a0b195fd7f176ac3c8bca975c3b96568eb802e562f13d5e94438f728cea6e8965 +SHA512 (sscg-4.0.1.tar.gz) = 935ce6f22cb5fb8fd5cf325a6df296de5d8527c22e86f948b6b15b5e568c767fe26267aaaaf6d741dad02bfabf821eb6c8a5b729dcab3ed91af4f553478f7fd9 diff --git a/sscg.spec b/sscg.spec index 6093d06..858b703 100644 --- a/sscg.spec +++ b/sscg.spec @@ -9,7 +9,7 @@ %{!?meson_test: %global meson_test %{__meson} test -C %{_vpath_builddir} --num-processes %{_smp_build_ncpus} --print-errorlogs} Name: sscg -Version: 4.0.0 +Version: 4.0.1 Release: %autorelease Summary: Simple Signed Certificate Generator @@ -21,7 +21,6 @@ BuildRequires: libtalloc-devel BuildRequires: openssl BuildRequires: openssl-devel BuildRequires: popt-devel -BuildRequires: libpath_utils-devel BuildRequires: meson BuildRequires: ninja-build BuildRequires: help2man From 91a6bb94a604774a074de35c41ac704f15e077d7 Mon Sep 17 00:00:00 2001 From: Stephen Gallagher Date: Mon, 1 Dec 2025 12:58:55 -0500 Subject: [PATCH 5/7] Update to SSCG 4.0.2 Fixes a regression when attempting to use the same output file for both the CA and service certificates. Signed-off-by: Stephen Gallagher --- .gitignore | 1 + sources | 2 +- sscg.spec | 2 +- 3 files changed, 3 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index c0c0701..a236d72 100644 --- a/.gitignore +++ b/.gitignore @@ -32,3 +32,4 @@ /sscg-3.0.8.tar.gz /sscg-4.0.0.tar.gz /sscg-4.0.1.tar.gz +/sscg-4.0.2.tar.gz diff --git a/sources b/sources index 2f64a75..752df69 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (sscg-4.0.1.tar.gz) = 935ce6f22cb5fb8fd5cf325a6df296de5d8527c22e86f948b6b15b5e568c767fe26267aaaaf6d741dad02bfabf821eb6c8a5b729dcab3ed91af4f553478f7fd9 +SHA512 (sscg-4.0.2.tar.gz) = cefce5456d609cfe0a38ec734dd918bca65af53361ef44ad77ffdcbd10cd0848cf512707201b62fc15e1428231edd678cc9843ed59ecc79ba760307ad2b6a2b4 diff --git a/sscg.spec b/sscg.spec index 858b703..7224498 100644 --- a/sscg.spec +++ b/sscg.spec @@ -9,7 +9,7 @@ %{!?meson_test: %global meson_test %{__meson} test -C %{_vpath_builddir} --num-processes %{_smp_build_ncpus} --print-errorlogs} Name: sscg -Version: 4.0.1 +Version: 4.0.2 Release: %autorelease Summary: Simple Signed Certificate Generator From 9a650699eb952217bce7e3049c17d5e7d8eaa206 Mon Sep 17 00:00:00 2001 From: Stephen Gallagher Date: Mon, 1 Dec 2025 22:46:08 -0500 Subject: [PATCH 6/7] Update to 4.0.3 - Don't truncate destination files until just prior to writing. - Add test for file replacement - Use int type for POPT_ARG_NONE values to fix a bug on s390x Signed-off-by: Stephen Gallagher --- .gitignore | 1 + sources | 2 +- sscg.spec | 2 +- 3 files changed, 3 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index a236d72..9d784f4 100644 --- a/.gitignore +++ b/.gitignore @@ -33,3 +33,4 @@ /sscg-4.0.0.tar.gz /sscg-4.0.1.tar.gz /sscg-4.0.2.tar.gz +/sscg-4.0.3.tar.gz diff --git a/sources b/sources index 752df69..ebbdfd3 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (sscg-4.0.2.tar.gz) = cefce5456d609cfe0a38ec734dd918bca65af53361ef44ad77ffdcbd10cd0848cf512707201b62fc15e1428231edd678cc9843ed59ecc79ba760307ad2b6a2b4 +SHA512 (sscg-4.0.3.tar.gz) = f629cf7e32d4d4e7c1f58c4a53be925b96980e6fb3106e3a36a72f85c723bd79fba6aecdbf092b50f915a8833297bc7c6c1ccbe04fef488db38bbdc1e3a95b96 diff --git a/sscg.spec b/sscg.spec index 7224498..56ea1ed 100644 --- a/sscg.spec +++ b/sscg.spec @@ -9,7 +9,7 @@ %{!?meson_test: %global meson_test %{__meson} test -C %{_vpath_builddir} --num-processes %{_smp_build_ncpus} --print-errorlogs} Name: sscg -Version: 4.0.2 +Version: 4.0.3 Release: %autorelease Summary: Simple Signed Certificate Generator From a03c0c7017911abcde50a8b9ff17ac80788b1600 Mon Sep 17 00:00:00 2001 From: Stephen Gallagher Date: Tue, 2 Dec 2025 14:25:20 -0500 Subject: [PATCH 7/7] Fix segmentation fault when passed bad arguments Signed-off-by: Stephen Gallagher --- ...fault-on-receiving-bad-CLI-arguments.patch | 38 +++++++++++++++++++ sscg.spec | 4 ++ 2 files changed, 42 insertions(+) create mode 100644 0001-Avoid-segfault-on-receiving-bad-CLI-arguments.patch diff --git a/0001-Avoid-segfault-on-receiving-bad-CLI-arguments.patch b/0001-Avoid-segfault-on-receiving-bad-CLI-arguments.patch new file mode 100644 index 0000000..c80dc87 --- /dev/null +++ b/0001-Avoid-segfault-on-receiving-bad-CLI-arguments.patch @@ -0,0 +1,38 @@ +From 0c37e7ace585cfb550a0ffd9d5c331d059fd687f Mon Sep 17 00:00:00 2001 +From: Stephen Gallagher +Date: Tue, 2 Dec 2025 12:12:26 -0500 +Subject: [PATCH] Avoid segfault on receiving bad CLI arguments + +Signed-off-by: Stephen Gallagher +--- + src/sscg.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/src/sscg.c b/src/sscg.c +index b9b191f109300f6447262858f57a3a8321a14966..00e2862c2d6be5c44a4a362fc926e1a07d31d7bf 100644 +--- a/src/sscg.c ++++ b/src/sscg.c +@@ -59,7 +59,7 @@ int + main (int argc, const char **argv) + { + int ret, sret; +- struct sscg_options *options; ++ struct sscg_options *options = NULL; + bool build_client_cert = false; + char *dhparams_file = NULL; + +@@ -342,7 +342,10 @@ main (int argc, const char **argv) + done: + if (ret != EOK) + { +- sscg_io_utils_delete_output_files (options->streams); ++ if (options) ++ { ++ sscg_io_utils_delete_output_files (options->streams); ++ } + } + talloc_zfree (main_ctx); + if (getenv ("SSCG_TALLOC_REPORT")) +-- +2.52.0 + diff --git a/sscg.spec b/sscg.spec index 56ea1ed..4a60e76 100644 --- a/sscg.spec +++ b/sscg.spec @@ -25,6 +25,10 @@ BuildRequires: meson BuildRequires: ninja-build BuildRequires: help2man +# Upstream patch to avoid segfaults when receiving bad CLI arguments +# https://github.com/sgallagher/sscg/commit/0c37e7ace585cfb550a0ffd9d5c331d059fd687f +Patch: 0001-Avoid-segfault-on-receiving-bad-CLI-arguments.patch + %description A utility to aid in the creation of more secure "self-signed"