diff --git a/.gitignore b/.gitignore index de64401..ecb192a 100644 --- a/.gitignore +++ b/.gitignore @@ -4,3 +4,16 @@ xca-0.8.1.tar.gz /xca-0.9.1.tar.gz /xca-0.9.2.tar.gz /xca-0.9.3.tar.gz +/xca-1.0.0.tar.gz +/xca-1.1.0.tar.gz +/xca-1.3.2.tar.gz +/xca-1.4.0.tar.gz +/xca-1.4.1.tar.gz +/xca-2.1.2.tar.gz +/xca-2.2.1.tar.gz +/xca-2.3.0.tar.gz +/xca-2.4.0.tar.gz +/xca-2.5.0.tar.gz +/xca-2.6.0.tar.gz +/xca-2.7.0.tar.gz +/xca-2.9.0.tar.gz diff --git a/sources b/sources index 997fb6f..fae6ef5 100644 --- a/sources +++ b/sources @@ -1,2 +1 @@ -5e08cf8a93f023b1b3836c203bd0a694 xca-0.9.3.tar.gz -113ba37a89fe2de69338fcfe3b773a03 README.update +SHA512 (xca-2.9.0.tar.gz) = e635b83668d0053acb1ad5a8a20a2a1854de90a1e2a8806ecd38e83528d17bc87042d44fcea0f75f2e17df1ed135cc473449547fe273e7e3ea1fe175a4ddf054 diff --git a/xca-0.9.3-french.patch b/xca-0.9.3-french.patch deleted file mode 100644 index bf879ed..0000000 --- a/xca-0.9.3-french.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff -Naur xca-0.9.3.orig/lang/fr.po xca-0.9.3.new/lang/fr.po ---- xca-0.9.3.orig/lang/fr.po 2012-05-12 11:37:14.000000000 +0200 -+++ xca-0.9.3.new/lang/fr.po 2012-05-14 14:33:27.386075980 +0200 -@@ -1883,7 +1883,7 @@ - - #: PwDialog#2 - msgid "" --"The password is parsed as 2-digit hex code. It must have an equal number of " -+"The password is parsed as 2-digit hex code. It must have an even number of " - "digits (0-9 and a-f)" - msgstr "" - "Le mot de passe doit être exprimé sous forme d'une suite de chiffres " diff --git a/xca-2.5.0-README.IMPORTANT b/xca-2.5.0-README.IMPORTANT new file mode 100644 index 0000000..f65ad65 --- /dev/null +++ b/xca-2.5.0-README.IMPORTANT @@ -0,0 +1,28 @@ +When trying to use a private key when working on a database protected by +a password set by xca version < 2.0.0, version 2.5.0 and above might issue an +error like: + +--- +The following error occurred: +(8pki_x509[]:foo) +error:0300009C:digital envelope routines::unsupported algorithm +error:068C0100:asn1 encoding routines::malloc failure +error:068C0100:asn1 encoding routines::malloc failure + +(pki_x509.cpp:574) +--- + +The database is therefore unusable as it is in xca 2.5.0 for any operation +involving some private key. + +The solution is to reset the database password with xca version 2.4.0 +(Extra --> Change Database password). The new password may be the same as +the old one. + +If some private keys have their own password, reset the latter the same +way (right click --> Change password). + +Once these operations have been performed, the database is ready for use with +xca version >= 2.5. + +See https://github.com/chris2511/xca/discussions/468. diff --git a/xca-2.9.0-openssl4.patch b/xca-2.9.0-openssl4.patch new file mode 100644 index 0000000..85d3eca --- /dev/null +++ b/xca-2.9.0-openssl4.patch @@ -0,0 +1,504 @@ +diff -Naurp xca-2.9.0.orig/lib/asn1int.cpp xca-2.9.0.new/lib/asn1int.cpp +--- xca-2.9.0.orig/lib/asn1int.cpp 2025-03-28 19:28:15.000000000 +0100 ++++ xca-2.9.0.new/lib/asn1int.cpp 2026-07-21 14:50:45.138768332 +0200 +@@ -10,6 +10,7 @@ + #include "func_base.h" + #include "exception.h" + #include "limits.h" ++#include "openssl_compat.h" + #include + #include + +@@ -67,7 +68,7 @@ a1int &a1int::set(long l) + QString a1int::toQString(int dec) const + { + QString r; +- if (in->length == 0) { ++ if (xca_asn1_string_length(in.get()) == 0) { + return r; + } + QSharedPointer bn(ASN1_INTEGER_to_BN(get0(), NULL), BN_free); +diff -Naurp xca-2.9.0.orig/lib/asn1time.cpp xca-2.9.0.new/lib/asn1time.cpp +--- xca-2.9.0.orig/lib/asn1time.cpp 2025-03-28 19:28:15.000000000 +0100 ++++ xca-2.9.0.new/lib/asn1time.cpp 2026-07-21 15:48:01.479132516 +0200 +@@ -11,6 +11,7 @@ + #include "func.h" + #include "exception.h" + #include "asn1time.h" ++#include "openssl_compat.h" + #include + #include + #include +@@ -50,7 +51,8 @@ int a1time::from_asn1(const ASN1_TIME *a + gt = ASN1_TIME_to_generalizedtime((ASN1_TIME*)a, NULL); + if (!gt) + return -1; +- t = QString::fromLatin1((char*)gt->data, gt->length); ++ t = QString::fromLatin1((char*)xca_asn1_string_get0_data(gt), ++ xca_asn1_string_length(gt)); + ASN1_GENERALIZEDTIME_free(gt); + return fromPlain(t); + } +@@ -68,11 +70,15 @@ int a1time::fromPlain(const QString &pla + + int a1time::set_asn1(const QString &str, int type) const + { +- if (!atime) +- atime = ASN1_TIME_new(); +- if (!atime) +- return -1; +- atime->type = type; ++ if (atime && xca_asn1_string_type(atime) != type) { ++ ASN1_STRING_free(atime); ++ atime = NULL; ++ } ++ if (!atime) { ++ atime = ASN1_STRING_type_new(type); ++ if (!atime) ++ return -1; ++ } + if (ASN1_STRING_set(atime, str.toLatin1(), str.length())) + return -1; + return 0; +diff -Naurp xca-2.9.0.orig/lib/openssl_compat.h xca-2.9.0.new/lib/openssl_compat.h +--- xca-2.9.0.orig/lib/openssl_compat.h 2025-03-28 19:28:15.000000000 +0100 ++++ xca-2.9.0.new/lib/openssl_compat.h 2026-07-21 16:05:30.252809689 +0200 +@@ -35,4 +35,15 @@ EVP_DigestVerify(EVP_MD_CTX *ctx, const + } + #endif + ++ ++#if OPENSSL_VERSION_NUMBER < 0x40000000L ++#define xca_asn1_string_length(p) ((p)->length) ++#define xca_asn1_string_get0_data(p) ((p)->data) ++#define xca_asn1_string_type(p) ((p)->type) ++#else ++#define xca_asn1_string_length(p) ASN1_STRING_length(p) ++#define xca_asn1_string_get0_data(p) ASN1_STRING_get0_data(p) ++#define xca_asn1_string_type(p) ASN1_STRING_type(p) ++#endif ++ + #endif +diff -Naurp xca-2.9.0.orig/lib/pkcs11.cpp xca-2.9.0.new/lib/pkcs11.cpp +--- xca-2.9.0.orig/lib/pkcs11.cpp 2025-03-28 19:28:15.000000000 +0100 ++++ xca-2.9.0.new/lib/pkcs11.cpp 2026-07-22 17:10:39.158463523 +0200 +@@ -650,29 +650,6 @@ int pkcs11::encrypt(int flen, const unsi + return size; + } + +-#if not defined OPENSSL_NO_EC and defined EVP_PKEY_ED25519 +-// Shared between libressl and openssl +-static int eng_idx = -1; +-static int eng_finish(ENGINE *e) +-{ +- pkcs11 *p11 = (pkcs11 *)ENGINE_get_ex_data(e, eng_idx); +- delete p11; +- ENGINE_set_ex_data(e, eng_idx, NULL); +- return 1; +-} +- +-#if (OPENSSL_VERSION_NUMBER >= 0x30000000L) +-static int eng_pmeth_copy(EVP_PKEY_CTX *dst, const EVP_PKEY_CTX *src) +-#else +-static int eng_pmeth_copy(EVP_PKEY_CTX *dst, EVP_PKEY_CTX *src) +-#endif +-{ +- void *p = EVP_PKEY_CTX_get_app_data((EVP_PKEY_CTX *)src); +- EVP_PKEY_CTX_set_app_data(dst, p); +- return 1; +-} +-#endif +- + static int rsa_privdata_free(RSA *rsa) + { + pkcs11 *priv = (pkcs11*)RSA_get_app_data(rsa); +@@ -830,10 +807,33 @@ static EC_KEY_METHOD *setup_ec_key_meth( + ec_set_private_proc, ec_set_public_proc); + return ec_key_meth; + } +-#ifdef EVP_PKEY_ED25519 ++ ++ ++#if defined(EVP_PKEY_ED25519) && OPENSSL_VERSION_NUMBER < 0x40000000L + + static EVP_PKEY_METHOD *p11_eddsa_method; + ++// Shared between libressl and openssl ++static int eng_idx = -1; ++static int eng_finish(ENGINE *e) ++{ ++ pkcs11 *p11 = (pkcs11 *)ENGINE_get_ex_data(e, eng_idx); ++ delete p11; ++ ENGINE_set_ex_data(e, eng_idx, NULL); ++ return 1; ++} ++ ++#if (OPENSSL_VERSION_NUMBER >= 0x30000000L) ++static int eng_pmeth_copy(EVP_PKEY_CTX *dst, const EVP_PKEY_CTX *src) ++#else ++static int eng_pmeth_copy(EVP_PKEY_CTX *dst, EVP_PKEY_CTX *src) ++#endif ++{ ++ void *p = EVP_PKEY_CTX_get_app_data((EVP_PKEY_CTX *)src); ++ EVP_PKEY_CTX_set_app_data(dst, p); ++ return 1; ++} ++ + static int eddsa_eng_meths(ENGINE *e, EVP_PKEY_METHOD **m, const int **nids, int nid) + { + static const int my_nids[] = {EVP_PKEY_ED25519 }; +@@ -904,7 +904,7 @@ EVP_PKEY *pkcs11::getPrivateKey(EVP_PKEY + #ifndef OPENSSL_NO_EC + static EC_KEY_METHOD *ec_key_meth = NULL; + EC_KEY *ec; +-#ifdef EVP_PKEY_ED25519 ++#if defined(EVP_PKEY_ED25519) && OPENSSL_VERSION_NUMBER < 0x40000000L + static ENGINE *e = NULL; + + if (!e) { +@@ -991,6 +991,7 @@ EVP_PKEY *pkcs11::getPrivateKey(EVP_PKEY + #ifdef EVP_PKEY_ED25519 + case EVP_PKEY_ED25519: + size_t len; ++#if OPENSSL_VERSION_NUMBER < 0x40000000L + if (ENGINE_get_ex_data(e, eng_idx)) + qWarning() << "We forgot to free the previous Card key."; + ENGINE_set_ex_data(e, eng_idx, this); +@@ -1003,6 +1004,17 @@ EVP_PKEY *pkcs11::getPrivateKey(EVP_PKEY + openssl_error(); + OPENSSL_free(pubkey); + //EVP_PKEY_set1_engine(evp, e); ++#else ++ p11obj = obj; ++ EVP_PKEY_get_raw_public_key(pub, NULL, &len); ++ unsigned char *pubkey = (unsigned char *)OPENSSL_malloc(len); ++ Q_CHECK_PTR(pubkey); ++ EVP_PKEY_get_raw_public_key(pub, pubkey, &len); ++ evp = EVP_PKEY_new_raw_public_key_ex(OSSL_LIB_CTX_get0_global_default(), ++ "ED25519", NULL, pubkey, len); ++ openssl_error(); ++ OPENSSL_free(pubkey); ++#endif + break; + #endif + #endif +diff -Naurp xca-2.9.0.orig/lib/pki_pkcs12.cpp xca-2.9.0.new/lib/pki_pkcs12.cpp +--- xca-2.9.0.orig/lib/pki_pkcs12.cpp 2025-03-28 19:28:15.000000000 +0100 ++++ xca-2.9.0.new/lib/pki_pkcs12.cpp 2026-07-21 14:41:11.421805953 +0200 +@@ -85,7 +85,7 @@ pki_pkcs12::pki_pkcs12(const QString &fn + } + pki_ign_openssl_error(); + if (mycert) { +- unsigned char *str = X509_alias_get0(mycert, NULL); ++ const unsigned char *str = X509_alias_get0(mycert, NULL); + if (str) + alias = QString::fromUtf8((const char *)str); + alias = QString::fromUtf8(alias.toLatin1()); +diff -Naurp xca-2.9.0.orig/lib/pki_scard.cpp xca-2.9.0.new/lib/pki_scard.cpp +--- xca-2.9.0.orig/lib/pki_scard.cpp 2025-03-28 19:28:15.000000000 +0100 ++++ xca-2.9.0.new/lib/pki_scard.cpp 2026-07-21 16:07:19.266072856 +0200 +@@ -14,6 +14,7 @@ + #include "pkcs11.h" + #include "x509name.h" + #include "func.h" ++#include "openssl_compat.h" + #include "XcaProgress.h" + + #include "XcaWarningCore.h" +@@ -187,7 +188,8 @@ EVP_PKEY *pki_scard::load_pubkey(pkcs11 + d2i_bytearray(D2I_VOID(d2i_ASN1_OCTET_STRING), ba); + pki_openssl_error(); + +- BIGNUM *bn = BN_bin2bn(os->data, os->length, NULL); ++ BIGNUM *bn = BN_bin2bn(xca_asn1_string_get0_data(os), ++ xca_asn1_string_length(os), NULL); + pki_openssl_error(); + + EC_POINT *point = EC_POINT_bn2point(group, bn, NULL, NULL); +@@ -215,8 +217,8 @@ EVP_PKEY *pki_scard::load_pubkey(pkcs11 + d2i_bytearray(D2I_VOID(d2i_ASN1_OCTET_STRING), ba); + pki_openssl_error(); + pkey = EVP_PKEY_new_raw_public_key(EVP_PKEY_ED25519, NULL, +- (const uint8_t *)os->data, +- os->length); ++ (const uint8_t *)xca_asn1_string_get0_data(os), ++ xca_asn1_string_length(os)); + pki_openssl_error(); + ASN1_OCTET_STRING_free(os); + pki_openssl_error(); +diff -Naurp xca-2.9.0.orig/lib/pki_x509.cpp xca-2.9.0.new/lib/pki_x509.cpp +--- xca-2.9.0.orig/lib/pki_x509.cpp 2025-03-28 19:28:15.000000000 +0100 ++++ xca-2.9.0.new/lib/pki_x509.cpp 2026-07-21 16:09:29.644513174 +0200 +@@ -836,7 +836,7 @@ pki_key *pki_x509::getPubKey() const + bool pki_x509::compareNameAndKey(pki_x509 *other) + { + int r; +- X509_NAME *s1, *s2; ++ const X509_NAME *s1, *s2; + EVP_PKEY *pub1, *pub2; + + if (!cert || !other->cert) +diff -Naurp xca-2.9.0.orig/lib/pki_x509req.cpp xca-2.9.0.new/lib/pki_x509req.cpp +--- xca-2.9.0.orig/lib/pki_x509req.cpp 2025-03-28 19:28:15.000000000 +0100 ++++ xca-2.9.0.new/lib/pki_x509req.cpp 2026-07-21 16:11:59.068866756 +0200 +@@ -15,6 +15,7 @@ + #include "db_base.h" + #include "x509name.h" + #include "exception.h" ++#include "openssl_compat.h" + #include + + pki_x509req::pki_x509req(const QString &name) +@@ -204,7 +205,9 @@ void pki_x509req::addAttribute(int nid, + return; + + ASN1_STRING *a = QStringToAsn1(content, nid); +- X509_REQ_add1_attr_by_NID(request, nid, a->type, a->data, a->length); ++ X509_REQ_add1_attr_by_NID(request, nid, xca_asn1_string_type(a), ++ xca_asn1_string_get0_data(a), ++ xca_asn1_string_length(a)); + ASN1_STRING_free(a); + openssl_error_msg(QString("'%1' (%2)").arg(content).arg(OBJ_nid2ln(nid))); + } +diff -Naurp xca-2.9.0.orig/lib/x509name.cpp xca-2.9.0.new/lib/x509name.cpp +--- xca-2.9.0.orig/lib/x509name.cpp 2025-03-28 19:28:15.000000000 +0100 ++++ xca-2.9.0.new/lib/x509name.cpp 2026-07-21 15:56:14.876877763 +0200 +@@ -9,6 +9,7 @@ + #include "base.h" + #include "func_base.h" + #include "BioByteArray.h" ++#include "openssl_compat.h" + #include + #include + #include "exception.h" +@@ -89,7 +90,7 @@ QString x509name::getMostPopular() const + QString x509name::getEntry(int i) const + { + QString ret; +- ASN1_STRING *d; ++ const ASN1_STRING *d; + + if ( i<0 || i>entryCount() ) + return ret; +@@ -102,7 +103,7 @@ QString x509name::getEntry(int i) const + QString x509name::getEntryTag(int i) const + { + QString s = QObject::tr("Invalid"); +- ASN1_STRING *d; ++ const ASN1_STRING *d; + + if (i<0 || i>=entryCount()) + i = entryCount() - 1; +@@ -111,7 +112,7 @@ QString x509name::getEntryTag(int i) con + if (!d) + return s; + +- s = ASN1_tag2str(d->type); ++ s = ASN1_tag2str(xca_asn1_string_type(d)); + return s; + } + +@@ -154,13 +155,13 @@ QStringList x509name::entryList(int i) c + + int x509name::nid(int i) const + { +- X509_NAME_ENTRY *ne = X509_NAME_get_entry(get0(), i); ++ const X509_NAME_ENTRY *ne = X509_NAME_get_entry(get0(), i); + return ne ? OBJ_obj2nid(X509_NAME_ENTRY_get_object(ne)) : NID_undef; + } + + QString x509name::getOid(int i) const + { +- X509_NAME_ENTRY *ne = X509_NAME_get_entry(_get(), i); ++ const X509_NAME_ENTRY *ne = X509_NAME_get_entry(_get(), i); + return ne ? OBJ_obj2QString(X509_NAME_ENTRY_get_object(ne), 1) : QString(); + } + +@@ -258,7 +259,10 @@ void x509name::addEntryByNid(int nid, co + if (entry.isEmpty()) + return; + ASN1_STRING *a = QStringToAsn1(entry.simplified(), nid); +- X509_NAME_add_entry_by_NID(_get(), nid, a->type, a->data, a->length, -1, 0); ++ X509_NAME_add_entry_by_NID(_get(), nid, ++ xca_asn1_string_type(a), ++ xca_asn1_string_get0_data(a), ++ xca_asn1_string_length(a), -1, 0); + ASN1_STRING_free(a); + openssl_error_msg(QString("'%1' (%2)").arg(entry).arg(OBJ_nid2ln(nid))); + } +diff -Naurp xca-2.9.0.orig/lib/x509v3ext.cpp xca-2.9.0.new/lib/x509v3ext.cpp +--- xca-2.9.0.orig/lib/x509v3ext.cpp 2025-03-28 19:28:15.000000000 +0100 ++++ xca-2.9.0.new/lib/x509v3ext.cpp 2026-07-22 17:43:52.060374543 +0200 +@@ -10,6 +10,7 @@ + #include "asn1int.h" + #include "func.h" + #include "exception.h" ++#include "openssl_compat.h" + #include + #include + #include +@@ -49,8 +50,8 @@ x509v3ext::~x509v3ext() + x509v3ext &x509v3ext::set(const X509_EXTENSION *n) + { + if (n) { +- ASN1_OCTET_STRING *str = X509_EXTENSION_get_data((X509_EXTENSION *)n); +- if (!str || !str->length) ++ const ASN1_OCTET_STRING *str = X509_EXTENSION_get_data((X509_EXTENSION *)n); ++ if (!str || !xca_asn1_string_length(str)) + n = nullptr; + } + if (ext != nullptr) +@@ -116,7 +117,7 @@ x509v3ext &x509v3ext::create_ia5(int nid + + const ASN1_OBJECT *x509v3ext::object() const + { +- ASN1_OBJECT *obj = nullptr; ++ const ASN1_OBJECT *obj = nullptr; + if (ext) { + obj = X509_EXTENSION_get_object(ext); + ign_openssl_error(); +@@ -166,9 +167,9 @@ int x509v3ext::getCritical() const + return ext ? X509_EXTENSION_get_critical(ext) : 0; + } + +-ASN1_OCTET_STRING *x509v3ext::getData() const ++const ASN1_OCTET_STRING *x509v3ext::getData() const + { +- return ext ? X509_EXTENSION_get_data(ext) : nullptr;; ++ return ext ? X509_EXTENSION_get_data(ext) : nullptr; + } + + QString x509v3ext::getValue() const +@@ -318,7 +319,7 @@ static QString ipv6_from_binary(const un + static bool + genName2conf(GENERAL_NAME *gen, QString tag, QString *single, QString *sect) + { +- unsigned char *p; ++ const unsigned char *p; + QString ret; + + switch (gen->type) { +@@ -335,22 +336,23 @@ genName2conf(GENERAL_NAME *gen, QString + return true; + } + case GEN_IPADD: +- p = gen->d.ip->data; +- if (gen->d.ip->length == 4) { ++ p = xca_asn1_string_get0_data(gen->d.ip); ++ if (xca_asn1_string_length(gen->d.ip) == 4) { + *single = QString("IP:%1.%2.%3.%4"). + arg(p[0]).arg(p[1]).arg(p[2]).arg(p[3]); + return true; +- } else if(gen->d.ip->length == 8) { ++ } else if(xca_asn1_string_length(gen->d.ip) == 8) { + *single = QString("IP:%1.%2.%3.%4/%5.%6.%7.%8"). + arg(p[0]).arg(p[1]).arg(p[2]).arg(p[3]). + arg(p[4]).arg(p[5]).arg(p[6]).arg(p[7]); + return true; +- } else if(gen->d.ip->length == 16) { +- *single = "IP:" + ipv6_from_binary(gen->d.ip->data); ++ } else if(xca_asn1_string_length(gen->d.ip) == 16) { ++ *single = "IP:" + ipv6_from_binary(xca_asn1_string_get0_data(gen->d.ip)); + return true; +- } else if(gen->d.ip->length == 32) { +- *single = "IP:" + ipv6_from_binary(gen->d.ip->data) + +- "/" + ipv6_from_binary(gen->d.ip->data +16); ++ } else if(xca_asn1_string_length(gen->d.ip) == 32) { ++ *single = "IP:" + ++ ipv6_from_binary(xca_asn1_string_get0_data(gen->d.ip)) + ++ "/" + ipv6_from_binary(xca_asn1_string_get0_data(gen->d.ip) + 16); + return true; + } + return false; +@@ -372,9 +374,9 @@ genName2conf(GENERAL_NAME *gen, QString + *single = QString("otherName:%1;FORMAT:HEX,%2"). + arg(obj2SnOid(gen->d.otherName->type_id)). + arg(asn1Type2Name(type)); +- for (int i=0; ilength; i++) { ++ for (int i=0; idata[i]), 2, 16, QChar('0')); ++ arg((int)(xca_asn1_string_get0_data(a)[i]), 2, 16, QChar('0')); + } + } + return true; +@@ -423,12 +425,12 @@ bool x509v3ext::parse_ia5(QString *singl + return false; + + if (!str) { +- const unsigned char *p = getData()->data; +- str = d2i_ASN1_OCTET_STRING(NULL, &p, getData()->length); ++ const unsigned char *p = xca_asn1_string_get0_data(getData()); ++ str = d2i_ASN1_OCTET_STRING(NULL, &p, xca_asn1_string_length(getData())); + if (ign_openssl_error() || !str) + return false; + ret = QString("%2"). +- arg(asn1Type2Name(str->type)). ++ arg(asn1Type2Name(xca_asn1_string_type(str))). + arg(QString(asn1ToQString(str))); + } else { + ret = QString(asn1ToQString(str)); +@@ -824,10 +826,10 @@ bool x509v3ext::parse_generic(QString *, + + const ASN1_OBJECT *o = object(); + QString der, obj = o ? obj2SnOid(o) : QString("INVALID"); +- ASN1_OCTET_STRING *v = getData(); ++ const ASN1_OCTET_STRING *v = getData(); + +- for (int i=0; v && i < v->length; i++) +- der += QString(":%1").arg((int)(v->data[i]), 2, 16, QChar('0')); ++ for (int i=0; v && i < xca_asn1_string_length(v); i++) ++ der += QString(":%1").arg((int)(xca_asn1_string_get0_data(v)[i]), 2, 16, QChar('0')); + + if (adv) + *adv = QString("%1=%2DER%3\n").arg(obj). +@@ -1037,7 +1039,7 @@ X509_EXTENSION *x509v3ext::get() const + + bool x509v3ext::isValid() const + { +- return ext && getData() && getData()->length > 0 && ++ return ext && getData() && xca_asn1_string_length(getData()) > 0 && + OBJ_obj2nid(X509_EXTENSION_get_object(ext)) != NID_undef; + } + +diff -Naurp xca-2.9.0.orig/lib/x509v3ext.h xca-2.9.0.new/lib/x509v3ext.h +--- xca-2.9.0.orig/lib/x509v3ext.h 2025-03-28 19:28:15.000000000 +0100 ++++ xca-2.9.0.new/lib/x509v3ext.h 2026-07-22 17:33:42.586049536 +0200 +@@ -35,7 +35,7 @@ class x509v3ext + // bool operator == (const x509v3ext &x) const; + QString getObject() const; + int getCritical() const; +- ASN1_OCTET_STRING *getData() const; ++ const ASN1_OCTET_STRING *getData() const; + QString getValue() const; + QString getHtmlValue() const; + QString getConsoleValue(const QString &indent) const; +diff -Naurp xca-2.9.0.orig/widgets/CertDetail.cpp xca-2.9.0.new/widgets/CertDetail.cpp +--- xca-2.9.0.orig/widgets/CertDetail.cpp 2025-03-28 19:28:15.000000000 +0100 ++++ xca-2.9.0.new/widgets/CertDetail.cpp 2026-07-22 17:48:13.703356907 +0200 +@@ -16,6 +16,7 @@ + #include "lib/func_base.h" + #include "lib/func.h" + #include "lib/XcaWarningCore.h" ++#include "lib/openssl_compat.h" + #include + #include + #include +@@ -269,7 +270,7 @@ void CertDetail::setReq(pki_x509req *req + + int count = X509_ATTRIBUTE_count(att); + for (int j=0; jvalue.asn1_string); + attrLayout->addWidget(label, ii, j +1); + } +@@ -289,7 +290,7 @@ QLabel *CertDetail::labelFromAsn1String( + QLabel *label; + label = new CopyLabel(this); + label->setText(asn1ToQString(s)); +- label->setToolTip(QString(ASN1_tag2str(s->type))); ++ label->setToolTip(QString(ASN1_tag2str(xca_asn1_string_type(s)))); + return label; + } + diff --git a/xca.spec b/xca.spec index ff281e1..d9b5861 100644 --- a/xca.spec +++ b/xca.spec @@ -1,26 +1,41 @@ -%{!?release_func:%global release_func() %1%{?dist}} +%global gitproject0 xca +%global gitowner0 chris2511 Summary: Graphical X.509 certificate management tool Name: xca -Version: 0.9.3 -Release: %release_func 1 +Version: 2.9.0 +Release: 5%{?dist} +# Automatically converted from old format: BSD - review is highly recommended. +License: LicenseRef-Callaway-BSD +URL: https://hohnstaedt.de/xca/ +Source0: https://github.com/%{gitowner0}/%{gitproject0}/releases/download/RELEASE.%{version}/%{name}-%{version}.tar.gz +Source1: xca-2.5.0-README.IMPORTANT -License: BSD -Group: Applications/Productivity -URL: http://www.hohnstaedt.de/xca.html -Source0: http://downloads.sourceforge.net/sourceforge/xca/%{name}-%{version}.tar.gz -Source1: README.update -Patch1: xca-0.9.3-french.patch -BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) -BuildRequires: qt4-devel openssl-devel -BuildRequires: xdg-utils -BuildRequires: ImageMagick -BuildRequires: linuxdoc-tools +Patch1: xca-2.9.0-openssl4.patch + +BuildRequires: cmake +BuildRequires: gcc-c++ +BuildRequires: cmake(Qt6Core) +BuildRequires: cmake(Qt6Widgets) +BuildRequires: cmake(Qt6Sql) +BuildRequires: cmake(Qt6Help) +BuildRequires: cmake(Qt6LinguistTools) +BuildRequires: cmake(Qt6Test) +BuildRequires: openssl-devel +%if 0%{?fedora} >= 41 && 0%{?fedora} <= 44 +BuildRequires: openssl-devel-engine +%endif +BuildRequires: desktop-file-utils +BuildRequires: libappstream-glib BuildRequires: libtool-ltdl-devel -BuildRequires: translate-toolkit -Requires: hicolor-icon-theme -Requires(posttrans): shared-mime-info -Requires(postun): shared-mime-info +BuildRequires: python3-sphinx +BuildRequires: python3-sphinxcontrib-qthelp + +Requires: hicolor-icon-theme + +Suggests: qt6-qtbase-mysql +Suggests: qt6-qtbase-postgresql +Suggests: qt6-qtbase-odbc %description @@ -31,118 +46,310 @@ OpenSSL library for the cryptographic operations. Certificate signing requests (PKCS#10), certificates (X509v3), the signing of requests, the creation of self-signed certificates, certificate revocation lists and SmartCards are supported. For an easy company-wide use, customizable -templates can be used for certificate and request generation. The PKI structures -can be imported and exported in several formats like PKCS#7, PKCS#12, PEM, -DER, PKCS#8. All cryptographic data are stored in a byte order agnostic file -format, portable across operating systems. +templates can be used for certificate and request generation. The PKI +structures can be imported and exported in several formats like PKCS#7, +PKCS#12, PEM, DER, PKCS#8. All cryptographic data are stored in a byte order +agnostic file format, portable across operating systems. +#------------------------------------------------------------------------------- %prep -%setup -q +#------------------------------------------------------------------------------- -%patch1 -p 1 -b .french - -mkdir -p _tmp_root/usr -ln -s "/usr/%{_lib}" _tmp_root/usr/lib -ln -s "/%{_lib}" _tmp_root/lib -ln -s "%{_includedir}/Qt" _tmp_root/include - -install -p -m 644 "%{SOURCE1}" ./ +%autosetup -p 1 +cp '%{SOURCE1}' README.IMPORTANT +#------------------------------------------------------------------------------- %build -#test -n "${QTDIR}" || . "%{_sysconfdir}/profile.d/qt.sh" -export QTDIR="%{_libdir}/qt4" -CC='%{__cxx}' LD='%{__ld}' CFLAGS="${RPM_OPT_FLAGS} \ - -DXCA_DEFAULT_QT_TRANSLATE=\"\\\"%{_datadir}/qt4/translations\\\"\"" \ - STRIP=: prefix="%{_prefix}" \ - LIBS="-Wl,-as-needed `pkg-config --libs QtGui`" \ - ./configure "`pwd`/"_tmp_root{,/usr} -make %{?_smp_mflags} +#------------------------------------------------------------------------------- -convert img/xca.ico xca.png -touch -r img/xca.ico xca.png -convert img/xdb.ico xdb.png -touch -r img/xdb.ico xdb.png - -iconv -f iso8859-1 -t utf8 AUTHORS > AUTHORS.utf8 -touch -r AUTHORS AUTHORS.utf8 -mv AUTHORS.utf8 AUTHORS +export CXXFLAGS='%{optflags} -DDOCDIR=\"%{_docdir}/xca\"' +%cmake -DCMAKE_SHARED_LINKER_FLAGS="-Wl,--as-needed" +%cmake_build +#------------------------------------------------------------------------------- %install -rm -rf "${RPM_BUILD_ROOT}" +#------------------------------------------------------------------------------- -make destdir="${RPM_BUILD_ROOT}" mandir=share/man install -make destdir="${RPM_BUILD_ROOT}" mandir=share/man install.misc +%cmake_install -# HACK: check whether workarounds below are still necessary -if test ! -e "${RPM_BUILD_ROOT}%{_datadir}/xca/crl.png" -then install -d -m 755 \ - "${RPM_BUILD_ROOT}%{_datadir}/"{applications,mime/packages,icons/hicolor} - install -p -m 644 img/*.png "${RPM_BUILD_ROOT}%{_datadir}/xca" -fi +# Do not include db statistics program and man. +find '%{buildroot}' -name 'xca_db_stat*' -delete -install -p -m 644 misc/xca.xml "${RPM_BUILD_ROOT}%{_datadir}/mime/packages/" +# Do not use pixmaps directory. +rm -rf '%{buildroot}%{_datadir}/pixmaps' -export XDG_DATA_DIRS="${RPM_BUILD_ROOT}%{_datadir}" -export XDG_UTILS_INSTALL_MODE=system +# Reinstall documentation. +rm -rf '%{buildroot}%{_docdir}/xca'/* +mv '%{buildroot}%{_datadir}/xca/html' '%{buildroot}%{_docdir}/xca/' -xdg-icon-resource install --noupdate --context mimetypes \ - --size 32 xdb.png application-x-xca-database -xdg-icon-resource install --noupdate --size 32 xca.png fedora-xca +# Install mime file types. +install -d -m 755 '%{buildroot}%{_datadir}/mime/packages' +install -p -m 644 misc/xca.xml '%{buildroot}%{_datadir}/mime/packages/' -desktop-file-install --vendor fedora --mode 0644 \ - --dir "${RPM_BUILD_ROOT}%{_datadir}/applications" \ - --delete-original \ - --add-mime-type application/x-xca-database \ - --remove-category QT \ - "${RPM_BUILD_ROOT}%{_datadir}/applications/xca.desktop" +# Validate desktop files. +desktop-file-validate \ + '%{buildroot}%{_datadir}/applications/de.hohnstaedt.xca.desktop' +appstream-util validate-relax --nonet \ + '%{buildroot}%{_metainfodir}/de.hohnstaedt.xca.metainfo.xml' + +# Template contains neither translations nor language code. +rm -f '%{buildroot}%{_datadir}/xca/i18n/xca.qm' + +# Tag translation files. +%find_lang '%{name}' --with-qt -%clean -rm -rf "${RPM_BUILD_ROOT}" +#------------------------------------------------------------------------------- +%check +#------------------------------------------------------------------------------- + +# Do not test GUI. +%ctest -E '^testxca$' || : -%post -touch --no-create "%{_datadir}/icons/hicolor" || : +#------------------------------------------------------------------------------- +%files -f %{name}.lang +#------------------------------------------------------------------------------- -%preun -touch --no-create "%{_datadir}/icons/hicolor" || : - -%posttrans -gtk-update-icon-cache "%{_datadir}/icons/hicolor" &> /dev/null || : -update-mime-database "%{_datadir}/mime" &> /dev/null || : -update-desktop-database &> /dev/null || : - -%postun -update-desktop-database &> /dev/null || : -update-mime-database "%{_datadir}/mime" &> /dev/null || : -gtk-update-icon-cache "%{_datadir}/icons/hicolor" &> /dev/null || : - - -%files -%defattr(-, root, root, -) -%doc AUTHORS COPYRIGHT README.update -%{_bindir}/* +%doc AUTHORS COPYRIGHT README.IMPORTANT +%doc %{_docdir}/xca/* +%{_bindir}/xca %dir %{_datadir}/xca -%{_datadir}/xca/*.png %{_datadir}/xca/*.txt -%{_datadir}/xca/*.html %{_datadir}/xca/*.xca -%lang(de) %{_datadir}/xca/xca_de.qm -%lang(es) %{_datadir}/xca/xca_es.qm -%lang(fr) %{_datadir}/xca/xca_fr.qm -%lang(ru) %{_datadir}/xca/xca_ru.qm -%lang(tr) %{_datadir}/xca/xca_tr.qm -%{_datadir}/pixmaps/*.xpm %{_datadir}/icons/*/*/*/*.png %{_datadir}/mime/packages/%{name}.* -%{_datadir}/applications/* +%{_datadir}/applications/de.hohnstaedt.xca.desktop +%{_datadir}/bash-completion/ +%{_metainfodir}/de.hohnstaedt.xca.metainfo.xml %attr(0644, root, root) %{_mandir}/*/* +#------------------------------------------------------------------------------- %changelog +#------------------------------------------------------------------------------- + +* Wed Jul 22 2026 Patrick Monnerat 2.9.0-5 +- Patch "openssl4" for openssl version 4 compatibility. +- Remove BR openssl-devel-engine for Fedora > 44. +- Perform tests. + +* Fri Jul 17 2026 Fedora Release Engineering - 2.9.0-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild + +* Sat Jun 13 2026 Yaakov Selkowitz - 2.9.0-3 +- Rebuilt for openssl 4.0 + +* Sat Jan 17 2026 Fedora Release Engineering - 2.9.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild + +* Mon Sep 01 2025 Yaakov Selkowitz - 2.9.0-1 +- Update to 2.9.0 + +* Fri Jul 25 2025 Fedora Release Engineering - 2.7.0-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + +* Sun Jan 19 2025 Fedora Release Engineering - 2.7.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + +* Fri Sep 6 2024 Patrick Monnerat 2.7.0-1 +- New upstream release. + +* Wed Sep 4 2024 Miroslav Suchý - 2.6.0-5 +- convert license to SPDX + +* Tue Jul 23 2024 Patrick Monnerat 2.6.0-4 +- BR openssl-devel-engine for Fedora >= 41. + +* Sat Jul 20 2024 Fedora Release Engineering - 2.6.0-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + +* Mon May 6 2024 Patrick Monnerat 2.6.0-2 +- Fix application icon. + https://bugzilla.redhat.com/show_bug.cgi?id=2279161 + +* Sun Mar 17 2024 Patrick Monnerat 2.6.0-1 +- New upstream release. + +* Mon Jan 22 2024 Patrick Monnerat 2.5.0-3 +- Patch "pastekey" fixes a crash pasting an encrypted private key. + https://github.com/chris2511/xca/commit/d29d55a +- Patch "revokedel" fixes a freeze when deleting a certificate. + https://github.com/chris2511/xca/commit/43e1b33 +- Patch "delete_after_revoke" fixes a crash deleting+revoking a certificate. + https://bugzilla.redhat.com/show_bug.cgi?id=2259477 + +* Tue Nov 07 2023 Miro Hrončok - 2.5.0-2 +- Explicitly BuildRequire python3-sphinxcontrib-qthelp + +* Fri Oct 6 2023 Patrick Monnerat 2.5.0-1 +- New upstream release. +- Build using cmake. +- Doc file "README.IMPORTANT" for needed passord reset. + https://github.com/chris2511/xca/issues/458#issuecomment-1740106691 + +* Sat Jul 22 2023 Fedora Release Engineering - 2.4.0-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + +* Sat Jan 21 2023 Fedora Release Engineering - 2.4.0-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + +* Sat Jul 23 2022 Fedora Release Engineering - 2.4.0-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + +* Sat Jan 22 2022 Fedora Release Engineering - 2.4.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + +* Sat Nov 13 2021 Patrick Monnerat 2.4.0-1 +- New upstream release. +- Patch "openssl3" for openssl version 3 compatibility. +- Patch "noclean" fixes building in symlinked directory. +- Patch "mimeicons" to declare mime types icons as generic. +- Patch "lang-it" to update italian translation. +- Patch "lang-fr" to update french translation. +- Uses sphinx instead of SGML for documentation. +- Use new icons. + +* Tue Sep 14 2021 Sahana Prasad - 2.3.0-5 +- Rebuilt with OpenSSL 3.0.0 + +* Fri Jul 23 2021 Fedora Release Engineering - 2.3.0-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + +* Wed Jan 27 2021 Fedora Release Engineering - 2.3.0-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + +* Tue Dec 1 2020 Patrick Monnerat 2.3.0-2 +- BR translate-toolkit is not needed anymore. + +* Thu Aug 6 2020 Patrick Monnerat 2.3.0-1 +- New upstream relase. + +* Sat Aug 01 2020 Fedora Release Engineering - 2.2.1-3 +- Second attempt - Rebuilt for + https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + +* Wed Jul 29 2020 Fedora Release Engineering - 2.2.1-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + +* Sat Feb 8 2020 Patrick Monnerat 2.2.1-1 +- New upstream relase. + +* Fri Jan 31 2020 Fedora Release Engineering - 2.1.2-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + +* Mon Dec 9 2019 Patrick Monnerat 2.1.2-4 +- Patch "bz1779029-segv" fixes a segmentation fault. + https://github.com/chris2511/xca/commit/262c805 + https://bugzilla.redhat.com/show_bug.cgi?id=1779029 + +* Sat Jul 27 2019 Fedora Release Engineering - 2.1.2-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + +* Sun Feb 03 2019 Fedora Release Engineering - 2.1.2-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + +* Fri Jan 4 2019 Patrick Monnerat 2.1.2-1 +- New upstream release. +- Require qt database backends for external database support. +- Do not install images: they are already linked into the xca binary program. +- Improve language tagging. + +* Sat Jul 14 2018 Fedora Release Engineering - 1.4.1-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild + +* Wed Apr 18 2018 Patrick Monnerat 1.4.1-1 +- New upstream release. +- New URL and source location. + Fixes BZ #1568760. + +* Wed Mar 7 2018 Patrick Monnerat 1.4.0-3 +- "Modernize" spec file. +- BR gcc-g++. + +* Fri Feb 09 2018 Fedora Release Engineering - 1.4.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild + +* Mon Jan 22 2018 Patrick Monnerat 1.4.0-1 +- New upstream release 1.4.0. +- Use qt5. +- Remove obsolete rpm scriptlets. + +* Mon Aug 7 2017 Patrick Monnerat 1.3.2-7 +- Remove xca_db_stat from install (fixes FTBFS on rawhide). + +* Thu Aug 03 2017 Fedora Release Engineering - 1.3.2-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild + +* Thu Jul 27 2017 Fedora Release Engineering - 1.3.2-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild + +* Thu Mar 23 2017 Patrick Monnerat 1.3.2-4 +- Patch "openssl11" for OpenSSL 1.1 support. + +* Sat Feb 11 2017 Fedora Release Engineering - 1.3.2-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild + + +* Fri Feb 05 2016 Fedora Release Engineering - 1.3.2-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild + +* Mon Oct 26 2015 Patrick Monnerat 1.3.2-1 +- New upstream release. +- Patch "oidfieldcursor" to restore normal cursor behavior on OID resolver + input field. +- Drop README.update. + +* Fri Jun 19 2015 Fedora Release Engineering - 1.1.0-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild + +* Sat May 02 2015 Kalev Lember - 1.1.0-2 +- Rebuilt for GCC 5 C++11 ABI change + +* Mon Nov 24 2014 Patrick Monnerat 1.1.0-1 +- New upstream release + +* Mon Nov 17 2014 Patrick Monnerat 1.0.0-2 +- Patch "nonstdext" avoids segfault when viewing cert with + non-standard extension. + https://bugzilla.redhat.com/show_bug.cgi?id=1164340 + +* Tue Oct 28 2014 Patrick Monnerat 1.0.0-1 +- New upstream release. + Set-up a larger desktop icon. + +* Wed Oct 15 2014 Patrick Monnerat 0.9.3-9 +- Patch "openssl101i" for openssl-1.0.1i compatibility. + https://bugzilla.redhat.com/show_bug.cgi?id=1152043 +- Patch "desktopicon" removes the icon file extension in desktop entry file. + https://sourceforge.net/p/xca/patches/15/ + +* Mon Aug 18 2014 Fedora Release Engineering - 0.9.3-8 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild + +* Tue Aug 12 2014 Rex Dieter 0.9.3-7 +- fix/update scriptlets + +* Sun Jun 08 2014 Fedora Release Engineering - 0.9.3-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild + +* Tue Apr 22 2014 Patrick Monnerat - 0.9.3-5 +- Rebuild for elliptic curves inclusion. + https://bugzilla.redhat.com/show_bug.cgi?id=1089245 + +* Sun Aug 04 2013 Fedora Release Engineering - 0.9.3-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild + +* Sun Feb 10 2013 Parag Nemade - 0.9.3-3 +- Remove vendor tag from desktop file as per https://fedorahosted.org/fesco/ticket/1077 +- Cleanup spec as per recently changed packaging guidelines + +* Sun Jul 22 2012 Fedora Release Engineering - 0.9.3-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild + * Mon May 14 2012 Patrick Monnerat 0.9.3-1 - New upstream release. @@ -150,6 +357,9 @@ gtk-update-icon-cache "%{_datadir}/icons/hicolor" &> /dev/null || : - New upstream release. - Patch "french" to update french translation. +* Sat Jan 14 2012 Fedora Release Engineering - 0.9.1-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild + * Tue Nov 8 2011 Patrick Monnerat 0.9.1-1 - New upstream release: all previous patches included in new code. @@ -239,7 +449,7 @@ gtk-update-icon-cache "%{_datadir}/icons/hicolor" &> /dev/null || : * Thu May 19 2005 Enrico Scholz - 0.5.1-2 - use %%dist instead of %%disttag -* Fri Apr 7 2005 Michael Schwendt +* Thu Apr 7 2005 Michael Schwendt - rebuilt * Tue Mar 8 2005 Enrico Scholz - 0.5.1